@codyswann/lisa 4.81.4 → 4.81.6

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -808,6 +808,62 @@ follow_split() {
       }
       return 0;
     }
+    # U records tell the walker the stream below may not match the shell, so
+    # a compound closer can no longer be trusted (follow_compound_close). They
+    # only ever ADD distrust; every other record is emitted exactly as before.
+    #
+    # A statement spanning lines (a quoted newline, a backslash continuation)
+    # reaches the line-oriented reader as several records, and a later line
+    # can spell `done` or `fi` on its own.
+    function record(kind, text) {
+      if (text ~ /\n/) { printf "U\t\n" }
+      printf "%s\t%s\n", kind, text;
+    }
+    # The first word of one separator-delimited piece of a comment, as the
+    # walker would read it if the split hands it over as a statement.
+    function comment_reserved(piece) {
+      sub(/^[[:space:]]+/, "", piece); sub(/[[:space:]].*$/, "", piece);
+      gsub(/["\047]/, "", piece);
+      return piece ~ /^(fi|done|esac|case|if|then|else|elif|do|while|until|for|select|function|!|\{|\})$/;
+    }
+    # This split does not recognise comments, so a comment is split as code. It
+    # is harmless only when that split cannot change any structure the walker
+    # tracks: no piece after a separator starts with a reserved word, quotes
+    # close, parentheses and braces balance, and nothing escapes or substitutes.
+    # Inside a case pattern a `)` ends the pattern, so it is never harmless
+    # there; a `(` is ignored there, which keeps the Gradle `#(` safe.
+    # Anything else is reported, and the walker stops restoring flow.
+    function comment_unsafe(from, pattern, j, c, cq, parens, braces, pieces, piece) {
+      cq = ""; parens = 0; braces = 0; pieces = 0; piece = "";
+      for (j = from; j <= n; j++) {
+        c = substr(s, j, 1);
+        if (c == "\n") { break }
+        if (c == "\\" || c == "`") { return 1 }
+        if (cq != "") {
+          if (c == cq) { cq = "" }
+          else if (cq == "\"" && c == "(" && substr(s, j - 1, 1) == "$") { return 1 }
+          piece = piece c; continue;
+        }
+        if (c == "\"" || c == "\047") { cq = c; piece = piece c; continue }
+        if (c ~ /[;&|(){}]/) {
+          if (pieces > 0 && comment_reserved(piece)) { return 1 }
+          pieces++; piece = "";
+          if (c == "(" && !pattern) { parens++ }
+          if (c == ")" && (pattern || --parens < 0)) { return 1 }
+          if (c == "{") { braces++ }
+          if (c == "}" && --braces < 0) { return 1 }
+          continue;
+        }
+        piece = piece c;
+      }
+      if (pieces > 0 && comment_reserved(piece)) { return 1 }
+      return cq != "" || parens != 0 || braces != 0;
+    }
+    function comment_check(at, pattern) {
+      if ((at == 1 || substr(s, at - 1, 1) ~ /[[:space:];&|()]/) && comment_unsafe(at + 1, pattern)) {
+        printf "U\t\n";
+      }
+    }
     BEGIN {
       s = ENVIRON["SN_FOLLOW_TEXT"]; n = length(s);
       q = ""; esc = 0; start = 1; sep = "o"; parens = 0;
@@ -820,6 +876,7 @@ follow_split() {
         if (functions > 0) {
           if (q != "") { if (c == q) { q = "" } continue }
           if (c == "\"" || c == "\047") { q = c; continue }
+          if (c == "#") { comment_check(i, 0) }
           if (c == "{") { functions++ }
           if (c == "}" && --functions == 0) {
             printf "N\t%s\t%s\n", sep, function_name;
@@ -833,10 +890,11 @@ follow_split() {
         quoted_expression = q == "\"" && ((c == "(" && substr(s, i - 1, 1) == "$" && !literal_dollars[i - 1]) || c == "`");
         if (q != "" && !quoted_expression) { if (c == q) { q = "" } continue }
         if (c == "\"" || c == "\047") { q = c; continue }
+        if (c == "#") { comment_check(i, cases > 0 && case_scopes[cases] == parens && case_patterns[cases]) }
         if (c == "`") {
           if (backtick) {
             piece = substr(s, start, i - start);
