@codyswann/lisa 2.321.4 → 2.321.5

package/dist/core/upstream-evidence-manifest.js

@@ -550,7 +550,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-sentry-access/SKILL.md": "ecaf49b42bbf399781a3ebd0b1595e5a8ac44422537832e0442b2f184da0c83c",
     "plugins/src/base/skills/lisa-setup-atlassian/SKILL.md": "3820aecb57d184fde1cfa988e7e1402d8f2a766a0b3ffbb576de5a6a72b3d5c5",
     "plugins/src/base/skills/lisa-setup-automations/SKILL.md": "3ad004148a54571a50df90f23abec71e8510ef3ea3562ac812f8e2e11beb157a",
-    "plugins/src/base/skills/lisa-setup-automations/scripts/generate-workflow.mjs": "dd1a0999156bbbaf864fc0f1d85206db5ea2ada172ccac2ee11091303e06ff4d",
+    "plugins/src/base/skills/lisa-setup-automations/scripts/generate-workflow.mjs": "bfb3867cc62dd37d84367859e4d796edb7a0c046595b3e0194ddb0b6d3b63d61",
     "plugins/src/base/skills/lisa-setup-confluence/SKILL.md": "e92d762dbdaeae671c3e52dfe8e10d40a10b606b5e050589181a3898649faedc",
     "plugins/src/base/skills/lisa-setup-github-repo/SKILL.md": "b9b223a5ffad2f88e3fde5831b60fea9bdc2c981750c49d03bb046d43772a0d3",
     "plugins/src/base/skills/lisa-setup-github/SKILL.md": "75435e81130abd21c678d302b7a220da95a19868d122ca93168278628b200666",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.321.4",
+  "version": "2.321.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -41,9 +41,20 @@ export function readAutomation(name, cwd = process.cwd()) {
         `Declare the loop before generating its workflow.`
     );
   }
+  const surface = cfg.remoteEnv?.surfaces?.[loop.executionEnv];
+  const github = cfg.github ?? {};
   return {
     ...loop,
-    repository: cfg.remoteEnv?.surfaces?.[loop.executionEnv]?.repository,
+    // Only used for the fork guard, so it is a question about *this* repository
+    // rather than about the surface. Read from the surface where one records it
+    // — Codex Cloud binds an environment to a repository — and otherwise from
+    // the project's own GitHub config. A Claude cloud environment binds no
+    // repository at all, and demanding one there asked for a field that cannot
+    // exist, which refused to generate a workflow for a correctly configured
+    // loop.
+    repository:
+      surface?.repository ??
+      (github.org && github.repo ? `${github.org}/${github.repo}` : undefined),
     // Where this project keeps its bootstrap. A workstation serving several
     // tenants gives each its own name, so the generated workflow must template
     // it rather than assume the default.
@@ -81,12 +92,28 @@ export function renderWorkflow(name, loop) {
   const bootstrap = loop.bootstrapKey ?? "BWS_ACCESS_TOKEN";
   if (!loop.repository) {
     throw new Error(
-      `automations["${name}"] targets executionEnv "${loop.executionEnv}", ` +
-        `but no remoteEnv.surfaces["${loop.executionEnv}"].repository is set.\n` +
-        `Run /lisa:setup:remote-env ${loop.executionEnv} first.`
+      `cannot determine which repository this loop belongs to.\n` +
+        `The generated workflow guards on it so a fork never dispatches. Set ` +
+        `github.org and github.repo in .lisa.config.json.`
     );
   }
 
+  // Always emitted, even for a surface whose dispatcher token is not consumed
+  // by use. Making it conditional on secrets.rotating would mean a project that
+  // later declares one, without regenerating its workflow, silently loses the
+  // persist step and strands the replacement. One inert step is the cheaper
+  // failure.
+  const rotation = `
+      # The dispatcher authenticates with a credential that rotates on use, so
+      # the replacement must be persisted even when the dispatch itself failed.
+      - name: Persist any credential rotation
+        if: \${{ always() }}
+        env:
+          ${bootstrap}: \${{ secrets.${bootstrap} }}
+        run: |
+          set -euo pipefail
+          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
     : `  # schedule: disabled until the production path is proven once for one\n` +
@@ -149,15 +176,7 @@ jobs:
             'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
             --skill ${loop.skill ?? `lisa-${name}`}
 
-      # The dispatcher authenticates with a credential that rotates on use, so
-      # the replacement must be persisted even when the dispatch itself failed.
-      - name: Persist any credential rotation
-        if: \${{ always() }}
-        env:
-          ${bootstrap}: \${{ secrets.${bootstrap} }}
-        run: |
-          set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases
+${rotation}
 `;
 }