@codyswann/lisa 2.178.0 → 2.178.2

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.178.0",
+  "version": "2.178.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.178.0",
+  "version": "2.178.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.178.0",
+  "version": "2.178.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.178.0",
+  "version": "2.178.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/reference/integration-access-layer.md

@@ -22,7 +22,7 @@ available.
 | Atlassian | `lisa:atlassian-access` | `ATLASSIAN_API_TOKEN` | Atlassian Cloud REST |
 | Notion | `lisa:notion-access` | `NOTION_API_TOKEN` | Notion REST |
 | Linear | `lisa:linear-access` | `LINEAR_API_KEY` | Linear GraphQL |
-| Jam | `lisa:jam-access` | `JAM_PAT` | Jam MCP HTTP endpoint with bearer PAT |
+| Jam | `lisa:jam-access` | `JAM_PAT` | Jam CLI |
 | SonarCloud | `lisa:sonarcloud-access` | `SONAR_TOKEN` | SonarCloud Web API |
 | Sentry | `lisa:sentry-access` | `SENTRY_AUTH_TOKEN` | Sentry REST API |
 | PostHog | `lisa:posthog-access` | `POSTHOG_PERSONAL_API_KEY` | PostHog REST API |

package/plugins/lisa-copilot/skills/analyze-claude-remote/SKILL.md

@@ -133,11 +133,35 @@ Group the findings as:
    `RISK`/`GAP` (need a local process — only viable if the cloud session can spawn them from the
    repo). Flag interactively/OAuth-authed servers as `GAP` for headless auth — they cannot complete
    a browser flow headless **regardless of transport** (an HTTP MCP like `linear-server` is still a
-   `GAP` because its *auth* is OAuth, not because of its transport). When an OAuth MCP backs an
-   active tracker/source, do not stop at the `GAP` — cross-reference group 4a and point to the
-   integration's token substrate as the headless replacement (e.g. `linear-server` MCP → `LINEAR_API_KEY`
-   + Linear GraphQL). Note any user-scoped MCP (`~/.claude.json`) as `GAP` — it never reaches the
-   cloud; it must be moved into project `.mcp.json`.
+   `GAP` because its *auth* is OAuth, not because of its transport). Before finalizing any
+   OAuth/interactive/stdio MCP as a flat `GAP`, check for a documented headless substrate: a
+   static-token MCP header, a vendor CLI that can login from an env token, or a token-authenticated
+   REST API that the MCP wraps. If documented evidence exists, mark the MCP `headlessUsable: true`
+   in the inventory, mark the supporting secret `required: false` / `secret: true` unless the
+   integration is active, and set `replacedBy` to the concrete substrate rather than leaving it as
+   an impossible capability. When an OAuth MCP backs an active tracker/source, do not stop at the
+   `GAP` — cross-reference group 4a and point to the integration's token substrate as the headless
+   replacement (e.g. `linear-server` MCP -> `LINEAR_API_KEY` + Linear GraphQL). Note any user-scoped
+   MCP (`~/.claude.json`) as `GAP` — it never reaches the cloud; it must be moved into project
+   `.mcp.json`.
+
+   Use this data-driven hint table as seed evidence, and extend it only when you can cite a vendor
+   doc or committed access-skill reference:
+
+   | Match | Substrate | Env | Setup / wiring | Domains |
+   |---|---|---|---|---|
+   | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
+   | `mcp/sonarqube`, `sonarqube`, or SonarCloud/SonarQube MCP entries | SonarCloud Web API | `SONAR_TOKEN` | use REST calls against `https://sonarcloud.io/api/`; if a host needs legacy token-as-basic-auth, put that in the access adapter | `sonarcloud.io` |
+
+   For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
+   the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
+   generator can print a commented `.mcp.json` example. Do **not** use that for Jam: Jam's preferred
+   headless substrate is the `jam` CLI, so the generator should emit CLI setup lines instead of an
+   `.mcp.json` header snippet.
+
+   When no documented substrate is known, keep the MCP as `headlessUsable: false` / `GAP`, and add
+   an action line like: `check the vendor for a documented PAT, API-key, CLI, or REST substrate`.
+   Never assert that no substrate exists unless the vendor documentation explicitly says so.
 
 6. **Config scope & memory gaps** — identify reliance on user-scoped config that will not load
    remotely: `~/.claude/CLAUDE.md`, user `enabledPlugins`, user skills/agents, user MCP. Most
@@ -148,9 +172,14 @@ Group the findings as:
 7. **Platform constraints** — surface the non-config constraints as `GAP`/`RISK` so the user is
    not surprised: routines run with no interactive permission prompts and cannot ask the user
    mid-run; interactive auth (SSO/OAuth browser, keychain) is unavailable; GitHub org IP
-   allowlisting blocks cloud sessions; outbound traffic is proxied and custom domains need
-   allowlisting; resource limits (~4 vCPU / 16 GB RAM / 30 GB disk); no desktop/computer-use; no
-   statusline/theme rendering.
+   allowlisting blocks cloud sessions; raw GitHub clone/fetch/push operations are handled by
+   Claude's connected-GitHub proxy/identity and do not need a separate PAT; the `gh` CLI is not the
+   same substrate and still needs `GH_TOKEN`; outbound traffic is controlled by the routine
+   environment network tier, where the default Trusted tier includes common development domains and
+   package registries but arbitrary integration hosts need Custom or Full access; environment
+   variables and setup scripts are stored in the cloud environment configuration and are visible to
+   anyone who can edit that environment; resource limits (~4 vCPU / 16 GB RAM / 30 GB disk); no
+   desktop/computer-use; no statusline/theme rendering.
 
