@codyswann/lisa 4.81.2 → 4.81.4

package/plugins/src/base/skills/lisa-session-manager/scripts/config.mjs

@@ -11,12 +11,12 @@
  * registry populates defaults into every project, and the manager starts
  * yolo-mode sessions; it must exist only where an operator wrote it.
  *
- * Pure apart from `detectRepos`, whose filesystem calls are injectable.
+ * Pure. Repo detection, which reads the filesystem, lives in repo-detect.mjs
+ * and is re-exported here so callers keep one import.
  * @module session-manager/config
  */
 
-import { existsSync, readdirSync } from "node:fs";
-import { isAbsolute, join, resolve, sep } from "node:path";
+import { isAbsolute, resolve, sep } from "node:path";
 
 import {
   mergeConfigLayers as mergeLayers,
@@ -25,6 +25,7 @@ import {
 } from "../../lisa-secrets-access/scripts/validate-config.mjs";
 
 export { parseLoopInterval, validateSessionManager };
+export { detectRepos, draftHints } from "./repo-detect.mjs";
 
 /**
  * Documented defaults for every optional key.
@@ -122,33 +123,6 @@ export function resolveSessionManagerConfig(globalConfig, localConfig) {
   };
 }
 
-/**
- * List the Lisa-configured child repos of a multi-repo project.
- *
- * A child counts only when it carries its own `.lisa.config.json`: workers run
- * `/lisa:implement` inside it, which needs that file, and a stray directory
- * under `projects/` is not something to route tickets into.
- * @param {string} root Project root.
- * @param {{
- *   reposRoot?: string,
- *   fs?: { existsSync: (p: string) => boolean,
- *     readdirSync: (p: string, o: { withFileTypes: true }) =>
- *       Array<{ name: string, isDirectory: () => boolean }> },
- * }} [options] Repos root (default `projects`) and filesystem seam.
- * @returns {string[]} Child directory names, sorted.
- */
-export function detectRepos(root, options = {}) {
-  const fs = options.fs ?? { existsSync, readdirSync };
-  const base = join(root, options.reposRoot ?? DEFAULT_REPOS_ROOT);
-  if (!fs.existsSync(base)) return [];
-  return fs
-    .readdirSync(base, { withFileTypes: true })
-    .filter(entry => entry.isDirectory() && SAFE_SEGMENT.test(entry.name))
-    .filter(entry => fs.existsSync(join(base, entry.name, ".lisa.config.json")))
-    .map(entry => entry.name)
-    .sort();
-}
-
 /**
  * Turn a project name into a slug the validator accepts.
  * @param {string} projectSlug Project name, possibly with dots or capitals.
@@ -177,13 +151,18 @@ function normalizeSlug(projectSlug) {
  * Defaults are written out rather than left implicit, so an operator sees
  * every knob in the file they will edit. With no detected repos the block has
  * no `repos` key, which is what makes a project single-repo. Each detected
- * repo's hints start as its own name: valid, and an obvious prompt to add real
- * ones.
- * @param {{ projectSlug: string, detectedRepos?: string[] }} input Project
- *   slug and the output of `detectRepos`.
+ * repo's hints are its drafted hints when given (`draftHints`), else its own
+ * name: valid either way, and setup asks the operator to review them.
+ * @param {{ projectSlug: string, detectedRepos?: string[],
+ *   hints?: Record<string, string[]> }} input Project slug, the output of
+ *   `detectRepos`, and drafted hints per repo.
  * @returns {SessionManagerBlock} A block `validateSessionManager` accepts.
  */
-export function buildDefaultBlock({ projectSlug, detectedRepos = [] }) {
+export function buildDefaultBlock({
+  projectSlug,
+  detectedRepos = [],
+  hints = {},
+}) {
   const slug = normalizeSlug(projectSlug);
   const repos = [...detectedRepos].sort();
   return {
@@ -194,7 +173,10 @@ export function buildDefaultBlock({ projectSlug, detectedRepos = [] }) {
           repos: {
             root: DEFAULT_REPOS_ROOT,
             entries: Object.fromEntries(
-              repos.map(name => [name, { hints: [name] }])
+              repos.map(name => [
+                name,
+                { hints: hints[name]?.length ? [...hints[name]] : [name] },
+              ])
             ),
           },
         }

package/plugins/src/base/skills/lisa-session-manager/scripts/launch.mjs

@@ -43,6 +43,7 @@ export {
   buildStoreTokenCommand,
   loadPromptSecret,
   storeToken,
+  storeTokenFromClipboard,
   validateBotToken,
   writeTokenFile,
 } from "./token.mjs";

