@codyswann/lisa 2.338.1 → 2.338.2

package/package.json

@@ -118,7 +118,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.0 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.0 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.1 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.1 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -34,6 +34,8 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
 
 import {
   AGENTS,
@@ -297,6 +299,84 @@ export function renderPlan(plan) {
  * @param {object} [deps] Injected runner, for tests.
  * @returns {object} Result row.
  */
+/**
+ * Make a tool that installed elsewhere reachable from `~/.local/bin`.
+ *
+ * A vendor script installs where it likes — SonarQube's puts `sonar` under
+ * `~/.local/share/sonarqube-cli/bin` — and the catalogue records that in
+ * `binDir`. Until now the only thing that put those directories on PATH was an
+ * edit to the shell rc files, which a cloud container never reads: its tool
+ * shell is not a login shell. So the tool installed, and the session that asked
+ * for it could not find it. Observed on a live Claude Tag channel, where
+ * `~/.local/share/sonarqube-cli` existed and `command -v sonar` came back empty.
+ *
+ * Exporting PATH from the setup script does not fix that either — those exports
+ * die with the process that ran them. Only the filesystem survives into the
+ * session, so the fix has to be a file.
+ *
+ * A symlink into `~/.local/bin` is the shape the AWS installer already uses
+ * (`aws -> ~/.local/aws-cli/v2/current/bin/aws`), and that directory is the one
+ * place every surface agrees is on PATH.
+ *
+ * Deliberately never fatal. A tool that is already reachable does not need the
+ * link, and one that cannot be linked is caught a moment later by the probe —
+ * which reports the real problem instead of a symlink error standing in for it.
+ * @param {object} entry Catalogue entry just installed.
+ * @param {object} [deps] Injected seams, for tests.
+ */
+export function linkIntoBinDir(entry, deps = {}) {
+  if (!entry.binDir) return;
+
+  const home = deps.home ?? process.env.HOME ?? "";
+  const link = deps.link ?? symlinkSync;
+  const exists = deps.exists ?? existsSync;
+  const remove = deps.remove ?? rmSync;
+  const makeDir = deps.mkdir ?? mkdirSync;
+  // Two different questions, and they need two different probes.
+  //
+  // The SOURCE must be followed: a link pointing at a binary that is not there
+  // means the install did not produce one, whatever the link says.
+  //
+  // The TARGET must NOT be followed. `existsSync` reports false for a dangling
+  // symlink, which is precisely the case this function claims to repair — the
+  // vendor moved and the old link now points at nothing. Following it would
+  // skip the removal, `symlinkSync` would throw EEXIST, the catch below would
+  // swallow it, and the broken link would survive the fix meant to replace it.
+  const present = deps.present ?? (path => lstatPresent(path));
+
+  const source = join(
+    entry.binDir.replace(/^~/, home),
+    entry.binary ?? entry.name
+  );
+  const target = join(home, ".local", "bin", entry.name);
+  if (source === target || !exists(source)) return;
+
+  try {
+    makeDir(join(home, ".local", "bin"), { recursive: true });
+    // Replaced rather than skipped-if-present: a stale link left by an earlier
+    // version pointing at a path the vendor has since moved is worse than none,
+    // because it resolves and then fails at the moment of use.
+    if (present(target)) remove(target, { force: true });
+    link(source, target);
+  } catch {
+    // See above: the probe is the authority on whether this worked.
+  }
+}
+
+/**
+ * Whether a path exists WITHOUT following it, so a dangling link counts.
+ * @param {string} path Path to inspect.
+ * @returns {boolean} True when something occupies the path.
+ */
+function lstatPresent(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function installEntry(entry, row, deps = {}) {
   const run =
     deps.run ??
@@ -398,6 +478,10 @@ export function installEntry(entry, row, deps = {}) {
     };
   }
 
+  // Link it into ~/.local/bin BEFORE probing, because that is what makes the
+  // probe meaningful for a tool the vendor put somewhere else.
+  linkIntoBinDir(entry, deps);
+
   // Verify by looking, not by exit status. Every installer above can exit 0
   // having installed nothing, so a claim of success is only as good as a fresh
   // probe — reporting a tool as installed when it is absent is worse than

