@codyswann/lisa 2.325.2 → 2.325.4

package/dist/core/upstream-evidence-manifest.js

@@ -425,7 +425,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-debrief/SKILL.md": "47e4cda36b07994ff47ab15fb04a17dd6b0c310ad804f9cae9d69637edaaa72a",
     "plugins/src/base/skills/lisa-delivery-effectiveness/SKILL.md": "21bc55fa0e86a9694bd22269fd089dbfae0c54c199262f46a4955447acea0f35",
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "1778a009d06099b3bd2d9a33b37bec34836b295e21fad220ae926491d3557208",
-    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "ccbd2cf7251e792467ca74c664088a22b1c50ead579ad2279a55daa5d0ba0693",
+    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "05e0c4808e64fbdc277419ad00b6a68da96766a9261a5b97f3a4961bbab107c4",
     "plugins/src/base/skills/lisa-doctor/SKILL.md": "fb41a1e63c5332d47a46e715aff52551f3df867033b5e4f37dfaeee30019b891",
     "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "c78ae2ba32c830d0b2cd7d24de91adf99e2b3cef4c7cab1c417580d86f41351f",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",
@@ -568,7 +568,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
     "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "77a537460aaa1a7f9da74128161d24fa3bf758ae1fec6f6dcbc47bde9f078750",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
-    "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c04afb1cf8e14a2713645228e679fa7772559488330a240ec0297cae6afd03e2",
+    "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "eb8017ee2eef5b5b166908e5c2fccf493af283b0a40717688033d65263cf35ce",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "341e8058e1d20e7e52276007aae9ceda1504b995615cf8421c9494b60b550ef9",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "82bc2a27a0a5afb2ff413a88365c619fd7f0eaada5de3ccabf2000938f0607a4",
@@ -998,7 +998,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lisa-github-repo-setup.sh": "dc2f1c9d718aa34ba57161120d9319b5f78fe6b0b496d8e3c77226a08795aa36",
     "scripts/lisa-github-rulesets.sh": "920a43ba268421b6fe55096062bd85850468bee9389f6006ad7c671010e7cccb",
     "scripts/lisa-remote-env/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
-    "scripts/lisa-remote-env/setup.sh": "c04afb1cf8e14a2713645228e679fa7772559488330a240ec0297cae6afd03e2",
+    "scripts/lisa-remote-env/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "scripts/lisa-update-local.sh": "c811f9e10dbcb38499a9791c1ae9051460b347051d04a1d2046925bab9a53c96",
     "scripts/lisa-work-item.mjs": "51081847e980f314a764c2e50a7a121b1ced9ef4b980f33898057de4c7b852e6",
     "scripts/migrate-deploy-order.sh": "77d909b4cbbfc05169a79168d7868600ea7f56f846feefb7d5121618c54800c3",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/plugins/lisa/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/lisa/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/lisa-agy/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.325.2",
+  "version": "2.325.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -205,8 +205,16 @@ export function toolsFromSecretNotes(notes) {
  */
 export function toolsFromQuality(config) {
   const found = new Map();
-  if (config?.quality?.e2eCoverage?.playwright) {
-    found.set("playwright", "quality.e2eCoverage.playwright is configured");
+  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
+  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
+  // repository — produced no signal at all, so the one tool that genuinely
+  // needs a pinned binary and genuinely was not declared stayed invisible to
+  // the detector built to find it. A gate that reports "nothing outstanding"
+  // while the gap is right there is worse than no gate.
+  for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
+    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
+      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
+    }
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -238,6 +246,32 @@ export function declaredTools(config, surface = "remote") {
   );
 }
 
+/**
+ * Whether a tool already reaches this project as an npm dependency.
+ *
+ * A package that declares `@playwright/test` gets the `playwright` binary in
+ * `node_modules/.bin`, and its npm scripts resolve it from there. It never
+ * needs to be on PATH, so proposing a manifest entry for it is noise — and
+ * noise is how a detector teaches people to skim it, which is the one failure
+ * this skill's own documentation warns about.
+ *
+ * Only the CLI is covered by this. Anything else the tool needs at runtime —
+ * Playwright's browsers, for instance — is a separate concern that a package
+ * manager does not solve and this function does not claim to.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} tool Tool name.
+ * @returns {boolean} Whether npm already provides the binary.
+ */
+export function satisfiedByNpm(pkg, tool) {
+  const viaNpm = KNOWN_TOOLS[tool]?.viaNpm;
+  if (!viaNpm) return false;
+  const declared = {
+    ...(pkg?.dependencies ?? {}),
+    ...(pkg?.devDependencies ?? {}),
+  };
+  return Object.hasOwn(declared, viaNpm);
+}
+
 /**
  * Collect every signal and subtract what the manifest already covers.
  * @param {string} [cwd] Project root.
@@ -261,6 +295,8 @@ export function detectTooling(cwd = process.cwd()) {
   for (const signal of signals) {
     for (const [tool, evidence] of signal) {
       if (declared.has(tool)) continue;
+      // Already provided by the package manager, so there is nothing to pin.
+      if (satisfiedByNpm(pkg, tool)) continue;
       const entry = merged.get(tool) ?? { evidence: [] };
       entry.evidence.push(evidence);
       merged.set(tool, entry);

package/plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.

package/scripts/lisa-remote-env/setup.sh

@@ -49,7 +49,7 @@ fi
 #
 # Skipped when node_modules already exists, which is what makes this cheap on a
 # resumed container and correct to run twice.
-if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
+if [ ! -d node_modules ]; then
   if [ -f bun.lock ] || [ -f bun.lockb ]; then install_cmd="bun install"
   elif [ -f pnpm-lock.yaml ]; then install_cmd="pnpm install --frozen-lockfile"
   elif [ -f yarn.lock ]; then
@@ -83,7 +83,20 @@ if [ "${LISA_SKIP_INSTALL:-}" != "1" ] && [ ! -d node_modules ]; then
     # Without it the bug is cache-dependent, not deterministic: a fresh
     # container installs and dirties the tree, a resumed one skips the install
     # and succeeds. That reads as flakiness rather than a cause.
-    CI=1 $install_cmd
+    # LISA_SKIP_INSTALL suppresses the INSTALL, not the decision. It used to
+    # gate the whole block, so the only way to observe which package manager
+    # was chosen was to actually run it — which is why a test asserting the
+    # choice ran `yarn install` against a fabricated lockfile, passing on a
+    # machine without yarn and doing a real network install on one with it.
+    #
+    # Reporting the choice and skipping the work is also the more useful
+    # behaviour for a caller that installed already: it still says what it
+    # would have done.
+    if [ "${LISA_SKIP_INSTALL:-}" = "1" ]; then
+      echo "  LISA_SKIP_INSTALL=1 — not running it."
+    else
+      CI=1 $install_cmd
+    fi
   else
     # Not fatal on its own. A project may carry no lockfile and still have the
     # skill in a checkout directory, so let the resolver below decide.