package/plugins/src/base/skills/lisa-session-manager/scripts/repo-detect.mjs

@@ -0,0 +1,205 @@
+/**
+ * Which children of a multi-repo project's repos root are real, routable
+ * repos, and a first draft of the hints the manager routes on.
+ *
+ * A host's `projects/` dir collects more than one checkout per repo: linked
+ * worktrees agents made for a ticket (`.git` is a FILE pointing back at the
+ * main clone), and whole second clones of the same remote (`api-se1234`).
+ * Each carries the repo's own `.lisa.config.json`, so counting config files
+ * alone proposed 110 routed repos for a project with 4 (CodySwannGT/lisa#4465)
+ * and the operator had to prune them by hand. A worker routed into a stale
+ * ticket worktree builds on the wrong branch, so the detector keeps one
+ * checkout per remote: the one named after the repo when there is one.
+ *
+ * Every filesystem call goes through an injectable seam.
+ * @module session-manager/repo-detect
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/** One path segment that cannot climb out of, or hide inside, its parent. */
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/** `url = <value>` inside the `[remote "origin"]` section of a git config. */
+const ORIGIN_SECTION = /^\s*\[remote\s+"origin"\]\s*$/;
+const ANY_SECTION = /^\s*\[/;
+const URL_LINE = /^\s*url\s*=\s*(\S+)\s*$/;
+
+/**
+ * Well-known dependencies and the hint each one implies. Order is the order
+ * hints are listed in. A key ending in `/` matches every package under that
+ * scope.
+ */
+const DEPENDENCY_HINTS = Object.freeze([
+  ["@nestjs/", "NestJS"],
+  ["typeorm", "TypeORM"],
+  ["prisma", "Prisma"],
+  ["@prisma/client", "Prisma"],
+  ["@apollo/server", "GraphQL API"],
+  ["graphql", "GraphQL"],
+  ["express", "Express"],
+  ["fastify", "Fastify"],
+  ["serverless", "Serverless"],
+  ["expo", "Expo"],
+  ["react-native", "React Native"],
+  ["next", "Next.js"],
+  ["react", "React"],
+  ["vue", "Vue"],
+  ["@angular/core", "Angular"],
+  ["@apollo/client", "Apollo client"],
+  ["aws-cdk-lib", "AWS CDK"],
+  ["@pulumi/pulumi", "Pulumi"],
+  ["@langchain/langgraph", "LangGraph"],
+  ["@langchain/core", "LangChain"],
+  ["@anthropic-ai/sdk", "Claude API"],
+  ["@aws-sdk/client-bedrock-runtime", "Bedrock"],
+  ["phaser", "Phaser"],
+  ["@playwright/test", "Playwright"],
+]);
+
+/** The default filesystem seam. */
+const NODE_FS = { existsSync, readdirSync, readFileSync, statSync };
+
+/**
+ * Reduce a git remote URL to `host/owner/repo` so the SSH and HTTPS spellings
+ * of one remote compare equal. Returns null for anything unparseable.
+ * @param {string} url - Remote URL as written in `.git/config`
+ * @returns {string | null} Normalized identity, lowercased
+ */
+export function normalizeRemote(url) {
+  const trimmed = String(url ?? "").trim();
+  const scp = /^[^@/]+@([^:/]+):(.+)$/.exec(trimmed);
+  const parsed = scp
+    ? null
+    : /^[a-z+]+:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(trimmed);
+  const match = scp ?? parsed;
+  if (!match) return null;
+  const repoPath = match[2].replace(/\/+$/, "").replace(/\.git$/, "");
+  return repoPath ? `${match[1]}/${repoPath}`.toLowerCase() : null;
+}
+
+/**
+ * The `origin` URL from a clone's `.git/config`, or null.
+ * @param {string} dir - Child directory
+ * @param {typeof NODE_FS} fs - Filesystem seam
+ * @returns {string | null} Raw URL
+ */
+function readOrigin(dir, fs) {
+  let text;
+  try {
+    text = fs.readFileSync(join(dir, ".git", "config"), "utf8");
+  } catch {
+    return null;
+  }
+  let inOrigin = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (ANY_SECTION.test(line)) inOrigin = ORIGIN_SECTION.test(line);
+    const url = inOrigin ? URL_LINE.exec(line) : null;
+    if (url) return url[1];
+  }
+  return null;
+}
+
+/** The `gitdir:` line of a linked worktree points into `.git/worktrees/`. */
