@codyswann/lisa 4.80.1 → 4.81.0

package/README.md

@@ -189,9 +189,12 @@ manifests remain unverified; this diagnostic is not a full lockfile audit.
 Clean TypeScript and CDK hosts receive the shared Node 24.21.0 LTS baseline,
 Vitest and coverage-v8 4.1.11 minimums, and a Vite 8.3.2 minimum within Vite 8.
 Lisa retains the TypeScript 6, ESLint 9, Knip 5, Husky 8 and Vitest 4 families.
-New CDK hosts default to `aws-cdk-github-oidc ^5.2.0` with `constructs ^10.7.2`
-minimum peers. Existing OIDC dependency choices stay host-owned, including exact
-5.2.0 and legacy v2 pins. Before migrating a v2 host, review the vendor’s
+CDK applies force `constructs ^10.7.2` and default `aws-cdk-lib`, which satisfy
+the peers of `aws-cdk-github-oidc` 5.2.0. Lisa does not add opt-in construct
+libraries such as `aws-cdk-github-oidc` or `@aws-cdk/aws-amplify-alpha`: an app
+that imports one declares it, and a host that removes an unused one keeps it
+removed on the next apply. Existing declarations stay host-owned, including
+exact 5.2.0 and legacy v2 OIDC pins. Before migrating a v2 host, review the vendor’s
 [versioned API](https://unpkg.com/aws-cdk-github-oidc@5.2.0/API.md)
 and update its application trust configuration deliberately. Lisa generates no
 OIDC constructs and does not migrate application IAM policies.

package/all/copy-contents/gitignore

@@ -249,6 +249,11 @@ expo-env.d.ts
 # /lisa:automation-status. Runbooks are project knowledge; run records are not.
 .lisa/automations/runs/
 
+# Session-manager machine state (the ledger of workers this machine spawned,
+# its session log). Per machine by construction; the manager's runbook under
+# .lisa/automations/ stays trackable.
+.lisa/session-manager/
+
 # Proof that `lisa apply` completed in THIS checkout, read by `lisa doctor` to
 # report a repo that has silently stopped receiving templates. Machine-local by
 # construction: committing it would churn on every version bump, conflict

package/cdk/package-lisa/package.lisa.json

@@ -51,8 +51,6 @@
   },
   "defaults": {
     "dependencies": {
-      "aws-cdk-github-oidc": "^5.2.0",
-      "@aws-cdk/aws-amplify-alpha": "^2.272.0-alpha.0",
       "aws-cdk-lib": "2.272.0"
     },
     "engines": {

package/dist/cli/doctor-cdk-preset-adoption.js

@@ -187,8 +187,8 @@ const REMEDY = "Nothing here is removed automatically: the repository may since
     "to depend on something the preset delivered. Decide per file, then keep " +
     `the decision by making sure no \`${CDK_APP_MARKER}\` is present — while ` +
     "one is, every apply re-merges the preset's current forced entries. " +
-    "OIDC dependency choices and existing bins are host-owned; current applies " +
-    "do not remove legacy entries";
+    "Construct-library dependency choices (OIDC, Amplify alpha) and existing " +
+    "bins are host-owned; current applies neither add nor remove them";
 /**
  * The consequence worth stating, because it is the one that reports success.
  */

