@codyswann/lisa 2.338.3 → 2.338.5

package/package.json

@@ -118,7 +118,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "2.338.3",
+  "version": "2.338.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.3",
+  "version": "2.338.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.3",
+  "version": "2.338.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs

@@ -51,6 +51,29 @@ const PROVIDER_BOOTSTRAP_ENV = {
   doppler: "DOPPLER_TOKEN",
 };
 
+/**
+ * The tenant-scoped bootstrap variable a provider expects, by convention.
+ *
+ * Exists so the repo-less path cannot invent one. It used to compose
+ * `BWS_ACCESS_TOKEN_<namespace>` literally, ignoring the provider it had just
+ * resolved — so a Doppler tenant with no checkout was told to set a Bitwarden
+ * variable, and its CLI failed with "Missing access token". That is precisely
+ * the confusion the two questions above are separated to prevent, reintroduced
+ * on the one surface with no config file to correct it.
+ *
+ * `null` for a provider with no env-var bootstrap — 1Password, Vault and AWS
+ * authenticate by other means — because a name invented for them would be a
+ * variable nothing reads, which is worse than admitting there is none.
+ * `providerEnv` already treats an unmapped provider as "inject nothing".
+ * @param {string} provider Provider name.
+ * @param {string} namespace Tenant namespace.
+ * @returns {string|null} The variable to set, or null when the provider has none.
+ */
+export function bootstrapKeyFor(provider, namespace) {
+  const canonical = PROVIDER_BOOTSTRAP_ENV[provider];
+  return canonical ? `${canonical}_${namespace}` : null;
+}
+
 /**
  * Build the child environment for a provider CLI, injecting the bootstrap under
  * the name that CLI actually reads.

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -17,6 +17,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { bootstrapKeyFor } from "./providers.mjs";
+
 /**
  * Capabilities, per surface.
  *
@@ -237,10 +239,14 @@ function fromEnvironment(env) {
     namespace: assertNamespace(namespace),
     bootstrap: {
       ...DEFAULTS.bootstrap,
+      // Derived from the provider resolved just above, not from Bitwarden's
+      // name. Hardcoding it told a Doppler tenant to set BWS_ACCESS_TOKEN_<ns>,
+      // which its CLI has never heard of — on the one surface that has no
+      // config file to override the guess.
       key:
         env.LISA_BOOTSTRAP_KEY ??
         env.LISA_SECRETS_BOOTSTRAP_KEY ??
-        `BWS_ACCESS_TOKEN_${namespace}`,
+        bootstrapKeyFor(provider, namespace),
     },
   };
 }

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -662,7 +662,14 @@ export const SETUP_FIELD =
   "/workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; " +
   'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
   'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
-  'n=$((n+1)); bash "$f" || rc=$?; done; ' +
+  // `rc` keeps the FIRST failure, which is what the contract below promises.
+  //
+  // A bare `rc=$?` keeps the last one, so with two broken checkouts the
+  // operator is shown the second and the first is lost — the precise hiding the
+  // documented behaviour exists to prevent. A success never overwrites, because
+  // `||` only fires on failure, so the bug was confined to the multiple-failure
+  // case that the rule was written for.
+  'n=$((n+1)); bash "$f" || { s=$?; [ "$rc" -ne 0 ] || rc=$s; }; done; ' +
   '[ "$n" -gt 0 ] && exit "$rc"; ' +
   'g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; ' +
   'do [ -e "$c" ] && g=1; done; ' +
@@ -878,6 +885,52 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
   return path;
 }
 
