@codyswann/lisa 2.321.1 → 2.321.3

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.321.1",
+  "version": "2.321.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.1",
+  "version": "2.321.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.1",
+  "version": "2.321.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md

@@ -161,6 +161,8 @@ It reads the project's own install command from its lockfile and the bootstrap n
 
 - **`gh` is not pre-installed.** If the project's flows shell out to it, add it to `remoteEnv.tools.install`, pinned and checksummed like anything else.
 - **A proxied credential reads as the literal string `proxy-injected`.** Tools that authenticate through the GitHub proxy work; a script that reads the variable directly gets the placeholder. The read-back asserts this rather than leaving it to be discovered against a live service.
+- **The setup field runs from `$HOME`, not from the checkout.** The emitted setup command starts with `cd <repo-name>` on purpose; without it the package install runs one directory above the clone and cannot find `package.json`.
+- **Trusted network access is not enough for provider CLIs.** Use Custom and include package registries, GitHub, cloud SDK hosts, and the bootstrap credential manager API.
 
 ### One environment per project, pinned locally
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/setup.sh

@@ -13,6 +13,16 @@
 # and emphatically not in a vendor settings field.
 set -euo pipefail
 
+# Claude Code web runs the environment setup field from $HOME, while the
+# checkout lives at $HOME/<repo>. If this installed copy is invoked by absolute
+# path, move back to the repository root before resolving project-local files.
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+case "$script_dir" in
+  */scripts/lisa-remote-env)
+    cd "$script_dir/../.."
+    ;;
+esac
+
 # Node is the one thing that cannot be installed by the installer, since the
 # installer is written in it. Fail with an actionable message rather than a
 # "command not found" forty lines deep.

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -337,11 +337,12 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null, install: string}} options Project details.
+ * @param {{bootstrapKey: string|null, install: string, repoDir?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey, install }) {
+export function emitClaudeWeb({ bootstrapKey, install, repoDir = "lisa" }) {
   const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+  const setup = `cd ${shellQuote(repoDir)} && ${install} && bash scripts/lisa-remote-env/setup.sh`;
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -350,7 +351,8 @@ export function emitClaudeWeb({ bootstrapKey, install }) {
     "",
     "Paste into the environment dialog",
     "---------------------------------",
-    "  Network access:  Trusted, or Custom plus any host your project needs",
+    "  Network access:  Custom plus your package registries, GitHub, cloud SDK",
+    "                   hosts, and the bootstrap credential manager API",
     "",
     "  Environment variables:",
     `    ${key}=<read this from your credential manager>`,
@@ -362,11 +364,13 @@ export function emitClaudeWeb({ bootstrapKey, install }) {
     "    is why exactly one value needs to live here.",
     "",
     "  Setup script:",
-    `    ${install} && bash scripts/lisa-remote-env/setup.sh`,
+    `    ${setup}`,
     "",
-    "    The install must come first. On a fresh container node_modules is the",
-    "    only copy of the Lisa skills present, because Claude receives them as",
-    "    an installed plugin rather than as part of the clone.",
+    `    Claude runs this field from $HOME, while the checkout is $HOME/${repoDir}.`,
+    "    The `cd` must come first, and the install must run before the setup",
+    "    script. On a fresh container node_modules is the only copy of the Lisa",
+    "    skills present, because Claude receives them as an installed plugin",
+    "    rather than as part of the clone.",
     "",
     "Commit to the repository",
     "------------------------",
@@ -467,6 +471,35 @@ export function detectInstallCommand(cwd = process.cwd()) {
   return "<your install command>";
 }
 
