@codyswann/lisa 4.74.9 → 4.75.0

package/plugins/lisa-devin/hooks/secrets-preflight.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Prove at session start that this agent can actually do the work: that the
+# credentials the project needs resolve, and that the CLIs it needs are on PATH.
+#
+# One hook for both because it is one question — can this agent do the work —
+# and an operator reading two separate reports has to assemble the answer
+# themselves. Both halves also share the same failure mode if split: two hooks
+# means two subprocess spawns on every session start, for a check that is silent
+# almost every time.
+#
+# Injects rather than blocks, and that is deliberate. The right response to a
+# missing credential or tool is for the agent to know before it claims work and
+# to route the item to blocked with a reason a human can act on — not for the
+# session to die. A session that cannot reach the vault can still write code,
+# review a PR, or answer a question; killing it would tax every session for a
+# minority need, and a control people route around enforces nothing.
+#
+# The hard gates live where they can afford to be hard: `lisa doctor` and CI
+# run the same two scripts and exit non-zero on them.
+#
+# Silent on success on purpose. A control that announces itself when everything
+# is fine trains its readers to skim past it, and then it is decoration.
+set -uo pipefail
+
+INPUT=$(cat 2>/dev/null || true)
+if [ -n "$INPUT" ]; then
+  HOOK_EVENT=$(printf '%s' "$INPUT" | jq -r '.hook_event_name // "SessionStart"' 2>/dev/null || echo "SessionStart")
+else
+  HOOK_EVENT="SessionStart"
+fi
+
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+SECRETS="$ROOT/skills/lisa-secrets-access/scripts/preflight-secrets.mjs"
+TOOLS="$ROOT/skills/lisa-setup-remote-env/scripts/preflight-tools.mjs"
+
+command -v node >/dev/null 2>&1 || exit 0
+# The hook's whole output is one `jq -n` document. Without jq there is nothing
+# to write, so exiting is the only honest outcome — the alternative is a hook
+# that prints `jq: command not found` and exits 127, which reports a failure
+# from a check designed never to block. The doctor and CI gates run the same
+# two scripts without jq involved.
+command -v jq >/dev/null 2>&1 || exit 0
+
+# stderr carries each report; stdout is reserved for the hook's JSON. A script
+# that is absent (partial or older install) or fails to run at all contributes
+# nothing, because a broken hook must not manufacture a finding.
+REPORT=""
+for script in "$SECRETS" "$TOOLS"; do
+  [ -f "$script" ] || continue
+  # An escape hatch that is honest about what it costs, and scoped to what it
+  # names. Set when a surface has no secrets provider by design and the noise is
+  # not worth it; the doctor and CI gates are unaffected, so opting out here
+  # does not opt out of the check entirely. It must not also silence the
+  # TOOLING half — a variable about secrets that hides a missing `gh` or
+  # `maestro` is an opt-out from a check nobody opted out of.
+  if [ "$script" = "$SECRETS" ] && [ "${LISA_SKIP_SECRETS_PREFLIGHT:-}" = "1" ]; then
+    continue
+  fi
+  OUT=$(node "$script" 2>&1 >/dev/null) || true
+  [ -n "$OUT" ] || continue
+  [ -n "$REPORT" ] && REPORT+=$'\n\n'
+  REPORT+="$OUT"
+done
+
+[ -n "$REPORT" ] || exit 0
+
+CONTEXT="## Readiness preflight
+
+$REPORT"
+
+jq -n --arg event "$HOOK_EVENT" --arg ctx "$CONTEXT" \
+  '{"hookSpecificOutput": {"hookEventName": $event, "additionalContext": $ctx}}'

package/plugins/lisa-devin/hooks/setup-jira-cli.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+##
+# Writes the JIRA CLI config file from environment variables.
+# Runs on SessionStart so the config is available for every session.
+#
+# Gated on the project's configured tracker: this only writes anything when
+# `.lisa.config*.json` declares `tracker: "jira"`. A project on Linear or GitHub
+# Issues has no use for a jira-cli config, and writing one made a false implicit
+# claim about which tracker the project runs on. The gate fails closed — a
+# tracker that cannot be READ now says so on stderr and exits non-zero, rather
+# than exiting 0 as though the project had declared nothing.
