@codyswann/lisa 2.331.0 → 2.331.2

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/SKILL.md

@@ -137,6 +137,7 @@ than stopping.
 - **Install a credential manager you did not pick.**
 - **Reinstall over a tool that is already there**, whatever installed it.
 - **Install anything without `--install`.**
-- **Install `agy`.** Antigravity publishes no headless installer; it is reported as manual
-  with a pointer, because "not installed" and "cannot be installed by this tool" are
-  different answers to the operator.
+- **Install a tool whose vendor publishes no headless installer.** Such an entry is
+  reported as manual with a pointer, because "not installed" and "cannot be installed by
+  this tool" are different answers to the operator. No agent is currently in that state —
+  Antigravity was listed there in error and does publish a bootstrapper.

package/plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/catalogue.mjs

@@ -66,11 +66,13 @@ export const AGENTS = [
   {
     name: "agy",
     label: "Antigravity",
-    kind: "manual",
-    // No headless installer published. Reported as absent with a pointer
-    // rather than silently skipped, because "not installed" and "cannot be
-    // installed by this tool" are different answers to the operator.
-    note: "no headless installer published; install from the vendor",
+    kind: "vendor-script",
+    // Google does publish a headless bootstrapper; this entry previously said
+    // otherwise and reported the agent as uninstallable. Confirmed live —
+    // `content-type: application/x-sh`, and the payload is a bash script that
+    // downloads and verifies the flat native build.
+    script: "https://antigravity.google/cli/install.sh",
+    selfUpdates: true,
   },
   {
     name: "copilot",

package/plugins/lisa/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa/skills/lisa-setup-workstation/SKILL.md

@@ -137,6 +137,7 @@ than stopping.
 - **Install a credential manager you did not pick.**
 - **Reinstall over a tool that is already there**, whatever installed it.
 - **Install anything without `--install`.**
-- **Install `agy`.** Antigravity publishes no headless installer; it is reported as manual
-  with a pointer, because "not installed" and "cannot be installed by this tool" are
-  different answers to the operator.
+- **Install a tool whose vendor publishes no headless installer.** Such an entry is
+  reported as manual with a pointer, because "not installed" and "cannot be installed by
+  this tool" are different answers to the operator. No agent is currently in that state —
+  Antigravity was listed there in error and does publish a bootstrapper.

package/plugins/lisa/skills/lisa-setup-workstation/scripts/catalogue.mjs

@@ -66,11 +66,13 @@ export const AGENTS = [
   {
     name: "agy",
     label: "Antigravity",
-    kind: "manual",
-    // No headless installer published. Reported as absent with a pointer
-    // rather than silently skipped, because "not installed" and "cannot be
-    // installed by this tool" are different answers to the operator.
-    note: "no headless installer published; install from the vendor",
+    kind: "vendor-script",
+    // Google does publish a headless bootstrapper; this entry previously said
+    // otherwise and reported the agent as uninstallable. Confirmed live —
+    // `content-type: application/x-sh`, and the payload is a bash script that
+    // downloads and verifies the flat native build.
+    script: "https://antigravity.google/cli/install.sh",
+    selfUpdates: true,
   },
   {
     name: "copilot",

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-agy/skills/lisa-setup-workstation/SKILL.md

@@ -137,6 +137,7 @@ than stopping.
 - **Install a credential manager you did not pick.**
 - **Reinstall over a tool that is already there**, whatever installed it.
 - **Install anything without `--install`.**
-- **Install `agy`.** Antigravity publishes no headless installer; it is reported as manual
-  with a pointer, because "not installed" and "cannot be installed by this tool" are
-  different answers to the operator.
+- **Install a tool whose vendor publishes no headless installer.** Such an entry is
+  reported as manual with a pointer, because "not installed" and "cannot be installed by
+  this tool" are different answers to the operator. No agent is currently in that state —
+  Antigravity was listed there in error and does publish a bootstrapper.

package/plugins/lisa-agy/skills/lisa-setup-workstation/scripts/catalogue.mjs

@@ -66,11 +66,13 @@ export const AGENTS = [
   {
     name: "agy",
     label: "Antigravity",
-    kind: "manual",
-    // No headless installer published. Reported as absent with a pointer
-    // rather than silently skipped, because "not installed" and "cannot be
-    // installed by this tool" are different answers to the operator.
-    note: "no headless installer published; install from the vendor",
+    kind: "vendor-script",
+    // Google does publish a headless bootstrapper; this entry previously said
+    // otherwise and reported the agent as uninstallable. Confirmed live —
+    // `content-type: application/x-sh`, and the payload is a bash script that
+    // downloads and verifies the flat native build.
+    script: "https://antigravity.google/cli/install.sh",
+    selfUpdates: true,
   },
   {
     name: "copilot",

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-copilot/skills/lisa-setup-workstation/SKILL.md

@@ -137,6 +137,7 @@ than stopping.
 - **Install a credential manager you did not pick.**
 - **Reinstall over a tool that is already there**, whatever installed it.
 - **Install anything without `--install`.**
-- **Install `agy`.** Antigravity publishes no headless installer; it is reported as manual
-  with a pointer, because "not installed" and "cannot be installed by this tool" are
-  different answers to the operator.
+- **Install a tool whose vendor publishes no headless installer.** Such an entry is
+  reported as manual with a pointer, because "not installed" and "cannot be installed by
+  this tool" are different answers to the operator. No agent is currently in that state —
+  Antigravity was listed there in error and does publish a bootstrapper.

package/plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/catalogue.mjs

@@ -66,11 +66,13 @@ export const AGENTS = [
   {
     name: "agy",
     label: "Antigravity",
-    kind: "manual",
-    // No headless installer published. Reported as absent with a pointer
-    // rather than silently skipped, because "not installed" and "cannot be
-    // installed by this tool" are different answers to the operator.
-    note: "no headless installer published; install from the vendor",
+    kind: "vendor-script",
+    // Google does publish a headless bootstrapper; this entry previously said
+    // otherwise and reported the agent as uninstallable. Confirmed live —
+    // `content-type: application/x-sh`, and the payload is a bash script that
+    // downloads and verifies the flat native build.
+    script: "https://antigravity.google/cli/install.sh",
+    selfUpdates: true,
   },
   {
     name: "copilot",

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.0",
+  "version": "2.331.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-cursor/skills/lisa-setup-workstation/SKILL.md

@@ -137,6 +137,7 @@ than stopping.
 - **Install a credential manager you did not pick.**
 - **Reinstall over a tool that is already there**, whatever installed it.
 - **Install anything without `--install`.**
-- **Install `agy`.** Antigravity publishes no headless installer; it is reported as manual
-  with a pointer, because "not installed" and "cannot be installed by this tool" are
-  different answers to the operator.
+- **Install a tool whose vendor publishes no headless installer.** Such an entry is
+  reported as manual with a pointer, because "not installed" and "cannot be installed by
+  this tool" are different answers to the operator. No agent is currently in that state —
+  Antigravity was listed there in error and does publish a bootstrapper.