@codyswann/lisa 2.338.4 → 2.339.0

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -51,6 +51,29 @@ const PROVIDER_BOOTSTRAP_ENV = {
   doppler: "DOPPLER_TOKEN",
 };
 
+/**
+ * The tenant-scoped bootstrap variable a provider expects, by convention.
+ *
+ * Exists so the repo-less path cannot invent one. It used to compose
+ * `BWS_ACCESS_TOKEN_<namespace>` literally, ignoring the provider it had just
+ * resolved — so a Doppler tenant with no checkout was told to set a Bitwarden
+ * variable, and its CLI failed with "Missing access token". That is precisely
+ * the confusion the two questions above are separated to prevent, reintroduced
+ * on the one surface with no config file to correct it.
+ *
+ * `null` for a provider with no env-var bootstrap — 1Password, Vault and AWS
+ * authenticate by other means — because a name invented for them would be a
+ * variable nothing reads, which is worse than admitting there is none.
+ * `providerEnv` already treats an unmapped provider as "inject nothing".
+ * @param {string} provider Provider name.
+ * @param {string} namespace Tenant namespace.
+ * @returns {string|null} The variable to set, or null when the provider has none.
+ */
+export function bootstrapKeyFor(provider, namespace) {
+  const canonical = PROVIDER_BOOTSTRAP_ENV[provider];
+  return canonical ? `${canonical}_${namespace}` : null;
+}
+
 /**
  * Build the child environment for a provider CLI, injecting the bootstrap under
  * the name that CLI actually reads.

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -17,6 +17,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { bootstrapKeyFor } from "./providers.mjs";
+
 /**
  * Capabilities, per surface.
  *
@@ -79,6 +81,28 @@ export const SURFACES = {
     // recoverable; an absent one means the environment does not work.
     materializeAt: "both",
   },
+  // A container an operator builds and runs themselves — locally, or anywhere
+  // Lisa is not the one provisioning the host.
+  //
+  // It exists because `local` was standing in for it, and `local` is
+  // `materialized: false`. That default is right for a human at a keyboard: the
+  // provider CLI is authenticated, secrets resolve live, and writing them to
+  // disk would be a second copy to keep honest. A container has no keychain and
+  // dies with its filesystem, so the same default leaves it with the CLIs
+  // installed and nothing to authenticate them.
+  //
+  // The workaround was to claim `claude-web`, which materializes correctly and
+  // is a lie — it made a local container indistinguishable from a cloud session
+  // in every diagnostic and log.
+  //
+  // `setup` rather than `both`: a container has no session-start hook to run,
+  // and it is started fresh rather than resumed from a vendor's cache, so the
+  // start of the container IS the refresh.
+  container: {
+    materialized: true,
+    mayWriteValues: true,
+    materializeAt: "setup",
+  },
 };
 
 /** Config defaults when `.lisa.config.json` carries no `secrets` block. */
@@ -185,17 +209,49 @@ export function readConfig(cwd = process.cwd(), env = process.env) {
     throw new Error(`.lisa.config.json is not readable: ${err.message}`);
   }
   if (!cfg) return withSurface(DEFAULTS);
+  const provider = cfg.provider ?? DEFAULTS.provider;
+  const namespace = assertNamespace(cfg.namespace ?? DEFAULTS.namespace);
   return withSurface({
-    provider: cfg.provider ?? DEFAULTS.provider,
-    bootstrap: { ...DEFAULTS.bootstrap, ...(cfg.bootstrap ?? {}) },
+    provider,
+    bootstrap: resolveBootstrap(cfg.bootstrap, provider, namespace),
     require: cfg.require ?? null,
     rotating: cfg.rotating ?? [],
-    namespace: assertNamespace(cfg.namespace ?? DEFAULTS.namespace),
+    namespace,
     narrow: { ...DEFAULTS.narrow, ...(cfg.narrow ?? {}) },
     surface: cfg.surface ?? null,
   });
 }
 