 8. **Host-project app needs** — note any build/test/run command a routine would invoke and any
    runtime service it depends on (database, queue, external API) that will not exist in a fresh
@@ -168,9 +197,18 @@ unsuffixed `…_TOKEN`/`…_KEY` is the simplest to set in a single-account rout
 
 ### GitHub — `tracker: github` and/or `source: github`
 - Headless substrate: `gh` CLI authed by token (every Lisa GitHub script gates on `gh auth status`).
-- Env: `GH_TOKEN` (the routine's built-in repo connection may not authenticate the `gh` CLI — verify; set `GH_TOKEN` if `gh auth status` fails). `PAT` only for cross-repo flows.
+- Platform substrate: Claude's connected-GitHub proxy/identity authenticates raw git
+  clone/fetch/push for repositories the routine can access. Do not ask for a PAT solely for raw git
+  or sibling-repo clones.
+- Env: `GH_TOKEN` for the `gh` CLI only; set it because Lisa's PR/issue lifecycle shells out to
+  `gh`. Do not describe it as required for raw git clone/fetch/push.
 - Acquire: fine-grained — `https://github.com/settings/personal-access-tokens`; classic — `https://github.com/settings/tokens`.
-- Access: fine-grained → Repository access to the target repo(s); Repository permissions: Contents R/W, Issues R/W, Pull requests R/W, Metadata R (mandatory); add Workflows R/W only if editing `.github/workflows`, and Organization → Projects R/W only if using ProjectV2. Classic equivalent: `repo` + `workflow` (+ `project`, `read:org` for boards). The identity must hold WRITE/MAINTAIN/ADMIN on the repo.
+- Access: fine-grained → Repository access to the repo(s) where Lisa will run `gh` commands (the
+  project repo, and the Lisa repo only if filing Lisa issues); Repository permissions: Contents R/W,
+  Issues R/W, Pull requests R/W, Metadata R (mandatory); add Workflows R/W only if editing
+  `.github/workflows`, and Organization → Projects R/W only if using ProjectV2. Do not include
+  sibling repos that are only cloned/fetched with raw git. Classic equivalent: `repo` + `workflow`
+  (+ `project`, `read:org` for boards). The identity must hold WRITE/MAINTAIN/ADMIN on the repo.
 