package/dist/cli/doctor-cdk-preset-adoption.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-cdk-preset-adoption.js","sourceRoot":"","sources":["../../src/cli/doctor-cdk-preset-adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAGxC,kEAAkE;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CACxB,WAAmB,EACnB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1D;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1D;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mBAAmB,YAAY,KAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;IACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,MAAe;IAEf,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA4B,CAAC,GAAG;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM;QACN,OAAO,EAAE,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAiB;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,QAGd,CAAC;IACF,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;QACrE,CAAC,CAAE,MAAM,CAAC,YAAwC;QAClD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAClD,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,YAAY,CAC7B,CAAC;IACF,MAAM,GAAG,GACP,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;QACnD,CAAC,CAAE,MAAM,CAAC,GAA+B;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,MAAM,CAAC,MAAM,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,CAAC;YACxE,CAAC,CAAC,EAAE;QACN,8BAA8B,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,GAAG,CACrE,IAAI,CAAC,EAAE,CAAC,4BAA4B,IAAI,eAAe,CACxD;QACD,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,MAAM;YAC5D,CAAC,CAAC;gBACE,kBAAkB,oBAAoB,CAAC,IAAI,uBAAuB;oBAChE,KAAK,oBAAoB,CAAC,MAAM,IAAI;aACvC;YACH,CAAC,CAAC,EAAE;KACP,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GACV,4EAA4E;IAC5E,0EAA0E;IAC1E,oCAAoC,cAAc,wBAAwB;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,8BAA8B,CAAC;AAEjC;;GAEG;AACH,MAAM,iBAAiB,GACrB,wEAAwE;IACxE,4EAA4E;IAC5E,mDAAmD,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,4DAA4D;gBAC5D,uBACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,sEAAsE;gBACtE,uCAAuC;SAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CAAC,WAAmB;IACvC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,wDAAwD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QACzC,eAAe;QACf,YAAY;QACZ,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,gDAAgD,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,2DAA2D;gBAC3D,GAAG,cAAc,oDAAoD;gBACrE,oEAAoE;gBACpE,mCAAmC,cAAc,mBAAmB;gBACpE,gCAAgC,iBAAiB,CAAC,WAAW,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,gBAAgB,CACtB,eAAe,EACf,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,IAAI,EACR,MAAM,aAAa,CAAC,WAAW,CAAC,CACjC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,qBAAqB,CAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAClD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,8CAA8C,YAAY,aAAa;gBACrE,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,eAAkC,EAClC,YAA2B,EAC3B,SAA4B;IAE5B,MAAM,GAAG,GACP,YAAY,KAAK,IAAI;QACnB,CAAC,CAAC,eAAe,cAAc,wCAAwC;YACrE,YAAY;QACd,CAAC,CAAC,OAAO,cAAc,8BAA8B;YACnD,MAAM,YAAY,gDAAgD;YAClE,mDAAmD,CAAC;IAC1D,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,CACL,kEAAkE;QAClE,mBAAmB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QACpE,GAAG,GAAG,IAAI,MAAM,IAAI,iBAAiB,KAAK,MAAM,EAAE,CACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,EAAE,CAAC,MAAc;IACxB,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"doctor-cdk-preset-adoption.js","sourceRoot":"","sources":["../../src/cli/doctor-cdk-preset-adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAGxC,kEAAkE;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAE,KAA4B,CAAC,IAAI;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CACxB,WAAmB,EACnB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1D;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,YAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,kBAAkB,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,EAC1D;YACE,KAAK,EAAE,KAAK;SACb,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAmB,EACnB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mBAAmB,YAAY,KAC7B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CACnC,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CACzE,CAAC;IACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,MAAe;IAEf,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA4B,CAAC,GAAG;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM;QACN,OAAO,EAAE,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAiB;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,QAGd,CAAC;IACF,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI;QACrE,CAAC,CAAE,MAAM,CAAC,YAAwC;QAClD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAClD,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,YAAY,CAC7B,CAAC;IACF,MAAM,GAAG,GACP,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;QACnD,CAAC,CAAE,MAAM,CAAC,GAA+B;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,MAAM,CAAC,MAAM,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,YAAY,EAAE,CAAC;YACxE,CAAC,CAAC,EAAE;QACN,8BAA8B,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,GAAG,CACrE,IAAI,CAAC,EAAE,CAAC,4BAA4B,IAAI,eAAe,CACxD;QACD,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,oBAAoB,CAAC,MAAM;YAC5D,CAAC,CAAC;gBACE,kBAAkB,oBAAoB,CAAC,IAAI,uBAAuB;oBAChE,KAAK,oBAAoB,CAAC,MAAM,IAAI;aACvC;YACH,CAAC,CAAC,EAAE;KACP,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,MAAM,GACV,4EAA4E;IAC5E,0EAA0E;IAC1E,oCAAoC,cAAc,wBAAwB;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,kEAAkE,CAAC;AAErE;;GAEG;AACH,MAAM,iBAAiB,GACrB,wEAAwE;IACxE,4EAA4E;IAC5E,mDAAmD,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,qBAAqB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,4DAA4D;gBAC5D,uBACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,sEAAsE;gBACtE,uCAAuC;SAC1C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CAAC,WAAmB;IACvC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC,wDAAwD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QACzC,eAAe;QACf,YAAY;QACZ,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,gDAAgD,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,2DAA2D;gBAC3D,GAAG,cAAc,oDAAoD;gBACrE,oEAAoE;gBACpE,mCAAmC,cAAc,mBAAmB;gBACpE,gCAAgC,iBAAiB,CAAC,WAAW,EAAE,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,8BAA8B;QACpC,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,gBAAgB,CACtB,eAAe,EACf,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,IAAI,EACR,MAAM,aAAa,CAAC,WAAW,CAAC,CACjC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,qBAAqB,CAC1B,MAAM,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAClD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,8CAA8C,YAAY,aAAa;gBACrE,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,eAAkC,EAClC,YAA2B,EAC3B,SAA4B;IAE5B,MAAM,GAAG,GACP,YAAY,KAAK,IAAI;QACnB,CAAC,CAAC,eAAe,cAAc,wCAAwC;YACrE,YAAY;QACd,CAAC,CAAC,OAAO,cAAc,8BAA8B;YACnD,MAAM,YAAY,gDAAgD;YAClE,mDAAmD,CAAC;IAC1D,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,CACL,kEAAkE;QAClE,mBAAmB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QACpE,GAAG,GAAG,IAAI,MAAM,IAAI,iBAAiB,KAAK,MAAM,EAAE,CACnD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,EAAE,CAAC,MAAc;IACxB,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxE,CAAC"}

