@codyswann/lisa 2.339.0 → 2.341.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (103) hide show
  1. package/dist/cli/environment-cmd.d.ts +40 -0
  2. package/dist/cli/environment-cmd.d.ts.map +1 -0
  3. package/dist/cli/environment-cmd.js +84 -0
  4. package/dist/cli/environment-cmd.js.map +1 -0
  5. package/dist/cli/index.d.ts.map +1 -1
  6. package/dist/cli/index.js +2 -0
  7. package/dist/cli/index.js.map +1 -1
  8. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  9. package/dist/core/upstream-evidence-manifest.js +30 -4
  10. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  11. package/package.json +1 -1
  12. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  13. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  14. package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  15. package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  16. package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  17. package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  18. package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  19. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  20. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
  21. package/plugins/lisa/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  22. package/plugins/lisa/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  23. package/plugins/lisa/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  24. package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  25. package/plugins/lisa/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  26. package/plugins/lisa/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  27. package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
  28. package/plugins/lisa-agy/plugin.json +1 -1
  29. package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  30. package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  31. package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  32. package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  33. package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  34. package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  35. package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
  36. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  37. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  38. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  39. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  40. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  41. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  42. package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  43. package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  44. package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  45. package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  46. package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  47. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  48. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
  49. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  50. package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  51. package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  52. package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  53. package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  54. package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  55. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  56. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
  57. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  58. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  59. package/plugins/lisa-expo-agy/plugin.json +1 -1
  60. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  61. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  62. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  63. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  64. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  65. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  66. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  67. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  68. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  69. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  70. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  71. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  72. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  73. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  74. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  75. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  76. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  77. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  78. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  79. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  80. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  81. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  82. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  83. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  84. package/plugins/lisa-rails-agy/plugin.json +1 -1
  85. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  86. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  87. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  88. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  89. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  90. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  91. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  92. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  93. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  94. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  95. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  96. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  97. package/plugins/src/base/skills/lisa-secrets-access/scripts/bootstrap-store.mjs +232 -0
  98. package/plugins/src/base/skills/lisa-secrets-access/scripts/materialize-secrets.mjs +19 -3
  99. package/plugins/src/base/skills/lisa-secrets-access/scripts/prompt-secret.mjs +79 -0
  100. package/plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs +21 -3
  101. package/plugins/src/base/skills/lisa-secrets-access/scripts/surfaces.mjs +27 -0
  102. package/plugins/src/base/skills/lisa-setup-remote-env/scripts/environment.mjs +227 -0
  103. package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +136 -0
@@ -0,0 +1,227 @@
1
+ #!/usr/bin/env node
2
+ /**
3
+ * Configure one surface for one tenant.
4
+ *
5
+ * One verb, one axis — *which surface* — and the only difference between them
6
+ * is whether Lisa can execute there or has to hand an operator text to paste.
7
+ *
8
+ * environment local runs it here
9
+ * environment container emits an image definition and a run command
10
+ * environment claude-web emits, because the dialog has no API
11
+ * environment codex-cloud emits, same reason
12
+ *
13
+ * This replaces `remote-env --emit=<surface>`, whose name described the
14
+ * machinery rather than the task: from a laptop, `remote-env` reads as
15
+ * "prepare the remote environment I am currently in", which is the opposite of
16
+ * what an operator configuring a cloud environment is doing. The old spelling
17
+ * still works so nothing in flight breaks.
18
+ *
19
+ * `workstation` remains a separate command and a separate concern: it answers
20
+ * "what binaries does this machine have", with no tenant and no credentials. So
21
+ * **rotating a token is `environment local` again**, not re-running an
22
+ * installer that wants to reinstall six coding agents.
