@codyswann/lisa 4.32.0 → 4.32.2

package/package.json

@@ -165,7 +165,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.32.0",
+  "version": "4.32.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -313,7 +313,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "71eecf04effc8e491c8a3625272eb3ec237b048d",
-  "gitHead": "71eecf04effc8e491c8a3625272eb3ec237b048d",
-  "lisaReleaseTag": "v4.32.0"
+  "lisaReleaseCommit": "44180393649b76125ea1a90169e23cd98fa79ca1",
+  "gitHead": "44180393649b76125ea1a90169e23cd98fa79ca1",
+  "lisaReleaseTag": "v4.32.2"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.32.0",
+  "version": "4.32.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.32.0",
+  "version": "4.32.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/inject-resolved-config.mjs

@@ -116,27 +116,39 @@ const SENSITIVE_WORDS = new Set([
   "actor",
   "actors",
   "apikey",
+  "arn",
   "auth",
+  "authorization",
   "bearer",
+  "cert",
+  "certificate",
+  "connection",
   "cookie",
   "credential",
   "credentials",
   "dsn",
   "email",
   "identity",
+  "jwt",
   "key",
   "keys",
   "login",
   "mail",
+  "mfa",
   "oauth",
+  "otp",
   "passphrase",
   "passwd",
   "password",
   "pat",
+  "pem",
+  "pin",
+  "private",
   "secret",
   "session",
   "signature",
   "token",
+  "totp",
   "user",
   "username",
   "webhook",
@@ -156,6 +168,36 @@ const SENSITIVE_WORDS = new Set([
  */
 const EMAIL_SHAPED = /[^\s@,=]+@[^\s@,=]+\.[^\s@,=]+/g;
 
+/**
+ * Value shapes that are a credential whatever key they arrived under.
+ *
+ * {@link SENSITIVE_WORDS} can only ever cover key names somebody thought of.
+ * {@link SUBTREE_ORDER} is a SUBTREE allowlist, so a key added under an
+ * already-listed parent reaches every session with nobody reviewing it — which
+ * is the case these patterns exist for, and the reason the preamble's sentence
+ * was made to describe this mechanism rather than promise more than it has.
+ *
+ * Each pattern is anchored on a structural marker (a scheme with a
+ * `user:password@` userinfo, a vendor key prefix, three base64url segments),
+ * never on entropy. An entropy heuristic would redact ids a config legitimately
+ * carries — routine ids, revisions, digests — and this block exists to make
+ * configuration visible, so a false redaction is a real cost, not a free one.
+ */
+const CREDENTIAL_SHAPED = [
+  // A private key pasted into a config value.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  // Credentials in a connection string's userinfo. The whole URL goes: the
+  // host is not worth keeping at the price of splicing a line back together
+  // around the part that was cut out.
+  /\b[a-z][a-z0-9+.-]*:\/\/[^\s:@,=]+:[^\s@,=]+@[^\s,=]*/g,
+  // Vendor-prefixed API keys.
+  /\b(?:[a-z]{2}_(?:live|test)_[A-Za-z0-9]{8,}|gh[pousr]_[A-Za-z0-9]{16,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|sk-[A-Za-z0-9_-]{16,})\b/g,
+  // A signed token: three base64url segments, header first.
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+  // An ARN carries an account number in its fifth field.
+  /\barn:[a-z0-9-]*:[^\s,=]*/g,
+];
+
 /** What replaces a redacted value, so the KEY's existence is still visible. */
 const REDACTED = "[redacted]";
 
@@ -168,9 +210,15 @@ const REDACTED = "[redacted]";
  * arbitrary host project — and `tests/unit/hooks/inject-resolved-config.test.ts`
  * imports the real constants and asserts this table still agrees with them, so
  * the copy cannot drift silently.
+ *
+ * EXPORTED so that test can compare PATH-TO-VALUE PAIRS. Asserting instead that
+ * each constant appears somewhere in this file pins only the set of values
+ * present: swapping the `harness` and `gates.unproven` entries preserves that
+ * set, leaves every test in both suites green, and tells every session with no
+ * declared harness that its harness is `warn`.
  * @type {ReadonlyArray<{path: string, value: string, owner: string}>}
  */
-const BUILT_IN_DEFAULTS = [
+export const BUILT_IN_DEFAULTS = [
   { path: "harness", value: "claude", owner: "src/core/config.ts" },
   {
     path: "gates.runner",
@@ -256,12 +304,15 @@ function isSensitivePath(path) {
 }
 