+/**
+ * Name the directory Claude creates under $HOME when it clones this repository.
+ *
+ * Claude cloud runs the environment setup field from $HOME, not from the
+ * checkout. The setup line therefore has to `cd` into the clone before running
+ * the project install. Prefer the configured GitHub repo name because it is the
+ * thing Claude clones; fall back to the current directory for non-GitHub tests
+ * and local dry runs.
+ * @param {string} [cwd] Repository root.
+ * @returns {string} Directory name to place after `cd`.
+ */
+export function detectRepositoryDirectory(cwd = process.cwd()) {
+  const path = join(cwd, ".lisa.config.json");
+  if (existsSync(path)) {
+    const repo = JSON.parse(readFileSync(path, "utf8")).github?.repo;
+    if (repo && !repo.includes("/") && !repo.includes("\0")) return repo;
+  }
+  return basename(cwd);
+}
+
+/**
+ * Quote a value for POSIX shell usage.
+ * @param {string} value Raw value.
+ * @returns {string} Single-quoted shell literal.
+ */
+function shellQuote(value) {
+  return "'" + String(value).replaceAll("'", "'\\''") + "'";
+}
+
 /**
  * Read the bootstrap key name, which is the one value the operator must paste.
  * @param {string} [cwd] Repository root.
@@ -519,6 +552,7 @@ async function main() {
       emitClaudeWeb({
         bootstrapKey: readBootstrapKey(),
         install: detectInstallCommand(),
+        repoDir: detectRepositoryDirectory(),
       })
     );
     return;

package/plugins/lisa/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -161,6 +161,8 @@ It reads the project's own install command from its lockfile and the bootstrap n
 
 - **`gh` is not pre-installed.** If the project's flows shell out to it, add it to `remoteEnv.tools.install`, pinned and checksummed like anything else.
 - **A proxied credential reads as the literal string `proxy-injected`.** Tools that authenticate through the GitHub proxy work; a script that reads the variable directly gets the placeholder. The read-back asserts this rather than leaving it to be discovered against a live service.
+- **The setup field runs from `$HOME`, not from the checkout.** The emitted setup command starts with `cd <repo-name>` on purpose; without it the package install runs one directory above the clone and cannot find `package.json`.
+- **Trusted network access is not enough for provider CLIs.** Use Custom and include package registries, GitHub, cloud SDK hosts, and the bootstrap credential manager API.
 
 ### One environment per project, pinned locally
 

package/plugins/lisa/skills/lisa-setup-remote-env/assets/setup.sh

@@ -13,6 +13,16 @@
 # and emphatically not in a vendor settings field.
 set -euo pipefail
 
+# Claude Code web runs the environment setup field from $HOME, while the
+# checkout lives at $HOME/<repo>. If this installed copy is invoked by absolute
+# path, move back to the repository root before resolving project-local files.
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+case "$script_dir" in
+  */scripts/lisa-remote-env)
+    cd "$script_dir/../.."
+    ;;
+esac
+
 # Node is the one thing that cannot be installed by the installer, since the
 # installer is written in it. Fail with an actionable message rather than a
 # "command not found" forty lines deep.

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -337,11 +337,12 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null, install: string}} options Project details.
+ * @param {{bootstrapKey: string|null, install: string, repoDir?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey, install }) {
+export function emitClaudeWeb({ bootstrapKey, install, repoDir = "lisa" }) {
   const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+  const setup = `cd ${shellQuote(repoDir)} && ${install} && bash scripts/lisa-remote-env/setup.sh`;
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -350,7 +351,8 @@ export function emitClaudeWeb({ bootstrapKey, install }) {
     "",
     "Paste into the environment dialog",
     "---------------------------------",
-    "  Network access:  Trusted, or Custom plus any host your project needs",
+    "  Network access:  Custom plus your package registries, GitHub, cloud SDK",
+    "                   hosts, and the bootstrap credential manager API",
     "",
     "  Environment variables:",
     `    ${key}=<read this from your credential manager>`,
@@ -362,11 +364,13 @@ export function emitClaudeWeb({ bootstrapKey, install }) {
     "    is why exactly one value needs to live here.",
     "",
     "  Setup script:",
-    `    ${install} && bash scripts/lisa-remote-env/setup.sh`,
+    `    ${setup}`,
     "",
-    "    The install must come first. On a fresh container node_modules is the",
-    "    only copy of the Lisa skills present, because Claude receives them as",
-    "    an installed plugin rather than as part of the clone.",
+    `    Claude runs this field from $HOME, while the checkout is $HOME/${repoDir}.`,
+    "    The `cd` must come first, and the install must run before the setup",
+    "    script. On a fresh container node_modules is the only copy of the Lisa",
+    "    skills present, because Claude receives them as an installed plugin",
+    "    rather than as part of the clone.",
     "",
     "Commit to the repository",
     "------------------------",
@@ -467,6 +471,35 @@ export function detectInstallCommand(cwd = process.cwd()) {
   return "<your install command>";
 }
 