23
+ * @module environment
24
+ */
25
+
26
+ import { pathToFileURL } from "node:url";
27
+
28
+ /** Surfaces this command can configure, and how each is delivered. */
29
+ export const TARGETS = {
30
+ local: { mode: "run", label: "this machine" },
31
+ container: { mode: "emit", label: "a container image you build" },
32
+ "claude-web": { mode: "emit", label: "a Claude cloud environment" },
33
+ "codex-cloud": { mode: "emit", label: "a Codex Cloud environment" },
34
+ };
35
+
36
+ /**
37
+ * Resolve the surface name an operator asked for.
38
+ *
39
+ * An unknown name is an error rather than a default, because defaulting would
40
+ * configure something other than what they typed — and on this command the
41
+ * difference between surfaces is where a credential ends up.
42
+ * @param {string|undefined} name Requested surface.
43
+ * @returns {string} A key of {@link TARGETS}.
44
+ */
45
+ export function assertTarget(name) {
46
+ if (!name || !TARGETS[name]) {
47
+ throw new Error(
48
+ `unknown environment "${name ?? ""}".\n` +
49
+ `Known: ${Object.keys(TARGETS).join(", ")}`
50
+ );
51
+ }
52
+ return name;
53
+ }
54
+
55
+ /**
56
+ * Prepare THIS machine: store the bootstrap, then materialize.
57
+ *
58
+ * The prompt is skipped rather than blocked when nothing can answer it, and
59
+ * skipped rather than repeated when the machine already holds a bootstrap —
60
+ * `environment local` is also how an operator re-materializes after rotating a
61
+ * secret in the vault, and demanding the token again every time would make the
62
+ * common case the tedious one. `--rotate` is how you say you mean to replace it.
63
+ * @param {object} options Resolved tenant, provider and flags.
64
+ * @param {object} [deps] Injected seams, for tests.
65
+ * @returns {Promise<string[]>} Lines to report.
66
+ */
67
+ export async function configureLocal(options, deps = {}) {
68
+ const { tenant, provider, bootstrapKey: key, rotate = false } = options;
69
+ const lines = [];
70
+
71
+ // A tenant is required here, unlike the emit paths, because this one WRITES.
72
+ // Without it the config falls back to the default namespace and materializes
73
+ // one tenant's credentials into another's directory — and on a machine
74
+ // serving several, the two would then share a store.
75
+ if (!tenant) {
76
+ throw new Error(
77
+ "environment local needs --tenant=<name>.\n" +
78
+ "It writes credentials into a per-tenant directory, so guessing the " +
79
+ "name would put one tenant's secrets where another's sessions read."
80
+ );
81
+ }
82
+
83
+ const wired = deps.prompt
84
+ ? deps
85
+ : { ...(await localDeps({ tenant, provider })), ...deps };
86
+ const { canPrompt, promptSecret } = wired.prompt;
87
+ const { storeBootstrap, hasBootstrap } = wired.store;
88
+ const materialize = wired.materialize;
89
+
90
+ if (!key) {
91
+ lines.push(
92
+ `${provider} has no environment-variable bootstrap, so there is nothing`,
93
+ `to store. Authenticate it the way its own CLI expects.`
94
+ );
95
+ } else if (hasBootstrap(key) && !rotate) {
96
+ lines.push(`${key} is already stored; pass --rotate to replace it.`);
97
+ } else if (!canPrompt()) {
98
+ // Not fatal. A non-interactive caller can legitimately have supplied the
99
+ // bootstrap through the environment, and refusing would break that.
100
+ lines.push(
101
+ `No terminal to prompt on, so ${key} was not stored.`,
102
+ `Set it in the environment, or re-run where a human can type.`
103
+ );
104
+ } else {
105
+ const value = promptSecret(`Paste the access token for ${tenant}: `);
106
+ if (!value) {
107
+ lines.push(`Nothing entered, so ${key} was not stored.`);
108
+ } else {
109
+ const { where } = storeBootstrap(key, value);
110
+ lines.push(`Stored ${key} in ${where}.`);
111
+ }
112
+ }
113
+
114
+ const result = await materialize();
115
+ lines.push(...result);
116
+ return lines;
117
+ }
118
+
119
+ /**
120
+ * Run the command.
