@codyswann/lisa 4.85.0 → 4.86.1

package/plugins/lisa/skills/lisa-session-manager/scripts/cli-human.mjs

@@ -0,0 +1,199 @@
+/**
+ * Human-needed subcommands of the session-manager CLI (CodySwannGT/lisa#4555,
+ * part 3): `mark-plan`, `answer` and `item-answer`.
+ *
+ * `mark-plan` says how to mark an item that needs a human: the configured
+ * human-needed label (else the configured `blocked` role), a move to the
+ * `blocked` role for an `exhausted` item, and the comment to post. It writes
+ * nothing; the manager applies the plan through `lisa-tracker-write`, so the
+ * tracker write stays with the vendor writers. `answer` and `item-answer`
+ * queue a human's answer in the ledger for the next cycle to deliver.
+ *
+ * Question and answer text arrive on stdin, never in argv, and are refused
+ * (exit 2) when they look like they hold a credential.
+ * @module session-manager/cli-human
+ */
+import { resolveRole } from "../../../scripts/resolve-lifecycle-role.mjs";
+import {
+  CliError,
+  EXIT,
+  asSetupError,
+  asSetupErrorAsync,
+  humanNeededLabel,
+  loadProject,
+  requirePositional,
+  stdinText,
+  validOrAbsent,
+} from "./cli-runtime.mjs";
+import { parseJson } from "./cli-queue.mjs";
+import { notifyProvider } from "./config.mjs";
+import { pickItemAnswer } from "./human-answer.mjs";
+import { findCredentialShape, planMark } from "./human-needed.mjs";
+import { readLedger } from "./ledger.mjs";
+import { queueAnswer } from "./ledger-questions.mjs";
+
+/**
+ * The project's configured tracker.
+ * @param {ReturnType<typeof loadProject>} project - Loaded project
+ * @returns {string | undefined} `github`, `jira` or `linear`
+ */
+function trackerOf(project) {
+  return project.local?.tracker ?? project.global?.tracker;
+}
+
+/**
+ * `mark-plan <ref> --kind <kind>` (question or reason on stdin).
+ * @param {object} ctx - CLI context
+ * @returns {{ json: object }} `{ref,kind,marker,move?,comment,answerWith}`
+ */
+export function markPlan(ctx) {
+  const ref = requirePositional(ctx, "ref");
+  const text = stdinText(ctx, "question or reason");
+  const project = loadProject(ctx.root);
+  const config = validOrAbsent(project);
+  const tracker = trackerOf(project);
+  const blocked = resolveRole({
+    role: "blocked",
+    vendor: tracker,
+    intent: "write",
+    local: project.local,
+    global: project.global,
+  }).value;
+  return {
+    json: asSetupError(() =>
+      planMark({
+        ref,
+        kind: ctx.values.kind,
+        text,
+        label: humanNeededLabel(project, tracker),
+        blocked: blocked || undefined,
+        channel: config ? notifyProvider(config) === "telegram" : false,
+        answerers: allowedAnswerers(config).length > 0,
+      })
+    ),
+  };
+}
+
+/**
+ * Refuse (exit 2) text that looks like it holds a credential.
+ * @param {string} text - Answer text
+ */
+function refuseCredential(text) {
+  const shape = findCredentialShape(text);
+  if (shape) {
+    throw new CliError(
+      `The answer looks like it holds a credential (${shape}); nothing was queued. Keep secrets in the secrets provider.`,
+      EXIT.SETUP
+    );
+  }
+}
+
+/**
+ * `answer <ref>` (answer on stdin): queue an operator's answer from the
+ * terminal. Exit 2 when the ref has no pending question.
+ * @param {object} ctx - CLI context
+ * @returns {Promise<{ json: object }>} `{queued:true,ref,source}`
+ */
+export async function answer(ctx) {
+  const ref = requirePositional(ctx, "ref");
+  const text = stdinText(ctx, "answer");