+const WORKTREE_GITDIR = /^gitdir:\s*\S*[\\/]worktrees[\\/]/m;
+
+/**
+ * Whether `<dir>` is a linked worktree: its `.git` is a file whose `gitdir:`
+ * points into another clone's `worktrees/`. A `.git` file that points
+ * anywhere else (a submodule, `--separate-git-dir`) may be the only checkout
+ * of its repo, so it is kept.
+ * @param {string} dir - Child directory
+ * @param {typeof NODE_FS} fs - Filesystem seam
+ * @returns {boolean} True for a linked worktree
+ */
+function isLinkedWorktree(dir, fs) {
+  const marker = join(dir, ".git");
+  try {
+    if (!fs.statSync(marker).isFile()) return false;
+    return WORKTREE_GITDIR.test(fs.readFileSync(marker, "utf8"));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Keep one child per remote: the one whose name is the remote's repo name,
+ * else the lexically first. Children with no readable origin are each kept.
+ * @param {Array<{ name: string, remote: string | null }>} children - Sorted
+ * @returns {string[]} Kept names, sorted
+ */
+function onePerRemote(children) {
+  const groups = new Map();
+  const kept = [];
+  for (const child of children) {
+    if (child.remote === null) kept.push(child.name);
+    else groups.set(child.remote, [...(groups.get(child.remote) ?? []), child]);
+  }
+  for (const [remote, members] of groups) {
+    const repoName = remote.split("/").at(-1);
+    const named = members.find(
+      member => member.name.toLowerCase() === repoName
+    );
+    kept.push((named ?? members[0]).name);
+  }
+  return kept.sort();
+}
+
+/**
+ * List the routable child repos of a multi-repo project.
+ *
+ * A child counts only when it carries its own `.lisa.config.json` (workers
+ * run `/lisa:implement` inside it, which needs that file), is not a linked
+ * worktree, and is the chosen checkout of its remote.
+ * @param {string} root - Project root
+ * @param {{ reposRoot?: string, fs?: Partial<typeof NODE_FS> }} [options] -
+ *   Repos root (default `projects`) and filesystem seam
+ * @returns {string[]} Child directory names, sorted
+ */
+export function detectRepos(root, options = {}) {
+  const fs = { ...NODE_FS, ...options.fs };
+  const base = join(root, options.reposRoot ?? "projects");
+  if (!fs.existsSync(base)) return [];
+  const children = fs
+    .readdirSync(base, { withFileTypes: true })
+    .filter(entry => entry.isDirectory() && SAFE_SEGMENT.test(entry.name))
+    .map(entry => ({ name: entry.name, dir: join(base, entry.name) }))
+    .filter(child => fs.existsSync(join(child.dir, ".lisa.config.json")))
+    .filter(child => !isLinkedWorktree(child.dir, fs))
+    .map(child => ({
+      name: child.name,
+      remote: normalizeRemote(readOrigin(child.dir, fs) ?? ""),
+    }))
+    .sort((a, b) => (a.name < b.name ? -1 : 1));
+  return onePerRemote(children);
+}
+
+/**
+ * Draft routing hints for one child: its name, then a hint per well-known
+ * dependency in its `package.json`. Only a draft; setup asks the operator to
+ * review it. A child with no `package.json`, or none of the known
+ * dependencies, keeps just its name.
+ * @param {string} dir - Child directory
+ * @param {string} name - Child name (always the first hint)
+ * @param {{ fs?: Partial<typeof NODE_FS> }} [options] - Filesystem seam
+ * @returns {string[]} Hints, de-duplicated, name first
+ */
+export function draftHints(dir, name, options = {}) {
+  const fs = { ...NODE_FS, ...options.fs };
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(join(dir, "package.json"), "utf8"));
+  } catch {
+    return [name];
+  }
+  const deps = Object.keys({
+    ...manifest?.dependencies,
+    ...manifest?.devDependencies,
+  });
+  const hints = DEPENDENCY_HINTS.filter(([key]) =>
+    key.endsWith("/")
+      ? deps.some(dep => dep.startsWith(key))
+      : deps.includes(key)
+  ).map(([, hint]) => hint);
+  return [...new Set([name, ...hints])];
+}

