@codyswann/lisa 2.324.1 → 2.325.0

package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -221,8 +221,9 @@ function installTool(tool, binDir) {
  * @param {boolean} dryRun Whether to plan only.
  * @returns {Array<object>} The plan that was applied.
  */
-function applyToolchain(tools, dryRun) {
-  const plan = planToolchain(tools, probe);
+function applyToolchain(tools, dryRun, options = {}) {
+  const { surface = "remote", consent = true } = options;
+  const plan = planToolchain(tools, probe, surface);
   const blocked = plan.filter(
     p => p.action === "missing" || p.action === "invalid"
   );
@@ -234,6 +235,34 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing is a different act on a laptop than in a container. A container
+  // is disposable and provisioning it silently is the whole point; a developer
+  // machine belongs to a person, and putting pinned binaries in their
+  // ~/.local/bin without being asked is not ours to decide. So the same
+  // manifest drives both, and only the consent differs.
+  //
+  // Reporting still happens either way — knowing the machine diverges from what
+  // the project declares is most of the value, and is what nothing did before.
+  if (!consent) {
+    const missing = plan.filter(step => step.action === "install");
+    if (missing.length === 0) {
+      console.log("  every declared tool is already present");
+      return plan;
+    }
+    console.log(
+      `  ${missing.length} declared tool(s) are missing or below their pin:`
+    );
+    for (const step of missing) {
+      const tool = byName.get(step.name);
+      console.log(`    ${step.name}${tool?.version ? ` ${tool.version}` : ""}`);
+    }
+    console.log(
+      "\n  Not installing without confirmation. Re-run with --install-tools\n" +
+        "  to provision them, or install them yourself."
+    );
+    return plan;
+  }
+
   // Installing a binary somewhere nothing looks is the same as not installing
   // it. `~/.local/bin` is on PATH by default on a developer workstation and is
   // NOT on a minimal container, so the toolchain step reported `install bws`,
@@ -526,6 +555,40 @@ export function emitClaudeWeb({ bootstrapKey }) {
   ].join("\n");
 }
 
+/**
+ * Report tooling the project appears to need but has not declared.
+ *
+ * Called before the toolchain is applied, because the manifest is the only
+ * thing that puts a binary on PATH and nothing populates it — so provisioning
+ * "the declared toolchain" happily succeeds while the tool a project actually
+ * uses is absent, and fails later at the moment of use instead of here.
+ *
+ * Informational, never blocking. The detector proposes and a human decides, so
+ * an undeclared tool must not stop a setup that was asked to provision what IS
+ * declared; failing here would make a advisory signal into a gate nobody chose.
+ * Its own absence is silent for the same reason: an older installed copy of the
+ * skills has no detector, and that is not a reason to refuse to provision.
+ * @param {Function} [exec] Seam for tests.
+ */
+function reportUndeclaredTooling(exec = execFileSync) {
+  let script;
+  try {
+    script = siblingScript("lisa-detect-tooling", "detect-tooling.mjs");
+  } catch {
+    return;
+  }
+  try {
+    const out = exec("node", [script], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const text = String(out).trim();
+    if (text) console.log(`\n${text}\n`);
+  } catch {
+    // A detector that cannot run is a missing hint, not a failed setup.
+  }
+}
+
 /**
  * Decide which phases this invocation runs.
  *
@@ -640,8 +703,16 @@ async function main() {
   }
 
   if (phases.includes("toolchain")) {
+    reportUndeclaredTooling();
     console.log("Toolchain:");
-    applyToolchain(cfg.tools, dryRun);
+    // A remote container consents by construction: it is disposable, nobody is
+    // watching, and provisioning it is why the script exists. Locally the
+    // operator opts in per run.
+    const remote = Boolean(materializeAt);
+    applyToolchain(cfg.tools, dryRun, {
+      surface: remote ? "remote" : "local",
+      consent: remote || process.argv.includes("--install-tools"),
+    });
   }
 
   if (phases.includes("secrets")) {

package/plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs

@@ -124,18 +124,65 @@ function planInstallable(tool, found) {
   };
 }
 
+/** Surfaces a manifest entry may name. */
+const KNOWN_SURFACES = new Set(["local", "remote"]);
+
+/**
+ * Whether a manifest entry applies to the surface being provisioned.
+ *
+ * One declaration per tool, not one block per surface. Most tools a project
+ * needs are needed *everywhere* — a Maestro or Sonar CLI is as required on a
+ * laptop as in a container — and duplicated blocks drift, which this repository
+ * has paid for more than once. What actually differs between surfaces is the
+ * install method and, more importantly, consent: a disposable container may
+ * install silently, a developer's machine may not.
+ *
+ * Omitting `surfaces` means every surface, because that is true of most tools
+ * and the failure of forgetting it should be "checked somewhere unnecessary"
+ * rather than "silently absent where it was needed".
+ * @param {object} tool Manifest entry.
+ * @param {string} surface Surface being provisioned.
+ * @returns {boolean} Whether this entry applies.
+ */
+export function appliesToSurface(tool, surface) {
+  const surfaces = tool.surfaces;
+  if (surfaces === undefined) return true;
+  // A typo must not silently widen scope. Treating any non-array as "omitted"
+  // meant `surfaces: "remote"` — an easy thing to write — quietly applied the
+  // entry to every surface, which for a platform-specific archive means
+  // offering a Linux binary to a laptop. Absent means everywhere; malformed
+  // means stop.
+  if (!Array.isArray(surfaces)) {
+    throw new Error(
+      `${tool.name}: surfaces must be an array, got ${typeof surfaces}.\n` +
+        `Omit it to mean every surface; write ["remote"] or ["local"] to narrow.`
+    );
+  }
+  if (surfaces.length === 0) return true;
+  const unknown = surfaces.filter(entry => !KNOWN_SURFACES.has(entry));
+  if (unknown.length > 0) {
+    throw new Error(
+      `${tool.name}: unknown surface(s) ${unknown.join(", ")}.\n` +
+        `Known: ${[...KNOWN_SURFACES].join(", ")}.`
+    );
+  }
+  return surfaces.includes(surface);
+}
+
 /**
  * Produce the complete plan for a toolchain manifest.
  * @param {{require?: object[], install?: object[]}} tools Manifest.
  * @param {(name: string) => {version: string|null, present: boolean}} probe Version probe.
  * @returns {Array<{name: string, action: string, reason: string}>} Ordered decisions.
  */
-export function planToolchain(tools, probe) {
+export function planToolchain(tools, probe, surface = "remote") {
   const plan = [];
   for (const tool of tools.require ?? [])
-    plan.push(planRequired(tool, probe(tool.name)));
+    if (appliesToSurface(tool, surface))
+      plan.push(planRequired(tool, probe(tool.name)));
   for (const tool of tools.install ?? [])
-    plan.push(planInstallable(tool, probe(tool.name)));
+    if (appliesToSurface(tool, surface))
+      plan.push(planInstallable(tool, probe(tool.name)));
   return plan;
 }