@codyswann/lisa 2.178.5 → 2.178.6

package/plugins/src/base/skills/generate-claude-remote-build-script/SKILL.md

@@ -31,7 +31,7 @@ tracker/source, plus the host project's own package manager and tooling — not
 
 1. **Inventory.** Invoke `/lisa:analyze-claude-remote --json` and parse its machine-readable
    inventory block (`packageManager`, `tools`, `env`, `mcp`, `gaps`, `platform`,
-   `networkAccess`, `allowlistDomains`). If the analysis cannot run, stop and report why — never
+   `networkAccess`, `allowlistDomains`, `awsProfiles`). If the analysis cannot run, stop and report why — never
    emit a script from guesses.
 
 2. **Compose the setup script** from the inventory. The script must be:
@@ -71,6 +71,9 @@ tracker/source, plus the host project's own package manager and tooling — not
    include `JAM_PAT`, `SONAR_TOKEN`, or similar documented substrate env vars
    only as optional secrets, with their acquire/scope comments when the analysis
    supplied them. Never invent values or promote dormant substrates to required.
+   When AWS entries are present, list `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, optional
+   `AWS_SESSION_TOKEN`, and `AWS_DEFAULT_REGION` exactly as the analysis reported. State that these
+   bootstrap credentials are for STS assume-role only; do not emit or recommend `aws sso login`.
 
 3a. **Emit substrate setup snippets.** When the inventory marks an MCP
    `headlessUsable: true` through a documented substrate, render the matching
@@ -88,6 +91,19 @@ tracker/source, plus the host project's own package manager and tooling — not
      transport supports static-token auth. Do not print a Jam `.mcp.json` header snippet because
      Jam's preferred headless substrate is its PAT-authenticated CLI.
 
+3b. **Emit AWS assume-role profile setup.** When the inventory includes `awsProfiles`, write an
+   idempotent `~/.aws/config` block gated on `[ -n "${AWS_ACCESS_KEY_ID:-}" ]`. The generated block
+   must:
+   - `mkdir -p "$HOME/.aws"` and create or append profile stanzas without writing secrets.
+   - Emit one `[profile <name>]` stanza per inventory profile with `role_arn`,
+     `credential_source = Environment`, `region` when present, and `external_id` when present.
+   - Keep regions and ExternalIds as non-secret project metadata from the inventory; never invent
+     account IDs, role names, profile names, regions, or ExternalIds.
+   - Warn and skip profile writing when AWS profile metadata is absent, while still listing the
+     required `AWS_*` env var names in the secret template.
+   - Include a comment that agents should use `aws --profile <name> ...` and must not run
+     `aws sso login` in headless routines.
+
 4. **Emit the allowlist + gaps notice.** List any custom domains the setup or runtime reaches
    (from `networkAccess.allowlistDomains`, falling back to legacy `allowlistDomains`) that the user
    must add when the environment needs Custom network access. Do not include default Trusted domains
@@ -123,6 +139,9 @@ shape, not a fixed payload):
 #   # Note: GH_TOKEN is for gh CLI only. Raw git uses Claude's connected-GitHub proxy/identity;
 #   # sibling repos reached only by raw git do not need to be in this token scope.
 #   - GH_TOKEN=<token>                          # REQUIRED, github is the active tracker+source
+#   - AWS_ACCESS_KEY_ID=<access-key-id>          # REQUIRED when AWS inventory is active
+#   - AWS_SECRET_ACCESS_KEY=<secret-access-key>  # REQUIRED when AWS inventory is active
+#   - AWS_SESSION_TOKEN=<session-token>          # OPTIONAL for temporary bootstrap creds
 # NETWORK: set the environment to Custom and allowlist these non-default domains if not on Full:
 #   - <networkAccess.allowlistDomains, if any>
 set -uo pipefail
@@ -165,6 +184,14 @@ need gh || (sudo apt-get update -y && sudo apt-get install -y gh)
 need jq || sudo apt-get install -y jq
 require gh; require jq
 
+# --- AWS assume-role profiles, when inventory includes awsProfiles ---
+if [ -n "${AWS_ACCESS_KEY_ID:-}" ]; then
+  mkdir -p "$HOME/.aws"
+  # Generated stanzas use credential_source=Environment and contain no secrets.
+  # Agents should run: aws --profile <profile> ...
+  # Do not run aws sso login in headless routines; SSO requires an interactive browser/device flow.
+fi
+
 # --- optional, only with --include-optional ---
 # (docker / ruby / chromium / etc., guarded)
 ```
@@ -186,6 +213,8 @@ to stop are: the analysis could not run, or the `--out` path is not writable.
   raw git/cross-repo clone guidance must not expand the token scope to sibling repositories.
 - Never emit an install for a tool the analysis did not surface, and never install `OPTIONAL` tools
   unless `--include-optional` is set.
+- When AWS is in the inventory, generate environment-backed assume-role profile stanzas from
+  `awsProfiles`; never emit `aws sso login` as a remote setup step.
 - Prefer `networkAccess.allowlistDomains` over legacy top-level `allowlistDomains`; never emit
   domains already covered by the routine environment's default Trusted list.
 - Keep the script idempotent and detect-before-install so it is safe to re-run and cache.

package/plugins/src/expo/agents/ops-specialist.md

@@ -100,10 +100,10 @@ Read `app/` directory structure to discover all available routes.
 |---------|-------------|-----|
 | `port 8081 already in use` | Previous Metro bundler running | `lsof -ti :8081 \| xargs kill -9` |
 | `port 3000 already in use` | Previous backend running | `lsof -ti :3000 \| xargs kill -9` |
-| `ExpiredTokenException` | AWS SSO session expired | Run `aws:signin:{env}` script from backend dir |
+| `ExpiredTokenException` | AWS credentials expired | Interactive local: refresh the backend AWS signin flow. Headless: use the environment-backed AWS profile; do not start an SSO browser/device flow |
 | Metro bundler crash | Cache corruption | `bun start:local --clear` |
 | `ECONNREFUSED localhost:3000` | Backend not running | Start backend first, then frontend |
-| Migration fails | Missing AWS credentials | Run `aws:signin:{env}` script before migration |
+| Migration fails | Missing AWS credentials | Verify `aws sts get-caller-identity --profile {profile}`; use interactive signin only locally, environment-backed profile headless |
 | EAS CLI not found | Not installed globally | `npm install -g eas-cli` |
 | `sls` not found | Serverless not installed | `cd $BACKEND_DIR && bun install` |
 | GraphQL schema mismatch | Stale generated types | Run `generate:types:{env}` script |

package/plugins/src/expo/skills/ops-check-logs/SKILL.md

@@ -132,9 +132,14 @@ Discover available log scripts from the backend `package.json` (matching `logs:*
 
