@codyswann/lisa 2.334.1 → 2.336.0

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -24,16 +24,39 @@ payload="$(cat)"
 repo_root="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null)}"
 [ -n "$repo_root" ] || exit 0
 
-# Skip when the plugin is installed, so a developer machine does not run every
-# guard twice and print every refusal twice. Absence is the interesting case and
-# the only one this exists for.
+# There is deliberately no skip here, and that is the whole point.
 #
-# Read from the plugin registry rather than from CLAUDE_PLUGIN_ROOT: that
-# variable is set for plugin hooks, and this hook is by definition not one.
-installed="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/plugins/installed_plugins.json"
-if [ -f "$installed" ] && grep -q '"lisa@lisa"' "$installed" 2>/dev/null; then
-  exit 0
-fi
+# This used to stand down when `installed_plugins.json` mentioned `lisa@lisa`,
+# to avoid running every guard twice on a developer machine. The question that
+# has to be answered is "are the plugin's guards running in this session?" and
+# the file being consulted answers "has this plugin ever been installed, for any
+# project, on this machine?". Those come apart three ways, and in each one both
+# layers were off:
+#
+#   - Project-blind. The registry is keyed by plugin with an array of per-project
+#     entries, so the grep matched the key. One project installing Lisa disabled
+#     the fallback for every other project on the machine.
+#   - Enablement-blind. `enabledPlugins` can set a plugin to false without
+#     removing its registry entry, so the plugin guards were off while this file
+#     believed they were on.
+#   - Session-blind. Hooks load at session start; the registry is written on any
+#     install or update. A plugin updated four minutes into a session leaves the
+#     registry saying "installed" for the rest of it, with no plugin hooks
+#     loaded. That is the one that was caught in the wild: a write to AGENTS.md
+#     went through in a session where both guard copies exit 2 for that exact
+#     payload.
+#
+# The first two are fixable with a better lookup. The third is not: plugin-hook
+# liveness is not observable from a repository hook. CLAUDE_PLUGIN_ROOT is set
+# only for plugin hooks, and nothing on disk distinguishes "registered" from
+# "loaded into this session". Any check against a file answers a different
+# question and will drift from the real one again.
+#
+# So the guards run unconditionally. On a machine where the plugin hooks are also
+# live that costs a duplicated sweep (~170ms) and a refusal printed twice, and
+# that is the correct trade against enforcement silently switching itself off.
+# Recovering it belongs in the guards — a marker keyed on session and payload, so
+# whichever layer fires first does the work — not in a liveness guess here.
 
