@codyswann/lisa 2.297.0 → 2.297.2

package/plugins/lisa-copilot/rules/reference/integration-access-layer.md

@@ -17,8 +17,8 @@ available.
 
 Some MCPs authenticate headlessly from an env token and need no separate REST
 tier — the MCP **is** the headless substrate on both developer machines and cloud
-routines. The official SonarQube MCP is one such case (`SONARQUBE_TOKEN`
-[+ `SONARQUBE_ORG`/`SONARQUBE_URL`]): `lisa-sonarcloud-access` resolves it as a
+routines. The official SonarQube MCP is one such case (`SONARQUBE_CLI_TOKEN`
+[+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`]): `lisa-sonarcloud-access` resolves it as a
 single substrate with no hand-rolled REST fallback. Reserve the two-tier
 MCP-then-REST shape for vendors whose MCP is browser-OAuth or keychain-bound and
 therefore dead headless.
@@ -31,7 +31,7 @@ therefore dead headless.
 | Notion | `lisa-notion-access` | `NOTION_API_TOKEN` | Notion REST |
 | Linear | `lisa-linear-access` | `LINEAR_API_KEY` | Linear GraphQL |
 | Jam | `lisa-jam-access` | `JAM_PAT` | Jam CLI |
-| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`) | Official SonarQube MCP (headless via token) |
+| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`) | Official SonarQube MCP (headless via token) |
 | Sentry | `lisa-sentry-access` | `SENTRY_AUTH_TOKEN` | Sentry REST API |
 | PostHog | `lisa-posthog-access` | `POSTHOG_PERSONAL_API_KEY` | PostHog REST API |
 | Google Play | `lisa-expo:play-store-access` | `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` or `GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64` | Google Play Developer API |

package/plugins/lisa-copilot/skills/lisa-analyze-claude-remote/SKILL.md

@@ -195,7 +195,7 @@ Group the findings as:
    | Match | Substrate | Env | Setup / wiring | Domains |
    |---|---|---|---|---|
    | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
-   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG` for Cloud / `SONARQUBE_URL` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
+   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG` for Cloud / `SONARQUBE_CLI_SERVER` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
 
    For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
    the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
@@ -353,11 +353,11 @@ so the generator can render acquisition comments into its template:
       "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
     },
     {
-      "name": "SONARQUBE_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "name": "SONARQUBE_CLI_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
       "reason": "authenticates the official SonarQube MCP headlessly; the MCP runs as-is in a cloud routine (Docker is preinstalled), so no REST substitute is needed",
       "headlessSubstrate": "Official SonarQube MCP (token-authed)",
       "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
-      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server)"
+      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_CLI_ORG (Cloud) or SONARQUBE_CLI_SERVER (Server)"
     }
   ],
   "mcp": [

package/plugins/lisa-copilot/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -69,7 +69,7 @@ tracker/source, plus the host project's own package manager and tooling — not
    sibling repos reachable through the routine's GitHub proxy.
    For OPTIONAL non-tracker MCP recovery entries discovered by
    `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
-   include `JAM_PAT`, `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`), or
+   include `JAM_PAT`, `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`), or
    similar documented substrate env vars only as optional secrets, with their
    acquire/scope comments when the analysis supplied them. Never invent values or promote dormant substrates to required.
    When AWS entries are present, list only `LISA_AWS_BOOTSTRAP_JSON` as the
@@ -89,8 +89,8 @@ tracker/source, plus the host project's own package manager and tooling — not
      real MCP rather than substituting REST. Emit, guarded on the optional env
      token, the vendor CLI install (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash`),
      `sonar integrate <agent>`, and a `sonar run mcp`-image pre-pull so the first
-     run fits the ~5-min cache budget. Provide `SONARQUBE_TOKEN`
-     (+ `SONARQUBE_ORG`/`SONARQUBE_URL`); never emit `sonar auth login` (keychain
+     run fits the ~5-min cache budget. Provide `SONARQUBE_CLI_TOKEN`
+     (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`); never emit `sonar auth login` (keychain
      does not exist headless).
    - REST-only substitute substrates: for a vendor whose MCP genuinely cannot run
      headless, do not install an MCP — emit comments naming the REST host and env

package/plugins/lisa-copilot/skills/lisa-setup-sonar/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-setup-sonar
-description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
+description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
 allowed-tools: ["Bash", "Read", "Write", "Edit", "AskUserQuestion", "Skill"]
 ---
 