+/**
+ * The lines an operator puts above the field, for a session with no checkout.
+ *
+ * Emitted as shell that runs, not as a template with holes: every hole is a
+ * hand substitution in a settings box with no review, which is the failure this
+ * whole file exists to prevent. So a provider that cannot be bootstrapped by an
+ * environment variable gets a sentence explaining that, not an `export` of a
+ * placeholder — a line that would be a syntax error if pasted.
+ *
+ * `LISA_PROVIDER` is exported even though the field defaults it, because the
+ * field's default is Bitwarden. A Doppler tenant that omits it gets `bws`
+ * installed and its own CLI missing, having configured everything correctly.
+ * @param {object} options Resolved identity and display strings.
+ * @returns {string[]} Lines to include in the emitted guidance.
+ */
+function repoLessExports({ namespace, key, provider, bootstrapKey, tenant }) {
+  // Two different reasons the key can be missing, and telling them apart is the
+  // whole value of the message. "Nothing was named" is the operator's to fix by
+  // re-running; "this provider has no such variable" is not fixable at all and
+  // must not read as an omission.
+  if (!tenant) {
+    return [
+      "      # Re-run with --tenant=<name> and these are filled in for you.",
+      `      export LISA_TENANT=${namespace}`,
+      "      export <bootstrap variable>='<read from your credential manager>'",
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  if (!bootstrapKey) {
+    return [
+      `      # ${provider} has no environment-variable bootstrap, so there is`,
+      "      # nothing to export for it. Authenticate it the way its own CLI",
+      "      # expects, then set the three below.",
+      `      export LISA_TENANT=${namespace}`,
+      `      export LISA_PROVIDER=${provider}`,
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  return [
+    `      export LISA_TENANT=${namespace}`,
+    `      export ${key}='<the same value as above>'`,
+    ...(provider ? [`      export LISA_PROVIDER=${provider}`] : []),
+    "      export LISA_SECRETS_SURFACE=claude-web",
+  ];
+}
+
 /**
  * Produce the configuration a human pastes to provision a Claude cloud surface.
  *
@@ -886,11 +939,16 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null}} options Project details.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey }) {
-  const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+export function emitClaudeWeb({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -917,11 +975,9 @@ export function emitClaudeWeb({ bootstrapKey }) {
     "    while the image is being built, before the environment exists. So a",
     "    session with no checkout has to be told its tenant inside the script",
     "    itself, or the field finds nothing to prepare and exits 0 looking like",
-    "    success. Put these three lines FIRST, then the line after them:",
+    "    success. Put the lines below FIRST, then the field after them:",
     "",
-    "      export LISA_TENANT=<your namespace>",
-    `      export ${key}='<the same value as above>'`,
-    "      export LISA_SECRETS_SURFACE=claude-web",
+    ...repoLessExports({ namespace, key, provider, bootstrapKey, tenant }),
     "",
     "    LISA_SECRETS_SURFACE is set explicitly rather than left to detection:",
     "    detection keys off CLAUDE_CODE_REMOTE, and a surface that does not set",
@@ -1089,6 +1145,66 @@ function readBootstrapKey(cwd = process.cwd()) {
   return JSON.parse(readFileSync(path, "utf8")).secrets?.bootstrap?.key ?? null;
 }
 
+/**
+ * Work out what to tell the operator to export, for a surface that has no repo.
+ *
+ * Emitting used to read the key out of `.lisa.config.json` in the working
+ * directory, which made the command that configures a REPO-LESS environment
+ * require a repository — so it was run from a checkout that happened to be
+ * nearby, or it printed a placeholder the operator substituted by hand.
+ *
+ * Explicit flags win, then the environment, then a checkout if the caller
+ * happens to be standing in one, then the convention. The provider matters
+ * because it decides the variable's name: `bws` reads `BWS_ACCESS_TOKEN` and
+ * `doppler` reads `DOPPLER_TOKEN`, so a tenant on one told to export the
+ * other's name gets "Missing access token" from a CLI it did configure.
+ * @param {string[]} argv Process arguments.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @param {string} [cwd] Directory to look for a config in.
+ * @returns {Promise<{tenant: string|null, provider: string, bootstrapKey: string|null}>} Resolved identity.
+ */
+export async function resolveEmitTarget(
+  argv,
+  env = process.env,
+  cwd = process.cwd()
+) {
+  const flag = name =>
+    argv.find(a => a.startsWith(`--${name}=`))?.slice(name.length + 3) ?? null;
+
+  const tenant =
+    flag("tenant") ||
+    (env.LISA_TENANT ?? env.LISA_SECRETS_NAMESPACE ?? "").trim() ||
+    null;
+  const provider =
+    flag("provider") ||
+    (env.LISA_PROVIDER ?? env.LISA_SECRETS_PROVIDER ?? "").trim() ||
+    "bitwarden";
+
+  // Validated before it can reach the output, by the same rule the runtime path
+  // applies. This one becomes `export LISA_TENANT=<value>` in a block an
+  // operator pastes verbatim, so `my tenant` or `has$var` would emit shell that
+  // breaks — or worse, expands — where nothing reviews it. Refusing here costs
+  // a re-run; emitting it costs a container nobody can explain.
+  if (tenant) {
+    const { assertNamespace } = await import(
+      pathToFileURL(siblingScript("lisa-secrets-access", "surfaces.mjs")).href
+    );
+    assertNamespace(tenant);
+  }
+
+  // A configured key outranks the convention: a project may legitimately use a
+  // name that is not derivable, and this command must not tell its operator to
+  // set a different one from the one their sessions actually read.
+  const configured = readBootstrapKey(cwd);
+  if (configured) return { tenant, provider, bootstrapKey: configured };
+  if (!tenant) return { tenant, provider, bootstrapKey: null };
+
+  const { bootstrapKeyFor } = await import(
+    pathToFileURL(siblingScript("lisa-secrets-access", "providers.mjs")).href
+  );
+  return { tenant, provider, bootstrapKey: bootstrapKeyFor(provider, tenant) };
+}
+
 async function main() {
   // `--print-tools` answers "which CLIs does this secret set imply", reading
   // the notes materialized alongside the values.
@@ -1163,7 +1279,7 @@ async function main() {
           `Emitting is implemented for claude-web, which has no other tier.`
       );
     }
-    console.log(emitClaudeWeb({ bootstrapKey: readBootstrapKey() }));
+    console.log(emitClaudeWeb(await resolveEmitTarget(process.argv)));
     return;
   }
 

