@codyswann/lisa 2.332.2 → 2.332.4

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -38,6 +38,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -583,6 +584,101 @@ export const SETUP_FIELD =
   'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
   'exit "$rc"';
 
+/**
+ * Register the session-start hook at USER scope, so it fires wherever the
+ * session opens.
+ *
+ * The committed `.claude/settings.json` hook is *project*-scoped: it loads only
+ * when Claude Code's project directory is that repository. A cloud session does
+ * not reliably start there. With several repositories it starts in the shared
+ * parent, which is not a git repository at all; even with one, the checkout sits
+ * at `$HOME/<repo>` while the session may open at `$HOME`. In those sessions no
+ * project settings load, the hook never registers, and nothing materializes —
+ * the failure that `materializeAt: "both"` was introduced to paper over, and
+ * which it could not fix, because the setup phase cannot see the bootstrap
+ * credential in the first place.
+ *
+ * A user-scoped hook has neither problem: `~/.claude/settings.json` is read for
+ * every session regardless of project directory, and it runs in-session where
+ * the vendor's configured variables ARE present.
+ *
+ * Only ever on a remote surface. This writes machine state in an ephemeral
+ * container, which is fine there and would be an intrusion on a developer's
+ * laptop, where the project hook already works and the user owns that file.
+ *
+ * Merged, never clobbered, and idempotent on the exact command — an existing
+ * user settings file may carry hooks this knows nothing about.
+ * @param {string} repoRoot Absolute path to the checkout.
+ * @param {object} options Home directory, dry-run flag, and file seams.
+ * @returns {{action: string, path: string, reason?: string}} What was done.
+ */
+export function installUserSessionHook(repoRoot, options = {}) {
+  const {
+    home = process.env.HOME || homedir(),
+    dryRun = false,
+    exists = existsSync,
+    read = readFileSync,
+    write = writeFileSync,
+    mkdir = mkdirSync,
+  } = options;
+
+  const script = join(repoRoot, "scripts/lisa-remote-env/session-start.sh");
+  if (!exists(script)) {
+    return { action: "skipped", path: script, reason: "no session-start.sh" };
+  }
+
+  const dir = join(home, ".claude");
+  const settingsPath = join(dir, "settings.json");
+  const command = `bash ${script}`;
+
+  let settings = {};
+  if (exists(settingsPath)) {
+    try {
+      settings = JSON.parse(String(read(settingsPath, "utf8"))) || {};
+    } catch {
+      // Refuse rather than overwrite. A settings file that does not parse is
+      // still someone's configuration, and replacing it would be the careless
+      // destruction this whole function is written to avoid.
+      return {
+        action: "failed",
+        path: settingsPath,
+        reason: "existing settings.json is not valid JSON; left untouched",
+      };
+    }
+  }
+
+  const hooks = settings.hooks ?? {};
+  const sessionStart = Array.isArray(hooks.SessionStart)
+    ? hooks.SessionStart
+    : [];
+  const already = sessionStart.some(entry =>
+    (entry?.hooks ?? []).some(hook => hook?.command === command)
+  );
+  if (already) {
+    return { action: "present", path: settingsPath };
+  }
+
+  const updated = {
+    ...settings,
+    hooks: {
+      ...hooks,
+      SessionStart: [
+        ...sessionStart,
+        {
+          matcher: "startup|resume",
+          hooks: [{ type: "command", command }],
+        },
+      ],
+    },
+  };
+
+  if (dryRun) return { action: "would-register", path: settingsPath };
+
+  mkdir(dir, { recursive: true });
+  write(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
+  return { action: "registered", path: settingsPath };
+}
+
 /**
  * The settings block that wires the session-start hook into a repository.
  *
@@ -936,6 +1032,19 @@ async function main() {
     // codex-cloud both have no second chance, so a silent pass there would
     // hand back a session with no credentials and call it ready.
     const retried = !requested && materializesAtSessionStart(materializeAt);
+
+    // If the hook is what will retry, make sure the hook can actually fire.
+    // Registering it at user scope is what makes the retry real rather than
+    // assumed: the committed project hook does not load when the session opens
+    // above the checkout, which is the norm in a cloud container.
+    // `materializeAt` being set is what "remote surface" means here. The
+    // toolchain phase derives a local `remote` from it, but that binding is
+    // scoped to its own block and is not in scope in this one.
+    if (retried && Boolean(materializeAt)) {
+      const hook = installUserSessionHook(process.cwd(), { dryRun });
+      console.log(`  session-start hook: ${hook.action} (${hook.path})`);
+      if (hook.reason) console.log(`    ${hook.reason}`);
+    }
     try {
       execFileSync(
         "node",

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -21,11 +21,15 @@
 
 import {
   chmodSync,
+  existsSync,
   mkdirSync,
+  readFileSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 import { deriveAwsEnvironment } from "./aws-bootstrap.mjs";
 import { renderEnv, renderNotes } from "./envfile.mjs";
@@ -58,6 +62,70 @@ function writeAtomic(destination, contents) {
  * @param {object} [cfg] Resolved configuration.
  * @returns {{count: number, dir: string}} What was written, and where.
  */
+/** Marks the block this owns, so it is replaced rather than appended twice. */
+const PROFILE_MARKER = "# >>> lisa secrets (managed) >>>";
+
+/** Closes the managed block. */
+const PROFILE_END = "# <<< lisa secrets (managed) <<<";
+
+/**
+ * Make every shell in this container load the materialized secrets.
+ *
+ * `set -a` so the values are exported rather than merely set as shell
+ * variables, and sourced LAST so they win over anything the host injected —
+ * environment variables outrank profile files in AWS's credential chain, which
+ * is the whole reason a valid credential was being ignored.
+ *
+ * Guarded on the file existing, so a shell still starts cleanly before the
+ * first materialization or if the file is removed. Written to both `.bashrc`
+ * and `.profile` because which one a given shell reads depends on whether it is
+ * interactive or a login shell, and an agent's tool calls are not reliably
+ * either.
+ * @param {string} valuesFile Absolute path to the materialized env file.
+ * @param {object} [options] Home directory and file seams, for tests.
+ * @returns {string[]} The profile files that now source it.
+ */
+export function installProfileSourcing(valuesFile, options = {}) {
+  const {
+    home = process.env.HOME || homedir(),
+    exists = existsSync,
+    read = readFileSync,
+    write = writeFileSync,
+  } = options;
+
+  const block = [
+    PROFILE_MARKER,
+    `if [ -f "${valuesFile}" ]; then`,
+    `  set -a`,
+    `  . "${valuesFile}"`,
+    `  set +a`,
+    `fi`,
+    PROFILE_END,
+  ].join("\n");
+
+  const updated = [];
+  for (const name of [".bashrc", ".profile"]) {
+    const file = join(home, name);
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+
+    // Replace an existing managed block rather than appending another: this
+    // runs on every session, and an appended-forever profile is its own bug.
+    const start = current.indexOf(PROFILE_MARKER);
+    const next =
+      start === -1
+        ? `${current}${current.endsWith("\n") || !current ? "" : "\n"}\n${block}\n`
+        : `${current.slice(0, start)}${block}${current.slice(
+            current.indexOf(PROFILE_END, start) + PROFILE_END.length
+          )}`;
+
+    if (next !== current) {
+      write(file, next, { mode: 0o600 });
+      updated.push(file);
+    }
+  }
+  return updated;
+}
+
 export function materialize(cfg = readConfig()) {
   if (!cfg.capabilities.mayWriteValues) {
     throw new Error(
@@ -88,7 +156,21 @@ export function materialize(cfg = readConfig()) {
   chmodSync(dir, 0o700);
   writeAtomic(valuesFile, renderEnv(selected));
   writeAtomic(notesFile, renderNotes(selected));
-  return { count: selected.size, derived: derived.size, dir };
+
+  // Writing the file is not the same as the values being in effect.
+  //
+  // A materialized secrets.env that nothing sources changes nothing: the agent's
+  // shell starts from the container's own environment, so a host-injected
+  // AWS_ACCESS_KEY_ID keeps winning and every call fails with
+  // InvalidClientTokenId while the correct credential sits on disk, correct and
+  // unused. Deriving the variables (above) only fixes precedence WITHIN the
+  // file — something still has to load the file.
+  //
+  // So the shell profile sources it. That is what makes "the credential is
+  // materialized" and "the credential is usable" the same statement.
+  const sourced = installProfileSourcing(valuesFile);
+
+  return { count: selected.size, derived: derived.size, dir, sourced };
 }
 
 function main() {

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -38,6 +38,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -583,6 +584,101 @@ export const SETUP_FIELD =
   'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
   'exit "$rc"';
 
+/**
+ * Register the session-start hook at USER scope, so it fires wherever the
+ * session opens.
+ *
+ * The committed `.claude/settings.json` hook is *project*-scoped: it loads only
+ * when Claude Code's project directory is that repository. A cloud session does
+ * not reliably start there. With several repositories it starts in the shared
+ * parent, which is not a git repository at all; even with one, the checkout sits
+ * at `$HOME/<repo>` while the session may open at `$HOME`. In those sessions no
+ * project settings load, the hook never registers, and nothing materializes —
+ * the failure that `materializeAt: "both"` was introduced to paper over, and
+ * which it could not fix, because the setup phase cannot see the bootstrap
+ * credential in the first place.
+ *
+ * A user-scoped hook has neither problem: `~/.claude/settings.json` is read for
+ * every session regardless of project directory, and it runs in-session where
+ * the vendor's configured variables ARE present.
+ *
+ * Only ever on a remote surface. This writes machine state in an ephemeral
+ * container, which is fine there and would be an intrusion on a developer's
+ * laptop, where the project hook already works and the user owns that file.
+ *
+ * Merged, never clobbered, and idempotent on the exact command — an existing
+ * user settings file may carry hooks this knows nothing about.
+ * @param {string} repoRoot Absolute path to the checkout.
+ * @param {object} options Home directory, dry-run flag, and file seams.
+ * @returns {{action: string, path: string, reason?: string}} What was done.
+ */
+export function installUserSessionHook(repoRoot, options = {}) {
+  const {
+    home = process.env.HOME || homedir(),
+    dryRun = false,
+    exists = existsSync,
+    read = readFileSync,
+    write = writeFileSync,
+    mkdir = mkdirSync,
+  } = options;
+
+  const script = join(repoRoot, "scripts/lisa-remote-env/session-start.sh");
+  if (!exists(script)) {
+    return { action: "skipped", path: script, reason: "no session-start.sh" };
+  }
+
+  const dir = join(home, ".claude");
+  const settingsPath = join(dir, "settings.json");
+  const command = `bash ${script}`;
+
+  let settings = {};
+  if (exists(settingsPath)) {
+    try {
+      settings = JSON.parse(String(read(settingsPath, "utf8"))) || {};
+    } catch {
+      // Refuse rather than overwrite. A settings file that does not parse is
+      // still someone's configuration, and replacing it would be the careless
+      // destruction this whole function is written to avoid.
+      return {
+        action: "failed",
+        path: settingsPath,
+        reason: "existing settings.json is not valid JSON; left untouched",
+      };
+    }
+  }
+
+  const hooks = settings.hooks ?? {};
+  const sessionStart = Array.isArray(hooks.SessionStart)
+    ? hooks.SessionStart
+    : [];
+  const already = sessionStart.some(entry =>
+    (entry?.hooks ?? []).some(hook => hook?.command === command)
+  );
+  if (already) {
+    return { action: "present", path: settingsPath };
+  }
+
+  const updated = {
+    ...settings,
+    hooks: {
+      ...hooks,
+      SessionStart: [
+        ...sessionStart,
+        {
+          matcher: "startup|resume",
+          hooks: [{ type: "command", command }],
+        },
+      ],
+    },
+  };
+
+  if (dryRun) return { action: "would-register", path: settingsPath };
+
+  mkdir(dir, { recursive: true });
+  write(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
+  return { action: "registered", path: settingsPath };
+}
+
 /**
  * The settings block that wires the session-start hook into a repository.
  *
@@ -936,6 +1032,19 @@ async function main() {
     // codex-cloud both have no second chance, so a silent pass there would
     // hand back a session with no credentials and call it ready.
     const retried = !requested && materializesAtSessionStart(materializeAt);
+
+    // If the hook is what will retry, make sure the hook can actually fire.
+    // Registering it at user scope is what makes the retry real rather than
+    // assumed: the committed project hook does not load when the session opens
+    // above the checkout, which is the norm in a cloud container.
+    // `materializeAt` being set is what "remote surface" means here. The
+    // toolchain phase derives a local `remote` from it, but that binding is
+    // scoped to its own block and is not in scope in this one.
+    if (retried && Boolean(materializeAt)) {
+      const hook = installUserSessionHook(process.cwd(), { dryRun });
+      console.log(`  session-start hook: ${hook.action} (${hook.path})`);
+      if (hook.reason) console.log(`    ${hook.reason}`);
+    }
     try {
       execFileSync(
         "node",

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -21,11 +21,15 @@
 
 import {
   chmodSync,
+  existsSync,
   mkdirSync,
+  readFileSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 import { deriveAwsEnvironment } from "./aws-bootstrap.mjs";
 import { renderEnv, renderNotes } from "./envfile.mjs";
@@ -58,6 +62,70 @@ function writeAtomic(destination, contents) {
  * @param {object} [cfg] Resolved configuration.
  * @returns {{count: number, dir: string}} What was written, and where.
  */
+/** Marks the block this owns, so it is replaced rather than appended twice. */
+const PROFILE_MARKER = "# >>> lisa secrets (managed) >>>";
+
+/** Closes the managed block. */
+const PROFILE_END = "# <<< lisa secrets (managed) <<<";
+
+/**
+ * Make every shell in this container load the materialized secrets.
+ *
+ * `set -a` so the values are exported rather than merely set as shell
+ * variables, and sourced LAST so they win over anything the host injected —
+ * environment variables outrank profile files in AWS's credential chain, which
+ * is the whole reason a valid credential was being ignored.
+ *
+ * Guarded on the file existing, so a shell still starts cleanly before the
+ * first materialization or if the file is removed. Written to both `.bashrc`
+ * and `.profile` because which one a given shell reads depends on whether it is
+ * interactive or a login shell, and an agent's tool calls are not reliably
+ * either.
+ * @param {string} valuesFile Absolute path to the materialized env file.
+ * @param {object} [options] Home directory and file seams, for tests.
+ * @returns {string[]} The profile files that now source it.
+ */
+export function installProfileSourcing(valuesFile, options = {}) {
+  const {
+    home = process.env.HOME || homedir(),
+    exists = existsSync,
+    read = readFileSync,
+    write = writeFileSync,
+  } = options;
+
+  const block = [
+    PROFILE_MARKER,
+    `if [ -f "${valuesFile}" ]; then`,
+    `  set -a`,
+    `  . "${valuesFile}"`,
+    `  set +a`,
+    `fi`,
+    PROFILE_END,
+  ].join("\n");
+
+  const updated = [];
+  for (const name of [".bashrc", ".profile"]) {
+    const file = join(home, name);
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+
+    // Replace an existing managed block rather than appending another: this
+    // runs on every session, and an appended-forever profile is its own bug.
+    const start = current.indexOf(PROFILE_MARKER);
+    const next =
+      start === -1
+        ? `${current}${current.endsWith("\n") || !current ? "" : "\n"}\n${block}\n`
+        : `${current.slice(0, start)}${block}${current.slice(
+            current.indexOf(PROFILE_END, start) + PROFILE_END.length
+          )}`;
+
+    if (next !== current) {
+      write(file, next, { mode: 0o600 });
+      updated.push(file);
+    }
+  }
+  return updated;
+}
+
 export function materialize(cfg = readConfig()) {
   if (!cfg.capabilities.mayWriteValues) {
     throw new Error(
@@ -88,7 +156,21 @@ export function materialize(cfg = readConfig()) {
   chmodSync(dir, 0o700);
   writeAtomic(valuesFile, renderEnv(selected));
   writeAtomic(notesFile, renderNotes(selected));
-  return { count: selected.size, derived: derived.size, dir };
+
+  // Writing the file is not the same as the values being in effect.
+  //
+  // A materialized secrets.env that nothing sources changes nothing: the agent's
+  // shell starts from the container's own environment, so a host-injected
+  // AWS_ACCESS_KEY_ID keeps winning and every call fails with
+  // InvalidClientTokenId while the correct credential sits on disk, correct and
+  // unused. Deriving the variables (above) only fixes precedence WITHIN the
+  // file — something still has to load the file.
+  //
+  // So the shell profile sources it. That is what makes "the credential is
+  // materialized" and "the credential is usable" the same statement.
+  const sourced = installProfileSourcing(valuesFile);
+
+  return { count: selected.size, derived: derived.size, dir, sourced };
 }
 
 function main() {

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -38,6 +38,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
+import { homedir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
@@ -583,6 +584,101 @@ export const SETUP_FIELD =
   'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
   'exit "$rc"';
 
+/**
+ * Register the session-start hook at USER scope, so it fires wherever the
+ * session opens.
+ *
+ * The committed `.claude/settings.json` hook is *project*-scoped: it loads only
+ * when Claude Code's project directory is that repository. A cloud session does
+ * not reliably start there. With several repositories it starts in the shared
+ * parent, which is not a git repository at all; even with one, the checkout sits
+ * at `$HOME/<repo>` while the session may open at `$HOME`. In those sessions no
+ * project settings load, the hook never registers, and nothing materializes —
+ * the failure that `materializeAt: "both"` was introduced to paper over, and
+ * which it could not fix, because the setup phase cannot see the bootstrap
+ * credential in the first place.
+ *
+ * A user-scoped hook has neither problem: `~/.claude/settings.json` is read for
+ * every session regardless of project directory, and it runs in-session where
+ * the vendor's configured variables ARE present.
+ *
+ * Only ever on a remote surface. This writes machine state in an ephemeral
+ * container, which is fine there and would be an intrusion on a developer's
+ * laptop, where the project hook already works and the user owns that file.
+ *
+ * Merged, never clobbered, and idempotent on the exact command — an existing
+ * user settings file may carry hooks this knows nothing about.
+ * @param {string} repoRoot Absolute path to the checkout.
+ * @param {object} options Home directory, dry-run flag, and file seams.
+ * @returns {{action: string, path: string, reason?: string}} What was done.
+ */
+export function installUserSessionHook(repoRoot, options = {}) {
+  const {
+    home = process.env.HOME || homedir(),
+    dryRun = false,
+    exists = existsSync,
+    read = readFileSync,
+    write = writeFileSync,
+    mkdir = mkdirSync,
+  } = options;
+
+  const script = join(repoRoot, "scripts/lisa-remote-env/session-start.sh");
+  if (!exists(script)) {
+    return { action: "skipped", path: script, reason: "no session-start.sh" };
+  }
+
+  const dir = join(home, ".claude");
+  const settingsPath = join(dir, "settings.json");
+  const command = `bash ${script}`;
+
+  let settings = {};
+  if (exists(settingsPath)) {
+    try {
+      settings = JSON.parse(String(read(settingsPath, "utf8"))) || {};
+    } catch {
+      // Refuse rather than overwrite. A settings file that does not parse is
+      // still someone's configuration, and replacing it would be the careless
+      // destruction this whole function is written to avoid.
+      return {
+        action: "failed",
+        path: settingsPath,
+        reason: "existing settings.json is not valid JSON; left untouched",
+      };
+    }
+  }
+
+  const hooks = settings.hooks ?? {};
+  const sessionStart = Array.isArray(hooks.SessionStart)
+    ? hooks.SessionStart
+    : [];
+  const already = sessionStart.some(entry =>
+    (entry?.hooks ?? []).some(hook => hook?.command === command)
+  );
+  if (already) {
+    return { action: "present", path: settingsPath };
+  }
+
+  const updated = {
+    ...settings,
+    hooks: {
+      ...hooks,
+      SessionStart: [
+        ...sessionStart,
+        {
+          matcher: "startup|resume",
+          hooks: [{ type: "command", command }],
+        },
+      ],
+    },
+  };
+
+  if (dryRun) return { action: "would-register", path: settingsPath };
+
+  mkdir(dir, { recursive: true });
+  write(settingsPath, `${JSON.stringify(updated, null, 2)}\n`);
+  return { action: "registered", path: settingsPath };
+}
+
 /**
  * The settings block that wires the session-start hook into a repository.
  *
@@ -936,6 +1032,19 @@ async function main() {
     // codex-cloud both have no second chance, so a silent pass there would
     // hand back a session with no credentials and call it ready.
     const retried = !requested && materializesAtSessionStart(materializeAt);
+
+    // If the hook is what will retry, make sure the hook can actually fire.
+    // Registering it at user scope is what makes the retry real rather than
+    // assumed: the committed project hook does not load when the session opens
+    // above the checkout, which is the norm in a cloud container.
+    // `materializeAt` being set is what "remote surface" means here. The
+    // toolchain phase derives a local `remote` from it, but that binding is
+    // scoped to its own block and is not in scope in this one.
+    if (retried && Boolean(materializeAt)) {
+      const hook = installUserSessionHook(process.cwd(), { dryRun });
+      console.log(`  session-start hook: ${hook.action} (${hook.path})`);
+      if (hook.reason) console.log(`    ${hook.reason}`);
+    }
     try {
       execFileSync(
         "node",

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.332.2",
+  "version": "2.332.4",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"