@codyswann/lisa 4.55.25 → 4.55.27

package/plugins/src/base/skills/lisa-github-build-intake/SKILL.md

@@ -174,15 +174,25 @@ A "transition" means: remove the old role label and add the new one, in two `gh
 ### Phase 2 — Find ready issues
 
 ```bash
-if [ -n "$ASSIGNEE" ]; then
-  gh issue list --repo <org>/<repo> --label "$READY" --assignee "$ASSIGNEE" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
-else
-  gh issue list --repo <org>/<repo> --label "$READY" --state open \
-    --json number,title,labels,assignees,milestone,createdAt --limit 100
+# QUEUE_REPO is the resolved <org>/<repo> from Phase 1.
+if [ "${ASSIGNEE:-}" = "@me" ]; then
+  ASSIGNEE=$(gh api user --jq .login) || exit 1
 fi
+ISSUE_PAGES=$(gh api --method GET "repos/$QUEUE_REPO/issues" \
+  -f state=open -f per_page=100 --paginate --slurp) || exit 1
+# The repository issues endpoint also returns pull requests; exclude them.
+ISSUES_JSON=$(printf '%s' "$ISSUE_PAGES" | jq '[.[][] | select(has("pull_request") | not)]') || exit 1
+printf '%s' "$ISSUES_JSON" | jq --arg ready "$READY" --arg assignee "${ASSIGNEE:-}" '
+  [.[] | select(any(.labels[]; .name == $ready))
+       | select($assignee == "" or any(.assignees[]; .login == $assignee))]'
 ```
 
+Wait for every page before choosing work or reporting an empty queue. A failed
+page is an incomplete read: report it and end this cycle without dispatching.
+The REST fields use `created_at` and label/assignee objects. Reuse this complete
+issue snapshot for the lane counts below; apply the assignee filter to candidates
+only, so the repository totals still describe the whole queue.
+
 If empty, run a secondary check to distinguish a genuinely empty queue from an unconfigured repo:
 
 ```bash
@@ -206,8 +216,8 @@ GitHub's data model, not a preference (see "Why labels" above). That makes the o
 - open issues carrying **no** build role label — which this scanner must see anyway in order to
   determine and stamp their repo.
 
-Count each lane and the repo's **total open** count (`gh issue list --state open --limit 1000 --json
-number | jq length`), then build the denominator with the shared helper — GitHub callers pass the
+Count each lane and the repo's **total open** count from `ISSUES_JSON`, then build
+the denominator with the shared helper — GitHub callers pass the
 lane type explicitly, since there is none to read:
 
 ```text

package/plugins/src/base/skills/lisa-jira-build-intake/SKILL.md

@@ -177,7 +177,16 @@ the Linear side produced 31 consecutive false "dry lane" cycles (#2657).
 2. Then sweep the rest of pre-work with the same base JQL, swapping the status clause for
    `statusCategory = "To Do"`, and read the **total open** count (`statusCategory != Done`). The
    open total is what makes an omitted lane arithmetically visible.
-3. Page to exhaustion — a single unpaged `search-issues` call is not a count.
+3. Page each query to exhaustion using the configured access tool's pagination
+   fields. For token-based search, pass the returned `nextPageToken` until the
+   response marks the last page. For offset-based search, advance `startAt` by
+   the number of returned issues until the reported total is reached. Keep the
+   same JQL and ordering throughout, and deduplicate issue keys across pages.
+   A failed page, repeated cursor, or missing continuation while more results
+   are reported makes the read incomplete. Report that condition and end the
+   cycle without dispatching; never report a partial read as an empty queue.
+   If the access tool hides pagination, use its documented complete-list mode
+   or another configured read path that exposes continuation metadata.
 
 Capture each ticket's: key, summary, issue type, priority, assignee, parent (epic), status (with
 its category), labels, components.

package/plugins/src/base/skills/lisa-linear-build-intake/SKILL.md

@@ -164,8 +164,15 @@ This skill ONLY transitions `$READY → $CLAIMED` on claim, and `$CLAIMED → $D
 
 1. List the team's workflow states via `lisa-linear-access operation: list-workflow-states`.
 2. Keep every state whose `type` is `backlog` or `unstarted` — that is the pre-work set. `$READY` is one member of it, not the whole of it.
-3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, paging to `hasNextPage=false`. Linear's GraphQL complexity ceiling silently truncates at `first: 250`, so a single unpaged call is not a count.
-4. Also read the **total open** count for the team (every state whose `type` is not `completed` / `canceled`). This number is what makes an omitted lane arithmetically visible.
+3. Query each pre-work state: `lisa-linear-access operation: list-issues({team: <teamId>, state: "<state>"})`, following `endCursor` until `hasNextPage=false`. Deduplicate issue IDs. A failed page or non-advancing cursor makes the read incomplete; report it and end the cycle without dispatching. Do not infer completeness from a single page's size.
+4. Also read the **total open** count for the team using the same terminal set as the child check below: exclude `completed`, `canceled`, and `duplicate`. Intermediate deployment states remain open.
+
+Report the query scope, pages read and distinct issue count. If a previous read
+or a known issue contradicts the result, re-read that evidence before declaring
+the queue empty. Identifier ranges and gaps are diagnostics, not proof of
+completeness: filters, deleted issues and unseen omissions can all affect them.
+The historical 249-row report did not establish a root-connection defect, so it
+does not justify changing connections or adding a separate range-validation gate.
 
 Capture each Issue's: identifier, title, type label, priority, assignee, project, state (with its `type`), labels, description summary.
 

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -49,6 +49,26 @@ environment  →  materialized file (surfaces that have one)  →  provider
 
 **The middle rung exists only where it must.** A remote agent container prepares itself during setup — before any task exists, and often before network policy would permit a provider call from the task itself — so files written at that moment are the only channel available.
 
+### Recovering AWS access during a task
+
+When an AWS operation reports missing or expired credentials, first resolve
+`LISA_AWS_BOOTSTRAP_JSON` through the ladder above. If available, run the existing
+`scripts/remote-agent-aws-setup.sh` from the trusted installed Lisa plugin/package
+in the project checkout, supplying the bundle only to that subprocess's
+environment. Select the intended namespace, stage and expected account from the
+project configuration. Require its successful account verification; do not
+disable verification or take over another project's default profile to force
+success. Use `lisa-setup-remote-aws` only if installation is missing. Keep the
+bundle private; do not print it or copy it into a second secret provider. Do not
+use `aws sso login` to recover this Lisa-managed bootstrap path.
+
+Before retrying the operation, verify that the selected profile's caller account
+matches the project's expected account; successful authentication alone is not
+enough. If the bundle cannot be resolved or the account mismatches, report that
+specific failure. An SSO-shaped local profile is not evidence that a human login
+is required. Projects explicitly configured for a different access method keep
+that method; do not invent a bootstrap bundle for them.
+
 ## Writing values to disk
 
 The default rule is absolute: **never write a resolved value to disk**, including "temporary" files. A value on disk is a copy that can drift and leak.