@codyswann/lisa 2.339.0 → 2.341.0

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/environment.mjs

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+/**
+ * Configure one surface for one tenant.
+ *
+ * One verb, one axis — *which surface* — and the only difference between them
+ * is whether Lisa can execute there or has to hand an operator text to paste.
+ *
+ *     environment local        runs it here
+ *     environment container    emits an image definition and a run command
+ *     environment claude-web   emits, because the dialog has no API
+ *     environment codex-cloud  emits, same reason
+ *
+ * This replaces `remote-env --emit=<surface>`, whose name described the
+ * machinery rather than the task: from a laptop, `remote-env` reads as
+ * "prepare the remote environment I am currently in", which is the opposite of
+ * what an operator configuring a cloud environment is doing. The old spelling
+ * still works so nothing in flight breaks.
+ *
+ * `workstation` remains a separate command and a separate concern: it answers
+ * "what binaries does this machine have", with no tenant and no credentials. So
+ * **rotating a token is `environment local` again**, not re-running an
+ * installer that wants to reinstall six coding agents.
+ * @module environment
+ */
+
+import { pathToFileURL } from "node:url";
+
+/** Surfaces this command can configure, and how each is delivered. */
+export const TARGETS = {
+  local: { mode: "run", label: "this machine" },
+  container: { mode: "emit", label: "a container image you build" },
+  "claude-web": { mode: "emit", label: "a Claude cloud environment" },
+  "codex-cloud": { mode: "emit", label: "a Codex Cloud environment" },
+};
+
+/**
+ * Resolve the surface name an operator asked for.
+ *
+ * An unknown name is an error rather than a default, because defaulting would
+ * configure something other than what they typed — and on this command the
+ * difference between surfaces is where a credential ends up.
+ * @param {string|undefined} name Requested surface.
+ * @returns {string} A key of {@link TARGETS}.
+ */
+export function assertTarget(name) {
+  if (!name || !TARGETS[name]) {
+    throw new Error(
+      `unknown environment "${name ?? ""}".\n` +
+        `Known: ${Object.keys(TARGETS).join(", ")}`
+    );
+  }
+  return name;
+}
+
+/**
+ * Prepare THIS machine: store the bootstrap, then materialize.
+ *
+ * The prompt is skipped rather than blocked when nothing can answer it, and
+ * skipped rather than repeated when the machine already holds a bootstrap —
+ * `environment local` is also how an operator re-materializes after rotating a
+ * secret in the vault, and demanding the token again every time would make the
+ * common case the tedious one. `--rotate` is how you say you mean to replace it.
+ * @param {object} options Resolved tenant, provider and flags.
+ * @param {object} [deps] Injected seams, for tests.
+ * @returns {Promise<string[]>} Lines to report.
+ */
+export async function configureLocal(options, deps = {}) {
+  const { tenant, provider, bootstrapKey: key, rotate = false } = options;
+  const lines = [];
+
+  // A tenant is required here, unlike the emit paths, because this one WRITES.
+  // Without it the config falls back to the default namespace and materializes
+  // one tenant's credentials into another's directory — and on a machine
+  // serving several, the two would then share a store.
+  if (!tenant) {
+    throw new Error(
+      "environment local needs --tenant=<name>.\n" +
+        "It writes credentials into a per-tenant directory, so guessing the " +
+        "name would put one tenant's secrets where another's sessions read."
+    );
+  }
+
+  const wired = deps.prompt
+    ? deps
+    : { ...(await localDeps({ tenant, provider })), ...deps };
+  const { canPrompt, promptSecret } = wired.prompt;
+  const { storeBootstrap, hasBootstrap } = wired.store;
+  const materialize = wired.materialize;
+
+  if (!key) {
+    lines.push(
+      `${provider} has no environment-variable bootstrap, so there is nothing`,
+      `to store. Authenticate it the way its own CLI expects.`
+    );
+  } else if (hasBootstrap(key) && !rotate) {
+    lines.push(`${key} is already stored; pass --rotate to replace it.`);
+  } else if (!canPrompt()) {
+    // Not fatal. A non-interactive caller can legitimately have supplied the
+    // bootstrap through the environment, and refusing would break that.