 # Where the guards live depends on which repository this is.
 #

package/dist/core/upstream-evidence-manifest.js

@@ -3,7 +3,7 @@
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "9d3831007e681186a3673e1037ef3fc82980cab2fc04e27c0868e562912c9e9f",
     "all/copy-contents/gitignore": "2dbf7fd2f2020fc7824c432342002d9ca3ebb57b2872e761b14e942b23479a11",
-    "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
+    "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "a612f172282d13ba9318fe5e03689d7c6ff42a0122d0c9d5d39051e1967b93dc",
     "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "8996e0bcbf1db085a5d99734e797c91f5025997bd967bc374efff8348dac14c2",
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "a6ed91576efebb6ba40cfa4e9d8a3e8566314909210ae8d5860be62a3feb4cff",
@@ -560,7 +560,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "1471d2108058f3059e242f9c71208c99fdbc212bde32de34b798eaa9a27ffbcc",
     "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "04ab89bc1f890526ba3b693cd3b022abc5a24e078b93c08fe7dfd586452b70b1",
     "plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs": "546dc1c2f279cee6db56c0f55c01aabae0c316842f32d3219c5af6d638936a9c",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/surfaces.mjs": "f8d4404ab105284ee072a26319366a71333c89abb14f9d71aafe461e7ea0686a",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/surfaces.mjs": "21d3408de74f2691d61649862b086dfc37a5ce2553bcb17366fcd5d1c50a4ae8",
     "plugins/src/base/skills/lisa-secrets-access/scripts/validate-config.mjs": "62d1b87d1b852dc00c00ea9d132d9d6953f4ef77beb5fa4b93652c4424f33274",
     "plugins/src/base/skills/lisa-security-review/SKILL.md": "5a980eaf5efc4fcce66e75521ec5b1eda143a5b0d36e7157234a705dac94e3f5",
     "plugins/src/base/skills/lisa-security-zap-scan/SKILL.md": "a5189442dbf970cc49fd089ab03c386c8a205b856e09501f6ad1966321e7e4b5",
@@ -578,10 +578,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "bff68aa66d6d4cd7cb9d0e39be691c6daa232edb097f8a601815432a32cca6a6",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "f5a1e9290789fd1c33675168d30461fb24a11c98a433ef777c1f536bc2f905ef",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
-    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "b570ebc3faa5099dc8e43f33f5ba51bdc1e2312b3c49d28d04a3ae67f138041f",
+    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "b5993444364b361c7b365092ab424bc1d0eee61705a5a2471e4e1f443e30d78f",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
-    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "aa703a3fcadd847594c694f458fc41edd39590dfabeddf4fed1546b73099f33f",
+    "plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs": "830a2c75fabb0069ebe1bf3f5ec1c1f4dd3437fea6c059b41b8ab4092277025f",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "496de5aed034692fee421dc3a1fbad9f85ed9e1d0c83a1080f781a486d0274e6",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "82bc2a27a0a5afb2ff413a88365c619fd7f0eaada5de3ccabf2000938f0607a4",
     "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "b18e07ae942f75aad5730c0535840ef5f7115072f1b6cc62afac83196b28d6a3",
@@ -1008,7 +1008,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lib/reusable-workflow-contract.d.mts": "791f01b55dd7a6b5d9a5f4cb9c44167caa146c2fc3c31a2ae4c2d8a350adc2f1",
     "scripts/lib/reusable-workflow-contract.mjs": "134ee2a327290f066f1eb318b5ed53c711557c3e10ed462c00ff5c97cfb20863",
     "scripts/lisa-commit-and-pr-local.sh": "605409c3ce6ec38ad3275604291a1ceae98f7807a605654263bc14f811c03903",
-    "scripts/lisa-enforcement-fallback.sh": "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
+    "scripts/lisa-enforcement-fallback.sh": "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
     "scripts/lisa-github-environments.sh": "0a76e92f108519abaf3e29991299ec3b0db20ea533e69e6d2a53d802dba9c370",
     "scripts/lisa-github-repo-settings.sh": "4afbccdfb08c62ba13afee42ec8561a28facf87c61f6f4b80000115328364d54",
     "scripts/lisa-github-repo-setup.sh": "dc2f1c9d718aa34ba57161120d9319b5f78fe6b0b496d8e3c77226a08795aa36",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -165,9 +165,19 @@ export function materializedPaths(namespace, env = process.env) {
  * @param {string} [cwd] Directory to look in.
  * @returns {object} Resolved configuration with defaults applied.
  */
-export function readConfig(cwd = process.cwd()) {
+export function readConfig(cwd = process.cwd(), env = process.env) {
   const path = join(cwd, ".lisa.config.json");
-  if (!existsSync(path)) return withSurface(DEFAULTS);
+  // No repository is a real, supported state — not just a missing file.
+  //
+  // A Claude Tag channel session runs as the organization with no user account,
+  // and a repository "doesn't enter a session until a request names it". So a
+  // session can legitimately have no checkout and therefore no config, while
+  // still needing the credentials and profiles every other surface gets.
+  //
+  // The only values a config would supply here are the namespace and provider,
+  // so they can come from the environment instead. Everything else keeps its
+  // default, and an environment that sets neither still gets the old behaviour.
+  if (!existsSync(path)) return withSurface(fromEnvironment(env));
   let cfg;
   try {
     cfg = JSON.parse(readFileSync(path, "utf8")).secrets;
@@ -186,6 +196,36 @@ export function readConfig(cwd = process.cwd()) {
   });
 }
 
+/**
+ * Build a configuration from the environment, for sessions with no checkout.
+ *
+ * `LISA_SECRETS_NAMESPACE` is the one value with no safe default: it names the
+ * directory secrets are written to and the tenant they belong to, so guessing
+ * it would write one tenant's credentials under another's name. Absent, this
+ * returns the ordinary defaults and the caller behaves exactly as before.
+ *
+ * The bootstrap key follows the namespace by convention
+ * (`BWS_ACCESS_TOKEN_<namespace>`) so a channel environment needs one variable
+ * set, not two.
+ * @param {object} env The environment to read.
+ * @returns {object} A configuration, defaulted where the environment is silent.
+ */
+function fromEnvironment(env) {
+  const namespace = (env.LISA_SECRETS_NAMESPACE ?? "").trim();
+  if (!namespace) return DEFAULTS;
+
+  const provider = (env.LISA_SECRETS_PROVIDER ?? "").trim() || "bitwarden";
+  return {
+    ...DEFAULTS,
+    provider,
+    namespace: assertNamespace(namespace),
+    bootstrap: {
+      ...DEFAULTS.bootstrap,
+      key: env.LISA_SECRETS_BOOTSTRAP_KEY ?? `BWS_ACCESS_TOKEN_${namespace}`,
+    },
+  };
+}
+
 /**
  * Attach the resolved surface and its capabilities to a configuration.
  * @param {object} cfg Configuration without surface resolution.

