@codyswann/lisa 2.321.3 → 2.321.5

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.3",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"