+/**
+ * Name the directory Claude creates under $HOME when it clones this repository.
+ *
+ * Claude cloud runs the environment setup field from $HOME, not from the
+ * checkout. The setup line therefore has to `cd` into the clone before running
+ * the project install. Prefer the configured GitHub repo name because it is the
+ * thing Claude clones; fall back to the current directory for non-GitHub tests
+ * and local dry runs.
+ * @param {string} [cwd] Repository root.
+ * @returns {string} Directory name to place after `cd`.
+ */
+export function detectRepositoryDirectory(cwd = process.cwd()) {
+  const path = join(cwd, ".lisa.config.json");
+  if (existsSync(path)) {
+    const repo = JSON.parse(readFileSync(path, "utf8")).github?.repo;
+    if (repo && !repo.includes("/") && !repo.includes("\0")) return repo;
+  }
+  return basename(cwd);
+}
+
+/**
+ * Quote a value for POSIX shell usage.
+ * @param {string} value Raw value.
+ * @returns {string} Single-quoted shell literal.
+ */
+function shellQuote(value) {
+  return "'" + String(value).replaceAll("'", "'\\''") + "'";
+}
+
 /**
  * Read the bootstrap key name, which is the one value the operator must paste.
  * @param {string} [cwd] Repository root.
@@ -519,6 +552,7 @@ async function main() {
       emitClaudeWeb({
         bootstrapKey: readBootstrapKey(),
         install: detectInstallCommand(),
+        repoDir: detectRepositoryDirectory(),
       })
     );
     return;

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.1",
+  "version": "2.321.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md

@@ -161,6 +161,8 @@ It reads the project's own install command from its lockfile and the bootstrap n
 
 - **`gh` is not pre-installed.** If the project's flows shell out to it, add it to `remoteEnv.tools.install`, pinned and checksummed like anything else.
 - **A proxied credential reads as the literal string `proxy-injected`.** Tools that authenticate through the GitHub proxy work; a script that reads the variable directly gets the placeholder. The read-back asserts this rather than leaving it to be discovered against a live service.
+- **The setup field runs from `$HOME`, not from the checkout.** The emitted setup command starts with `cd <repo-name>` on purpose; without it the package install runs one directory above the clone and cannot find `package.json`.
+- **Trusted network access is not enough for provider CLIs.** Use Custom and include package registries, GitHub, cloud SDK hosts, and the bootstrap credential manager API.
 
 ### One environment per project, pinned locally
 

package/plugins/lisa-agy/skills/lisa-setup-remote-env/assets/setup.sh

@@ -13,6 +13,16 @@
 # and emphatically not in a vendor settings field.
 set -euo pipefail
 
+# Claude Code web runs the environment setup field from $HOME, while the
+# checkout lives at $HOME/<repo>. If this installed copy is invoked by absolute
+# path, move back to the repository root before resolving project-local files.
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+case "$script_dir" in
+  */scripts/lisa-remote-env)
+    cd "$script_dir/../.."
+    ;;
+esac
+
 # Node is the one thing that cannot be installed by the installer, since the
 # installer is written in it. Fail with an actionable message rather than a
 # "command not found" forty lines deep.