@codyswann/lisa 4.85.0 → 4.86.1

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -3475,12 +3475,28 @@ if [ -f "$rules_file" ]; then
     # here — before the remaining rules ran, and with an exit status that is
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
-    # Consume the whole input: grep -q can close an early match while printf
-    # is still writing, making pipefail report SIGPIPE instead of the match.
+    # A here-string, never a pipe. With `printf | grep` under pipefail, a grep
+    # that stops at its first match (`-q`, and GNU grep whose stdout is
+    # /dev/null, which it treats as `-q`) closes the pipe while printf is still
+    # writing; printf takes SIGPIPE and the pipeline reports 141 instead of
+    # grep's 0. 141 lands in the `*)` arm below and a rule that MATCHED was
+    # reported as an invalid regex and not enforced (CodySwannGT/lisa#4564).
+    # A here-string has no writer process, so the status is grep's alone.
+    #
+    # The here-string is staged by the shell (a pipe, or a temp file for a
+    # large body or on Bash 3.2), and that staging can fail: no temp space,
+    # a file-size limit. A failed redirection on a bare `grep … <<<` returns
+    # 1, the same status as "no match", so the rule would silently pass. The
+    # brace group separates the two: grep's own status is captured INSIDE it,
+    # so the group itself only fails when the redirection could not be set up.
     rule_status=0
-    printf '%s' "$custom_command_str" | grep -Ei -- "$rule" >/dev/null || rule_status=$?
+    { grep -qEi -- "$rule" || rule_status=$?; } <<<"$custom_command_str" \
+      || rule_status=unstaged
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      # Fail closed: the rule could not be evaluated at all, which is not the
+      # same thing as the rule not matching.
+      unstaged) block "could not stage the command to check project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match
       # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
       # in a project's rules file silently disabled that rule — a guard the

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.85.0",
+  "version": "4.86.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -177,8 +177,11 @@ once at module startup with the DSN from the environment. Await a finite positiv
 flush budget on both success and original-error paths. A false flush result or
 rejection must not turn successful queue work into a retry or replace its real
 error. Keep diagnostics local and non-throwing, and preserve the client for warm
-invocations: `close()` disables it. The following helper wraps the host's existing
-business operation; it neither mutates context nor adds a Lambda callback.
+invocations: `close()` disables it. A warm container reuses the same process, so
+run each invocation inside `Sentry.withIsolationScope()`: tags, user and
+breadcrumbs that one invocation sets then stay with that invocation instead of
+leaking into the next one's events. The following helper wraps the host's existing
+business operation; it neither mutates the Lambda context nor adds a Lambda callback.
 
 <!-- lisa-node24-unwrapped-example:start -->
 ```ts
@@ -200,24 +203,28 @@ export async function withSentryFlush<T>(
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
     throw new RangeError("Choose a finite positive Sentry flush budget");
   }
-  try {
-    return await work();
-  } catch (originalError) {
-    try {
-      Sentry.captureException(originalError);
-    } catch {
-      // Preserve the original handler error even if capture fails.
-    }
-    throw originalError;
-  } finally {
+  // A fresh isolation scope per invocation: scope data set by one warm
+  // invocation must not be attached to the next invocation's events.
+  return Sentry.withIsolationScope(async () => {
     try {
-      if (!(await Sentry.flush(timeoutMs))) {
-        reportFlushProblem("Sentry flush did not finish in time");
+      return await work();
+    } catch (originalError) {
+      try {
+        Sentry.captureException(originalError);
+      } catch {
+        // Preserve the original handler error even if capture fails.
+      }
+      throw originalError;
+    } finally {
+      try {
+        if (!(await Sentry.flush(timeoutMs))) {
+          reportFlushProblem("Sentry flush did not finish in time");
+        }
+      } catch {
+        reportFlushProblem("Sentry flush rejected");
       }
-    } catch {
-      reportFlushProblem("Sentry flush rejected");
     }
-  }
+  });
 }
 ```
 <!-- lisa-node24-unwrapped-example:end -->