121
+ * @param {string[]} argv Arguments after the command name.
122
+ * @param {object} [deps] Injected seams, for tests.
123
+ * @returns {Promise<number>} Exit code.
124
+ */
125
+ export async function run(argv, deps = {}) {
126
+ const out = deps.log ?? console.log;
127
+ const err = deps.error ?? console.error;
128
+
129
+ try {
130
+ const target = assertTarget(argv.find(a => !a.startsWith("-")));
131
+ const resolve = deps.resolveTarget ?? (await defaultResolver());
132
+ const identity = await resolve(argv);
133
+
134
+ if (TARGETS[target].mode === "run") {
135
+ const lines = await (deps.configureLocal ?? configureLocal)(
136
+ { ...identity, rotate: argv.includes("--rotate") },
137
+ deps
138
+ );
139
+ out(lines.join("\n"));
140
+ return 0;
141
+ }
142
+
143
+ out((deps.emit ?? (await defaultEmitter()))(target, identity));
144
+ return 0;
145
+ } catch (error) {
146
+ err(String(error.message));
147
+ return 1;
148
+ }
149
+ }
150
+
151
+ // Executed directly by the CLI, imported by tests. Without this the module
152
+ // exported a `run` nobody called and the command printed nothing at all.
153
+ if (
154
+ process.argv[1] &&
155
+ import.meta.url === pathToFileURL(process.argv[1]).href
156
+ ) {
157
+ run(process.argv.slice(2)).then(code => {
158
+ process.exitCode = code;
159
+ });
160
+ }
161
+
162
+ /**
163
+ * Wire the local path to the real prompt, store and materializer.
164
+ *
165
+ * Loaded lazily so the emit paths — which need none of it — do not pay for it,
166
+ * and so tests can substitute the lot without touching a keychain or a vault.
167
+ *
168
+ * `materialize` is called with `requested: true`: the operator typed the
169
+ * command whose purpose is to put credentials on this machine, which is a
170
+ * different question from whether an automated flow may write here. The
171
+ * capability guard still refuses the automated case.
172
+ * @returns {Promise<object>} Default dependencies for `configureLocal`.
173
+ */
174
+ async function localDeps(identity) {
175
+ const at = name =>
176
+ new URL(`../../lisa-secrets-access/scripts/${name}`, import.meta.url).href;
177
+ const prompt = await import(at("prompt-secret.mjs"));
178
+ const store = await import(at("bootstrap-store.mjs"));
179
+ const secrets = await import(at("materialize-secrets.mjs"));
180
+ const surfaces = await import(at("surfaces.mjs"));
181
+
182
+ return {
183
+ prompt,
184
+ store,
185
+ materialize: () => {
186
+ // The NAMED tenant, not whatever config the working directory holds.
187
+ // Reading the directory materialized the default namespace instead of the
188
+ // one on the command line — observed writing 49 secrets of the wrong
189
+ // tenant into the wrong directory.
190
+ const { count, derived, dir, profiles } = secrets.materialize(
191
+ surfaces.configForTenant(identity),
192
+ { requested: true }
193
+ );
194
+ return [
195
+ `Materialized ${count} secret(s) into ${dir}.`,
196
+ ...(derived ? [`${derived} variable(s) derived from the bundle.`] : []),
197
+ ...(profiles?.length
198
+ ? [`AWS profiles installed: ${profiles.join(", ")}`]
199
+ : []),
200
+ ];
201
+ },
202
+ };
203
+ }
204
+
205
+ /**
206
+ * Load the identity resolver from the sibling runner.
207
+ * @returns {Promise<Function>} The resolver.
208
+ */
209
+ async function defaultResolver() {
210
+ // Already a URL — passing it through pathToFileURL again throws.