package/plugins/src/base/skills/lisa-session-manager/scripts/session-manager.mjs

@@ -18,11 +18,14 @@
  * background sessions (`claude --bg`, `claude agents`), cross-session
  * messaging and channels, which no other supported agent has. Codex, Cursor,
  * OpenCode, Antigravity, Copilot and Devin can run the setup-time subcommands
- * (init-config, store-token, validate, start), and `start` hosts a Claude Code
- * manager in tmux whatever agent ran it; they cannot run a manager cycle
+ * (init-config, store-token, trust-status, coexistence, validate, start), and
+ * `start` hosts a Claude Code manager in tmux whatever agent ran it. Note that
+ * trust-status reads Claude Code's own trust record, which is the one that
+ * matters: workers are always Claude Code. They cannot run a manager cycle
  * themselves. OpenCode copies skill folders without the plugin-level
- * `scripts/` directory, so `queue` and `record-cycle` (which import from it)
- * are unavailable there unless the npm package provides that directory.
+ * `scripts/` directory, and this entry point statically imports modules that
+ * reach into it (cli-cycle.mjs, cli-runtime.mjs), so on OpenCode every
+ * subcommand runs only from the npm package, never from the skill-folder copy.
  * @module session-manager
  */
 import { readFileSync, realpathSync } from "node:fs";
@@ -38,17 +41,15 @@ import {
   recordCycle,
   route,
 } from "./cli-cycle.mjs";
+import { repoDir, start, status, stop, validate } from "./cli-manager.mjs";
+import { queue } from "./cli-queue.mjs";
+import { CliError, EXIT } from "./cli-runtime.mjs";
 import {
+  coexistence,
   initConfig,
-  repoDir,
-  start,
-  status,
-  stop,
   storeToken,
-  validate,
-} from "./cli-manager.mjs";
-import { queue } from "./cli-queue.mjs";
-import { CliError, EXIT } from "./cli-runtime.mjs";
+  trustStatus,
+} from "./cli-setup.mjs";
 import { USAGE } from "./cli-usage.mjs";
 import { capacity, classify, resume, spawn } from "./cli-workers.mjs";
 
@@ -67,9 +68,11 @@ const COMMANDS = {
   stop: { run: stop, options: {}, positionals: 0 },
   "store-token": {
     run: storeToken,
-    options: { replace: flag },
+    options: { replace: flag, "from-clipboard": flag },
     positionals: 0,
   },
+  "trust-status": { run: trustStatus, options: {}, positionals: 0 },
+  coexistence: { run: coexistence, options: {}, positionals: 0 },
   "repo-dir": {
     run: repoDir,
     options: { repo: text, raw: flag },