+    lines.push(
+      `No terminal to prompt on, so ${key} was not stored.`,
+      `Set it in the environment, or re-run where a human can type.`
+    );
+  } else {
+    const value = promptSecret(`Paste the access token for ${tenant}: `);
+    if (!value) {
+      lines.push(`Nothing entered, so ${key} was not stored.`);
+    } else {
+      const { where } = storeBootstrap(key, value);
+      lines.push(`Stored ${key} in ${where}.`);
+    }
+  }
+
+  const result = await materialize();
+  lines.push(...result);
+  return lines;
+}
+
+/**
+ * Run the command.
+ * @param {string[]} argv Arguments after the command name.
+ * @param {object} [deps] Injected seams, for tests.
+ * @returns {Promise<number>} Exit code.
+ */
+export async function run(argv, deps = {}) {
+  const out = deps.log ?? console.log;
+  const err = deps.error ?? console.error;
+
+  try {
+    const target = assertTarget(argv.find(a => !a.startsWith("-")));
+    const resolve = deps.resolveTarget ?? (await defaultResolver());
+    const identity = await resolve(argv);
+
+    if (TARGETS[target].mode === "run") {
+      const lines = await (deps.configureLocal ?? configureLocal)(
+        { ...identity, rotate: argv.includes("--rotate") },
+        deps
+      );
+      out(lines.join("\n"));
+      return 0;
+    }
+
+    out((deps.emit ?? (await defaultEmitter()))(target, identity));
+    return 0;
+  } catch (error) {
+    err(String(error.message));
+    return 1;
+  }
+}
+
+// Executed directly by the CLI, imported by tests. Without this the module
+// exported a `run` nobody called and the command printed nothing at all.
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  run(process.argv.slice(2)).then(code => {
+    process.exitCode = code;
+  });
+}
+
+/**
+ * Wire the local path to the real prompt, store and materializer.
+ *
+ * Loaded lazily so the emit paths — which need none of it — do not pay for it,
+ * and so tests can substitute the lot without touching a keychain or a vault.
+ *
+ * `materialize` is called with `requested: true`: the operator typed the
+ * command whose purpose is to put credentials on this machine, which is a
+ * different question from whether an automated flow may write here. The
+ * capability guard still refuses the automated case.
+ * @returns {Promise<object>} Default dependencies for `configureLocal`.
+ */
+async function localDeps(identity) {
+  const at = name =>
+    new URL(`../../lisa-secrets-access/scripts/${name}`, import.meta.url).href;
+  const prompt = await import(at("prompt-secret.mjs"));
+  const store = await import(at("bootstrap-store.mjs"));
+  const secrets = await import(at("materialize-secrets.mjs"));
+  const surfaces = await import(at("surfaces.mjs"));
+
+  return {
+    prompt,
+    store,
+    materialize: () => {
+      // The NAMED tenant, not whatever config the working directory holds.
+      // Reading the directory materialized the default namespace instead of the
+      // one on the command line — observed writing 49 secrets of the wrong
+      // tenant into the wrong directory.
+      const { count, derived, dir, profiles } = secrets.materialize(
+        surfaces.configForTenant(identity),
+        { requested: true }
+      );
+      return [
+        `Materialized ${count} secret(s) into ${dir}.`,
+        ...(derived ? [`${derived} variable(s) derived from the bundle.`] : []),
+        ...(profiles?.length
+          ? [`AWS profiles installed: ${profiles.join(", ")}`]
+          : []),
+      ];
+    },
+  };
+}
+
+/**
+ * Load the identity resolver from the sibling runner.
+ * @returns {Promise<Function>} The resolver.
+ */
+async function defaultResolver() {
+  // Already a URL — passing it through pathToFileURL again throws.
+  const mod = await import(
+    new URL("./setup-remote-env.mjs", import.meta.url).href
+  );
+  return argv => mod.resolveEmitTarget(argv);
+}
+
+/**
+ * Load the emitter from the sibling runner.
