@codyswann/lisa 2.322.1 → 2.322.3

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -62,6 +62,51 @@ export function readAutomation(name, cwd = process.cwd()) {
   };
 }
 
+/**
+ * Emit shell that locates a Lisa skill script before running it.
+ *
+ * A hardcoded `.claude/skills/...` path is wrong in exactly the place this
+ * workflow runs. Claude and Codex receive Lisa skills as an installed plugin
+ * living in the user's home directory, which is emphatically not part of a
+ * clone — and a scheduled run is always a fresh clone with no plugin install.
+ * So the one path that reliably exists on a runner is the npm package, at the
+ * version the project pins, which is the version its automation should run.
+ *
+ * The same candidate list the remote-env entrypoint uses, for the same reason:
+ * the in-checkout copies are cheapest and need nothing installed, and
+ * `node_modules` is the fallback that makes the plugin-delivered harnesses work
+ * at all.
+ * @param {string} skill Skill slug that owns the script.
+ * @param {string} script Script filename.
+ * @param {string[]} args Arguments appended to the invocation, one per line.
+ * @returns {string} Shell, indented for a workflow `run:` block.
+ */
+function runSkillScript(skill, script, args) {
+  const candidates = [
+    `.claude/skills/${skill}/scripts/${script}`,
+    `.agents/skills/${skill}/scripts/${script}`,
+    `.codex/skills/${skill}/scripts/${script}`,
+    `node_modules/@codyswann/lisa/plugins/lisa/skills/${skill}/scripts/${script}`,
+  ]
+    .map(candidate => `            "${candidate}"`)
+    .join(" \\\n");
+  const tail = args.map(arg => `            ${arg}`).join(" \\\n");
+  return `          runner=""
+          for candidate in \\
+${candidates}; do
+            if [ -f "$candidate" ]; then runner="$candidate"; break; fi
+          done
+          if [ -z "$runner" ]; then
+            echo "cannot find ${skill}/scripts/${script}" >&2
+            echo "Checked the agent skill directories and node_modules." >&2
+            echo "Lisa skills reach Claude and Codex as an installed plugin," >&2
+            echo "so node_modules is the only copy a runner ever has." >&2
+            exit 1
+          fi
+          node "$runner" \\
+${tail}`;
+}
+
 /**
  * Render the workflow YAML for one loop.
  *
@@ -112,7 +157,7 @@ export function renderWorkflow(name, loop) {
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+${runSkillScript("lisa-secrets-access", "rotate-secret.mjs", ["leases"])}`;
 
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
@@ -172,9 +217,10 @@ jobs:
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-remote-dispatch/scripts/dispatch.mjs \\
-            'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
-            --skill ${loop.skill ?? `lisa-${name}`}
+${runSkillScript("lisa-remote-dispatch", "dispatch.mjs", [
+  `'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}'`,
+  `--skill ${loop.skill ?? `lisa-${name}`}`,
+])}
 
 ${rotation}
 `;

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -299,18 +299,29 @@ export function installAssets(cwd = process.cwd()) {
 }
 
 /**
- * The setup field, identical for every project.
+ * The setup field, identical for every project and every surface.
  *
- * Names neither the repository nor its package manager. Claude Code web runs
- * this field from `$HOME` while the checkout sits one level down, so the glob
- * locates the script; the script then anchors itself on the repository root and
- * installs dependencies from whichever lockfile the project commits.
+ * Names neither the repository nor its package manager, and deliberately not
+ * `$HOME` either: the surfaces disagree about where the field runs. Codex Cloud
+ * runs it inside the checkout, Claude Code web runs it from `$HOME` with the
+ * checkout one level down, and on Codex Cloud the checkout is not under `$HOME`
+ * at all — so a `$HOME` glob matched nothing there and bash was handed a path
+ * still containing a literal asterisk.
  *
- * A field that named both was a string a human had to get right, in a settings
- * box with no review, no version history and no test — and the logic it encoded
- * belongs in a file that has all three.
+ * Both candidates are therefore tried relative to cwd. `exec` on the first hit
+ * avoids a subshell and avoids parsing `ls`; the explicit `exit 1` means a
+ * missing entrypoint says so rather than the field quietly succeeding. The
+ * script then anchors itself on the repository root and installs dependencies
+ * from whichever lockfile the project commits.
+ *
+ * A field that named the repository and package manager was a string a human
+ * had to get right, in a settings box with no review, no version history and no
+ * test — and the logic it encoded belongs in a file that has all three.
  */
-const SETUP_FIELD = `bash "$HOME"/*/scripts/lisa-remote-env/setup.sh`;
+export const SETUP_FIELD =
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] && exec bash "$f"; done; ' +
+  'echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1';
 