211
+ const mod = await import(
212
+ new URL("./setup-remote-env.mjs", import.meta.url).href
213
+ );
214
+ return argv => mod.resolveEmitTarget(argv);
215
+ }
216
+
217
+ /**
218
+ * Load the emitter from the sibling runner.
219
+ * @returns {Promise<Function>} The emitter.
220
+ */
221
+ async function defaultEmitter() {
222
+ // Already a URL — passing it through pathToFileURL again throws.
223
+ const mod = await import(
224
+ new URL("./setup-remote-env.mjs", import.meta.url).href
225
+ );
226
+ return (target, identity) => mod.emitFor(target, identity);
227
+ }
@@ -1030,6 +1030,142 @@ export function emitClaudeWeb({
1030
1030
  ].join("\n");
1031
1031
  }
1032
1032
 
1033
+ /**
1034
+ * Emit the configuration for a surface Lisa cannot reach.
1035
+ *
1036
+ * Dispatch rather than four call sites, so `environment` names a surface and
1037
+ * nothing downstream has to know which of them has an API and which does not.
1038
+ * @param {string} target Surface name.
1039
+ * @param {object} identity Resolved tenant, provider and bootstrap key.
1040
+ * @returns {string} Text to show the operator.
1041
+ */
1042
+ export function emitFor(target, identity) {
1043
+ if (target === "claude-web") return emitClaudeWeb(identity);
1044
+ if (target === "codex-cloud") return emitCodexCloud(identity);
1045
+ if (target === "container") return emitContainer(identity);
1046
+ throw new Error(`no emit template for surface "${target}".`);
1047
+ }
1048
+
1049
+ /**
1050
+ * Produce the configuration a human pastes into a Codex Cloud environment.
1051
+ *
1052
+ * Differs from Claude's in three ways that are properties of the vendor rather
1053
+ * than of Lisa, and each has cost someone a debugging session.
1054
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
1055
+ * @returns {string} Text to show the operator.
1056
+ */
1057
+ export function emitCodexCloud({
1058
+ bootstrapKey,
1059
+ tenant = null,
1060
+ provider = null,
1061
+ }) {
1062
+ const key = bootstrapKey ?? "<not resolved>";
1063
+ const namespace = tenant ?? "<your namespace>";
1064
+ return [
1065
+ "Provisioning tier: EMIT — Codex Cloud exposes no environment API.",
1066
+ " `codex cloud` offers exec, status and list; nothing that writes an",
1067
+ " environment. So this is text for the settings page.",
1068
+ "",
1069
+ "Paste into the environment settings",
1070
+ "-----------------------------------",
1071
+ " Repository: the DEFAULT checkout for this environment",
1072
+ "",
1073
+ " Environment variables — NOT task secrets:",
1074
+ // Written as name=value, not as `export name='value'`. This is a settings
1075
+ // form, not a shell: the quotes would be stored as part of the value, and
1076
+ // the surface named must be this one rather than the shell block's.
1077
+ ` LISA_TENANT=${namespace}`,
1078
+ ...(bootstrapKey
1079
+ ? [` ${key}=<read this from your credential manager>`]
1080
+ : [` (${provider} has no environment-variable bootstrap)`]),
1081
+ ...(provider ? [` LISA_PROVIDER=${provider}`] : []),
1082
+ " LISA_SECRETS_SURFACE=codex-cloud",
1083
+ "",
1084
+ " Setup and cache-resume maintenance both run BEFORE task secrets",
1085
+ " exist, so a bootstrap placed in the secrets box is invisible to the",
1086
+ " only two steps that need it.",
1087
+ "",
1088
+ " Setup script:",
1089
+ ` ${SETUP_FIELD}`,
1090
+ "",
1091
+ " Maintenance script:",
1092
+ " The SAME line. It runs when a container resumes from cache, and every",
1093
+ " step is idempotent and version-aware — so running it again is how a",
1094
+ " rotated value, an edited note, or a changed pin gets picked up.",
1095
+ "",
1096
+ "Watch for",
1097
+ "---------",
1098
+ " CODEX_ENV_NODE_VERSION overrides the repository's own .nvmrc and",
1099
+ " engines. An environment left on an older major breaks setup for a repo",
1100
+ " that requires a newer one, and the error blames the package manager.",
1101
+ "",
1102
+ " Codex clones `main`, not the repository's default branch. If those",
1103
+ " differ here, that is where the confusion starts.",
1104
+ "",
1105
+ " Setup logs are visible only in the Codex UI; no CLI retrieves them.",
1106
+ ].join("\n");
1107
+ }
1108
+
1109
+ /**
1110
+ * Produce an image definition and a run command for a container.