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -51,6 +51,29 @@ const PROVIDER_BOOTSTRAP_ENV = {
   doppler: "DOPPLER_TOKEN",
 };
 
+/**
+ * The tenant-scoped bootstrap variable a provider expects, by convention.
+ *
+ * Exists so the repo-less path cannot invent one. It used to compose
+ * `BWS_ACCESS_TOKEN_<namespace>` literally, ignoring the provider it had just
+ * resolved — so a Doppler tenant with no checkout was told to set a Bitwarden
+ * variable, and its CLI failed with "Missing access token". That is precisely
+ * the confusion the two questions above are separated to prevent, reintroduced
+ * on the one surface with no config file to correct it.
+ *
+ * `null` for a provider with no env-var bootstrap — 1Password, Vault and AWS
+ * authenticate by other means — because a name invented for them would be a
+ * variable nothing reads, which is worse than admitting there is none.
+ * `providerEnv` already treats an unmapped provider as "inject nothing".
+ * @param {string} provider Provider name.
+ * @param {string} namespace Tenant namespace.
+ * @returns {string|null} The variable to set, or null when the provider has none.
+ */
+export function bootstrapKeyFor(provider, namespace) {
+  const canonical = PROVIDER_BOOTSTRAP_ENV[provider];
+  return canonical ? `${canonical}_${namespace}` : null;
+}
+
 /**
  * Build the child environment for a provider CLI, injecting the bootstrap under
  * the name that CLI actually reads.

package/plugins/lisa/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -17,6 +17,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { bootstrapKeyFor } from "./providers.mjs";
+
 /**
  * Capabilities, per surface.
  *
@@ -237,10 +239,14 @@ function fromEnvironment(env) {
     namespace: assertNamespace(namespace),
     bootstrap: {
       ...DEFAULTS.bootstrap,
+      // Derived from the provider resolved just above, not from Bitwarden's
+      // name. Hardcoding it told a Doppler tenant to set BWS_ACCESS_TOKEN_<ns>,
+      // which its CLI has never heard of — on the one surface that has no
+      // config file to override the guess.
       key:
         env.LISA_BOOTSTRAP_KEY ??
         env.LISA_SECRETS_BOOTSTRAP_KEY ??
-        `BWS_ACCESS_TOKEN_${namespace}`,
+        bootstrapKeyFor(provider, namespace),
     },
   };
 }

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -662,7 +662,14 @@ export const SETUP_FIELD =
   "/workspace/scripts/lisa-remote-env/setup.sh /workspace/*/scripts/lisa-remote-env/setup.sh; " +
   'do [ -f "$f" ] || continue; d=$(cd "$(dirname "$f")" && pwd -P); ' +
   'case " $seen " in *" $d "*) continue;; esac; seen="$seen $d"; ' +
-  'n=$((n+1)); bash "$f" || rc=$?; done; ' +
+  // `rc` keeps the FIRST failure, which is what the contract below promises.
+  //
+  // A bare `rc=$?` keeps the last one, so with two broken checkouts the
+  // operator is shown the second and the first is lost — the precise hiding the
+  // documented behaviour exists to prevent. A success never overwrites, because
+  // `||` only fires on failure, so the bug was confined to the multiple-failure
+  // case that the rule was written for.
+  'n=$((n+1)); bash "$f" || { s=$?; [ "$rc" -ne 0 ] || rc=$s; }; done; ' +
   '[ "$n" -gt 0 ] && exit "$rc"; ' +
   'g=0; for c in ./.git ./*/.git "$HOME"/*/.git /workspace/*/.git; ' +
   'do [ -e "$c" ] && g=1; done; ' +
@@ -878,6 +885,52 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
   return path;
 }
 