package/dist/cli/doctor-session-manager-trust.d.ts

@@ -0,0 +1,62 @@
+/** A parsed JSON object (config or settings file). */
+export type JsonRecord = Record<string, unknown>;
+/** One finding; the check reports the worst status of all of them. */
+export interface Finding {
+    readonly status: "warn" | "fail";
+    readonly text: string;
+}
+/** Returns a repo's visibility (`PUBLIC`, `PRIVATE`, `INTERNAL`) or throws. */
+export type RepoVisibilityProbe = (repo: string) => Promise<string>;
+/**
+ * Ask `gh` for a repository's visibility.
+ * @param repo - `owner/name`
+ * @returns Visibility as `gh` prints it
+ */
+export declare const ghRepoVisibility: RepoVisibilityProbe;
+/**
+ * Whether a value is a plain JSON object.
+ * @param value - Candidate value
+ * @returns True for `{}`-shaped values
+ */
+export declare function isRecord(value: unknown): value is JsonRecord;
+/**
+ * Whether an error means "file does not exist".
+ * @param error - Thrown value
+ * @returns True for ENOENT
+ */
+export declare function isMissing(error: unknown): boolean;
+/**
+ * Read and parse a JSON object file, or undefined when it does not exist.
+ * @param read - Text reader
+ * @param file - Absolute path
+ * @returns The parsed object, or undefined when absent
+ */
+export declare function readJson(read: (file: string) => Promise<string>, file: string): Promise<JsonRecord | undefined>;
+/**
+ * The file's mode, or undefined when it does not exist. Never reads contents.
+ * @param statFile - Mode reader
+ * @param file - Absolute path
+ * @returns Mode bits, or undefined
+ */
+export declare function modeOf(statFile: (file: string) => Promise<{
+    readonly mode: number;
+}>, file: string): Promise<number | undefined>;
+/**
+ * Fail for a public GitHub repo whose manager would dispatch any author's
+ * item; warn when visibility cannot be determined.
+ * @param config - Merged top-level config (`tracker`, `github`)
+ * @param block - Merged `sessionManager` block
+ * @param probe - Visibility probe, or `undefined` in offline mode, where no
+ *   network call may be made
+ * @returns Findings
+ */
+export declare function trustFindings(config: JsonRecord, block: JsonRecord, probe: RepoVisibilityProbe | undefined): Promise<readonly Finding[]>;
+/**
+ * Warn for every project-scope settings file that enables the plugin.
+ * @param root - Project root
+ * @param block - Merged `sessionManager` block
+ * @param read - Text reader
+ * @returns Findings
+ */
+export declare function projectPluginFindings(root: string, block: JsonRecord, read: (file: string) => Promise<string>): Promise<readonly Finding[]>;
+//# sourceMappingURL=doctor-session-manager-trust.d.ts.map

package/dist/cli/doctor-session-manager-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-session-manager-trust.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-session-manager-trust.ts"],"names":[],"mappings":"AAuBA,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAWpE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,mBAO9B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9D,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CA4C7B;AAsBD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACtC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAc7B"}