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.0 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.0 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.1 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.1 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -34,6 +34,8 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
 
 import {
   AGENTS,
@@ -297,6 +299,84 @@ export function renderPlan(plan) {
  * @param {object} [deps] Injected runner, for tests.
  * @returns {object} Result row.
  */
+/**
+ * Make a tool that installed elsewhere reachable from `~/.local/bin`.
+ *
+ * A vendor script installs where it likes — SonarQube's puts `sonar` under
+ * `~/.local/share/sonarqube-cli/bin` — and the catalogue records that in
+ * `binDir`. Until now the only thing that put those directories on PATH was an
+ * edit to the shell rc files, which a cloud container never reads: its tool
+ * shell is not a login shell. So the tool installed, and the session that asked
+ * for it could not find it. Observed on a live Claude Tag channel, where
+ * `~/.local/share/sonarqube-cli` existed and `command -v sonar` came back empty.
+ *
+ * Exporting PATH from the setup script does not fix that either — those exports
+ * die with the process that ran them. Only the filesystem survives into the
+ * session, so the fix has to be a file.
+ *
+ * A symlink into `~/.local/bin` is the shape the AWS installer already uses
+ * (`aws -> ~/.local/aws-cli/v2/current/bin/aws`), and that directory is the one
+ * place every surface agrees is on PATH.
+ *
+ * Deliberately never fatal. A tool that is already reachable does not need the
+ * link, and one that cannot be linked is caught a moment later by the probe —
+ * which reports the real problem instead of a symlink error standing in for it.
+ * @param {object} entry Catalogue entry just installed.
+ * @param {object} [deps] Injected seams, for tests.
+ */
+export function linkIntoBinDir(entry, deps = {}) {
+  if (!entry.binDir) return;
+
+  const home = deps.home ?? process.env.HOME ?? "";
+  const link = deps.link ?? symlinkSync;
+  const exists = deps.exists ?? existsSync;
+  const remove = deps.remove ?? rmSync;
+  const makeDir = deps.mkdir ?? mkdirSync;
+  // Two different questions, and they need two different probes.
+  //
+  // The SOURCE must be followed: a link pointing at a binary that is not there
+  // means the install did not produce one, whatever the link says.
+  //
+  // The TARGET must NOT be followed. `existsSync` reports false for a dangling
+  // symlink, which is precisely the case this function claims to repair — the
+  // vendor moved and the old link now points at nothing. Following it would
+  // skip the removal, `symlinkSync` would throw EEXIST, the catch below would
+  // swallow it, and the broken link would survive the fix meant to replace it.
+  const present = deps.present ?? (path => lstatPresent(path));
+
+  const source = join(
+    entry.binDir.replace(/^~/, home),
+    entry.binary ?? entry.name
+  );
+  const target = join(home, ".local", "bin", entry.name);
+  if (source === target || !exists(source)) return;
+
+  try {
+    makeDir(join(home, ".local", "bin"), { recursive: true });
+    // Replaced rather than skipped-if-present: a stale link left by an earlier
+    // version pointing at a path the vendor has since moved is worse than none,
+    // because it resolves and then fails at the moment of use.
+    if (present(target)) remove(target, { force: true });
+    link(source, target);
+  } catch {
+    // See above: the probe is the authority on whether this worked.
+  }
+}
+
+/**
+ * Whether a path exists WITHOUT following it, so a dangling link counts.
+ * @param {string} path Path to inspect.
+ * @returns {boolean} True when something occupies the path.
+ */
+function lstatPresent(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function installEntry(entry, row, deps = {}) {
   const run =
     deps.run ??
@@ -398,6 +478,10 @@ export function installEntry(entry, row, deps = {}) {
     };
   }
 
+  // Link it into ~/.local/bin BEFORE probing, because that is what makes the
+  // probe meaningful for a tool the vendor put somewhere else.
+  linkIntoBinDir(entry, deps);
+
   // Verify by looking, not by exit status. Every installer above can exit 0
   // having installed nothing, so a claim of success is only as good as a fresh
   // probe — reporting a tool as installed when it is absent is worse than

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.0 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.0 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.1 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.1 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa-agy/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -34,6 +34,8 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
 