 ### JIRA — `tracker: jira`
 - Headless substrate: `jira-cli` + curl (Basic auth). The acli and Atlassian-MCP tiers need prior interactive/OAuth auth → not viable headless.
@@ -236,12 +274,41 @@ so the generator can render acquisition comments into its template:
       "headlessSubstrate": "gh CLI (token)",
       "acquireUrl": "https://github.com/settings/personal-access-tokens",
       "accessScope": "fine-grained PAT on target repo: Contents R/W, Issues R/W, Pull requests R/W, Metadata R; +Workflows R/W if editing .github/workflows; +Projects R/W if using ProjectV2"
+    },
+    {
+      "name": "JAM_PAT", "required": false, "secret": true, "integration": "jam",
+      "reason": "optional non-tracker MCP recovery; Jam CLI can authenticate headlessly from a PAT",
+      "headlessSubstrate": "jam CLI (PAT)",
+      "acquireUrl": "https://jam.dev/docs/debug-a-jam/mcp/personal-access-tokens",
+      "accessScope": "Jam Personal Access Token for the workspace/team whose traces the routine needs to read",
+      "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
+    },
+    {
+      "name": "SONAR_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "reason": "optional non-tracker MCP recovery; SonarQube MCP wraps the token-authenticated SonarCloud Web API",
+      "headlessSubstrate": "SonarCloud Web API (token)",
+      "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
+      "accessScope": "token must be able to read the target SonarCloud organization/project quality gate, issues, hotspots, rules, and source snippets"
     }
   ],
   "mcp": [
-    { "name": "linear-server", "transport": "http", "auth": "oauth", "headlessUsable": false, "replacedBy": "LINEAR_API_KEY + Linear GraphQL", "dormant": true }
+    { "name": "linear-server", "transport": "http", "auth": "oauth", "headlessUsable": false, "replacedBy": "LINEAR_API_KEY + Linear GraphQL", "dormant": true },
+    { "name": "jam", "transport": "http", "auth": "oauth", "headlessUsable": true, "replacedBy": "jam CLI + JAM_PAT", "dormant": true },
+    { "name": "sonarqube", "transport": "stdio", "auth": "local-wrapper", "headlessUsable": true, "replacedBy": "SONAR_TOKEN + SonarCloud Web API", "dormant": true }
   ],
   "gaps": [ "auto-memory not synced to cloud", "bun package fetch behind proxy", "OS keychain absent — env-var token form only" ],
+  "platform": {
+    "githubProxy": {
+      "rawGitAuthenticated": true,
+      "crossRepoAccess": "repositories reachable by the connected GitHub identity/routine access do not need a PAT for raw git",
+      "ghCliNeedsToken": true
+    },
+    "secretsVisibility": "environment variables and setup scripts are visible to environment editors"
+  },
+  "networkAccess": {
+    "tier": "custom",
+    "allowlistDomains": []
+  },
   "allowlistDomains": []
 }
 ```
@@ -269,5 +336,16 @@ so the generator can render acquisition comments into its template:
   Lisa's `setup-*` skills) — transcribe them exactly; never guess at the access a token needs.
 - For the active `tracker`/`source`, always report the **env-var** form of the secret, never the OS
   keychain form — keychain reads do not work in a cloud routine.
+- For GitHub, keep the split explicit: raw git uses the platform GitHub proxy/identity, while
+  `GH_TOKEN` is for `gh` CLI commands. Sibling repos that are only cloned or fetched with raw git do
+  not belong in the token scope.
+- Add GitHub/npm/PyPI/Docker Hub/common development domains to neither `allowlistDomains` nor
+  `networkAccess.allowlistDomains`; those are covered by the routine environment's default Trusted
+  list. Only non-default integration hosts require Custom-network allowlisting.
+- Always include a `RISK`/`GAP` finding when environment secrets or setup scripts would be visible
+  to environment editors; never imply the generated script can hide them.
 - A browser-OAuth MCP (or interactively-authed CLI) backing an active integration is a `GAP`; the
   remediation is its token substrate from the table, not "authenticate the MCP".
+- For non-tracker MCPs, a documented CLI, PAT/API-key, or REST substrate converts the finding from
+  a flat `GAP` into an `OPTIONAL` headless recovery path; unknown vendors remain gaps with a
+  vendor-substrate follow-up, not invented credentials.

package/plugins/lisa-copilot/skills/generate-claude-remote-build-script/SKILL.md

@@ -30,8 +30,9 @@ tracker/source, plus the host project's own package manager and tooling — not
 ## Procedure
 
 1. **Inventory.** Invoke `/lisa:analyze-claude-remote --json` and parse its machine-readable
-   inventory block (`packageManager`, `tools`, `env`, `mcp`, `gaps`, `allowlistDomains`). If the
-   analysis cannot run, stop and report why — never emit a script from guesses.
+   inventory block (`packageManager`, `tools`, `env`, `mcp`, `gaps`, `platform`,
+   `networkAccess`, `allowlistDomains`). If the analysis cannot run, stop and report why — never
+   emit a script from guesses.
 
 2. **Compose the setup script** from the inventory. The script must be:
    - **Idempotent & detect-before-install** — every install guarded by a `command -v <tool>` check
@@ -62,11 +63,38 @@ tracker/source, plus the host project's own package manager and tooling — not
    where to get the token and what permissions it needs. Emit only the **env-var form** of the name
    that the analysis reported (including any per-account suffixed form like `LINEAR_API_KEY_<slug>`);
    never emit a keychain instruction — keychain does not exist in a cloud routine.
+   When the entry is `GH_TOKEN`, add a comment from `platform.githubProxy` clarifying that the token
+   is for `gh` CLI commands against the project/Lisa repos, not for raw git clone/fetch/push or