package/plugins/lisa-agy/skills/lisa-secrets-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-secrets-access
-description: "Vendor-neutral access layer for secrets. Every skill and script that needs an API key MUST resolve it through this skill rather than reading a keychain, an .env file, or a provider CLI directly. Models two independent axes — the provider a secret lives in (Bitwarden, 1Password, AWS Secrets Manager, Doppler, Vault) and the surface the code runs on (local, GitHub Actions, Codex Cloud) — resolving environment first, then a materialized file where the surface has one, then the provider by exact key name. Enforces one store per secret, fails closed on duplicate names, reads usage metadata from the provider's own note field, and never writes. Rotating credentials route through the separate rotate-secret writer, and copying one into a second store (Bitwarden → GitHub Actions) routes through the separate sync-secret-to-ci propagator."
+description: "Vendor-neutral access layer for secrets. Every skill and script that needs an API key MUST resolve it through this skill rather than reading a keychain, an .env file, or a provider CLI directly. Models two independent axes — the provider a secret lives in (Bitwarden, 1Password, AWS Secrets Manager, Doppler, Vault) and the surface the code runs on (local, GitHub Actions, Codex Cloud) — resolving environment first, then a materialized file where the surface has one, then the provider by exact key name. Enforces one store per secret, fails closed on duplicate names, reads usage metadata from the provider's own note field, and never writes. Rotating credentials route through the separate rotate-secret writer, and copying one into a second store (Bitwarden → GitHub Actions) routes through the separate sync-secret-to-ci propagator; the session manager's Telegram bot token is stored through its own store-token, which uses this skill's provider write path."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -273,6 +273,8 @@ No create, no update, no rotate. Writing secrets or their notes requires an auth
 
 The two writers are siblings, not modes: `rotate-secret.mjs` replaces a value **at its source**, and `sync-secret-to-ci.mjs` copies one **into a second store** without touching the source. Each needs an authority the resolver must not hold, so each is its own program with its own declaration list.
 
+A third, narrow writer lives outside this skill: the session manager's `store-token` (`lisa-session-manager/scripts/token-store.mjs`) stores the Telegram bot token as `TELEGRAM_BOT_TOKEN_<NAME>` through `providers.mjs` `createSecret` (a new record) or `writeSecret` (`--replace`), then reads it back through the ordinary provider view and compares hashes before deleting the plaintext file it replaces. It writes that one name only, and only when an operator runs it. `createSecret` is Bitwarden-only; on any other provider the operator creates the secret and `store-token` verifies it. Like `bws secret edit`, `bws secret create` (2.1.0) takes the value as a positional argument and its help offers no stdin or file option, so the value is in argv for the life of that one call: the same documented exception, confined the same way (no shell, `--output none`, and a failure message that never repeats the command line).
+
 ## Rotating credentials
 
 A **consumable** credential is one where using it can invalidate the stored copy: an OAuth refresh token the issuer replaces on every exchange, a short-lived session, a single-use enrollment token. The defining property is not "OAuth" — it is that a successful use makes the value on record wrong.
@@ -366,9 +368,9 @@ Values never enter that process, so its output cannot leak one even if logged.
 
 ## Provider dispatch
 
-| Provider | Read | Write (rotation only) |
+| Provider | Read | Write (rotation, and the session manager's `store-token`) |
 | --- | --- | --- |
-| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit`; temporary `create`/`delete` for AWS publication coordination |
+| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit`; `bws secret create <KEY> <VALUE> <PROJECT_ID> --output none` for `store-token` (`createSecret`); temporary `create`/`delete` for AWS publication coordination |
 | `doppler` | `doppler secrets download --no-file --format json` | not implemented |
 | `env` | environment only; the provider is the environment | n/a |
 | `1password` | `op read "op://<vault>/<name>/credential"` | not implemented |

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -701,6 +701,72 @@ export function rawByKey(cfg, key) {
   return matches[0] ?? null;
 }
 
