@codyswann/lisa 2.297.0 → 2.297.1

package/dist/core/sonar-integration.d.ts

@@ -21,7 +21,7 @@ export declare const runSonarCommand: SonarCommandRunner;
  *
  * Disabled (no `verification.sonar.enabled`) is healthy — the provider is
  * optional. When enabled, prove the `sonar` CLI is installed and authenticated
- * (`sonar auth status`, which honors either a login session or `SONARQUBE_TOKEN`).
+ * (`sonar auth status`, which honors either a login session or `SONARQUBE_CLI_TOKEN`).
  * @param projectRoot - Downstream project root
  * @param runner - Injectable process runner
  * @returns Readiness status for doctor and setup

package/dist/core/sonar-integration.js

@@ -22,7 +22,7 @@ export const runSonarCommand = async (args) => {
  *
  * Disabled (no `verification.sonar.enabled`) is healthy — the provider is
  * optional. When enabled, prove the `sonar` CLI is installed and authenticated
- * (`sonar auth status`, which honors either a login session or `SONARQUBE_TOKEN`).
+ * (`sonar auth status`, which honors either a login session or `SONARQUBE_CLI_TOKEN`).
  * @param projectRoot - Downstream project root
  * @param runner - Injectable process runner
  * @returns Readiness status for doctor and setup
@@ -46,7 +46,7 @@ export async function probeSonarReadiness(projectRoot, runner = runSonarCommand)
     if (!auth.ok) {
         return {
             status: "fail",
-            detail: "SonarQube CLI not authenticated; run `sonar auth login` or set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server)",
+            detail: "SonarQube CLI not authenticated; run `sonar auth login` or set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server)",
         };
     }
     const target = config.projectKey ?? config.organization ?? "the configured project";