+   sibling repos reachable through the routine's GitHub proxy.
+   For OPTIONAL non-tracker MCP recovery entries discovered by
+   `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
+   include `JAM_PAT`, `SONAR_TOKEN`, or similar documented substrate env vars
+   only as optional secrets, with their acquire/scope comments when the analysis
+   supplied them. Never invent values or promote dormant substrates to required.
+
+3a. **Emit substrate setup snippets.** When the inventory marks an MCP
+   `headlessUsable: true` through a documented substrate, render the matching
+   wiring guidance as commented, opt-in setup:
+   - CLI substrates: emit the detected install/login commands gated on the
+     optional env var. For Jam, this means `curl -fsSL https://native.jam.dev/install | bash`,
+     `export PATH="$HOME/.local/bin:$PATH"`, `printf '%s' "$JAM_PAT" | jam auth login --token`,
+     and `jam skills install`, all inside `[ -n "${JAM_PAT:-}" ] && ...` guards so missing
+     optional secrets do not fail the environment build.
+   - REST substitute substrates: do not install an MCP. Emit comments naming the
+     REST host and env var (for example `SONAR_TOKEN` with `https://sonarcloud.io/api/`) and
+     rely on the access skill or generated consumer to call the API.
+   - PAT-bearer MCP substrates: print a commented `.mcp.json` `headers` snippet from the
+     inventory's `mcpHeaders`. Use this only when the analysis explicitly says the same MCP
+     transport supports static-token auth. Do not print a Jam `.mcp.json` header snippet because
+     Jam's preferred headless substrate is its PAT-authenticated CLI.
 
 4. **Emit the allowlist + gaps notice.** List any custom domains the setup or runtime reaches
-   (from `allowlistDomains`) that the user must add to the environment's network access, and echo
-   the `gaps` from the analysis (auto-memory not synced, interactive-auth/stdio-MCP unavailable,
-   etc.) as a header comment so the user knows what the script **cannot** fix.
+   (from `networkAccess.allowlistDomains`, falling back to legacy `allowlistDomains`) that the user
+   must add when the environment needs Custom network access. Do not include default Trusted domains
+   such as GitHub, npm/PyPI registries, or Docker Hub. Echo the `gaps` from the analysis
+   (auto-memory not synced, interactive-auth/stdio-MCP unavailable, etc.) and the
+   `platform.secretsVisibility` warning as a header comment so the user knows what the script
+   **cannot** fix.
 
 5. **Write and report.** Write the script to `--out` (default `scripts/claude-remote-setup.sh`),
    `chmod +x` it, and print: the path, a one-line summary of what it installs and which env vars to
@@ -92,9 +120,11 @@ shape, not a fixed payload):
 #   # --- credentials for the active tracker/source (set in the environment UI) ---
 #   # Acquire: https://github.com/settings/personal-access-tokens
 #   # Access:  fine-grained PAT on target repo: Contents R/W, Issues R/W, Pull requests R/W, Metadata R
+#   # Note: GH_TOKEN is for gh CLI only. Raw git uses Claude's connected-GitHub proxy/identity;
+#   # sibling repos reached only by raw git do not need to be in this token scope.
 #   - GH_TOKEN=<token>                          # REQUIRED, github is the active tracker+source
-# NETWORK: allowlist these domains in the environment if not on full access:
-#   - <allowlistDomains, if any>
+# NETWORK: set the environment to Custom and allowlist these non-default domains if not on Full:
+#   - <networkAccess.allowlistDomains, if any>
 set -uo pipefail
 
 need() { command -v "$1" >/dev/null 2>&1; }
@@ -152,8 +182,12 @@ to stop are: the analysis could not run, or the `--out` path is not writable.
 - Never write real secret values into the script or template — names and placeholders only.
 - For active tracker/source credentials, carry the analysis's `Acquire:` URL and `Access:` scope into
   the template as comments, and emit only the env-var form of the name — never a keychain command.
+- For `GH_TOKEN`, preserve the analysis's GitHub proxy split: it is for `gh` CLI commands only, and
+  raw git/cross-repo clone guidance must not expand the token scope to sibling repositories.
 - Never emit an install for a tool the analysis did not surface, and never install `OPTIONAL` tools
   unless `--include-optional` is set.
+- Prefer `networkAccess.allowlistDomains` over legacy top-level `allowlistDomains`; never emit
+  domains already covered by the routine environment's default Trusted list.
 - Keep the script idempotent and detect-before-install so it is safe to re-run and cache.
 - Preserve the inventory's `REQUIRED` vs `OPTIONAL` distinction in both fail-behavior (fatal vs
   warn) and section placement.

package/plugins/lisa-copilot/skills/jam-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: jam-access
-description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to JAM_PAT bearer auth for headless routines."
+description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to the JAM_PAT-authenticated Jam CLI for headless routines."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -24,16 +24,16 @@ Return parsed JSON or a concise structured summary in a `<result>` block.
 Probe in order:
 
 1. Jam MCP, if the tool is available and authenticated.
-2. `JAM_PAT` bearer token against Jam's MCP/trace HTTP substrate.
+2. Jam CLI authenticated with `JAM_PAT`.
 
-Jam documents personal access tokens for MCP clients so a browser OAuth flow is
-not required. The headless tier uses:
+Jam documents a PAT-authenticated CLI that is cleaner for remote routines than
+editing `.mcp.json` headers. The headless tier uses:
 