+#
+# Required env vars (must be created in your Claude Code Web environment):
+#   JIRA_INSTALLATION - cloud or local
+#   JIRA_SERVER       - Atlassian instance URL (falls back to .lisa.config*.json atlassian.site)
+#   JIRA_LOGIN        - login email
+#   JIRA_PROJECT      - default project key (falls back to .lisa.config*.json jira.project)
+#   JIRA_API_TOKEN    - already expected by jira-cli natively
+#
+# Optional env vars:
+#   JIRA_BOARD        - default board name
+##
+
+set -euo pipefail
+
+# Drain the hook envelope before any early return.
+cat >/dev/null 2>&1 || true
+
+# ---------------------------------------------------------------------------
+# WHERE THE CONFIG IS READ FROM.
+#
+# The write target has always been absolute (`${PROJECT_DIR}/.lisa/jira-cli`)
+# while the reads were relative to the process working directory. A session
+# launched anywhere but the project root therefore read a different directory
+# than it wrote, and `jq` on a missing file yields empty, which every consumer
+# below treats as "not configured" — so the hook reported success having
+# configured nothing. Both ends now resolve against PROJECT_DIR, matching the
+# OpenCode implementation, which has always resolved against the worktree root
+# it is handed.
+#
+# CLAUDE_PROJECT_DIR first (the harness's own declaration of the root, and
+# inert on harnesses that never set it), then the git toplevel, then pwd. This
+# block is deliberately identical in both shell implementations: two copies of
+# one resolution rule, allowed to drift, is what produced the Codex half of
+# this defect in the first place.
+# ---------------------------------------------------------------------------
+
+# ---------------------------------------------------------------------------
+# WHO READS WHAT THIS WRITES — and why no per-harness env export is needed.
+#
+# `${PROJECT_DIR}/.lisa/jira-cli/.config.yml` had NO reader at all until
+# CodySwannGT/lisa#2767: the hook wrote a file, every consumer looked at
+# `${HOME}/.config/.jira/.config.yml` instead, and the hook was therefore an
+# inert control that reported success while feeding nothing. It now has three
+# consumers, all Lisa-owned:
+#
+#   * lisa-jira-evidence/scripts/post-evidence.sh — greps `server:`/`login:`
+#     out of this YAML, then passes `--config <path>` to `jira issue move`.
+#   * lisa-jira-read-ticket/scripts/download-attachment.sh — greps the same two
+#     keys, but ONLY when JIRA_SERVER/JIRA_LOGIN are unset. Env still wins; a
+#     headless runner with those exported never opens this file.
+#   * SKILL prose (lisa-jira-add-journey, base-rules) — types
+#     `jira --config .lisa/jira-cli/.config.yml issue view <KEY>`.
+#
+# #2767 framed the blocking question as "can a SessionStart hook export an
+# environment variable into the agent's later tool invocations, and does that
+# differ per harness?" That question is MOOT for every consumer above, because
+# none of them needs an export:
+#
+#   - Two of the three parse this YAML themselves, in Lisa-owned shell.
+#   - The one real jira-cli invocation passes `--config`, an ARGUMENT. It
+#     crosses no process boundary, so it behaves identically on Claude Code,
+#     Codex, Cursor, Copilot, OpenCode and Antigravity. There is no per-harness
+#     capability to record because no harness capability is used.
+#
+# The only surface where an export could still have mattered is a freehand
+# `jira ...` an agent types from SKILL prose. That is compensated at the same
+# rung rather than dropped: the prose types `--config` too. `JIRA_CONFIG_FILE`
+# is deliberately exported NOWHERE in Lisa — an unexported variable is another
+# inert control, and the flag makes the export unnecessary.
+#
+# jira-cli's own resolution order, MEASURED against v1.7.0 (darwin/arm64)
+# rather than taken from its README:
+#
+#   1. `--config`/`-c <path>`               (highest; accepted either before or
+#                                            after the subcommand)
+#   2. `JIRA_CONFIG_FILE=<path>`
+#   3. `${HOME}/.config/.jira/.config.yml`  (default)
+#
+# A path named by (1) or (2) that does not exist FAILS CLOSED: jira-cli prints
+# "Missing configuration file." and exits 1 — it does NOT fall back to (3).
+# That is what makes passing `--config` safe rather than a silent no-op.
+#
+# This hook never writes to `${HOME}/.config/.jira`. That is a developer's
+# personal jira-cli state; consumers read it as an ANNOUNCED fallback only.