+/**
+ * The lines an operator puts above the field, for a session with no checkout.
+ *
+ * Emitted as shell that runs, not as a template with holes: every hole is a
+ * hand substitution in a settings box with no review, which is the failure this
+ * whole file exists to prevent. So a provider that cannot be bootstrapped by an
+ * environment variable gets a sentence explaining that, not an `export` of a
+ * placeholder — a line that would be a syntax error if pasted.
+ *
+ * `LISA_PROVIDER` is exported even though the field defaults it, because the
+ * field's default is Bitwarden. A Doppler tenant that omits it gets `bws`
+ * installed and its own CLI missing, having configured everything correctly.
+ * @param {object} options Resolved identity and display strings.
+ * @returns {string[]} Lines to include in the emitted guidance.
+ */
+function repoLessExports({ namespace, key, provider, bootstrapKey, tenant }) {
+  // Two different reasons the key can be missing, and telling them apart is the
+  // whole value of the message. "Nothing was named" is the operator's to fix by
+  // re-running; "this provider has no such variable" is not fixable at all and
+  // must not read as an omission.
+  if (!tenant) {
+    return [
+      "      # Re-run with --tenant=<name> and these are filled in for you.",
+      `      export LISA_TENANT=${namespace}`,
+      "      export <bootstrap variable>='<read from your credential manager>'",
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  if (!bootstrapKey) {
+    return [
+      `      # ${provider} has no environment-variable bootstrap, so there is`,
+      "      # nothing to export for it. Authenticate it the way its own CLI",
+      "      # expects, then set the three below.",
+      `      export LISA_TENANT=${namespace}`,
+      `      export LISA_PROVIDER=${provider}`,
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  return [
+    `      export LISA_TENANT=${namespace}`,
+    `      export ${key}='<the same value as above>'`,
+    ...(provider ? [`      export LISA_PROVIDER=${provider}`] : []),
+    "      export LISA_SECRETS_SURFACE=claude-web",
+  ];
+}
+
 /**
  * Produce the configuration a human pastes to provision a Claude cloud surface.
  *
@@ -886,11 +939,16 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null}} options Project details.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey }) {
-  const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+export function emitClaudeWeb({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -917,11 +975,9 @@ export function emitClaudeWeb({ bootstrapKey }) {
     "    while the image is being built, before the environment exists. So a",
     "    session with no checkout has to be told its tenant inside the script",
     "    itself, or the field finds nothing to prepare and exits 0 looking like",
-    "    success. Put these three lines FIRST, then the line after them:",
+    "    success. Put the lines below FIRST, then the field after them:",
     "",
-    "      export LISA_TENANT=<your namespace>",
-    `      export ${key}='<the same value as above>'`,
-    "      export LISA_SECRETS_SURFACE=claude-web",
+    ...repoLessExports({ namespace, key, provider, bootstrapKey, tenant }),
     "",
     "    LISA_SECRETS_SURFACE is set explicitly rather than left to detection:",
     "    detection keys off CLAUDE_CODE_REMOTE, and a surface that does not set",
@@ -1089,6 +1145,66 @@ function readBootstrapKey(cwd = process.cwd()) {
   return JSON.parse(readFileSync(path, "utf8")).secrets?.bootstrap?.key ?? null;
 }
 
