@codyswann/lisa 2.227.0 → 2.229.0

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.227.0",
+  "version": "2.229.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/install-claude-plugins.sh

@@ -55,9 +55,23 @@ detect_lisa_stack() {
   done
 }
 
+# One-time migration marker: once the user-wide Codex registrations are
+# confirmed retired, skip the `codex plugin marketplace list` probe (a codex
+# CLI spawn) on every subsequent install.
+CODEX_RETIRE_MARKER="$HOME/.codex/.lisa-legacy-plugins-retired"
+
+write_codex_retire_marker() {
+  mkdir -p "$HOME/.codex" 2>/dev/null && touch "$CODEX_RETIRE_MARKER" 2>/dev/null || true
+}
+
 remove_user_wide_codex_lisa_plugins() {
   command -v codex >/dev/null 2>&1 || return 0
 
+  # The marker is written only after the cleanup actually ran or was confirmed
+  # unnecessary — never on the CODEX_THREAD_ID deferral below, which must
+  # retry on a later install (see fix/defer-codex-retirement-postinstall).
+  [ -f "$CODEX_RETIRE_MARKER" ] && return 0
+
   # Removing a plugin relocates its cache directory. A running Codex session
   # has already captured absolute hook paths, so removal inside that session
   # turns every later hook invocation into an EPIPE/broken-pipe failure. Defer
@@ -84,6 +98,7 @@ remove_user_wide_codex_lisa_plugins() {
       }
     });
   '; then
+    write_codex_retire_marker
     return 0
   fi
 
@@ -102,6 +117,7 @@ remove_user_wide_codex_lisa_plugins() {
     codex plugin remove "${plugin}@lisa" </dev/null >/dev/null 2>&1 || true
   done
   codex plugin marketplace remove lisa </dev/null >/dev/null 2>&1 || true
+  write_codex_retire_marker
 }
 
 # Skip running Lisa's full template engine on itself — the Lisa repo IS the
@@ -144,8 +160,23 @@ fi
 # each path is written exactly once by its most-specific stack — there is no
 # intermediate clobbered state to be interrupted in. See src/core/lisa.ts
 # loadCopyOverwriteOwnership.
+# Dedup guard: when the host's own package.json postinstall already invokes
+# Lisa (wired by the ensure-lisa-postinstall migration), the package manager
+# will run that root lifecycle script in this same install — running the full
+# apply here too doubles the work for no benefit. The package-side apply
+# exists for the bootstrap chicken-and-egg (#1017: a never-applied project
+# has no postinstall to wire itself), so it still runs whenever the marker is
+# absent. Detection matches LISA_MARKER in ensure-lisa-postinstall.ts.
+HOST_HAS_LISA_POSTINSTALL="$(node -e "
+  const scripts = require('$PROJECT_ROOT/package.json').scripts || {};
+  const postinstall = scripts.postinstall || '';
+  process.stdout.write(postinstall.includes('node_modules/@codyswann/lisa/dist/index.js') ? 'true' : 'false');
+" 2>/dev/null || echo false)"
+
 if [ "$IS_LISA_SELF" != "true" ] && [ -z "${CI:-}" ]; then
-  if ! LISA_BOOTSTRAP=1 node "$LISA_DIR/dist/index.js" --yes --skip-git-check "$PROJECT_ROOT"; then
+  if [ "$HOST_HAS_LISA_POSTINSTALL" = "true" ]; then
+    echo "Lisa apply deferred to the host project's own postinstall script."
+  elif ! LISA_BOOTSTRAP=1 node "$LISA_DIR/dist/index.js" --yes --skip-git-check "$PROJECT_ROOT"; then
     echo "⚠️  Warning: Lisa template application failed. Migration may be incomplete." >&2
   fi
 fi
@@ -259,6 +290,38 @@ fi
 # Install plugins only when claude CLI is available
 if ! command -v claude &>/dev/null; then exit 0; fi
 