package/plugins/src/base/skills/lisa-session-manager/scripts/setup-checks.mjs

@@ -0,0 +1,168 @@
+/**
+ * Read-only facts setup needs before it asks the operator for anything:
+ * which worker directories Claude Code already trusts, and whether a
+ * scheduled intake loop is still running alongside the manager.
+ *
+ * Both used to be manual (CodySwannGT/lisa#4465). Setup asked the operator to
+ * open `claude` in every worker directory to accept workspace trust, even
+ * where Claude Code had already recorded it; and it only warned that
+ * `intake-tickets` / `intake-repair` compete with the manager, leaving the
+ * agent to dig through run logs to find out whether either was alive.
+ *
+ * Neither check writes anything, and neither answers a trust prompt.
+ * @module session-manager/setup-checks
+ */
+import * as nodeFs from "node:fs";
+import path from "node:path";
+
+/** The scheduled loops that compete with the manager for the same items. */
+export const COMPETING_LOOPS = Object.freeze([
+  "intake-tickets",
+  "intake-repair",
+]);
+
+/** A loop counts as recent when it ran within at least this long. */
+const MIN_RECENT_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * Where Claude Code keeps its global state, including per-directory trust:
+ * `$CLAUDE_CONFIG_DIR/.claude.json` when that is set, else `~/.claude.json`.
+ * @param {{ env?: Record<string, string | undefined>, homedir: string }} input
+ *   - Environment and home directory
+ * @returns {string} Absolute path
+ */
+export function claudeStateFile({ env = {}, homedir }) {
+  const configDir = env.CLAUDE_CONFIG_DIR;
+  return configDir
+    ? path.join(configDir, ".claude.json")
+    : path.join(homedir, ".claude.json");
+}
+
+/**
+ * Whether Claude Code has recorded workspace trust for each directory.
+ *
+ * `true` and `false` come from Claude Code's own record
+ * (`projects[<dir>].hasTrustDialogAccepted`). A directory and the key Claude
+ * Code recorded can name the same place through different symlinks (macOS
+ * `/var` is `/private/var`), so a key matches when the two realpaths agree;
+ * only keys with the same final segment are resolved, so a large state file
+ * costs a handful of realpath calls. `unknown` means the record could not be
+ * read, so the operator still has to check that directory by hand.
+ * @param {{ dirs: string[], env?: Record<string, string | undefined>,
+ *   homedir: string, fs?: Pick<typeof nodeFs, "readFileSync" | "realpathSync"> }}
+ *   input - Worker directories, environment, home directory and fs seam
+ * @returns {{ file: string, dirs: Array<{ dir: string,
+ *   trusted: true | false | "unknown" }> }} One row per directory
+ */
+export function trustStatus({ dirs, env, homedir, fs = nodeFs }) {
+  const file = claudeStateFile({ env, homedir });
+  let projects = null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    projects =
+      parsed && typeof parsed.projects === "object" ? parsed.projects : {};
+  } catch {
+    projects = null;
+  }
+  const realpath = dir => {
+    try {
+      return fs.realpathSync(dir);
+    } catch {
+      return dir;
+    }
+  };
+  const entryFor = dir => {
+    if (Object.hasOwn(projects, dir)) return projects[dir];
+    const target = realpath(dir);
+    const key = Object.keys(projects).find(
+      candidate =>
+        path.basename(candidate) === path.basename(dir) &&
+        realpath(candidate) === target
+    );
+    return key === undefined ? undefined : projects[key];
+  };
+  return {
+    file,
+    dirs: dirs.map(dir => {
+      if (projects === null) return { dir, trusted: "unknown" };
+      return { dir, trusted: entryFor(dir)?.hasTrustDialogAccepted === true };
+    }),
+  };
+}
+
+/**
+ * The last parseable record of a loop's run log, or null.
+ * @param {string} file - `.lisa/automations/runs/<loop>.jsonl`
+ * @param {Pick<typeof nodeFs, "readFileSync">} fs - Filesystem seam
+ * @returns {{ ts: string, outcome: string | null } | null} Last record
+ */
+function lastRunRecord(file, fs) {
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  const lines = text.split("\n").filter(line => line.trim());
+  for (const line of lines.reverse()) {
+    try {
+      const record = JSON.parse(line);
+      if (
+        typeof record?.ts === "string" &&
+        !Number.isNaN(Date.parse(record.ts))
+      ) {
+        return { ts: record.ts, outcome: record.outcome ?? null };
+      }
+    } catch {
+      // A torn or foreign line: keep looking further back.
+    }
+  }
+  return null;
+}
+
+/**
+ * How long a loop may go without a recorded run and still count as live:
+ * twice the time the manager gives a silent worker before giving up on it
+ * (`stall.noOutputMinutes × stall.maxAttempts`), and never under a day.
+ * @param {{ noOutputMinutes?: number, maxAttempts?: number } | undefined} stall
+ *   - The manager's stall settings
+ * @returns {number} Milliseconds
+ */
+export function recentWindowMs(stall) {
+  const minutes = (stall?.noOutputMinutes ?? 60) * (stall?.maxAttempts ?? 3);
+  return Math.max(MIN_RECENT_MS, 2 * minutes * 60 * 1000);
+}
+
+/**
+ * What this project's own run logs say about each competing intake loop.
+ *
+ * A loop with a recent recorded run is probably still scheduled and will
+ * compete with the manager. A stale or missing log is evidence, not proof,
+ * that it stopped: the runtime's scheduler (claude.ai routines, Codex
+ * automations, GitHub Actions) is the authority, and setup lists it too.
+ * @param {{ root: string, now: Date, stall?: object,
+ *   fs?: Pick<typeof nodeFs, "readFileSync"> }} input - Project root, the
+ *   current time, the manager's stall settings and fs seam
+ * @returns {{ windowHours: number, loops: Array<{ loop: string,
+ *   log: string, lastRun: { ts: string, outcome: string | null } | null,
+ *   recent: boolean }> }} One row per competing loop
+ */
+export function coexistence({ root, now, stall, fs = nodeFs }) {
+  const windowMs = recentWindowMs(stall);
+  return {
+    windowHours: windowMs / 3_600_000,
+    loops: COMPETING_LOOPS.map(loop => {
+      const log = path.join(
+        root,
+        ".lisa",
+        "automations",
+        "runs",
+        `${loop}.jsonl`
+      );
+      const lastRun = lastRunRecord(log, fs);
+      const recent =
+        lastRun !== null && now.getTime() - Date.parse(lastRun.ts) <= windowMs;
+      return { loop, log, lastRun, recent };
+    }),
+  };
+}