+/** A provider error that names a rate limit (HTTP 429). */
+const RATE_LIMITED = /\b429\b|too many requests|rate.?limit/i;
+
+/**
+ * Run a provider CLI whose argv carries a secret value, and never let that
+ * argv reach an error message.
+ *
+ * `execFileSync` puts the whole command line in its error (`Command failed:
+ * bws secret create KEY <value> ...`), so a failed write would print the very
+ * value it was writing. The rethrown error keeps only what a caller needs to
+ * act on: the operation, the exit status and whether the provider
+ * rate-limited the call. Every other error (a missing binary's
+ * `spawnSync bws ENOENT`, a deadline {@link run} already reworded) is
+ * rebuilt too, keeping only its message (with the value redacted) and its
+ * `code`/`errno`/`syscall`/`status`/`signal`: Node's spawn errors also carry
+ * `spawnargs`, the full argv, value included, which a caller that logs or
+ * serializes the error would publish.
+ * @param {string} bin Executable name.
+ * @param {string[]} args Arguments, one of them a secret value.
+ * @param {NodeJS.ProcessEnv} env Environment for the child.
+ * @param {string} operation What the call was doing, in operator words.
+ * @param {string} value The secret value in `args`, redacted from any error.
+ * @returns {string} Captured stdout.
+ */
+function runWithValue(bin, args, env, operation, value) {
+  try {
+    return run(bin, args, env, operation);
+  } catch (error) {
+    // Node's "Command failed: <command line>" error carries argv in its text.
+    if (!String(error?.message ?? "").startsWith("Command failed")) {
+      throw withoutArgv(error, value);
+    }
+    const why = RATE_LIMITED.test(String(error.stderr ?? ""))
+      ? "the provider rate-limited the request (429 Too Many Requests)"
+      : "the provider refused the request or could not be reached";
+    throw new Error(
+      `${operation} failed (exit ${error.status ?? error.signal}): ${why}. ` +
+        `The command's own output is withheld because its arguments carry ` +
+        `the secret value.`
+    );
+  }
+}
+
+/** The fields of a spawn error that carry no argv, output or value. */
+const SAFE_ERROR_FIELDS = ["code", "errno", "syscall", "status", "signal"];
+
+/**
+ * A copy of a child-process error with no argv on it: a fresh Error whose
+ * message has `value` redacted, and only {@link SAFE_ERROR_FIELDS}. Drops
+ * `spawnargs`, `cmd`, `path`, `stdout`, `stderr` and `output`.
+ * @param {unknown} error What the call threw.
+ * @param {string} value The secret value to redact.
+ * @returns {Error} The rebuilt error.
+ */
+function withoutArgv(error, value) {
+  const text = String(error?.message ?? error);
+  const message = value ? text.split(String(value)).join("<redacted>") : text;
+  const safe = Object.fromEntries(
+    SAFE_ERROR_FIELDS.filter(key => error?.[key] !== undefined).map(key => [
+      key,
+      error[key],
+    ])
+  );
+  return Object.assign(new Error(message), safe);
+}
+
 /**
  * Write a replacement value back to the provider.
  *
@@ -709,7 +775,8 @@ export function rawByKey(cfg, key) {
  * Bitwarden CLI exposes no stdin path for an edit, so this is a documented
  * exception rather than an oversight: it is confined to the one operation that
  * cannot be expressed otherwise, and `execFileSync` at least keeps the value
- * out of a shell and therefore out of shell history.
+ * out of a shell and therefore out of shell history. A failure is reported
+ * through {@link runWithValue}, so the value never reaches the error either.
  * @param {object} cfg Resolved configuration.
  * @param {string} id Provider-side identifier for the secret.
  * @param {string} value Replacement value.
@@ -718,11 +785,12 @@ export function writeSecret(cfg, id, value) {
   const env = providerEnv(cfg);
 
   if (cfg.provider === "bitwarden") {
-    run(
+    runWithValue(
       "bws",
       ["secret", "edit", id, "--value", value],
       env,
-      "updating a secret in Bitwarden"
+      "updating a secret in Bitwarden",
+      value
     );
     return;
   }
@@ -732,6 +800,56 @@ export function writeSecret(cfg, id, value) {
   );
 }
 