package/dist/cli/doctor-session-manager-trust.js

@@ -0,0 +1,174 @@
+/**
+ * Trust findings for the session-manager doctor check (#4448), plus the file
+ * and JSON helpers both halves of the check share.
+ *
+ * The manager dispatches Ready items to workers that run with permissions
+ * bypassed, so whoever can write an item effectively runs commands on the
+ * operator's machine. On a public GitHub repository that is anyone, unless
+ * `sessionManager.trustedAuthorIds` limits dispatch to known authors; that
+ * combination is a `fail`, not a warning. Visibility comes from an injected
+ * probe (`gh repo view <repo> --json visibility` by default); when it cannot
+ * run, the check warns and says why rather than guessing either way. Under
+ * `lisa doctor --offline` the probe is never run (it is a network call) and the
+ * check warns that visibility was not checked.
+ *
+ * The Telegram plugin must be enabled only through the manager's own
+ * `--settings`. Enabled in a project-scope settings file (at the root or in a
+ * routed child repo, where workers start), every session there would start a
+ * poller and take the bot away from the manager.
+ */
+import { execFile } from "node:child_process";
+import * as path from "node:path";
+import { promisify } from "node:util";
+const PLUGIN_ID = "telegram@claude-plugins-official";
+const SETTINGS_FILES = ["settings.json", "settings.local.json"];
+const DEFAULT_REPOS_ROOT = "projects";
+/** A child-repo key that cannot climb out of the repos root. */
+const SAFE_KEY = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
+const PROBE_TIMEOUT_MS = 15_000;
+const execFileAsync = promisify(execFile);
+/**
+ * Ask `gh` for a repository's visibility.
+ * @param repo - `owner/name`
+ * @returns Visibility as `gh` prints it
+ */
+export const ghRepoVisibility = async (repo) => {
+    const { stdout } = await execFileAsync("gh", ["repo", "view", repo, "--json", "visibility", "-q", ".visibility"], { timeout: PROBE_TIMEOUT_MS });
+    return stdout.trim();
+};
+/**
+ * Whether a value is a plain JSON object.
+ * @param value - Candidate value
+ * @returns True for `{}`-shaped values
+ */
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Whether an error means "file does not exist".
+ * @param error - Thrown value
+ * @returns True for ENOENT
+ */
+export function isMissing(error) {
+    return error?.code === "ENOENT";
+}
+/**
+ * Read and parse a JSON object file, or undefined when it does not exist.
+ * @param read - Text reader
+ * @param file - Absolute path
+ * @returns The parsed object, or undefined when absent
+ */
+export async function readJson(read, file) {
+    try {
+        const parsed = JSON.parse(await read(file));
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch (error) {
+        if (isMissing(error))
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * The file's mode, or undefined when it does not exist. Never reads contents.
+ * @param statFile - Mode reader
+ * @param file - Absolute path
+ * @returns Mode bits, or undefined
+ */
+export async function modeOf(statFile, file) {
+    try {
+        return (await statFile(file)).mode;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Fail for a public GitHub repo whose manager would dispatch any author's
+ * item; warn when visibility cannot be determined.
+ * @param config - Merged top-level config (`tracker`, `github`)
+ * @param block - Merged `sessionManager` block
+ * @param probe - Visibility probe, or `undefined` in offline mode, where no
+ *   network call may be made
+ * @returns Findings
+ */
+export async function trustFindings(config, block, probe) {
+    // An empty list filters no author, so it counts as unset here.
+    const trusted = block.trustedAuthorIds;
+    if (config.tracker !== "github" ||
+        (Array.isArray(trusted) && trusted.length > 0)) {
+        return [];
+    }
+    const github = isRecord(config.github) ? config.github : {};
+    if (typeof github.org !== "string" || typeof github.repo !== "string") {
+        return [];
+    }
+    const repo = `${github.org}/${github.repo}`;
+    if (probe === undefined) {
+        return [
+            {
+                status: "warn",
+                text: `${repo} visibility not checked (offline); if it is public, set sessionManager.trustedAuthorIds before starting the manager`,
+            },
+        ];
+    }
+    const visibility = await probe(repo).then(value => ({ value: value.toUpperCase(), why: undefined }), (error) => ({
+        value: undefined,
+        why: error instanceof Error ? error.message : String(error),
+    }));
+    if (visibility.why !== undefined) {
+        return [
+            {
+                status: "warn",
+                text: `could not read the visibility of ${repo} (${visibility.why}); if it is public, set sessionManager.trustedAuthorIds before starting the manager`,
+            },
+        ];
+    }
+    if (visibility.value !== "PUBLIC")
+        return [];
+    return [
+        {
+            status: "fail",
+            text: `${repo} is public and sessionManager.trustedAuthorIds is not set, so anyone can write a Ready item that a bypass-permissions worker runs; set trustedAuthorIds to the tracker user IDs allowed to author dispatched work`,
+        },
+    ];
+}
+/**
+ * Directories whose project-scope settings a manager or worker loads: the
+ * root, plus each routed child repo.
+ * @param root - Project root
+ * @param block - Merged `sessionManager` block
+ * @returns Absolute directories
+ */
+function settingsDirs(root, block) {
+    const repos = isRecord(block.repos) ? block.repos : {};
+    const entries = isRecord(repos.entries) ? repos.entries : {};
+    const reposRoot = typeof repos.root === "string" ? repos.root : DEFAULT_REPOS_ROOT;
+    const base = path.resolve(root);
+    const children = Object.keys(entries)
+        .filter(key => SAFE_KEY.test(key))
+        .map(key => path.resolve(base, reposRoot, key))
+        .filter(dir => dir.startsWith(`${base}${path.sep}`));
+    return [base, ...children];
+}
+/**
+ * Warn for every project-scope settings file that enables the plugin.
+ * @param root - Project root
+ * @param block - Merged `sessionManager` block
+ * @param read - Text reader
+ * @returns Findings
+ */
+export async function projectPluginFindings(root, block, read) {
+    const files = settingsDirs(root, block).flatMap(dir => SETTINGS_FILES.map(name => path.join(dir, ".claude", name)));
+    const enabled = await Promise.all(files.map(async (file) => {
+        const plugins = (await readJson(read, file))?.enabledPlugins;
+        return isRecord(plugins) && plugins[PLUGIN_ID] === true ? [file] : [];
+    }));
+    return enabled.flat().map(file => ({
+        status: "warn",
+        text: `${PLUGIN_ID} is enabled in project settings ${file}, so every session there polls the bot; remove it (the manager enables it for itself)`,
+    }));
+}
+//# sourceMappingURL=doctor-session-manager-trust.js.map