+/**
+ * Fill in the bootstrap block a project did not spell out.
+ *
+ * Both defaults exist because a token stored on the machine was going unread.
+ *
+ * **The key** follows the same convention the repo-less path uses,
+ * `<PROVIDER_VAR>_<namespace>`, so a machine provisioned once serves every
+ * project of that tenant without each restating the name. A project that sets
+ * one keeps it: a name that is not derivable is a legitimate choice, and
+ * overriding it would point sessions at a variable nobody set.
+ *
+ * **The sources** gain `keychain` because `["env"]` alone meant a token in the
+ * OS keychain was never consulted — so the machine setup appeared to work and
+ * every project still failed until someone hand-edited its config. Env stays
+ * first, so a CI runner injecting the bootstrap never reaches for a local store.
+ * On a platform with no keychain the extra source reads as empty and costs
+ * nothing.
+ * @param {object|undefined} bootstrap The project's own block, if any.
+ * @param {string} provider Resolved provider name.
+ * @param {string} namespace Resolved namespace.
+ * @returns {{sources: string[], key: string|null}} The resolved block.
+ */
+function resolveBootstrap(bootstrap, provider, namespace) {
+  const given = bootstrap ?? {};
+  return {
+    sources: given.sources ?? ["env", "keychain"],
+    key: given.key ?? bootstrapKeyFor(provider, namespace),
+  };
+}
+
 /**
  * Build a configuration from the environment, for sessions with no checkout.
  *
@@ -237,10 +293,18 @@ function fromEnvironment(env) {
     namespace: assertNamespace(namespace),
     bootstrap: {
       ...DEFAULTS.bootstrap,
+      // Derived from the provider resolved just above, not from Bitwarden's
+      // name. Hardcoding it told a Doppler tenant to set BWS_ACCESS_TOKEN_<ns>,
+      // which its CLI has never heard of — on the one surface that has no
+      // config file to override the guess.
+      // Same two defaults as a project config gets, for the same reasons —
+      // see `resolveBootstrap`. Stated here too because this path never reads
+      // a file, so it cannot inherit them.
+      sources: ["env", "keychain"],
       key:
         env.LISA_BOOTSTRAP_KEY ??
         env.LISA_SECRETS_BOOTSTRAP_KEY ??
-        `BWS_ACCESS_TOKEN_${namespace}`,
+        bootstrapKeyFor(provider, namespace),
     },
   };
 }

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -885,6 +885,52 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
   return path;
 }
 
+/**
+ * The lines an operator puts above the field, for a session with no checkout.
+ *
+ * Emitted as shell that runs, not as a template with holes: every hole is a
+ * hand substitution in a settings box with no review, which is the failure this
+ * whole file exists to prevent. So a provider that cannot be bootstrapped by an
+ * environment variable gets a sentence explaining that, not an `export` of a
+ * placeholder — a line that would be a syntax error if pasted.
+ *
+ * `LISA_PROVIDER` is exported even though the field defaults it, because the
+ * field's default is Bitwarden. A Doppler tenant that omits it gets `bws`
+ * installed and its own CLI missing, having configured everything correctly.
+ * @param {object} options Resolved identity and display strings.
+ * @returns {string[]} Lines to include in the emitted guidance.
+ */
+function repoLessExports({ namespace, key, provider, bootstrapKey, tenant }) {
+  // Two different reasons the key can be missing, and telling them apart is the
+  // whole value of the message. "Nothing was named" is the operator's to fix by
+  // re-running; "this provider has no such variable" is not fixable at all and
+  // must not read as an omission.
+  if (!tenant) {
+    return [
+      "      # Re-run with --tenant=<name> and these are filled in for you.",
+      `      export LISA_TENANT=${namespace}`,
+      "      export <bootstrap variable>='<read from your credential manager>'",
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  if (!bootstrapKey) {
+    return [
+      `      # ${provider} has no environment-variable bootstrap, so there is`,
+      "      # nothing to export for it. Authenticate it the way its own CLI",
+      "      # expects, then set the three below.",
+      `      export LISA_TENANT=${namespace}`,
+      `      export LISA_PROVIDER=${provider}`,
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  return [
+    `      export LISA_TENANT=${namespace}`,
+    `      export ${key}='<the same value as above>'`,
+    ...(provider ? [`      export LISA_PROVIDER=${provider}`] : []),
+    "      export LISA_SECRETS_SURFACE=claude-web",
+  ];
+}
+
 /**
  * Produce the configuration a human pastes to provision a Claude cloud surface.
  *
@@ -893,11 +939,16 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null}} options Project details.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey }) {
-  const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+export function emitClaudeWeb({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -924,11 +975,9 @@ export function emitClaudeWeb({ bootstrapKey }) {
     "    while the image is being built, before the environment exists. So a",
     "    session with no checkout has to be told its tenant inside the script",
     "    itself, or the field finds nothing to prepare and exits 0 looking like",
-    "    success. Put these three lines FIRST, then the line after them:",
+    "    success. Put the lines below FIRST, then the field after them:",
     "",
-    "      export LISA_TENANT=<your namespace>",
-    `      export ${key}='<the same value as above>'`,
-    "      export LISA_SECRETS_SURFACE=claude-web",
+    ...repoLessExports({ namespace, key, provider, bootstrapKey, tenant }),
     "",
     "    LISA_SECRETS_SURFACE is set explicitly rather than left to detection:",
     "    detection keys off CLAUDE_CODE_REMOTE, and a surface that does not set",
@@ -1096,6 +1145,66 @@ function readBootstrapKey(cwd = process.cwd()) {
   return JSON.parse(readFileSync(path, "utf8")).secrets?.bootstrap?.key ?? null;
 }
 