+/**
+ * Create one new secret in the provider.
+ *
+ * The one caller is the session manager's `store-token` (#4555), which moves
+ * the Telegram bot token out of a plaintext file and into the vault, then
+ * reads it back to prove the write before deleting the file. It never
+ * replaces an existing record: that is {@link writeSecret}'s job.
+ *
+ * The value is a positional argument, the same documented exception as
+ * {@link writeSecret}: `bws secret create` (2.1.0) takes `<KEY> <VALUE>
+ * <PROJECT_ID>` and its help lists no stdin or file option for the value, so
+ * there is no way to keep it out of argv. `execFileSync` keeps it out of a
+ * shell, `--output none` keeps the created record (value included) off
+ * stdout, and {@link runWithValue} keeps it out of any error.
+ *
+ * Bitwarden only. Other providers fail with a message naming where to add
+ * one; until then the operator creates the secret in the vault themselves.
+ * @param {object} cfg Resolved configuration.
+ * @param {{name: string, value: string, projectId: string, note?: string}}
+ *   secret Exact key, value, target provider project and usage note.
+ */
+export function createSecret(cfg, { name, value, projectId, note }) {
+  if (!ENV_KEY.test(name)) {
+    throw new Error(`secret name is not an environment variable name: ${name}`);
+  }
+  if (cfg.provider === "bitwarden") {
+    runWithValue(
+      "bws",
+      [
+        "secret",
+        "create",
+        name,
+        value,
+        projectId,
+        ...(note ? ["--note", note] : []),
+        "--output",
+        "none",
+      ],
+      providerEnv(cfg),
+      "creating a secret in Bitwarden",
+      value
+    );
+    return;
+  }
+  throw new Error(
+    `provider "${cfg.provider}" has no create implemented.\n` +
+      `Create the secret in the provider yourself, or add one in providers.mjs.`
+  );
+}
+
 /**
  * Create one provider-issued publication contender in the target project.
  *

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -664,12 +664,19 @@ const STALL_RULES = {
   requestionHours: [n => n >= 0, "zero or a positive number"],
 };
 
+/** Notification providers `sessionManager.notify.provider` accepts. */
+const NOTIFY_PROVIDERS = ["none", "telegram"];
+
 /**
  * Validate `sessionManager.notify`.
  *
- * `stateDir` is required rather than defaulted here: the default dir is shared
- * by every project, and a shared dir is exactly how one project's bot gets
- * taken over by another's session.
+ * A notification channel is optional (#4555): an absent block, an absent
+ * provider and `"none"` all mean the manager runs with no channel, and then
+ * there is no state dir to name. A `stateDir` without the telegram provider is
+ * refused rather than ignored, because it means the operator believes a bot is
+ * attached when none will be. For telegram, `stateDir` is required rather than
+ * defaulted here: the default dir is shared by every project, and a shared dir
+ * is exactly how one project's bot gets taken over by another's session.
  * @param {unknown} notify The declared value.
  * @returns {string[]} Problems found.
  */
@@ -677,56 +684,104 @@ function validateNotify(notify) {
   if (notify !== undefined && !isPlainObject(notify)) {
     return ["sessionManager.notify must be an object"];
   }
-  const provider = notify?.provider;
-  const stateDir = notify?.stateDir;
-  return [
-    ...(provider === undefined || provider === "telegram"
-      ? []
-      : [
-          `sessionManager.notify.provider ${JSON.stringify(provider)} is not ` +
-            `supported. Only "telegram" is implemented.`,
-        ]),
-    ...(typeof stateDir === "string" && stateDir.trim() !== ""
-      ? []
-      : [
-          `sessionManager.notify.stateDir is missing. Each project needs its ` +
-            `own Telegram state dir, such as ` +
-            `"~/.claude/channels/telegram-<project>".`,
-        ]),
-  ];
+  const provider = notify?.provider ?? "none";
+  if (!NOTIFY_PROVIDERS.includes(provider)) {
+    return [
+      `sessionManager.notify.provider ${JSON.stringify(provider)} is not ` +
+        `supported. Use "none" (no notification channel) or "telegram".`,
+    ];
+  }
+  const hasStateDir = notify?.stateDir !== undefined;
+  const stateDirOk =
+    typeof notify?.stateDir === "string" && notify.stateDir.trim() !== "";
+  if (provider === "none") {
+    return hasStateDir
+      ? [
+          `sessionManager.notify.stateDir is set, but notify.provider is not ` +
+            `"telegram", so no bot would use it. Set notify.provider to ` +
+            `"telegram", or remove notify.stateDir.`,
+        ]
+      : [];
+  }
+  return stateDirOk
+    ? []
+    : [
+        `sessionManager.notify.stateDir is missing. Each project needs its ` +
+          `own Telegram state dir, such as ` +
+          `"~/.claude/channels/telegram-<project>".`,
+      ];
+}
+
+/**
+ * Maps under `sessionManager` whose KEYS are names chosen by the project, not
+ * config field names. `repos.entries` is keyed by child repository directory,
+ * so a repo called `token-service` or `secrets-manager` is a name, not a
+ * credential field; testing it against CREDENTIAL_KEY made `init-config
+ * --write` emit a block that `validate` then refused (CodySwannGT/lisa#4564).
+ * Their VALUES are still walked, so a token placed inside an entry is caught.
+ */
+const NAME_KEYED_MAPS = [["repos", "entries"]];
+
+/**
+ * Whether a key trail below `sessionManager` is exactly a name-keyed map.
+ * Compared segment by segment, never as a dotted string: a literal key
+ * `"repos.entries"` would otherwise borrow the exemption.
+ * @param {readonly string[]} segments Object keys from the block root.
+ * @returns {boolean} True for a map whose keys are names.
+ */
+function isNameKeyedMap(segments) {
+  return NAME_KEYED_MAPS.some(
+    map =>
+      map.length === segments.length &&
+      map.every((segment, i) => segment === segments[i])
+  );
 }
 