@@ -46,15 +46,15 @@ The MCP authenticates from environment variables — this is the headless path a
 the one factories use. **Never** write credentials to `.lisa.config.json` or
 `.lisa.config.local.json`; provide them as environment variables / CI secrets:
 
-- `SONARQUBE_TOKEN` — required.
-- `SONARQUBE_ORG` — for SonarQube Cloud.
-- `SONARQUBE_URL` — for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required.
+- `SONARQUBE_CLI_ORG` — for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — for a self-hosted SonarQube Server.
 
 On an interactive developer machine you may instead run `sonar auth login`
 (browser flow; token stored in the OS keychain). Do **not** use the keychain flow
 for headless/cloud-routine environments — provision the env token there instead
 (see `/lisa:generate-claude-remote-build-script`, which now installs the CLI,
-pre-pulls the MCP image, and sets `SONARQUBE_TOKEN`). Verify with `sonar auth
+pre-pulls the MCP image, and sets `SONARQUBE_CLI_TOKEN`). Verify with `sonar auth
 status`; record the identity label only, never token material.
 
 ## 3. Select the Test Manager target

package/plugins/lisa-copilot/skills/lisa-sonarcloud-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-sonarcloud-access
-description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud, SONARQUBE_URL for Server)."
+description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud, SONARQUBE_CLI_SERVER for Server)."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -17,9 +17,16 @@ the `sonarqube` plugin and launched by the `sonar` CLI (`sonar run mcp`). It
 authenticates headlessly from environment variables — no browser, no OS keychain —
 so it is the same substrate on a developer machine and in a headless cloud routine:
 
-- `SONARQUBE_TOKEN` — required (Sonar user/analysis token).
-- `SONARQUBE_ORG` — required for SonarQube Cloud.
-- `SONARQUBE_URL` — required for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required (Sonar user/analysis token).
+- `SONARQUBE_CLI_ORG` — required for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — required for a self-hosted SonarQube Server.
+
+These are the **SonarQube CLI** variable names (`SONARQUBE_CLI_*`), which the
+`sonar run mcp` wrapper forwards into the MCP container — verified against a live
+SonarQube Cloud org. Do **not** substitute the raw MCP-image names
+(`SONARQUBE_TOKEN`/`SONARQUBE_ORG`/`SONARQUBE_URL`): those are read only when
+running the Docker image directly, and the `sonar` CLI ignores them (auth exits
+non-zero). The CI scan gate's `SONAR_TOKEN` is a third, separate name.
 
 Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
 <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -37,7 +44,7 @@ always enabled):
   loudly and do not improvise a substitute:
 
 ```text
-Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server).
+Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server).
 ```
 
 There is no hand-rolled REST fallback: the official MCP is headless-capable via the
@@ -69,7 +76,7 @@ tool accepts them.
 ## Invariants
 
 - The official SonarQube MCP is the only substrate; there is no REST fallback.
-- Auth is env-var only (`SONARQUBE_TOKEN` [+ `SONARQUBE_ORG` | `SONARQUBE_URL`]);
+- Auth is env-var only (`SONARQUBE_CLI_TOKEN` [+ `SONARQUBE_CLI_ORG` | `SONARQUBE_CLI_SERVER`]);
   never the interactive `sonar auth login` keychain flow inside a factory.
 - Sonar host access requires the host (`sonarcloud.io`, `sonarqube.us`, or the
   Server URL) in any custom remote-network allowlist.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/commands/lisa/setup/sonar.md

@@ -1,5 +1,5 @@
 ---
-description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
+description: "Wire the official SonarQube plugin + MCP into this project across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent, and writes only non-secret policy to `.lisa.config.json`. Does not touch the separate CI SonarCloud scan gate."
 allowed-tools: ["Skill"]
 argument-hint: "[--org=<org-key>] [--server-url=<url>] [--global]"
 ---

package/plugins/lisa-cursor/rules/integration-access-layer-reference.mdc

@@ -22,8 +22,8 @@ available.
 
