@codyswann/lisa 2.331.1 → 2.331.3

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs

@@ -0,0 +1,102 @@
+/**
+ * Turn the AWS bootstrap bundle into environment variables the AWS SDKs obey.
+ *
+ * `LISA_AWS_BOOTSTRAP_JSON` carries the agent's AWS identity as one JSON blob.
+ * Materializing it verbatim is not enough, because nothing reads that name:
+ * every AWS SDK and the CLI look for `AWS_ACCESS_KEY_ID` and
+ * `AWS_SECRET_ACCESS_KEY`, or for a profile.
+ *
+ * Writing profiles alone is also not enough, and that is the failure this
+ * module exists for. A Claude cloud container ships its own
+ * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` in the ambient environment, and
+ * **environment variables outrank profile files in the credential chain**. So a
+ * session with correctly written `~/.aws/credentials` still failed:
+ *
+ *     aws sts get-caller-identity
+ *     InvalidClientTokenId: The security token included in the request is invalid.
+ *
+ * Deriving the pair into the materialized env file fixes it, because that file
+ * is sourced into the session and the last export wins. Exporting over a
+ * variable this project did not set is a real intrusion, so it is deliberate,
+ * narrow, and never silent:
+ *
+ *   - only when the bundle actually parses and carries both halves
+ *   - never over a value the secret store itself supplies under those names,
+ *     which is a project stating an explicit intent
+ *   - recorded in the notes file, so the override is discoverable by the same
+ *     read-the-note path as any other credential
+ * @module aws-bootstrap
+ */
+
+/** The names every AWS SDK and the CLI actually read. */
+const ACCESS_KEY = "AWS_ACCESS_KEY_ID";
+const SECRET_KEY = "AWS_SECRET_ACCESS_KEY";
+const REGION = "AWS_DEFAULT_REGION";
+
+/** The bundle that carries the agent's identity. */
+export const BOOTSTRAP_KEY = "LISA_AWS_BOOTSTRAP_JSON";
+
+/**
+ * Read the bootstrap bundle, treating anything malformed as absent.
+ *
+ * A parse failure must not take materialization down with it: every other
+ * secret in the run is still valid and still needed, and a session with most of
+ * its credentials beats a session with none.
+ * @param {string} raw Bundle contents.
+ * @returns {object|null} Parsed bundle, or null.
+ */
+export function parseBootstrap(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Derive the AWS variables implied by an already-selected secret set.
+ *
+ * Returns only additions; the caller merges. Nothing here mutates its input,
+ * so a caller can decide what to do with the result — including reporting it.
+ * @param {Map<string, {value: string}>} selected Secrets by exact name.
+ * @returns {Map<string, {value: string, note: string}>} Derived variables.
+ */
+export function deriveAwsEnvironment(selected) {
+  const derived = new Map();
+  const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
+  if (!bundle) return derived;
+
+  const accessKeyId = bundle.accessKeyId ?? bundle.aws_access_key_id;
+  const secretAccessKey =
+    bundle.secretAccessKey ?? bundle.aws_secret_access_key;
+  // Both halves or neither. Half a credential is not a weaker credential, it is
+  // a confusing failure — the SDK reports a signature error rather than a
+  // missing one.
+  if (!accessKeyId || !secretAccessKey) return derived;
+
+  // A project that stores these under their own names has said something
+  // explicit. Overriding that would be this module guessing against an operator.
+  if (selected.has(ACCESS_KEY) || selected.has(SECRET_KEY)) return derived;
+
+  const note =
+    `Derived from ${BOOTSTRAP_KEY} by lisa-secrets-access. Exported ` +
+    `deliberately so it overrides any ambient ${ACCESS_KEY} the host injects — ` +
+    `environment variables outrank profile files in the AWS credential chain, ` +
+    `so without this a stale host value wins and every call fails with ` +
+    `InvalidClientTokenId. This is the assume-only bootstrap identity; real ` +
+    `work assumes a role from it.`;
+
+  derived.set(ACCESS_KEY, { value: String(accessKeyId), note });
+  derived.set(SECRET_KEY, { value: String(secretAccessKey), note });
+
+  const region = bundle.region ?? bundle.defaultRegion;
+  if (region && !selected.has(REGION)) {
+    derived.set(REGION, {
+      value: String(region),
+      note: `Derived from ${BOOTSTRAP_KEY} by lisa-secrets-access.`,
+    });
+  }
+  return derived;
+}

