@codyswann/lisa 4.22.8 → 4.22.10

package/plugins/lisa-copilot/skills/lisa-repair-intake/SKILL.md

@@ -383,6 +383,11 @@ invisible on that surface — the exact state this recovery path exists to catch
 only via search (no `Closes #` / native dev link) would otherwise never be discovered, and the leaf
 would never recover. Read each PR with the vendor's native state, e.g. GitHub
 `gh pr view <n> --json state,mergedAt,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,comments,reviews`.
+For `reviews`, derive the effective set from the **latest non-dismissed review
+per reviewer**, ordered by `submitted_at` then id. Never count the raw history:
+an older approval does not satisfy a later `CHANGES_REQUESTED` review by the
+same reviewer. Use the same paginated REST reduction documented by
+`lisa-drive-pr-to-merge` when the `gh pr view` projection is incomplete.
 
 **2. PR already merged → recover, don't re-dispatch.** If `state == MERGED`, the build is effectively
 complete and the only thing missing is the env transition the build-intake never applied (its merge
@@ -695,10 +700,18 @@ left in a status it should not carry, including a stale build-ready `ready`).
 
 ```bash
 ROLLUP_DIR="$(mktemp -d)"
+# Serialize the EXACT graph resolved in step 1 before any classifier reads it.
+# RESOLVED_CHILD_GRAPH_JSON is the in-memory object from that read; do not
+# re-query the tracker here or hand-author a smaller substitute.
+printf '%s\n' "$RESOLVED_CHILD_GRAPH_JSON" \
+  | jq -e '{container, children, readError, renderedState, childTally}' \
+  > "$ROLLUP_DIR/graph.json"
+test -s "$ROLLUP_DIR/graph.json"
+
 # children[]: { ref, state, labels[], blockedBy[{ref, open}], children[] } — the graph
 # step 1 already resolved, nested as deep as it was read. The script probes nothing.
 jq -n --slurpfile g "$ROLLUP_DIR/graph.json" \
-      '{container: $g[0].container, children: $g[0].children, readError: $g[0].readError}' \
+      '{container: $g[0].container, children: $g[0].children, readError: $g[0].readError, renderedState: $g[0].renderedState, childTally: $g[0].childTally}' \
   > "$ROLLUP_DIR/input.json"
 
 node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
@@ -707,7 +720,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
 
    It **exits non-zero and classifies nothing** when the tracker could not be read, the container
    has no children, or no child was readable. That is a repair failure to report, never an
-   all-clear: do not fall through to "no blocked children" on a non-zero exit. On success its
+   all-clear and a strict **no-write** result: do not transition lifecycle state and do not
+   post/update the rollup note. Do not fall through to "no blocked children" on a non-zero exit. On success its
    report names, per class, the blocking leaf, the path to it, and **who must act** — those lines
    are what goes in the rollup note, verbatim. Never set the `spec_defect` marker yourself and
    never infer a class from prose; a hold with nothing recorded classifies `unknown`, and the
@@ -717,7 +731,9 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/rollup-blocker-classification.mjs" \
    lifecycle write (JIRA transition, GitHub/Linear label swap keeping exactly one `status:*`),
    removing any conflicting stale build lifecycle role — **including a stale `ready`** the parent
    should never carry. Post an idempotent `[lisa-repair-intake]` rollup note naming the derived
-   state and the child tally (honor the backoff window + fingerprint). **When the derived state is
+   state and the child tally (honor the backoff window + fingerprint). Include that exact rendered
+   state and tally in the classifier input: its fingerprint deduplicates the complete note, not only