+ * @returns {Promise<Function>} The emitter.
+ */
+async function defaultEmitter() {
+  // Already a URL — passing it through pathToFileURL again throws.
+  const mod = await import(
+    new URL("./setup-remote-env.mjs", import.meta.url).href
+  );
+  return (target, identity) => mod.emitFor(target, identity);
+}

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -1030,6 +1030,142 @@ export function emitClaudeWeb({
   ].join("\n");
 }
 
+/**
+ * Emit the configuration for a surface Lisa cannot reach.
+ *
+ * Dispatch rather than four call sites, so `environment` names a surface and
+ * nothing downstream has to know which of them has an API and which does not.
+ * @param {string} target Surface name.
+ * @param {object} identity Resolved tenant, provider and bootstrap key.
+ * @returns {string} Text to show the operator.
+ */
+export function emitFor(target, identity) {
+  if (target === "claude-web") return emitClaudeWeb(identity);
+  if (target === "codex-cloud") return emitCodexCloud(identity);
+  if (target === "container") return emitContainer(identity);
+  throw new Error(`no emit template for surface "${target}".`);
+}
+
+/**
+ * Produce the configuration a human pastes into a Codex Cloud environment.
+ *
+ * Differs from Claude's in three ways that are properties of the vendor rather
+ * than of Lisa, and each has cost someone a debugging session.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
+ * @returns {string} Text to show the operator.
+ */
+export function emitCodexCloud({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
+  return [
+    "Provisioning tier: EMIT — Codex Cloud exposes no environment API.",
+    "  `codex cloud` offers exec, status and list; nothing that writes an",
+    "  environment. So this is text for the settings page.",
+    "",
+    "Paste into the environment settings",
+    "-----------------------------------",
+    "  Repository:        the DEFAULT checkout for this environment",
+    "",
+    "  Environment variables — NOT task secrets:",
+    // Written as name=value, not as `export name='value'`. This is a settings
+    // form, not a shell: the quotes would be stored as part of the value, and
+    // the surface named must be this one rather than the shell block's.
+    `    LISA_TENANT=${namespace}`,
+    ...(bootstrapKey
+      ? [`    ${key}=<read this from your credential manager>`]
+      : [`    (${provider} has no environment-variable bootstrap)`]),
+    ...(provider ? [`    LISA_PROVIDER=${provider}`] : []),
+    "    LISA_SECRETS_SURFACE=codex-cloud",
+    "",
+    "    Setup and cache-resume maintenance both run BEFORE task secrets",
+    "    exist, so a bootstrap placed in the secrets box is invisible to the",
+    "    only two steps that need it.",
+    "",
+    "  Setup script:",
+    `    ${SETUP_FIELD}`,
+    "",
+    "  Maintenance script:",
+    "    The SAME line. It runs when a container resumes from cache, and every",
+    "    step is idempotent and version-aware — so running it again is how a",
+    "    rotated value, an edited note, or a changed pin gets picked up.",
+    "",
+    "Watch for",
+    "---------",
+    "  CODEX_ENV_NODE_VERSION overrides the repository's own .nvmrc and",
+    "  engines. An environment left on an older major breaks setup for a repo",
+    "  that requires a newer one, and the error blames the package manager.",
+    "",
+    "  Codex clones `main`, not the repository's default branch. If those",
+    "  differ here, that is where the confusion starts.",
+    "",
+    "  Setup logs are visible only in the Codex UI; no CLI retrieves them.",
+  ].join("\n");
+}
+
+/**
+ * Produce an image definition and a run command for a container.
+ *
+ * Split across build and run on purpose: the binaries are baked once, and the
+ * credential arrives at `docker run`. Baking it would put it in an image layer,
+ * readable by anyone who can pull the image and surviving every
+ * `docker history` — so the Dockerfile deliberately contains no secret.
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
+ * @returns {string} Text to show the operator.
