@codyswann/lisa 2.322.4 → 2.322.6

package/dist/core/upstream-evidence-manifest.js

@@ -526,8 +526,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-qa-queue/SKILL.md": "1d5f009f60004bf75b5d79bca370096ce40e1d41d585dc8afd4389f21bba84ae",
     "plugins/src/base/skills/lisa-quality-review/SKILL.md": "17ba45f4c4b7877c0b0c9a3c1cc1cb9e18c642ead74ff7263698d8034d3241da",
     "plugins/src/base/skills/lisa-queue-status/SKILL.md": "87c6d34d0511d4afd812d1af3fee80fa3b7aa47db8449760b12f2699fedc1d78",
-    "plugins/src/base/skills/lisa-remote-dispatch/SKILL.md": "2cc999d2c3b61b10aabb849e0833fd58edb444c5013c05108dd58e5d7d60c4ba",
-    "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "c473e8eddf0fd5f220a5ea7ff9eb92f5482cfb2893e77edce59acc36671418a3",
+    "plugins/src/base/skills/lisa-remote-dispatch/SKILL.md": "f3c48120a206d01db45f849ca5b61690d572abc16bc36d559a4cacc8f9422c06",
+    "plugins/src/base/skills/lisa-remote-dispatch/scripts/dispatch.mjs": "475963ed64d9e72a6cbd6cbb61c8b57a419f2e1805e3ddfa76066047c590deeb",
     "plugins/src/base/skills/lisa-repair-intake/SKILL.md": "4f85ac1381631e9f250d9cf3239baba633ae0df9ba1959f8835ed662592e2d77",
     "plugins/src/base/skills/lisa-reproduce-bug/SKILL.md": "4d460993fac6021219ca23eee29b1b9afa7c37479dddc662b2fcfaca510edd68",
     "plugins/src/base/skills/lisa-research/SKILL.md": "19de7c5910b117c4b3b1bb7ae42cf9c8b6ff2a376b2e21961526bc7ebde18e85",
@@ -559,10 +559,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-linear/SKILL.md": "ec76f832a6df6f58b163f7f5ba6826ed2fcbddc91e44a8372e874858e4d0c518",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "f5a1e9290789fd1c33675168d30461fb24a11c98a433ef777c1f536bc2f905ef",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
-    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "4fe124678cfc2b37188370af3b4e16895fcbad4d4b6f13b0fc7ac02bd99b0d26",
+    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "f706b5c94267d128bf41ef1a5fa6b68ea184e22c7929bda126128f08e1728b86",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "6e3871ec2f8d56b8ebb85376ebdd3956f3ed8fa4f7b278c2ed90ca9b8845897c",
-    "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "7f7cf8a2248dbaa31f2f039fdaf147d083427a21633f7cf06ad612f38344d6c1",
-    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "e8f1e74dd29104dc880eb2540024549d18d2a9c958b2b6fce0610ab0afd55cbb",
+    "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c04afb1cf8e14a2713645228e679fa7772559488330a240ec0297cae6afd03e2",
+    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "f468dcf72512ff0b7d0d0ff6a38e81e5b57d83361ffff45c5265147f67ca01df",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "ff66d33ba41a068d09be18f81ac68988238c2afa1d4e3733ae906b73eea74324",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "82bc2a27a0a5afb2ff413a88365c619fd7f0eaada5de3ccabf2000938f0607a4",
     "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "53fbd8acce4b5e47e88195a7b90d5be424fa6ef7ad872f52c50467c690664c3b",
@@ -990,7 +990,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lisa-github-repo-setup.sh": "dc2f1c9d718aa34ba57161120d9319b5f78fe6b0b496d8e3c77226a08795aa36",
     "scripts/lisa-github-rulesets.sh": "920a43ba268421b6fe55096062bd85850468bee9389f6006ad7c671010e7cccb",
     "scripts/lisa-remote-env/session-start.sh": "6e3871ec2f8d56b8ebb85376ebdd3956f3ed8fa4f7b278c2ed90ca9b8845897c",
-    "scripts/lisa-remote-env/setup.sh": "7f7cf8a2248dbaa31f2f039fdaf147d083427a21633f7cf06ad612f38344d6c1",
+    "scripts/lisa-remote-env/setup.sh": "c04afb1cf8e14a2713645228e679fa7772559488330a240ec0297cae6afd03e2",
     "scripts/lisa-update-local.sh": "c811f9e10dbcb38499a9791c1ae9051460b347051d04a1d2046925bab9a53c96",
     "scripts/lisa-work-item.mjs": "acb359ed7a39150fd5e1e68f4c95144045e75d9d53b735da4a7a9271f063044e",
     "scripts/migrate-deploy-order.sh": "77d909b4cbbfc05169a79168d7868600ea7f56f846feefb7d5121618c54800c3",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.322.4",
+  "version": "2.322.6",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.4",
+  "version": "2.322.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.4",
+  "version": "2.322.6",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-remote-dispatch/SKILL.md