+# Version-gated plugin sync (perf). `claude plugin marketplace update` is a
+# network git pull of the whole Lisa repo and every `claude plugin install`
+# spawns the Claude CLI (seconds each); re-running all of it on every install
+# made a single `bun add` cost minutes. A full sync still runs whenever the
+# installed Lisa version differs from the .claude/.lisa-plugins-synced marker
+# (shared with Lisa.apply's registerPlugins); between version changes only
+# plugins missing for this project are installed, so the self-heal property
+# (a removed plugin comes back on the next install) survives at the cost of a
+# single `claude plugin list` call.
+LISA_VERSION="$(node -e "console.log(require('$LISA_DIR/package.json').version || '')" 2>/dev/null || true)"
+PLUGIN_SYNC_MARKER="$PROJECT_ROOT/.claude/.lisa-plugins-synced"
+FORCE_PLUGIN_SYNC=true
+if [ -n "$LISA_VERSION" ] && [ -f "$PLUGIN_SYNC_MARKER" ] \
+  && [ "$(cat "$PLUGIN_SYNC_MARKER" 2>/dev/null)" = "$LISA_VERSION" ]; then
+  FORCE_PLUGIN_SYNC=false
+fi
+
+INSTALLED_PLUGINS_FOR_PROJECT=""
+if command -v jq >/dev/null 2>&1; then
+  INSTALLED_PLUGINS_FOR_PROJECT="$(claude plugin list --json 2>/dev/null \
+    | jq -r --arg cwd "$PROJECT_ROOT" '.[] | select(.projectPath == $cwd) | .id' 2>/dev/null || true)"
+fi
+
+install_plugin_if_missing() {
+  local plugin="$1"
+  if [ "$FORCE_PLUGIN_SYNC" != "true" ] && [ -n "$INSTALLED_PLUGINS_FOR_PROJECT" ] \
+    && printf '%s\n' "$INSTALLED_PLUGINS_FOR_PROJECT" | grep -qxF "$plugin"; then
+    return 0
+  fi
+  claude plugin install "$plugin" --scope project </dev/null 2>&1 || true
+}
+
 # The Lisa marketplace is registered via extraKnownMarketplaces in .claude/settings.json
 # pointing to the GitHub repo (CodySwannGT/lisa). Built plugins are committed to the repo
 # so relative paths in marketplace.json resolve correctly.
@@ -272,7 +335,10 @@ if ! command -v claude &>/dev/null; then exit 0; fi
 # "Update now" action with: "Local plugins cannot be updated remotely."
 # If we detect a non-github marketplace named "lisa", uninstall the plugins
 # sourced from it and remove the registration so the github source can take over.
-if command -v jq >/dev/null 2>&1; then
+# Gated on version change: the stale registration can only exist in state
+# written by an older Lisa, so re-probing it on every same-version install
+# spends a claude CLI spawn to re-confirm a fact that cannot have changed.
+if [ "$FORCE_PLUGIN_SYNC" = "true" ] && command -v jq >/dev/null 2>&1; then
   STALE_LISA_SOURCE=$(claude plugin marketplace list --json 2>/dev/null \
     | jq -r '.[] | select(.name == "lisa" and .source != "github") | .source' 2>/dev/null \
     | head -n 1)
@@ -339,7 +405,12 @@ heal_local_classification() {
 
 if command -v jq >/dev/null 2>&1; then
   # Refresh the cached marketplace.json so we're reading the latest schema.
-  claude plugin marketplace update lisa </dev/null >/dev/null 2>&1 || true
+  # Gated: the pull is a network git fetch of the whole Lisa repo; once this
+  # version's plugins are synced and the project's heal-v2 marker exists, a
+  # fresh pull cannot change the outcome of the schema check below.
+  if [ "$FORCE_PLUGIN_SYNC" = "true" ] || [ ! -f "$PROJECT_ROOT/.claude/$HEAL_V2_MARKER_NAME" ]; then
+    claude plugin marketplace update lisa </dev/null >/dev/null 2>&1 || true
+  fi
 
   MARKETPLACE_JSON_PATH="$HOME/.claude/plugins/marketplaces/lisa/.claude-plugin/marketplace.json"
   NEW_SCHEMA="false"
@@ -364,8 +435,8 @@ if command -v jq >/dev/null 2>&1; then
   fi
 fi
 