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -27,6 +27,7 @@ import {
   writeFileSync,
 } from "node:fs";
 
+import { deriveAwsEnvironment } from "./aws-bootstrap.mjs";
 import { renderEnv, renderNotes } from "./envfile.mjs";
 import { fetchAll } from "./providers.mjs";
 import { materializedPaths, readConfig } from "./surfaces.mjs";
@@ -74,25 +75,47 @@ export function materialize(cfg = readConfig()) {
     );
   }
 
+  // The AWS bundle is stored as one JSON blob under a name no SDK reads, so
+  // the variables it implies are derived here. Without them a host-injected
+  // AWS_ACCESS_KEY_ID wins — environment variables outrank profile files in the
+  // credential chain — and every AWS call fails with InvalidClientTokenId even
+  // though the real credential materialized correctly.
+  const derived = deriveAwsEnvironment(selected);
+  for (const [name, entry] of derived) selected.set(name, entry);
+
   const { dir, valuesFile, notesFile } = materializedPaths(cfg.namespace);
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
   writeAtomic(valuesFile, renderEnv(selected));
   writeAtomic(notesFile, renderNotes(selected));
-  return { count: selected.size, dir };
+  return { count: selected.size, derived: derived.size, dir };
 }
 
 function main() {
   const cfg = readConfig();
   if (process.argv.includes("--dry-run")) {
     const selected = fetchAll(cfg);
+    // Derive here too, or the preview lies in the one place it matters most:
+    // the derived names are exactly the ones that override ambient host
+    // credentials, so omitting them hides the most surprising effect of the run
+    // and reports a smaller count than the real write produces.
+    for (const [name, entry] of deriveAwsEnvironment(selected)) {
+      selected.set(name, entry);
+    }
     const { dir } = materializedPaths(cfg.namespace);
     console.log(`would write ${selected.size} secret(s) to ${dir}`);
     console.log([...selected.keys()].sort().join("\n"));
     return;
   }
-  const { count, dir } = materialize(cfg);
+  const { count, derived, dir } = materialize(cfg);
   console.log(`materialized ${count} secret(s) and their notes into ${dir}`);
+  if (derived > 0) {
+    // Said out loud: this run exported variables the host may also have set.
+    console.log(
+      `  ${derived} AWS variable(s) derived from the bootstrap bundle, ` +
+        `overriding any ambient value`
+    );
+  }
 }
 
