@codyswann/lisa 4.74.8 → 4.75.0

package/plugins/lisa-devin/skills/lisa-setup-remote-env/assets/materialized-env-authority.mjs

@@ -0,0 +1,262 @@
+#!/usr/bin/env node
+/**
+ * Fail-closed authority for Lisa's materialized remote environment.
+ *
+ * SessionStart sources secret-bearing shell text, so it must first prove that
+ * the path still has the exact type, mode, owner, and writer format Lisa owns.
+ * This asset is self-contained because a freshly cloned remote host has no
+ * plugin module graph yet.
+ * @module materialized-env-authority
+ */
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HEADER = [
+  "# Generated by lisa-secrets-access. Contains secret values.",
+  "# Do not print, inspect, summarize, commit, or copy this file.",
+];
+const SAFE_NAMESPACE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const EXPORT_LINE = /^export ([A-Za-z_]\w*)='(.*)'$/u;
+const AUTHORITY_REFUSAL = 77;
+
+/**
+ * Decide whether both materialized filesystem objects belong to this user.
+ * @param {{directoryUid: number, expectedUid: number, fileUid: number}} facts
+ *   Immutable owner identities.
+ * @returns {boolean} Whether both objects have the expected owner.
+ */
+export function materializedOwnersMatch(facts) {
+  return (
+    facts.directoryUid === facts.expectedUid &&
+    facts.fileUid === facts.expectedUid
+  );
+}
+
+/**
+ * Create the pure filesystem authority decision around one owner predicate.
+ * @param {(facts: object) => boolean} ownersMatch Owner authority.
+ * @returns {(facts: object) => {accepted: boolean, reason?: string}} Verdict.
+ */
+export function createMaterializedEnvAuthority(ownersMatch) {
+  return facts => {
+    if (facts.directoryType === "symlink" || facts.fileType === "symlink") {
+      return { accepted: false, reason: "materialized environment symlink" };
+    }
+    if (facts.directoryType !== "directory") {
+      return {
+        accepted: false,
+        reason: "materialized environment directory type mismatch",
+      };
+    }
+    if (facts.fileType !== "file") {
+      return {
+        accepted: false,
+        reason: "materialized environment regular file type mismatch",
+      };
+    }
+    if (facts.directoryMode !== 0o700) {
+      return {
+        accepted: false,
+        reason: "materialized environment directory mode is not 0700",
+      };
+    }
+    if (facts.fileMode !== 0o600) {
+      return {
+        accepted: false,
+        reason: "materialized environment file mode is not 0600",
+      };
+    }
+    if (!ownersMatch(facts.ownership)) {
+      return {
+        accepted: false,
+        reason: "materialized environment file ownership mismatch",
+      };
+    }
+    return { accepted: true };
+  };
+}
+
+export const validateMaterializedEnvAuthority = createMaterializedEnvAuthority(
+  materializedOwnersMatch
+);
+
+/**
+ * Identify one lstat result without following a symbolic link.
+ * @param {import("node:fs").Stats} stat Immutable lstat observation.
+ * @returns {"symlink" | "directory" | "file" | "other"} Object kind.
+ */
+function statType(stat) {
+  if (stat.isSymbolicLink()) return "symlink";
+  if (stat.isDirectory()) return "directory";
+  if (stat.isFile()) return "file";
+  return "other";
+}
+
+/**
+ * Capture the complete immutable authority decision before reading bytes.
+ * @param {string} valuesFile Absolute materialized artifact path.
+ * @param {object} dependencies Injected filesystem and identity boundary.
+ * @returns {Readonly<object>} Frozen authority facts.
+ */
+function authorityFacts(valuesFile, dependencies) {
+  const expectedUid = dependencies.getuid();
+  const directory = dependencies.lstat(dirname(valuesFile));
+  const file = dependencies.lstat(valuesFile);
+  const ownership = Object.freeze({
+    directoryUid: directory.uid,
+    expectedUid,
+    fileUid: file.uid,
+  });
+  return Object.freeze({
+    directoryMode: directory.mode & 0o777,
+    directoryType: statType(directory),
+    directoryUid: directory.uid,
+    expectedUid,
+    fileMode: file.mode & 0o777,
+    fileType: statType(file),
+    fileUid: file.uid,
+    ownership,
+  });
+}
+
+/**
+ * Prove text is exactly the sorted, newline-terminated Lisa writer format.
