@codyswann/lisa 2.178.1 → 2.178.2

package/plugins/src/base/skills/generate-claude-remote-build-script/SKILL.md

@@ -66,6 +66,27 @@ tracker/source, plus the host project's own package manager and tooling — not
    When the entry is `GH_TOKEN`, add a comment from `platform.githubProxy` clarifying that the token
    is for `gh` CLI commands against the project/Lisa repos, not for raw git clone/fetch/push or
    sibling repos reachable through the routine's GitHub proxy.
+   For OPTIONAL non-tracker MCP recovery entries discovered by
+   `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
+   include `JAM_PAT`, `SONAR_TOKEN`, or similar documented substrate env vars
+   only as optional secrets, with their acquire/scope comments when the analysis
+   supplied them. Never invent values or promote dormant substrates to required.
+
+3a. **Emit substrate setup snippets.** When the inventory marks an MCP
+   `headlessUsable: true` through a documented substrate, render the matching
+   wiring guidance as commented, opt-in setup:
+   - CLI substrates: emit the detected install/login commands gated on the
+     optional env var. For Jam, this means `curl -fsSL https://native.jam.dev/install | bash`,
+     `export PATH="$HOME/.local/bin:$PATH"`, `printf '%s' "$JAM_PAT" | jam auth login --token`,
+     and `jam skills install`, all inside `[ -n "${JAM_PAT:-}" ] && ...` guards so missing
+     optional secrets do not fail the environment build.
+   - REST substitute substrates: do not install an MCP. Emit comments naming the
+     REST host and env var (for example `SONAR_TOKEN` with `https://sonarcloud.io/api/`) and
+     rely on the access skill or generated consumer to call the API.
+   - PAT-bearer MCP substrates: print a commented `.mcp.json` `headers` snippet from the
+     inventory's `mcpHeaders`. Use this only when the analysis explicitly says the same MCP
+     transport supports static-token auth. Do not print a Jam `.mcp.json` header snippet because
+     Jam's preferred headless substrate is its PAT-authenticated CLI.
 
 4. **Emit the allowlist + gaps notice.** List any custom domains the setup or runtime reaches
    (from `networkAccess.allowlistDomains`, falling back to legacy `allowlistDomains`) that the user

package/plugins/src/base/skills/jam-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: jam-access
-description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to JAM_PAT bearer auth for headless routines."
+description: "Vendor-neutral access layer for Jam. Jam triage rules and skills MUST delegate through this skill rather than calling Jam MCP tools directly. Resolves Jam MCP first when available, then falls back to the JAM_PAT-authenticated Jam CLI for headless routines."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -24,16 +24,16 @@ Return parsed JSON or a concise structured summary in a `<result>` block.
 Probe in order:
 
 1. Jam MCP, if the tool is available and authenticated.
-2. `JAM_PAT` bearer token against Jam's MCP/trace HTTP substrate.
+2. Jam CLI authenticated with `JAM_PAT`.
 
-Jam documents personal access tokens for MCP clients so a browser OAuth flow is
-not required. The headless tier uses:
+Jam documents a PAT-authenticated CLI that is cleaner for remote routines than
+editing `.mcp.json` headers. The headless tier uses:
 
 ```bash
-curl -sS "https://mcp.jam.dev/mcp" \
-  -H "Authorization: Bearer $JAM_PAT" \
-  -H "Content-Type: application/json" \
-  --data-binary "$PAYLOAD"
+curl -fsSL https://native.jam.dev/install | bash
+export PATH="$HOME/.local/bin:$PATH"
+printf '%s' "$JAM_PAT" | jam auth login --token
+jam skills install
 ```
 
 If neither tier works, fail with:
@@ -45,7 +45,8 @@ Error: no Jam access substrate available. Authenticate the Jam MCP or set JAM_PA
 ## Invariants
 
 - Fallback is gated on `JAM_PAT`; do not retry Jam MCP failures blindly.
-- Never commit a Jam PAT into `.mcp.json`. Use env interpolation in host MCP
-  config, for example `Authorization: Bearer ${JAM_PAT}`.
-- If a requested operation is not yet mapped to the Jam HTTP substrate, surface
+- Never commit a Jam PAT into `.mcp.json` or any generated setup artifact.
+- Headless Jam access requires `native.jam.dev` for the installer and
+  `api.jam.dev` for CLI/API calls in any custom remote network allowlist.
+- If a requested operation is not yet mapped to the Jam CLI substrate, surface
   that exact missing adapter instead of pretending the trace is unavailable.