@codyswann/lisa 2.317.7 → 2.319.0

package/expo/package-lisa/package.lisa.json

@@ -69,7 +69,7 @@
       "i18n-js": "^4.5.1",
       "patch-package": "^8.0.0",
       "react-hook-form": "^7.70.0",
-      "tar": ">=7.5.11",
+      "tar": ">=7.5.19",
       "text-encoding-polyfill": "^0.6.7",
       "usehooks-ts": "^3.1.1",
       "zod": "^4.3.5"
@@ -98,19 +98,19 @@
     },
     "resolutions": {
       "@isaacs/brace-expansion": "^5.0.1",
-      "brace-expansion": ">=5.0.7",
+      "brace-expansion": ">=5.0.8",
       "eslint-plugin-react-hooks": "^7.0.0",
       "fast-xml-parser": "^5.10.1",
-      "tar": ">=7.5.11",
+      "tar": ">=7.5.19",
       "websocket-driver": ">=0.7.5"
     },
     "overrides": {
       "@isaacs/brace-expansion": "^5.0.1",
-      "brace-expansion": ">=5.0.7",
+      "brace-expansion": ">=5.0.8",
       "eslint-plugin-react-hooks": "^7.0.0",
       "fast-xml-parser": "^5.10.1",
       "zod-validation-error": "^4.0.0",
-      "tar": ">=7.5.11",
+      "tar": ">=7.5.19",
       "websocket-driver": ">=0.7.5"
     }
   },

package/nestjs/package-lisa/package.lisa.json

@@ -49,7 +49,7 @@
       "lint:fix": "oxlint --fix && eslint . --fix"
     },
     "dependencies": {
-      "@apollo/server": "^5.2.0",
+      "@apollo/server": "^5.4.0",
       "@as-integrations/express5": "^1.1.2",
       "@aws-sdk/client-apigatewaymanagementapi": "^3.967.0",
       "@aws-sdk/client-cognito-identity-provider": "^3.969.0",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.8"
   },
   "name": "@codyswann/lisa",
-  "version": "2.317.7",
+  "version": "2.319.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.317.7",
+  "version": "2.319.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.317.7",
+  "version": "2.319.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -47,6 +47,16 @@ function fingerprint(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
 
+/**
+ * The value a proxied credential reads as instead of a usable token.
+ *
+ * Some surfaces keep a credential outside the sandbox entirely and substitute
+ * the real value at egress. The variable is then present and non-empty, which
+ * is exactly what makes it dangerous: a presence check passes, and only a
+ * consumer that reads the variable *itself* discovers it holds a placeholder.
+ */
+const PROXY_PLACEHOLDER = "proxy-injected";
+
 /**
  * Assert every declared name actually resolves.
  * @param {object} cfg Resolved configuration.
@@ -56,18 +66,36 @@ function fingerprint(value) {
  */
 export function checkRequired(cfg, provider, file, report) {
   for (const name of cfg.require ?? []) {
-    const resolves =
-      (process.env[name] ?? "").trim() ||
-      file.get(name) ||
-      provider.get(name)?.value;
-    if (resolves) report("ok", name, "resolves");
-    else
+    const fromEnv = (process.env[name] ?? "").trim();
+    const resolves = fromEnv || file.get(name) || provider.get(name)?.value;
+
+    if (!resolves) {
       report(
         "error",
         name,
         "declared in secrets.require but resolves nowhere — a startup error, " +
           "not a late surprise"
       );
+      continue;
+    }
+
+    // Reported separately from "resolves" because the two are not the same
+    // claim. A tool that authenticates through the proxy works; a script that
+    // reads this variable and puts it in an Authorization header sends the
+    // literal placeholder and gets a confusing auth failure far from here.
+    if (fromEnv === PROXY_PLACEHOLDER) {
+      report(
+        "warn",
+        name,
+        `reads as the literal string "${PROXY_PLACEHOLDER}" — the value is ` +
+          `substituted at egress and never enters this environment. Tools that ` +
+          `authenticate through the proxy work; anything reading this variable ` +
+          `directly gets the placeholder, not a credential`
+      );
+      continue;
+    }
+
+    report("ok", name, "resolves");
   }
 }
 