@@ -16,9 +16,12 @@ It changes **where** work happens and nothing about **what** happens. The remote
 | --- | --- |
 | omitted / `local` | The calling skill proceeds normally. Nothing is dispatched. |
 | `codex-cloud` | Submit to the project's Codex Cloud environment and return. |
+| `claude-web` | Fire the project's Claude routine, which starts a cloud session, and return. |
 
 Any other value is **rejected explicitly**. A silently ignored `executionEnv` would run the work locally while the operator believes it went remote, and nothing downstream would contradict that belief.
 
+For the same reason, the parameter is accepted as both `executionEnv=…` and `--executionEnv=…`, and a *dashed* parameter this skill does not recognise is an error rather than payload. The bare form is the documented one, but the dashed form is what anyone who has used a CLI will type, and a misspelling of either is indistinguishable from not asking at all — which is the one failure an operator cannot act on. A bare `key=value` still belongs to the payload, since prose may legitimately contain an equals sign.
+
 If a behaviour must differ between local and remote, it belongs in the calling skill as an explicit branch — never here. The moment this file starts encoding domain behaviour, there are two implementations to keep in sync.
 
 ## The invocation stays thin

package/plugins/lisa/.codex-plugin/skills/lisa-remote-dispatch/scripts/dispatch.mjs

@@ -68,11 +68,25 @@ const LEDGER = join(".lisa", "remote-dispatch.json");
 /** This file's directory, for locating the sibling secrets skill. */
 const HERE = dirname(fileURLToPath(import.meta.url));
 
+/** Every parameter this program reads. Anything else is a typo. */
+const KNOWN_PARAMS = new Set(["executionEnv"]);
+
 /**
  * Split `key=value` parameters from the rest of an invocation.
  *
  * The remainder is passed through untouched. It is the caller's payload — a
  * ticket key, a description — and this program has no business interpreting it.
+ *
+ * A leading `--` is accepted and stripped. The bare form is the documented one,
+ * but `--executionEnv=claude-web` is what anyone who has used a CLI this decade
+ * types, and it previously fell through to the payload and left the surface at
+ * its default. That is precisely the outcome this skill says it exists to
+ * prevent: work runs locally while the operator believes it went remote, and
+ * nothing downstream contradicts them.
+ *
+ * An unrecognised parameter is rejected for the same reason. A misspelled
+ * `executionEnvv=claude-web` is indistinguishable from not asking at all, and
+ * silence is the one response that cannot be acted on.
  * @param {string} input Raw argument string.
  * @returns {{params: Record<string, string>, rest: string}} Parsed invocation.
  */
@@ -83,9 +97,19 @@ export function parseInvocation(input) {
     .trim()
     .split(/\s+/)
     .filter(Boolean)) {
-    const match = /^([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
-    if (match) params[match[1]] = match[2];
-    else rest.push(token);
+    const match = /^(--)?([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
+    // Only a dashed token is required to be a known parameter. A bare `x=y` may
+    // legitimately be part of a payload — a description, a query — and this
+    // program has no business rejecting the caller's prose.
+    if (match && (match[1] || KNOWN_PARAMS.has(match[2]))) {
+      if (!KNOWN_PARAMS.has(match[2])) {
+        throw new Error(
+          `unknown parameter "${match[2]}".\n` +
+            `Supported: ${[...KNOWN_PARAMS].join(", ")}.`
+        );
+      }
+      params[match[2]] = match[3];
+    } else rest.push(token);
   }
   return { params, rest: rest.join(" ") };
 }