 /**
  * The settings block that wires the session-start hook into a repository.

package/plugins/lisa/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -62,6 +62,51 @@ export function readAutomation(name, cwd = process.cwd()) {
   };
 }
 
+/**
+ * Emit shell that locates a Lisa skill script before running it.
+ *
+ * A hardcoded `.claude/skills/...` path is wrong in exactly the place this
+ * workflow runs. Claude and Codex receive Lisa skills as an installed plugin
+ * living in the user's home directory, which is emphatically not part of a
+ * clone — and a scheduled run is always a fresh clone with no plugin install.
+ * So the one path that reliably exists on a runner is the npm package, at the
+ * version the project pins, which is the version its automation should run.
+ *
+ * The same candidate list the remote-env entrypoint uses, for the same reason:
+ * the in-checkout copies are cheapest and need nothing installed, and
+ * `node_modules` is the fallback that makes the plugin-delivered harnesses work
+ * at all.
+ * @param {string} skill Skill slug that owns the script.
+ * @param {string} script Script filename.
+ * @param {string[]} args Arguments appended to the invocation, one per line.
+ * @returns {string} Shell, indented for a workflow `run:` block.
+ */
+function runSkillScript(skill, script, args) {
+  const candidates = [
+    `.claude/skills/${skill}/scripts/${script}`,
+    `.agents/skills/${skill}/scripts/${script}`,
+    `.codex/skills/${skill}/scripts/${script}`,
+    `node_modules/@codyswann/lisa/plugins/lisa/skills/${skill}/scripts/${script}`,
+  ]
+    .map(candidate => `            "${candidate}"`)
+    .join(" \\\n");
+  const tail = args.map(arg => `            ${arg}`).join(" \\\n");
+  return `          runner=""
+          for candidate in \\
+${candidates}; do
+            if [ -f "$candidate" ]; then runner="$candidate"; break; fi
+          done
+          if [ -z "$runner" ]; then
+            echo "cannot find ${skill}/scripts/${script}" >&2
+            echo "Checked the agent skill directories and node_modules." >&2
+            echo "Lisa skills reach Claude and Codex as an installed plugin," >&2
+            echo "so node_modules is the only copy a runner ever has." >&2
+            exit 1
+          fi
+          node "$runner" \\
+${tail}`;
+}
+
 /**
  * Render the workflow YAML for one loop.
  *
@@ -112,7 +157,7 @@ export function renderWorkflow(name, loop) {
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+${runSkillScript("lisa-secrets-access", "rotate-secret.mjs", ["leases"])}`;
 
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
@@ -172,9 +217,10 @@ jobs:
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-remote-dispatch/scripts/dispatch.mjs \\
-            'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
-            --skill ${loop.skill ?? `lisa-${name}`}
+${runSkillScript("lisa-remote-dispatch", "dispatch.mjs", [
+  `'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}'`,
+  `--skill ${loop.skill ?? `lisa-${name}`}`,
+])}
 
 ${rotation}
 `;

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -299,18 +299,29 @@ export function installAssets(cwd = process.cwd()) {
 }
 
 /**
- * The setup field, identical for every project.
+ * The setup field, identical for every project and every surface.
  *
- * Names neither the repository nor its package manager. Claude Code web runs
- * this field from `$HOME` while the checkout sits one level down, so the glob
- * locates the script; the script then anchors itself on the repository root and
- * installs dependencies from whichever lockfile the project commits.
+ * Names neither the repository nor its package manager, and deliberately not
+ * `$HOME` either: the surfaces disagree about where the field runs. Codex Cloud
+ * runs it inside the checkout, Claude Code web runs it from `$HOME` with the
+ * checkout one level down, and on Codex Cloud the checkout is not under `$HOME`
+ * at all — so a `$HOME` glob matched nothing there and bash was handed a path
+ * still containing a literal asterisk.
  *
- * A field that named both was a string a human had to get right, in a settings
- * box with no review, no version history and no test — and the logic it encoded
- * belongs in a file that has all three.
+ * Both candidates are therefore tried relative to cwd. `exec` on the first hit
+ * avoids a subshell and avoids parsing `ls`; the explicit `exit 1` means a
+ * missing entrypoint says so rather than the field quietly succeeding. The
+ * script then anchors itself on the repository root and installs dependencies
+ * from whichever lockfile the project commits.
+ *
+ * A field that named the repository and package manager was a string a human
+ * had to get right, in a settings box with no review, no version history and no
+ * test — and the logic it encoded belongs in a file that has all three.
  */
-const SETUP_FIELD = `bash "$HOME"/*/scripts/lisa-remote-env/setup.sh`;
+export const SETUP_FIELD =
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] && exec bash "$f"; done; ' +
+  'echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1';
 