package/dist/cli/doctor-session-manager-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-session-manager-trust.js","sourceRoot":"","sources":["../../src/cli/doctor-session-manager-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AActC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,cAAc,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAU,CAAC;AACzE,MAAM,kBAAkB,GAAG,UAAU,CAAC;AACtC,gEAAgE;AAChE,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AACjD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,KAAK,EAAC,IAAI,EAAC,EAAE;IAChE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,IAAI,EACJ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,EACnE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC9B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAuC,EACvC,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAA8D,EAC9D,IAAY;IAEZ,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,KAAiB,EACjB,KAAsC;IAEtC,+DAA+D;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC;IACvC,IACE,MAAM,CAAC,OAAO,KAAK,QAAQ;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,GAAG,IAAI,qHAAqH;aACnI;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACvC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EACzD,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;QACnB,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC5D,CAAC,CACH,CAAC;IACF,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,oCAAoC,IAAI,KAAK,UAAU,CAAC,GAAG,qFAAqF;aACvJ;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO;QACL;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,IAAI,mNAAmN;SACjO;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,KAAiB;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAClC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;SAC9C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,KAAiB,EACjB,IAAuC;IAEvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CACpD,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrB,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC;QAC7D,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,GAAG,SAAS,mCAAmC,IAAI,uFAAuF;KACjJ,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/cli/doctor-session-manager.d.ts

@@ -0,0 +1,35 @@
+import type { DoctorCheck } from "./doctor.js";
+import { type RepoVisibilityProbe } from "./doctor-session-manager-trust.js";
+/** Managed settings outrank `--settings`, so they can undo the manager's. */
+export declare const DEFAULT_MANAGED_SETTINGS_PATHS: readonly string[];
+/** Collaborators for the session-manager doctor check. */
+export interface SessionManagerDoctorDependencies {
+    /** Environment doctor runs in; also the source of HOME by default. */
+    readonly env: NodeJS.ProcessEnv;
+    /** Home directory; defaults to `env.HOME`, then `os.homedir()`. */
+    readonly home?: string;
+    /** Text reader for JSON config and settings files. */
+    readonly readFile?: (file: string) => Promise<string>;
+    /** Mode reader for token files; never reads their contents. */
+    readonly stat?: (file: string) => Promise<{
+        readonly mode: number;
+    }>;
+    /** Managed-settings files to inspect, in precedence order. */
+    readonly managedSettingsPaths?: readonly string[];
+    /** Repo visibility probe; defaults to `gh repo view --json visibility`. */
+    readonly probeRepoVisibility?: RepoVisibilityProbe;
+}
+/** The doctor options this check honours. */
+export interface SessionManagerDoctorOptions {
+    /** `lisa doctor --offline`: skip the visibility probe, a network call. */
+    readonly offline?: boolean;
+}
+/**
+ * Check Telegram isolation for a configured session manager.
+ * @param targetPath - Project root
+ * @param deps - Injected environment, HOME and file access
+ * @param options - Doctor options; `offline` skips the visibility probe
+ * @returns Doctor check result
+ */
+export declare function checkSessionManagerIsolation(targetPath: string, deps: SessionManagerDoctorDependencies, options?: SessionManagerDoctorOptions): Promise<DoctorCheck>;
+//# sourceMappingURL=doctor-session-manager.d.ts.map

package/dist/cli/doctor-session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-session-manager.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-session-manager.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAEL,KAAK,mBAAmB,EAOzB,MAAM,mCAAmC,CAAC;AAY3C,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAG3D,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,gCAAgC;IAC/C,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,8DAA8D;IAC9D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,2EAA2E;IAC3E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD;AAED,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAwID;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,gCAAgC,EACtC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,WAAW,CAAC,CA+DtB"}