+/**
+ * Work out what to tell the operator to export, for a surface that has no repo.
+ *
+ * Emitting used to read the key out of `.lisa.config.json` in the working
+ * directory, which made the command that configures a REPO-LESS environment
+ * require a repository — so it was run from a checkout that happened to be
+ * nearby, or it printed a placeholder the operator substituted by hand.
+ *
+ * Explicit flags win, then the environment, then a checkout if the caller
+ * happens to be standing in one, then the convention. The provider matters
+ * because it decides the variable's name: `bws` reads `BWS_ACCESS_TOKEN` and
+ * `doppler` reads `DOPPLER_TOKEN`, so a tenant on one told to export the
+ * other's name gets "Missing access token" from a CLI it did configure.
+ * @param {string[]} argv Process arguments.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @param {string} [cwd] Directory to look for a config in.
+ * @returns {Promise<{tenant: string|null, provider: string, bootstrapKey: string|null}>} Resolved identity.
+ */
+export async function resolveEmitTarget(
+  argv,
+  env = process.env,
+  cwd = process.cwd()
+) {
+  const flag = name =>
+    argv.find(a => a.startsWith(`--${name}=`))?.slice(name.length + 3) ?? null;
+
+  const tenant =
+    flag("tenant") ||
+    (env.LISA_TENANT ?? env.LISA_SECRETS_NAMESPACE ?? "").trim() ||
+    null;
+  const provider =
+    flag("provider") ||
+    (env.LISA_PROVIDER ?? env.LISA_SECRETS_PROVIDER ?? "").trim() ||
+    "bitwarden";
+
+  // Validated before it can reach the output, by the same rule the runtime path
+  // applies. This one becomes `export LISA_TENANT=<value>` in a block an
+  // operator pastes verbatim, so `my tenant` or `has$var` would emit shell that
+  // breaks — or worse, expands — where nothing reviews it. Refusing here costs
+  // a re-run; emitting it costs a container nobody can explain.
+  if (tenant) {
+    const { assertNamespace } = await import(
+      pathToFileURL(siblingScript("lisa-secrets-access", "surfaces.mjs")).href
+    );
+    assertNamespace(tenant);
+  }
+
+  // A configured key outranks the convention: a project may legitimately use a
+  // name that is not derivable, and this command must not tell its operator to
+  // set a different one from the one their sessions actually read.
+  const configured = readBootstrapKey(cwd);
+  if (configured) return { tenant, provider, bootstrapKey: configured };
+  if (!tenant) return { tenant, provider, bootstrapKey: null };
+
+  const { bootstrapKeyFor } = await import(
+    pathToFileURL(siblingScript("lisa-secrets-access", "providers.mjs")).href
+  );
+  return { tenant, provider, bootstrapKey: bootstrapKeyFor(provider, tenant) };
+}
+
 async function main() {
   // `--print-tools` answers "which CLIs does this secret set imply", reading
   // the notes materialized alongside the values.
@@ -1170,7 +1279,7 @@ async function main() {
           `Emitting is implemented for claude-web, which has no other tier.`
       );
     }
-    console.log(emitClaudeWeb({ bootstrapKey: readBootstrapKey() }));
+    console.log(emitClaudeWeb(await resolveEmitTarget(process.argv)));
     return;
   }
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/providers.mjs

@@ -51,6 +51,29 @@ const PROVIDER_BOOTSTRAP_ENV = {
   doppler: "DOPPLER_TOKEN",
 };
 
