@codyswann/lisa 2.119.0 → 2.121.0

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"
@@ -15,6 +15,7 @@
     "lisa-typescript"
   ],
   "skills": "./skills/",
+  "hooks": "./hooks.json",
   "interface": {
     "displayName": "Lisa Harper/Fabric",
     "shortDescription": "Harper/Fabric workflow guidance",

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/hooks/block-migration-edits.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+
+# PreToolUse hook: block Write/Edit on TypeORM migration files.
+# NestJS projects must use `bun run migration:generate` to create migrations
+# from entity diffs. Hand-written migrations drift from entity metadata and
+# break the schema/migration contract.
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+# Exit code 2 blocks the tool call and surfaces stderr to Claude.
+
+JSON_INPUT=$(cat)
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "⚠ block-migration-edits: jq not available, allowing edit" >&2
+  exit 0
+fi
+
+FILE_PATH=$(echo "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+
+if [ -z "$FILE_PATH" ]; then
+  exit 0
+fi
+
+case "$FILE_PATH" in
+  */migrations/*.ts|*/migrations/*.js)
+    cat >&2 <<EOF
+❌ Blocked: Direct edits to TypeORM migration files are not allowed.
+
+File: $FILE_PATH
+
+Entity files (src/database/entities/*.ts) are the single source of
+truth for the database schema in this project. Migrations are a derived
+artifact — generate them from entity diffs:
+
+  1. Edit the entity to express the desired schema.
+  2. Run: bun run migration:generate --name=<DescriptiveName>
+  3. Review the generated migration; commit entity + migration together.
+
+If a schema change cannot be expressed via the entity model, the entity
+model is wrong — fix the entity, do not hand-write the migration.
+
+OUT-OF-BAND MIGRATIONS (seed data, backfills, data transformations,
+one-off cleanup): these genuinely cannot come from entity diffs. They
+are legitimate but they bypass the entity-as-source-of-truth contract.
+
+If you believe this edit is an out-of-band migration:
+  1. STOP and tell the user what change is needed and why it cannot
+     be expressed via the entity model.
+  2. Get explicit approval before proceeding.
+  3. Document the rationale in the migration's class comment.
+
+Do NOT silently hand-write a migration. See the nestjs-rules skill
+for the full rationale.
+EOF
+    exit 2
+    ;;
+esac
+
+exit 0

package/plugins/lisa-nestjs/.codex-plugin/hooks.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./hooks/block-migration-edits.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"
@@ -15,6 +15,7 @@
     "lisa-typescript"
   ],
   "skills": "./skills/",
+  "hooks": "./hooks.json",
   "interface": {
     "displayName": "Lisa NestJS",
     "shortDescription": "NestJS workflow guidance",

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/hooks/inject-rules.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Reads all .md files from the plugin's rules/ directory and injects them
+# into the session context via additionalContext.
+# Used by SessionStart and SubagentStart hooks.
+set -euo pipefail
+
+RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules"
+
+# Bail silently if no rules directory
+[ -d "$RULES_DIR" ] || exit 0
+
+CONTEXT=""
+for file in "$RULES_DIR"/*.md; do
+  [ -f "$file" ] || continue
+  CONTEXT+="$(cat "$file")"$'\n\n'
+done
+
+# Bail if no rules found
+[ -n "$CONTEXT" ] || exit 0
+
+# Output as JSON — jq handles escaping
+jq -n --arg ctx "$CONTEXT" '{"additionalContext": $ctx}'