+ */
+export function emitContainer({
+  bootstrapKey,
+  tenant = null,
+  provider = null,
+}) {
+  const key = bootstrapKey ?? "<not resolved>";
+  const namespace = tenant ?? "<your namespace>";
+  return [
+    "Provisioning tier: EMIT — an image is built from a file you own.",
+    "",
+    "Dockerfile",
+    "----------",
+    "  Generate it with the bootstrap's own emitter, so the image and this",
+    "  machine install the identical set:",
+    "",
+    "    npx -y @codyswann/lisa@latest workstation --print-dockerfile \\",
+    `      --provider=${provider ?? "bitwarden"} > Dockerfile.lisa`,
+    "    docker build -f Dockerfile.lisa -t lisa-workstation .",
+    "",
+    "  Nothing secret belongs in it. An image layer is readable by anyone who",
+    "  can pull the image and survives every `docker history`, so the",
+    "  credential arrives at run time instead.",
+    "",
+    "docker run",
+    "----------",
+    "  docker run --rm -it \\",
+    `    -e LISA_TENANT=${namespace} \\`,
+    `    -e ${key}="<this image's own access token>" \\`,
+    ...(provider ? [`    -e LISA_PROVIDER=${provider} \\`] : []),
+    "    -e LISA_SECRETS_SURFACE=container \\",
+    '    -v "$PWD:/work" -w /work \\',
+    "    lisa-workstation",
+    "",
+    "  LISA_SECRETS_SURFACE=container is what makes credentials materialize.",
+    "  Left to detection a container reads as `local`, which is",
+    "  materialized:false — right for a human at a keyboard whose provider CLI",
+    "  is authenticated, wrong for a container that has no keychain and dies",
+    "  with its filesystem.",
+    "",
+    "  Give the image its own access token rather than reusing this machine's.",
+    "  If the image is shared, so is anything its token can read.",
+    "",
+    "Mounted repositories need nothing further",
+    "-----------------------------------------",
+    "  A checkout you have already run `apply` and `sync` on carries its",
+    "  .lisa.config.json with it. Cloning INSIDE the container instead means",
+    "  running those there.",
+  ].join("\n");
+}
+
 /**
  * Report tooling the project appears to need but has not declared.
  *

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.339.0",
+  "version": "2.341.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/bootstrap-store.mjs

@@ -0,0 +1,232 @@
+/**
+ * Store the one credential that unlocks the provider, on the machine that needs
+ * it.
+ *
+ * Reading it already existed; writing it did not, so every operator ran a
+ * platform-specific `security add-generic-password` copied from documentation.
+ * That is a command with a credential in it, typed by hand, on the one value
+ * whose compromise costs every other secret.
+ *
+ * **Two stores, because there is no third option.** macOS has a keychain that
+ * is encrypted at rest and unlocked with the login session. Linux has no
+ * equivalent that can be assumed present — libsecret needs a running daemon and
+ * a desktop session, which a server or a container does not have. So the
+ * fallback is a `0600` file under `$XDG_CONFIG_HOME`, which is the same
+ * protection the materialized secrets file already relies on. It is weaker than
+ * a keychain and it is stated as such, rather than pretending the two are equal.
+ * @module bootstrap-store
+ */
+
+import { execFileSync } from "node:child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+/**
+ * Where a file-backed bootstrap lives, for platforms with no keychain.
+ * @param {string} key Bootstrap variable name.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @returns {string} Absolute path.
+ */
+export function bootstrapFile(key, env = process.env) {
+  const root = env.XDG_CONFIG_HOME || join(env.HOME || homedir(), ".config");
+  return join(root, "lisa", "bootstrap", assertKey(key));
+}
+
+/**
+ * Reject a key that is not exactly one safe path segment.
+ *
+ * The key is joined onto a directory, and every entry point — store, clear and
+ * read — routes through that join. A `/` or a `..` in it escapes the bootstrap
+ * directory, so an unvalidated key can write, delete, or read an arbitrary file
+ * as the operator. Validating in `bootstrapFile` covers all three at once
+ * rather than trusting each caller to remember.
+ *
+ * Same guard `assertNamespace` applies to the namespace, and for the same
+ * reason. The character set is what a variable name can hold anyway, so nothing
+ * legitimate is refused.