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -28,11 +28,19 @@ import { join } from "node:path";
  * drift and leak. It is *required* on surfaces whose bootstrap runs before the
  * consuming process exists and which therefore have no other channel; a remote
  * agent container prepares itself during setup, long before any task starts.
+ *
+ * The two remote surfaces share the capability but not the timing, and a reader
+ * adding a third should not assume otherwise. `codex-cloud` re-runs its setup
+ * script when a container resumes, so materializing there picks up a rotated
+ * value. `claude-web` *skips* its setup script whenever a filesystem cache
+ * exists, so materializing there would strand a rotated value until the cache
+ * expired — its materialize step runs from a session-start hook instead.
  */
 export const SURFACES = {
   local: { materialized: false, mayWriteValues: false },
   "github-actions": { materialized: false, mayWriteValues: false },
   "codex-cloud": { materialized: true, mayWriteValues: true },
+  "claude-web": { materialized: true, mayWriteValues: true },
 };
 
 /** Config defaults when `.lisa.config.json` carries no `secrets` block. */
@@ -68,6 +76,10 @@ export function detectSurface(configured = null, env = process.env) {
     return explicit;
   }
   if ((env.GITHUB_ACTIONS ?? "") === "true") return "github-actions";
+  // Compared to the exact string rather than tested for presence: the variable
+  // is documented as carrying "true" in a cloud session and never being true
+  // locally, so a presence test would misread a shell that exports it empty.
+  if ((env.CLAUDE_CODE_REMOTE ?? "") === "true") return "claude-web";
   if ((env.CODEX_SANDBOX ?? env.CODEX_HOME ?? "") !== "") return "codex-cloud";
   return "local";
 }

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -19,14 +19,59 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { SURFACES as SURFACE_CAPABILITIES } from "./surfaces.mjs";
+
 /** Providers with a read implementation today. */
 const IMPLEMENTED_PROVIDERS = new Set(["bitwarden", "doppler", "env"]);
 
 /** Providers named in the dispatch table but not yet implemented. */
 const DECLARED_PROVIDERS = new Set(["1password", "aws", "vault"]);
 
-/** Surfaces the resolver knows. */
-const SURFACES = new Set(["local", "github-actions", "codex-cloud"]);
+/**
+ * Surfaces the resolver knows.
+ *
+ * Derived from the resolver's own table rather than restated here. The two
+ * lists previously drifted apart by construction: adding a surface meant
+ * remembering to edit a second file, and forgetting produced a config that
+ * resolved correctly at runtime while `doctor` called it unknown.
+ */
+const SURFACES = new Set(Object.keys(SURFACE_CAPABILITIES));
+
+/**
+ * What a provisioned surface must record before anything dispatches to it.
+ *
+ * Deliberately not uniform, because these surfaces do not bind the same way. A
+ * Codex Cloud environment is bound to one repository, so naming the repository
+ * is part of proving the environment is the right one. A Claude cloud
+ * environment has no repository at all — it is account-scoped configuration
+ * (network policy, variables, setup script) and the repository arrives per
+ * session — so its durable handle is the routine that dispatch fires.
+ *
+ * Requiring `repository` of every surface, as this file used to, would demand
+ * a field that cannot be true of `claude-web` in any meaningful sense.
+ *
+ * `repository` stays the default so every existing surface keeps its current
+ * contract. This file checks structure only — whether a declaration *could* be
+ * correct — so it deliberately does not restate the fuller preconditions that
+ * `lisa-remote-dispatch` enforces at the moment it actually dispatches.
+ */
+const SURFACE_BINDINGS = {
+  "claude-web": ["routineId", "fireUrl"],
+};
+
+/**
+ * The fields a surface must record, with the default applied.
+ *
+ * Read through one helper rather than at each call site, because the two
+ * callers answer different questions — "could this declaration be correct" and
+ * "may an automation dispatch to it" — and a fallback that drifted between them
+ * would let those answers disagree about the very same config.
+ * @param {string} surface Surface name.
+ * @returns {string[]} Field names that must be present.
+ */
+function bindingsFor(surface) {
+  return SURFACE_BINDINGS[surface] ?? ["repository"];
+}
 