 /**
  * The settings block that wires the session-start hook into a repository.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -62,6 +62,51 @@ export function readAutomation(name, cwd = process.cwd()) {
   };
 }
 
+/**
+ * Emit shell that locates a Lisa skill script before running it.
+ *
+ * A hardcoded `.claude/skills/...` path is wrong in exactly the place this
+ * workflow runs. Claude and Codex receive Lisa skills as an installed plugin
+ * living in the user's home directory, which is emphatically not part of a
+ * clone — and a scheduled run is always a fresh clone with no plugin install.
+ * So the one path that reliably exists on a runner is the npm package, at the
+ * version the project pins, which is the version its automation should run.
+ *
+ * The same candidate list the remote-env entrypoint uses, for the same reason:
+ * the in-checkout copies are cheapest and need nothing installed, and
+ * `node_modules` is the fallback that makes the plugin-delivered harnesses work
+ * at all.
+ * @param {string} skill Skill slug that owns the script.
+ * @param {string} script Script filename.
+ * @param {string[]} args Arguments appended to the invocation, one per line.
+ * @returns {string} Shell, indented for a workflow `run:` block.
+ */
+function runSkillScript(skill, script, args) {
+  const candidates = [
+    `.claude/skills/${skill}/scripts/${script}`,
+    `.agents/skills/${skill}/scripts/${script}`,
+    `.codex/skills/${skill}/scripts/${script}`,
+    `node_modules/@codyswann/lisa/plugins/lisa/skills/${skill}/scripts/${script}`,
+  ]
+    .map(candidate => `            "${candidate}"`)
+    .join(" \\\n");
+  const tail = args.map(arg => `            ${arg}`).join(" \\\n");
+  return `          runner=""
+          for candidate in \\
+${candidates}; do
+            if [ -f "$candidate" ]; then runner="$candidate"; break; fi
+          done
+          if [ -z "$runner" ]; then
+            echo "cannot find ${skill}/scripts/${script}" >&2
+            echo "Checked the agent skill directories and node_modules." >&2
+            echo "Lisa skills reach Claude and Codex as an installed plugin," >&2
+            echo "so node_modules is the only copy a runner ever has." >&2
+            exit 1
+          fi
+          node "$runner" \\
+${tail}`;
+}
+
 /**
  * Render the workflow YAML for one loop.
  *
@@ -112,7 +157,7 @@ export function renderWorkflow(name, loop) {
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+${runSkillScript("lisa-secrets-access", "rotate-secret.mjs", ["leases"])}`;
 
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
@@ -172,9 +217,10 @@ jobs:
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-remote-dispatch/scripts/dispatch.mjs \\
-            'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
-            --skill ${loop.skill ?? `lisa-${name}`}
+${runSkillScript("lisa-remote-dispatch", "dispatch.mjs", [
+  `'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}'`,
+  `--skill ${loop.skill ?? `lisa-${name}`}`,
+])}
 
 ${rotation}
 `;

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -299,18 +299,29 @@ export function installAssets(cwd = process.cwd()) {
 }
 
 /**
- * The setup field, identical for every project.
+ * The setup field, identical for every project and every surface.
  *
- * Names neither the repository nor its package manager. Claude Code web runs
- * this field from `$HOME` while the checkout sits one level down, so the glob
- * locates the script; the script then anchors itself on the repository root and
- * installs dependencies from whichever lockfile the project commits.
+ * Names neither the repository nor its package manager, and deliberately not
+ * `$HOME` either: the surfaces disagree about where the field runs. Codex Cloud
+ * runs it inside the checkout, Claude Code web runs it from `$HOME` with the
+ * checkout one level down, and on Codex Cloud the checkout is not under `$HOME`
+ * at all — so a `$HOME` glob matched nothing there and bash was handed a path
+ * still containing a literal asterisk.
  *
- * A field that named both was a string a human had to get right, in a settings
- * box with no review, no version history and no test — and the logic it encoded
- * belongs in a file that has all three.
+ * Both candidates are therefore tried relative to cwd. `exec` on the first hit
+ * avoids a subshell and avoids parsing `ls`; the explicit `exit 1` means a
+ * missing entrypoint says so rather than the field quietly succeeding. The
+ * script then anchors itself on the repository root and installs dependencies
+ * from whichever lockfile the project commits.
+ *
+ * A field that named the repository and package manager was a string a human
+ * had to get right, in a settings box with no review, no version history and no
+ * test — and the logic it encoded belongs in a file that has all three.
  */
-const SETUP_FIELD = `bash "$HOME"/*/scripts/lisa-remote-env/setup.sh`;
+export const SETUP_FIELD =
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] && exec bash "$f"; done; ' +
+  'echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1';
 