+  refuseCredential(text);
+  await asSetupErrorAsync(() =>
+    queueAnswer(ctx.root, { ref, source: "cli", text })
+  );
+  return { json: { queued: true, ref, source: "cli" } };
+}
+
+/**
+ * Who may answer on the item: operators and trusted authors only. There is
+ * no fallback to the tracker identity (`control.me`): workers and the
+ * manager post as that identity, so its comments cannot be told apart from
+ * an answer.
+ * @param {object | null} config - Resolved `sessionManager` block
+ * @returns {string[]} Allowed author ids (empty: nobody may answer there)
+ */
+function allowedAnswerers(config) {
+  return [
+    ...(config?.operatorIds ?? []),
+    ...(config?.trustedAuthorIds ?? []),
+  ].map(String);
+}
+
+/** Why nothing is read off the item when nobody may answer there. */
+/** Why no answer can be read, and the fix, when the question is not found. */
+const NO_QUESTION =
+  "The question comment was not found on the item: its id is not recorded " +
+  "(or not among these comments), and no comment by an operator or trusted " +
+  "author starts with the question marker. Replies cannot be read until it " +
+  "is. Re-post the question comment from mark-plan, then record its id " +
+  "with ledger marked --comment-id <id>.";
+
+const NO_ANSWERERS =
+  "No sessionManager.operatorIds or trustedAuthorIds are configured, so " +
+  "replies on the item are not read: the tracker identity is the one " +
+  "workers post as. Answer with the answerCommand that status lists, or " +
+  "set sessionManager.operatorIds.";
+
+/**
+ * `item-answer <ref>` (stdin `{"comments":[...]}`): find the human's answer
+ * on the item and queue it. stdout `{queued:false,reason}` when there is none
+ * yet, or `reason: "no-answerers-configured"` (exit 0) when nobody may
+ * answer there. Exit 2 when the ref has no pending question.
+ * @param {object} ctx - CLI context
+ * @returns {Promise<{ json: object }>} What was queued, or why nothing was
+ */
+export async function itemAnswer(ctx) {
+  const ref = requirePositional(ctx, "ref");
+  const input = parseJson(stdinText(ctx, "item comments JSON"), "stdin");
+  const config = validOrAbsent(loadProject(ctx.root));
+  const ledger = await readLedger(ctx.root);
+  const pending = Object.hasOwn(ledger.items, ref)
+    ? ledger.items[ref].pendingQuestion
+    : null;
+  if (!pending) {
+    throw new CliError(`${ref} has no pending question in the ledger.`, 2);
+  }
+  if (pending.answer) {
+    return { json: { queued: false, ref, reason: "already-queued" } };
+  }
+  const allowed = allowedAnswerers(config);
+  if (allowed.length === 0) {
+    return {
+      json: {
+        queued: false,
+        ref,
+        reason: "no-answerers-configured",
+        explanation: NO_ANSWERERS,
+      },
+    };
+  }
+  const picked = asSetupError(() =>
+    pickItemAnswer({
+      comments: input?.comments,
+      allowed,
+      managerCommentIds: pending.managerCommentIds ?? [],
+    })
+  );
+  if (!picked.answer) {
+    return {
+      json: {
+        queued: false,
+        ref,
+        reason: picked.reason,
+        ...(picked.reason === "no-question-comment"
+          ? { explanation: NO_QUESTION }
+          : {}),
+      },
+    };
+  }
+  refuseCredential(picked.answer.text);
+  await queueAnswer(ctx.root, {
+    ref,
+    source: "item",
+    text: picked.answer.text,
+    author: picked.answer.author,
+  });
+  return {
+    json: { queued: true, ref, source: "item", author: picked.answer.author },
+  };
+}