package/plugins/lisa-rails/.codex-plugin/hooks/rubocop-on-edit.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# RuboCop Lint-and-Format-on-Edit Hook (PostToolUse - Write|Edit)
+# =============================================================================
+# Runs RuboCop -a (safe autocorrect) on each edited Ruby file, then checks for
+# remaining unfixable errors. RuboCop serves as both formatter and linter
+# for Ruby, so this single hook replaces the Prettier + ESLint pipeline.
+#
+# Behavior:
+#   - Exit 0: RuboCop passes or auto-fix resolved all errors
+#   - Exit 1: unfixable errors remain — blocks Claude so it fixes them immediately
+#
+# @see .claude/rules/verification.md "Self-Correction Loop" section
+# =============================================================================
+
+# Extract file path from JSON input
+FILE_PATH=$(cat | grep -o '"file_path":"[^"]*"' | head -1 | cut -d'"' -f4)
+
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if file type is supported (Ruby only)
+case "${FILE_PATH##*.}" in
+    rb) ;;
+    *) exit 0 ;;
+esac
+
+# Validate project directory
+if [ -z "${CLAUDE_PROJECT_DIR:-}" ]; then
+    exit 0
+fi
+
+# Check if file is in a recognized source directory, excluding generated/vendored paths
+RELATIVE_PATH="${FILE_PATH#$CLAUDE_PROJECT_DIR/}"
+case "$RELATIVE_PATH" in
+    db/migrate/*|db/schema.rb) exit 0 ;;
+    vendor/*|bin/*|tmp/*|node_modules/*) exit 0 ;;
+esac
+case "$RELATIVE_PATH" in
+    app/*|lib/*|spec/*|config/*|db/*) ;;
+    *) exit 0 ;;
+esac
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# Verify this is a Ruby project with Bundler
+if [ ! -f "Gemfile" ]; then
+    exit 0
+fi
+
+# Run RuboCop autocorrect — fail only on errors (not warnings/conventions)
+echo "Running RuboCop on: $FILE_PATH"
+
+# First pass: attempt safe auto-correct
+OUTPUT=$(bundle exec rubocop -a --fail-level E "$FILE_PATH" 2>&1)
+FIX_EXIT=$?
+
+if [ $FIX_EXIT -eq 0 ]; then
+    echo "RuboCop: No errors in $(basename "$FILE_PATH")"
+    exit 0
+fi
+
+# Auto-fix resolved some issues but errors remain — re-run to get remaining errors
+OUTPUT=$(bundle exec rubocop --fail-level E "$FILE_PATH" 2>&1)
+LINT_EXIT=$?
+
+if [ $LINT_EXIT -eq 0 ]; then
+    echo "RuboCop: Auto-fixed all errors in $(basename "$FILE_PATH")"
+    exit 0
+fi
+
+# Unfixable errors remain — block with feedback
+echo "RuboCop found unfixable errors in: $FILE_PATH" >&2
+echo "$OUTPUT" >&2
+exit 1

package/plugins/lisa-rails/.codex-plugin/hooks/sg-scan-on-edit.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# ast-grep Scan-on-Edit Hook (PostToolUse - Write|Edit)
+# =============================================================================
+# Runs ast-grep scan on each edited Ruby file to enforce structural code rules.
+# Complements RuboCop by catching patterns that require AST-level analysis.
+#
+# Behavior:
+#   - Exit 0: no issues found or ast-grep not configured
+#   - Exit 1: issues found — blocks Claude so it fixes them immediately
+#
+# @see .claude/rules/verification.md "Self-Correction Loop" section
+# =============================================================================
+
+# Extract file path from JSON input
+FILE_PATH=$(cat | grep -o '"file_path":"[^"]*"' | head -1 | cut -d'"' -f4)
+
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if file type is supported (Ruby only)
+case "${FILE_PATH##*.}" in
+    rb) ;;
+    *) exit 0 ;;
+esac
+
+# Validate project directory
+if [ -z "${CLAUDE_PROJECT_DIR:-}" ]; then
+    exit 0
+fi
+
+# Check if file is in a recognized source directory
+RELATIVE_PATH="${FILE_PATH#$CLAUDE_PROJECT_DIR/}"
+case "$RELATIVE_PATH" in
+    app/*|lib/*|config/*|spec/*) ;;
+    *) exit 0 ;;
+esac
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# Verify ast-grep configuration exists
+if [ ! -f "sgconfig.yml" ]; then
+    exit 0
+fi
+
+# Verify rules are defined
+RULE_COUNT=$(find ast-grep/rules -name "*.yml" -o -name "*.yaml" 2>/dev/null | grep -v ".gitkeep" | wc -l | tr -d ' ')
+if [ "$RULE_COUNT" -eq 0 ]; then
+    exit 0
+fi
+
+# Locate ast-grep binary — prefer local sg, then npx fallback
+if command -v sg >/dev/null 2>&1; then
+    SG_CMD="sg"
+elif command -v npx >/dev/null 2>&1; then
+    SG_CMD="npx @ast-grep/cli"
+else
+    echo "ast-grep: sg binary not found, skipping scan"
+    exit 0
+fi
+
+# Run ast-grep scan
+echo "Running ast-grep scan on: $FILE_PATH"
+if OUTPUT=$($SG_CMD scan "$FILE_PATH" 2>&1); then
+    echo "ast-grep: No issues found in $(basename "$FILE_PATH")"
+    exit 0
+else
+    echo "ast-grep found issues in: $FILE_PATH" >&2
+    echo "$OUTPUT" >&2
+    exit 1
+fi