-# Always install the base plugin (universal governance for all projects)
-claude plugin install "lisa@lisa" --scope project </dev/null 2>&1 || true
+# Always ensure the base plugin (universal governance for all projects)
+install_plugin_if_missing "lisa@lisa"
 
 # Detect which stack plugin to install from .claude/settings.json
 LISA_STACK="$(detect_lisa_stack "$SETTINGS_FILE")"
@@ -374,13 +445,13 @@ LISA_STACK="$(detect_lisa_stack "$SETTINGS_FILE")"
 case "$LISA_STACK" in
   rails) ;; # Rails doesn't get typescript plugin
   *)
-    claude plugin install "lisa-typescript@lisa" --scope project </dev/null 2>&1 || true
+    install_plugin_if_missing "lisa-typescript@lisa"
     ;;
 esac
 
 # Install stack-specific plugin if not plain typescript
 if [ -n "$LISA_STACK" ]; then
-  claude plugin install "lisa-${LISA_STACK}@lisa" --scope project </dev/null 2>&1 || true
+  install_plugin_if_missing "lisa-${LISA_STACK}@lisa"
 fi
 
 # Uninstall old monolithic plugins during migration
@@ -403,7 +474,7 @@ for plugin in \
   "skill-creator@claude-plugins-official" \
   "atlassian@claude-plugins-official" \
   "safety-net@cc-marketplace"; do
-  claude plugin install "$plugin" --scope project </dev/null 2>&1 || true
+  install_plugin_if_missing "$plugin"
 done
 
 # Install stack-specific third-party plugins
@@ -411,6 +482,15 @@ if [ "$LISA_STACK" = "expo" ] || [ "$LISA_STACK" = "harper-fabric" ]; then
   for plugin in \
     "playwright@claude-plugins-official" \
     "posthog@claude-plugins-official"; do
-    claude plugin install "$plugin" --scope project </dev/null 2>&1 || true
+    install_plugin_if_missing "$plugin"
   done
 fi
+
+# Record the fully-synced Lisa version so same-version installs skip the
+# marketplace pulls and forced reinstalls above. Written last so any earlier
+# failure exits (set -e) without recording a sync that did not finish.
+if [ -n "$LISA_VERSION" ]; then
+  mkdir -p "$PROJECT_ROOT/.claude" 2>/dev/null \
+    && printf '%s' "$LISA_VERSION" > "$PLUGIN_SYNC_MARKER" 2>/dev/null \
+    || true
+fi