package/dist/core/sonar-integration.js.map

@@ -1 +1 @@
-{"version":3,"file":"sonar-integration.js","sourceRoot":"","sources":["../../src/core/sonar-integration.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmB1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuB,KAAK,EAAC,IAAI,EAAC,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,SAA6B,eAAe;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC;IAC1E,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,uIAAuI;SAC1I,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,IAAI,wBAAwB,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"sonar-integration.js","sourceRoot":"","sources":["../../src/core/sonar-integration.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmB1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuB,KAAK,EAAC,IAAI,EAAC,EAAE;IAC9D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,SAA6B,eAAe;IAE5C,MAAM,MAAM,GAAG,CAAC,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC;IAC1E,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,sJAAsJ;SACzJ,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,IAAI,wBAAwB,CAAC;IACvE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -273,7 +273,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/setup/jira.md": "6eb95e989b25fe2ed72ec7d361a66b1c7eece6b9950ac0e841d00f6fd8f16d8a",
     "plugins/src/base/commands/setup/linear.md": "5c25e3140d40140b5b6024de64a0bb808c48d966d88537baa0a37444cc043dbb",
     "plugins/src/base/commands/setup/notion.md": "2d705679db0dbb6c77728592a020430a529af9d0ef24ac7c434969d590d9f5a6",
-    "plugins/src/base/commands/setup/sonar.md": "d79ffe15f5fc340a5c5ffcaff4c9a7893391b4129df592a45d2b0c7e508e8c44",
+    "plugins/src/base/commands/setup/sonar.md": "1d2e94fd9f21988ce6d4be2ce4268b8c0bb020eb7cd7baf8ca65def7d8a4f5bc",
     "plugins/src/base/commands/sync-down.md": "4e974cb9745a4fd680f4a55f859d31fa8cf3cb28afa739b40a2e1a99de31e034",
     "plugins/src/base/commands/tear-down-automations.md": "969f28850326f0ceab5c09763266c60265951db30e88c738d2425ff82f088aac",
     "plugins/src/base/commands/track.md": "ae655031c3698f9bf449c4b9d8654cfab2586ca82164a710ae3f66be37c831fb",
@@ -350,7 +350,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/rules/reference/empirical-inquiry.md": "85f4552aa4c561677de40fd01bc6cccf5dbcf13865647db9df819d11f3cc3389",
     "plugins/src/base/rules/reference/factory-model.md": "b28a2ea4df7c33390111667a2807d9003cf8c9a14829f6fb0dbc929b05bfed3a",
     "plugins/src/base/rules/reference/history-audit.md": "20a46390f71fadda499c61193d430c3d53df49b55a4cefa50a112f82fa4b05ef",
-    "plugins/src/base/rules/reference/integration-access-layer.md": "be38ab7dd57eeda554f1d984c719516badef496b8a228a74144ff4d63bdfcd71",
+    "plugins/src/base/rules/reference/integration-access-layer.md": "8b0a0fc0e63492efce79c58a0fc1f112748b17ad59383cfdb9c25300b29a2c8b",
     "plugins/src/base/rules/reference/intent-routing.md": "8d2750f30b82ff9a84c5273954b0055e37bc305e3e83e4aef50f5ce47942df45",
     "plugins/src/base/rules/reference/leaf-only-lifecycle.md": "3d6d531fdca61a348fa1dd1bdb4c28fe66c85fb955238ef668a78cce4a36a7a1",
     "plugins/src/base/rules/reference/observability-audit.md": "98cf4c849baf0801bd2c46a90e7a072196649d506fbda577cc5c4019d2194551",
@@ -388,7 +388,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-acceptance-criteria/SKILL.md": "b4289ec04de657f0eeefaed56939fa171c2f8a11086bd225db39130f4a609e95",
     "plugins/src/base/skills/lisa-agent-design-best-practices/SKILL.md": "5c7414198d5c747d2cda554c85784164afb2f6fe04fd28fb4d7674857dfd4801",
     "plugins/src/base/skills/lisa-agent-ready/SKILL.md": "13f2e0f50287a04ed9a036ef1c547563b5f6f6325b2b35f6746d46a5ed4d15df",
-    "plugins/src/base/skills/lisa-analyze-claude-remote/SKILL.md": "661ddf014a60ff4bf16b2ef6582cb5eb94d14fddcdeeeb69ca1f1fabe269e347",
+    "plugins/src/base/skills/lisa-analyze-claude-remote/SKILL.md": "a5863836b8fa9d67825d048e1c2fc086d3df95de33cf110129488959b83cb4b5",
     "plugins/src/base/skills/lisa-atlassian-access/SKILL.md": "f58707d8689764ac68c79dbe5b6c548e2933cc656c5f4df03ae71c863f61b022",
     "plugins/src/base/skills/lisa-atlassian-access/scripts/markdown-to-adf.mjs": "538e5a3d91482b9e2a055e133b7c1fcf809be51d4ae72a10776aaeeb8df4832a",
     "plugins/src/base/skills/lisa-attribute-failure/SKILL.md": "5d737b9fda916f02aaf13b208316cd54995d83aa06d27ba5daa19b6ebed6b4d9",
@@ -407,7 +407,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
     "plugins/src/base/skills/lisa-exploratory-qa/SKILL.md": "bc34dfc6418bff6eb5bc03f0c5cd98c7b6164ca3f4f80774d981f681321119b0",
     "plugins/src/base/skills/lisa-fix-linter-error/SKILL.md": "3a8f01f014ac7f7ac37024c67df1ba07202331542d269d27da3356a7fa0a5599",
-    "plugins/src/base/skills/lisa-generate-claude-remote-build-script/SKILL.md": "632ed5f64c4014d9f2d1baebdb63f7a2e0e75e285f5eab1187805c8afe7ffe07",
+    "plugins/src/base/skills/lisa-generate-claude-remote-build-script/SKILL.md": "9ae66050b046b3d5bcf4acb582928cb56f295d4d869b712e85b6e0717b67dc7b",
     "plugins/src/base/skills/lisa-git-commit/SKILL.md": "56320566e9278fb43b4d51c00854f3714dc61edc960292d51962a6f49116ac0f",
     "plugins/src/base/skills/lisa-git-prune/SKILL.md": "11fad06d109538f1a8ee4ef8043bb0e083672e3c9a7cb7ae8a7233c5411d6dd2",
     "plugins/src/base/skills/lisa-git-submit-pr/SKILL.md": "e70da3ced1a233ff094f70284c5e2ff9ff238b8c59b3eee722414dfe8a668406",
@@ -528,8 +528,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-linear/SKILL.md": "ec76f832a6df6f58b163f7f5ba6826ed2fcbddc91e44a8372e874858e4d0c518",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "f5a1e9290789fd1c33675168d30461fb24a11c98a433ef777c1f536bc2f905ef",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "7a134f6ce7857152076c2a85e0777d88f1f22b0ecfe607dd2fc6f8a286547910",
-    "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "a00ec455df6aeb6e5b436acc0265fcfa4659a546dec2e8ae2b1c8eca488bf9d7",
-    "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": "e0124aab451021f39dc3b4edfa74f5f9e32ef01d020b317531827a544150fb16",
+    "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "53fbd8acce4b5e47e88195a7b90d5be424fa6ef7ad872f52c50467c690664c3b",
+    "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": "031acb01195ae59010a65335da98d46a1d6080e749823d6f6d157938d9e96648",
     "plugins/src/base/skills/lisa-spec-conformance/SKILL.md": "3bcaf6d3b47917d00732542e30a8a302c3e293a9957faf79cac5b1d75cc538a2",
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": "c32e6a4e3115ca32b7d335e90d0a73b243c6c631a2d192568423be0cb5944e84",
     "plugins/src/base/skills/lisa-task-decomposition/SKILL.md": "d4c8bd6b36d827e609178e5192270a21bb392aa825a902f61e33a9fe73cda10c",