 /** Install methods the toolchain runner supports. */
 const INSTALL_METHODS = new Set(["release-zip", "npm-global"]);
@@ -139,15 +184,30 @@ export function validateRemoteEnv(remoteEnv) {
   for (const [surface, block] of Object.entries(remoteEnv.surfaces ?? {})) {
     if (!SURFACES.has(surface)) {
       problems.push(`remoteEnv.surfaces has unknown surface "${surface}"`);
+      continue;
     }
-    if (!block.repository) {
-      problems.push(`remoteEnv.surfaces["${surface}"] has no repository`);
+    for (const field of bindingsFor(surface)) {
+      if (!block[field]) {
+        problems.push(`remoteEnv.surfaces["${surface}"] has no ${field}`);
+      }
     }
   }
 
   return problems;
 }
 
+/**
+ * Report whether a surface has been provisioned far enough to dispatch to.
+ * @param {object|undefined} remoteEnv The remote-environment block.
+ * @param {string} surface Surface name.
+ * @returns {boolean} Whether every binding field is recorded.
+ */
+export function isProvisioned(remoteEnv, surface) {
+  const block = remoteEnv?.surfaces?.[surface];
+  if (!block) return false;
+  return bindingsFor(surface).every(field => Boolean(block[field]));
+}
+
 /**
  * Validate the `automations` block against declared surfaces.
  * @param {object|undefined} automations The block, if present.
@@ -173,7 +233,7 @@ export function validateAutomations(automations, remoteEnv) {
       );
       continue;
     }
-    if (!remoteEnv?.surfaces?.[loop.executionEnv]?.repository) {
+    if (!isProvisioned(remoteEnv, loop.executionEnv)) {
       problems.push(
         `automations["${name}"] dispatches to "${loop.executionEnv}", which is ` +
           `not provisioned. Run /lisa:setup:remote-env ${loop.executionEnv} first.`

package/plugins/lisa/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -47,6 +47,16 @@ function fingerprint(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
 
+/**
+ * The value a proxied credential reads as instead of a usable token.
+ *
+ * Some surfaces keep a credential outside the sandbox entirely and substitute
+ * the real value at egress. The variable is then present and non-empty, which
+ * is exactly what makes it dangerous: a presence check passes, and only a
+ * consumer that reads the variable *itself* discovers it holds a placeholder.
+ */
+const PROXY_PLACEHOLDER = "proxy-injected";
+
 /**
  * Assert every declared name actually resolves.
  * @param {object} cfg Resolved configuration.
@@ -56,18 +66,36 @@ function fingerprint(value) {
  */
 export function checkRequired(cfg, provider, file, report) {
   for (const name of cfg.require ?? []) {
-    const resolves =
-      (process.env[name] ?? "").trim() ||
-      file.get(name) ||
-      provider.get(name)?.value;
-    if (resolves) report("ok", name, "resolves");
-    else
+    const fromEnv = (process.env[name] ?? "").trim();
+    const resolves = fromEnv || file.get(name) || provider.get(name)?.value;
+
+    if (!resolves) {
       report(
         "error",
         name,
         "declared in secrets.require but resolves nowhere — a startup error, " +
           "not a late surprise"
       );
+      continue;
+    }
+
+    // Reported separately from "resolves" because the two are not the same
+    // claim. A tool that authenticates through the proxy works; a script that
+    // reads this variable and puts it in an Authorization header sends the
+    // literal placeholder and gets a confusing auth failure far from here.
+    if (fromEnv === PROXY_PLACEHOLDER) {
+      report(
+        "warn",
+        name,
+        `reads as the literal string "${PROXY_PLACEHOLDER}" — the value is ` +
+          `substituted at egress and never enters this environment. Tools that ` +
+          `authenticate through the proxy work; anything reading this variable ` +
+          `directly gets the placeholder, not a credential`
+      );
+      continue;
+    }
+
+    report("ok", name, "resolves");
   }
 }
 

package/plugins/lisa/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -28,11 +28,19 @@ import { join } from "node:path";
  * drift and leak. It is *required* on surfaces whose bootstrap runs before the
  * consuming process exists and which therefore have no other channel; a remote
  * agent container prepares itself during setup, long before any task starts.
+ *
+ * The two remote surfaces share the capability but not the timing, and a reader
+ * adding a third should not assume otherwise. `codex-cloud` re-runs its setup
+ * script when a container resumes, so materializing there picks up a rotated
+ * value. `claude-web` *skips* its setup script whenever a filesystem cache
+ * exists, so materializing there would strand a rotated value until the cache
+ * expired — its materialize step runs from a session-start hook instead.
  */
 export const SURFACES = {
   local: { materialized: false, mayWriteValues: false },
   "github-actions": { materialized: false, mayWriteValues: false },
   "codex-cloud": { materialized: true, mayWriteValues: true },
+  "claude-web": { materialized: true, mayWriteValues: true },
 };
 