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             printf "]\t\n"; start = backtick_start; q = backtick_quote; backtick = 0;
           } else {
             backtick_start = start; backtick_quote = q; q = ""; backtick = 1;
@@ -876,14 +934,14 @@ follow_split() {
           brace_groups[++brace_depth] = group;
           if (group) {
             brace_sep = sep;
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             # A pipeline owns the whole compound command, not just the final
             # statement before |. Snapshot before any brace-body cd/return.
             outgoing = brace_pipe(i + 1, "{", "}");
             brace_pipes[brace_depth] = brace_sep == "|" || outgoing;
             if (brace_pipes[brace_depth]) { printf "(\t%s%s\nL\t%d\n", (brace_sep == "|" ? "|" : ""), (outgoing ? "+" : ""), list_async(i + 1) }
             printf "G\t%s\nL\t%d\n", brace_sep, list_async(i + 1);
-            if (brace_redirect ~ /[^[:space:]]/) { printf "I\t%s\n", brace_redirect }
+            if (brace_redirect ~ /[^[:space:]]/) { record("I", brace_redirect) }
             # P retains incoming stdin provenance without wrapping each body
             # statement in another child: all statements share the brace cwd.
             if (brace_sep == "|") { sep = "P" }
@@ -894,7 +952,7 @@ follow_split() {
           group = brace_groups[brace_depth--];
           if (group) {
             piece = substr(s, start, i - start);
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             printf "H\t\n";
             if (brace_pipes[brace_depth + 1]) { printf ")\t\n" }
             start = i + 1; post_brace = 1; continue;
@@ -915,10 +973,10 @@ follow_split() {
           }
           if (group) {
             piece = substr(s, start, i - start);
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             outgoing = brace_pipe(i + 1, "(", ")");
             printf "(\t%s%s\nL\t%d\n", sep, (outgoing ? "+" : ""), list_async(i + 1);
-            if (brace_redirect ~ /[^[:space:]]/) { printf "I\t%s\n", brace_redirect }
+            if (brace_redirect ~ /[^[:space:]]/) { record("I", brace_redirect) }
             if (sep == "|") { sep = "P" }
             start = i + 1; continue;
           }
@@ -927,12 +985,12 @@ follow_split() {
           piece = substr(s, start, i - start);
           group = scopes[parens--];
           if (group == 2) {
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             printf "]\t\n"; start = expression_starts[parens + 1]; q = expression_quotes[parens + 1]; continue;
           }
           if (group) {
             piece = substr(s, start, i - start);
-            if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", sep, piece; sep = "o" }
+            if (piece ~ /[^[:space:]]/) { record(sep, piece); sep = "o" }
             printf ")\t\n"; start = i + 1; post_brace = 1; continue;
           }
         }
@@ -942,7 +1000,7 @@ follow_split() {
           piece = substr(s, start, i - start);
           pipe = c == "|" && substr(s, i + 1, 1) != "|";
           if (pipe || sep == "|") { printf "(\t%s%s\nL\t%d\n", (sep == "|" ? "|" : ""), (pipe ? "+" : ""), list_async(start) }
-          if (piece ~ /[^[:space:]]/) { printf "%s\t%s\n", post_brace ? "R" : sep, piece }
+          if (piece ~ /[^[:space:]]/) { record(post_brace ? "R" : sep, piece) }
           post_brace = 0;
           if (pipe || sep == "|") { printf ")\t\n" }
           if (c == ";" && substr(s, i + 1, 1) == ";" && cases > 0) {
@@ -962,7 +1020,7 @@ follow_split() {
         }
       }
       if (sep == "|") { printf "(\t|\nL\t%d\n", list_async(start) }
-      printf "%s\t%s\n", sep, substr(s, start, n - start + 1);
+      record(sep, substr(s, start, n - start + 1));
       if (sep == "|") { printf ")\t\n" }
     }
   '
@@ -1432,6 +1490,77 @@ PY
   follow_redirect_output="$(printf '%s' "$result" | jq -er '.output')" || follow_refuse "compound redirection" "invalid output projection"
 }
 