package/plugins/lisa-rails/.codex-plugin/hooks.json

@@ -0,0 +1,41 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./hooks/inject-rules.sh"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./hooks/inject-rules.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "./hooks/rubocop-on-edit.sh"
+          },
+          {
+            "type": "command",
+            "command": "./hooks/sg-scan-on-edit.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"
@@ -15,6 +15,7 @@
     "lisa"
   ],
   "skills": "./skills/",
+  "hooks": "./hooks.json",
   "interface": {
     "displayName": "Lisa Rails",
     "shortDescription": "Ruby on Rails workflows",

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.119.0",
+  "version": "2.121.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/hooks/block-suppress-directives.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+#
+# PreToolUse hook (Write|Edit): block adding error-suppression directives to
+# JS/TS source. Suppressing the type checker, linter, or formatter hides real
+# defects instead of fixing them, so it is a documented last resort (see the
+# base "ASK FIRST" governance rule). The agent should stop and get the user's
+# approval rather than slip a suppression past silently.
+#
+# Inspects only the NEW text the tool introduces, scoped to JS/TS files, and
+# matches the directive only in comment syntax (// or /*) so prose, strings,
+# and identifiers that merely mention these tokens are not flagged.
+# Exit code 2 blocks the tool call and surfaces stderr to Claude.
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+
+JSON_INPUT=$(cat)
+
+# Project rule (.claude/rules/PROJECT_RULES.md): never parse JSON in shell with
+# grep/sed/cut/awk — always use jq. Fail open without jq so we never hard-block
+# the agent on missing tooling.
+command -v jq >/dev/null 2>&1 || exit 0
+
+FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+[ -n "$FILE_PATH" ] || exit 0
+
+# Only guard JS/TS source. Directives in other file types (docs, configs that
+# document the rules, this script) are not suppressions.
+case "${FILE_PATH##*.}" in
+  ts | tsx | js | jsx | mjs | cjs) ;;
+  *) exit 0 ;;
+esac
+
+# Resolve the new text per tool shape:
+#   Write     -> tool_input.content
+#   MultiEdit -> tool_input.edits[].new_string
+#   Edit      -> tool_input.new_string
+NEW_TEXT=$(printf '%s' "$JSON_INPUT" | jq -r '
+  .tool_input as $i
+  | if   ($i.content     // null) != null then $i.content
+    elif ($i.edits       // null) != null then ([$i.edits[].new_string] | join("\n"))
+    elif ($i.new_string  // null) != null then $i.new_string
+    else "" end')
+
+# Comment-syntax-only match: a // or /* opener, optional whitespace, then the
+# suppression directive. @ts-expect-error is intentionally NOT matched — it is
+# the safer alternative this hook steers toward.
+DIRECTIVE_RE='(//|/\*)[[:space:]]*(@ts-(ignore|nocheck)|eslint-disable|biome-ignore|prettier-ignore)'
+
+if printf '%s' "$NEW_TEXT" | grep -Eq "$DIRECTIVE_RE"; then
+  cat >&2 <<MSG
+❌ Blocked: error-suppression directive in $FILE_PATH
+
+You are adding a @ts-ignore / @ts-nocheck / eslint-disable / biome-ignore /
+prettier-ignore comment. These silence the type checker, linter, or formatter
+instead of fixing the underlying problem. They are a last resort, not a default.
+
+Fix it properly first:
+  - Resolve the actual type/lint error rather than suppressing it.
+  - Add the missing annotation, narrow the type, or restructure the code so the
+    rule passes legitimately.
+  - For a faulty dependency type, prefer a typed wrapper or module augmentation.
+
+If — and only if — there is genuinely no other way (e.g. a known upstream bug):
+  - STOP and get the user's approval before suppressing (base "ASK FIRST" rule).
+  - Prefer @ts-expect-error over @ts-ignore (it fails once the error is gone).
+  - Scope the disable to one line and one rule, never a whole file.
+  - Include a "-- <reason>" description (eslint-comments/require-description).
+MSG
+  exit 2
+fi
+
+exit 0