 ```bash
-curl -sS "https://mcp.jam.dev/mcp" \
-  -H "Authorization: Bearer $JAM_PAT" \
-  -H "Content-Type: application/json" \
-  --data-binary "$PAYLOAD"
+curl -fsSL https://native.jam.dev/install | bash
+export PATH="$HOME/.local/bin:$PATH"
+printf '%s' "$JAM_PAT" | jam auth login --token
+jam skills install
 ```
 
 If neither tier works, fail with:
@@ -45,7 +45,8 @@ Error: no Jam access substrate available. Authenticate the Jam MCP or set JAM_PA
 ## Invariants
 
 - Fallback is gated on `JAM_PAT`; do not retry Jam MCP failures blindly.
-- Never commit a Jam PAT into `.mcp.json`. Use env interpolation in host MCP
-  config, for example `Authorization: Bearer ${JAM_PAT}`.
-- If a requested operation is not yet mapped to the Jam HTTP substrate, surface
+- Never commit a Jam PAT into `.mcp.json` or any generated setup artifact.
+- Headless Jam access requires `native.jam.dev` for the installer and
+  `api.jam.dev` for CLI/API calls in any custom remote network allowlist.
+- If a requested operation is not yet mapped to the Jam CLI substrate, surface
   that exact missing adapter instead of pretending the trace is unavailable.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.178.0",
+  "version": "2.178.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/integration-access-layer-reference.mdc

@@ -27,7 +27,7 @@ available.
 | Atlassian | `lisa:atlassian-access` | `ATLASSIAN_API_TOKEN` | Atlassian Cloud REST |
 | Notion | `lisa:notion-access` | `NOTION_API_TOKEN` | Notion REST |
 | Linear | `lisa:linear-access` | `LINEAR_API_KEY` | Linear GraphQL |
-| Jam | `lisa:jam-access` | `JAM_PAT` | Jam MCP HTTP endpoint with bearer PAT |
+| Jam | `lisa:jam-access` | `JAM_PAT` | Jam CLI |
 | SonarCloud | `lisa:sonarcloud-access` | `SONAR_TOKEN` | SonarCloud Web API |
 | Sentry | `lisa:sentry-access` | `SENTRY_AUTH_TOKEN` | Sentry REST API |
 | PostHog | `lisa:posthog-access` | `POSTHOG_PERSONAL_API_KEY` | PostHog REST API |

package/plugins/lisa-cursor/skills/analyze-claude-remote/SKILL.md

@@ -133,11 +133,35 @@ Group the findings as:
    `RISK`/`GAP` (need a local process — only viable if the cloud session can spawn them from the
    repo). Flag interactively/OAuth-authed servers as `GAP` for headless auth — they cannot complete
    a browser flow headless **regardless of transport** (an HTTP MCP like `linear-server` is still a
-   `GAP` because its *auth* is OAuth, not because of its transport). When an OAuth MCP backs an
-   active tracker/source, do not stop at the `GAP` — cross-reference group 4a and point to the
-   integration's token substrate as the headless replacement (e.g. `linear-server` MCP → `LINEAR_API_KEY`
-   + Linear GraphQL). Note any user-scoped MCP (`~/.claude.json`) as `GAP` — it never reaches the
-   cloud; it must be moved into project `.mcp.json`.
+   `GAP` because its *auth* is OAuth, not because of its transport). Before finalizing any
+   OAuth/interactive/stdio MCP as a flat `GAP`, check for a documented headless substrate: a
+   static-token MCP header, a vendor CLI that can login from an env token, or a token-authenticated
+   REST API that the MCP wraps. If documented evidence exists, mark the MCP `headlessUsable: true`
+   in the inventory, mark the supporting secret `required: false` / `secret: true` unless the
+   integration is active, and set `replacedBy` to the concrete substrate rather than leaving it as
+   an impossible capability. When an OAuth MCP backs an active tracker/source, do not stop at the
+   `GAP` — cross-reference group 4a and point to the integration's token substrate as the headless
+   replacement (e.g. `linear-server` MCP -> `LINEAR_API_KEY` + Linear GraphQL). Note any user-scoped
+   MCP (`~/.claude.json`) as `GAP` — it never reaches the cloud; it must be moved into project
+   `.mcp.json`.
+
+   Use this data-driven hint table as seed evidence, and extend it only when you can cite a vendor
+   doc or committed access-skill reference:
+
+   | Match | Substrate | Env | Setup / wiring | Domains |
+   |---|---|---|---|---|
+   | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
+   | `mcp/sonarqube`, `sonarqube`, or SonarCloud/SonarQube MCP entries | SonarCloud Web API | `SONAR_TOKEN` | use REST calls against `https://sonarcloud.io/api/`; if a host needs legacy token-as-basic-auth, put that in the access adapter | `sonarcloud.io` |
+
+   For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
+   the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
+   generator can print a commented `.mcp.json` example. Do **not** use that for Jam: Jam's preferred
+   headless substrate is the `jam` CLI, so the generator should emit CLI setup lines instead of an
+   `.mcp.json` header snippet.
+
+   When no documented substrate is known, keep the MCP as `headlessUsable: false` / `GAP`, and add
+   an action line like: `check the vendor for a documented PAT, API-key, CLI, or REST substrate`.
+   Never assert that no substrate exists unless the vendor documentation explicitly says so.
 
 6. **Config scope & memory gaps** — identify reliance on user-scoped config that will not load
    remotely: `~/.claude/CLAUDE.md`, user `enabledPlugins`, user skills/agents, user MCP. Most
@@ -148,9 +172,14 @@ Group the findings as:
 7. **Platform constraints** — surface the non-config constraints as `GAP`/`RISK` so the user is
    not surprised: routines run with no interactive permission prompts and cannot ask the user
    mid-run; interactive auth (SSO/OAuth browser, keychain) is unavailable; GitHub org IP
-   allowlisting blocks cloud sessions; outbound traffic is proxied and custom domains need
-   allowlisting; resource limits (~4 vCPU / 16 GB RAM / 30 GB disk); no desktop/computer-use; no
-   statusline/theme rendering.
+   allowlisting blocks cloud sessions; raw GitHub clone/fetch/push operations are handled by
+   Claude's connected-GitHub proxy/identity and do not need a separate PAT; the `gh` CLI is not the
+   same substrate and still needs `GH_TOKEN`; outbound traffic is controlled by the routine
+   environment network tier, where the default Trusted tier includes common development domains and
+   package registries but arbitrary integration hosts need Custom or Full access; environment
+   variables and setup scripts are stored in the cloud environment configuration and are visible to
+   anyone who can edit that environment; resource limits (~4 vCPU / 16 GB RAM / 30 GB disk); no