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md

@@ -13,8 +13,8 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-maintenance: n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 
 **That line is identical for every project AND every surface.** Nothing in it names the
@@ -164,8 +164,8 @@ When emitting, produce exactly:
 ```text
 Environment name:  <project> remote executor
 Repository:        <org>/<repo>        (must be the default checkout)
-Setup script:      n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-Maintenance:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+Setup script:      n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+Maintenance:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
                    (identical for every project — the script finds the
                    checkout and installs from the committed lockfile)
 Environment vars:  LISA_SECRETS_SURFACE=codex-cloud

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/setup.sh

@@ -105,11 +105,21 @@ fi
 # plugin-delivered harnesses work at all. Lisa is a dependency of every project
 # it is applied to, so `node_modules` carries the same skill at the version that
 # project pins, which is the version its setup should run.
+#
+# `plugins/lisa/skills/` sits between them, and exists for exactly one project:
+# Lisa itself. There the checkout IS Lisa, at HEAD, while `node_modules` holds
+# whatever version its own lockfile pins — which was four months and a hundred
+# skills behind, so this file did not exist there at all and setup aborted
+# claiming the skill could not be found. The one place it was is the only place
+# that was not searched. It is ahead of node_modules because a checkout that
+# builds this skill is newer than any published copy of it, and harmless
+# everywhere else because no other project has that directory.
 runner=""
 for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then
     runner="$candidate"
@@ -132,6 +142,18 @@ if [ -z "$runner" ]; then
   echo >&2
   echo "If dependencies are installed, run 'lisa apply' so the skills are" >&2
   echo "present, then re-run setup." >&2
+  echo >&2
+  # The version actually resolved, because "not found" and "found, but too old
+  # to contain this skill" read identically above and are fixed differently.
+  # The second is what happened on Lisa itself: node_modules held a release
+  # from before this skill existed, so every path checked was legitimately
+  # absent and the message blamed the install.
+  if [ -f node_modules/@codyswann/lisa/package.json ]; then
+    echo "For reference, node_modules has @codyswann/lisa version:" >&2
+    node -p "require('./node_modules/@codyswann/lisa/package.json').version" >&2 2>/dev/null ||
+      echo "  (unreadable)" >&2
+    echo "If that predates this skill, the pin is the problem, not the install." >&2
+  fi
   exit 1
 fi
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -308,28 +308,44 @@ export function installAssets(cwd = process.cwd()) {
  * at all — so a `$HOME` glob matched nothing there and bash was handed a path
  * still containing a literal asterisk.
  *
- * Both candidates are therefore tried relative to cwd, and EVERY match is
- * prepared rather than the first. A Claude Code web environment can hold more
- * than one checkout, so stopping at the first hit would prepare whichever
- * repository sorts first and silently ignore the rest — arbitrary rather than
- * merely limited. Each script anchors itself on its own repository root and
- * each project materializes under its own `secrets.namespace`, so preparing
- * several is well defined rather than a collision.
+ * Candidates are therefore tried relative to cwd first, then under `$HOME` and
+ * `/workspace` — the container roots the two surfaces actually use — because
+ * cwd is not reliably either of them. A Claude environment reported `$HOME` as
+ * `/root` with no checkout beneath it, which a cwd-only search cannot reach.
+ *
+ * EVERY match is prepared rather than the first. A Claude Code web environment
+ * can hold more than one checkout, so stopping at the first hit would prepare
+ * whichever repository sorts first and silently ignore the rest — arbitrary
+ * rather than merely limited. Each script anchors itself on its own repository
+ * root and each project materializes under its own `secrets.namespace`, so
+ * preparing several is well defined rather than a collision. Matches are
+ * deduplicated by resolved directory, since the candidate globs overlap
+ * whenever cwd happens to be one of the roots.
  *
  * The status is the first failure and every checkout is still attempted: one
  * broken repository must neither hide the others nor report success. The
  * explicit `exit 1` on no matches matters because a `for` loop over a glob that
  * matches nothing otherwise exits 0 — the quiet success this guards against.
  *
+ * Failure prints the layout it found rather than only the path it wanted. This
+ * field lives in a vendor settings box with a slow edit-and-retry loop, and a
+ * miss that reports nothing costs a whole round trip to learn one fact; the
+ * listing means the next message names the layout instead of repeating it.
+ *
  * A field that named the repository and package manager was a string a human
  * had to get right, in a settings box with no review, no version history and no
  * test — and the logic it encoded belongs in a file that has all three.
  */
 export const SETUP_FIELD =
-  "n=0; rc=0; " +
-  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