 Some MCPs authenticate headlessly from an env token and need no separate REST
 tier — the MCP **is** the headless substrate on both developer machines and cloud
-routines. The official SonarQube MCP is one such case (`SONARQUBE_TOKEN`
-[+ `SONARQUBE_ORG`/`SONARQUBE_URL`]): `lisa-sonarcloud-access` resolves it as a
+routines. The official SonarQube MCP is one such case (`SONARQUBE_CLI_TOKEN`
+[+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`]): `lisa-sonarcloud-access` resolves it as a
 single substrate with no hand-rolled REST fallback. Reserve the two-tier
 MCP-then-REST shape for vendors whose MCP is browser-OAuth or keychain-bound and
 therefore dead headless.
@@ -36,7 +36,7 @@ therefore dead headless.
 | Notion | `lisa-notion-access` | `NOTION_API_TOKEN` | Notion REST |
 | Linear | `lisa-linear-access` | `LINEAR_API_KEY` | Linear GraphQL |
 | Jam | `lisa-jam-access` | `JAM_PAT` | Jam CLI |
-| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`) | Official SonarQube MCP (headless via token) |
+| SonarCloud | `lisa-sonarcloud-access` | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`) | Official SonarQube MCP (headless via token) |
 | Sentry | `lisa-sentry-access` | `SENTRY_AUTH_TOKEN` | Sentry REST API |
 | PostHog | `lisa-posthog-access` | `POSTHOG_PERSONAL_API_KEY` | PostHog REST API |
 | Google Play | `lisa-expo:play-store-access` | `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` or `GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64` | Google Play Developer API |

package/plugins/lisa-cursor/skills/lisa-analyze-claude-remote/SKILL.md

@@ -195,7 +195,7 @@ Group the findings as:
    | Match | Substrate | Env | Setup / wiring | Domains |
    |---|---|---|---|---|
    | `mcp.jam.dev`, `jam`, or Jam MCP entries | Jam CLI (`jam`) authenticated by PAT | `JAM_PAT` | install with `curl -fsSL https://native.jam.dev/install | bash`; export `~/.local/bin`; run `printf '%s' "$JAM_PAT" | jam auth login --token`; optionally `jam skills install` | `native.jam.dev`, `api.jam.dev` |
-   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG` for Cloud / `SONARQUBE_URL` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
+   | `mcp/sonarqube`, `sonarqube`, or SonarQube/SonarCloud MCP entries | Official SonarQube MCP (`sonar run mcp`), token-authed — runs headless as-is, no REST substitute | `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG` for Cloud / `SONARQUBE_CLI_SERVER` for Server) | install the SonarQube CLI (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh \| bash`) and `sonar integrate <agent>`; pre-pull the MCP container image in the setup script so it fits the cache budget; the MCP authenticates from the env token — never `sonar auth login` | `sonarcloud.io`, `sonarqube.us` (or the Server URL) |
 