package/ui/README.md

@@ -27,6 +27,21 @@ live config it falls back to Lisa's shipped defaults:
 open ui/index.html
 ```
 
+## Live status contract
+
+When served by `lisa ui`, the page fetches `GET /api/status` from the same
+loopback origin and renders each probe in a compact status strip. A probe has
+exactly one of three states: a real `value`, `unknown` with both a
+machine-readable reason and human-readable message, or `not-applicable`.
+Throwing and timing-out probes degrade independently to `unknown`, so one
+unavailable integration cannot block the page or cause a value to be invented.
+Concurrent requests share one in-flight snapshot. In-process probes must be
+asynchronous and cooperate with the supplied abort signal; JSON depth and size
+budgets also bound result normalization. The first reference probe scopes
+`gh auth status --active` to the project's origin hostname; the
+remaining live integrations are delivered by the console work that builds on
+this transport.
+
 ## Config sync (`lisa sync`)
 
 `lisa sync [path] [--dry-run] [--json]` makes `.lisa.config.json` (with the
@@ -153,6 +168,7 @@ visible in the section.
 | General (`harness`, `tracker`, `source`, `repo`, package manager) | `src/core/config.ts`, `plugins/src/base/rules/reference/config-resolution.md` |
 | Project types (8 stacks + template strategies) | `src/detection/`, `src/strategies/`, `<stack>/` template dirs |
 | Coding agents (claude/codex/cursor/agy/copilot/opencode/fleet) | `src/core/lisa.ts`, `scripts/generate-*-plugin-artifacts.mjs` |
+| Remote Environment (variable presence + active-agent startup scripts) | `src/cli/ui-cmd.ts`, `plugins/src/base/scripts/remote-agent-aws-setup.sh` |
 | Work tracker (JIRA / GitHub Issues / Linear) | `config-resolution.md`, `lisa-setup-*` skills |
 | PRD source (Notion / Confluence / Linear / GitHub) | `config-resolution.md`, `lisa-setup-*` skills |
 | Deploy & environments (`deploy.*`, `github.environments`) | `scripts/lisa-github-environments.sh` |

package/ui/index.html

@@ -289,6 +289,45 @@
         margin-top: 3px;
         max-width: 26ch;
       }
+      .live-status-panel {
+        display: flex;
+        align-items: center;
+        gap: 12px;
+        min-height: 42px;
+        padding: 7px 20px;
+        background: var(--surface2);
+        border-bottom: 1px solid var(--line);
+      }
+      .live-status-panel h2 {
+        margin: 0;
+        font-size: 12px;
+        color: var(--muted);
+        text-transform: uppercase;
+        letter-spacing: 0.06em;
+      }
+      .live-status-list {
+        display: flex;
+        align-items: center;
+        flex-wrap: wrap;
+        gap: 8px;
+      }
+      .live-status-item {
+        display: inline-flex;
+        align-items: center;
+        gap: 6px;
+        padding: 3px 9px;
+        border: 1px solid var(--line);
+        border-radius: 99px;
+        background: var(--surface);
+        font-family: var(--mono);
+        font-size: 11px;
+      }
+      .live-status-item .status-why {
+        display: inline;
+        margin: 0;
+        max-width: 48ch;
+        overflow-wrap: anywhere;
+      }
 
       .check-item {
         display: flex;
@@ -1203,6 +1242,18 @@
         ◐
       </button>
     </header>
+    <section
+      class="live-status-panel"
+      aria-labelledby="liveStatusHeading"
+      aria-live="polite"
+      aria-atomic="true"
+      role="status"
+    >
+      <h2 id="liveStatusHeading">Live status</h2>
+      <div class="live-status-list" id="liveStatusList" role="list">
+        <span class="live-status-item" role="listitem">Loading…</span>
+      </div>
+    </section>
     <div class="app">
       <nav class="sidebar" id="nav" aria-label="Settings sections"></nav>
       <main class="main" id="main"></main>
@@ -1259,6 +1310,7 @@
               "stacks",
               "starters",
               "agents",
+              "remote",
             ],
           },
           {
@@ -2348,6 +2400,33 @@
         ],
       };
 
+      /* -------------------------- Remote environment -------------------------- */
+      DATA.sections.remote = {
+        title: "Remote Environment",
+        desc: "AWS CLI bootstrap readiness for the project's active remote coding agents. Secret values are never sent to the browser — the console receives presence checks only.",
+        src: "scripts/remote-agent-aws-setup.sh · remote platform environments",
+        blocks: [
+          {
+            type: "table",
+            card: "Variables",
+            note: "Set status reflects variables visible to the lisa ui process; values remain hidden",
+            cols: ["Variable", "Purpose", "Status"],
+            rows: [],
+          },
+          {
+            type: "table",
+            card: "Startup Script",
+            note: "Only agents enabled by the current harness are listed",