-  'do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; ' +
-  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; ' +
+  'n=0; rc=0; seen=""; ' +
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh " +
+  '"$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh ' +
+  "/workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
+  'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
+  'n=$((n+1)); bash "$f" || rc=$?; done; ' +
+  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. ' +
+  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
   'exit "$rc"';
 
 /**

package/plugins/lisa/skills/lisa-remote-dispatch/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-remote-dispatch
-description: "Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly."
+description: "Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud or claude-web today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -16,9 +16,12 @@ It changes **where** work happens and nothing about **what** happens. The remote
 | --- | --- |
 | omitted / `local` | The calling skill proceeds normally. Nothing is dispatched. |
 | `codex-cloud` | Submit to the project's Codex Cloud environment and return. |
+| `claude-web` | Fire the project's Claude routine, which starts a cloud session, and return. |
 
 Any other value is **rejected explicitly**. A silently ignored `executionEnv` would run the work locally while the operator believes it went remote, and nothing downstream would contradict that belief.
 
+For the same reason, the parameter is accepted as both `executionEnv=…` and `--executionEnv=…`, and a *dashed* parameter this skill does not recognise is an error rather than payload. The bare form is the documented one, but the dashed form is what anyone who has used a CLI will type, and a misspelling of either is indistinguishable from not asking at all — which is the one failure an operator cannot act on. A bare `key=value` still belongs to the payload, since prose may legitimately contain an equals sign.
+
 If a behaviour must differ between local and remote, it belongs in the calling skill as an explicit branch — never here. The moment this file starts encoding domain behaviour, there are two implementations to keep in sync.
 
 ## The invocation stays thin

package/plugins/lisa/skills/lisa-remote-dispatch/scripts/dispatch.mjs

@@ -68,11 +68,25 @@ const LEDGER = join(".lisa", "remote-dispatch.json");
 /** This file's directory, for locating the sibling secrets skill. */
 const HERE = dirname(fileURLToPath(import.meta.url));
 
+/** Every parameter this program reads. Anything else is a typo. */
+const KNOWN_PARAMS = new Set(["executionEnv"]);
+
 /**
  * Split `key=value` parameters from the rest of an invocation.
  *
  * The remainder is passed through untouched. It is the caller's payload — a
  * ticket key, a description — and this program has no business interpreting it.
+ *
+ * A leading `--` is accepted and stripped. The bare form is the documented one,
+ * but `--executionEnv=claude-web` is what anyone who has used a CLI this decade
+ * types, and it previously fell through to the payload and left the surface at
+ * its default. That is precisely the outcome this skill says it exists to
+ * prevent: work runs locally while the operator believes it went remote, and
+ * nothing downstream contradicts them.
+ *
+ * An unrecognised parameter is rejected for the same reason. A misspelled
+ * `executionEnvv=claude-web` is indistinguishable from not asking at all, and
+ * silence is the one response that cannot be acted on.
  * @param {string} input Raw argument string.
  * @returns {{params: Record<string, string>, rest: string}} Parsed invocation.
  */
@@ -83,9 +97,19 @@ export function parseInvocation(input) {
     .trim()
     .split(/\s+/)
     .filter(Boolean)) {
-    const match = /^([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
-    if (match) params[match[1]] = match[2];
-    else rest.push(token);
+    const match = /^(--)?([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
+    // Only a dashed token is required to be a known parameter. A bare `x=y` may
+    // legitimately be part of a payload — a description, a query — and this
+    // program has no business rejecting the caller's prose.
+    if (match && (match[1] || KNOWN_PARAMS.has(match[2]))) {
+      if (!KNOWN_PARAMS.has(match[2])) {
+        throw new Error(
+          `unknown parameter "${match[2]}".\n` +
+            `Supported: ${[...KNOWN_PARAMS].join(", ")}.`
+        );
+      }
+      params[match[2]] = match[3];
+    } else rest.push(token);
   }
   return { params, rest: rest.join(" ") };
 }

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -13,8 +13,8 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-maintenance: n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 
 **That line is identical for every project AND every surface.** Nothing in it names the
@@ -164,8 +164,8 @@ When emitting, produce exactly:
 ```text
 Environment name:  <project> remote executor
 Repository:        <org>/<repo>        (must be the default checkout)
-Setup script:      n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-Maintenance:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+Setup script:      n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+Maintenance:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
                    (identical for every project — the script finds the
                    checkout and installs from the committed lockfile)
 Environment vars:  LISA_SECRETS_SURFACE=codex-cloud