    For PAT-bearer MCP substrates that really use the same MCP transport, include `mcpHeaders` in
    the inventory with a snippet such as `headers: { "Authorization": "Bearer ${VAR}" }` so the
@@ -353,11 +353,11 @@ so the generator can render acquisition comments into its template:
       "setupSnippet": "curl -fsSL https://native.jam.dev/install | bash; export PATH=\"$HOME/.local/bin:$PATH\"; printf '%s' \"$JAM_PAT\" | jam auth login --token; jam skills install"
     },
     {
-      "name": "SONARQUBE_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
+      "name": "SONARQUBE_CLI_TOKEN", "required": false, "secret": true, "integration": "sonarcloud",
       "reason": "authenticates the official SonarQube MCP headlessly; the MCP runs as-is in a cloud routine (Docker is preinstalled), so no REST substitute is needed",
       "headlessSubstrate": "Official SonarQube MCP (token-authed)",
       "acquireUrl": "https://docs.sonarsource.com/sonarqube-cloud/managing-your-account/managing-tokens",
-      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_ORG (Cloud) or SONARQUBE_URL (Server)"
+      "accessScope": "token must be able to read the target Sonar organization/project quality gate, issues, hotspots, rules, coverage, duplications, and dependency risks; add SONARQUBE_CLI_ORG (Cloud) or SONARQUBE_CLI_SERVER (Server)"
     }
   ],
   "mcp": [

package/plugins/lisa-cursor/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -69,7 +69,7 @@ tracker/source, plus the host project's own package manager and tooling — not
    sibling repos reachable through the routine's GitHub proxy.
    For OPTIONAL non-tracker MCP recovery entries discovered by
    `/lisa:analyze-claude-remote`, preserve the same names-only behavior:
-   include `JAM_PAT`, `SONARQUBE_TOKEN` (+ `SONARQUBE_ORG`/`SONARQUBE_URL`), or
+   include `JAM_PAT`, `SONARQUBE_CLI_TOKEN` (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`), or
    similar documented substrate env vars only as optional secrets, with their
    acquire/scope comments when the analysis supplied them. Never invent values or promote dormant substrates to required.
    When AWS entries are present, list only `LISA_AWS_BOOTSTRAP_JSON` as the
@@ -89,8 +89,8 @@ tracker/source, plus the host project's own package manager and tooling — not
      real MCP rather than substituting REST. Emit, guarded on the optional env
      token, the vendor CLI install (`curl -o- https://raw.githubusercontent.com/SonarSource/sonarqube-cli/refs/heads/master/user-scripts/install.sh | bash`),
      `sonar integrate <agent>`, and a `sonar run mcp`-image pre-pull so the first
-     run fits the ~5-min cache budget. Provide `SONARQUBE_TOKEN`
-     (+ `SONARQUBE_ORG`/`SONARQUBE_URL`); never emit `sonar auth login` (keychain
+     run fits the ~5-min cache budget. Provide `SONARQUBE_CLI_TOKEN`
+     (+ `SONARQUBE_CLI_ORG`/`SONARQUBE_CLI_SERVER`); never emit `sonar auth login` (keychain
      does not exist headless).
    - REST-only substitute substrates: for a vendor whose MCP genuinely cannot run
      headless, do not install an MCP — emit comments naming the REST host and env

package/plugins/lisa-cursor/skills/lisa-setup-sonar/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-setup-sonar
-description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
+description: "Configure the official SonarQube plugin + MCP as Lisa's single Sonar substrate across every supported coding agent. Installs/updates the SonarQube CLI, authenticates (browser login on a dev machine, or SONARQUBE_CLI_TOKEN headless), selects the Test Manager target, runs `sonar integrate <agent>` for each supported agent (Claude, Codex, Cursor, Copilot, Antigravity) and wires the MCP for OpenCode, then writes only non-secret policy to .lisa.config.json. Separate from the CI SonarCloud scan gate, which is unchanged."
 allowed-tools: ["Bash", "Read", "Write", "Edit", "AskUserQuestion", "Skill"]
 ---
 
@@ -46,15 +46,15 @@ The MCP authenticates from environment variables — this is the headless path a
 the one factories use. **Never** write credentials to `.lisa.config.json` or
 `.lisa.config.local.json`; provide them as environment variables / CI secrets:
 
-- `SONARQUBE_TOKEN` — required.
-- `SONARQUBE_ORG` — for SonarQube Cloud.
-- `SONARQUBE_URL` — for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required.
+- `SONARQUBE_CLI_ORG` — for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — for a self-hosted SonarQube Server.
 