+# Enter a compound command (`if`, `while`/`until`/`for`/`select`, `case`).
+#
+# Reaching anything inside it depends on runtime flow, so a definition there is
+# conditional. The enclosing flow state is saved so the matching closer can put
+# it back: a compound that has CLOSED no longer decides whether the next
+# top-level definition runs. Leaving the flag raised past the closer marked
+# every function defined after any loop or case as conditional, which refused
+# every Gradle-generated start script (CodySwannGT/lisa#4470). Brace groups
+# already restore this way through brace_flows.
+#
+# These read and write follow_scan's locals through bash's dynamic scoping.
+follow_compound_open() {
+  local frame_scope=$scope_depth
+  # A pipeline element is its own scope, but `if a | b; then` and
+  # `x | while read l; do` open their compound at the ENCLOSING level.
+  if [ "$scope_depth" -gt 0 ]; then
+    case "${scope_kinds[scope_depth - 1]}" in '+' | '|' | '|+') frame_scope=$((scope_depth - 1)) ;; esac
+  fi
+  compound_flows[compound_depth]=$function_flow_unknown
+  compound_kinds[compound_depth]="$1"
+  compound_frame_scopes[compound_depth]=$frame_scope
+  compound_opened_at="$compound_opened_at${i:-} "
+  compound_depth=$((compound_depth + 1))
+  function_flow_unknown=1
+}
+
+# Close the innermost compound, restoring the flow state that encloses it.
+#
+# Only a closer of the SAME kind as the innermost open compound may lower the
+# flag. The walker splits text, it does not parse shell: a comment's `;` or a
+# heredoc payload line can reach it as a `fi`/`done` statement. A closer that
+# matches nothing, or arrives after a heredoc (see compound_trusted), proves the
+# walk has lost the structure, so every later closer keeps the flag where it is
+# — the verdict this walker gave before closers restored anything.
+#
+# A conditional `return` inside the compound can skip whatever follows it in a
+# function body or sourced file, so it re-raises the flag, as H does for a brace
+# group. `break`/`continue` resume at or inside the loop, so they never skip a
+# definition after `done`, and `exit` ends the shell before any later call runs:
+# neither needs to persist past the closer. A `break` inside a function body
+# can end the CALLER's loop and skip the rest of that body, but such a call only
+# has that effect when the call itself sits inside a loop body, which is
+# already conditional.
+#
+# The closer must also sit in the scope its compound opened in: a `done` inside
+# a command substitution (`$( … )` or backticks) is a different shell's syntax
+# error, not the end of this loop. The one cross-scope closer is `done | cmd`,
+# whose `done` is the first element of a pipeline. Callers pass only a closer
+# spelled as the bare first word of its statement; see the fi/done arm.
+follow_compound_close() {
+  local frame_scope
+  if [ "$compound_trusted" -eq 0 ] || [ "$compound_depth" -eq 0 ] \
+    || [ "${compound_kinds[compound_depth - 1]}" != "$1" ]; then
+    compound_trusted=0
+    return 0
+  fi
+  frame_scope="${compound_frame_scopes[compound_depth - 1]}"
+  if [ "$scope_depth" -ne "$frame_scope" ]; then
+    case "$((scope_depth - frame_scope)):${scope_kinds[scope_depth - 1]}" in
+      '1:+' | '1:|' | '1:|+') ;;
+      *)
+        compound_trusted=0
+        return 0
+        ;;
+    esac
+  fi
+  compound_depth=$((compound_depth - 1))
+  function_flow_unknown="${compound_flows[compound_depth]}"
+  if [ "$return_flow_unknown" -ne 0 ]; then function_flow_unknown=1; fi
+}
+
 # Walk one text for the files it executes. Runs in the PARENT shell, never in a
 # command substitution: follow_refuse() must be able to deny, and an exit inside
 # a subshell ends that subshell rather than this hook — the mistake documented
@@ -1467,6 +1596,18 @@ follow_scan() {
   local -a brace_descriptor_maps=() scope_descriptor_maps=()
   local -a brace_stdin_cats=() brace_stdin_cwds=() brace_stdin_unknowns=() scope_stdin_cats=() scope_stdin_cwds=() scope_stdin_unknowns=()
   local -a case_cwds=() case_unknowns=() case_changes=()
+  # Open compound commands of THIS text, innermost last. See
+  # follow_compound_open. The stack starts empty, so a closer can never lower
+  # the flag below the value this scan was entered with.
+  local compound_depth=0 compound_trusted=1 compound_opened_at=" " compound_prev