+# ---------------------------------------------------------------------------
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
+if [[ -z "${PROJECT_DIR}" || ! -d "${PROJECT_DIR}" ]]; then
+  PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+fi
+LISA_CONFIG_LOCAL="${PROJECT_DIR}/.lisa.config.local.json"
+LISA_CONFIG_MAIN="${PROJECT_DIR}/.lisa.config.json"
+
+# A project with no Lisa config at all is genuinely unconfigured: nothing to
+# read, nothing to write. That case exits silently, exactly as it always has —
+# it is the control that keeps this change from being a behavior change for
+# every non-Lisa directory a harness might launch in.
+if [[ ! -f "${LISA_CONFIG_LOCAL}" && ! -f "${LISA_CONFIG_MAIN}" ]]; then
+  exit 0
+fi
+
+# FAIL CLOSED FROM HERE. A config file exists, so anything that stops us
+# reading it is a failure, not an answer. Reporting "no tracker configured"
+# because jq is absent or the JSON is malformed is the silent-inert-control
+# failure this hook family keeps producing; it is now visible on stderr and
+# non-zero rather than an exit 0 that claims the project configured nothing.
+if ! command -v jq &>/dev/null; then
+  printf '%s\n' \
+    "setup-jira-cli: cannot read ${LISA_CONFIG_MAIN}: jq is not installed." \
+    "setup-jira-cli: refusing to report this project as unconfigured. Install jq." >&2
+  exit 1
+fi
+
+for lisa_config_candidate in "${LISA_CONFIG_LOCAL}" "${LISA_CONFIG_MAIN}"; do
+  if [[ -f "${lisa_config_candidate}" ]] &&
+    ! jq empty "${lisa_config_candidate}" >/dev/null 2>&1; then
+    printf '%s\n' \
+      "setup-jira-cli: ${lisa_config_candidate} is not valid JSON." \
+      "setup-jira-cli: refusing to report this project as unconfigured." >&2
+    exit 1
+  fi
+done
+
+# Reads the first non-empty value for `query` across the local override and the
+# committed config, both resolved from PROJECT_DIR. A jq failure returns
+# non-zero so the caller can fail closed; it never degrades to an empty string.
+read_lisa_config() {
+  local query="$1"
+  local value=""
+  local candidate
+
+  for candidate in "${LISA_CONFIG_LOCAL}" "${LISA_CONFIG_MAIN}"; do
+    [[ -f "${candidate}" ]] || continue
+    if ! value="$(jq -r "${query} // empty" "${candidate}")"; then
+      printf '%s\n' \
+        "setup-jira-cli: failed to read ${query} from ${candidate}." >&2
+      return 1
+    fi
+    [[ -n "${value}" ]] && break
+  done
+
+  printf '%s' "${value}"
+}
+
+# Tracker gate: do nothing unless this project actually runs on JIRA. An
+# unreadable tracker is a hard stop, not a "no".
+if ! LISA_TRACKER="$(read_lisa_config '.tracker')"; then
+  exit 1
+fi
+if [[ "${LISA_TRACKER}" != "jira" ]]; then
+  exit 0
+fi
+
+if [[ -z "${JIRA_SERVER:-}" ]]; then
+  if ! ATLASSIAN_SITE="$(read_lisa_config '.atlassian.site')"; then
+    exit 1
+  fi
+  if [[ -n "${ATLASSIAN_SITE}" ]]; then
+    if [[ "${ATLASSIAN_SITE}" == http://* || "${ATLASSIAN_SITE}" == https://* ]]; then
+      JIRA_SERVER="${ATLASSIAN_SITE}"
+    else
+      JIRA_SERVER="https://${ATLASSIAN_SITE}"
+    fi
+  fi
+fi
+
+if [[ -z "${JIRA_PROJECT:-}" ]]; then
+  if ! JIRA_PROJECT="$(read_lisa_config '.jira.project')"; then
+    exit 1
+  fi
+fi
+
+CONFIG_DIR="${PROJECT_DIR}/.lisa/jira-cli"
+CONFIG_FILE="${CONFIG_DIR}/.config.yml"
+
+# Skip config write if required vars are missing. These are identity/secret
+# values supplied by the environment, never by .lisa.config*.json, so their
+# absence is an unconfigured environment rather than an unreadable one.