+/**
+ * Work out what to tell the operator to export, for a surface that has no repo.
+ *
+ * Emitting used to read the key out of `.lisa.config.json` in the working
+ * directory, which made the command that configures a REPO-LESS environment
+ * require a repository — so it was run from a checkout that happened to be
+ * nearby, or it printed a placeholder the operator substituted by hand.
+ *
+ * Explicit flags win, then the environment, then a checkout if the caller
+ * happens to be standing in one, then the convention. The provider matters
+ * because it decides the variable's name: `bws` reads `BWS_ACCESS_TOKEN` and
+ * `doppler` reads `DOPPLER_TOKEN`, so a tenant on one told to export the
+ * other's name gets "Missing access token" from a CLI it did configure.
+ * @param {string[]} argv Process arguments.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @param {string} [cwd] Directory to look for a config in.
+ * @returns {Promise<{tenant: string|null, provider: string, bootstrapKey: string|null}>} Resolved identity.
+ */
+export async function resolveEmitTarget(
+  argv,
+  env = process.env,
+  cwd = process.cwd()
+) {
+  const flag = name =>
+    argv.find(a => a.startsWith(`--${name}=`))?.slice(name.length + 3) ?? null;
+
+  const tenant =
+    flag("tenant") ||
+    (env.LISA_TENANT ?? env.LISA_SECRETS_NAMESPACE ?? "").trim() ||
+    null;
+  const provider =
+    flag("provider") ||
+    (env.LISA_PROVIDER ?? env.LISA_SECRETS_PROVIDER ?? "").trim() ||
+    "bitwarden";
+
+  // Validated before it can reach the output, by the same rule the runtime path
+  // applies. This one becomes `export LISA_TENANT=<value>` in a block an
+  // operator pastes verbatim, so `my tenant` or `has$var` would emit shell that
+  // breaks — or worse, expands — where nothing reviews it. Refusing here costs
+  // a re-run; emitting it costs a container nobody can explain.
+  if (tenant) {
+    const { assertNamespace } = await import(
+      pathToFileURL(siblingScript("lisa-secrets-access", "surfaces.mjs")).href
+    );
+    assertNamespace(tenant);
+  }
+
+  // A configured key outranks the convention: a project may legitimately use a
+  // name that is not derivable, and this command must not tell its operator to
+  // set a different one from the one their sessions actually read.
+  const configured = readBootstrapKey(cwd);
+  if (configured) return { tenant, provider, bootstrapKey: configured };
+  if (!tenant) return { tenant, provider, bootstrapKey: null };
+
+  const { bootstrapKeyFor } = await import(
+    pathToFileURL(siblingScript("lisa-secrets-access", "providers.mjs")).href
+  );
+  return { tenant, provider, bootstrapKey: bootstrapKeyFor(provider, tenant) };
+}
+
 async function main() {
   // `--print-tools` answers "which CLIs does this secret set imply", reading
   // the notes materialized alongside the values.
@@ -1163,7 +1279,7 @@ async function main() {
           `Emitting is implemented for claude-web, which has no other tier.`
       );
     }
-    console.log(emitClaudeWeb({ bootstrapKey: readBootstrapKey() }));
+    console.log(emitClaudeWeb(await resolveEmitTarget(process.argv)));
     return;
   }
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.3",
+  "version": "2.338.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -51,6 +51,29 @@ const PROVIDER_BOOTSTRAP_ENV = {
   doppler: "DOPPLER_TOKEN",
 };
 
+/**
+ * The tenant-scoped bootstrap variable a provider expects, by convention.
+ *
+ * Exists so the repo-less path cannot invent one. It used to compose
+ * `BWS_ACCESS_TOKEN_<namespace>` literally, ignoring the provider it had just
+ * resolved — so a Doppler tenant with no checkout was told to set a Bitwarden
+ * variable, and its CLI failed with "Missing access token". That is precisely
+ * the confusion the two questions above are separated to prevent, reintroduced
+ * on the one surface with no config file to correct it.
+ *
+ * `null` for a provider with no env-var bootstrap — 1Password, Vault and AWS
+ * authenticate by other means — because a name invented for them would be a
+ * variable nothing reads, which is worse than admitting there is none.
+ * `providerEnv` already treats an unmapped provider as "inject nothing".
+ * @param {string} provider Provider name.
+ * @param {string} namespace Tenant namespace.
+ * @returns {string|null} The variable to set, or null when the provider has none.
+ */
+export function bootstrapKeyFor(provider, namespace) {
+  const canonical = PROVIDER_BOOTSTRAP_ENV[provider];
+  return canonical ? `${canonical}_${namespace}` : null;
+}
+
 /**
  * Build the child environment for a provider CLI, injecting the bootstrap under
  * the name that CLI actually reads.

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -17,6 +17,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { bootstrapKeyFor } from "./providers.mjs";
+
 /**
  * Capabilities, per surface.
  *
@@ -237,10 +239,14 @@ function fromEnvironment(env) {
     namespace: assertNamespace(namespace),
     bootstrap: {
       ...DEFAULTS.bootstrap,
+      // Derived from the provider resolved just above, not from Bitwarden's
+      // name. Hardcoding it told a Doppler tenant to set BWS_ACCESS_TOKEN_<ns>,
+      // which its CLI has never heard of — on the one surface that has no
+      // config file to override the guess.
       key:
         env.LISA_BOOTSTRAP_KEY ??
         env.LISA_SECRETS_BOOTSTRAP_KEY ??
-        `BWS_ACCESS_TOKEN_${namespace}`,
+        bootstrapKeyFor(provider, namespace),
     },
   };
 }