+  local -a compound_flows=() compound_kinds=() compound_scopes=() compound_frame_scopes=() scope_kinds=()
+  # The split treats every [[:space:]] byte as a blank, but bash separates words
+  # only on space and tab (and ends a command on newline). A form feed,
+  # vertical tab or carriage return is an ordinary word byte to bash, so
+  # `<FF>done` is a command name there and a bare closer here. With none of the
+  # three present, every [[:space:]] the split tests is a bash blank or a
+  # newline, so this one check covers each such test in the split.
+  case "$text" in *$'\f'* | *$'\v'* | *$'\r'*) compound_trusted=0 ;; esac
   if [ "$function_call_depth" -eq 0 ] && [ "$invocation_kind" != source ]; then
     # Ordinary child shells do not inherit unexported functions. Sourcing and
     # function calls share the caller's definitions instead.
@@ -1480,6 +1621,14 @@ follow_scan() {
     stmt="${line#*$'\t'}"
     statement_conditional=0
     case "$sep" in '&' | '?') statement_conditional=1 ;; esac
+    # A heredoc payload reaches this walk as statements, so a payload line can
+    # spell a closer. Once one starts, closers stop restoring flow for the rest
+    # of this text. Checked before any skip so an unread payload still counts.
+    # A here-string (`<<<`) carries no payload lines.
+    # The same test also matches an arithmetic shift such as `$((1 << 2))`.
+    # That only withholds a restore, which is the safe direction.
+    case "${stmt//<<</}" in *'<<'*) compound_trusted=0 ;; esac
+    if [ "$sep" = U ]; then compound_trusted=0; continue; fi
     # A reached && successor observes the preceding successful command's cwd.
     # Scope/list events invalidate this projection; it must never carry a
     # child's or a background list's directory into another shell/list.
@@ -1570,7 +1719,7 @@ follow_scan() {
         continue
         ;;
       C)
-        function_flow_unknown=1
+        follow_compound_open case
         case_cwds[case_depth]="$follow_cwd"
         case_unknowns[case_depth]="$follow_cwd_unknown"
         case_changes[case_depth]=0
@@ -1589,6 +1738,9 @@ follow_scan() {
             follow_cwd=""; follow_cwd_unknown=1
           fi
           case_depth=$((case_depth - 1))
+          # K closes the case; the literal `esac` statement the split emits
+          # after it is not a closer and must not close another frame.
+          follow_compound_close case
         fi
         continue
         ;;
@@ -1601,6 +1753,10 @@ follow_scan() {
         scope_descriptor_maps[scope_depth]="$follow_descriptor_map"
         function_scopes[scope_depth]=$function_count
         flow_scopes[scope_depth]=$function_flow_unknown
+        compound_scopes[scope_depth]=$compound_depth
+        # `[` is a substitution; for `(` the split's tail says whether this is
+        # a pipeline element (`+`, `|`, `|+`) or a literal subshell.
+        if [ "$sep" = '[' ]; then scope_kinds[scope_depth]='['; else scope_kinds[scope_depth]="$stmt"; fi
         return_flows[scope_depth]=$return_flow_unknown
         scope_stdin_cats[scope_depth]="$follow_stdin_cat"
         scope_stdin_cwds[scope_depth]="$follow_stdin_cwd"
@@ -1626,6 +1782,16 @@ follow_scan() {
         follow_cwd_unknown="${unknown_scopes[scope_depth]}"
         function_flow_unknown="${flow_scopes[scope_depth]}"
         return_flow_unknown="${return_flows[scope_depth]}"
+        # A pipeline element is a scope of its own, so `done | cmd` closes, in
+        # here, a loop opened outside. The scope must not undo that closer: the
+        # flow after the pipeline is the one the loop's frame saved. The stack
+        # itself is never rewound here. `if a | b; then` opens its `if` inside
+        # the first element, and discarding that frame would let the `fi` close
+        # an ENCLOSING compound instead.
+        if [ "$compound_depth" -lt "${compound_scopes[scope_depth]}" ]; then
+          function_flow_unknown="${compound_flows[compound_depth]}"
+          if [ "$return_flow_unknown" -ne 0 ]; then function_flow_unknown=1; fi
+        fi
         follow_stdin_cat="${scope_stdin_cats[scope_depth]}"
         follow_stdin_cwd="${scope_stdin_cwds[scope_depth]}"
         follow_stdin_unknown="${scope_stdin_unknowns[scope_depth]}"
@@ -1691,6 +1857,7 @@ follow_scan() {
     n=${#toks[@]}
     [ "$n" -gt 0 ] || continue
     i=0
+    compound_opened_at=" "