package/dist/cli/doctor-session-manager.js

@@ -0,0 +1,209 @@
+/**
+ * Doctor check for the session manager's Telegram isolation (#4448).
+ *
+ * The manager is the only Claude session that may poll the project's Telegram
+ * bot. Two sessions polling one bot steal each other's messages, and a worker
+ * that inherits the token can impersonate the manager. Setup and `start`
+ * enforce isolation when they run; this check catches drift afterwards: a
+ * plugin later enabled at user scope, a token copied into the shared default
+ * dir, a token exported from a shell profile, a loosened file mode, or managed
+ * settings that override the manager's `crossSessionInbound: accept`. Trust
+ * findings (a public repo without `trustedAuthorIds`, the plugin enabled in
+ * project-scope settings) live in `doctor-session-manager-trust`.
+ *
+ * Gated on a `sessionManager` block in the merged config (the Kane model): a
+ * project that never opted in gets `ok` / "not configured" and nothing is read
+ * under HOME. Token files are only ever `stat`-ed, never read, so the token
+ * value cannot reach the detail text; environment values are reported by name
+ * only. HOME, env, file reads and managed-settings paths are injectable so
+ * tests never touch the operator's real `~/.claude`.
+ */
+import { readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { ghRepoVisibility, isRecord, modeOf, projectPluginFindings, readJson, trustFindings, } from "./doctor-session-manager-trust.js";
+import { mergeSessionManagerBlocks } from "./session-manager-config-merge.js";
+const CHECK_NAME = "Session manager Telegram isolation?";
+const PLUGIN_ID = "telegram@claude-plugins-official";
+const TOKEN_FILE = ".env";
+const ENV_NAMES = ["TELEGRAM_BOT_TOKEN", "TELEGRAM_STATE_DIR"];
+/** Group + other permission bits are the low six bits of a file mode. */
+const GROUP_OTHER_SPAN = 0o100;
+/** All permission bits (owner, group, other) are the low nine. */
+const PERMISSION_SPAN = 0o1000;
+/** Managed settings outrank `--settings`, so they can undo the manager's. */
+export const DEFAULT_MANAGED_SETTINGS_PATHS = [
+    "/Library/Application Support/ClaudeCode/managed-settings.json",
+    "/etc/claude-code/managed-settings.json",
+];
+/**
+ * Resolve the configured state dir to an absolute path, expanding `~`.
+ * @param raw - Configured `notify.stateDir`
+ * @param home - Home directory
+ * @param projectRoot - Base for a relative path
+ * @returns Absolute path, or undefined when unset
+ */
+function resolveStateDir(raw, home, projectRoot) {
+    if (typeof raw !== "string" || raw.trim() === "")
+        return undefined;
+    const dir = raw.trim();
+    if (dir === "~")
+        return home;
+    if (dir.startsWith("~/"))
+        return path.resolve(home, dir.slice(2));
+    return path.resolve(projectRoot, dir);
+}
+/**
+ * Findings about the configured per-project state dir and its token file.
+ * @param ctx - Resolved inputs
+ * @param stateDir - Absolute state dir, or undefined when unset
+ * @returns Findings
+ */
+async function stateDirFindings(ctx, stateDir) {
+    if (stateDir === undefined) {
+        return [
+            {
+                status: "fail",
+                text: "sessionManager.notify.stateDir is not set; run /lisa:setup:session-manager to give this project its own Telegram state dir",
+            },
+        ];
+    }
+    if (stateDir === ctx.sharedDir) {
+        return [
+            {
+                status: "fail",
+                text: `notify.stateDir is the shared default ${ctx.sharedDir}, so every Telegram session on this machine would poll one bot; point it at a per-project dir such as ${ctx.sharedDir}-<project>`,
+            },
+        ];
+    }
+    const tokenFile = path.join(stateDir, TOKEN_FILE);
+    const mode = await modeOf(ctx.statFile, tokenFile);
+    if (mode === undefined) {
+        return [
+            {
+                status: "warn",
+                text: `token file ${tokenFile} is missing, so the manager cannot start; store the bot token with /lisa:setup:session-manager`,
+            },
+        ];
+    }
+    if (mode % GROUP_OTHER_SPAN === 0)
+        return [];
+    const octal = (mode % PERMISSION_SPAN).toString(8).padStart(3, "0");
+    return [
+        {
+            status: "warn",
+            text: `token file ${tokenFile} has mode 0${octal}, open to other users; run chmod 600 ${tokenFile}`,
+        },
+    ];
+}
+/**
+ * Findings about the user-scope plugin and the shared default token file.
+ * @param ctx - Resolved inputs
+ * @returns Findings
+ */
+async function userScopeFindings(ctx) {
+    const settings = await readJson(ctx.read, path.join(ctx.claudeDir, "settings.json"));
+    const plugins = settings?.enabledPlugins;
+    const sharedToken = path.join(ctx.sharedDir, TOKEN_FILE);
+    return [
+        ...(isRecord(plugins) && plugins[PLUGIN_ID] === true
+            ? [
+                {
+                    status: "warn",
+                    text: `${PLUGIN_ID} is enabled at user scope, so every Claude session polls the bot; run claude plugin disable ${PLUGIN_ID} -s user (the manager enables it for itself)`,
+                },
+            ]
+            : []),
+        ...((await modeOf(ctx.statFile, sharedToken)) === undefined
+            ? []
+            : [
+                {
+                    status: "warn",
+                    text: `a token file exists in the shared default dir (${sharedToken}); move it to the per-project state dir and delete it`,
+                },
+            ]),
+    ];
+}
+/**
+ * Findings about the shell environment and managed settings.
+ * @param ctx - Resolved inputs
+ * @returns Findings
+ */
+async function environmentFindings(ctx) {
+    const exported = ENV_NAMES.filter(name => (ctx.env[name] ?? "") !== "").map(name => ({
+        status: "warn",
+        text: `${name} is set in this shell's environment, so workers may inherit it; remove the export from your shell profile`,
+    }));
+    const managed = await Promise.all(ctx.managedPaths.map(async (file) => ({
+        file,
+        inbound: (await readJson(ctx.read, file))?.crossSessionInbound,
+    })));
+    const held = managed
+        .filter(({ inbound }) => inbound !== undefined && inbound !== "accept")
+        .map(({ file, inbound }) => ({
+        status: "warn",
+        text: `managed settings ${file} set crossSessionInbound to ${JSON.stringify(inbound)}, which outranks the manager's "accept", so worker messages would be held`,
+    }));
+    return [...exported, ...held];
+}
+/**
+ * Check Telegram isolation for a configured session manager.
+ * @param targetPath - Project root
+ * @param deps - Injected environment, HOME and file access
+ * @param options - Doctor options; `offline` skips the visibility probe
+ * @returns Doctor check result
+ */
+export async function checkSessionManagerIsolation(targetPath, deps, options = {}) {
+    const read = deps.readFile ?? (file => fsReadFile(file, "utf8"));
+    try {
+        const committed = await readJson(read, path.join(targetPath, ".lisa.config.json"));
+        const local = await readJson(read, path.join(targetPath, ".lisa.config.local.json"));
+        const block = mergeSessionManagerBlocks(committed, local);
+        if (block === undefined) {
+            return { name: CHECK_NAME, status: "ok", detail: "not configured" };
+        }
+        const home = deps.home ?? deps.env.HOME ?? os.homedir();
+        const claudeDir = deps.env.CLAUDE_CONFIG_DIR
+            ? path.resolve(deps.env.CLAUDE_CONFIG_DIR)
+            : path.join(home, ".claude");
+        const ctx = {
+            claudeDir,
+            sharedDir: path.join(claudeDir, "channels", "telegram"),
+            env: deps.env,
+            read,
+            statFile: deps.stat ?? fsStat,
+            managedPaths: deps.managedSettingsPaths ?? DEFAULT_MANAGED_SETTINGS_PATHS,
+        };
+        const notify = isRecord(block.notify) ? block.notify : {};
+        const stateDir = resolveStateDir(notify.stateDir, home, targetPath);
+        const findings = [
+            ...(await stateDirFindings(ctx, stateDir)),
+            ...(await userScopeFindings(ctx)),
+            ...(await environmentFindings(ctx)),
+            ...(await projectPluginFindings(targetPath, block, read)),
+            ...(await trustFindings({ ...committed, ...local }, block, options.offline === true
+                ? undefined
+                : (deps.probeRepoVisibility ?? ghRepoVisibility))),
+        ];
+        if (findings.length === 0) {
+            return {
+                name: CHECK_NAME,
+                status: "ok",
+                detail: `isolated: per-project state dir ${String(stateDir)}, token file mode 0600 or tighter, plugin not enabled at user scope`,
+            };
+        }
+        return {
+            name: CHECK_NAME,
+            status: findings.some(f => f.status === "fail") ? "fail" : "warn",
+            detail: findings.map(f => f.text).join("; "),
+        };
+    }
+    catch (error) {
+        return {
+            name: CHECK_NAME,
+            status: "warn",
+            detail: `could not evaluate session-manager isolation: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+//# sourceMappingURL=doctor-session-manager.js.map