+   desktop/computer-use; no statusline/theme rendering.
 
 8. **Host-project app needs** — note any build/test/run command a routine would invoke and any
    runtime service it depends on (database, queue, external API) that will not exist in a fresh
@@ -168,9 +197,18 @@ unsuffixed `…_TOKEN`/`…_KEY` is the simplest to set in a single-account rout
 
 ### GitHub — `tracker: github` and/or `source: github`
 - Headless substrate: `gh` CLI authed by token (every Lisa GitHub script gates on `gh auth status`).
-- Env: `GH_TOKEN` (the routine's built-in repo connection may not authenticate the `gh` CLI — verify; set `GH_TOKEN` if `gh auth status` fails). `PAT` only for cross-repo flows.
+- Platform substrate: Claude's connected-GitHub proxy/identity authenticates raw git
+  clone/fetch/push for repositories the routine can access. Do not ask for a PAT solely for raw git
+  or sibling-repo clones.
+- Env: `GH_TOKEN` for the `gh` CLI only; set it because Lisa's PR/issue lifecycle shells out to
+  `gh`. Do not describe it as required for raw git clone/fetch/push.
 - Acquire: fine-grained — `https://github.com/settings/personal-access-tokens`; classic — `https://github.com/settings/tokens`.
-- Access: fine-grained → Repository access to the target repo(s); Repository permissions: Contents R/W, Issues R/W, Pull requests R/W, Metadata R (mandatory); add Workflows R/W only if editing `.github/workflows`, and Organization → Projects R/W only if using ProjectV2. Classic equivalent: `repo` + `workflow` (+ `project`, `read:org` for boards). The identity must hold WRITE/MAINTAIN/ADMIN on the repo.
+- Access: fine-grained → Repository access to the repo(s) where Lisa will run `gh` commands (the
+  project repo, and the Lisa repo only if filing Lisa issues); Repository permissions: Contents R/W,
+  Issues R/W, Pull requests R/W, Metadata R (mandatory); add Workflows R/W only if editing
+  `.github/workflows`, and Organization → Projects R/W only if using ProjectV2. Do not include
+  sibling repos that are only cloned/fetched with raw git. Classic equivalent: `repo` + `workflow`
+  (+ `project`, `read:org` for boards). The identity must hold WRITE/MAINTAIN/ADMIN on the repo.
 
 ### JIRA — `tracker: jira`
 - Headless substrate: `jira-cli` + curl (Basic auth). The acli and Atlassian-MCP tiers need prior interactive/OAuth auth → not viable headless.
@@ -236,12 +274,41 @@ so the generator can render acquisition comments into its template:
       "headlessSubstrate": "gh CLI (token)",
       "acquireUrl": "https://github.com/settings/personal-access-tokens",
       "accessScope": "fine-grained PAT on target repo: Contents R/W, Issues R/W, Pull requests R/W, Metadata R; +Workflows R/W if editing .github/workflows; +Projects R/W if using ProjectV2"
+    },
+    {
+      "name": "JAM_PAT", "required": false, "secret": true, "integration": "jam",
+      "reason": "optional non-tracker MCP recovery; Jam CLI can authenticate headlessly from a PAT",
+      "headlessSubstrate": "jam CLI (PAT)",
+      "acquireUrl": "https://jam.dev/docs/debug-a-jam/mcp/personal-access-tokens",
+      "accessScope": "Jam Personal Access Token for the workspace/team whose traces the routine needs to read",
+      "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
+    },
+    {
+      "name": "SONAR_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "reason": "optional non-tracker MCP recovery; SonarQube MCP wraps the token-authenticated SonarCloud Web API",
+      "headlessSubstrate": "SonarCloud Web API (token)",
+      "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
+      "accessScope": "token must be able to read the target SonarCloud organization/project quality gate, issues, hotspots, rules, and source snippets"
     }
   ],
   "mcp": [
-    { "name": "linear-server", "transport": "http", "auth": "oauth", "headlessUsable": false, "replacedBy": "LINEAR_API_KEY + Linear GraphQL", "dormant": true }
+    { "name": "linear-server", "transport": "http", "auth": "oauth", "headlessUsable": false, "replacedBy": "LINEAR_API_KEY + Linear GraphQL", "dormant": true },
+    { "name": "jam", "transport": "http", "auth": "oauth", "headlessUsable": true, "replacedBy": "jam CLI + JAM_PAT", "dormant": true },
+    { "name": "sonarqube", "transport": "stdio", "auth": "local-wrapper", "headlessUsable": true, "replacedBy": "SONAR_TOKEN + SonarCloud Web API", "dormant": true }
   ],
   "gaps": [ "auto-memory not synced to cloud", "bun package fetch behind proxy", "OS keychain absent — env-var token form only" ],
+  "platform": {
+    "githubProxy": {
+      "rawGitAuthenticated": true,
+      "crossRepoAccess": "repositories reachable by the connected GitHub identity/routine access do not need a PAT for raw git",
+      "ghCliNeedsToken": true
+    },
+    "secretsVisibility": "environment variables and setup scripts are visible to environment editors"
+  },
+  "networkAccess": {
+    "tier": "custom",
+    "allowlistDomains": []
+  },
   "allowlistDomains": []
 }
 ```
@@ -269,5 +336,16 @@ so the generator can render acquisition comments into its template:
   Lisa's `setup-*` skills) — transcribe them exactly; never guess at the access a token needs.
 - For the active `tracker`/`source`, always report the **env-var** form of the secret, never the OS
   keychain form — keychain reads do not work in a cloud routine.
+- For GitHub, keep the split explicit: raw git uses the platform GitHub proxy/identity, while
+  `GH_TOKEN` is for `gh` CLI commands. Sibling repos that are only cloned or fetched with raw git do
+  not belong in the token scope.
+- Add GitHub/npm/PyPI/Docker Hub/common development domains to neither `allowlistDomains` nor
+  `networkAccess.allowlistDomains`; those are covered by the routine environment's default Trusted
+  list. Only non-default integration hosts require Custom-network allowlisting.
+- Always include a `RISK`/`GAP` finding when environment secrets or setup scripts would be visible
+  to environment editors; never imply the generated script can hide them.
 - A browser-OAuth MCP (or interactively-authed CLI) backing an active integration is a `GAP`; the
   remediation is its token substrate from the table, not "authenticate the MCP".
+- For non-tracker MCPs, a documented CLI, PAT/API-key, or REST substrate converts the finding from
+  a flat `GAP` into an `OPTIONAL` headless recovery path; unknown vendors remain gaps with a
+  vendor-substrate follow-up, not invented credentials.