package/plugins/lisa-typescript/.codex-plugin/hooks/format-on-edit.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+
+# Hook script to format files with Prettier after Claude edits them
+# This script receives JSON input via stdin with tool information
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+
+# Read the JSON input from stdin
+JSON_INPUT=$(cat)
+
+# Extract the file path from the tool_input. Use jq for robust JSON parsing
+# (never grep/sed/cut — a JSON shape change silently skips formatting). Fail
+# open without jq so we never hard-block an edit.
+command -v jq >/dev/null 2>&1 || exit 0
+FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Check if we successfully extracted a file path
+if [ -z "$FILE_PATH" ]; then
+    echo "⚠ Skipping Prettier: Could not extract file path from Edit tool input" >&2
+    exit 0  # Exit gracefully to not interrupt Claude's workflow
+fi
+
+# Check if the file exists
+if [ ! -f "$FILE_PATH" ]; then
+    echo "⚠ Skipping Prettier: File does not exist: $FILE_PATH" >&2
+    exit 0  # Exit gracefully
+fi
+
+# Get the file extension
+FILE_EXT="${FILE_PATH##*.}"
+
+# Check if this is a TypeScript or JavaScript file that should be formatted
+# Based on package.json format command: "prettier --write \"src/**/*.ts\" \"test/**/*.ts\""
+case "$FILE_EXT" in
+    ts|tsx|js|jsx|json)
+        # File type is supported for formatting
+        ;;
+    *)
+        echo "ℹ Skipping Prettier: File type .$FILE_EXT is not configured for auto-formatting"
+        exit 0
+        ;;
+esac
+
+# Change to the project directory to ensure package manager commands work
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# Resolve Prettier binary — prefer local node_modules/.bin, then package-manager exec
+if [ -x "./node_modules/.bin/prettier" ]; then
+    PRETTIER_CMD="./node_modules/.bin/prettier"
+    PKG_MANAGER="npm"
+elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    PRETTIER_CMD="bunx prettier"
+    PKG_MANAGER="bun"
+elif [ -f "pnpm-lock.yaml" ]; then
+    PRETTIER_CMD="pnpm exec prettier"
+    PKG_MANAGER="pnpm"
+elif [ -f "yarn.lock" ]; then
+    PRETTIER_CMD="yarn exec prettier"
+    PKG_MANAGER="yarn"
+else
+    PRETTIER_CMD="npx prettier"
+    PKG_MANAGER="npm"
+fi
+
+# Run Prettier on the specific file
+echo "🎨 Running Prettier on: $FILE_PATH"
+$PRETTIER_CMD --write "$FILE_PATH" 2>&1 | grep -v "run v" | grep -v "Done in"
+
+# Check the exit status
+if [ ${PIPESTATUS[0]} -eq 0 ]; then
+    echo "✓ Successfully formatted: $(basename "$FILE_PATH")"
+else
+    echo "⚠ Prettier formatting failed for: $FILE_PATH" >&2
+    echo "  You may need to run '$PKG_MANAGER run format' manually to fix formatting issues." >&2
+fi
+
+# Always exit successfully to not interrupt Claude's workflow
+exit 0

