@codyswann/lisa 2.341.0 → 2.341.1

package/README.md

@@ -69,6 +69,101 @@ native Playwright/Maestro regression authority.
 
 ## Getting started
 
+Setup has three layers, and conflating them is the usual mistake:
+
+```
+vault  →  machine  →  each repo  →  each other surface
+```
+
+Two commands do the machine-and-surface work, and **neither needs a checkout** —
+that matters, because the surfaces most in need of setup are the ones with no
+repository attached.
+
+| Command | Answers | Scope |
+| --- | --- | --- |
+| `workstation` | what binaries does this machine have | once per machine |
+| `environment <surface>` | which tenant, and where do its credentials go | once per machine, and once per other surface |
+
+`environment` runs where Lisa can execute and prints what to paste where it
+cannot:
+
+```
+environment local        prepares this machine
+environment container    an image definition and a run command
+environment claude-web   text for the Claude environment dialog
+environment codex-cloud  text for the Codex environment settings
+```
+
+### 1. The vault, once per tenant
+
+Create the secrets, then a **machine account** granted only the projects agents
+may read — that grant is what scopes every headless session. Annotate a secret's
+note with `tool: <name>` where a CLI is implied (`sonar`, `aws`, `gh`); a session
+with no checkout installs exactly what the notes name, and the whole catalogue
+if they name nothing.
+
+Issue each place its own access token, at the moment you set that place up. One
+token shared across five places makes any compromise a five-place outage, and
+makes every access in the audit log anonymous.
+
+### 2. The machine
+
+```bash
+npx -y @codyswann/lisa@latest workstation --install --provider=bitwarden
+exec $SHELL -l                                   # ~/.local/bin on PATH
+npx -y @codyswann/lisa@latest environment local --tenant=<name>
+```
+
+Node is the only prerequisite. `workstation` is the one entry point that works
+before any agent or repository exists — invoking a *skill* needs an installed
+agent, and Lisa is a devDependency so it needs a clone; both are what this
+creates.
+
+`environment local` prompts for the token, stores it in the OS keychain (a
+`0600` file where there is no keychain), materializes the credentials, and
+installs the per-environment AWS profiles. **Re-run it to rotate** — it is not
+an installer, so it will not reinstall six coding agents to replace one token.
+
+`--tenant` is required because every namespace is a directory: guessing would
+put one tenant's credentials where another tenant's sessions read.
+
+Then authenticate the things that are *you* rather than the machine account —
+`gh auth login`, `aws configure sso`, and each agent's own login.
+
+### 3. Each repository
+
+```bash
+git clone … && cd …
+npx -y @codyswann/lisa@latest apply    # lint, hooks, workflows, agent surfaces
+bun install                            # postinstall installs the agent plugins
+npx -y @codyswann/lisa@latest sync     # then set secrets.namespace
+```
+
+A repository only needs to say *which tenant it belongs to*. The credentials are
+already on the machine.
+
+Brownfield repositories then converge — see below.
+
+### 4. Each other surface
+
+Cloud environments are account-scoped and shared across every repository, so
+this is once per environment rather than once per repository:
+
+```bash
+npx -y @codyswann/lisa@latest environment claude-web --tenant=<name>
+```
+
+Paste what it prints. Give that environment its **own** access token: those
+dialogs store values in plain text, readable by everyone who can use the
+environment.
+
+A repository becomes usable *from* a cloud surface with
+`lisa remote-env --install`, which writes two entrypoints to commit. They are
+inert locally — a container that has just cloned the repository has never seen
+the plugin they came from, so they have to be part of the clone.
+
+---
+
 Install Lisa as a development dependency in each project that uses it:
 
 ```bash

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA6uNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwqEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CA8uNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -581,7 +581,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "bff68aa66d6d4cd7cb9d0e39be691c6daa232edb097f8a601815432a32cca6a6",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "f5a1e9290789fd1c33675168d30461fb24a11c98a433ef777c1f536bc2f905ef",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "80fbf157f9c562c033886c25a99b37356602edd9e61cd2d492f339769ddcf97e",
-    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "79c5572dfa4c5d37b1fcfbc75a38ca7d1d708258cca761ec946fb7070bc727f4",
+    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "7aa1f616440cb262e47881e8b37b701ebd11ad1ea619412aa04c33324770904c",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/environment.mjs": "3b9be11691d81a896fc779c37fb6d69e8e7222f95e23f84aa03d4e590f9d9108",
@@ -7315,6 +7315,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/core/upstream-attribution-file-safety.test.ts": true,
     "tests/unit/core/upstream-attribution-integrity.test.ts": true,
     "tests/unit/detection/detectors.test.ts": true,
+    "tests/unit/docs/onboarding-walkthrough.test.ts": true,
     "tests/unit/governance-contracts.test.ts": true,
     "tests/unit/health/agentic.test.ts": true,
     "tests/unit/health/consumer.test.ts": true,