+/**
+ * The tenant-scoped bootstrap variable a provider expects, by convention.
+ *
+ * Exists so the repo-less path cannot invent one. It used to compose
+ * `BWS_ACCESS_TOKEN_<namespace>` literally, ignoring the provider it had just
+ * resolved — so a Doppler tenant with no checkout was told to set a Bitwarden
+ * variable, and its CLI failed with "Missing access token". That is precisely
+ * the confusion the two questions above are separated to prevent, reintroduced
+ * on the one surface with no config file to correct it.
+ *
+ * `null` for a provider with no env-var bootstrap — 1Password, Vault and AWS
+ * authenticate by other means — because a name invented for them would be a
+ * variable nothing reads, which is worse than admitting there is none.
+ * `providerEnv` already treats an unmapped provider as "inject nothing".
+ * @param {string} provider Provider name.
+ * @param {string} namespace Tenant namespace.
+ * @returns {string|null} The variable to set, or null when the provider has none.
+ */
+export function bootstrapKeyFor(provider, namespace) {
+  const canonical = PROVIDER_BOOTSTRAP_ENV[provider];
+  return canonical ? `${canonical}_${namespace}` : null;
+}
+
 /**
  * Build the child environment for a provider CLI, injecting the bootstrap under
  * the name that CLI actually reads.

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/surfaces.mjs

@@ -17,6 +17,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { bootstrapKeyFor } from "./providers.mjs";
+
 /**
  * Capabilities, per surface.
  *
@@ -79,6 +81,28 @@ export const SURFACES = {
     // recoverable; an absent one means the environment does not work.
     materializeAt: "both",
   },
+  // A container an operator builds and runs themselves — locally, or anywhere
+  // Lisa is not the one provisioning the host.
+  //
+  // It exists because `local` was standing in for it, and `local` is
+  // `materialized: false`. That default is right for a human at a keyboard: the
+  // provider CLI is authenticated, secrets resolve live, and writing them to
+  // disk would be a second copy to keep honest. A container has no keychain and
+  // dies with its filesystem, so the same default leaves it with the CLIs
+  // installed and nothing to authenticate them.
+  //
+  // The workaround was to claim `claude-web`, which materializes correctly and
+  // is a lie — it made a local container indistinguishable from a cloud session
+  // in every diagnostic and log.
+  //
+  // `setup` rather than `both`: a container has no session-start hook to run,
+  // and it is started fresh rather than resumed from a vendor's cache, so the
+  // start of the container IS the refresh.
+  container: {
+    materialized: true,
+    mayWriteValues: true,
+    materializeAt: "setup",
+  },
 };
 
 /** Config defaults when `.lisa.config.json` carries no `secrets` block. */
@@ -185,17 +209,49 @@ export function readConfig(cwd = process.cwd(), env = process.env) {
     throw new Error(`.lisa.config.json is not readable: ${err.message}`);
   }
   if (!cfg) return withSurface(DEFAULTS);
+  const provider = cfg.provider ?? DEFAULTS.provider;
+  const namespace = assertNamespace(cfg.namespace ?? DEFAULTS.namespace);
   return withSurface({
-    provider: cfg.provider ?? DEFAULTS.provider,
-    bootstrap: { ...DEFAULTS.bootstrap, ...(cfg.bootstrap ?? {}) },
+    provider,
+    bootstrap: resolveBootstrap(cfg.bootstrap, provider, namespace),
     require: cfg.require ?? null,
     rotating: cfg.rotating ?? [],
-    namespace: assertNamespace(cfg.namespace ?? DEFAULTS.namespace),
+    namespace,
     narrow: { ...DEFAULTS.narrow, ...(cfg.narrow ?? {}) },
     surface: cfg.surface ?? null,
   });
 }
 