     cmd_pos=1
     function_lookup_allowed=1
     eval_mode=0
@@ -1795,12 +1962,32 @@ follow_scan() {
           fi
           cmd_pos=0; i=$((i + 1)); continue
           ;;
-        if | while | until)
-          function_flow_unknown=1
+        if)
+          follow_compound_open if
+          i=$((i + 1)); continue
+          ;;
+        while | until)
+          follow_compound_open loop
           i=$((i + 1)); continue
           ;;
         for | select)
-          function_flow_unknown=1
+          follow_compound_open loop
+          cmd_pos=0; i=$((i + 1)); continue
+          ;;
+        # A closer counts only as the bare, unquoted FIRST word of its
+        # statement. Anything else that unwraps to one — `"done"`, `\fi`,
+        # `x=1 done`, `eval done`, `command done`, the tail of `x='a; fi'` — is
+        # not a reserved word to the shell, so its appearance means the walk
+        # cannot prove where compounds end. A literal `esac` statement follows
+        # every K record and is harmless in that one spelling.
+        'fi' | 'done' | 'esac')
+          if [ "$i" -ne 0 ] || [ "${toks[0]}" != "$t" ]; then
+            compound_trusted=0
+          elif [ "$t" = 'fi' ]; then
+            follow_compound_close if
+          elif [ "$t" = 'done' ]; then
+            follow_compound_close loop
+          fi
           cmd_pos=0; i=$((i + 1)); continue
           ;;
         # Prefixes that keep the command position open: assignments, wrappers,
@@ -1842,11 +2029,13 @@ follow_scan() {
           continue
           ;;
         sudo | env | command | exec | nohup | nice | time | builtin \
-          | do | then | else | '!' | '{' \
+          | do | then | else | elif | '!' | '{' \
           | */sudo | */env | */nohup | */nice | */time)
           case "$t" in
             sudo | env | command | exec | nohup | nice | builtin | */sudo | */env | */nohup | */nice) function_lookup_allowed=0 ;;
-            do | then | else) function_flow_unknown=1 ;;
+            # `elif` starts a condition list at a command position, so an
+            # opener after it is a real compound (`elif if x; then …; fi`).
+            do | then | else | elif) function_flow_unknown=1 ;;
           esac
           i=$((i + 1))
           continue
@@ -2081,6 +2270,37 @@ follow_scan() {
     # Keep successful-branch provenance separate from the continuation join.
     # OR can skip its RHS and still reach a following &&, so it cannot prove
     # that RHS's cwd. A semicolon observes every possible preceding outcome.
+    # Every opener must have pushed a frame, or its own closer pops the
+    # ENCLOSING one and restores flow inside a compound that is still open.
+    # Bash reads a reserved word wherever a command may start, which this walk
+    # does not fully model: after `coproc NAME`, after a function header whose
+    # body is a bare compound (`f () while …`), or after `function NAME`. So an
+    # opener word the walk did not open stops all later restores unless the
+    # word before it is a plain argument (`echo if`, `# loops for x`), where
+    # bash reads it as data too. `case` never opens here (the split's C record
+    # does), so a statement-initial `case` means the split missed its `in`.
+    if [ "$compound_trusted" -ne 0 ]; then
+      for ((j = 0; j < n; j++)); do
+        case "${toks[j]}" in
+          coproc) compound_trusted=0 ;;
+          function) [ "$j" -ne 0 ] || compound_trusted=0 ;;
+          if | while | until | for | select | case)
+            case "$compound_opened_at" in *" $j "*) continue ;; esac
+            if [ "$j" -eq 0 ]; then
+              compound_trusted=0
+            else
+              compound_prev="${toks[j - 1]}"
+              case "$compound_prev" in
+                '' | *[!A-Za-z0-9_./,:=+@%-]* | elif | coproc | function | time | then | do | else)
+                  compound_trusted=0
+                  ;;
+              esac
+            fi
+            ;;
+        esac
+        [ "$compound_trusted" -ne 0 ] || break
+      done
+    fi
     and_cwd="$follow_cwd"; and_unknown="$follow_cwd_unknown"
     if [ "$sep" != '?' ] && [ "$function_flow_unknown" -eq 0 ]; then and_ready=1; fi
     if [ "$statement_conditional" -ne 0 ] && { [ "$join_unknown" -ne 0 ] || [ "$follow_cwd_unknown" -ne 0 ] || [ "$follow_cwd" != "$join_cwd" ]; }; then