+ * @param {string} key Candidate bootstrap variable name.
+ * @returns {string} The key, unchanged, when valid.
+ */
+export function assertKey(key) {
+  if (
+    typeof key !== "string" ||
+    !/^[A-Za-z0-9._-]+$/.test(key) ||
+    key === ".."
+  ) {
+    throw new Error(
+      `bootstrap key must be one safe path segment, got ${JSON.stringify(key)}`
+    );
+  }
+  return key;
+}
+
+/**
+ * Quote a word for `security -i`, which tokenizes its stdin like a shell.
+ *
+ * A token is usually base64-ish and needs no quoting, but "usually" is not a
+ * property to rely on for a credential: an unquoted value containing a space
+ * would be parsed as two arguments and silently store only the first part.
+ * A newline is refused outright rather than escaped, because it terminates the
+ * command line and there is no quoting that survives it.
+ * @param {string} word Value to quote.
+ * @returns {string} A single quoted token.
+ */
+function quote(word) {
+  if (/[\n\r]/.test(word)) {
+    throw new Error("bootstrap value must not contain a newline");
+  }
+  return `"${String(word).replace(/(["\\])/g, "\\$1")}"`;
+}
+
+/**
+ * Which store this platform uses.
+ * @param {string} [platform] Platform name, injectable for tests.
+ * @returns {"keychain"|"file"} The store.
+ */
+export function storeKind(platform = process.platform) {
+  return platform === "darwin" ? "keychain" : "file";
+}
+
+/**
+ * Write the bootstrap where this machine's sessions will look for it.
+ *
+ * The value never reaches a command line on either path. The keychain path
+ * feeds `security -i` a command stream on **stdin**, because an argument is
+ * visible in `ps` to every process running as this user for as long as the call
+ * lasts. The file path writes and chmods a temporary before renaming, so the
+ * credential is never briefly world-readable on a filesystem where the default
+ * umask would have made it so.
+ * @param {string} key Bootstrap variable name.
+ * @param {string} value The token.
+ * @param {object} [deps] Injected seams, for tests.
+ * @returns {{kind: string, where: string}} Where it went.
+ */
+export function storeBootstrap(key, value, deps = {}) {
+  const kind = deps.kind ?? storeKind();
+  const env = deps.env ?? process.env;
+
+  if (kind === "keychain") {
+    const run = deps.run ?? execFileSync;
+    assertKey(key);
+    // `security -i` reads a COMMAND STREAM on stdin, which is what keeps the
+    // value out of `argv` — where `ps` would show it to every process running
+    // as this user for as long as the call lasts.
+    //
+    // The obvious `-w` with no argument does NOT read the password from stdin.
+    // It opens an interactive prompt on the terminal, and with stdin piped it
+    // stores an EMPTY value and exits 0 — verified against the real binary,
+    // which is how this shipped broken the first time: unit tests injected the
+    // runner and never executed it.
+    //
+    // `-U` updates in place; without it a second run fails with "already
+    // exists", making rotation — the common case — the broken one.
+    run("security", ["-i"], {
+      input: `add-generic-password -U -s ${quote(key)} -a ${quote(
+        env.USER ?? ""
+      )} -w ${quote(value)}\n`,
+      stdio: ["pipe", "ignore", "ignore"],
+    });
+    return { kind, where: `keychain (service ${key})` };
+  }
+
+  const path = deps.path ?? bootstrapFile(key, env);
+  const write = deps.write ?? writeFileSync;
+  const chmod = deps.chmod ?? chmodSync;
+  const rename = deps.rename ?? renameSync;
+  const makeDir = deps.mkdir ?? mkdirSync;
+
+  makeDir(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.tmp`;
+  // mode on write applies only when the file is CREATED, so an existing
+  // temporary from a crashed run would keep its old permissions. chmod after
+  // writing is what makes 0600 true rather than usually true.