 On an interactive developer machine you may instead run `sonar auth login`
 (browser flow; token stored in the OS keychain). Do **not** use the keychain flow
 for headless/cloud-routine environments — provision the env token there instead
 (see `/lisa:generate-claude-remote-build-script`, which now installs the CLI,
-pre-pulls the MCP image, and sets `SONARQUBE_TOKEN`). Verify with `sonar auth
+pre-pulls the MCP image, and sets `SONARQUBE_CLI_TOKEN`). Verify with `sonar auth
 status`; record the identity label only, never token material.
 
 ## 3. Select the Test Manager target

package/plugins/lisa-cursor/skills/lisa-sonarcloud-access/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-sonarcloud-access
-description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud, SONARQUBE_URL for Server)."
+description: "Vendor-neutral access layer for SonarQube Cloud/Server. Sonar triage skills MUST delegate through this skill rather than calling the SonarQube MCP tools directly. Single substrate: the official SonarQube MCP server (mcp__sonarqube__*), authenticated headlessly from SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud, SONARQUBE_CLI_SERVER for Server)."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -17,9 +17,16 @@ the `sonarqube` plugin and launched by the `sonar` CLI (`sonar run mcp`). It
 authenticates headlessly from environment variables — no browser, no OS keychain —
 so it is the same substrate on a developer machine and in a headless cloud routine:
 
-- `SONARQUBE_TOKEN` — required (Sonar user/analysis token).
-- `SONARQUBE_ORG` — required for SonarQube Cloud.
-- `SONARQUBE_URL` — required for a self-hosted SonarQube Server.
+- `SONARQUBE_CLI_TOKEN` — required (Sonar user/analysis token).
+- `SONARQUBE_CLI_ORG` — required for SonarQube Cloud.
+- `SONARQUBE_CLI_SERVER` — required for a self-hosted SonarQube Server.
+
+These are the **SonarQube CLI** variable names (`SONARQUBE_CLI_*`), which the
+`sonar run mcp` wrapper forwards into the MCP container — verified against a live
+SonarQube Cloud org. Do **not** substitute the raw MCP-image names
+(`SONARQUBE_TOKEN`/`SONARQUBE_ORG`/`SONARQUBE_URL`): those are read only when
+running the Docker image directly, and the `sonar` CLI ignores them (auth exits
+non-zero). The CI scan gate's `SONAR_TOKEN` is a third, separate name.
 
 Wiring is performed once by `/lisa:setup:sonar` (which drives `sonar integrate
 <agent>`); this access layer assumes the MCP is already wired. This is distinct
@@ -37,7 +44,7 @@ always enabled):
   loudly and do not improvise a substitute:
 
 ```text
-Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_TOKEN (+ SONARQUBE_ORG for Cloud / SONARQUBE_URL for Server).
+Error: no SonarQube access. Run /lisa:setup:sonar (or `sonar integrate <agent>`), and set SONARQUBE_CLI_TOKEN (+ SONARQUBE_CLI_ORG for Cloud / SONARQUBE_CLI_SERVER for Server).
 ```
 
 There is no hand-rolled REST fallback: the official MCP is headless-capable via the
@@ -69,7 +76,7 @@ tool accepts them.
 ## Invariants
 
 - The official SonarQube MCP is the only substrate; there is no REST fallback.
-- Auth is env-var only (`SONARQUBE_TOKEN` [+ `SONARQUBE_ORG` | `SONARQUBE_URL`]);
+- Auth is env-var only (`SONARQUBE_CLI_TOKEN` [+ `SONARQUBE_CLI_ORG` | `SONARQUBE_CLI_SERVER`]);
   never the interactive `sonar auth login` keychain flow inside a factory.
 - Sonar host access requires the host (`sonarcloud.io`, `sonarqube.us`, or the
   Server URL) in any custom remote-network allowlist.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.297.0",
+  "version": "2.297.2",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"