+if [[ -z "${JIRA_SERVER:-}" || -z "${JIRA_LOGIN:-}" ]]; then
+  exit 0
+fi
+
+mkdir -p "${CONFIG_DIR}"
+
+cat > "${CONFIG_FILE}" << EOF
+installation: ${JIRA_INSTALLATION:-cloud}
+server: ${JIRA_SERVER}
+login: ${JIRA_LOGIN}
+project: ${JIRA_PROJECT:-}
+board: "${JIRA_BOARD:-}"
+auth_type: basic
+epic:
+  name: Epic Name
+  link: Epic Link
+EOF

package/plugins/lisa-devin/hooks/shell-write-nudge.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# Shell Write Nudge Hook (PostToolUse - Bash)
+# =============================================================================
+# Emits a one-line, non-blocking notice when a Bash command appears to mutate a
+# tracked repository file directly. This keeps shell escape hatches visible
+# without blocking legitimate scripts or codemods.
+# =============================================================================
+set -uo pipefail
+
+JSON_INPUT="$(cat)"
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+COMMAND="$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+[ -n "$COMMAND" ] || exit 0
+
+case "$COMMAND" in
+  bun\ run* | npm\ run* | pnpm\ run* | yarn\ run* | node\ scripts/* | bun\ scripts/* | bash\ scripts/* | sh\ scripts/*)
+    exit 0
+    ;;
+esac
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$repo_root" 2>/dev/null || exit 0
+
+is_tracked_file() {
+  local candidate="$1"
+  [ -n "$candidate" ] || return 1
+  candidate="${candidate#./}"
+  git ls-files --error-unmatch -- "$candidate" >/dev/null 2>&1
+}
+
+# Returns 0 when an inline runtime command (python -c / node -e / bun -e) contains
+# explicit write-intent indicators.  Read-only operations such as open(f).read() or
+# readFileSync should not trigger the nudge.
+inline_runtime_intends_to_write() {
+  local cmd="$1"
+  # Python: open() with write/append mode as second positional argument
+  [[ "$cmd" == *", 'w'"* || "$cmd" == *", 'a'"* || "$cmd" == *", 'wb'"* || "$cmd" == *", 'ab'"* ]] && return 0
+  [[ "$cmd" == *', "w"'* || "$cmd" == *', "a"'* || "$cmd" == *', "wb"'* || "$cmd" == *', "ab"'* ]] && return 0
+  # Python / general: explicit .write( method call
+  [[ "$cmd" == *'.write('* ]] && return 0
+  # Node/Bun fs write functions
+  [[ "$cmd" == *'writeFile'* || "$cmd" == *'appendFile'* || "$cmd" == *'createWriteStream'* ]] && return 0
+  return 1
+}
+
+command_mentions_tracked_write() {
+  local token
+  local sed_command_re='(^|[[:space:];&|])sed[[:space:]]'
+  local inline_runtime_re='(^|[[:space:];&|])(python3?|node|bun)[[:space:]]+-[ce][[:space:]]'
+
+  if [[ "$COMMAND" =~ $sed_command_re && "$COMMAND" == *"-i"* ]]; then
+    while IFS= read -r token; do
+      is_tracked_file "$token" && return 0
+    done < <(printf '%s\n' "$COMMAND" | tr ' ' '\n' | sed 's/^[\"'\'']//; s/[\"'\'',;|&)]$//')
+  fi
+
+  while IFS= read -r token; do
+    token="${token#./}"
+    is_tracked_file "$token" && return 0
+  done < <(
+    printf '%s\n' "$COMMAND" |
+      grep -Eo '(^|[[:space:]])(>>?|tee([[:space:]]+-a)?|cat[[:space:]]+<<[^[:space:]]+[[:space:]]*>)[[:space:]]*[^[:space:];|&]+' |
+      sed -E 's/^[[:space:]]*(>>?|tee([[:space:]]+-a)?|cat[[:space:]]+<<[^[:space:]]+[[:space:]]*>)[[:space:]]*//; s/^[\"'\'']//; s/[\"'\'']$//'
+  )
+
+  if [[ "$COMMAND" =~ $inline_runtime_re ]] && inline_runtime_intends_to_write "$COMMAND"; then
+    while IFS= read -r token; do
+      is_tracked_file "$token" && return 0
+    done < <(git ls-files | while IFS= read -r file; do
+      [[ "$COMMAND" == *"$file"* ]] && printf '%s\n' "$file"
+    done)
+  fi
+
+  return 1
+}
+
+if command_mentions_tracked_write; then
+  echo "Lisa notice: prefer Edit/Write for tracked file edits so lint-on-edit can see the change." >&2
+fi
+
+exit 0

package/plugins/lisa-devin/hooks/sonar-secrets.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+#
+# Shared wrapper around `sonar hook <event>` for every agent surface.