package/plugins/lisa/skills/lisa-setup-remote-env/assets/setup.sh

@@ -105,11 +105,21 @@ fi
 # plugin-delivered harnesses work at all. Lisa is a dependency of every project
 # it is applied to, so `node_modules` carries the same skill at the version that
 # project pins, which is the version its setup should run.
+#
+# `plugins/lisa/skills/` sits between them, and exists for exactly one project:
+# Lisa itself. There the checkout IS Lisa, at HEAD, while `node_modules` holds
+# whatever version its own lockfile pins — which was four months and a hundred
+# skills behind, so this file did not exist there at all and setup aborted
+# claiming the skill could not be found. The one place it was is the only place
+# that was not searched. It is ahead of node_modules because a checkout that
+# builds this skill is newer than any published copy of it, and harmless
+# everywhere else because no other project has that directory.
 runner=""
 for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then
     runner="$candidate"
@@ -132,6 +142,18 @@ if [ -z "$runner" ]; then
   echo >&2
   echo "If dependencies are installed, run 'lisa apply' so the skills are" >&2
   echo "present, then re-run setup." >&2
+  echo >&2
+  # The version actually resolved, because "not found" and "found, but too old
+  # to contain this skill" read identically above and are fixed differently.
+  # The second is what happened on Lisa itself: node_modules held a release
+  # from before this skill existed, so every path checked was legitimately
+  # absent and the message blamed the install.
+  if [ -f node_modules/@codyswann/lisa/package.json ]; then
+    echo "For reference, node_modules has @codyswann/lisa version:" >&2
+    node -p "require('./node_modules/@codyswann/lisa/package.json').version" >&2 2>/dev/null ||
+      echo "  (unreadable)" >&2
+    echo "If that predates this skill, the pin is the problem, not the install." >&2
+  fi
   exit 1
 fi
 

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -308,28 +308,44 @@ export function installAssets(cwd = process.cwd()) {
  * at all — so a `$HOME` glob matched nothing there and bash was handed a path
  * still containing a literal asterisk.
  *
- * Both candidates are therefore tried relative to cwd, and EVERY match is
- * prepared rather than the first. A Claude Code web environment can hold more
- * than one checkout, so stopping at the first hit would prepare whichever
- * repository sorts first and silently ignore the rest — arbitrary rather than
- * merely limited. Each script anchors itself on its own repository root and
- * each project materializes under its own `secrets.namespace`, so preparing
- * several is well defined rather than a collision.
+ * Candidates are therefore tried relative to cwd first, then under `$HOME` and
+ * `/workspace` — the container roots the two surfaces actually use — because
+ * cwd is not reliably either of them. A Claude environment reported `$HOME` as
+ * `/root` with no checkout beneath it, which a cwd-only search cannot reach.
+ *
+ * EVERY match is prepared rather than the first. A Claude Code web environment
+ * can hold more than one checkout, so stopping at the first hit would prepare
+ * whichever repository sorts first and silently ignore the rest — arbitrary
+ * rather than merely limited. Each script anchors itself on its own repository
+ * root and each project materializes under its own `secrets.namespace`, so
+ * preparing several is well defined rather than a collision. Matches are
+ * deduplicated by resolved directory, since the candidate globs overlap
+ * whenever cwd happens to be one of the roots.
  *
  * The status is the first failure and every checkout is still attempted: one
  * broken repository must neither hide the others nor report success. The
  * explicit `exit 1` on no matches matters because a `for` loop over a glob that
  * matches nothing otherwise exits 0 — the quiet success this guards against.
  *
+ * Failure prints the layout it found rather than only the path it wanted. This
+ * field lives in a vendor settings box with a slow edit-and-retry loop, and a
+ * miss that reports nothing costs a whole round trip to learn one fact; the
+ * listing means the next message names the layout instead of repeating it.
+ *
  * A field that named the repository and package manager was a string a human
  * had to get right, in a settings box with no review, no version history and no
  * test — and the logic it encoded belongs in a file that has all three.
  */
 export const SETUP_FIELD =
-  "n=0; rc=0; " +
-  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; " +
-  'do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; ' +
-  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; ' +
+  'n=0; rc=0; seen=""; ' +
+  "for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh " +
+  '"$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh ' +
+  "/workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; " +
+  'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
+  'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
+  'n=$((n+1)); bash "$f" || rc=$?; done; ' +
+  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. ' +
+  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
   'exit "$rc"';
 