+   the blocker classes. **When the derived state is
    `blocked`, the note carries the classifier's per-class report** — the blocking leaf, its path,
    and its actor — so an operator never descends the tree by hand to find out which item and which
    kind. Use the classifier's `change.summary` as the dedupe test: an unchanged verdict has nothing

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -161,12 +161,16 @@ function stripFamilyBlocks(text, family) {
     const opened = findFamily(out, start);
     if (opened.index === -1) return out;
     const closed = findFamily(out, end, opened.index + opened.length);
-    // A truncated block (opened, never closed) would otherwise swallow the rest
-    // of the file on every subsequent write.
-    const after =
-      closed.index === -1
-        ? ""
-        : out.slice(closed.index + closed.length).replace(/^\n/, "");
+    // A truncated block (opened, never closed) is not safe to interpret. Any
+    // guessed boundary could delete operator-authored content after the marker,
+    // so refuse before the caller writes and preserve the original byte-for-byte.
+    if (closed.index === -1) {
+      throw new Error(
+        `Refusing to rewrite a managed ${family} block with no closing marker. ` +
+          `Repair the marker pair first; no file was changed.`
+      );
+    }
+    const after = out.slice(closed.index + closed.length).replace(/^\n/, "");
     out = `${out.slice(0, opened.index)}${after}`;
   }
 }

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -56,6 +56,11 @@ const ROLE_ARN =
   /^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[\w+=,.@/-]+$/;
 const PUBLICATION_COORDINATION_SCOPE = "AWS_BOOTSTRAP_";
 const PUBLICATION_LOCK_TTL_MS = 30 * 60 * 1000;
+// Every provider and AWS child has its own 30-second deadline. Stop starting
+// target mutations five minutes before another publisher may reap this lock,
+// leaving ample room for the in-flight child to finish. This is a monotonic
+// duration budget, not a wall clock used to order or expire provider records.
+const PUBLICATION_CRITICAL_SECTION_BUDGET_MS = 25 * 60 * 1000;
 
 /**
  * Validate and normalize one complete bundle without changing its serialized
@@ -257,6 +262,22 @@ function writeProviderValue(cfg, id, value, write) {
   }
 }
 
+function publicationBudgetGuard(startedAt, monotonicNow) {
+  return () => {
+    const elapsed = monotonicNow() - startedAt;
+    if (!Number.isFinite(elapsed) || elapsed < 0) {
+      throw new Error(
+        "publication lock monotonic timer became invalid; refusing further provider mutation"
+      );
+    }
+    if (elapsed >= PUBLICATION_CRITICAL_SECTION_BUDGET_MS) {
+      throw new Error(
+        "publication lock execution budget exceeded; refusing further provider mutation"
+      );
+    }
+  };
+}
+
 /**
  * Enter the provider election for one AWS bootstrap record.
  *
@@ -427,23 +448,29 @@ export function releasePublicationLock(cfg, lock, operations = {}) {
  * snapshot can never overwrite a publication that finished while this process
  * was entering the election.
  */
-function withPublicationLock(cfg, operations, task) {
+function withPublicationLock(cfg, operations, task, completedMessage) {
   const fetch = operations.fetch ?? fetchAll;
   const acquire = operations.acquireLock ?? acquirePublicationLock;
   const release = operations.releaseLock ?? releasePublicationLock;
+  const monotonicNow = operations.monotonicNow ?? (() => performance.now());
+  const startedAt = monotonicNow();
+  const assertWithinBudget = publicationBudgetGuard(startedAt, monotonicNow);
   const target = currentEntry(cfg, fetch);
   const lock = acquire(cfg, target, operations);
   let result;
   let taskError;
 
   try {