+ * @param {string} text Candidate shell artifact content.
+ * @returns {boolean} Whether the complete artifact matches the writer format.
+ */
+function materializedFormatValid(text) {
+  if (typeof text !== "string" || !text.endsWith("\n")) return false;
+  const lines = text.split("\n");
+  lines.pop();
+  if (lines[0] !== HEADER[0] || lines[1] !== HEADER[1]) return false;
+  const names = [];
+  for (const line of lines.slice(2)) {
+    const match = EXPORT_LINE.exec(line);
+    if (!match || match[2].replaceAll("'\\''", "").includes("'")) {
+      return false;
+    }
+    names.push(match[1]);
+  }
+  return names.every((name, index) => index === 0 || names[index - 1] < name);
+}
+
+/**
+ * Read the configured safe namespace and resolve its exact values artifact.
+ * @param {string} configFile Absolute project configuration path.
+ * @param {string} configRoot Absolute per-user configuration root.
+ * @param {object} dependencies Injected filesystem boundary.
+ * @returns {string} Absolute materialized values path.
+ */
+function valuesFileFromConfig(configFile, configRoot, dependencies) {
+  let config = {};
+  try {
+    config = JSON.parse(dependencies.readFile(configFile, "utf8"));
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw new Error("configuration is invalid");
+  }
+  if (!config || typeof config !== "object" || Array.isArray(config)) {
+    throw new Error("configuration is invalid");
+  }
+  const secrets = config.secrets ?? {};
+  if (!secrets || typeof secrets !== "object" || Array.isArray(secrets)) {
+    throw new Error("configuration secrets are invalid");
+  }
+  const namespace = secrets.namespace ?? "lisa";
+  if (
+    typeof namespace !== "string" ||
+    namespace === ".." ||
+    !SAFE_NAMESPACE.test(namespace)
+  ) {
+    throw new Error("unsafe materialized environment namespace");
+  }
+  if (!isAbsolute(configRoot)) {
+    throw new Error("materialized environment config root is not absolute");
+  }
+  return join(configRoot, namespace, "secrets.env");
+}
+
+/**
+ * Convert a caught failure into a bounded, value-free reason.
+ * @param {unknown} error Refusal caught at the CLI boundary.
+ * @returns {string} Public diagnostic reason without artifact content.
+ */
+function refusalReason(error) {
+  if (error?.code === "ENOENT") return "file is missing";
+  if (error?.code === "EACCES") return "file is unreadable";
+  if (error instanceof Error && error.message.startsWith("materialized ")) {
+    return error.message;
+  }
+  if (error instanceof Error && error.message.startsWith("unsafe ")) {
+    return error.message;
+  }
+  if (error instanceof Error && error.message.startsWith("configuration ")) {
+    return error.message;
+  }
+  return "authority check failed";
+}
+
+/** Default synchronous boundary; injection is reserved for executable tests. */
+const DEFAULT_DEPENDENCIES = Object.freeze({
+  getuid: () => (typeof process.getuid === "function" ? process.getuid() : -1),
+  lstat: lstatSync,
+  readFile: readFileSync,
+  writeError: diagnostic => process.stderr.write(diagnostic),
+  writeOutput: output => process.stdout.write(output),
+});
+
+/**
+ * Validate one materialized file, or resolve it from the project config.
+ * @param {readonly string[]} argv Direct file or `--resolve` arguments.
+ * @param {object} [injected] Test-owned filesystem and diagnostic boundary.
+ * @returns {number} Zero only after complete authority and format validation.
+ */
+export function runMaterializedEnvAuthorityCli(argv, injected = {}) {
+  const dependencies = { ...DEFAULT_DEPENDENCIES, ...injected };
+  try {
+    const resolving = argv[0] === "--resolve";
+    if ((!resolving && argv.length !== 1) || (resolving && argv.length !== 3)) {
+      throw new Error("materialized environment arguments are invalid");
+    }
+    const valuesFile = resolving
+      ? valuesFileFromConfig(argv[1], argv[2], dependencies)
+      : argv[0];
+    if (!isAbsolute(valuesFile)) {
+      throw new Error("materialized environment path is not absolute");
+    }
+    const facts = authorityFacts(valuesFile, dependencies);
+    const decision = validateMaterializedEnvAuthority(facts);
+    if (!decision.accepted) throw new Error(decision.reason);
+    const text = dependencies.readFile(valuesFile, "utf8");
+    if (!materializedFormatValid(text)) {
+      throw new Error("materialized environment format is invalid");
+    }
+    if (resolving) dependencies.writeOutput(`${valuesFile}\n`);
+    return 0;
+  } catch (error) {
+    const reason = refusalReason(error);
+    dependencies.writeError(`Lisa materialized environment ${reason}\n`);
+    return AUTHORITY_REFUSAL;
+  }
+}
+
+/**
+ * Decide whether this module is the process entrypoint.