 /**
- * Redact anything email-shaped in already-rendered text.
+ * Redact anything identity- or credential-shaped in already-rendered text.
  * @param {string} text Rendered line or block.
- * @returns {string} The text with identity-shaped values replaced.
+ * @returns {string} The text with those values replaced.
  */
 function scrub(text) {
-  return text.replace(EMAIL_SHAPED, REDACTED);
+  return CREDENTIAL_SHAPED.reduce(
+    (carried, pattern) => carried.replace(pattern, REDACTED),
+    text.replace(EMAIL_SHAPED, REDACTED)
+  );
 }
 
 /**
@@ -273,6 +324,35 @@ function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+/**
+ * Keys that reach an object's prototype rather than its own properties.
+ *
+ * `JSON.parse` makes `__proto__` an OWN property, so a later `merged[key] =`
+ * hands it to the prototype setter — and `key in config` and `node[key]` both
+ * read the prototype chain. A local override file carrying nothing but a
+ * `__proto__` object could therefore make this block announce a gate that no
+ * file declares, while the gate runner (which destructures own properties)
+ * enforced something else. The injected view is the one an agent is told to
+ * act on, so it is the one that must not be forgeable.
+ */
+const PROTOTYPE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+
+/**
+ * Strip prototype-reaching keys from parsed JSON, at every depth.
+ * @param {unknown} value A parsed JSON value.
+ * @returns {unknown} The same value with {@link PROTOTYPE_KEYS} removed.
+ */
+function withoutPrototypeKeys(value) {
+  if (Array.isArray(value)) return value.map(withoutPrototypeKeys);
+  if (!isObject(value)) return value;
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    if (PROTOTYPE_KEYS.has(key)) continue;
+    out[key] = withoutPrototypeKeys(child);
+  }
+  return out;
+}
+
 /**
  * Deep-merge the local override onto the committed config.
  *
@@ -290,11 +370,41 @@ function deepMerge(base, override) {
   if (!isObject(base) || !isObject(override)) return override;
   const merged = { ...base };
   for (const [key, value] of Object.entries(override)) {
+    // Belt and braces: `readJson` has already stripped these, and this loop is
+    // the assignment that would otherwise reach the prototype setter.
+    if (PROTOTYPE_KEYS.has(key)) continue;
     merged[key] = deepMerge(base[key], value);
   }
   return merged;
 }
 
+/**
+ * Why a file could not be read, said without quoting the file or the disk.
+ *
+ * A `JSON.parse` failure message is not safe to repeat. V8 embeds roughly the
+ * first ten characters of the offending input in one of its forms — the entire
+ * file when the file is short — and this path runs against the gitignored local
+ * override, the one file identity is supposed to live in. There are no keys at
+ * that point, so the key-name filter cannot help. An `fs` failure message is
+ * not safe either: it carries the absolute path.
+ *
+ * Only the position is kept, because a line and column number describe the
+ * file's SHAPE and can be acted on, while quoting its contents adds nothing a
+ * reader with the file in front of them does not already have.
+ * @param {unknown} err What was thrown.
+ * @returns {string} A reason carrying no content and no path.
+ */
+function safeReason(err) {
+  const code = isObject(err) ? err.code : undefined;
+  if (typeof code === "string") return `${code} while reading the file`;
+  const message =
+    isObject(err) && typeof err.message === "string" ? err.message : "";
+  const position = /at position \d+(?: \(line \d+ column \d+\))?/.exec(message);
+  return position === null
+    ? "not valid JSON"
+    : `not valid JSON ${position[0].replace("at position", "at byte")}`;
+}
+
 /**
  * Read one JSON file.
  * @param {string} path Absolute path.
@@ -309,9 +419,9 @@ function readJson(path) {
     if (!isObject(parsed)) {
       return { state: "bad", reason: "root is not a JSON object" };
     }
-    return { state: "ok", value: parsed };
+    return { state: "ok", value: withoutPrototypeKeys(parsed) };
   } catch (err) {
-    return { state: "bad", reason: err.message };
+    return { state: "bad", reason: safeReason(err) };
   }
 }
 
@@ -405,6 +515,41 @@ function levelOf(declaration) {
   return declared !== null && LEVELS.has(declared) ? declared : null;
 }
 