 /** Config defaults when `.lisa.config.json` carries no `secrets` block. */
@@ -68,6 +76,10 @@ export function detectSurface(configured = null, env = process.env) {
     return explicit;
   }
   if ((env.GITHUB_ACTIONS ?? "") === "true") return "github-actions";
+  // Compared to the exact string rather than tested for presence: the variable
+  // is documented as carrying "true" in a cloud session and never being true
+  // locally, so a presence test would misread a shell that exports it empty.
+  if ((env.CLAUDE_CODE_REMOTE ?? "") === "true") return "claude-web";
   if ((env.CODEX_SANDBOX ?? env.CODEX_HOME ?? "") !== "") return "codex-cloud";
   return "local";
 }

package/plugins/lisa/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -19,14 +19,59 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { SURFACES as SURFACE_CAPABILITIES } from "./surfaces.mjs";
+
 /** Providers with a read implementation today. */
 const IMPLEMENTED_PROVIDERS = new Set(["bitwarden", "doppler", "env"]);
 
 /** Providers named in the dispatch table but not yet implemented. */
 const DECLARED_PROVIDERS = new Set(["1password", "aws", "vault"]);
 
-/** Surfaces the resolver knows. */
-const SURFACES = new Set(["local", "github-actions", "codex-cloud"]);
+/**
+ * Surfaces the resolver knows.
+ *
+ * Derived from the resolver's own table rather than restated here. The two
+ * lists previously drifted apart by construction: adding a surface meant
+ * remembering to edit a second file, and forgetting produced a config that
+ * resolved correctly at runtime while `doctor` called it unknown.
+ */
+const SURFACES = new Set(Object.keys(SURFACE_CAPABILITIES));
+
+/**
+ * What a provisioned surface must record before anything dispatches to it.
+ *
+ * Deliberately not uniform, because these surfaces do not bind the same way. A
+ * Codex Cloud environment is bound to one repository, so naming the repository
+ * is part of proving the environment is the right one. A Claude cloud
+ * environment has no repository at all — it is account-scoped configuration
+ * (network policy, variables, setup script) and the repository arrives per
+ * session — so its durable handle is the routine that dispatch fires.
+ *
+ * Requiring `repository` of every surface, as this file used to, would demand
+ * a field that cannot be true of `claude-web` in any meaningful sense.
+ *
+ * `repository` stays the default so every existing surface keeps its current
+ * contract. This file checks structure only — whether a declaration *could* be
+ * correct — so it deliberately does not restate the fuller preconditions that
+ * `lisa-remote-dispatch` enforces at the moment it actually dispatches.
+ */
+const SURFACE_BINDINGS = {
+  "claude-web": ["routineId", "fireUrl"],
+};
+
+/**
+ * The fields a surface must record, with the default applied.
+ *
+ * Read through one helper rather than at each call site, because the two
+ * callers answer different questions — "could this declaration be correct" and
+ * "may an automation dispatch to it" — and a fallback that drifted between them
+ * would let those answers disagree about the very same config.
+ * @param {string} surface Surface name.
+ * @returns {string[]} Field names that must be present.
+ */
+function bindingsFor(surface) {
+  return SURFACE_BINDINGS[surface] ?? ["repository"];
+}
 
 /** Install methods the toolchain runner supports. */
 const INSTALL_METHODS = new Set(["release-zip", "npm-global"]);
@@ -139,15 +184,30 @@ export function validateRemoteEnv(remoteEnv) {
   for (const [surface, block] of Object.entries(remoteEnv.surfaces ?? {})) {
     if (!SURFACES.has(surface)) {
       problems.push(`remoteEnv.surfaces has unknown surface "${surface}"`);
+      continue;
     }
-    if (!block.repository) {
-      problems.push(`remoteEnv.surfaces["${surface}"] has no repository`);
+    for (const field of bindingsFor(surface)) {
+      if (!block[field]) {
+        problems.push(`remoteEnv.surfaces["${surface}"] has no ${field}`);
+      }
     }
   }
 