package/plugins/lisa/skills/lisa-session-manager/scripts/cli-manager-token.mjs

@@ -0,0 +1,99 @@
+/**
+ * The Telegram-token half of the session-manager `start` subcommand (#4555),
+ * split out of cli-manager.mjs to keep it under the line budget: where the
+ * bot token comes from ({@link telegramToken}), and the tmux launch that
+ * hands a provider-held token to the manager's session on stdin, never in
+ * argv ({@link launchWithToken}). The token value never reaches a return
+ * value that is printed, an error message or a log line.
+ * @module session-manager/cli-manager-token
+ */
+import path from "node:path";
+
+import {
+  CliError,
+  EXIT,
+  asSetupError,
+  asSetupErrorAsync,
+  run,
+} from "./cli-runtime.mjs";
+import { buildSourcedLaunch, buildStoreTokenCommand } from "./launch.mjs";
+import {
+  loadTokenSecrets,
+  resolveTelegramToken,
+  telegramSecretName,
+} from "./token-store.mjs";
+import { shellQuote } from "./token.mjs";
+
+/**
+ * Where `start` gets the Telegram bot token (#4555). With a secrets provider
+ * it is resolved once from the provider (exit 2 for a leftover plaintext
+ * file, naming the `store-token` command that migrates it; exit 1 when the
+ * provider cannot answer). With none, the plugin reads `<stateDir>/.env`.
+ * The value is kept off the returned JSON; `shellVars` is the foreground
+ * line's way to resolve it in the operator's own shell instead.
+ * @param {object} ctx - CLI context
+ * @param {string} managerName - `sessionManager.name`
+ * @param {string} stateDir - Resolved state dir
+ * @returns {Promise<{ source: "file" } | { source: "provider",
+ *   secret: string, value: string, shellVars: Record<string, string> }>}
+ *   Token source
+ */
+export async function telegramToken(ctx, managerName, stateDir) {
+  const secrets = await asSetupErrorAsync(() =>
+    loadTokenSecrets(ctx.root, ctx.env)
+  );
+  if (secrets === null) return { source: "file" };
+  const secret = telegramSecretName(managerName);
+  const value = await asSetupErrorAsync(() =>
+    resolveTelegramToken({
+      ...secrets,
+      name: secret,
+      stateDir,
+      fixCommand: buildStoreTokenCommand({
+        scriptsDir: ctx.scriptsDir,
+        projectRoot: ctx.root,
+      }),
+    })
+  );
+  const resolver = path.resolve(
+    ctx.scriptsDir,
+    "../../lisa-secrets-access/scripts/resolve-secret.mjs"
+  );
+  return {
+    source: "provider",
+    secret,
+    value,
+    shellVars: {
+      TELEGRAM_BOT_TOKEN: `$(node ${shellQuote(resolver)} get ${secret})`,
+    },
+  };
+}
+
+/**
+ * Start the manager's tmux session with the bot token on tmux's stdin
+ * (`start-server ; source-file -`), never in argv. tmux's own stderr is never
+ * passed through: a parse error can quote the line, which holds the token.
+ * @param {{ ctx: object, argv: string[], env: object,
+ *   token: { value: string }, foreground: () => string }} input - Context,
+ *   the launch argv, the scrubbed env, the token and the foreground line
+ */
+export function launchWithToken({ ctx, argv, env, token, foreground }) {
+  const sourced = asSetupError(() =>
+    buildSourcedLaunch(argv, { TELEGRAM_BOT_TOKEN: token.value })
+  );
+  const result = run("tmux", sourced.argv, {
+    env,
+    cwd: ctx.root,
+    input: sourced.input,
+  });
+  if (result.missing) throw new CliError("tmux is not on PATH.", EXIT.SETUP);
+  if (result.status !== 0) {
+    throw new CliError(
+      `tmux could not start the manager's session (exit ` +
+        `${String(result.status)}). tmux's own error is not shown, because ` +
+        `the command it read carries the bot token. Run the launch in the ` +
+        `foreground to see the error:\n  ${foreground()}`,
+      EXIT.FAILURE
+    );
+  }
+}

package/plugins/lisa/skills/lisa-session-manager/scripts/cli-manager.mjs

@@ -3,13 +3,22 @@
  * repo-dir and validate. The setup ones (init-config, store-token,
  * trust-status, coexistence) live in cli-setup.mjs.
  *
- * `start` hosts the manager in tmux. It refuses (exit 2) unless the bot
- * token file exists with owner-only permissions in the project's own state
- * dir, and it treats an existing tmux session started in this root as
+ * `start` hosts the manager in tmux. With Telegram as the notification
+ * channel and a secrets provider configured, it resolves the bot token once
+ * from the provider and hands it to tmux on stdin (#4555; see
+ * token-store.mjs). With Telegram and no provider it refuses (exit 2) unless
+ * the bot token file exists with owner-only permissions in the project's own
+ * state dir; with no channel
+ * (`notify.provider` `"none"`, or no `notify` block) it needs no token, state
+ * dir or plugin and launches without `--channels` (#4555). It treats an existing tmux session started in this root as
  * "already running" rather than starting a second poller on the same bot. A
  * session of that name started in another root is another project's manager,
  * so both `start` and `stop` refuse it (exit 2). `stop` kills only the
  * manager's tmux session: workers hold claimed work and keep running.
+ *
+ * The token lookup and stdin launch live in cli-manager-token.mjs and
+ * `status` in cli-status.mjs (re-exported here), to keep each module under
+ * the line budget.
  * @module session-manager/cli-manager
  */
 import {
@@ -18,25 +27,25 @@ import {
   GLOBAL_CONFIG_FILE,
   asSetupError,
   intFlag,
-  listAgents,
   loadProject,
   mustRun,
   requireConfig,
   requireLisaRepo,
   run,
 } from "./cli-runtime.mjs";
-import { resolveRepoDir } from "./config.mjs";
+import { launchWithToken, telegramToken } from "./cli-manager-token.mjs";
+import { notifyProvider, resolveRepoDir } from "./config.mjs";
 import { probeOwnSession, sessionSurvives } from "./isolation.mjs";
 import {
   assertTokenPresent,
   buildForegroundCommand,
-  buildHasSession,
   buildManagerLaunch,
   buildStopManager,
   resolveStateDir,
 } from "./launch.mjs";
-import { readLedger } from "./ledger.mjs";
-import { parseWorkerName, scrubWorkerEnv } from "./workers.mjs";
+import { scrubWorkerEnv } from "./workers.mjs";
+
+export { status } from "./cli-status.mjs";
 