 /**

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.322.4",
+  "version": "2.322.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-remote-dispatch/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lisa-remote-dispatch
-description: "Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly."
+description: "Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud or claude-web today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly."
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
@@ -16,9 +16,12 @@ It changes **where** work happens and nothing about **what** happens. The remote
 | --- | --- |
 | omitted / `local` | The calling skill proceeds normally. Nothing is dispatched. |
 | `codex-cloud` | Submit to the project's Codex Cloud environment and return. |
+| `claude-web` | Fire the project's Claude routine, which starts a cloud session, and return. |
 
 Any other value is **rejected explicitly**. A silently ignored `executionEnv` would run the work locally while the operator believes it went remote, and nothing downstream would contradict that belief.
 
+For the same reason, the parameter is accepted as both `executionEnv=…` and `--executionEnv=…`, and a *dashed* parameter this skill does not recognise is an error rather than payload. The bare form is the documented one, but the dashed form is what anyone who has used a CLI will type, and a misspelling of either is indistinguishable from not asking at all — which is the one failure an operator cannot act on. A bare `key=value` still belongs to the payload, since prose may legitimately contain an equals sign.
+
 If a behaviour must differ between local and remote, it belongs in the calling skill as an explicit branch — never here. The moment this file starts encoding domain behaviour, there are two implementations to keep in sync.
 
 ## The invocation stays thin

package/plugins/lisa-agy/skills/lisa-remote-dispatch/scripts/dispatch.mjs

@@ -68,11 +68,25 @@ const LEDGER = join(".lisa", "remote-dispatch.json");
 /** This file's directory, for locating the sibling secrets skill. */
 const HERE = dirname(fileURLToPath(import.meta.url));
 
+/** Every parameter this program reads. Anything else is a typo. */
+const KNOWN_PARAMS = new Set(["executionEnv"]);
+
 /**
  * Split `key=value` parameters from the rest of an invocation.
  *
  * The remainder is passed through untouched. It is the caller's payload — a
  * ticket key, a description — and this program has no business interpreting it.
+ *
+ * A leading `--` is accepted and stripped. The bare form is the documented one,
+ * but `--executionEnv=claude-web` is what anyone who has used a CLI this decade
+ * types, and it previously fell through to the payload and left the surface at
+ * its default. That is precisely the outcome this skill says it exists to
+ * prevent: work runs locally while the operator believes it went remote, and
+ * nothing downstream contradicts them.
+ *
+ * An unrecognised parameter is rejected for the same reason. A misspelled
+ * `executionEnvv=claude-web` is indistinguishable from not asking at all, and
+ * silence is the one response that cannot be acted on.
  * @param {string} input Raw argument string.
  * @returns {{params: Record<string, string>, rest: string}} Parsed invocation.
  */
@@ -83,9 +97,19 @@ export function parseInvocation(input) {
     .trim()
     .split(/\s+/)
     .filter(Boolean)) {
-    const match = /^([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
-    if (match) params[match[1]] = match[2];
-    else rest.push(token);
+    const match = /^(--)?([A-Za-z][A-Za-z0-9_]*)=(.*)$/.exec(token);
+    // Only a dashed token is required to be a known parameter. A bare `x=y` may
+    // legitimately be part of a payload — a description, a query — and this
+    // program has no business rejecting the caller's prose.
+    if (match && (match[1] || KNOWN_PARAMS.has(match[2]))) {
+      if (!KNOWN_PARAMS.has(match[2])) {
+        throw new Error(
+          `unknown parameter "${match[2]}".\n` +
+            `Supported: ${[...KNOWN_PARAMS].join(", ")}.`
+        );
+      }
+      params[match[2]] = match[3];
+    } else rest.push(token);
   }
   return { params, rest: rest.join(" ") };
 }

package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md

@@ -13,8 +13,8 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-maintenance: n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 
 **That line is identical for every project AND every surface.** Nothing in it names the
@@ -164,8 +164,8 @@ When emitting, produce exactly:
 ```text
 Environment name:  <project> remote executor
 Repository:        <org>/<repo>        (must be the default checkout)
-Setup script:      n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
-Maintenance:       n=0; rc=0; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found under $PWD" >&2; exit 1; }; exit "$rc"
+Setup script:      n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+Maintenance:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
                    (identical for every project — the script finds the
                    checkout and installs from the committed lockfile)
 Environment vars:  LISA_SECRETS_SURFACE=codex-cloud