 if (import.meta.url === `file://${process.argv[1]}`) {

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs

@@ -0,0 +1,102 @@
+/**
+ * Turn the AWS bootstrap bundle into environment variables the AWS SDKs obey.
+ *
+ * `LISA_AWS_BOOTSTRAP_JSON` carries the agent's AWS identity as one JSON blob.
+ * Materializing it verbatim is not enough, because nothing reads that name:
+ * every AWS SDK and the CLI look for `AWS_ACCESS_KEY_ID` and
+ * `AWS_SECRET_ACCESS_KEY`, or for a profile.
+ *
+ * Writing profiles alone is also not enough, and that is the failure this
+ * module exists for. A Claude cloud container ships its own
+ * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` in the ambient environment, and
+ * **environment variables outrank profile files in the credential chain**. So a
+ * session with correctly written `~/.aws/credentials` still failed:
+ *
+ *     aws sts get-caller-identity
+ *     InvalidClientTokenId: The security token included in the request is invalid.
+ *
+ * Deriving the pair into the materialized env file fixes it, because that file
+ * is sourced into the session and the last export wins. Exporting over a
+ * variable this project did not set is a real intrusion, so it is deliberate,
+ * narrow, and never silent:
+ *
+ *   - only when the bundle actually parses and carries both halves
+ *   - never over a value the secret store itself supplies under those names,
+ *     which is a project stating an explicit intent
+ *   - recorded in the notes file, so the override is discoverable by the same
+ *     read-the-note path as any other credential
+ * @module aws-bootstrap
+ */
+
+/** The names every AWS SDK and the CLI actually read. */
+const ACCESS_KEY = "AWS_ACCESS_KEY_ID";
+const SECRET_KEY = "AWS_SECRET_ACCESS_KEY";
+const REGION = "AWS_DEFAULT_REGION";
+
+/** The bundle that carries the agent's identity. */
+export const BOOTSTRAP_KEY = "LISA_AWS_BOOTSTRAP_JSON";
+
+/**
+ * Read the bootstrap bundle, treating anything malformed as absent.
+ *
+ * A parse failure must not take materialization down with it: every other
+ * secret in the run is still valid and still needed, and a session with most of
+ * its credentials beats a session with none.
+ * @param {string} raw Bundle contents.
+ * @returns {object|null} Parsed bundle, or null.
+ */
+export function parseBootstrap(raw) {
+  if (typeof raw !== "string" || raw.trim() === "") return null;
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Derive the AWS variables implied by an already-selected secret set.
+ *
+ * Returns only additions; the caller merges. Nothing here mutates its input,
+ * so a caller can decide what to do with the result — including reporting it.
+ * @param {Map<string, {value: string}>} selected Secrets by exact name.
+ * @returns {Map<string, {value: string, note: string}>} Derived variables.
+ */
+export function deriveAwsEnvironment(selected) {
+  const derived = new Map();
+  const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
+  if (!bundle) return derived;
+
+  const accessKeyId = bundle.accessKeyId ?? bundle.aws_access_key_id;
+  const secretAccessKey =
+    bundle.secretAccessKey ?? bundle.aws_secret_access_key;
+  // Both halves or neither. Half a credential is not a weaker credential, it is
+  // a confusing failure — the SDK reports a signature error rather than a
+  // missing one.
+  if (!accessKeyId || !secretAccessKey) return derived;
+
+  // A project that stores these under their own names has said something
+  // explicit. Overriding that would be this module guessing against an operator.
+  if (selected.has(ACCESS_KEY) || selected.has(SECRET_KEY)) return derived;
+
+  const note =
+    `Derived from ${BOOTSTRAP_KEY} by lisa-secrets-access. Exported ` +
+    `deliberately so it overrides any ambient ${ACCESS_KEY} the host injects — ` +
+    `environment variables outrank profile files in the AWS credential chain, ` +
+    `so without this a stale host value wins and every call fails with ` +
+    `InvalidClientTokenId. This is the assume-only bootstrap identity; real ` +
+    `work assumes a role from it.`;
+
+  derived.set(ACCESS_KEY, { value: String(accessKeyId), note });
+  derived.set(SECRET_KEY, { value: String(secretAccessKey), note });
+
+  const region = bundle.region ?? bundle.defaultRegion;
+  if (region && !selected.has(REGION)) {
+    derived.set(REGION, {
+      value: String(region),
+      note: `Derived from ${BOOTSTRAP_KEY} by lisa-secrets-access.`,
+    });
+  }
+  return derived;
+}

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -27,6 +27,7 @@ import {
   writeFileSync,
 } from "node:fs";
 
+import { deriveAwsEnvironment } from "./aws-bootstrap.mjs";
 import { renderEnv, renderNotes } from "./envfile.mjs";
 import { fetchAll } from "./providers.mjs";
 import { materializedPaths, readConfig } from "./surfaces.mjs";
@@ -74,25 +75,47 @@ export function materialize(cfg = readConfig()) {
     );
   }
 
+  // The AWS bundle is stored as one JSON blob under a name no SDK reads, so
+  // the variables it implies are derived here. Without them a host-injected
+  // AWS_ACCESS_KEY_ID wins — environment variables outrank profile files in the
+  // credential chain — and every AWS call fails with InvalidClientTokenId even
+  // though the real credential materialized correctly.
+  const derived = deriveAwsEnvironment(selected);
+  for (const [name, entry] of derived) selected.set(name, entry);
+
   const { dir, valuesFile, notesFile } = materializedPaths(cfg.namespace);
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
   writeAtomic(valuesFile, renderEnv(selected));
   writeAtomic(notesFile, renderNotes(selected));
-  return { count: selected.size, dir };
+  return { count: selected.size, derived: derived.size, dir };
 }
 