+/**
+ * Fill in the bootstrap block a project did not spell out.
+ *
+ * Both defaults exist because a token stored on the machine was going unread.
+ *
+ * **The key** follows the same convention the repo-less path uses,
+ * `<PROVIDER_VAR>_<namespace>`, so a machine provisioned once serves every
+ * project of that tenant without each restating the name. A project that sets
+ * one keeps it: a name that is not derivable is a legitimate choice, and
+ * overriding it would point sessions at a variable nobody set.
+ *
+ * **The sources** gain `keychain` because `["env"]` alone meant a token in the
+ * OS keychain was never consulted — so the machine setup appeared to work and
+ * every project still failed until someone hand-edited its config. Env stays
+ * first, so a CI runner injecting the bootstrap never reaches for a local store.
+ * On a platform with no keychain the extra source reads as empty and costs
+ * nothing.
+ * @param {object|undefined} bootstrap The project's own block, if any.
+ * @param {string} provider Resolved provider name.
+ * @param {string} namespace Resolved namespace.
+ * @returns {{sources: string[], key: string|null}} The resolved block.
+ */
+function resolveBootstrap(bootstrap, provider, namespace) {
+  const given = bootstrap ?? {};
+  return {
+    sources: given.sources ?? ["env", "keychain"],
+    key: given.key ?? bootstrapKeyFor(provider, namespace),
+  };
+}
+
 /**
  * Build a configuration from the environment, for sessions with no checkout.
  *
@@ -237,10 +293,18 @@ function fromEnvironment(env) {
     namespace: assertNamespace(namespace),
     bootstrap: {
       ...DEFAULTS.bootstrap,
+      // Derived from the provider resolved just above, not from Bitwarden's
+      // name. Hardcoding it told a Doppler tenant to set BWS_ACCESS_TOKEN_<ns>,
+      // which its CLI has never heard of — on the one surface that has no
+      // config file to override the guess.
+      // Same two defaults as a project config gets, for the same reasons —
+      // see `resolveBootstrap`. Stated here too because this path never reads
+      // a file, so it cannot inherit them.
+      sources: ["env", "keychain"],
       key:
         env.LISA_BOOTSTRAP_KEY ??
         env.LISA_SECRETS_BOOTSTRAP_KEY ??
-        `BWS_ACCESS_TOKEN_${namespace}`,
+        bootstrapKeyFor(provider, namespace),
     },
   };
 }

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -885,6 +885,52 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
   return path;
 }
 
+/**
+ * The lines an operator puts above the field, for a session with no checkout.
+ *
+ * Emitted as shell that runs, not as a template with holes: every hole is a
+ * hand substitution in a settings box with no review, which is the failure this
+ * whole file exists to prevent. So a provider that cannot be bootstrapped by an
+ * environment variable gets a sentence explaining that, not an `export` of a
+ * placeholder — a line that would be a syntax error if pasted.
+ *
+ * `LISA_PROVIDER` is exported even though the field defaults it, because the
+ * field's default is Bitwarden. A Doppler tenant that omits it gets `bws`
+ * installed and its own CLI missing, having configured everything correctly.
+ * @param {object} options Resolved identity and display strings.
+ * @returns {string[]} Lines to include in the emitted guidance.
+ */
+function repoLessExports({ namespace, key, provider, bootstrapKey, tenant }) {
+  // Two different reasons the key can be missing, and telling them apart is the
+  // whole value of the message. "Nothing was named" is the operator's to fix by
+  // re-running; "this provider has no such variable" is not fixable at all and
+  // must not read as an omission.
+  if (!tenant) {
+    return [
+      "      # Re-run with --tenant=<name> and these are filled in for you.",
+      `      export LISA_TENANT=${namespace}`,
+      "      export <bootstrap variable>='<read from your credential manager>'",
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  if (!bootstrapKey) {
+    return [
+      `      # ${provider} has no environment-variable bootstrap, so there is`,
+      "      # nothing to export for it. Authenticate it the way its own CLI",
+      "      # expects, then set the three below.",
+      `      export LISA_TENANT=${namespace}`,
+      `      export LISA_PROVIDER=${provider}`,
+      "      export LISA_SECRETS_SURFACE=claude-web",
+    ];
+  }
+  return [
+    `      export LISA_TENANT=${namespace}`,
+    `      export ${key}='<the same value as above>'`,
+    ...(provider ? [`      export LISA_PROVIDER=${provider}`] : []),
+    "      export LISA_SECRETS_SURFACE=claude-web",
+  ];
+}
+
 /**
  * Produce the configuration a human pastes to provision a Claude cloud surface.
  *
@@ -893,11 +939,16 @@ export function pinEnvironment(environmentId, cwd = process.cwd()) {
  * settings page, no direct URL, and no endpoint. Emit is not a degraded option
  * here, it is the only one — so the read-back in `verify-remote-env.mjs` is
  * what makes the result trustworthy, exactly as it would be at any other tier.
- * @param {{bootstrapKey: string|null}} options Project details.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
  * @returns {string} Text to show the operator.
  */
-export function emitClaudeWeb({ bootstrapKey }) {
-  const key = bootstrapKey ?? "<secrets.bootstrap.key is not configured>";
+export function emitClaudeWeb({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
   return [
     "Provisioning tier: EMIT — and for this surface that is the only tier.",
     "  A Claude cloud environment is account-scoped configuration edited in the",
@@ -924,11 +975,9 @@ export function emitClaudeWeb({ bootstrapKey }) {
     "    while the image is being built, before the environment exists. So a",
     "    session with no checkout has to be told its tenant inside the script",
     "    itself, or the field finds nothing to prepare and exits 0 looking like",
-    "    success. Put these three lines FIRST, then the line after them:",
+    "    success. Put the lines below FIRST, then the field after them:",
     "",
-    "      export LISA_TENANT=<your namespace>",
-    `      export ${key}='<the same value as above>'`,
-    "      export LISA_SECRETS_SURFACE=claude-web",
+    ...repoLessExports({ namespace, key, provider, bootstrapKey, tenant }),
     "",
     "    LISA_SECRETS_SURFACE is set explicitly rather than left to detection:",
     "    detection keys off CLAUDE_CODE_REMOTE, and a surface that does not set",
@@ -1096,6 +1145,66 @@ function readBootstrapKey(cwd = process.cwd()) {
   return JSON.parse(readFileSync(path, "utf8")).secrets?.bootstrap?.key ?? null;
 }
 
