@codyswann/lisa 4.21.3 → 4.21.5

package/dist/core/upstream-evidence-manifest.js

@@ -655,7 +655,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-secrets-access/scripts/preflight-secrets.mjs": "98a0a541041d543fe91e6260da4a25e383123a0eb40bad32a4d59551b7da8db8",
     "plugins/src/base/skills/lisa-secrets-access/scripts/prompt-secret.mjs": "22b28bcdf49b9b0fcd1b15639e031655efacc028b74d48d57e2275f3e1557508",
     "plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs": "bc0c75528f82f92478b10d75c9c60349c50160594255f5bafd7bfc03e8a54fee",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs": "992b26b13a96d358e388d070fb4cfeaf628f527e9a23f19aba662d190560879f",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs": "69a614f2bdb7a169dc19561457fc09fb45402d4617e9802004243aeb74abd1db",
     "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "735434e25bf1db9f2f7eb3d5ede8361cba01b922d65931393bd36e6f96531654",
     "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "4170220c95f410072f3871f58938b7575684254480d0645e3dbb1535cf09d7a7",
     "plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs": "adada60f766760395858c69ef784654e9e096943485ed237c395c8fc2ca8e20f",
@@ -680,8 +680,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-local-env/scripts/local-env.mjs": "6f3713451139d9d4fd8eed8f11f49e472667394c4f9a7cae63897b7702115687",
     "plugins/src/base/skills/lisa-setup-notion/SKILL.md": "63b6a86a85adfbbb389f18ab228883b760a4560d5ed71ac4bc7023c868a59143",
     "plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md": "46b53201c9bcb68b6fa51f220e34b10ec1d5ba4cfc1d471d9e9595db2550d72b",
-    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "7aa1f616440cb262e47881e8b37b701ebd11ad1ea619412aa04c33324770904c",
-    "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
+    "plugins/src/base/skills/lisa-setup-remote-env/SKILL.md": "a753f7c8b413339ee7d4383f87239fae04b75f7dd41e18d9afbcf307c521e363",
+    "plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh": "862f8096585bfa7639dfecd0b3dc69a1218ee7fd740df4851f6f1da09f17a9fe",
     "plugins/src/base/skills/lisa-setup-remote-env/assets/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/environment.mjs": "3b9be11691d81a896fc779c37fb6d69e8e7222f95e23f84aa03d4e590f9d9108",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/preflight-tools.mjs": "eb8ee672fbfdb0ab41dde5f17337dae59912f18eafa6f15a05fd203906d16352",
@@ -1144,7 +1144,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lisa-github-repo-setup.sh": "4717873e339b3e615d0bf22b4cb290b3575df5aba8c3639dc0d3bebc23abf651",
     "scripts/lisa-github-rulesets.sh": "a5b81fe09266f1daf181b8031c2b73fa0fd6206a9e7299d42eaa12766fbd51fb",
     "scripts/lisa-mutation.mjs": "74603e61f493d700318feb862f61ee1653430700b5edf232e70241ccdedac587",
-    "scripts/lisa-remote-env/session-start.sh": "cb63d08b14ab7aa2d405e6770e0cf7db5d6588ae1dcb924ea6224b026fcff496",
+    "scripts/lisa-remote-env/session-start.sh": "862f8096585bfa7639dfecd0b3dc69a1218ee7fd740df4851f6f1da09f17a9fe",
     "scripts/lisa-remote-env/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "scripts/lisa-ruleset-payload.mjs": "3e10b5a4c113e3aa895c6a09f063045eb198dbdabb11a00be87bea1477c91fbb",
     "scripts/lisa-ruleset-reach.mjs": "e51b12092062379e7317b368c89a789e2067ec302388e557ea84a29a35ffc238",

package/package.json

@@ -159,7 +159,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -298,5 +298,5 @@
     "vite": "^8.0.16"
   },
   "type": "module",
-  "lisaReleaseCommit": "18deaa8e1216cd40097bed43ccece0f668882cff"
+  "lisaReleaseCommit": "3058845dd698f4d6fd2bb7356825d96f65e008ce"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/lisa/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/lisa-agy/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.3",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/src/base/skills/lisa-setup-remote-env/SKILL.md

@@ -97,7 +97,7 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; delegates to --phase=secrets
+bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
 ```
 
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.

package/plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"

package/scripts/lisa-remote-env/session-start.sh

@@ -41,7 +41,17 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # of --version calls and nothing else.
 #
 # Before secrets, because materializing needs the provider CLI that this step
-# installs. A failure here is fatal for the same reason: continuing would report
-# a missing credential when the real fault was a missing binary.
+# installs. A failure here terminates this hook for the same reason: continuing
+# would report a missing credential when the real fault was a missing binary.
+# SessionStart hosts are fail-open, so they surface that result and still allow
+# the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
-exec bash "${here}/setup.sh" --phase=secrets "$@"
+bash "${here}/setup.sh" --phase=secrets "$@"
+
+# A project hook is part of the remote toolchain contract too. It covers tools
+# that cannot be expressed by the pinned manifest, so skipping it on a cached
+# session can leave fresh credentials with no client capable of using them.
+# Run it last, matching the full setup order, and exec so its failure becomes
+# the SessionStart result the host can surface. SessionStart remains fail-open;
+# this reports an incomplete bootstrap but does not block the agent session.
+exec bash "${here}/setup.sh" --phase=hook "$@"