package/dist/cli/doctor-session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-session-manager.js","sourceRoot":"","sources":["../../src/cli/doctor-session-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAGL,gBAAgB,EAChB,QAAQ,EACR,MAAM,EACN,qBAAqB,EACrB,QAAQ,EACR,aAAa,GACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAU,CAAC;AACxE,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,kEAAkE;AAClE,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,+DAA+D;IAC/D,wCAAwC;CACzC,CAAC;AAkCF;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,GAAY,EACZ,IAAY,EACZ,WAAmB;IAEnB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAA4B;IAE5B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,4HAA4H;aACnI;SACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yCAAyC,GAAG,CAAC,SAAS,yGAAyG,GAAG,CAAC,SAAS,YAAY;aAC/L;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,cAAc,SAAS,gGAAgG;aAC9H;SACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,GAAG,gBAAgB,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,OAAO;QACL;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,cAAc,SAAS,cAAc,KAAK,wCAAwC,SAAS,EAAE;SACpG;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAY;IAC3C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,GAAG,CAAC,IAAI,EACR,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAC1C,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,EAAE,cAAc,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI;YAClD,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,MAAe;oBACvB,IAAI,EAAE,GAAG,SAAS,+FAA+F,SAAS,8CAA8C;iBACzK;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,KAAK,SAAS;YACzD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,MAAe;oBACvB,IAAI,EAAE,kDAAkD,WAAW,uDAAuD;iBAC3H;aACF,CAAC;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAY;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CACzE,IAAI,CAAC,EAAE,CAAC,CAAC;QACP,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,GAAG,IAAI,2GAA2G;KACzH,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC;QAClC,IAAI;QACJ,OAAO,EAAE,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,mBAAmB;KAC/D,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,OAAO;SACjB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC;SACtE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,MAAe;QACvB,IAAI,EAAE,oBAAoB,IAAI,+BAA+B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,2EAA2E;KAChK,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,UAAkB,EAClB,IAAsC,EACtC,UAAuC,EAAE;IAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAC9B,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAC3C,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAC1B,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC,CACjD,CAAC;QACF,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAY;YACnB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC;YACvD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;YAC7B,YAAY,EAAE,IAAI,CAAC,oBAAoB,IAAI,8BAA8B;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1C,GAAG,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACjC,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,qBAAqB,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,aAAa,CACrB,EAAE,GAAG,SAAS,EAAE,GAAG,KAAK,EAAE,EAC1B,KAAK,EACL,OAAO,CAAC,OAAO,KAAK,IAAI;gBACtB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,CACnD,CAAC;SACH,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,mCAAmC,MAAM,CAAC,QAAQ,CAAC,qEAAqE;aACjI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACjE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iDACN,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAYnE,OAAO,EAEL,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAchC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAazD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mDAAmD;AACnD,KAAK,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAO3C,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IAChD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;CAC3D;AAyBD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAChD,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAyBtB;AA8JD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,EACtB,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC7C,OAAO,CAAC,YAAY,CAAC,CA0JvB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAanE,OAAO,EAEL,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAchC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAazD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mDAAmD;AACnD,KAAK,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAO3C,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,KAAK,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,mBAAmB,EAAE,OAAO,mBAAmB,CAAC;IAChD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;CAC3D;AAyBD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAChD,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CAyBtB;AA8JD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,aAAa,EACtB,YAAY,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC7C,OAAO,CAAC,YAAY,CAAC,CA4JvB"}