   return problems;
 }
 
+/**
+ * Report whether a surface has been provisioned far enough to dispatch to.
+ * @param {object|undefined} remoteEnv The remote-environment block.
+ * @param {string} surface Surface name.
+ * @returns {boolean} Whether every binding field is recorded.
+ */
+export function isProvisioned(remoteEnv, surface) {
+  const block = remoteEnv?.surfaces?.[surface];
+  if (!block) return false;
+  return bindingsFor(surface).every(field => Boolean(block[field]));
+}
+
 /**
  * Validate the `automations` block against declared surfaces.
  * @param {object|undefined} automations The block, if present.
@@ -173,7 +233,7 @@ export function validateAutomations(automations, remoteEnv) {
       );
       continue;
     }
-    if (!remoteEnv?.surfaces?.[loop.executionEnv]?.repository) {
+    if (!isProvisioned(remoteEnv, loop.executionEnv)) {
       problems.push(
         `automations["${name}"] dispatches to "${loop.executionEnv}", which is ` +
           `not provisioned. Run /lisa:setup:remote-env ${loop.executionEnv} first.`

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.317.7",
+  "version": "2.319.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -47,6 +47,16 @@ function fingerprint(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 12);
 }
 
+/**
+ * The value a proxied credential reads as instead of a usable token.
+ *
+ * Some surfaces keep a credential outside the sandbox entirely and substitute
+ * the real value at egress. The variable is then present and non-empty, which
+ * is exactly what makes it dangerous: a presence check passes, and only a
+ * consumer that reads the variable *itself* discovers it holds a placeholder.
+ */
+const PROXY_PLACEHOLDER = "proxy-injected";
+
 /**
  * Assert every declared name actually resolves.
  * @param {object} cfg Resolved configuration.
@@ -56,18 +66,36 @@ function fingerprint(value) {
  */
 export function checkRequired(cfg, provider, file, report) {
   for (const name of cfg.require ?? []) {
-    const resolves =
-      (process.env[name] ?? "").trim() ||
-      file.get(name) ||
-      provider.get(name)?.value;
-    if (resolves) report("ok", name, "resolves");
-    else
+    const fromEnv = (process.env[name] ?? "").trim();
+    const resolves = fromEnv || file.get(name) || provider.get(name)?.value;
+
+    if (!resolves) {
       report(
         "error",
         name,
         "declared in secrets.require but resolves nowhere — a startup error, " +
           "not a late surprise"
       );
+      continue;
+    }
+
+    // Reported separately from "resolves" because the two are not the same
+    // claim. A tool that authenticates through the proxy works; a script that
+    // reads this variable and puts it in an Authorization header sends the
+    // literal placeholder and gets a confusing auth failure far from here.
+    if (fromEnv === PROXY_PLACEHOLDER) {
+      report(
+        "warn",
+        name,
+        `reads as the literal string "${PROXY_PLACEHOLDER}" — the value is ` +
+          `substituted at egress and never enters this environment. Tools that ` +
+          `authenticate through the proxy work; anything reading this variable ` +
+          `directly gets the placeholder, not a credential`
+      );
+      continue;
+    }
+
+    report("ok", name, "resolves");
   }
 }
 

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -28,11 +28,19 @@ import { join } from "node:path";
  * drift and leak. It is *required* on surfaces whose bootstrap runs before the
  * consuming process exists and which therefore have no other channel; a remote
  * agent container prepares itself during setup, long before any task starts.
+ *
+ * The two remote surfaces share the capability but not the timing, and a reader
+ * adding a third should not assume otherwise. `codex-cloud` re-runs its setup
+ * script when a container resumes, so materializing there picks up a rotated
+ * value. `claude-web` *skips* its setup script whenever a filesystem cache
+ * exists, so materializing there would strand a rotated value until the cache
+ * expired — its materialize step runs from a session-start hook instead.
  */
 export const SURFACES = {
   local: { materialized: false, mayWriteValues: false },
   "github-actions": { materialized: false, mayWriteValues: false },
   "codex-cloud": { materialized: true, mayWriteValues: true },
+  "claude-web": { materialized: true, mayWriteValues: true },
 };
 
 /** Config defaults when `.lisa.config.json` carries no `secrets` block. */
@@ -68,6 +76,10 @@ export function detectSurface(configured = null, env = process.env) {
     return explicit;
   }
   if ((env.GITHUB_ACTIONS ?? "") === "true") return "github-actions";
+  // Compared to the exact string rather than tested for presence: the variable
+  // is documented as carrying "true" in a cloud session and never being true
+  // locally, so a presence test would misread a shell that exports it empty.
+  if ((env.CLAUDE_CODE_REMOTE ?? "") === "true") return "claude-web";
   if ((env.CODEX_SANDBOX ?? env.CODEX_HOME ?? "") !== "") return "codex-cloud";
   return "local";
 }