package/package.json

@@ -189,7 +189,7 @@
     "qs": "^6.16.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.81.4",
+  "version": "4.81.6",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -345,7 +345,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "e9f635e3e13ab6737422426cfe248257a081a4e5",
-  "gitHead": "e9f635e3e13ab6737422426cfe248257a081a4e5",
-  "lisaReleaseTag": "v4.81.4"
+  "lisaReleaseCommit": "08ee71200b5e384f43d4daa01f71d3cc75dc5944",
+  "gitHead": "08ee71200b5e384f43d4daa01f71d3cc75dc5944",
+  "lisaReleaseTag": "v4.81.6"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.81.4",
+  "version": "4.81.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.81.4",
+  "version": "4.81.6",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -727,6 +727,35 @@ function findCredentials(value, path) {
   );
 }
 
+/**
+ * Validate `sessionManager.operatorIds`: the people the manager works for,
+ * whose assigned items it dispatches first. Matched against the assignee the
+ * way "me" is, so the GitHub entry is a login, not the numeric id
+ * `trustedAuthorIds` takes. An empty list reads as configured but names no
+ * one, so it is refused like an empty `trustedAuthorIds`.
+ * @param {unknown} ids The value, if present.
+ * @returns {string[]} Problems found.
+ */
+function validateOperatorIds(ids) {
+  if (ids === undefined) return [];
+  if (
+    !Array.isArray(ids) ||
+    !ids.every(id => typeof id === "string" && id.trim() !== "")
+  ) {
+    return [
+      `sessionManager.operatorIds must be an array of tracker user ids as ` +
+        `strings, matched against the assignee: the GitHub login, the Jira ` +
+        `accountId or the Linear user id.`,
+    ];
+  }
+  return ids.length === 0
+    ? [
+        `sessionManager.operatorIds must name at least one person. Remove ` +
+          `the key instead if the manager works only for its own identity.`,
+      ]
+    : [];
+}
+
 /**
  * Validate the opt-in `sessionManager` block.
  *
@@ -786,6 +815,7 @@ export function validateSessionManager(block) {
             `if every author's item may be dispatched.`,
         ]
       : []),
+    ...validateOperatorIds(block.operatorIds),
     ...findCredentials(block, "sessionManager"),
   ];
 }