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; npx -y @codyswann/lisa@latest workstation --provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -559,9 +559,26 @@ export function installAssets(cwd = process.cwd()) {
  * whenever cwd happens to be one of the roots.
  *
  * The status is the first failure and every checkout is still attempted: one
- * broken repository must neither hide the others nor report success. The
- * explicit `exit 1` on no matches matters because a `for` loop over a glob that
- * matches nothing otherwise exits 0 — the quiet success this guards against.
+ * broken repository must neither hide the others nor report success.
+ *
+ * Preparing nothing has two causes, and they are not the same failure:
+ *
+ *   - A checkout is present but carries no entrypoint. That is a
+ *     misconfiguration, and a `for` loop over a glob that matches nothing exits
+ *     0 on its own — the quiet success this has always guarded against. It
+ *     still fails loudly, printing the layout it found rather than only the
+ *     path it wanted.
+ *   - There is NO checkout. A Claude Tag channel session runs as the
+ *     organization with no user account, and a repository does not enter the
+ *     session until a request names one, so this is an ordinary state rather
+ *     than an error. Failing here would be severe: a setup script that exits
+ *     non-zero stops the session from starting at all, so the old blanket
+ *     `exit 1` would have killed every repo-less channel session.
+ *
+ * With no checkout, `LISA_SECRETS_NAMESPACE` decides whether there is anything
+ * to do: it names the tenant, which is the one value no default can supply.
+ * Given it, the machine itself is prepared — tools and credentials, no repo
+ * required. Without it there is nothing to prepare and nothing to fail about.
  *
  * Failure prints the layout it found rather than only the path it wanted. This
  * field lives in a vendor settings box with a slow edit-and-retry loop, and a
@@ -580,9 +597,19 @@ export const SETUP_FIELD =
   'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
   'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
   'n=$((n+1)); bash "$f" || rc=$?; done; ' +
-  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. ' +
-  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
-  'exit "$rc"';
+  '[ "$n" -gt 0 ] && exit "$rc"; ' +
+  'g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; ' +
+  'do [ -e "$c" ] && g=1; done; ' +
+  'if [ "$g" -eq 1 ]; then ' +
+  'echo "lisa-remote-env entrypoint not found, but a checkout is present. ' +
+  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ' +
+  'if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then ' +
+  'echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; ' +
+  "npx -y @codyswann/lisa@latest workstation " +
+  '--provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; ' +
+  "npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; " +
+  'else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; ' +
+  "exit 0";
 
 /**
  * Register the session-start hook at USER scope, so it fires wherever the

package/plugins/lisa/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -165,9 +165,19 @@ export function materializedPaths(namespace, env = process.env) {
  * @param {string} [cwd] Directory to look in.
  * @returns {object} Resolved configuration with defaults applied.
  */
-export function readConfig(cwd = process.cwd()) {
+export function readConfig(cwd = process.cwd(), env = process.env) {
   const path = join(cwd, ".lisa.config.json");
-  if (!existsSync(path)) return withSurface(DEFAULTS);
+  // No repository is a real, supported state — not just a missing file.
+  //
+  // A Claude Tag channel session runs as the organization with no user account,
+  // and a repository "doesn't enter a session until a request names it". So a
+  // session can legitimately have no checkout and therefore no config, while
+  // still needing the credentials and profiles every other surface gets.
+  //
+  // The only values a config would supply here are the namespace and provider,
+  // so they can come from the environment instead. Everything else keeps its
+  // default, and an environment that sets neither still gets the old behaviour.
+  if (!existsSync(path)) return withSurface(fromEnvironment(env));
   let cfg;
   try {
     cfg = JSON.parse(readFileSync(path, "utf8")).secrets;
@@ -186,6 +196,36 @@ export function readConfig(cwd = process.cwd()) {
   });
 }
 