+    assertWithinBudget();
     const current = currentEntry(cfg, fetch);
     if (current.id !== target.id || current.projectId !== target.projectId) {
       throw new Error(
         `${BOOTSTRAP_KEY} moved after publication lock acquisition; retry from the new provider record`
       );
     }
-    result = task(current);
+    assertWithinBudget();
+    result = task(current, assertWithinBudget);
+    assertWithinBudget();
   } catch (error) {
     taskError = error;
   }
@@ -455,15 +482,18 @@ function withPublicationLock(cfg, operations, task) {
     if (taskError) {
       throw new Error(`${firstLine(taskError)}; ${releaseReason}`);
     }
-    throw new Error(releaseReason);
+    throw new Error(
+      `${completedMessage}; ${releaseReason}; remove the coordination record before the next publication`
+    );
   }
 
   if (taskError) throw taskError;
   return result;
 }
 
-function preflightUnderLock(cfg, entry, write) {
+function preflightUnderLock(cfg, entry, write, assertWithinBudget) {
   try {
+    assertWithinBudget();
     writeProviderValue(cfg, entry.id, entry.value, write);
   } catch (error) {
     throw new Error(
@@ -482,8 +512,12 @@ function preflightUnderLock(cfg, entry, write) {
  */
 export function preflightAwsBootstrap(cfg, operations = {}) {
   const write = operations.write ?? writeSecret;
-  return withPublicationLock(cfg, operations, entry =>
-    preflightUnderLock(cfg, entry, write)
+  return withPublicationLock(
+    cfg,
+    operations,
+    (entry, assertWithinBudget) =>
+      preflightUnderLock(cfg, entry, write, assertWithinBudget),
+    "preflight completed"
   );
 }
 
@@ -496,12 +530,20 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, candidateRaw, fetch, write) {
+function rollback(
+  cfg,
+  previous,
+  candidateRaw,
+  fetch,
+  write,
+  assertWithinBudget
+) {
   try {
     const current = currentEntry(cfg, fetch);
     if (current.value !== candidateRaw) {
       return "rollback skipped because the provider changed after this publication";
     }
+    assertWithinBudget();
     writeProviderValue(cfg, previous.id, previous.value, write);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -528,47 +570,56 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   const write = operations.write ?? writeSecret;
   const verify = operations.verify ?? verifyAwsBootstrap;
   const candidate = validateAwsBootstrap(raw);
-  return withPublicationLock(cfg, operations, previous => {
-    preflightUnderLock(cfg, previous, write);
-
-    // Verify before the write. A candidate that cannot assume one of its roles
-    // never becomes the value every new remote session receives.
-    verify(candidate);
-
-    if (candidate.raw === previous.value) {
-      return {
-        changed: false,
-        profiles: candidate.profiles.map(profile => profile.name),
-      };
-    }
+  return withPublicationLock(
+    cfg,
+    operations,
+    (previous, assertWithinBudget) => {
+      preflightUnderLock(cfg, previous, write, assertWithinBudget);
+
+      // Verify before the write. A candidate that cannot assume one of its roles
+      // never becomes the value every new remote session receives.
+      verify(candidate);
+      assertWithinBudget();
+
+      if (candidate.raw === previous.value) {
+        return {
+          changed: false,
+          profiles: candidate.profiles.map(profile => profile.name),
+        };
+      }
 
-    try {
-      writeProviderValue(cfg, previous.id, candidate.raw, write);
-      const stored = currentEntry(cfg, fetch);
-      if (stored.value !== candidate.raw) {
+      try {
+        assertWithinBudget();
+        writeProviderValue(cfg, previous.id, candidate.raw, write);
+        const stored = currentEntry(cfg, fetch);