1111
+ *
1112
+ * Split across build and run on purpose: the binaries are baked once, and the
1113
+ * credential arrives at `docker run`. Baking it would put it in an image layer,
1114
+ * readable by anyone who can pull the image and surviving every
1115
+ * `docker history` — so the Dockerfile deliberately contains no secret.
1116
+ * @param {{bootstrapKey: string|null, tenant?: string|null, provider?: string}} options Project details.
1117
+ * @returns {string} Text to show the operator.
1118
+ */
1119
+ export function emitContainer({
1120
+ bootstrapKey,
1121
+ tenant = null,
1122
+ provider = null,
1123
+ }) {
1124
+ const key = bootstrapKey ?? "<not resolved>";
1125
+ const namespace = tenant ?? "<your namespace>";
1126
+ return [
1127
+ "Provisioning tier: EMIT — an image is built from a file you own.",
1128
+ "",
1129
+ "Dockerfile",
1130
+ "----------",
1131
+ " Generate it with the bootstrap's own emitter, so the image and this",
1132
+ " machine install the identical set:",
1133
+ "",
1134
+ " npx -y @codyswann/lisa@latest workstation --print-dockerfile \\",
1135
+ ` --provider=${provider ?? "bitwarden"} > Dockerfile.lisa`,
1136
+ " docker build -f Dockerfile.lisa -t lisa-workstation .",
1137
+ "",
1138
+ " Nothing secret belongs in it. An image layer is readable by anyone who",
1139
+ " can pull the image and survives every `docker history`, so the",
1140
+ " credential arrives at run time instead.",
1141
+ "",
1142
+ "docker run",
1143
+ "----------",
1144
+ " docker run --rm -it \\",
1145
+ ` -e LISA_TENANT=${namespace} \\`,
1146
+ ` -e ${key}="<this image's own access token>" \\`,
1147
+ ...(provider ? [` -e LISA_PROVIDER=${provider} \\`] : []),
1148
+ " -e LISA_SECRETS_SURFACE=container \\",
1149
+ ' -v "$PWD:/work" -w /work \\',
1150
+ " lisa-workstation",
1151
+ "",
1152
+ " LISA_SECRETS_SURFACE=container is what makes credentials materialize.",
1153
+ " Left to detection a container reads as `local`, which is",
1154
+ " materialized:false — right for a human at a keyboard whose provider CLI",
1155
+ " is authenticated, wrong for a container that has no keychain and dies",
1156
+ " with its filesystem.",
1157
+ "",
1158
+ " Give the image its own access token rather than reusing this machine's.",
1159
+ " If the image is shared, so is anything its token can read.",
1160
+ "",
1161
+ "Mounted repositories need nothing further",
1162
+ "-----------------------------------------",
1163
+ " A checkout you have already run `apply` and `sync` on carries its",
1164
+ " .lisa.config.json with it. Cloning INSIDE the container instead means",
1165
+ " running those there.",
1166
+ ].join("\n");
1167
+ }
1168
+
1033
1169
  /**
1034
1170
  * Report tooling the project appears to need but has not declared.
1035
1171
  *
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "2.339.0",
3
+ "version": "2.341.0",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"