+ * @param {string} moduleUrl Current module URL.
+ * @param {string | undefined} argv1 Invoked script path, when present.
+ * @returns {boolean} Whether the CLI driver must run.
+ */
+function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return (
+      realpathSync(resolve(argv1)) === realpathSync(fileURLToPath(moduleUrl))
+    );
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
+  process.exitCode = runMaterializedEnvAuthorityCli(process.argv.slice(2));
+}

package/plugins/lisa-devin/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+#
+# Session-start entrypoint for surfaces that materialize secrets per session
+# rather than during environment setup.
+#
+# Wired into the repository's `.claude/settings.json` as a SessionStart hook,
+# so it is part of the clone and runs on every session — including a session
+# resumed onto a cached environment, which is the case that matters.
+#
+# Why this exists at all: a cloud environment's setup script is skipped whenever
+# a filesystem cache exists. Materializing there would write the values once and
+# never refresh them, so a rotated credential would stay stale until the cache
+# expired days later. This hook runs every session, so the copy on disk is
+# always the provider's current view.
+#
+# It is deliberately a guard and a delegation, not a second implementation. The
+# skill-resolution ladder is subtle enough that two copies would drift, so the
+# real work stays in setup.sh and this file only decides whether to call it.
+set -euo pipefail
+
+# Exit before doing anything on a machine that is not a remote session. The hook
+# is committed to the repository, so it also fires on every local session; the
+# materialize step would correctly refuse there, but failing on a developer's
+# laptop every time they start a session is noise, not a signal.
+if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
+  exit 0
+fi
+
+here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
+
+# The toolchain first, for the same reason the secrets are here at all.
+#
+# It used to run only from the environment setup script, which a cached
+# environment skips — so a tool added to remoteEnv.tools was invisible until the
+# cache expired about a week later, or until someone edited the vendor's setup
+# field to force a rebuild. Neither is a thing a project can rely on, and the
+# symptom is a container missing a tool its own committed config pins.
+#
+# It is cheap to repeat: the plan probes each tool and installs only what is
+# absent or below its pinned version, so on a warm container this is a handful
+# of --version calls and nothing else.
+#
+# Before secrets, because materializing needs the provider CLI that this step
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
+bash "${here}/setup.sh" --phase=toolchain "$@"
+
+# The toolchain child cannot export into this parent shell. Its durable output
+# is linked into ~/.local/bin, so make that directory visible before the next
+# child tries to execute the provider CLI it just installed.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# Validate the exact Lisa-owned secrets.env before sourcing any bytes. The
+# profile is unrelated host startup code and may return before Lisa's managed
+# block, mutate the environment, or run arbitrary user commands. The authority
+# process resolves the same configured namespace as the materializer and emits
+# only the fully validated absolute artifact path.
+project_root="$(CDPATH='' cd -- "${here}/../.." && pwd)"
+config_root="${XDG_CONFIG_HOME:-$HOME/.config}"
+values_file="$(
+  node "${here}/materialized-env-authority.mjs" \
+    --resolve "${project_root}/.lisa.config.json" "${config_root}"
+)"
+
+# Match the managed block's AWS poison removal, then export the artifact's
+# values only for this session-start process and its project-hook child.
+unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
+set -a
+# The authority process proved this exact path and its complete writer format.
+# shellcheck disable=SC1090
+. "${values_file}"
+set +a
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec /bin/bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa-devin/skills/lisa-setup-remote-env/assets/setup.sh

@@ -0,0 +1,216 @@
+#!/usr/bin/env bash
+#
+# Remote environment entrypoint. Installed by /lisa:setup:remote-env; the remote
+# environment's setup AND maintenance fields both call this exact path.
+#
+# They are the same script on purpose. A container may be built fresh or resumed
+# from cache, and everything below is idempotent and version-aware — so running
+# it twice is correct, and running it on resume is what picks up a rotated
+# value, an edited note, or a changed version pin.