+#
+# `sonar integrate <agent>` generates a five-line shim per surface: if `sonar` is
+# on PATH, pipe the hook payload to it and let whatever comes back stand. That is
+# correct for the thing the scanner exists to do — refusing a prompt or a file
+# read that genuinely contains a credential — and wrong for the thing it also
+# does, which is refusing *everything* when the CLI has no token yet:
+#
+#   {"decision":"block","reason":"SonarQube secret scanning is inactive:
+#    not authenticated. Run 'sonar auth login'."}
+#
+# At the shim level that reply is indistinguishable from a real finding, so a
+# workstation that had simply never run the browser login could not submit a
+# prompt at all. Two things are wrong with that, and this wrapper fixes both.
+#
+# 1. The credential is usually already provisioned. A project that declares
+#    SONARQUBE_CLI_TOKEN under `secrets.require` has it in its configured
+#    provider — and the CLI reads only the environment and the OS keychain, so on
+#    a local surface (which deliberately materializes nothing to disk) the value
+#    is present and unreachable at the same time. We resolve it through
+#    lisa-secrets-access, the one sanctioned reader, and only when the CLI says
+#    it needs it.
+#
+# 2. An unauthenticated scanner is a degraded gate, not a breach. This hook is
+#    one of several overlapping layers: secret scanning at commit time and in CI
+#    does not depend on it. Blocking every prompt to protect a redundant layer
+#    trades a certain outage for a hypothetical leak — and the outage lands on
+#    exactly the person least able to diagnose it, since the block fires before
+#    their first prompt is ever seen.
+#
+# A real finding still blocks. Only the "inactive" reply is downgraded, and the
+# distinction is drawn on the reason text the vendor emits, so a detection that
+# arrives while unauthenticated is impossible by construction — in that state the
+# scanner does not scan at all.
+#
+# Usage: sonar-secrets.sh <vendor-event-name>   # hook payload on stdin
+set -uo pipefail
+
+# Read the payload FIRST, before anything here can stand aside.
+#
+# The caller pipes the hook envelope into our stdin. A path that exits before
+# consuming it closes the read end while the caller's write is still in flight,
+# and the caller's write raises EPIPE — a failure in the harness, produced by a
+# hook that had nothing to say and exited 0 saying it. The evidence lands
+# entirely on the writing side, which is why it read as a mystery for so long.
+#
+# It is a race, so it only fires when this process wins. Measured against the
+# real payload at a 1-minute load average of 82: 3 EPIPE in 600 invocations of
+# the no-event path (0.50%), and 30 in 30 once the payload exceeds the pipe
+# buffer. Rare enough to look like a real failure, frequent enough to keep
+# costing re-runs (CodySwannGT/lisa#2949).
+#
+# Reading first is the fix that also covers real callers, rather than only the
+# tests: every exit below now happens after stdin has reached EOF. Use Bash's
+# `read` builtin instead of `cat`: the no-CLI path deliberately works with a
+# PATH that contains no executables, and making the drain depend on PATH removes
+# the drain at exactly the moment this wrapper is proving `sonar` is absent
+# (CodySwannGT/lisa#3308). An empty delimiter means "read through NUL or EOF";
+# hook envelopes contain no NUL, so the non-zero EOF result is expected.
+payload=""
+IFS= read -r -d '' payload || true
+
+event="${1:-}"
+[[ -n "$event" ]] || exit 0
+
+# Nothing installed, nothing to enforce. Matches the vendor shim's own guard.
+command -v sonar >/dev/null 2>&1 || exit 0
+
+# An explicit off switch, for bisecting a session that is misbehaving. There is
+# deliberately no way to turn the *blocking* back on from the environment: the
+# decision that a missing token must not stop work belongs in this file, where it
+# is reviewable, not in whatever shell happened to launch the agent.
+[[ "${LISA_SONAR_HOOK:-on}" == "off" ]] && exit 0
+
+# The vendor signals its verdict as JSON on stdout and always exits 0, so the
+# exit code carries no information and the reason text is the only channel.