package/plugins/lisa-typescript/.codex-plugin/hooks/lint-on-edit.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# Lint-on-Edit Hook (PostToolUse - Write|Edit)
+# =============================================================================
+# Runs oxlint --fix, then ESLint --fix --quiet --cache on each edited
+# TypeScript file. Part of the inline self-correction pipeline:
+#   prettier → ast-grep → oxlint --fix → eslint --fix
+#
+# oxlint runs first because it's a Rust-native linter (~1000x faster) that
+# covers the majority of rules, leaving only the slow / type-aware / plugin
+# rules for ESLint to handle.
+#
+# Behavior:
+#   - Exit 0: lint passes or auto-fix resolved all errors
+#   - Exit 2: unfixable errors remain — blocks Claude so it fixes them immediately
+#
+# @see .claude/rules/verfication.md "Self-Correction Loop" section
+# =============================================================================
+
+# Extract file path from JSON input. Use jq for robust JSON parsing (never
+# grep/sed/cut — a shape change would silently skip the blocking lint gate).
+# Fail open without jq so we never hard-block an edit.
+command -v jq >/dev/null 2>&1 || exit 0
+FILE_PATH=$(cat | jq -r '.tool_input.file_path // empty')
+
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if file type is supported (TypeScript only)
+case "${FILE_PATH##*.}" in
+    ts|tsx) ;;
+    *) exit 0 ;;
+esac
+
+# Validate project directory
+if [ -z "${CLAUDE_PROJECT_DIR:-}" ]; then
+    exit 0
+fi
+
+# Check if file is in a source directory
+RELATIVE_PATH="${FILE_PATH#$CLAUDE_PROJECT_DIR/}"
+case "$RELATIVE_PATH" in
+    src/*|apps/*|libs/*|test/*|tests/*|features/*|components/*|hooks/*|screens/*|app/*|constants/*|utils/*|providers/*|stores/*) ;;
+    *) exit 0 ;;
+esac
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# Resolve oxlint and ESLint binaries — prefer local node_modules/.bin
+if [ -x "./node_modules/.bin/oxlint" ]; then
+    OXLINT_CMD="./node_modules/.bin/oxlint"
+elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    OXLINT_CMD="bunx oxlint"
+elif [ -f "pnpm-lock.yaml" ]; then
+    OXLINT_CMD="pnpm exec oxlint"
+elif [ -f "yarn.lock" ]; then
+    OXLINT_CMD="yarn exec oxlint"
+else
+    OXLINT_CMD="npx oxlint"
+fi
+
+if [ -x "./node_modules/.bin/eslint" ]; then
+    ESLINT_CMD="./node_modules/.bin/eslint"
+elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    ESLINT_CMD="bunx eslint"
+elif [ -f "pnpm-lock.yaml" ]; then
+    ESLINT_CMD="pnpm exec eslint"
+elif [ -f "yarn.lock" ]; then
+    ESLINT_CMD="yarn exec eslint"
+else
+    ESLINT_CMD="npx eslint"
+fi
+
+# 1) oxlint --fix (REQUIRED in the Phase 2 hybrid pipeline)
+# If oxlint is missing the project is out of sync with the current Lisa
+# governance — fail loudly rather than silently skipping. ESLint alone is
+# no longer a complete lint pass.
+if [ ! -x "./node_modules/.bin/oxlint" ] && ! command -v "${OXLINT_CMD%% *}" >/dev/null 2>&1; then
+    echo "oxlint is required but not installed in this project." >&2
+    echo "Add 'oxlint' as a devDependency (Lisa governance pins it via package.lisa.json) and run install." >&2
+    exit 2
+fi
+
+if [ ! -f ".oxlintrc.json" ] && [ ! -f ".oxlintrc.jsonc" ] && [ ! -f "oxlint.config.ts" ]; then
+    echo "oxlint is installed but no .oxlintrc.json found. Run 'lisa update' to install the stack template." >&2
+    exit 2
+fi
+
+echo "Running oxlint --fix on: $FILE_PATH"
+OX_OUTPUT=$($OXLINT_CMD --fix --quiet "$FILE_PATH" 2>&1)
+OX_EXIT=$?
+if [ $OX_EXIT -ne 0 ]; then
+    # Re-run without --fix to capture remaining errors
+    OX_OUTPUT=$($OXLINT_CMD --quiet "$FILE_PATH" 2>&1)
+    OX_EXIT=$?
+    if [ $OX_EXIT -ne 0 ]; then
+        echo "oxlint found unfixable errors in: $FILE_PATH" >&2
+        echo "$OX_OUTPUT" >&2
+        exit 2
+    fi
+fi
+
+# 2) ESLint --fix --quiet --cache
+# --quiet: suppress warnings, only show errors
+# --cache: use ESLint cache for performance
+# --rule: disable no-unused-vars auto-fix to prevent removing imports that Claude
+#         plans to use in a subsequent edit (pre-commit hook still catches them)
+echo "Running ESLint --fix on: $FILE_PATH"
+
+# First pass: attempt auto-fix
+OUTPUT=$($ESLINT_CMD --fix --quiet --cache --rule '@typescript-eslint/no-unused-vars: off' "$FILE_PATH" 2>&1)
+FIX_EXIT=$?
+
+if [ $FIX_EXIT -eq 0 ]; then
+    echo "ESLint: No errors in $(basename "$FILE_PATH")"
+    exit 0
+fi
+
+# Auto-fix resolved some issues but errors remain — re-run to get remaining errors
+OUTPUT=$($ESLINT_CMD --quiet --cache "$FILE_PATH" 2>&1)
+LINT_EXIT=$?
+
+if [ $LINT_EXIT -eq 0 ]; then
+    echo "ESLint: Auto-fixed all errors in $(basename "$FILE_PATH")"
+    exit 0
+fi
+
+# Unfixable errors remain — block with feedback
+echo "ESLint found unfixable errors in: $FILE_PATH" >&2
+echo "$OUTPUT" >&2
+exit 2