+/**
+ * Build a configuration from the environment, for sessions with no checkout.
+ *
+ * `LISA_SECRETS_NAMESPACE` is the one value with no safe default: it names the
+ * directory secrets are written to and the tenant they belong to, so guessing
+ * it would write one tenant's credentials under another's name. Absent, this
+ * returns the ordinary defaults and the caller behaves exactly as before.
+ *
+ * The bootstrap key follows the namespace by convention
+ * (`BWS_ACCESS_TOKEN_<namespace>`) so a channel environment needs one variable
+ * set, not two.
+ * @param {object} env The environment to read.
+ * @returns {object} A configuration, defaulted where the environment is silent.
+ */
+function fromEnvironment(env) {
+  const namespace = (env.LISA_SECRETS_NAMESPACE ?? "").trim();
+  if (!namespace) return DEFAULTS;
+
+  const provider = (env.LISA_SECRETS_PROVIDER ?? "").trim() || "bitwarden";
+  return {
+    ...DEFAULTS,
+    provider,
+    namespace: assertNamespace(namespace),
+    bootstrap: {
+      ...DEFAULTS.bootstrap,
+      key: env.LISA_SECRETS_BOOTSTRAP_KEY ?? `BWS_ACCESS_TOKEN_${namespace}`,
+    },
+  };
+}
+
 /**
  * Attach the resolved surface and its capabilities to a configuration.
  * @param {object} cfg Configuration without surface resolution.

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; npx -y @codyswann/lisa@latest workstation --provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -559,9 +559,26 @@ export function installAssets(cwd = process.cwd()) {
  * whenever cwd happens to be one of the roots.
  *
  * The status is the first failure and every checkout is still attempted: one
- * broken repository must neither hide the others nor report success. The
- * explicit `exit 1` on no matches matters because a `for` loop over a glob that
- * matches nothing otherwise exits 0 — the quiet success this guards against.
+ * broken repository must neither hide the others nor report success.
+ *
+ * Preparing nothing has two causes, and they are not the same failure:
+ *
+ *   - A checkout is present but carries no entrypoint. That is a
+ *     misconfiguration, and a `for` loop over a glob that matches nothing exits
+ *     0 on its own — the quiet success this has always guarded against. It
+ *     still fails loudly, printing the layout it found rather than only the
+ *     path it wanted.
+ *   - There is NO checkout. A Claude Tag channel session runs as the
+ *     organization with no user account, and a repository does not enter the
+ *     session until a request names one, so this is an ordinary state rather
+ *     than an error. Failing here would be severe: a setup script that exits
+ *     non-zero stops the session from starting at all, so the old blanket
+ *     `exit 1` would have killed every repo-less channel session.
+ *
+ * With no checkout, `LISA_SECRETS_NAMESPACE` decides whether there is anything
+ * to do: it names the tenant, which is the one value no default can supply.
+ * Given it, the machine itself is prepared — tools and credentials, no repo
+ * required. Without it there is nothing to prepare and nothing to fail about.
  *
  * Failure prints the layout it found rather than only the path it wanted. This
  * field lives in a vendor settings box with a slow edit-and-retry loop, and a
@@ -580,9 +597,19 @@ export const SETUP_FIELD =
   'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
   'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
   'n=$((n+1)); bash "$f" || rc=$?; done; ' +
-  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. ' +
-  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
-  'exit "$rc"';
+  '[ "$n" -gt 0 ] && exit "$rc"; ' +
+  'g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; ' +
+  'do [ -e "$c" ] && g=1; done; ' +
+  'if [ "$g" -eq 1 ]; then ' +
+  'echo "lisa-remote-env entrypoint not found, but a checkout is present. ' +
+  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ' +
+  'if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then ' +
+  'echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; ' +
+  "npx -y @codyswann/lisa@latest workstation " +
+  '--provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; ' +
+  "npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; " +
+  'else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; ' +
+  "exit 0";
 
 /**
  * Register the session-start hook at USER scope, so it fires wherever the

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -165,9 +165,19 @@ export function materializedPaths(namespace, env = process.env) {
  * @param {string} [cwd] Directory to look in.
  * @returns {object} Resolved configuration with defaults applied.
  */
-export function readConfig(cwd = process.cwd()) {
+export function readConfig(cwd = process.cwd(), env = process.env) {
   const path = join(cwd, ".lisa.config.json");
-  if (!existsSync(path)) return withSurface(DEFAULTS);
+  // No repository is a real, supported state — not just a missing file.
+  //
+  // A Claude Tag channel session runs as the organization with no user account,
+  // and a repository "doesn't enter a session until a request names it". So a
+  // session can legitimately have no checkout and therefore no config, while
+  // still needing the credentials and profiles every other surface gets.
+  //
+  // The only values a config would supply here are the namespace and provider,
+  // so they can come from the environment instead. Everything else keeps its
+  // default, and an environment that sets neither still gets the old behaviour.
+  if (!existsSync(path)) return withSurface(fromEnvironment(env));
   let cfg;
   try {
     cfg = JSON.parse(readFileSync(path, "utf8")).secrets;
@@ -186,6 +196,36 @@ export function readConfig(cwd = process.cwd()) {
   });
 }
 