+            cols: ["Agent", "Remote environment setup", "Project artifact"],
+            rows: [],
+          },
+          {
+            type: "callout",
+            text: "<b>One bootstrap bundle, renewable sessions.</b> Store the complete Secrets Manager value as <code>LISA_AWS_BOOTSTRAP_JSON</code>. Each startup command writes the assume-only source credential and renewable role profiles; do not configure <code>AWS_ACCESS_KEY_ID</code> or <code>AWS_SECRET_ACCESS_KEY</code> directly.",
+          },
+        ],
+      };
+
       /* ---------------------------------- Tracker ---------------------------------- */
       DATA.sections.tracker = {
         title: "Work tracker",
@@ -5783,26 +5862,238 @@
         if (control.type === "static" && typeof value === "string")
           control.value = value;
       }
+      const REMOTE_AGENT_ORDER = [
+        "claude",
+        "codex",
+        "cursor",
+        "agy",
+        "copilot",
+        "opencode",
+      ];
+      const REMOTE_STARTUP = {
+        claude: {
+          command:
+            "LISA_REMOTE_AGENT=claude bash scripts/remote-agent-aws-setup.sh",
+          artifacts: ["scripts/remote-agent-aws-setup.sh"],
+        },
+        codex: {
+          command:
+            "LISA_REMOTE_AGENT=codex bash scripts/remote-agent-aws-setup.sh",
+          artifacts: ["scripts/remote-agent-aws-setup.sh"],
+        },
+        cursor: {
+          command:
+            ".cursor/environment.json → LISA_REMOTE_AGENT=cursor bash scripts/remote-agent-aws-setup.sh",
+          artifacts: [
+            "scripts/remote-agent-aws-setup.sh",
+            ".cursor/environment.json",
+          ],
+        },
+        agy: {
+          command:
+            "LISA_REMOTE_AGENT=agy bash scripts/remote-agent-aws-setup.sh (user-managed host)",
+          artifacts: ["scripts/remote-agent-aws-setup.sh"],
+        },
+        copilot: {
+          command:
+            ".github/workflows/copilot-setup-steps.yml → bash scripts/remote-agent-aws-setup.sh",
+          artifacts: [
+            "scripts/remote-agent-aws-setup.sh",
+            ".github/workflows/copilot-setup-steps.yml",
+          ],
+        },
+        opencode: {
+          command:
+            "LISA_REMOTE_AGENT=opencode bash scripts/remote-agent-aws-setup.sh (opencode serve host)",
+          artifacts: ["scripts/remote-agent-aws-setup.sh"],
+        },
+      };
+      function configureRemoteEnvironment(cfg) {
+        const snapshot = window.LISA_REMOTE_ENVIRONMENT || {
+          variables: {},
+          artifacts: {},
+        };
+        const harness = cfg && cfg.harness ? cfg.harness : "fleet";
+        const activeAgents =
+          harness === "fleet" || harness === "all"
+            ? REMOTE_AGENT_ORDER
+            : REMOTE_AGENT_ORDER.includes(harness)
+              ? [harness]
+              : ["claude"];
+        const variableRows = [
+          [
+            "LISA_AWS_BOOTSTRAP_JSON",
+            "Required secret — complete vendor-neutral bootstrap bundle",
+          ],
+          [
+            "LISA_REMOTE_AGENT",
+            "Platform label used as the AWS role session name (startup commands set it inline)",
+          ],
+          [
+            "LISA_AWS_DEFAULT_PROFILE",
+            "Optional default account profile; dev is used when unset",
+          ],
+        ].map(([name, purpose]) => {
+          const isSet = snapshot.variables[name] === true;
+          return [
+            { t: "mono", v: name },
+            { t: "text", v: purpose },
+            {
+              t: "badge",
+              v: isSet ? "set" : "not set",
+              cls: isSet
+                ? "pass"
+                : name.endsWith("DEFAULT_PROFILE")
+                  ? "warn"
+                  : "fail",
+            },
+          ];
+        });
+        const startupRows = activeAgents.map(agent => {
+          const startup = REMOTE_STARTUP[agent];
+          const ready = startup.artifacts.every(
+            artifact => snapshot.artifacts[artifact] === true
+          );
+          return [
+            { t: "mono", v: agent },
+            { t: "mono", v: startup.command },
+            {
+              t: "badge",
+              v: ready ? "installed" : "missing",
+              cls: ready ? "pass" : "fail",
+            },
+          ];
+        });
+        DATA.sections.remote.blocks[0].rows = variableRows;
+        DATA.sections.remote.blocks[1].rows = startupRows;
+      }
       function hydrateFromLiveConfig() {
-        const cfg = window.LISA_LIVE_CONFIG;
-        if (!cfg) return;
-        Object.values(DATA.sections).forEach(section => {
-          walkRows(section.blocks, row => {
-            if (!row.key || !row.control) return;
-            const value = liveGet(cfg, row.key);
-            if (value !== undefined) hydrateControl(row.control, value);
+        const cfg = window.LISA_LIVE_CONFIG || {};