package/plugins/lisa-cursor/skills/generate-claude-remote-build-script/SKILL.md

@@ -30,8 +30,9 @@ tracker/source, plus the host project's own package manager and tooling — not
 ## Procedure
 
 1. **Inventory.** Invoke `/lisa:analyze-claude-remote --json` and parse its machine-readable
-   inventory block (`packageManager`, `tools`, `env`, `mcp`, `gaps`, `allowlistDomains`). If the
-   analysis cannot run, stop and report why — never emit a script from guesses.
+   inventory block (`packageManager`, `tools`, `env`, `mcp`, `gaps`, `platform`,
+   `networkAccess`, `allowlistDomains`). If the analysis cannot run, stop and report why — never
+   emit a script from guesses.
 
 2. **Compose the setup script** from the inventory. The script must be:
    - **Idempotent & detect-before-install** — every install guarded by a `command -v <tool>` check
@@ -62,11 +63,38 @@ tracker/source, plus the host project's own package manager and tooling — not
    where to get the token and what permissions it needs. Emit only the **env-var form** of the name
    that the analysis reported (including any per-account suffixed form like `LINEAR_API_KEY_<slug>`);
    never emit a keychain instruction — keychain does not exist in a cloud routine.
+   When the entry is `GH_TOKEN`, add a comment from `platform.githubProxy` clarifying that the token
+   is for `gh` CLI commands against the project/Lisa repos, not for raw git clone/fetch/push or
+   sibling repos reachable through the routine's GitHub proxy.
+   For OPTIONAL non-tracker MCP recovery entries discovered by
+   `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
+   include `JAM_PAT`, `SONAR_TOKEN`, or similar documented substrate env vars
+   only as optional secrets, with their acquire/scope comments when the analysis
+   supplied them. Never invent values or promote dormant substrates to required.
+
+3a. **Emit substrate setup snippets.** When the inventory marks an MCP
+   `headlessUsable: true` through a documented substrate, render the matching
+   wiring guidance as commented, opt-in setup:
+   - CLI substrates: emit the detected install/login commands gated on the
+     optional env var. For Jam, this means `curl -fsSL https://native.jam.dev/install | bash`,
+     `export PATH="$HOME/.local/bin:$PATH"`, `printf '%s' "$JAM_PAT" | jam auth login --token`,
+     and `jam skills install`, all inside `[ -n "${JAM_PAT:-}" ] && ...` guards so missing
+     optional secrets do not fail the environment build.
+   - REST substitute substrates: do not install an MCP. Emit comments naming the
+     REST host and env var (for example `SONAR_TOKEN` with `https://sonarcloud.io/api/`) and
+     rely on the access skill or generated consumer to call the API.
+   - PAT-bearer MCP substrates: print a commented `.mcp.json` `headers` snippet from the
+     inventory's `mcpHeaders`. Use this only when the analysis explicitly says the same MCP
+     transport supports static-token auth. Do not print a Jam `.mcp.json` header snippet because
+     Jam's preferred headless substrate is its PAT-authenticated CLI.
 