 import {
   AGENTS,
@@ -297,6 +299,84 @@ export function renderPlan(plan) {
  * @param {object} [deps] Injected runner, for tests.
  * @returns {object} Result row.
  */
+/**
+ * Make a tool that installed elsewhere reachable from `~/.local/bin`.
+ *
+ * A vendor script installs where it likes — SonarQube's puts `sonar` under
+ * `~/.local/share/sonarqube-cli/bin` — and the catalogue records that in
+ * `binDir`. Until now the only thing that put those directories on PATH was an
+ * edit to the shell rc files, which a cloud container never reads: its tool
+ * shell is not a login shell. So the tool installed, and the session that asked
+ * for it could not find it. Observed on a live Claude Tag channel, where
+ * `~/.local/share/sonarqube-cli` existed and `command -v sonar` came back empty.
+ *
+ * Exporting PATH from the setup script does not fix that either — those exports
+ * die with the process that ran them. Only the filesystem survives into the
+ * session, so the fix has to be a file.
+ *
+ * A symlink into `~/.local/bin` is the shape the AWS installer already uses
+ * (`aws -> ~/.local/aws-cli/v2/current/bin/aws`), and that directory is the one
+ * place every surface agrees is on PATH.
+ *
+ * Deliberately never fatal. A tool that is already reachable does not need the
+ * link, and one that cannot be linked is caught a moment later by the probe —
+ * which reports the real problem instead of a symlink error standing in for it.
+ * @param {object} entry Catalogue entry just installed.
+ * @param {object} [deps] Injected seams, for tests.
+ */
+export function linkIntoBinDir(entry, deps = {}) {
+  if (!entry.binDir) return;
+
+  const home = deps.home ?? process.env.HOME ?? "";
+  const link = deps.link ?? symlinkSync;
+  const exists = deps.exists ?? existsSync;
+  const remove = deps.remove ?? rmSync;
+  const makeDir = deps.mkdir ?? mkdirSync;
+  // Two different questions, and they need two different probes.
+  //
+  // The SOURCE must be followed: a link pointing at a binary that is not there
+  // means the install did not produce one, whatever the link says.
+  //
+  // The TARGET must NOT be followed. `existsSync` reports false for a dangling
+  // symlink, which is precisely the case this function claims to repair — the
+  // vendor moved and the old link now points at nothing. Following it would
+  // skip the removal, `symlinkSync` would throw EEXIST, the catch below would
+  // swallow it, and the broken link would survive the fix meant to replace it.
+  const present = deps.present ?? (path => lstatPresent(path));
+
+  const source = join(
+    entry.binDir.replace(/^~/, home),
+    entry.binary ?? entry.name
+  );
+  const target = join(home, ".local", "bin", entry.name);
+  if (source === target || !exists(source)) return;
+
+  try {
+    makeDir(join(home, ".local", "bin"), { recursive: true });
+    // Replaced rather than skipped-if-present: a stale link left by an earlier
+    // version pointing at a path the vendor has since moved is worse than none,
+    // because it resolves and then fails at the moment of use.
+    if (present(target)) remove(target, { force: true });
+    link(source, target);
+  } catch {
+    // See above: the probe is the authority on whether this worked.
+  }
+}
+
+/**
+ * Whether a path exists WITHOUT following it, so a dangling link counts.
+ * @param {string} path Path to inspect.
+ * @returns {boolean} True when something occupies the path.
+ */
+function lstatPresent(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function installEntry(entry, row, deps = {}) {
   const run =
     deps.run ??
@@ -398,6 +478,10 @@ export function installEntry(entry, row, deps = {}) {
     };
   }
 
+  // Link it into ~/.local/bin BEFORE probing, because that is what makes the
+  // probe meaningful for a tool the vendor put somewhere else.
+  linkIntoBinDir(entry, deps);
+
   // Verify by looking, not by exit status. Every installer above can exit 0
   // having installed nothing, so a claim of success is only as good as a fresh
   // probe — reporting a tool as installed when it is absent is worse than

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.0 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.0 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.1 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.1 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```
 

package/plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -34,6 +34,8 @@
  */
 
 import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
+import { join } from "node:path";
 
 import {
   AGENTS,
@@ -297,6 +299,84 @@ export function renderPlan(plan) {
  * @param {object} [deps] Injected runner, for tests.
  * @returns {object} Result row.
  */
+/**
+ * Make a tool that installed elsewhere reachable from `~/.local/bin`.
+ *
+ * A vendor script installs where it likes — SonarQube's puts `sonar` under
+ * `~/.local/share/sonarqube-cli/bin` — and the catalogue records that in
+ * `binDir`. Until now the only thing that put those directories on PATH was an
+ * edit to the shell rc files, which a cloud container never reads: its tool
+ * shell is not a login shell. So the tool installed, and the session that asked
+ * for it could not find it. Observed on a live Claude Tag channel, where
+ * `~/.local/share/sonarqube-cli` existed and `command -v sonar` came back empty.
+ *
+ * Exporting PATH from the setup script does not fix that either — those exports
+ * die with the process that ran them. Only the filesystem survives into the
+ * session, so the fix has to be a file.
+ *
+ * A symlink into `~/.local/bin` is the shape the AWS installer already uses
+ * (`aws -> ~/.local/aws-cli/v2/current/bin/aws`), and that directory is the one
+ * place every surface agrees is on PATH.
+ *
+ * Deliberately never fatal. A tool that is already reachable does not need the
+ * link, and one that cannot be linked is caught a moment later by the probe —
+ * which reports the real problem instead of a symlink error standing in for it.
+ * @param {object} entry Catalogue entry just installed.
+ * @param {object} [deps] Injected seams, for tests.
+ */
+export function linkIntoBinDir(entry, deps = {}) {
+  if (!entry.binDir) return;
+
+  const home = deps.home ?? process.env.HOME ?? "";
+  const link = deps.link ?? symlinkSync;
+  const exists = deps.exists ?? existsSync;
+  const remove = deps.remove ?? rmSync;
+  const makeDir = deps.mkdir ?? mkdirSync;
+  // Two different questions, and they need two different probes.
+  //
+  // The SOURCE must be followed: a link pointing at a binary that is not there
+  // means the install did not produce one, whatever the link says.
+  //
+  // The TARGET must NOT be followed. `existsSync` reports false for a dangling
+  // symlink, which is precisely the case this function claims to repair — the
+  // vendor moved and the old link now points at nothing. Following it would
+  // skip the removal, `symlinkSync` would throw EEXIST, the catch below would
+  // swallow it, and the broken link would survive the fix meant to replace it.
+  const present = deps.present ?? (path => lstatPresent(path));
+
+  const source = join(
+    entry.binDir.replace(/^~/, home),
+    entry.binary ?? entry.name
+  );
+  const target = join(home, ".local", "bin", entry.name);
+  if (source === target || !exists(source)) return;
+
+  try {
+    makeDir(join(home, ".local", "bin"), { recursive: true });
+    // Replaced rather than skipped-if-present: a stale link left by an earlier
+    // version pointing at a path the vendor has since moved is worse than none,
+    // because it resolves and then fails at the moment of use.
+    if (present(target)) remove(target, { force: true });
+    link(source, target);
+  } catch {
+    // See above: the probe is the authority on whether this worked.
+  }
+}
+
+/**
+ * Whether a path exists WITHOUT following it, so a dangling link counts.
+ * @param {string} path Path to inspect.
+ * @returns {boolean} True when something occupies the path.
+ */
+function lstatPresent(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function installEntry(entry, row, deps = {}) {
   const run =
     deps.run ??
@@ -398,6 +478,10 @@ export function installEntry(entry, row, deps = {}) {
     };
   }
 