+        if (stored.value !== candidate.raw) {
+          throw new Error(
+            "provider read-back did not match the candidate exactly"
+          );
+        }
+        const storedCandidate = validateAwsBootstrap(stored.value);
+        verify(storedCandidate);
+        assertWithinBudget();
+        return {
+          changed: true,
+          profiles: storedCandidate.profiles.map(profile => profile.name),
+        };
+      } catch (error) {
+        const rollbackOutcome = rollback(
+          cfg,
+          previous,
+          candidate.raw,
+          fetch,
+          write,
+          assertWithinBudget
+        );
         throw new Error(
-          "provider read-back did not match the candidate exactly"
+          `${BOOTSTRAP_KEY} publication failed: ${firstLine(error)}; ${rollbackOutcome}`
         );
       }
-      const storedCandidate = validateAwsBootstrap(stored.value);
-      verify(storedCandidate);
-      return {
-        changed: true,
-        profiles: storedCandidate.profiles.map(profile => profile.name),
-      };
-    } catch (error) {
-      const rollbackOutcome = rollback(
-        cfg,
-        previous,
-        candidate.raw,
-        fetch,
-        write
-      );
-      throw new Error(
-        `${BOOTSTRAP_KEY} publication failed: ${firstLine(error)}; ${rollbackOutcome}`
-      );
-    }
-  });
+    },
+    "publication completed"
+  );
 }
 
 /** Read a candidate from stdin without ever placing it in argv. */

package/plugins/lisa-copilot/skills/lisa-sentry-access/SKILL.md

@@ -48,9 +48,9 @@ interactively and headlessly — which is why it leads. The REST tier uses:
 read_sentry_token() {
   [ -n "${SENTRY_AUTH_TOKEN:-}" ] && { echo "$SENTRY_AUTH_TOKEN"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -59,12 +59,9 @@ read_sentry_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -83,7 +80,7 @@ read_sentry_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get SENTRY_AUTH_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa-copilot/skills/lisa-setup-atlassian/SKILL.md

@@ -86,9 +86,9 @@ read_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -97,12 +97,9 @@ read_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -121,7 +118,7 @@ read_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get ATLASSIAN_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa-copilot/skills/lisa-setup-linear/SKILL.md

@@ -104,17 +104,14 @@ read_linear_key() {  # $1=workspace slug
   # `linear-access` grew to seven, leaving `/lisa:setup:linear` unable to reach
   # a key that `lisa-linear-access` could read from the same repository.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used. The plugin rungs are the floor: `resolve-secret.mjs` ships
-  # beside this skill, so a rung pointing at it is reachable from anywhere the
-  # plugin itself is installed.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
+  # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
+  # pointing at it is reachable from anywhere the plugin itself is installed.
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -133,7 +130,7 @@ read_linear_key() {  # $1=workspace slug
       local via_lisa
       via_lisa=$(node "$resolver" get LINEAR_API_KEY 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa-copilot/skills/lisa-setup-notion/SKILL.md

@@ -173,9 +173,9 @@ read_notion_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -184,12 +184,9 @@ read_notion_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -208,7 +205,7 @@ read_notion_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa-copilot/skills/lisa-setup-remote-aws/SKILL.md

@@ -64,13 +64,18 @@ The lock remains held through rollback and its deletion is verified before the
 command reports success:
 