package/package.json

@@ -113,7 +113,7 @@
     "brace-expansion": ">=5.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-analyze-claude-remote/SKILL.md

@@ -195,7 +195,7 @@ Group the findings as:
    | Match | Substrate | Env | Setup / wiring | Domains |
    |---|---|---|---|---|
    | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
-   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG` for Cloud / `SONARQUBE_URL` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
+   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG` for Cloud / `SONARQUBE_CLI_SERVER` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
 
    For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
    the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
@@ -353,11 +353,11 @@ so the generator can render acquisition comments into its template:
       "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
     },
     {
-      "name": "SONARQUBE_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "name": "SONARQUBE_CLI_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
       "reason": "authenticates the official SonarQube MCP headlessly; the MCP runs as-is in a cloud routine (Docker is preinstalled), so no REST substitute is needed",
       "headlessSubstrate": "Official SonarQube MCP (token-authed)",
       "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
-      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server)"
+      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_CLI_ORG (Cloud) or SONARQUBE_CLI_SERVER (Server)"
     }
   ],
   "mcp": [

package/plugins/lisa/.codex-plugin/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -69,7 +69,7 @@ tracker/source, plus the host project's own package manager and tooling — not
    sibling repos reachable through the routine's GitHub proxy.
    For OPTIONAL non-tracker MCP recovery entries discovered by
    `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
-   include `JAM_PAT`, `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`), or
+   include `JAM_PAT`, `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`), or
    similar documented substrate env vars only as optional secrets, with their
    acquire/scope comments when the analysis supplied them. Never invent values or promote dormant substrates to required.
    When AWS entries are present, list only `LISA_AWS_BOOTSTRAP_JSON` as the
@@ -89,8 +89,8 @@ tracker/source, plus the host project's own package manager and tooling — not
      real MCP rather than substituting REST. Emit, guarded on the optional env
      token, the vendor CLI install (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash`),
      `sonar integrate <agent>`, and a `sonar run mcp`-image pre-pull so the first
-     run fits the ~5-min cache budget. Provide `SONARQUBE_TOKEN`
-     (+ `SONARQUBE_ORG`/`SONARQUBE_URL`); never emit `sonar auth login` (keychain
+     run fits the ~5-min cache budget. Provide `SONARQUBE_CLI_TOKEN`
+     (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`); never emit `sonar auth login` (keychain
      does not exist headless).
    - REST-only substitute substrates: for a vendor whose MCP genuinely cannot run
      headless, do not install an MCP — emit comments naming the REST host and env

package/plugins/lisa/.codex-plugin/skills/lisa-setup-sonar/SKILL.md

@@ -46,15 +46,15 @@ The MCP authenticates from environment variables — this is the headless path a
 the one factories use. **Never** write credentials to `.lisa.config.json` or
 `.lisa.config.local.json`; provide them as environment variables / CI secrets:
 
-- `SONARQUBE_TOKEN` — required.
-- `SONARQUBE_ORG` — for SonarQube Cloud.
-- `SONARQUBE_URL` — for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required.
+- `SONARQUBE_CLI_ORG` — for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — for a self-hosted SonarQube Server.
 