+/**
+ * Work out what to tell the operator to export, for a surface that has no repo.
+ *
+ * Emitting used to read the key out of `.lisa.config.json` in the working
+ * directory, which made the command that configures a REPO-LESS environment
+ * require a repository — so it was run from a checkout that happened to be
+ * nearby, or it printed a placeholder the operator substituted by hand.
+ *
+ * Explicit flags win, then the environment, then a checkout if the caller
+ * happens to be standing in one, then the convention. The provider matters
+ * because it decides the variable's name: `bws` reads `BWS_ACCESS_TOKEN` and
+ * `doppler` reads `DOPPLER_TOKEN`, so a tenant on one told to export the
+ * other's name gets "Missing access token" from a CLI it did configure.
+ * @param {string[]} argv Process arguments.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @param {string} [cwd] Directory to look for a config in.
+ * @returns {Promise<{tenant: string|null, provider: string, bootstrapKey: string|null}>} Resolved identity.
+ */
+export async function resolveEmitTarget(
+  argv,
+  env = process.env,
+  cwd = process.cwd()
+) {
+  const flag = name =>
+    argv.find(a => a.startsWith(`--${name}=`))?.slice(name.length + 3) ?? null;
+
+  const tenant =
+    flag("tenant") ||
+    (env.LISA_TENANT ?? env.LISA_SECRETS_NAMESPACE ?? "").trim() ||
+    null;
+  const provider =
+    flag("provider") ||
+    (env.LISA_PROVIDER ?? env.LISA_SECRETS_PROVIDER ?? "").trim() ||
+    "bitwarden";
+
+  // Validated before it can reach the output, by the same rule the runtime path
+  // applies. This one becomes `export LISA_TENANT=<value>` in a block an
+  // operator pastes verbatim, so `my tenant` or `has$var` would emit shell that
+  // breaks — or worse, expands — where nothing reviews it. Refusing here costs
+  // a re-run; emitting it costs a container nobody can explain.
+  if (tenant) {
+    const { assertNamespace } = await import(
+      pathToFileURL(siblingScript("lisa-secrets-access", "surfaces.mjs")).href
+    );
+    assertNamespace(tenant);
+  }
+
+  // A configured key outranks the convention: a project may legitimately use a
+  // name that is not derivable, and this command must not tell its operator to
+  // set a different one from the one their sessions actually read.
+  const configured = readBootstrapKey(cwd);
+  if (configured) return { tenant, provider, bootstrapKey: configured };
+  if (!tenant) return { tenant, provider, bootstrapKey: null };
+
+  const { bootstrapKeyFor } = await import(
+    pathToFileURL(siblingScript("lisa-secrets-access", "providers.mjs")).href
+  );
+  return { tenant, provider, bootstrapKey: bootstrapKeyFor(provider, tenant) };
+}
+
 async function main() {
   // `--print-tools` answers "which CLIs does this secret set imply", reading
   // the notes materialized alongside the values.
@@ -1170,7 +1279,7 @@ async function main() {
           `Emitting is implemented for claude-web, which has no other tier.`
       );
     }
-    console.log(emitClaudeWeb({ bootstrapKey: readBootstrapKey() }));
+    console.log(emitClaudeWeb(await resolveEmitTarget(process.argv)));
     return;
   }
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.338.4",
+  "version": "2.339.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"