 function main() {
   const cfg = readConfig();
   if (process.argv.includes("--dry-run")) {
     const selected = fetchAll(cfg);
+    // Derive here too, or the preview lies in the one place it matters most:
+    // the derived names are exactly the ones that override ambient host
+    // credentials, so omitting them hides the most surprising effect of the run
+    // and reports a smaller count than the real write produces.
+    for (const [name, entry] of deriveAwsEnvironment(selected)) {
+      selected.set(name, entry);
+    }
     const { dir } = materializedPaths(cfg.namespace);
     console.log(`would write ${selected.size} secret(s) to ${dir}`);
     console.log([...selected.keys()].sort().join("\n"));
     return;
   }
-  const { count, dir } = materialize(cfg);
+  const { count, derived, dir } = materialize(cfg);
   console.log(`materialized ${count} secret(s) and their notes into ${dir}`);
+  if (derived > 0) {
+    // Said out loud: this run exported variables the host may also have set.
+    console.log(
+      `  ${derived} AWS variable(s) derived from the bootstrap bundle, ` +
+        `overriding any ambient value`
+    );
+  }
 }
 
 if (import.meta.url === `file://${process.argv[1]}`) {

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -56,7 +56,28 @@ export const SURFACES = {
   "claude-web": {
     materialized: true,
     mayWriteValues: true,
-    materializeAt: "session-start",
+    // BOTH, and the two cover disjoint failures rather than duplicating work.
+    //
+    // The hook alone was the original design, for a real reason: this surface
+    // skips its setup script whenever a cached environment exists, so
+    // materializing only there would write values once and never refresh them.
+    //
+    // What that missed is that the hook is PROJECT-scoped — it lives in a
+    // repository's `.claude/settings.json` and only loads when Claude Code's
+    // project directory is that repository. A cloud environment configured with
+    // more than one repository starts in their parent:
+    //
+    //     HOME=/root  PWD=/home/user
+    //     /home/user/backend  /home/user/infrastructure
+    //
+    // `/home/user` is not a project root, so no settings load, no hook
+    // registers, and nothing materializes at all. Verified in a real session.
+    //
+    // So the setup run is the FLOOR — a fresh environment has its secrets even
+    // where the hook cannot fire — and the hook is the REFRESH, picking up
+    // rotation on resumed sessions that skip setup. A stale secret is
+    // recoverable; an absent one means the environment does not work.
+    materializeAt: "both",
   },
 };
 

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -736,7 +736,7 @@ export function selectPhases(requested, materializeAt) {
         `unknown --phase "${requested}". Known: ${PHASES.join(", ")}.`
       );
     }
-    if (requested === "secrets" && materializeAt !== "session-start") {
+    if (requested === "secrets" && !materializesAtSessionStart(materializeAt)) {
       // Not an error: the hook is committed to the repository and runs on every
       // surface the project is ever checked out on. Refusing loudly would make
       // a correct local session look broken every time it started.
@@ -745,10 +745,34 @@ export function selectPhases(requested, materializeAt) {
     return [requested];
   }
   return PHASES.filter(
-    phase => phase !== "secrets" || materializeAt === "setup"
+    phase => phase !== "secrets" || materializesAtSetup(materializeAt)
   );
 }
 
+/**
+ * Whether the setup run itself should materialize.
+ *
+ * `"both"` means the surface materializes in the setup run AND from the
+ * session-start hook, because on that surface either one alone has a hole: the
+ * setup run is skipped when a cached environment is reused, and the hook cannot
+ * fire when Claude Code's project directory is not the repository — which is
+ * every cloud environment configured with more than one repo.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether to materialize during setup.
+ */
+export function materializesAtSetup(materializeAt) {
+  return materializeAt === "setup" || materializeAt === "both";
+}
+
+/**
+ * Whether the committed session-start hook should materialize.
+ * @param {string|null} materializeAt Surface capability.
+ * @returns {boolean} Whether the hook does the work.
+ */
+export function materializesAtSessionStart(materializeAt) {
+  return materializeAt === "session-start" || materializeAt === "both";
+}
+
 /**
  * Read the surface the resolver detects, without duplicating its rules.
  *

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.331.1",
+  "version": "2.331.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"