@codyswann/lisa 1.43.2 → 1.43.4

package/expo/copy-overwrite/lighthouserc.js

@@ -110,6 +110,74 @@ function loadConfig() {
 const config = loadConfig();
 const { collect, assertions: a } = config;
 
+/**
+ * Config keys that have explicit assertion mappings in the assertions object
+ * below. Any config key NOT in this set will be auto-converted to a
+ * kebab-case Lighthouse assertion name and applied as a dynamic override.
+ */
+const handledKeys = new Set([
+  "buttonName",
+  "validSourceMaps",
+  "errorsInConsole",
+  "performance",
+  "firstContentfulPaint",
+  "largestContentfulPaint",
+  "interactive",
+  "cumulativeLayoutShift",
+  "totalByteWeight",
+  "scriptSize",
+  "fontDisplay",
+  "imageAspectRatio",
+  "metaDescription",
+  "unusedJavascript",
+  "bootupTime",
+  "mainthreadWorkBreakdown",
+  "maxPotentialFid",
+  "legacyJavascript",
+  "legacyJavascriptInsight",
+  "speedIndex",
+  "unusedCssRules",
+  "usesRelPreconnect",
+  "fontDisplayInsight",
+  "networkDependencyTreeInsight",
+  "duplicatedJavascriptInsight",
+]);
+
+/**
+ * Converts camelCase config keys to kebab-case Lighthouse assertion names.
+ *
+ * @param {string} str - camelCase string
+ * @returns {string} kebab-case string
+ */
+function toKebabCase(str) {
+  return str.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
+/**
+ * Builds assertion overrides for config keys not handled by the explicit
+ * assertions below. Allows projects to tune or disable any Lighthouse
+ * preset assertion via lighthouserc-config.json without modifying this file.
+ *
+ * A minScore of 0 turns the assertion "off" entirely.
+ *
+ * @param {object} assertions - Merged assertion config
+ * @param {Set<string>} handled - Keys already handled by explicit assertions
+ * @returns {object} Extra assertion overrides keyed by kebab-case name
+ */
+function buildExtraAssertions(assertions, handled) {
+  const extra = {};
+  for (const [key, value] of Object.entries(assertions)) {
+    if (handled.has(key)) continue;
+    const assertionName = toKebabCase(key);
+    if (value.minScore === 0) {
+      extra[assertionName] = "off";
+    } else {
+      extra[assertionName] = ["warn", value];
+    }
+  }
+  return extra;
+}
+
 module.exports = {
   ci: {
     collect: {
@@ -214,6 +282,11 @@ module.exports = {
           "warn",
           { minScore: a.duplicatedJavascriptInsight.minScore },
         ],
+
+        // Dynamic overrides for any extra config keys not handled above.
+        // Projects can tune or disable any preset assertion by adding it
+        // to lighthouserc-config.json (e.g., "doctype": { "minScore": 0 }).
+        ...buildExtraAssertions(a, handledKeys),
       },
     },
 

package/package.json

@@ -95,7 +95,7 @@
     "axios": ">=1.13.5"
   },
   "name": "@codyswann/lisa",
-  "version": "1.43.2",
+  "version": "1.43.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "bin": {

package/typescript/copy-contents/.husky/pre-push

@@ -63,13 +63,24 @@ if [ "$PACKAGE_MANAGER" = "yarn" ]; then
   fi
 
 elif [ "$PACKAGE_MANAGER" = "npm" ]; then
-  # Run npm audit and only fail on high or critical vulnerabilities
-  npm audit --production --audit-level=high
-  if [ $? -ne 0 ]; then
+  # Run npm audit in JSON mode and filter out known false positives before failing.
+  # npm audit lacks a native --ignore flag, so we parse JSON and exclude by GHSA ID.
+
+  # Excluding GHSA-3ppc-4f35-3m26: minimatch ReDoS via repeated wildcards
+  # Nested dep in aws-cdk-lib; fix requires minimatch v10 (incompatible with ^3.1.2)
+  # Risk: None - dev-time CDK tooling, no production runtime exposure
+
+  # Excluding GHSA-2g4f-4pwh-qvx6: ajv ReDoS with $data option
+  # Nested dep in aws-cdk-lib and eslint; no fix available via npm
+  # Risk: Low - $data option not used in this application
+
+  AUDIT_JSON=$(npm audit --production --json 2>/dev/null || true)
+  UNFIXED_HIGH=$(echo "$AUDIT_JSON" | jq '[.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical") | .value.via[] | select(type == "object") | .url | ltrimstr("https://github.com/advisories/")] | unique | map(select(. == "GHSA-3ppc-4f35-3m26" or . == "GHSA-2g4f-4pwh-qvx6" | not)) | length')
+  if [ "$UNFIXED_HIGH" -gt 0 ]; then
     echo "⚠️ Security audit failed. Please fix high/critical vulnerabilities before pushing."
     exit 1
   fi
-  echo "✅ No high or critical vulnerabilities found in production dependencies"
+  echo "✅ No high or critical vulnerabilities found in production dependencies (excluding known false positives)"
 
 elif [ "$PACKAGE_MANAGER" = "bun" ]; then
   # Excluding GHSA-5j98-mcp5-4vw2 (CVE-2025-64756): glob CLI command injection

package/typescript/copy-overwrite/.github/workflows/quality.yml

@@ -967,12 +967,25 @@ jobs:
       - name: 🔒 Run security audit
         run: |
           if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            # Run audit and only fail on high or critical vulnerabilities
-            npm audit --production --audit-level=high || exit_code=$?
-            if [ "${exit_code:-0}" -ne 0 ]; then
-              echo "::warning::Found high or critical vulnerabilities"
-              exit $exit_code
+            # Run npm audit in JSON mode and filter out known false positives before failing.
+            # npm audit lacks a native --ignore flag, so we parse JSON and exclude by GHSA ID.
+
+            # Excluding GHSA-3ppc-4f35-3m26: minimatch ReDoS via repeated wildcards
+            # Nested dep in aws-cdk-lib; fix requires minimatch v10 (incompatible with ^3.1.2)
+            # Risk: None - dev-time CDK tooling, no production runtime exposure
+
+            # Excluding GHSA-2g4f-4pwh-qvx6: ajv ReDoS with $data option
+            # Nested dep in aws-cdk-lib and eslint; no fix available via npm
+            # Risk: Low - $data option not used in this application
+
+            AUDIT_JSON=$(npm audit --production --json 2>/dev/null || true)
+            UNFIXED_HIGH=$(echo "$AUDIT_JSON" | jq '[.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical") | .value.via[] | select(type == "object") | .url | ltrimstr("https://github.com/advisories/")] | unique | map(select(. == "GHSA-3ppc-4f35-3m26" or . == "GHSA-2g4f-4pwh-qvx6" | not)) | length')
+            if [ "$UNFIXED_HIGH" -gt 0 ]; then
+              echo "::warning::Found high or critical vulnerabilities (after excluding known false positives)"
+              npm audit --production --audit-level=high || true
+              exit 1
             fi
+            echo "::notice::No high or critical vulnerabilities found (excluding known false positives)"
           elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
             # Yarn audit outputs newline-delimited JSON, so we need to parse each line