 /**
  * The settings block that wires the session-start hook into a repository.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -62,6 +62,51 @@ export function readAutomation(name, cwd = process.cwd()) {
   };
 }
 
+/**
+ * Emit shell that locates a Lisa skill script before running it.
+ *
+ * A hardcoded `.claude/skills/...` path is wrong in exactly the place this
+ * workflow runs. Claude and Codex receive Lisa skills as an installed plugin
+ * living in the user's home directory, which is emphatically not part of a
+ * clone — and a scheduled run is always a fresh clone with no plugin install.
+ * So the one path that reliably exists on a runner is the npm package, at the
+ * version the project pins, which is the version its automation should run.
+ *
+ * The same candidate list the remote-env entrypoint uses, for the same reason:
+ * the in-checkout copies are cheapest and need nothing installed, and
+ * `node_modules` is the fallback that makes the plugin-delivered harnesses work
+ * at all.
+ * @param {string} skill Skill slug that owns the script.
+ * @param {string} script Script filename.
+ * @param {string[]} args Arguments appended to the invocation, one per line.
+ * @returns {string} Shell, indented for a workflow `run:` block.
+ */
+function runSkillScript(skill, script, args) {
+  const candidates = [
+    `.claude/skills/${skill}/scripts/${script}`,
+    `.agents/skills/${skill}/scripts/${script}`,
+    `.codex/skills/${skill}/scripts/${script}`,
+    `node_modules/@codyswann/lisa/plugins/lisa/skills/${skill}/scripts/${script}`,
+  ]
+    .map(candidate => `            "${candidate}"`)
+    .join(" \\\n");
+  const tail = args.map(arg => `            ${arg}`).join(" \\\n");
+  return `          runner=""
+          for candidate in \\
+${candidates}; do
+            if [ -f "$candidate" ]; then runner="$candidate"; break; fi
+          done
+          if [ -z "$runner" ]; then
+            echo "cannot find ${skill}/scripts/${script}" >&2
+            echo "Checked the agent skill directories and node_modules." >&2
+            echo "Lisa skills reach Claude and Codex as an installed plugin," >&2
+            echo "so node_modules is the only copy a runner ever has." >&2
+            exit 1
+          fi
+          node "$runner" \\
+${tail}`;
+}
+
 /**
  * Render the workflow YAML for one loop.
  *
@@ -112,7 +157,7 @@ export function renderWorkflow(name, loop) {
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+${runSkillScript("lisa-secrets-access", "rotate-secret.mjs", ["leases"])}`;
 
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
@@ -172,9 +217,10 @@ jobs:
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-remote-dispatch/scripts/dispatch.mjs \\
-            'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
-            --skill ${loop.skill ?? `lisa-${name}`}
+${runSkillScript("lisa-remote-dispatch", "dispatch.mjs", [
+  `'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}'`,
+  `--skill ${loop.skill ?? `lisa-${name}`}`,
+])}
 
 ${rotation}
 `;

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -299,18 +299,29 @@ export function installAssets(cwd = process.cwd()) {
 }
 