 ```bash
-aws --profile shared secretsmanager get-secret-value \
-  --secret-id remote-agent-credentials \
+aws secretsmanager get-secret-value \
+  --secret-id <selected-secret-name> \
   --query SecretString \
   --output text \
   | node .claude/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs publish
 ```
 
+Use the same secret name passed to `--secret-name`; the default is
+`remote-agent-credentials`. Add `--profile <source-profile>` only when the
+operator's ambient AWS identity cannot read the emission and the project names
+a source profile. A named `shared` profile is not otherwise required.
+
 Resolve the script from the installed runtime or `node_modules` when the
 `.claude/skills` copy is not present. Never print or place the candidate in an
 argument or temporary file. A CDK deployment followed later by a human copy is

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/SKILL.md

@@ -97,9 +97,14 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
+bash "$CLAUDE_PROJECT_DIR/scripts/lisa-remote-env/session-start.sh"   # project-scoped absolute hook
 ```
 
+The installer also registers a user-scoped hook using the checkout's resolved
+absolute path. If invoking this asset by hand, either use that absolute path or
+change to the repository root first; a bare checkout-relative command is not a
+portable session-start configuration.
+
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.
 
 ## Detect before you provision

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -46,8 +46,27 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # SessionStart hosts are fail-open, so they surface that result and still allow
 # the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
+
+# The toolchain child cannot export into this parent shell. Its durable output
+# is linked into ~/.local/bin, so make that directory visible before the next
+# child tries to execute the provider CLI it just installed.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
 bash "${here}/setup.sh" --phase=secrets "$@"
 
+# Materialization writes a Lisa-owned block into .profile that sources the
+# generated environment and removes ambient AWS credential poison. The project
+# hook is another non-login child, so load that block here and let the child
+# inherit the exact environment materialization just produced.
+if [ -r "$HOME/.profile" ]; then
+  # The materializer owns this runtime path.
+  # shellcheck disable=SC1090
+  . "$HOME/.profile"
+fi
+
 # A project hook is part of the remote toolchain contract too. It covers tools
 # that cannot be expressed by the pinned manifest, so skipping it on a cached
 # session can leave fresh credentials with no client capable of using them.

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/setup.sh

@@ -132,6 +132,7 @@ for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".opencode/skills/lisa/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then

package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -51,7 +51,10 @@ import { pathDirs } from "../../lisa-setup-workstation/scripts/catalogue.mjs";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
 
-import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -173,12 +176,14 @@ function installReleaseZip(tool, binDir) {
     const archive = join(temporary, "download.zip");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, not after. An unexpected archive must fail
     // before any of its contents reach a directory that is on PATH.
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("unzip", ["-q", "-o", archive, "-d", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     const binary = join(temporary, tool.binary ?? tool.name);
     boundedChildOutput(
@@ -186,6 +191,7 @@ function installReleaseZip(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -210,10 +216,12 @@ function installReleaseTar(tool, binDir) {
     const archive = join(temporary, "download.tar.gz");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("tar", ["-xzf", archive, "-C", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Release tarballs usually nest under a versioned directory, so `binary` is
     // a path within the archive rather than a bare name.
@@ -223,6 +231,7 @@ function installReleaseTar(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -272,6 +281,7 @@ function installReleaseTree(tool, binDir) {
     const archive = join(temporary, "download.archive");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, as everywhere else here: an unexpected archive
     // must fail before any of its contents reach the filesystem.
@@ -285,10 +295,12 @@ function installReleaseTree(tool, binDir) {
     if (tool.url.endsWith(".zip")) {
       boundedChildOutput("unzip", ["-q", "-o", archive, "-d", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     } else {
       boundedChildOutput("tar", ["-xzf", archive, "-C", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     }
 
@@ -342,6 +354,7 @@ function installReleaseBinary(tool, binDir) {
     const artifact = join(temporary, tool.name);
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", artifact], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before it reaches a directory on PATH. For this kind that ordering
     // matters more than for the archives: the downloaded file is directly
@@ -353,6 +366,7 @@ function installReleaseBinary(tool, binDir) {
       ["-m", "0755", artifact, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -370,6 +384,7 @@ function installNpmGlobal(tool) {
     ["install", "--global", `${tool.package}@${tool.version}`],
     {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     }
   );
 }
@@ -509,7 +524,10 @@ function runHook(hook, dryRun) {
   console.log(`\nProject hook: ${hook}`);
   if (dryRun) return;
   chmodSync(path, 0o755);
-  boundedChildOutput("bash", [path], { stdio: "inherit" });
+  boundedChildOutput("bash", [path], {
+    stdio: "inherit",
+    timeout: SETUP_OPERATION_BUDGET_MS,
+  });
 }
 
 /** Phases this runner can execute, in the order they must happen. */
@@ -789,7 +807,10 @@ export function installUserSessionHook(repoRoot, options = {}) {
 
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
-  const command = `bash ${script}`;
+  // Settings stores shell source, so the absolute path still needs quoting.
+  // JSON string syntax is accepted by the shell for ordinary path text and
+  // safely escapes spaces, quotes, dollars and backticks.
+  const command = `bash ${JSON.stringify(script)}`;
 
   let settings = {};
   if (exists(settingsPath)) {
@@ -1506,7 +1527,7 @@ async function main() {
       boundedChildOutput(
         "node",
         dryRun ? [materialize, "--dry-run"] : [materialize],
-        { stdio: "inherit" }
+        { stdio: "inherit", timeout: SETUP_OPERATION_BUDGET_MS }
       );
     } catch (err) {
       if (!retried) throw err;