+#
+# This file is deliberately thin. It resolves an interpreter and hands off; the
+# reviewed, tested, versioned logic lives in the Lisa skill rather than here,
+# and emphatically not in a vendor settings field.
+set -euo pipefail
+
+# Claude Code web runs the environment setup field from $HOME, while the
+# checkout lives at $HOME/<repo>. If this installed copy is invoked by absolute
+# path, move back to the repository root before resolving project-local files.
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+case "$script_dir" in
+  */scripts/lisa-remote-env)
+    cd "$script_dir/../.."
+    ;;
+esac
+
+# Node is the one thing that cannot be installed by the installer, since the
+# installer is written in it. Checked before the dependency install rather than
+# after: every package manager below is itself a node program, so a missing node
+# would otherwise surface as that manager failing under `set -e`, and the script
+# would exit on a confusing error instead of this actionable one.
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required to prepare this environment but is not present." >&2
+  echo "It cannot be installed by the toolchain step, because that step runs" >&2
+  echo "on node. Pin a base image that provides it." >&2
+  exit 1
+fi
+node_bin="$(command -v node)"
+
+# Install the project's dependencies, unless the caller already did.
+#
+# This lives here rather than in the vendor's settings field so that field can
+# be one identical line for every project. Naming the package manager there
+# meant a Claude environment for an npm project and one for a bun project
+# differed by a string a human had to get right, in a box with no review, no
+# version history, and no test.
+#
+# Which manager is decided by the lockfile that is actually committed, never
+# guessed: a guessed one fails on the container's first command with an error
+# blaming the project rather than the guess.
+#
+# A directory's presence says nothing about which lockfile produced it. Remote
+# vendors cache containers across commits, so node_modules can exist while
+# carrying the previous Lisa release or an otherwise stale dependency graph.
+# Persist the reconciled lockfile signature inside node_modules instead: a
+# matching signature is the cheap resume path, and a changed or missing one
+# earns one frozen reinstall.
+lock_file=""
+install_cmd=""
+if [ -f bun.lock ]; then lock_file="bun.lock"; install_cmd="bun install --frozen-lockfile"
+elif [ -f bun.lockb ]; then lock_file="bun.lockb"; install_cmd="bun install --frozen-lockfile"
+elif [ -f pnpm-lock.yaml ]; then lock_file="pnpm-lock.yaml"; install_cmd="pnpm install --frozen-lockfile"
+elif [ -f yarn.lock ]; then
+  lock_file="yarn.lock"
+  # Yarn Classic and Berry spell the same intent differently, and each rejects
+  # the other's flag. The lockfile itself says which is in use: Yarn 1 writes a
+  # "# yarn lockfile v1" header, Berry does not.
+  if head -5 yarn.lock | grep -q "yarn lockfile v1"; then
+    install_cmd="yarn install --frozen-lockfile"
+  else
+    install_cmd="yarn install --immutable"
+  fi
+elif [ -f package-lock.json ]; then lock_file="package-lock.json"; install_cmd="npm ci"
+fi
+
+if [ -n "$install_cmd" ]; then
+  lock_digest=$(node -e '
+    const crypto = require("node:crypto");
+    const fs = require("node:fs");
+    const path = process.argv[1];
+    process.stdout.write(
+      crypto.createHash("sha256").update(path).update("\0").update(fs.readFileSync(path)).digest("hex")
+    );
+  ' "$lock_file") || {
+    echo "Could not fingerprint $lock_file; refusing to trust cached dependencies." >&2
+    exit 1
+  }
+  lock_signature="$lock_file:$lock_digest"
+  lock_marker="node_modules/.lisa-lockfile.sha256"
+  cached_lock_signature=""
+  if [ -f "$lock_marker" ]; then
+    IFS= read -r cached_lock_signature < "$lock_marker" || true
+  fi
+
+  if [ ! -d node_modules ] || [ "$cached_lock_signature" != "$lock_signature" ]; then
+    echo "Installing dependencies with: $install_cmd"
+    # CI=1 so lifecycle scripts take their automation path and leave the
+    # checkout alone. A remote-env setup is automation by definition, and a
+    # postinstall that rewrites tracked files here breaks any skill with a
+    # clean-checkout precondition — which the publishing skills have, because
+    # their diff is contractually bounded and merged without human review.
+    #
+    # Lisa's own postinstall already guards on exactly this variable, so this
+    # is an existing convention rather than a new one.