+  write(temporary, `${value}\n`, { mode: 0o600 });
+  chmod(temporary, 0o600);
+  rename(temporary, path);
+  return { kind, where: path };
+}
+
+/**
+ * Remove a stored bootstrap, so a rotation can be proven rather than assumed.
+ * @param {string} key Bootstrap variable name.
+ * @param {object} [deps] Injected seams, for tests.
+ */
+export function clearBootstrap(key, deps = {}) {
+  const kind = deps.kind ?? storeKind();
+  const env = deps.env ?? process.env;
+
+  if (kind === "keychain") {
+    const run = deps.run ?? execFileSync;
+    try {
+      run(
+        "security",
+        ["delete-generic-password", "-s", key, "-a", env.USER ?? ""],
+        {
+          stdio: "ignore",
+        }
+      );
+    } catch {
+      // Absent is the desired state, and `security` exits non-zero for it.
+    }
+    return;
+  }
+  const remove = deps.remove ?? rmSync;
+  remove(deps.path ?? bootstrapFile(key, env), { force: true });
+}
+
+/**
+ * Whether this machine already holds a bootstrap under that name.
+ *
+ * Asked so `environment local` can re-materialize after a rotation in the vault
+ * without demanding the token again — that is the common case, and prompting
+ * every time would make it the tedious one.
+ *
+ * Presence only. The value is never read here, because nothing about deciding
+ * whether to prompt needs it.
+ * @param {string} key Bootstrap variable name.
+ * @param {object} [deps] Injected seams, for tests.
+ * @returns {boolean} True when a value is stored.
+ */
+export function hasBootstrap(key, deps = {}) {
+  const kind = deps.kind ?? storeKind();
+  const env = deps.env ?? process.env;
+
+  if (kind === "keychain") {
+    const run = deps.run ?? execFileSync;
+    try {
+      run(
+        "security",
+        ["find-generic-password", "-s", assertKey(key), "-a", env.USER ?? ""],
+        { stdio: "ignore" }
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return (deps.exists ?? existsSync)(deps.path ?? bootstrapFile(key, env));
+}
+
+/**
+ * Read a file-backed bootstrap, treating absence as empty.
+ *
+ * The keychain reader lives beside the other provider concerns in
+ * `providers.mjs`; this is its counterpart for platforms without one.
+ * @param {string} key Bootstrap variable name.
+ * @param {Record<string, string|undefined>} [env] Environment to read.
+ * @returns {string} The value, or an empty string.
+ */
+export function readBootstrapFile(key, env = process.env) {
+  const path = bootstrapFile(key, env);
+  if (!existsSync(path)) return "";
+  return readFileSync(path, "utf8").trim();
+}

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -299,12 +299,28 @@ export function installAwsProfiles(bundle, options = {}) {
   return rendered.profiles;
 }
 
-export function materialize(cfg = readConfig()) {
-  if (!cfg.capabilities.mayWriteValues) {
+export function materialize(cfg = readConfig(), options = {}) {
+  // `requested` distinguishes an OPERATOR asking from a flow deciding.
+  //
+  // The capability governs automated behaviour: a session-start hook on a
+  // laptop must not write credentials to disk, because the provider CLI is
+  // authenticated there and a copy would add drift and exposure without adding
+  // capability. That reasoning holds, and the guard below still enforces it.
+  //
+  // It does not hold for `lisa environment local`, where the operator typed the
+  // command whose entire purpose is to put credentials on this machine — the
+  // AWS `-static` profiles reference variables that exist only once the env
+  // file is materialized, so refusing there means the profiles never work.
+  //
+  // Two different questions, so two different answers, rather than flipping
+  // `local` to `materialized: true` and silently starting to write on every
+  // machine that upgrades.
+  if (!cfg.capabilities.mayWriteValues && !options.requested) {
     throw new Error(
       `surface "${cfg.surface}" may not write secret values to disk.\n` +
         `It can read through to the provider, so a copy on disk would add drift ` +
-        `and exposure without adding capability.`
+        `and exposure without adding capability.\n` +
+        `Run 'lisa environment local --tenant=<name>' to ask for it explicitly.`
     );
   }