+/**
+ * Build a configuration from the environment, for sessions with no checkout.
+ *
+ * `LISA_SECRETS_NAMESPACE` is the one value with no safe default: it names the
+ * directory secrets are written to and the tenant they belong to, so guessing
+ * it would write one tenant's credentials under another's name. Absent, this
+ * returns the ordinary defaults and the caller behaves exactly as before.
+ *
+ * The bootstrap key follows the namespace by convention
+ * (`BWS_ACCESS_TOKEN_<namespace>`) so a channel environment needs one variable
+ * set, not two.
+ * @param {object} env The environment to read.
+ * @returns {object} A configuration, defaulted where the environment is silent.
+ */
+function fromEnvironment(env) {
+  const namespace = (env.LISA_SECRETS_NAMESPACE ?? "").trim();
+  if (!namespace) return DEFAULTS;
+
+  const provider = (env.LISA_SECRETS_PROVIDER ?? "").trim() || "bitwarden";
+  return {
+    ...DEFAULTS,
+    provider,
+    namespace: assertNamespace(namespace),
+    bootstrap: {
+      ...DEFAULTS.bootstrap,
+      key: env.LISA_SECRETS_BOOTSTRAP_KEY ?? `BWS_ACCESS_TOKEN_${namespace}`,
+    },
+  };
+}
+
 /**
  * Attach the resolved surface and its capabilities to a configuration.
  * @param {object} cfg Configuration without surface resolution.

package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; npx -y @codyswann/lisa@latest workstation --provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -559,9 +559,26 @@ export function installAssets(cwd = process.cwd()) {
  * whenever cwd happens to be one of the roots.
  *
  * The status is the first failure and every checkout is still attempted: one
- * broken repository must neither hide the others nor report success. The
- * explicit `exit 1` on no matches matters because a `for` loop over a glob that
- * matches nothing otherwise exits 0 — the quiet success this guards against.
+ * broken repository must neither hide the others nor report success.
+ *
+ * Preparing nothing has two causes, and they are not the same failure:
+ *
+ *   - A checkout is present but carries no entrypoint. That is a
+ *     misconfiguration, and a `for` loop over a glob that matches nothing exits
+ *     0 on its own — the quiet success this has always guarded against. It
+ *     still fails loudly, printing the layout it found rather than only the
+ *     path it wanted.
+ *   - There is NO checkout. A Claude Tag channel session runs as the
+ *     organization with no user account, and a repository does not enter the
+ *     session until a request names one, so this is an ordinary state rather
+ *     than an error. Failing here would be severe: a setup script that exits
+ *     non-zero stops the session from starting at all, so the old blanket
+ *     `exit 1` would have killed every repo-less channel session.
+ *
+ * With no checkout, `LISA_SECRETS_NAMESPACE` decides whether there is anything
+ * to do: it names the tenant, which is the one value no default can supply.
+ * Given it, the machine itself is prepared — tools and credentials, no repo
+ * required. Without it there is nothing to prepare and nothing to fail about.
  *
  * Failure prints the layout it found rather than only the path it wanted. This
  * field lives in a vendor settings box with a slow edit-and-retry loop, and a
@@ -580,9 +597,19 @@ export const SETUP_FIELD =
   'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
   'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
   'n=$((n+1)); bash "$f" || rc=$?; done; ' +
-  '[ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. ' +
-  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; ' +
-  'exit "$rc"';
+  '[ "$n" -gt 0 ] && exit "$rc"; ' +
+  'g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; ' +
+  'do [ -e "$c" ] && g=1; done; ' +
+  'if [ "$g" -eq 1 ]; then ' +
+  'echo "lisa-remote-env entrypoint not found, but a checkout is present. ' +
+  'PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ' +
+  'if [ -n "${LISA_SECRETS_NAMESPACE:-}" ]; then ' +
+  'echo "No checkout; preparing tools and credentials for $LISA_SECRETS_NAMESPACE."; ' +
+  "npx -y @codyswann/lisa@latest workstation " +
+  '--provider "${LISA_SECRETS_PROVIDER:-bitwarden}" --yes || true; ' +
+  "npx -y @codyswann/lisa@latest remote-env --phase=secrets || true; " +
+  'else echo "No checkout and no LISA_SECRETS_NAMESPACE; nothing to prepare."; fi; ' +
+  "exit 0";
 
 /**
  * Register the session-start hook at USER scope, so it fires wherever the

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.334.1",
+  "version": "2.336.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"