+    #
+    # NOT --ignore-scripts: that would also stop patch-package, so a project
+    # relying on patched dependencies would silently get unpatched ones — a
+    # quieter failure than the one being fixed.
+    #
+    # Without it the bug is cache-dependent, not deterministic: a fresh
+    # container installs and dirties the tree, a resumed one skips the install
+    # and succeeds. That reads as flakiness rather than a cause.
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+      # npm ci replaces node_modules, while the other managers may update it in
+      # place. Write only after a successful install so an interrupted or
+      # explicitly skipped reconciliation never blesses a stale cache.
+      mkdir -p node_modules
+      printf '%s\n' "$lock_signature" > "$lock_marker"
+    fi
+  fi
+elif [ ! -d node_modules ]; then
+  # Not fatal on its own. A project may carry no lockfile and still have the
+  # skill in a checkout directory, so let the resolver below decide.
+  echo "No lockfile found; skipping dependency install." >&2
+fi
+
+# Where the skill lives depends on how this project's harness receives it, and
+# the two delivery models differ in a way that matters here.
+#
+# OpenCode and Antigravity get skills written INTO the checkout by `lisa apply`,
+# so a clone already carries them. Claude and Codex receive them as an installed
+# plugin, which lives in the user's home directory and is emphatically NOT part
+# of a clone. A fresh remote container is the second case every time: it clones
+# the repository and has never run a plugin install.
+#
+# So the agent directories are searched first — they are the cheapest hit and
+# need nothing installed — and the npm package is the fallback that makes the
+# plugin-delivered harnesses work at all. Lisa is a dependency of every project
+# it is applied to, so `node_modules` carries the same skill at the version that
+# project pins, which is the version its setup should run.
+#
+# `plugins/lisa/skills/` sits between them, and exists for exactly one project:
+# Lisa itself. There the checkout IS Lisa, at HEAD, while `node_modules` holds
+# whatever version its own lockfile pins — which was four months and a hundred
+# skills behind, so this file did not exist there at all and setup aborted
+# claiming the skill could not be found. The one place it was is the only place
+# that was not searched. It is ahead of node_modules because a checkout that
+# builds this skill is newer than any published copy of it, and harmless
+# everywhere else because no other project has that directory.
+runner=""
+for candidate in \
+  ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".opencode/skills/lisa/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
+  if [ -f "$candidate" ]; then
+    runner="$candidate"
+    break
+  fi
+done
+
+if [ -z "$runner" ]; then
+  echo "Cannot find the lisa-setup-remote-env skill." >&2
+  echo >&2
+  echo "Searched the agent skill directories and node_modules. On a remote" >&2
+  echo "container the usual cause is that dependencies have not been installed" >&2
+  echo "yet: Claude and Codex receive Lisa skills as an installed plugin, which" >&2
+  echo "is not part of a clone, so node_modules is the only copy present." >&2
+  echo >&2
+  echo "This script installs dependencies itself, so reaching here means the" >&2
+  echo "install did not produce the package, or the project has no lockfile" >&2
+  echo "identifying its package manager. Check that @codyswann/lisa is a" >&2
+  echo "dependency and that a lockfile is committed." >&2
+  echo >&2
+  echo "If dependencies are installed, run 'lisa apply' so the skills are" >&2
+  echo "present, then re-run setup." >&2
+  echo >&2
+  # The version actually resolved, because "not found" and "found, but too old
+  # to contain this skill" read identically above and are fixed differently.
+  # The second is what happened on Lisa itself: node_modules held a release
+  # from before this skill existed, so every path checked was legitimately
+  # absent and the message blamed the install.
+  if [ -f node_modules/@codyswann/lisa/package.json ]; then
+    echo "For reference, node_modules has @codyswann/lisa version:" >&2
+    node -p "require('./node_modules/@codyswann/lisa/package.json').version" >&2 2>/dev/null ||
+      echo "  (unreadable)" >&2
+    echo "If that predates this skill, the pin is the problem, not the install." >&2
+  fi
+  exit 1
+fi
+
+# Pinned tools live here. A fresh toolchain run prepends this directory inside
+# its own node process, but that export cannot reach the next SessionStart
+# process in a cached container. Add it only after bootstrap work has finished:
+# dependency installation and the runner itself keep using the inherited,
+# already-validated Node instead of trusting an executable from writable local
+# tool storage.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
+exec "$node_bin" "$runner" "$@"