 4. **Emit the allowlist + gaps notice.** List any custom domains the setup or runtime reaches
-   (from `allowlistDomains`) that the user must add to the environment's network access, and echo
-   the `gaps` from the analysis (auto-memory not synced, interactive-auth/stdio-MCP unavailable,
-   etc.) as a header comment so the user knows what the script **cannot** fix.
+   (from `networkAccess.allowlistDomains`, falling back to legacy `allowlistDomains`) that the user
+   must add when the environment needs Custom network access. Do not include default Trusted domains
+   such as GitHub, npm/PyPI registries, or Docker Hub. Echo the `gaps` from the analysis
+   (auto-memory not synced, interactive-auth/stdio-MCP unavailable, etc.) and the
+   `platform.secretsVisibility` warning as a header comment so the user knows what the script
+   **cannot** fix.
 
 5. **Write and report.** Write the script to `--out` (default `scripts/claude-remote-setup.sh`),
    `chmod +x` it, and print: the path, a one-line summary of what it installs and which env vars to
@@ -92,9 +120,11 @@ shape, not a fixed payload):
 #   # --- credentials for the active tracker/source (set in the environment UI) ---
 #   # Acquire: https://github.com/settings/personal-access-tokens
 #   # Access:  fine-grained PAT on target repo: Contents R/W, Issues R/W, Pull requests R/W, Metadata R
+#   # Note: GH_TOKEN is for gh CLI only. Raw git uses Claude's connected-GitHub proxy/identity;
+#   # sibling repos reached only by raw git do not need to be in this token scope.
 #   - GH_TOKEN=<token>                          # REQUIRED, github is the active tracker+source
-# NETWORK: allowlist these domains in the environment if not on full access:
-#   - <allowlistDomains, if any>
+# NETWORK: set the environment to Custom and allowlist these non-default domains if not on Full:
+#   - <networkAccess.allowlistDomains, if any>
 set -uo pipefail
 
 need() { command -v "$1" >/dev/null 2>&1; }
@@ -152,8 +182,12 @@ to stop are: the analysis could not run, or the `--out` path is not writable.
 - Never write real secret values into the script or template — names and placeholders only.
 - For active tracker/source credentials, carry the analysis's `Acquire:` URL and `Access:` scope into
   the template as comments, and emit only the env-var form of the name — never a keychain command.
+- For `GH_TOKEN`, preserve the analysis's GitHub proxy split: it is for `gh` CLI commands only, and
+  raw git/cross-repo clone guidance must not expand the token scope to sibling repositories.
 - Never emit an install for a tool the analysis did not surface, and never install `OPTIONAL` tools
   unless `--include-optional` is set.
+- Prefer `networkAccess.allowlistDomains` over legacy top-level `allowlistDomains`; never emit
+  domains already covered by the routine environment's default Trusted list.
 - Keep the script idempotent and detect-before-install so it is safe to re-run and cache.
 - Preserve the inventory's `REQUIRED` vs `OPTIONAL` distinction in both fail-behavior (fatal vs
   warn) and section placement.

package/plugins/lisa-cursor/skills/jam-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: jam-access
-description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to JAM_PAT bearer auth for headless routines."
+description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to the JAM_PAT-authenticated Jam CLI for headless routines."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -24,16 +24,16 @@ Return parsed JSON or a concise structured summary in a `<result>` block.
 Probe in order:
 
 1. Jam MCP, if the tool is available and authenticated.
-2. `JAM_PAT` bearer token against Jam's MCP/trace HTTP substrate.
+2. Jam CLI authenticated with `JAM_PAT`.
 
-Jam documents personal access tokens for MCP clients so a browser OAuth flow is
-not required. The headless tier uses:
+Jam documents a PAT-authenticated CLI that is cleaner for remote routines than
+editing `.mcp.json` headers. The headless tier uses:
 
 ```bash
-curl -sS "https://mcp.jam.dev/mcp" \
-  -H "Authorization: Bearer $JAM_PAT" \
-  -H "Content-Type: application/json" \
-  --data-binary "$PAYLOAD"
+curl -fsSL https://native.jam.dev/install | bash
+export PATH="$HOME/.local/bin:$PATH"
+printf '%s' "$JAM_PAT" | jam auth login --token
+jam skills install
 ```
 
 If neither tier works, fail with:
@@ -45,7 +45,8 @@ Error: no Jam access substrate available. Authenticate the Jam MCP or set JAM_PA
 ## Invariants
 
 - Fallback is gated on `JAM_PAT`; do not retry Jam MCP failures blindly.
-- Never commit a Jam PAT into `.mcp.json`. Use env interpolation in host MCP
-  config, for example `Authorization: Bearer ${JAM_PAT}`.
-- If a requested operation is not yet mapped to the Jam HTTP substrate, surface
+- Never commit a Jam PAT into `.mcp.json` or any generated setup artifact.
+- Headless Jam access requires `native.jam.dev` for the installer and
+  `api.jam.dev` for CLI/API calls in any custom remote network allowlist.
+- If a requested operation is not yet mapped to the Jam CLI substrate, surface
   that exact missing adapter instead of pretending the trace is unavailable.