 /**
- * The setup field, identical for every project.
+ * The setup field, identical for every project and every surface.
  *
- * Names neither the repository nor its package manager. Claude Code web runs
- * this field from `$HOME` while the checkout sits one level down, so the glob
- * locates the script; the script then anchors itself on the repository root and
- * installs dependencies from whichever lockfile the project commits.
+ * Names neither the repository nor its package manager, and deliberately not
+ * `$HOME` either: the surfaces disagree about where the field runs. Codex Cloud
+ * runs it inside the checkout, Claude Code web runs it from `$HOME` with the
+ * checkout one level down, and on Codex Cloud the checkout is not under `$HOME`
+ * at all — so a `$HOME` glob matched nothing there and bash was handed a path
+ * still containing a literal asterisk.
  *
- * A field that named both was a string a human had to get right, in a settings
- * box with no review, no version history and no test — and the logic it encoded
- * belongs in a file that has all three.
+ * Both candidates are therefore tried relative to cwd. `exec` on the first hit
+ * avoids a subshell and avoids parsing `ls`; the explicit `exit 1` means a
+ * missing entrypoint says so rather than the field quietly succeeding. The
+ * script then anchors itself on the repository root and installs dependencies
+ * from whichever lockfile the project commits.
+ *
+ * A field that named the repository and package manager was a string a human
+ * had to get right, in a settings box with no review, no version history and no
+ * test — and the logic it encoded belongs in a file that has all three.
  */
-const SETUP_FIELD = `bash "$HOME"/*/scripts/lisa-remote-env/setup.sh`;
+export const SETUP_FIELD =
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] && exec bash "$f"; done; ' +
+  'echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1';
 
 /**
  * The settings block that wires the session-start hook into a repository.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.1",
+  "version": "2.322.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-setup-automations/scripts/generate-workflow.mjs

@@ -62,6 +62,51 @@ export function readAutomation(name, cwd = process.cwd()) {
   };
 }
 
+/**
+ * Emit shell that locates a Lisa skill script before running it.
+ *
+ * A hardcoded `.claude/skills/...` path is wrong in exactly the place this
+ * workflow runs. Claude and Codex receive Lisa skills as an installed plugin
+ * living in the user's home directory, which is emphatically not part of a
+ * clone — and a scheduled run is always a fresh clone with no plugin install.
+ * So the one path that reliably exists on a runner is the npm package, at the
+ * version the project pins, which is the version its automation should run.
+ *
+ * The same candidate list the remote-env entrypoint uses, for the same reason:
+ * the in-checkout copies are cheapest and need nothing installed, and
+ * `node_modules` is the fallback that makes the plugin-delivered harnesses work
+ * at all.
+ * @param {string} skill Skill slug that owns the script.
+ * @param {string} script Script filename.
+ * @param {string[]} args Arguments appended to the invocation, one per line.
+ * @returns {string} Shell, indented for a workflow `run:` block.
+ */
+function runSkillScript(skill, script, args) {
+  const candidates = [
+    `.claude/skills/${skill}/scripts/${script}`,
+    `.agents/skills/${skill}/scripts/${script}`,
+    `.codex/skills/${skill}/scripts/${script}`,
+    `node_modules/@codyswann/lisa/plugins/lisa/skills/${skill}/scripts/${script}`,
+  ]
+    .map(candidate => `            "${candidate}"`)
+    .join(" \\\n");
+  const tail = args.map(arg => `            ${arg}`).join(" \\\n");
+  return `          runner=""
+          for candidate in \\
+${candidates}; do
+            if [ -f "$candidate" ]; then runner="$candidate"; break; fi
+          done
+          if [ -z "$runner" ]; then
+            echo "cannot find ${skill}/scripts/${script}" >&2
+            echo "Checked the agent skill directories and node_modules." >&2
+            echo "Lisa skills reach Claude and Codex as an installed plugin," >&2
+            echo "so node_modules is the only copy a runner ever has." >&2
+            exit 1
+          fi
+          node "$runner" \\
+${tail}`;
+}
+
 /**
  * Render the workflow YAML for one loop.
  *
@@ -112,7 +157,7 @@ export function renderWorkflow(name, loop) {
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-secrets-access/scripts/rotate-secret.mjs leases`;
+${runSkillScript("lisa-secrets-access", "rotate-secret.mjs", ["leases"])}`;
 
   const trigger = loop.enabled
     ? `  schedule:\n    - cron: '${loop.schedule}'\n  workflow_dispatch:`
@@ -172,9 +217,10 @@ jobs:
           ${bootstrap}: \${{ secrets.${bootstrap} }}
         run: |
           set -euo pipefail
-          node .claude/skills/lisa-remote-dispatch/scripts/dispatch.mjs \\
-            'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}' \\
-            --skill ${loop.skill ?? `lisa-${name}`}
+${runSkillScript("lisa-remote-dispatch", "dispatch.mjs", [
+  `'executionEnv=${loop.executionEnv} ${loop.payload ?? ""}'`,
+  `--skill ${loop.skill ?? `lisa-${name}`}`,
+])}
 
 ${rotation}
 `;