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/validate-config.mjs

@@ -19,14 +19,59 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { SURFACES as SURFACE_CAPABILITIES } from "./surfaces.mjs";
+
 /** Providers with a read implementation today. */
 const IMPLEMENTED_PROVIDERS = new Set(["bitwarden", "doppler", "env"]);
 
 /** Providers named in the dispatch table but not yet implemented. */
 const DECLARED_PROVIDERS = new Set(["1password", "aws", "vault"]);
 
-/** Surfaces the resolver knows. */
-const SURFACES = new Set(["local", "github-actions", "codex-cloud"]);
+/**
+ * Surfaces the resolver knows.
+ *
+ * Derived from the resolver's own table rather than restated here. The two
+ * lists previously drifted apart by construction: adding a surface meant
+ * remembering to edit a second file, and forgetting produced a config that
+ * resolved correctly at runtime while `doctor` called it unknown.
+ */
+const SURFACES = new Set(Object.keys(SURFACE_CAPABILITIES));
+
+/**
+ * What a provisioned surface must record before anything dispatches to it.
+ *
+ * Deliberately not uniform, because these surfaces do not bind the same way. A
+ * Codex Cloud environment is bound to one repository, so naming the repository
+ * is part of proving the environment is the right one. A Claude cloud
+ * environment has no repository at all — it is account-scoped configuration
+ * (network policy, variables, setup script) and the repository arrives per
+ * session — so its durable handle is the routine that dispatch fires.
+ *
+ * Requiring `repository` of every surface, as this file used to, would demand
+ * a field that cannot be true of `claude-web` in any meaningful sense.
+ *
+ * `repository` stays the default so every existing surface keeps its current
+ * contract. This file checks structure only — whether a declaration *could* be
+ * correct — so it deliberately does not restate the fuller preconditions that
+ * `lisa-remote-dispatch` enforces at the moment it actually dispatches.
+ */
+const SURFACE_BINDINGS = {
+  "claude-web": ["routineId", "fireUrl"],
+};
+
+/**
+ * The fields a surface must record, with the default applied.
+ *
+ * Read through one helper rather than at each call site, because the two
+ * callers answer different questions — "could this declaration be correct" and
+ * "may an automation dispatch to it" — and a fallback that drifted between them
+ * would let those answers disagree about the very same config.
+ * @param {string} surface Surface name.
+ * @returns {string[]} Field names that must be present.
+ */
+function bindingsFor(surface) {
+  return SURFACE_BINDINGS[surface] ?? ["repository"];
+}
 
 /** Install methods the toolchain runner supports. */
 const INSTALL_METHODS = new Set(["release-zip", "npm-global"]);
@@ -139,15 +184,30 @@ export function validateRemoteEnv(remoteEnv) {
   for (const [surface, block] of Object.entries(remoteEnv.surfaces ?? {})) {
     if (!SURFACES.has(surface)) {
       problems.push(`remoteEnv.surfaces has unknown surface "${surface}"`);
+      continue;
     }
-    if (!block.repository) {
-      problems.push(`remoteEnv.surfaces["${surface}"] has no repository`);
+    for (const field of bindingsFor(surface)) {
+      if (!block[field]) {
+        problems.push(`remoteEnv.surfaces["${surface}"] has no ${field}`);
+      }
     }
   }
 
   return problems;
 }
 
+/**
+ * Report whether a surface has been provisioned far enough to dispatch to.
+ * @param {object|undefined} remoteEnv The remote-environment block.
+ * @param {string} surface Surface name.
+ * @returns {boolean} Whether every binding field is recorded.
+ */
+export function isProvisioned(remoteEnv, surface) {
+  const block = remoteEnv?.surfaces?.[surface];
+  if (!block) return false;
+  return bindingsFor(surface).every(field => Boolean(block[field]));
+}
+
 /**
  * Validate the `automations` block against declared surfaces.
  * @param {object|undefined} automations The block, if present.
@@ -173,7 +233,7 @@ export function validateAutomations(automations, remoteEnv) {
       );
       continue;
     }
-    if (!remoteEnv?.surfaces?.[loop.executionEnv]?.repository) {
+    if (!isProvisioned(remoteEnv, loop.executionEnv)) {
       problems.push(
         `automations["${name}"] dispatches to "${loop.executionEnv}", which is ` +
           `not provisioned. Run /lisa:setup:remote-env ${loop.executionEnv} first.`