 On an interactive developer machine you may instead run `sonar auth login`
 (browser flow; token stored in the OS keychain). Do **not** use the keychain flow
 for headless/cloud-routine environments — provision the env token there instead
 (see `/lisa:generate-claude-remote-build-script`, which now installs the CLI,
-pre-pulls the MCP image, and sets `SONARQUBE_TOKEN`). Verify with `sonar auth
+pre-pulls the MCP image, and sets `SONARQUBE_CLI_TOKEN`). Verify with `sonar auth
 status`; record the identity label only, never token material.
 
 ## 3. Select the Test Manager target

package/plugins/lisa/.codex-plugin/skills/lisa-sonarcloud-access/SKILL.md

@@ -17,9 +17,16 @@ the `sonarqube` plugin and launched by the `sonar` CLI (`sonar run mcp`). It
 authenticates headlessly from environment variables — no browser, no OS keychain —
 so it is the same substrate on a developer machine and in a headless cloud routine:
 
-- `SONARQUBE_TOKEN` — required (Sonar user/analysis token).
-- `SONARQUBE_ORG` — required for SonarQube Cloud.
-- `SONARQUBE_URL` — required for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required (Sonar user/analysis token).
+- `SONARQUBE_CLI_ORG` — required for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — required for a self-hosted SonarQube Server.
+
+These are the **SonarQube CLI** variable names (`SONARQUBE_CLI_*`), which the
+`sonar run mcp` wrapper forwards into the MCP container — verified against a live
+SonarQube Cloud org. Do **not** substitute the raw MCP-image names
+(`SONARQUBE_TOKEN`/`SONARQUBE_ORG`/`SONARQUBE_URL`): those are read only when
+running the Docker image directly, and the `sonar` CLI ignores them (auth exits
+non-zero). The CI scan gate's `SONAR_TOKEN` is a third, separate name.
 
 Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
 <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -37,7 +44,7 @@ always enabled):
   loudly and do not improvise a substitute:
 
 ```text
-Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server).
+Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server).
 ```
 
 There is no hand-rolled REST fallback: the official MCP is headless-capable via the
@@ -69,7 +76,7 @@ tool accepts them.
 ## Invariants
 
 - The official SonarQube MCP is the only substrate; there is no REST fallback.
-- Auth is env-var only (`SONARQUBE_TOKEN` [+ `SONARQUBE_ORG` | `SONARQUBE_URL`]);
+- Auth is env-var only (`SONARQUBE_CLI_TOKEN` [+ `SONARQUBE_CLI_ORG` | `SONARQUBE_CLI_SERVER`]);
   never the interactive `sonar auth login` keychain flow inside a factory.
 - Sonar host access requires the host (`sonarcloud.io`, `sonarqube.us`, or the
   Server URL) in any custom remote-network allowlist.

package/plugins/lisa/commands/setup/sonar.md

@@ -1,5 +1,5 @@
 ---
-description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
+description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
 allowed-tools: ["Skill"]
 argument-hint: "[--org=<org-key>] [--server-url=<url>] [--global]"
 ---

package/plugins/lisa/rules/reference/integration-access-layer.md

@@ -17,8 +17,8 @@ available.
 
 Some MCPs authenticate headlessly from an env token and need no separate REST
 tier — the MCP **is** the headless substrate on both developer machines and cloud
-routines. The official SonarQube MCP is one such case (`SONARQUBE_TOKEN`
-[+ `SONARQUBE_ORG`/`SONARQUBE_URL`]): `lisa-sonarcloud-access` resolves it as a
+routines. The official SonarQube MCP is one such case (`SONARQUBE_CLI_TOKEN`
+[+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`]): `lisa-sonarcloud-access` resolves it as a
 single substrate with no hand-rolled REST fallback. Reserve the two-tier
 MCP-then-REST shape for vendors whose MCP is browser-OAuth or keychain-bound and
 therefore dead headless.
@@ -31,7 +31,7 @@ therefore dead headless.
 | Notion | `lisa-notion-access` | `NOTION_API_TOKEN` | Notion REST |
 | Linear | `lisa-linear-access` | `LINEAR_API_KEY` | Linear GraphQL |
 | Jam | `lisa-jam-access` | `JAM_PAT` | Jam CLI |
-| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`) | Official SonarQube MCP (headless via token) |
+| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`) | Official SonarQube MCP (headless via token) |
 | Sentry | `lisa-sentry-access` | `SENTRY_AUTH_TOKEN` | Sentry REST API |
 | PostHog | `lisa-posthog-access` | `POSTHOG_PERSONAL_API_KEY` | PostHog REST API |
 | Google Play | `lisa-expo:play-store-access` | `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` or `GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64` | Google Play Developer API |