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/SKILL.md

@@ -68,7 +68,12 @@ the manager.
   claims go through `lisa-tracker-claim`. Never call a vendor API around them.
 - **"Me".** Resolve once per manager run and store it with `ledger control --me <id>`: GitHub
   `gh api user --jq .login`; Jira the accountId from the `lisa-atlassian-access` identity probe;
-  Linear `viewer.id` through `lisa-linear-access`.
+  Linear `viewer.id` through `lisa-linear-access`. "Me" is whoever the tracker credential belongs
+  to, which is often an agent account.
+- **Operators.** `sessionManager.operatorIds` names the people the manager works for (the same
+  kind of id as "me": GitHub login, Jira accountId, Linear user id). Their assigned items come
+  first, then items assigned to "me", then unassigned. Items assigned to anyone else are never
+  dispatched. Never treat an operator's item as someone else's.
 - **Workers** start only through `spawn`. The worker prompt is exactly
   `/lisa:implement <REF> managedBy=<manager-name>`; `lisa-implement` owns what `managedBy=` means.
   Never start a worker another way, and never reuse a worker for another item or a new attempt.
@@ -209,8 +214,8 @@ Skip while `capacity` reports `paused`. Otherwise:
      Raw Jira issues carry `key` and `fields` (summary, priority, assignee, created, labels,
      description, reporter, issuetype, subtasks); raw Linear nodes carry identifier, title, priority,
      createdAt, assignee, labels, description, creator and children with their state type.
-   - `ordered` is the dispatch order (mine, then unassigned, then priority, then age). `excluded`
-     needs no action.
+   - `ordered` is the dispatch order: assigned to an operator, then to "me", then unassigned; each
+     group by priority, then age. `excluded` needs no action.
 2. **While `capacity` says `can_spawn`** and items remain, take the next item that has no pending
    question in the ledger:
    1. Read it fully (`lisa-tracker-read`): title, description, labels, project, parent, comments.
@@ -225,9 +230,11 @@ Skip while `capacity` reports `paused`. Otherwise:
       `cd "$(node "$SM/session-manager.mjs" repo-dir --repo <key> --raw --project-root "$ROOT")"`
       (omit `--repo` on a single-repo project), invoke `lisa-tracker-claim <ref>`, then
       `cd "$ROOT" && pwd` and confirm the path. Continue only on `claimed` or `reused` with the
-      assignee equal to "me"; anything else means skip. Then re-read the item with
-      `lisa-tracker-read`: if the re-read shows a different assignee, or shows the state did not
-      change to the `claimed` role, skip it (someone else holds it, or the claim did not land).
+      assignee equal to "me" or to one of `sessionManager.operatorIds` (the claim assigns only an
+      unassigned item, so an operator's item keeps the operator); anything else means skip. Then
+      re-read the item with `lisa-tracker-read`: if the re-read shows an assignee that is neither
+      "me" nor an operator, or shows the state did not change to the `claimed` role, skip it
+      (someone else holds it, or the claim did not land).
       Never spawn on the claim's word alone.
    4. **Spawn.** `spawn <ref> [--repo <key>]`.
       - exit 0: post `[<REF>] started in <repo> (<name>)` to Telegram.

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/references/runbook-template.md

@@ -18,9 +18,10 @@ session list from `claude agents`; and the project's own Telegram chat.
 
 ## Candidate selection
 
-Leaf items in the `ready` role, ordered: assigned to the operator, then unassigned, then by priority,
-then oldest. Items assigned to someone else, containers, human-held items and (when configured)
-items by untrusted authors are skipped. As many as the machine has capacity for.
+Leaf items in the `ready` role, ordered: assigned to an operator (`sessionManager.operatorIds`),
+then to the manager's own tracker identity, then unassigned; within each, by priority, then oldest.
+Items assigned to someone else, containers, human-held items and (when configured) items by
+untrusted authors are skipped. As many as the machine has capacity for.
 
 ## Scope/bounds
 

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/scripts/cli-queue.mjs

@@ -123,9 +123,11 @@ function readEnvelopeQueue(ctx, tracker) {
 }
 
 /**
- * `queue --tracker <github|jira|linear>`: the Ready queue, mine first.
+ * `queue --tracker <github|jira|linear>`: the Ready queue, the operator's
+ * items first (`sessionManager.operatorIds`), then mine, then unassigned.
  * @param {object} ctx - CLI context
- * @returns {Promise<{ json: object }>} `{tracker,me,total,pages,ordered,excluded}`
+ * @returns {Promise<{ json: object }>}
+ *   `{tracker,me,operators,total,pages,ordered,excluded}`
  */
 export async function queue(ctx) {
   const tracker = ctx.values.tracker;
@@ -139,10 +141,14 @@ export async function queue(ctx) {
       ? fetchGithubQueue(ctx, project)
       : readEnvelopeQueue(ctx, tracker);
   const me = ctx.values.me ?? (await readLedger(ctx.root)).control.me ?? null;
+  const operators = config?.operatorIds ?? [];
   const order = orderReadyQueue(items, {
     me,
+    operators,
     trustedAuthorIds: config?.trustedAuthorIds ?? undefined,
     humanNeededLabel: humanNeededLabel(project, tracker),
   });
-  return { json: { tracker, me, total: items.length, pages, ...order } };
+  return {
+    json: { tracker, me, operators, total: items.length, pages, ...order },
+  };
 }