+        if (window.LISA_LIVE_CONFIG) {
+          Object.values(DATA.sections).forEach(section => {
+            walkRows(section.blocks, row => {
+              if (!row.key || !row.control) return;
+              const value = liveGet(cfg, row.key);
+              if (value !== undefined) hydrateControl(row.control, value);
+            });
           });
-        });
+        }
+        configureRemoteEnvironment(cfg);
         const repoEl = document.querySelector(".project-switch .repo");
         if (repoEl && cfg.github && cfg.github.org && cfg.github.repo) {
           repoEl.textContent = cfg.github.org + "/" + cfg.github.repo;
         }
       }
 
+      /* --- live-status hydration (same-origin GET /api/status) --- */
+      function liveStatusValue(value) {
+        if (typeof value === "string") return value;
+        try {
+          return JSON.stringify(value);
+        } catch {
+          return String(value);
+        }
+      }
+      function normalizeLiveStatusResult(result) {
+        if (!result || typeof result !== "object" || Array.isArray(result)) {
+          return {
+            state: "unknown",
+            reason: "invalid-result",
+            message: "Probe returned an invalid status result",
+          };
+        }
+        const keys = Object.keys(result).sort().join(",");
+        if (result.state === "value" && keys === "state,value") return result;
+        if (result.state === "not-applicable" && keys === "state")
+          return result;
+        if (
+          result.state === "unknown" &&
+          keys === "message,reason,state" &&
+          typeof result.reason === "string" &&
+          result.reason.trim().length > 0 &&
+          typeof result.message === "string" &&
+          result.message.trim().length > 0
+        ) {
+          return result;
+        }
+        return {
+          state: "unknown",
+          reason: "invalid-result",
+          message: "Probe returned an invalid status result",
+        };
+      }
+      function liveStatusProbeMap(snapshot) {
+        if (
+          !snapshot ||
+          typeof snapshot !== "object" ||
+          Array.isArray(snapshot) ||
+          !Object.hasOwn(snapshot, "probes") ||
+          !snapshot.probes ||
+          typeof snapshot.probes !== "object" ||
+          Array.isArray(snapshot.probes)
+        ) {
+          throw new TypeError("Status response omitted a valid probes map");
+        }
+        return snapshot.probes;
+      }
+      function renderLiveStatuses(probes) {
+        const list = document.getElementById("liveStatusList");
+        list.innerHTML = "";
+        const entries = Object.entries(probes || {});
+        if (entries.length === 0) {
+          const empty = el("span", "live-status-item", "No probes");
+          empty.setAttribute("role", "listitem");
+          list.appendChild(empty);
+          return;
+        }
+        entries.forEach(([id, candidate]) => {
+          const result = normalizeLiveStatusResult(candidate);
+          const item = el("span", "live-status-item");
+          item.setAttribute("role", "listitem");
+          item.appendChild(el("b", "", esc(id)));
+          if (result.state === "value") {
+            item.appendChild(
+              el("span", "badge pass", esc(liveStatusValue(result.value)))
+            );
+          } else if (result.state === "not-applicable") {
+            item.appendChild(el("span", "badge default", "not applicable"));
+          } else {
+            item.appendChild(el("span", "badge warn", "unknown"));
+            item.appendChild(
+              el(
+                "span",
+                "status-why",
+                esc(result.reason + ": " + result.message)
+              )
+            );
+          }
+          list.appendChild(item);
+        });
+      }
+      async function hydrateLiveStatuses() {
+        try {
+          const response = await fetch("/api/status", {
+            headers: { accept: "application/json" },
+          });
+          if (!response.ok) throw new Error("HTTP " + response.status);
+          const snapshot = await response.json();
+          renderLiveStatuses(liveStatusProbeMap(snapshot));
+        } catch (error) {
+          renderLiveStatuses({
+            transport: {
+              state: "unknown",
+              reason: "status-unavailable",
+              message: error instanceof Error ? error.message : String(error),
+            },
+          });
+        }
+      }
+
       /* --- boot (deferred so an injected live-config tag after this script is seen) --- */
       function boot() {
         hydrateFromLiveConfig();
         renderAll();
+        void hydrateLiveStatuses();
         showSection(location.hash ? location.hash.slice(1) : "overview");
         if (!document.getElementById("section-" + activeSection))
           showSection("overview");