package/plugins/lisa/skills/lisa-analyze-claude-remote/SKILL.md

@@ -195,7 +195,7 @@ Group the findings as:
    | Match | Substrate | Env | Setup / wiring | Domains |
    |---|---|---|---|---|
    | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
-   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG` for Cloud / `SONARQUBE_URL` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
+   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG` for Cloud / `SONARQUBE_CLI_SERVER` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
 
    For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
    the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
@@ -353,11 +353,11 @@ so the generator can render acquisition comments into its template:
       "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
     },
     {
-      "name": "SONARQUBE_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "name": "SONARQUBE_CLI_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
       "reason": "authenticates the official SonarQube MCP headlessly; the MCP runs as-is in a cloud routine (Docker is preinstalled), so no REST substitute is needed",
       "headlessSubstrate": "Official SonarQube MCP (token-authed)",
       "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
-      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server)"
+      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_CLI_ORG (Cloud) or SONARQUBE_CLI_SERVER (Server)"
     }
   ],
   "mcp": [

package/plugins/lisa/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -69,7 +69,7 @@ tracker/source, plus the host project's own package manager and tooling — not
    sibling repos reachable through the routine's GitHub proxy.
    For OPTIONAL non-tracker MCP recovery entries discovered by
    `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
-   include `JAM_PAT`, `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`), or
+   include `JAM_PAT`, `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`), or
    similar documented substrate env vars only as optional secrets, with their
    acquire/scope comments when the analysis supplied them. Never invent values or promote dormant substrates to required.
    When AWS entries are present, list only `LISA_AWS_BOOTSTRAP_JSON` as the
@@ -89,8 +89,8 @@ tracker/source, plus the host project's own package manager and tooling — not
      real MCP rather than substituting REST. Emit, guarded on the optional env
      token, the vendor CLI install (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash`),
      `sonar integrate <agent>`, and a `sonar run mcp`-image pre-pull so the first
-     run fits the ~5-min cache budget. Provide `SONARQUBE_TOKEN`
-     (+ `SONARQUBE_ORG`/`SONARQUBE_URL`); never emit `sonar auth login` (keychain
+     run fits the ~5-min cache budget. Provide `SONARQUBE_CLI_TOKEN`
+     (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`); never emit `sonar auth login` (keychain
      does not exist headless).
    - REST-only substitute substrates: for a vendor whose MCP genuinely cannot run
      headless, do not install an MCP — emit comments naming the REST host and env

package/plugins/lisa/skills/lisa-setup-sonar/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-setup-sonar
-description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
+description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
 allowed-tools: ["Bash", "Read", "Write", "Edit", "AskUserQuestion", "Skill"]
 ---
 
@@ -46,15 +46,15 @@ The MCP authenticates from environment variables — this is the headless path a
 the one factories use. **Never** write credentials to `.lisa.config.json` or
 `.lisa.config.local.json`; provide them as environment variables / CI secrets:
 
-- `SONARQUBE_TOKEN` — required.
-- `SONARQUBE_ORG` — for SonarQube Cloud.
-- `SONARQUBE_URL` — for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required.
+- `SONARQUBE_CLI_ORG` — for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — for a self-hosted SonarQube Server.
 
 On an interactive developer machine you may instead run `sonar auth login`
 (browser flow; token stored in the OS keychain). Do **not** use the keychain flow
 for headless/cloud-routine environments — provision the env token there instead
 (see `/lisa:generate-claude-remote-build-script`, which now installs the CLI,
-pre-pulls the MCP image, and sets `SONARQUBE_TOKEN`). Verify with `sonar auth
+pre-pulls the MCP image, and sets `SONARQUBE_CLI_TOKEN`). Verify with `sonar auth
 status`; record the identity label only, never token material.
 