+/**
+ * Render one moment-and-level bucket across as many lines as its ids need.
+ *
+ * The generic {@link MAX_LINE} cut was being applied to the one line this
+ * module promises never elides: at 30 gates in a single bucket, six ids
+ * vanished behind `… (line truncated)` while the header above still counted
+ * them and the words beside it said not to bypass one. Wrapping is what keeps
+ * that promise — a count of what was dropped would still be an agent told the
+ * name of 24 gates out of 30 it must not skip.
+ * @param {string} bucket The `moment level` label.
+ * @param {string[]} ids Gate ids declared at that bucket.
+ * @returns {string[]} Lines, each within {@link MAX_LINE}.
+ */
+function bucketLines(bucket, ids) {
+  const lines = [];
+  let prefix = `  ${bucket}: `;
+  let current = [];
+  const flush = () => {
+    if (current.length === 0) return;
+    lines.push(`${prefix}${current.join(", ")}`);
+    prefix = `  ${bucket} (cont.): `;
+    current = [];
+  };
+  for (const id of ids) {
+    const width =
+      prefix.length +
+      current.reduce((carried, held) => carried + held.length + 2, 0) +
+      id.length;
+    if (current.length > 0 && width > MAX_LINE) flush();
+    current.push(id);
+  }
+  flush();
+  return lines;
+}
+
 /**
  * Render the gates block grouped by moment and level.
  *
@@ -441,7 +586,7 @@ function renderGates(gates) {
     `gates (${count} declared) — a gate below is enforced at that moment; do not skip, weaken or bypass one:`,
     ...[...grouped.entries()]
       .sort(([a], [b]) => a.localeCompare(b))
-      .map(([bucket, ids]) => `  ${bucket}: ${ids.join(", ")}`),
+      .flatMap(([bucket, ids]) => bucketLines(bucket, ids)),
   ];
 }
 
@@ -473,8 +618,25 @@ function renderDefaults(config) {
  * @returns {string} The rendered body.
  */
 function renderBody(config) {
+  // The gap lines go FIRST, and that ordering is the whole point rather than a
+  // presentation choice. `withinBudget` truncates from the end, so appending
+  // them last meant the budget ate them first: a config with a large `policy`
+  // block and no `tracker` rendered ZERO `NOT DECLARED` lines and zero
+  // built-in-default lines — "a gap has no symptom at all", the failure this
+  // hook was built against, reproduced inside the hook. A value that does not
+  // fit can be looked up in the file. An absence cannot be looked up anywhere,
+  // so it is the line that must survive.
   /** @type {string[]} */
-  const lines = [];
+  const lines = renderDefaults(config);
+  const gapLines = lines.length;
+  // The gates block is the one this module promises never elides, so the lines
+  // it produced are named here rather than inferred from their shape later.
+  // `bucketLines` keeps every line inside MAX_LINE by wrapping, but it cannot
+  // wrap a SINGLE id longer than the line — nothing splits an identifier — so
+  // without this the generic cut would come back for exactly the id that most
+  // needs reading in full.
+  /** @type {Set<string>} */
+  const unelidable = new Set();
   const seen = new Set();
   for (const key of SUBTREE_ORDER) {
     if (!(key in config)) continue;
@@ -488,7 +650,9 @@ function renderBody(config) {
       if (unproven !== undefined) {
         lines.push(`gates.unproven: ${renderLeaf(unproven)}`);
       }
-      lines.push(...renderGates(gates));
+      const gateLines = renderGates(gates);
+      for (const gateLine of gateLines) unelidable.add(gateLine);
+      lines.push(...gateLines);
       continue;
     }
     renderSubtree(config[key], key, lines);
@@ -501,16 +665,47 @@ function renderBody(config) {
       `other declared keys (not summarised here): ${unlisted.join(", ")}`
     );
   }
-  lines.push(...renderDefaults(config));
-  return withinBudget(lines);
+  return withinBudget(lines, { unelidable, gapLines });
+}
+
+/**
+ * The overflow notice, for a body that kept `keptCount` of `total` lines.
+ *
+ * Built from the counts rather than held as a constant because the notice is
+ * itself part of the body it describes: making room for it changes how many
+ * lines were dropped, which changes the sentence, which changes how much room
+ * it needs. See {@link withinBudget}.
+ * @param {number} total How many lines were rendered in all.
+ * @param {number} keptCount How many of them survived the budget.
+ * @param {number} gapLines How many leading lines describe gaps and defaults.
+ * @returns {string} The notice line.
+ */
+function overflowNotice(total, keptCount, gapLines) {
+  // Two things this notice used to get wrong. It counted LINES while reading as
+  // if it counted keys — one line carries many leaves — and it sent the reader
+  // to the config file for lines that no file can answer. The second is fixed
+  // by ordering (`renderBody` renders the declared-vs-default lines first, so
+  // they are never the omitted ones); saying so is what makes the advice true.
+  // The claim stays CONDITIONAL, because a config whose gap lines alone
+  // exhaust the budget would otherwise have this sentence assert a
+  // completeness the body does not have — the exact defect this hook exists to
+  // remove, committed by the sentence announcing it.
+  const completeness =
+    keptCount >= gapLines
+      ? `The declared-vs-default lines above are complete — read ${MAIN_CONFIG} and ${LOCAL_CONFIG} for the omitted values.`
+      : `The declared-vs-default lines above are NOT complete, so a gap may be missing entirely — read ${MAIN_CONFIG} and ${LOCAL_CONFIG}.`;
+  return `… ${total - keptCount} further rendered line(s) omitted to stay within the session-context budget; a line can carry several keys, so more keys than that are unrendered. ${completeness}`;
 }
 
 /**
  * Join lines, stopping at the budget and counting what did not fit.
  * @param {string[]} lines Rendered lines.
+ * @param {object} [options] Rendering constraints.
+ * @param {Set<string>} [options.unelidable] Lines the MAX_LINE cut may not touch.
+ * @param {number} [options.gapLines] How many leading lines describe gaps.
  * @returns {string} The joined body.
  */
-function withinBudget(lines) {
+function withinBudget(lines, { unelidable = new Set(), gapLines = 0 } = {}) {
   const kept = [];
   let size = 0;
   for (const raw of lines) {
@@ -519,13 +714,23 @@ function withinBudget(lines) {
     // joined body afterwards would be redacting text that had already escaped.
     const scrubbed = scrub(raw);
     const line =
-      scrubbed.length > MAX_LINE
+      scrubbed.length > MAX_LINE && !unelidable.has(raw)
         ? `${scrubbed.slice(0, MAX_LINE)}… (line truncated)`
         : scrubbed;
     if (size + line.length > CONTEXT_BUDGET) {
-      kept.push(
-        `… ${lines.length - kept.length} further line(s) omitted to stay within the session-context budget. Read ${MAIN_CONFIG} for the rest.`
-      );
+      // The notice has to fit INSIDE the budget, not be appended past it. It
+      // used to be pushed after the check, so a body that filled the budget
+      // exactly overshot it by the length of the sentence explaining that it
+      // had not. Lines come off the end until it fits, and the notice is
+      // rebuilt each time because dropping one is one more line to admit to.
+      while (
+        kept.length > 0 &&
+        size + overflowNotice(lines.length, kept.length, gapLines).length >
+          CONTEXT_BUDGET
+      ) {
+        size -= kept.pop().length + 1;
+      }
+      kept.push(overflowNotice(lines.length, kept.length, gapLines));
       break;
     }
     kept.push(line);
@@ -590,7 +795,9 @@ export function buildContext(projectDir) {
     `These are this project's EFFECTIVE Lisa configuration values, already resolved from ${sources}.\n` +
       `Act on them directly. Do not re-read the config files to learn them, and do not act ` +
       `against them. A line marked [Lisa built-in default] is NOT something this project ` +
-      `declared. Identity- and credential-shaped values are omitted by design.\n\n` +
+      `declared. A key whose NAME is identity- or credential-shaped is withheld and counted, ` +
+      `and a VALUE matching a known credential shape is replaced with ${REDACTED}: a ` +
+      `best-effort filter, not proof that anything it left alone is safe to repeat.\n\n` +
       renderBody(resolved)
   );
 }

package/plugins/lisa/hooks/inject-resolved-config.sh

@@ -44,5 +44,33 @@ if [ -z "${PROJECT_DIR}" ] || [ ! -d "${PROJECT_DIR}" ]; then
   PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 fi
 
+# ...but the harness sets CLAUDE_PROJECT_DIR to wherever the session STARTED,
+# which in a monorepo is routinely a subdirectory. Validating only that the
+# directory exists left the git fallback above unreachable in exactly that case,
+# so a fully configured repository reported "No Lisa configuration found" — the
+# loudest possible wrong answer, in the one state this hook exists to make loud.
+#
+# So walk up for the config instead of assuming the declared directory holds it.
+# The repository root bounds the walk: a config file ABOVE it belongs to some
+# other project, and adopting it would be the same wrong answer wearing a
+# different hat. `.git` is a file in a worktree and a directory otherwise, hence
+# `-e`. The depth cap is a symlink-loop guard, not a policy.
+config_root() {
+  dir="$1"
+  depth=0
+  while [ -n "${dir}" ] && [ "${dir}" != "/" ] && [ "${depth}" -lt 32 ]; do
+    if [ -f "${dir}/.lisa.config.json" ] || [ -f "${dir}/.lisa.config.local.json" ]; then
+      printf '%s' "${dir}"
+      return 0
+    fi
+    [ -e "${dir}/.git" ] && return 1
+    dir="$(dirname "${dir}")"
+    depth=$((depth + 1))
+  done
+  return 1
+}
+
+CONFIG_DIR="$(config_root "${PROJECT_DIR}")" && PROJECT_DIR="${CONFIG_DIR}"
+
 printf '%s' "$INPUT" | node "$RENDERER" --project-dir "$PROJECT_DIR" || true
 exit 0