 ```bash
 cd "${BACKEND_DIR:-../backend-v2}"
-bun run aws:signin:{env}
+aws sts get-caller-identity --profile {aws-profile} 2>/dev/null
 ```
 
+If this is an interactive local session and credentials are expired, refresh the backend's local
+AWS signin flow. In a headless or remote-routine session, do not start an SSO browser/device flow;
+use the preconfigured `~/.aws/config` profile backed by `AWS_ACCESS_KEY_ID` /
+`AWS_SECRET_ACCESS_KEY` environment credentials.
+
 ### View Recent Logs
 
 ```bash
@@ -151,7 +156,8 @@ FUNCTION_NAME={fn} bun run logs:watch:{env}
 
 ## Remote Logs (AWS CLI — Advanced Filtering)
 
-For more advanced filtering, use the AWS CLI directly. Discover the AWS profile from backend `package.json` `aws:signin:*` scripts.
+For more advanced filtering, use the AWS CLI directly. Discover the AWS profile from backend
+`package.json` scripts or the remote-routine `~/.aws/config` profile.
 
 ### Discover Log Groups
 

package/plugins/src/expo/skills/ops-db-ops/SKILL.md

@@ -29,7 +29,7 @@ Read the backend `package.json` to discover available migration and schema scrip
 - `migration:generate:*` — generate new migration from entity changes
 - `migration:create` — create empty migration
 - `generate:sql-schema*` — regenerate SQL schema for MCP
-- `aws:signin:*` — AWS credential scripts
+- AWS credential/profile scripts such as `aws:signin:*` and any environment-backed remote profile
 
 Read the frontend `package.json` to discover codegen scripts:
 - `fetch:graphql:schema:*` — fetch GraphQL schema
@@ -37,13 +37,17 @@ Read the frontend `package.json` to discover codegen scripts:
 
 ## AWS Prerequisite
 
-All database operations (except `codegen`) require AWS credentials. Run the backend's AWS signin script first:
+All database operations (except `codegen`) require AWS credentials. Verify the target profile first:
 
 ```bash
 cd "${BACKEND_DIR:-../backend-v2}"
-bun run aws:signin:{env}
+aws sts get-caller-identity --profile {aws-profile}
 ```
 
+If this is an interactive local session and credentials are expired, refresh the backend's local AWS
+signin flow. In a headless or remote-routine session, use the preconfigured environment-backed
+assume-role profile and do not start an SSO browser/device flow.
+
 ## Operations
 
 ### migrate (run pending migrations)

package/plugins/src/expo/skills/ops-deploy/SKILL.md

@@ -73,11 +73,15 @@ Use for JS-only changes (no native module changes).
 
 ### Full Deploy (Serverless Framework)
 
-1. AWS signin (discover script name from backend `package.json`):
+1. Verify AWS credentials (discover the profile from backend `package.json` or remote-routine
+   `~/.aws/config`):
    ```bash
    cd "${BACKEND_DIR:-../backend-v2}"
-   bun run aws:signin:{env}
+   aws sts get-caller-identity --profile {aws-profile}
    ```
+   If this is an interactive local session and credentials are expired, refresh the backend's local
+   AWS signin flow. In a headless or remote-routine session, use the environment-backed assume-role
+   profile and do not start an SSO browser/device flow.
 
 2. Deploy all functions:
    ```bash

package/plugins/src/expo/skills/ops-run-local/SKILL.md

@@ -95,11 +95,14 @@ Use when the backend is already deployed and you only need the frontend.
 
 ### start-backend (backend only)
 
-1. Check AWS credentials (discover profile from backend `package.json` `aws:signin:*` scripts):
+1. Check AWS credentials (discover profile from backend `package.json` scripts or remote-routine
+   `~/.aws/config`):
    ```bash
    aws sts get-caller-identity --profile {aws-profile} 2>/dev/null
    ```
-   If expired, run the backend's `aws:signin:{env}` script.
+   If this is an interactive local session and credentials are expired, refresh the backend's local
+   AWS signin flow. In headless sessions, rely on the configured environment-backed AWS profile and
+   do not start an SSO browser/device flow.
 
 2. Start:
    ```bash

package/plugins/src/rails/agents/ops-specialist.md

@@ -206,7 +206,7 @@ check_env() {
 | Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
 | Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
 | `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
-| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| AWS credentials expired | SSO session timed out locally, or missing env-backed profile headless | Interactive local: refresh the local AWS profile outside headless automation. Headless: use the configured environment-backed assume-role profile |
 | ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
 | OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
 | `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |