@codyswann/lisa 2.333.3 → 2.334.1

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -191,6 +191,38 @@ export function installProfileSourcing(valuesFile, options = {}) {
  * @param {object} [options] Home directory and file seams, for tests.
  * @returns {string[]} The profile names written.
  */
+/**
+ * Profile names already defined OUTSIDE this module's managed block.
+ *
+ * Only what lies outside the block counts: our own previous output is meant to
+ * be replaced, and treating it as a collision would make the second run fail.
+ * @param {string} dir The `.aws` directory.
+ * @param {string[]} names Profile names about to be written.
+ * @param {object} io `exists` and `read` seams.
+ * @returns {string[]} Colliding names, in the order given.
+ */
+export function collidingProfiles(dir, names, io = {}) {
+  const { exists = existsSync, read = readFileSync } = io;
+  const file = join(dir, "config");
+  if (!exists(file)) return [];
+
+  const text = String(read(file, "utf8"));
+  const start = text.indexOf(MANAGED_MARKER);
+  const endAt = start === -1 ? -1 : text.indexOf(MANAGED_END, start);
+  const outside =
+    start === -1
+      ? text
+      : text.slice(0, start) +
+        (endAt === -1 ? "" : text.slice(endAt + MANAGED_END.length));
+
+  return names.filter(name =>
+    new RegExp(
+      `^\\s*\\[profile\\s+${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\]`,
+      "m"
+    ).test(outside)
+  );
+}
+
 export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
@@ -205,6 +237,33 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+
+  // Refuse to write a profile name the operator already uses outside our block.
+  //
+  // AWS does not error on a duplicate `[profile x]` — it resolves one and
+  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
+  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // worse than either winning outright. Merging protects their sections from
+  // being deleted; this protects them from being shadowed.
+  //
+  // Deliberately not resolved by renaming theirs: this module writes its own
+  // block and nothing else. The operator renames (conventionally to `-sso`) and
+  // re-runs.
+  const collisions = collidingProfiles(dir, rendered.profiles, {
+    exists,
+    read,
+  });
+  if (collisions.length > 0) {
+    throw new Error(
+      `~/.aws/config already defines ${collisions.map(n => `"${n}"`).join(", ")} ` +
+        `outside the lisa-managed block.\n` +
+        `Writing them would create duplicate sections, and AWS resolves only ` +
+        `one — some calls would silently use the wrong identity.\n` +
+        `Rename the existing entries (for example to "${collisions[0]}-sso") ` +
+        `and run this again.`
+    );
+  }
+
   mkdir(dir, { recursive: true, mode: 0o700 });
   chmod(dir, 0o700);
 
@@ -297,6 +356,47 @@ export function materialize(cfg = readConfig()) {
 
 function main() {
   const cfg = readConfig();
+
+  // `--aws-profiles-only` writes ~/.aws and NOTHING else, on any surface.
+  //
+  // A laptop refuses to materialize secrets to disk, deliberately: read-through
+  // to the provider adds no drift and leaves no copy. That rule is about the
+  // thirteen values in secrets.env, and it stays exactly as it was here.
+  //
+  // The AWS profiles are a different bargain, requested explicitly. Agents
+  // working on a developer's machine should act as RemoteAgent rather than
+  // borrowing the human's SSO identity — separate attribution in CloudTrail,
+  // the role's blast radius instead of a person's, and the same `agent-*`
+  // profile names as a container so a script does not need two vocabularies.
+  //
+  // The cost is real and belongs in the open: `source_profile` needs a
+  // long-lived key pair, so this writes one to a machine that is not
+  // disposable, which is the thing the local surface otherwise prevents. It is
+  // therefore opt-in per run, never automatic, and never part of a normal
+  // materialize.
+  if (process.argv.includes("--aws-profiles-only")) {
+    const selected = fetchAll(cfg);
+    const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
+    const written = installAwsProfiles(bundle);
+
+    if (written.length === 0) {
+      console.log(
+        `no AWS profiles written — ${BOOTSTRAP_KEY} is absent, unparseable, ` +
+          `or declares no profile carrying a roleArn.`
+      );
+      return;
+    }
+    console.log(
+      `wrote ${written.length} AWS profile(s): ${written.join(", ")}`
+    );
+    console.log(
+      `  Sourced from a long-lived key pair in ~/.aws/credentials. Existing\n` +
+        `  sections were preserved — only the lisa-managed block was replaced.\n` +
+        `  Use them explicitly: aws --profile ${written[0]} ...`
+    );
+    return;
+  }
+
   if (process.argv.includes("--dry-run")) {
     const selected = fetchAll(cfg);
     // Derive here too, or the preview lies in the one place it matters most:
@@ -314,10 +414,20 @@ function main() {
   const { count, derived, dir } = materialize(cfg);
   console.log(`materialized ${count} secret(s) and their notes into ${dir}`);
   if (derived > 0) {
-    // Said out loud: this run exported variables the host may also have set.
+    // Do not claim an override this does not perform.
+    //
+    // This line used to end "overriding any ambient value". That was true when
+    // the key pair was exported and stopped being true when the pair moved into
+    // ~/.aws and AWS_PROFILE took its place — AWS_PROFILE loses to ambient
+    // environment credentials, it does not beat them. The stale sentence sent
+    // two separate investigations after a credential problem that did not
+    // exist, while the real fault was that nothing sourced the file. A message
+    // that overclaims costs more than no message.
     console.log(
-      `  ${derived} AWS variable(s) derived from the bootstrap bundle, ` +
-        `overriding any ambient value`
+      `  ${derived} AWS variable(s) derived from the bootstrap bundle. ` +
+        `These take\n  effect only in a shell that sourced the materialized ` +
+        `env file; ambient\n  credentials outrank AWS_PROFILE, so prefer an ` +
+        `explicit --profile.`
     );
   }
 }

package/plugins/lisa-agy/skills/lisa-setup-sonar/SKILL.md

@@ -80,6 +80,51 @@ MCP config so it launches `sonar run mcp`, authenticated from the same env token
 
 Skip any agent whose CLI is not installed; never wire Kiro or Gemini.
 
+## 4a. Patch the generated shims — required, not optional
+
+Each integrate writes a five-line shim that pipes the hook payload to `sonar hook
+<event>` and passes the verdict through unchanged. That makes an
+**unauthenticated CLI refuse every prompt and every file read**, with a reason
+string that reads exactly like a real finding:
+
+```text
+SonarQube secret scanning is inactive: not authenticated. Run 'sonar auth login'.
+```
+
+The operator most likely to hit it is the one who just installed the CLI and has
+not logged in — so their very first prompt is rejected, before the session can
+say anything useful. Repoint every generated shim at Lisa's wrapper, which keeps
+real findings blocking, resolves `SONARQUBE_CLI_TOKEN` through
+`lisa-secrets-access` when the CLI reports it has none, and degrades the
+still-unauthenticated case to a warning:
+
+```bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+here="$(cd -- "$(dirname -- "$0")" && pwd)"
+exec bash "${here}/<relative-path>/scripts/lisa-hooks/sonar-secrets.sh" <vendor-event>
+```
+
+One wrapper serves every surface — it takes the vendor event name as its only
+argument. Known shim locations and their events:
+
+| Agent | Shim | Event |
+| --- | --- | --- |
+| Claude | `.claude/hooks/sonar-secrets/build-scripts/prompt-secrets.sh` | `claude-prompt-submit` |
+| Claude | `.claude/hooks/sonar-secrets/build-scripts/pretool-secrets.sh` | `claude-pre-tool-use` |
+| Codex | `.codex/hooks/sonar-secrets/build-scripts/prompt-secrets.sh` | `codex-prompt-submit` |
+| Copilot | `.github/hooks/sonar-secrets/build-scripts/pretool-secrets.sh` | `copilot-pre-tool-use` |
+| Antigravity | `.agents/sonar/hooks/pretool-secrets.sh` | `antigravity-pre-tool-use` |
+
+Compute the relative path from each shim's own directory rather than assuming a
+depth — Antigravity's is three levels up, the rest are four.
+
+**Re-running an integrate overwrites the shim with the vendor's original**, so
+re-apply this patch whenever you re-run step 4, and say so in the summary. Leave
+a comment at the top of each patched shim naming the wrapper, so the next reader
+does not mistake the delegation for drift.
+
 ## 5. Write non-secret policy config
 
 Merge only non-secret identifiers into committed `.lisa.config.json`, preserving

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/sonar-secrets.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+#
+# Shared wrapper around `sonar hook <event>` for every agent surface.
+#
+# `sonar integrate <agent>` generates a five-line shim per surface: if `sonar` is
+# on PATH, pipe the hook payload to it and let whatever comes back stand. That is
+# correct for the thing the scanner exists to do — refusing a prompt or a file
+# read that genuinely contains a credential — and wrong for the thing it also
+# does, which is refusing *everything* when the CLI has no token yet:
+#
+#   {"decision":"block","reason":"SonarQube secret scanning is inactive:
+#    not authenticated. Run 'sonar auth login'."}
+#
+# At the shim level that reply is indistinguishable from a real finding, so a
+# workstation that had simply never run the browser login could not submit a
+# prompt at all. Two things are wrong with that, and this wrapper fixes both.
+#
+# 1. The credential is usually already provisioned. A project that declares
+#    SONARQUBE_CLI_TOKEN under `secrets.require` has it in its configured
+#    provider — and the CLI reads only the environment and the OS keychain, so on
+#    a local surface (which deliberately materializes nothing to disk) the value
+#    is present and unreachable at the same time. We resolve it through
+#    lisa-secrets-access, the one sanctioned reader, and only when the CLI says
+#    it needs it.
+#
+# 2. An unauthenticated scanner is a degraded gate, not a breach. This hook is
+#    one of several overlapping layers: secret scanning at commit time and in CI
+#    does not depend on it. Blocking every prompt to protect a redundant layer
+#    trades a certain outage for a hypothetical leak — and the outage lands on
+#    exactly the person least able to diagnose it, since the block fires before
+#    their first prompt is ever seen.
+#
+# A real finding still blocks. Only the "inactive" reply is downgraded, and the
+# distinction is drawn on the reason text the vendor emits, so a detection that
+# arrives while unauthenticated is impossible by construction — in that state the
+# scanner does not scan at all.
+#
+# Usage: sonar-secrets.sh <vendor-event-name>   # hook payload on stdin
+set -uo pipefail
+
+event="${1:-}"
+[ -n "$event" ] || exit 0
+
+# Nothing installed, nothing to enforce. Matches the vendor shim's own guard.
+command -v sonar >/dev/null 2>&1 || exit 0
+
+# An explicit off switch, for bisecting a session that is misbehaving. There is
+# deliberately no way to turn the *blocking* back on from the environment: the
+# decision that a missing token must not stop work belongs in this file, where it
+# is reviewable, not in whatever shell happened to launch the agent.
+[ "${LISA_SONAR_HOOK:-on}" = "off" ] && exit 0
+
+payload="$(cat)"
+
+# The vendor signals its verdict as JSON on stdout and always exits 0, so the
+# exit code carries no information and the reason text is the only channel.
+inactive_marker='secret scanning is inactive'
+
+run_scanner() {
+  printf '%s' "$payload" | sonar hook "$event" 2>/dev/null
+}
+
+is_inactive() {
+  case "$1" in
+    *"$inactive_marker"*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Run the resolver with a ceiling, because the provider call crosses the network
+# and this sits in front of every prompt and every file read. `timeout` is not
+# present on a stock macOS, so this is the portable equivalent: start it, poll,
+# give up. Giving up is safe — the caller treats an empty value as "the provider
+# had nothing", which lands on the warn path rather than a block.
+resolve_secret() {
+  local resolver="$1" name="$2" out pid waited=0
+  out="$(mktemp)" || return 0
+  node "$resolver" get "$name" >"$out" 2>/dev/null &
+  pid=$!
+  while kill -0 "$pid" 2>/dev/null; do
+    [ "$waited" -ge 10 ] && { kill -9 "$pid" 2>/dev/null; break; }
+    sleep 1
+    waited=$((waited + 1))
+  done
+  wait "$pid" 2>/dev/null
+  cat "$out"
+  rm -f "$out"
+}
+
+out="$(run_scanner)"
+
+if is_inactive "$out"; then
+  # Where lisa-secrets-access lives depends on how the project receives Lisa.
+  # Claude and Codex get it as an installed plugin, which is not part of a clone;
+  # the agent skill directories and node_modules are what a fresh checkout
+  # actually has. Same search order as the remote-env setup script, including the
+  # `plugins/` rung that exists only in the Lisa monorepo itself.
+  repo_root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+  resolver=""
+  for candidate in \
+    "$repo_root/.claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/.codex/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs" \
+    "$repo_root/node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-secret.mjs"; do
+    if [ -f "$candidate" ]; then
+      resolver="$candidate"
+      break
+    fi
+  done
+
+  if [ -n "$resolver" ] && command -v node >/dev/null 2>&1; then
+    token="$(resolve_secret "$resolver" SONARQUBE_CLI_TOKEN)"
+    if [ -n "$token" ]; then
+      # Exported into this process only. Writing it anywhere durable would create
+      # a second live copy of a credential whose single store is the provider —
+      # see the one-store rule in lisa-secrets-access.
+      export SONARQUBE_CLI_TOKEN="$token"
+      org="$(resolve_secret "$resolver" SONARQUBE_CLI_ORG)"
+      [ -n "$org" ] && export SONARQUBE_CLI_ORG="$org"
+      out="$(run_scanner)"
+    fi
+    unset token org
+  fi
+fi
+
+if is_inactive "$out"; then
+  # stderr on a zero exit is advisory in every agent's hook protocol: the user
+  # sees it, the operation proceeds.
+  echo "sonar: local secret scanning is inactive (no token in the environment," >&2
+  echo "  the OS keychain, or the configured secrets provider). Continuing —" >&2
+  echo "  commit-time and CI secret scanning still gate this repository." >&2
+  echo "  To restore it: 'sonar auth login', or store SONARQUBE_CLI_TOKEN in" >&2
+  echo "  the project's secrets provider." >&2
+  exit 0
+fi
+
+[ -n "$out" ] && printf '%s' "$out"
+exit 0

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -191,6 +191,38 @@ export function installProfileSourcing(valuesFile, options = {}) {
  * @param {object} [options] Home directory and file seams, for tests.
  * @returns {string[]} The profile names written.
  */
+/**
+ * Profile names already defined OUTSIDE this module's managed block.
+ *
+ * Only what lies outside the block counts: our own previous output is meant to
+ * be replaced, and treating it as a collision would make the second run fail.
+ * @param {string} dir The `.aws` directory.
+ * @param {string[]} names Profile names about to be written.
+ * @param {object} io `exists` and `read` seams.
+ * @returns {string[]} Colliding names, in the order given.
+ */
+export function collidingProfiles(dir, names, io = {}) {
+  const { exists = existsSync, read = readFileSync } = io;
+  const file = join(dir, "config");
+  if (!exists(file)) return [];
+
+  const text = String(read(file, "utf8"));
+  const start = text.indexOf(MANAGED_MARKER);
+  const endAt = start === -1 ? -1 : text.indexOf(MANAGED_END, start);
+  const outside =
+    start === -1
+      ? text
+      : text.slice(0, start) +
+        (endAt === -1 ? "" : text.slice(endAt + MANAGED_END.length));
+
+  return names.filter(name =>
+    new RegExp(
+      `^\\s*\\[profile\\s+${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\]`,
+      "m"
+    ).test(outside)
+  );
+}
+
 export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
@@ -205,6 +237,33 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+
+  // Refuse to write a profile name the operator already uses outside our block.
+  //
+  // AWS does not error on a duplicate `[profile x]` — it resolves one and
+  // ignores the other. So writing `tunnl-dev` next to an operator's existing SSO
+  // `tunnl-dev` would silently run some calls as the wrong identity, which is
+  // worse than either winning outright. Merging protects their sections from
+  // being deleted; this protects them from being shadowed.
+  //
+  // Deliberately not resolved by renaming theirs: this module writes its own
+  // block and nothing else. The operator renames (conventionally to `-sso`) and
+  // re-runs.
+  const collisions = collidingProfiles(dir, rendered.profiles, {
+    exists,
+    read,
+  });
+  if (collisions.length > 0) {
+    throw new Error(
+      `~/.aws/config already defines ${collisions.map(n => `"${n}"`).join(", ")} ` +
+        `outside the lisa-managed block.\n` +
+        `Writing them would create duplicate sections, and AWS resolves only ` +
+        `one — some calls would silently use the wrong identity.\n` +
+        `Rename the existing entries (for example to "${collisions[0]}-sso") ` +
+        `and run this again.`
+    );
+  }
+
   mkdir(dir, { recursive: true, mode: 0o700 });
   chmod(dir, 0o700);
 
@@ -297,6 +356,47 @@ export function materialize(cfg = readConfig()) {
 
 function main() {
   const cfg = readConfig();
+
+  // `--aws-profiles-only` writes ~/.aws and NOTHING else, on any surface.
+  //
+  // A laptop refuses to materialize secrets to disk, deliberately: read-through
+  // to the provider adds no drift and leaves no copy. That rule is about the
+  // thirteen values in secrets.env, and it stays exactly as it was here.
+  //
+  // The AWS profiles are a different bargain, requested explicitly. Agents
+  // working on a developer's machine should act as RemoteAgent rather than
+  // borrowing the human's SSO identity — separate attribution in CloudTrail,
+  // the role's blast radius instead of a person's, and the same `agent-*`
+  // profile names as a container so a script does not need two vocabularies.
+  //
+  // The cost is real and belongs in the open: `source_profile` needs a
+  // long-lived key pair, so this writes one to a machine that is not
+  // disposable, which is the thing the local surface otherwise prevents. It is
+  // therefore opt-in per run, never automatic, and never part of a normal
+  // materialize.
+  if (process.argv.includes("--aws-profiles-only")) {
+    const selected = fetchAll(cfg);
+    const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
+    const written = installAwsProfiles(bundle);
+
+    if (written.length === 0) {
+      console.log(
+        `no AWS profiles written — ${BOOTSTRAP_KEY} is absent, unparseable, ` +
+          `or declares no profile carrying a roleArn.`
+      );
+      return;
+    }
+    console.log(
+      `wrote ${written.length} AWS profile(s): ${written.join(", ")}`
+    );
+    console.log(
+      `  Sourced from a long-lived key pair in ~/.aws/credentials. Existing\n` +
+        `  sections were preserved — only the lisa-managed block was replaced.\n` +
+        `  Use them explicitly: aws --profile ${written[0]} ...`
+    );
+    return;
+  }
+
   if (process.argv.includes("--dry-run")) {
     const selected = fetchAll(cfg);
     // Derive here too, or the preview lies in the one place it matters most:
@@ -314,10 +414,20 @@ function main() {
   const { count, derived, dir } = materialize(cfg);
   console.log(`materialized ${count} secret(s) and their notes into ${dir}`);
   if (derived > 0) {
-    // Said out loud: this run exported variables the host may also have set.
+    // Do not claim an override this does not perform.
+    //
+    // This line used to end "overriding any ambient value". That was true when
+    // the key pair was exported and stopped being true when the pair moved into
+    // ~/.aws and AWS_PROFILE took its place — AWS_PROFILE loses to ambient
+    // environment credentials, it does not beat them. The stale sentence sent
+    // two separate investigations after a credential problem that did not
+    // exist, while the real fault was that nothing sourced the file. A message
+    // that overclaims costs more than no message.
     console.log(
-      `  ${derived} AWS variable(s) derived from the bootstrap bundle, ` +
-        `overriding any ambient value`
+      `  ${derived} AWS variable(s) derived from the bootstrap bundle. ` +
+        `These take\n  effect only in a shell that sourced the materialized ` +
+        `env file; ambient\n  credentials outrank AWS_PROFILE, so prefer an ` +
+        `explicit --profile.`
     );
   }
 }

package/plugins/lisa-copilot/skills/lisa-setup-sonar/SKILL.md

@@ -80,6 +80,51 @@ MCP config so it launches `sonar run mcp`, authenticated from the same env token
 
 Skip any agent whose CLI is not installed; never wire Kiro or Gemini.
 
+## 4a. Patch the generated shims — required, not optional
+
+Each integrate writes a five-line shim that pipes the hook payload to `sonar hook
+<event>` and passes the verdict through unchanged. That makes an
+**unauthenticated CLI refuse every prompt and every file read**, with a reason
+string that reads exactly like a real finding:
+
+```text
+SonarQube secret scanning is inactive: not authenticated. Run 'sonar auth login'.
+```
+
+The operator most likely to hit it is the one who just installed the CLI and has
+not logged in — so their very first prompt is rejected, before the session can
+say anything useful. Repoint every generated shim at Lisa's wrapper, which keeps
+real findings blocking, resolves `SONARQUBE_CLI_TOKEN` through
+`lisa-secrets-access` when the CLI reports it has none, and degrades the
+still-unauthenticated case to a warning:
+
+```bash
+if ! command -v sonar &> /dev/null; then
+  exit 0
+fi
+here="$(cd -- "$(dirname -- "$0")" && pwd)"
+exec bash "${here}/<relative-path>/scripts/lisa-hooks/sonar-secrets.sh" <vendor-event>
+```
+
+One wrapper serves every surface — it takes the vendor event name as its only
+argument. Known shim locations and their events:
+
+| Agent | Shim | Event |
+| --- | --- | --- |
+| Claude | `.claude/hooks/sonar-secrets/build-scripts/prompt-secrets.sh` | `claude-prompt-submit` |
+| Claude | `.claude/hooks/sonar-secrets/build-scripts/pretool-secrets.sh` | `claude-pre-tool-use` |
+| Codex | `.codex/hooks/sonar-secrets/build-scripts/prompt-secrets.sh` | `codex-prompt-submit` |
+| Copilot | `.github/hooks/sonar-secrets/build-scripts/pretool-secrets.sh` | `copilot-pre-tool-use` |
+| Antigravity | `.agents/sonar/hooks/pretool-secrets.sh` | `antigravity-pre-tool-use` |
+
+Compute the relative path from each shim's own directory rather than assuming a
+depth — Antigravity's is three levels up, the rest are four.
+
+**Re-running an integrate overwrites the shim with the vendor's original**, so
+re-apply this patch whenever you re-run step 4, and say so in the summary. Leave
+a comment at the top of each patched shim naming the wrapper, so the next reader
+does not mistake the delegation for drift.
+
 ## 5. Write non-secret policy config
 
 Merge only non-secret identifiers into committed `.lisa.config.json`, preserving

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.3",
+  "version": "2.334.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"