 ## 3. Select the Test Manager target

package/plugins/lisa/skills/lisa-sonarcloud-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-sonarcloud-access
-description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud, SONARQUBE_URL for Server)."
+description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud, SONARQUBE_CLI_SERVER for Server)."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -17,9 +17,16 @@ the `sonarqube` plugin and launched by the `sonar` CLI (`sonar run mcp`). It
 authenticates headlessly from environment variables — no browser, no OS keychain —
 so it is the same substrate on a developer machine and in a headless cloud routine:
 
-- `SONARQUBE_TOKEN` — required (Sonar user/analysis token).
-- `SONARQUBE_ORG` — required for SonarQube Cloud.
-- `SONARQUBE_URL` — required for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required (Sonar user/analysis token).
+- `SONARQUBE_CLI_ORG` — required for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — required for a self-hosted SonarQube Server.
+
+These are the **SonarQube CLI** variable names (`SONARQUBE_CLI_*`), which the
+`sonar run mcp` wrapper forwards into the MCP container — verified against a live
+SonarQube Cloud org. Do **not** substitute the raw MCP-image names
+(`SONARQUBE_TOKEN`/`SONARQUBE_ORG`/`SONARQUBE_URL`): those are read only when
+running the Docker image directly, and the `sonar` CLI ignores them (auth exits
+non-zero). The CI scan gate's `SONAR_TOKEN` is a third, separate name.
 
 Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
 <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -37,7 +44,7 @@ always enabled):
   loudly and do not improvise a substitute:
 
 ```text
-Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server).
+Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server).
 ```
 
 There is no hand-rolled REST fallback: the official MCP is headless-capable via the
@@ -69,7 +76,7 @@ tool accepts them.
 ## Invariants
 
 - The official SonarQube MCP is the only substrate; there is no REST fallback.
-- Auth is env-var only (`SONARQUBE_TOKEN` [+ `SONARQUBE_ORG` | `SONARQUBE_URL`]);
+- Auth is env-var only (`SONARQUBE_CLI_TOKEN` [+ `SONARQUBE_CLI_ORG` | `SONARQUBE_CLI_SERVER`]);
   never the interactive `sonar auth login` keychain flow inside a factory.
 - Sonar host access requires the host (`sonarcloud.io`, `sonarqube.us`, or the
   Server URL) in any custom remote-network allowlist.

package/plugins/lisa-agy/commands/lisa/setup/sonar.md

@@ -1,5 +1,5 @@
 ---
-description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
+description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
 allowed-tools: ["Skill"]
 argument-hint: "[--org=<org-key>] [--server-url=<url>] [--global]"
 ---

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-analyze-claude-remote/SKILL.md

@@ -195,7 +195,7 @@ Group the findings as:
    | Match | Substrate | Env | Setup / wiring | Domains |
    |---|---|---|---|---|
    | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
-   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG` for Cloud / `SONARQUBE_URL` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
+   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG` for Cloud / `SONARQUBE_CLI_SERVER` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
 
    For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
    the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
@@ -353,11 +353,11 @@ so the generator can render acquisition comments into its template:
       "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
     },
     {
-      "name": "SONARQUBE_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "name": "SONARQUBE_CLI_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
       "reason": "authenticates the official SonarQube MCP headlessly; the MCP runs as-is in a cloud routine (Docker is preinstalled), so no REST substitute is needed",
       "headlessSubstrate": "Official SonarQube MCP (token-authed)",
       "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
-      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server)"
+      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_CLI_ORG (Cloud) or SONARQUBE_CLI_SERVER (Server)"
     }
   ],
   "mcp": [

package/plugins/lisa-agy/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -69,7 +69,7 @@ tracker/source, plus the host project's own package manager and tooling — not
    sibling repos reachable through the routine's GitHub proxy.
    For OPTIONAL non-tracker MCP recovery entries discovered by
    `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
-   include `JAM_PAT`, `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`), or
+   include `JAM_PAT`, `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`), or
    similar documented substrate env vars only as optional secrets, with their
    acquire/scope comments when the analysis supplied them. Never invent values or promote dormant substrates to required.
    When AWS entries are present, list only `LISA_AWS_BOOTSTRAP_JSON` as the
@@ -89,8 +89,8 @@ tracker/source, plus the host project's own package manager and tooling — not
      real MCP rather than substituting REST. Emit, guarded on the optional env
      token, the vendor CLI install (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash`),
      `sonar integrate <agent>`, and a `sonar run mcp`-image pre-pull so the first
-     run fits the ~5-min cache budget. Provide `SONARQUBE_TOKEN`
-     (+ `SONARQUBE_ORG`/`SONARQUBE_URL`); never emit `sonar auth login` (keychain
+     run fits the ~5-min cache budget. Provide `SONARQUBE_CLI_TOKEN`
+     (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`); never emit `sonar auth login` (keychain
      does not exist headless).
    - REST-only substitute substrates: for a vendor whose MCP genuinely cannot run
      headless, do not install an MCP — emit comments naming the REST host and env

package/plugins/lisa-agy/skills/lisa-setup-sonar/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-setup-sonar
-description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
+description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
 allowed-tools: ["Bash", "Read", "Write", "Edit", "AskUserQuestion", "Skill"]
 ---
 