+  // Link it into ~/.local/bin BEFORE probing, because that is what makes the
+  // probe meaningful for a tool the vendor put somewhere else.
+  linkIntoBinDir(entry, deps);
+
   // Verify by looking, not by exit status. Every installer above can exit 0
   // having installed nothing, so a claim of success is only as good as a fresh
   // probe — reporting a tool as installed when it is absent is worse than

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.1",
+  "version": "2.338.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/SKILL.md

@@ -13,7 +13,7 @@ Prepare a remote surface so a host project can execute there. Today that means *
 The remote environment's own configuration fields stay **one line into the repository**. Nothing else is pasted into a vendor UI.
 
 ```text
-setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.0 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.0 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.0 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
+setup:       n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] && exit "$rc"; g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; do [ -e "$c" ] && g=1; done; if [ "$g" -eq 1 ]; then echo "lisa-remote-env entrypoint not found, but a checkout is present. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; fi; ten="${LISA_TENANT:-${LISA_SECRETS_NAMESPACE:-}}"; if [ -n "$ten" ]; then echo "No checkout; preparing tools and credentials for $ten."; tw=0; tt=0; ts=0; tp=0; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools=none --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tw=$?; export PATH="$HOME/.local/bin:$HOME/.opencode/bin:$HOME/.local/share/sonarqube-cli/bin:$PATH"; npx -y @codyswann/lisa@2.338.1 remote-env --phase=secrets || ts=$?; w=$(npx -y @codyswann/lisa@2.338.1 remote-env --print-tools 2>/dev/null) || tp=$?; w=$(printf "%s\n" "$w" | tail -1); [ "$tp" -eq 0 ] || echo "SETUP INCOMPLETE: could not read the tool list from the vault (exit $tp). Installing the full catalogue." >&2; npx -y @codyswann/lisa@2.338.1 workstation --install --agents=none --tools="$w" --provider="${LISA_PROVIDER:-${LISA_SECRETS_PROVIDER:-bitwarden}}" || tt=$?; [ "$tw" -eq 0 ] && [ "$tt" -eq 0 ] || echo "SETUP INCOMPLETE: tool install failed (exit $tw/$tt). The session will start WITHOUT the pinned tools." >&2; [ "$ts" -eq 0 ] || echo "SETUP INCOMPLETE: secrets did not materialize (exit $ts). The session will start WITHOUT credentials." >&2; else echo "No checkout and no tenant configured; nothing to prepare."; fi; exit 0
 maintenance: n=0; rc=0; seen=""; for f in scripts/lisa-remote-env/setup.sh */scripts/lisa-remote-env/setup.sh "$HOME"/scripts/lisa-remote-env/setup.sh "$HOME"/*/scripts/lisa-remote-env/setup.sh /workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; n=$((n+1)); bash "$f" || rc=$?; done; [ "$n" -gt 0 ] || { echo "lisa-remote-env entrypoint not found. PWD=$PWD HOME=$HOME" >&2; ls -1 . "$HOME" /workspace 2>&1 | head -40 >&2; exit 1; }; exit "$rc"
 ```