 /**
  * The configured state dir, resolved (exit 2 for the shared default dir).
@@ -85,32 +94,49 @@ function settleMsOf(ctx) {
 export async function start(ctx) {
   const settleMs = settleMsOf(ctx);
   const config = requireConfig(ctx);
-  const stateDir = stateDirOf(ctx, config);
+  const notify = notifyProvider(config);
+  const stateDir = notify === "telegram" ? stateDirOf(ctx, config) : undefined;
   // tmux gets the scrubbed env: if this call starts the tmux server, its
   // global environment must not carry a TELEGRAM_* value into other sessions.
   const env = scrubWorkerEnv(ctx.env);
+  // A running manager already holds its token, so it is reported before the
+  // provider is asked for one: a rate-limited vault must not turn "already
+  // running" into a failure, or spend a vault call on nothing.
   const session = probeOwnSession(ctx, config.name, env);
   if (session.missing) throw new CliError("tmux is not on PATH.", EXIT.SETUP);
   if (session.running) {
     return { json: { status: "already-running", name: config.name } };
   }
-  asSetupError(() => assertTokenPresent(stateDir));
+  // Resolved before any session is created: a provider that cannot answer
+  // must leave nothing half-started.
+  const token =
+    stateDir === undefined
+      ? null
+      : await telegramToken(ctx, config.name, stateDir);
+  if (token?.source === "file") {
+    asSetupError(() => assertTokenPresent(stateDir));
+  }
   const argv = asSetupError(() =>
     buildManagerLaunch({
       name: config.name,
       root: ctx.root,
-      stateDir,
+      ...(stateDir === undefined ? {} : { stateDir }),
       scriptsDir: ctx.scriptsDir,
       interval: config.interval,
+      notify,
     })
   );
-  mustRun("tmux", argv, { env, cwd: ctx.root });
+  const foreground = () => buildForegroundCommand(argv, token?.shellVars ?? {});
+  if (token?.source === "provider") {
+    launchWithToken({ ctx, argv, env, token, foreground });
+  } else {
+    mustRun("tmux", argv, { env, cwd: ctx.root });
+  }
   if (!(await sessionSurvives(config.name, env, settleMs))) {
-    const foreground = buildForegroundCommand(argv);
     throw new CliError(
       `The manager's tmux session "${config.name}" exited within ` +
         `${settleMs} ms of starting, so the manager is not running. Run the ` +
-        `launch in the foreground to see claude's error:\n  ${foreground}`,
+        `launch in the foreground to see claude's error:\n  ${foreground()}`,
       EXIT.SETUP
     );
   }
@@ -118,7 +144,14 @@ export async function start(ctx) {
     json: {
       status: "started",
       name: config.name,
-      stateDir,
+      notify,
+      ...(stateDir === undefined ? {} : { stateDir }),
+      ...(token === null
+        ? {}
+        : {
+            tokenSource: token.source,
+            ...(token.secret ? { secret: token.secret } : {}),
+          }),
       attach: `tmux attach -t ${config.name}`,
     },
   };
@@ -174,7 +207,10 @@ function environmentProblems(ctx, config) {
       return [`sessionManager.repos.entries.${key}: ${error.message}`];
     }
   });
-  if (typeof config.notify?.stateDir === "string") {
+  if (
+    notifyProvider(config) === "telegram" &&
+    typeof config.notify?.stateDir === "string"
+  ) {
     try {
       stateDirOf(ctx, config);
     } catch (error) {
@@ -199,39 +235,3 @@ export function validate(ctx) {
     exitCode: errors.length === 0 ? EXIT.OK : EXIT.SETUP,
   };
 }
-
-/**
- * `status`: is the manager's tmux session up, and what does the ledger say
- * about each worker it dispatched.
- * @param {object} ctx - CLI context
- * @returns {Promise<{ json: object }>} `{manager,control,workers,untracked}`
- */
-export async function status(ctx) {
-  const config = requireConfig(ctx);
-  const tmux = run("tmux", buildHasSession(config.name), { env: ctx.env });
-  const agents = listAgents(ctx, { all: true });
-  const ledger = await readLedger(ctx.root);
-  const liveNames = new Set(
-    agents.filter(agent => agent.active).map(agent => agent.name)
-  );
-  const tracked = new Set(Object.values(ledger.items).map(i => i.worker));
-  return {
-    json: {
-      manager: { name: config.name, running: tmux.status === 0 },
-      control: ledger.control,
-      workers: Object.entries(ledger.items).map(([ref, item]) => ({
-        ref,
-        worker: item.worker ?? null,
-        sessionId: item.sessionId ?? null,
-        repo: item.repo ?? null,
-        status: item.status ?? null,
-        attempts: item.attempts ?? 0,
-        pendingQuestion: Boolean(item.pendingQuestion),
-        live: liveNames.has(item.worker),
-      })),
-      untracked: [...liveNames]
-        .filter(name => parseWorkerName(name) !== null && !tracked.has(name))
-        .sort(),
-    },
-  };
-}