 /**
  * Walk the block for anything that looks like a credential.
  *
  * Config is committed, and this block configures a bot that grants shell
- * access over chat. The token belongs in the state dir's dotenv file (mode
- * 0600), so a token here is both leaked and unused. The value is never echoed.
+ * access over chat. The token belongs in the project's secrets provider
+ * (#4555; the state dir's 0600 dotenv file only when no provider is
+ * configured), so a token here is both leaked and unused. The value is never
+ * echoed.
  * @param {unknown} value Subtree.
- * @param {string} path Dotted path so far.
+ * @param {string} path Dotted path so far, for messages.
+ * @param {readonly string[] | null} [segments] Object keys from the block root;
+ *   `null` once an array is crossed, since no name-keyed map lives there.
  * @returns {string[]} Problems found.
  */
-function findCredentials(value, path) {
+function findCredentials(value, path, segments = []) {
   if (typeof value === "string") {
     return TOKEN_VALUE.test(value.trim())
       ? [
-          `${path} looks like a bot token. Tokens never go in config; ` +
-            `/lisa:setup:session-manager stores it in the state dir.`,
+          `${path} looks like a bot token. Tokens never go in config: ` +
+            `remove it, and store the token in the project's secrets ` +
+            `provider with session-manager.mjs store-token ` +
+            `(/lisa:setup:session-manager runs it).`,
         ]
       : [];
   }
   if (Array.isArray(value)) {
-    return value.flatMap((item, i) => findCredentials(item, `${path}[${i}]`));
+    return value.flatMap((item, i) =>
+      findCredentials(item, `${path}[${i}]`, null)
+    );
   }
   if (!isPlainObject(value)) return [];
+  const keysAreNames = segments !== null && isNameKeyedMap(segments);
   return Object.entries(value).flatMap(([key, child]) =>
-    CREDENTIAL_KEY.test(key)
+    !keysAreNames && CREDENTIAL_KEY.test(key)
       ? [
           `${path}.${key} names a credential. Tokens and secrets never go in ` +
-            `config; /lisa:setup:session-manager stores the bot token in the ` +
-            `state dir.`,
+            `config: remove it, and keep the bot token in the project's ` +
+            `secrets provider (session-manager.mjs store-token, run by ` +
+            `/lisa:setup:session-manager).`,
         ]
-      : findCredentials(child, `${path}.${key}`)
+      : findCredentials(
+          child,
+          `${path}.${key}`,
+          segments === null ? null : [...segments, key]
+        )
   );
 }