package/dist/cli/doctor.js

@@ -10,6 +10,7 @@ import { checkApplyFreshness, checkYamlRuntime, } from "./doctor-apply-freshness
 import { checkEnforcementCoverage } from "./doctor-enforcement-coverage.js";
 import { checkLockfileReconciliation } from "./doctor-reconciliation.js";
 import { checkKaneProvider } from "./doctor-kane.js";
+import { checkSessionManagerIsolation } from "./doctor-session-manager.js";
 import { checkLearningsLedger } from "./doctor-learnings-ledger.js";
 import { checkMergeDrivers } from "./doctor-merge-drivers.js";
 import { checkReadinessReportTracking } from "./doctor-readiness-tracking.js";
@@ -277,6 +278,8 @@ export async function runDoctor(targetPath, options, dependencies = {}) {
         await checkDeclaredContexts(resolvedTarget),
         await checkCodeRabbitProvider(resolvedTarget, deps),
         await checkKaneProvider(resolvedTarget, deps),
+        // Config-gated like Kane: "not configured" unless sessionManager is set.
+        await checkSessionManagerIsolation(resolvedTarget, deps, options),
         await checkSonarProvider(resolvedTarget, deps),
         await checkLegacyMonitorThresholds(resolvedTarget),
         await checkLisaOwnedArtifacts(resolvedTarget),