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/scripts/cli-runtime.mjs

@@ -126,6 +126,7 @@ function validationView(config) {
     ...config,
     repos: config.repos ?? undefined,
     trustedAuthorIds: config.trustedAuthorIds ?? undefined,
+    operatorIds: config.operatorIds,
   };
 }
 

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/scripts/cli-usage.mjs

@@ -111,7 +111,10 @@ Per cycle
   queue --tracker jira|linear --input <file> [--me <id>]
       <file> = {complete:true,pages,items:[raw vendor issues]}; exit 2 unless
       complete is exactly true.
-      Both print {tracker,me,total,pages,ordered,excluded:[{ref,reason}]}.
+      Both print {tracker,me,operators,total,pages,ordered,excluded:[{ref,
+      reason}]}. ordered: items assigned to sessionManager.operatorIds
+      first, then to --me, then unassigned; each group by priority, then age.
+      Items assigned to anyone else are excluded (assigned-to-other).
       --me defaults to the ledger's control.me.
   ledger get [<ref>]
   ledger record-spawn <ref> --worker <name> [--session-id <id>] [--repo <key>]

package/plugins/lisa/.codex-plugin/skills/lisa-session-manager/scripts/config.mjs

@@ -66,6 +66,7 @@ export const SESSION_MANAGER_DEFAULTS = Object.freeze({
  *   stall: StallBlock,
  *   notify: NotifyBlock,
  *   trustedAuthorIds: string[] | null,
+ *   operatorIds?: string[] | null,
  * }} SessionManagerConfig
  * @typedef {{
  *   name: string,
@@ -120,6 +121,9 @@ export function resolveSessionManagerConfig(globalConfig, localConfig) {
     ...merged,
     repos,
     trustedAuthorIds: merged.trustedAuthorIds ?? null,
+    // Left as declared: absent stays undefined and an explicit null stays null,
+    // so validation can refuse the null instead of reading it as "no operators".
+    operatorIds: merged.operatorIds,
   };
 }
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-session-manager/SKILL.md

@@ -56,7 +56,19 @@ writes `$SM`, and pass `--project-root "$ROOT"` (the absolute project root) on e
    bypass-permissions worker; say so plainly. The list holds stable tracker user ids as strings,
    never logins: the GitHub numeric user id (`gh api users/<login> --jq .id`), the Jira
    `accountId`, or the Linear user id. A login matches no one and silently excludes every item.
-4. `node "$SM/session-manager.mjs" validate --project-root "$ROOT"` must print `valid: true`.
+4. Set `sessionManager.operatorIds` to a non-empty **array** holding the operator's own tracker
+   user id, e.g. `"operatorIds": ["<operator-id>"]` (a bare string fails `validate`). Look up the
+   OPERATOR, not the credential: `gh api user` / `viewer.id` return whoever the tracker credential
+   belongs to, which is the agent account in exactly the case this key exists for. The manager dispatches
+   the operator's assigned items first, then items assigned to the tracker credential's identity
+   ("me"), then unassigned ones, and skips items assigned to anyone else. When the tracker
+   credential is not the operator's (an agent or bot account), leaving this unset means the
+   operator's own Ready items are never dispatched; say so plainly. Unlike `trustedAuthorIds`, this
+   is matched against the assignee, exactly and case-sensitively, so use the same kind of id as
+   "me", spelled as the tracker API returns it: the GitHub **login** (`gh api users/<login> --jq
+   .login`), the Jira `accountId`, or the Linear user id (the operator's entry in the team's member
+   list, or `viewer.id` only when the operator runs the lookup with their own credential).
+5. `node "$SM/session-manager.mjs" validate --project-root "$ROOT"` must print `valid: true`.
 
 ## Step 3: Store the bot token