@@ -46,15 +46,15 @@ The MCP authenticates from environment variables — this is the headless path a
 the one factories use. **Never** write credentials to `.lisa.config.json` or
 `.lisa.config.local.json`; provide them as environment variables / CI secrets:
 
-- `SONARQUBE_TOKEN` — required.
-- `SONARQUBE_ORG` — for SonarQube Cloud.
-- `SONARQUBE_URL` — for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required.
+- `SONARQUBE_CLI_ORG` — for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — for a self-hosted SonarQube Server.
 
 On an interactive developer machine you may instead run `sonar auth login`
 (browser flow; token stored in the OS keychain). Do **not** use the keychain flow
 for headless/cloud-routine environments — provision the env token there instead
 (see `/lisa:generate-claude-remote-build-script`, which now installs the CLI,
-pre-pulls the MCP image, and sets `SONARQUBE_TOKEN`). Verify with `sonar auth
+pre-pulls the MCP image, and sets `SONARQUBE_CLI_TOKEN`). Verify with `sonar auth
 status`; record the identity label only, never token material.
 
 ## 3. Select the Test Manager target

package/plugins/lisa-agy/skills/lisa-sonarcloud-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-sonarcloud-access
-description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud, SONARQUBE_URL for Server)."
+description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud, SONARQUBE_CLI_SERVER for Server)."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -17,9 +17,16 @@ the `sonarqube` plugin and launched by the `sonar` CLI (`sonar run mcp`). It
 authenticates headlessly from environment variables — no browser, no OS keychain —
 so it is the same substrate on a developer machine and in a headless cloud routine:
 
-- `SONARQUBE_TOKEN` — required (Sonar user/analysis token).
-- `SONARQUBE_ORG` — required for SonarQube Cloud.
-- `SONARQUBE_URL` — required for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required (Sonar user/analysis token).
+- `SONARQUBE_CLI_ORG` — required for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — required for a self-hosted SonarQube Server.
+
+These are the **SonarQube CLI** variable names (`SONARQUBE_CLI_*`), which the
+`sonar run mcp` wrapper forwards into the MCP container — verified against a live
+SonarQube Cloud org. Do **not** substitute the raw MCP-image names
+(`SONARQUBE_TOKEN`/`SONARQUBE_ORG`/`SONARQUBE_URL`): those are read only when
+running the Docker image directly, and the `sonar` CLI ignores them (auth exits
+non-zero). The CI scan gate's `SONAR_TOKEN` is a third, separate name.
 
 Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
 <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -37,7 +44,7 @@ always enabled):
   loudly and do not improvise a substitute:
 
 ```text
-Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server).
+Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server).
 ```
 
 There is no hand-rolled REST fallback: the official MCP is headless-capable via the
@@ -69,7 +76,7 @@ tool accepts them.
 ## Invariants
 
 - The official SonarQube MCP is the only substrate; there is no REST fallback.
-- Auth is env-var only (`SONARQUBE_TOKEN` [+ `SONARQUBE_ORG` | `SONARQUBE_URL`]);
+- Auth is env-var only (`SONARQUBE_CLI_TOKEN` [+ `SONARQUBE_CLI_ORG` | `SONARQUBE_CLI_SERVER`]);
   never the interactive `sonar auth login` keychain flow inside a factory.
 - Sonar host access requires the host (`sonarcloud.io`, `sonarqube.us`, or the
   Server URL) in any custom remote-network allowlist.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.297.0",
+  "version": "2.297.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/commands/lisa/setup/sonar.md

@@ -1,5 +1,5 @@
 ---
-description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
+description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
 allowed-tools: ["Skill"]
 argument-hint: "[--org=<org-key>] [--server-url=<url>] [--global]"
 ---