+inactive_marker='secret scanning is inactive'
+
+run_scanner() {
+  printf '%s' "$payload" | sonar hook "$event" 2>/dev/null
+}
+
+is_inactive() {
+  case "$1" in
+    *"$inactive_marker"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Run the resolver with a ceiling, because the provider call crosses the network
+# and this sits in front of every prompt and every file read.
+#
+# The value never touches the filesystem. An earlier version captured it through
+# `mktemp` and deleted the file afterwards, which is a race, not a cleanup: a
+# kill between the write and the `rm` leaves the token readable on disk (CWE-922)
+# — the precise failure the one-store rule in lisa-secrets-access exists to
+# prevent, reintroduced by the code enforcing it. Process substitution gives a
+# `/dev/fd` pipe instead, so there is no path on disk to leak and nothing to
+# clean up on any exit path, signalled or not.
+#
+# `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
+# `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
+# portable form. A timeout leaves `value` empty, which the caller treats as "the
+# provider had nothing" — the warn path, never a block.
+#
+# Ten seconds is the ceiling a consumer gets, and that is a product decision, not
+# a tuning constant: this runs in front of every prompt and every file read, so
+# it must not hang a session. `LISA_SONAR_RESOLVER_TIMEOUT_S` lets a caller that
+# is NOT a session say so. The only caller that is not a session is this repo's
+# own suite, where the "provider" is a local `node` script rather than a network
+# call and the cost of starting it is unbounded under load — a spawn measured
+# 45-50ms here at a 1-minute load average of 50, against an 18ms quiet figure,
+# and the read lost its whole ten seconds to one at ~98 concurrent test workers
+# (CodySwannGT/lisa#2905). The suite scales this the same way it scales its own
+# budgets, and stages a hang by shrinking it.
+#
+# Unset, empty, or unparseable all end in the warn path: `:-10` covers the first
+# two, and `read -t garbage` fails immediately, which leaves `value` empty. There
+# is no value of this variable that turns a warn into a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700. Its explicit Lisa prefix makes an interrupted resolver
+# attributable to the owning scratch lifecycle instead of anonymous `tmp.*`.
+resolve_secret() {
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d "${TMPDIR:-/tmp}/lisa-sonar-resolver.XXXXXXXX")" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t "${LISA_SONAR_RESOLVER_TIMEOUT_S:-10}" value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
+  printf '%s' "$value"
+}
+
+out="$(run_scanner)"
+
+if is_inactive "$out"; then
+  # Where lisa-secrets-access lives depends on how the project receives Lisa.
+  # Claude and Codex get it as an installed plugin, which is not part of a clone;
+  # the agent skill directories and node_modules are what a fresh checkout
+  # actually has. Same search order as the remote-env setup script, including the
+  # `plugins/` rung that exists only in the Lisa monorepo itself.
+  repo_root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+  resolver=""
+  for candidate in \
+    "$repo_root/.claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.codex/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs"; do
+    if [[ -f "$candidate" ]]; then
+      resolver="$candidate"
+      break
+    fi
+  done
+
+  if [[ -n "$resolver" ]] && command -v node >/dev/null 2>&1; then
+    token="$(resolve_secret "$resolver" SONARQUBE_CLI_TOKEN)"
+    if [[ -n "$token" ]]; then
+      # Exported into this process only. Writing it anywhere durable would create
+      # a second live copy of a credential whose single store is the provider —
+      # see the one-store rule in lisa-secrets-access.
+      export SONARQUBE_CLI_TOKEN="$token"
+      org="$(resolve_secret "$resolver" SONARQUBE_CLI_ORG)"
+      [[ -n "$org" ]] && export SONARQUBE_CLI_ORG="$org"
+      out="$(run_scanner)"
+    fi
+    unset token org
+  fi
+fi
+
+if is_inactive "$out"; then
+  # stderr on a zero exit is advisory in every agent's hook protocol: the user
+  # sees it, the operation proceeds.
+  echo "sonar: local secret scanning is inactive (no token in the environment," >&2
+  echo "  the OS keychain, or the configured secrets provider). Continuing —" >&2
+  echo "  commit-time and CI secret scanning still gate this repository." >&2
+  echo "  To restore it: 'sonar auth login', or store SONARQUBE_CLI_TOKEN in" >&2
+  echo "  the project's secrets provider." >&2
+  exit 0
+fi
+
+[[ -n "$out" ]] && printf '%s' "$out"
+exit 0