@codyswann/lisa 2.119.1 → 2.121.1

package/plugins/lisa-copilot/agents/verification-specialist.agent.md

@@ -0,0 +1,135 @@
+---
+name: verification-specialist
+description: Verification specialist agent. Discovers project tooling and executes verification for all required types. Plans and executes empirical proof that work is done by running the actual system and observing results.
+skills:
+  - verification-lifecycle
+  - codify-verification
+  - jira-journey
+  - spec-conformance
+---
+
+# Verification Specialist Agent
+
+You are a verification specialist. Your job is to **prove empirically** that work is done -- not by reading code, but by running the actual system and observing the results.
+
+Read `.claude/rules/verification.md` at the start of every investigation for the full verification framework, types, and lifecycle.
+
+## Core Philosophy
+
+**"If you didn't run it, you didn't verify it."** Code review is not verification. Reading a test file is not verification. **Running tests, typecheck, and lint is not verification either — those are quality gates (prerequisites).** Only executing the actual system and observing output counts as proof. Verification means making HTTP requests, clicking through the UI, running CLI commands, querying the database, or otherwise interacting with the running software as an end user would.
+
+## Verification Process
+
+Follow the verification lifecycle: **confirm quality gates, classify, check tooling, fail fast, plan, execute, codify, spec conformance, loop.**
+
+### 1. Confirm Quality Gates
+
+Confirm that quality gates (tests, typecheck, lint, format) pass. These are prerequisites — if they fail, fix them first. But passing quality gates does NOT mean the change is verified.
+
+### 2. Classify
+
+Read `.claude/rules/verification.md` to determine which **empirical verification types** apply to the current change (UI, API, Database, Auth, etc.). Do NOT include tests, typecheck, or lint here — those are quality gates handled in step 1.
+
+### 3. Discover Available Tools
+
+Before creating anything new, find what the project already has.
+
+**Project manifest:**
+- Read the manifest file for available scripts and their variants (build, test, lint, deploy, start, environment-specific variants)
+
+**Script directories:**
+- Search for shell scripts, automation files, and task runners in `scripts/`, `bin/`, and project root
+
+**Test infrastructure:**
+- Check for test framework configurations, E2E test directories, test fixtures, seed data, and factory files
+
+**Cloud/infrastructure tooling:**
+- Search for cloud CLI wrappers, deployment scripts, infrastructure-as-code configs
+- Check environment files for service URLs and connection strings
+- Look for health check endpoints or status pages already defined
+
+**MCP tools:**
+- Check available MCP server tools for browser automation, observability, issue tracking, and other capabilities
+
+### 4. Plan the Verification
+
+For each required verification type, determine:
+
+| Question | Answer needed |
+|----------|---------------|
+| What is the expected behavior? | Specific, observable outcome |
+| How can a user/caller trigger it? | HTTP request, UI action, CLI command, cron trigger |
+| What does success look like? | Status code, response body, UI state, database record |
+| What does failure look like? | Error message, wrong status, missing data |
+| What prerequisites are needed? | Running server, seeded database, auth token, test user |
+| What tool/command will be used? | Discovered tool from step 2 |
+
+If any required verification type has no available tool and no reasonable alternative, escalate immediately.
+
+### 5. Execute and Report
+
+Run the verification and capture output. Always include:
+
+- The exact command that was run
+- The full output (or relevant portion)
+- Whether it matched the expected result
+- If it failed, what the actual output was
+
+If any verification fails, fix and re-verify. Do not declare done until all required types pass.
+
+### 6. Codify
+
+For every empirical verification that produced PASS evidence, invoke the `codify-verification` skill to encode it as a regression test in the appropriate framework (Playwright for UI, integration test for API/DB/auth, benchmark for performance, etc.). The new test must run, pass, and be committed in the same PR. Skipping codification is allowed only for non-behavioral types (PR, Documentation, Deploy) and Investigate-Only spikes — for everything else, codify or escalate.
+
+## Output Format
+
+```
+## Verification Report
+
+### Prerequisites
+- [x] Prerequisite 1 (how it was confirmed)
+- [x] Prerequisite 2 (how it was confirmed)
+- [ ] Prerequisite 3 (unavailable -- verification blocked)
+
+### Verification Results
+
+| # | Type | What was verified | Command | Result |
+|---|------|-------------------|---------|--------|
+| 1 | Test | Description | `command` | PASS/FAIL |
+| 2 | Type Safety | Description | `command` | PASS/FAIL |
+
+### Evidence
+
+#### Verification 1: <description>
+**Command:**
+\`\`\`bash
+<exact command>
+\`\`\`
+**Output:**
+\`\`\`
+<actual output>
+\`\`\`
+**Expected:** <what success looks like>
+**Result:** PASS/FAIL
+
+### Scripts Created
+- `scripts/verify-<feature>.sh` -- purpose (delete after verification if temporary)
+
+### Blocked Verifications
+- [type] -- blocked because [reason], would need [what]
+```
+
+## Rules
+
+- Always read `.claude/rules/verification.md` first for the project's verification standards and type taxonomy
+- Follow the verification lifecycle: confirm quality gates, classify, check tooling, fail fast, plan, execute, codify, spec conformance, loop
+- Every passing empirical verification must be codified as a regression test via `codify-verification` before declaring done (skip allowed only for PR / Documentation / Deploy / Investigate-Only)
+- Tests, typecheck, lint, and format are quality gates (prerequisites), NOT verification — never report them as verification evidence
+- Discover existing project scripts and tools before creating new ones
+- Every verification must produce observable output -- a status code, a response body, a UI state, a test result
+- Verification scripts must be runnable locally without CI/CD dependencies
+- When creating verification scripts, make them idempotent (safe to run multiple times)
+- Clean up temporary verification scripts after use unless the user wants to keep them
+- If a verification is blocked (missing service, credentials, etc.), report exactly what is needed to unblock it -- do not skip it
+- Never report "verified by reading the code" -- that is not verification
+- Always capture and report the actual output, even on failure -- the output is the evidence

package/plugins/lisa-copilot/commands/automation-status.md

@@ -0,0 +1,12 @@
+---
+description: "Inspect the current project's Lisa automation fleet and report whether the expected recurring jobs exist, match Lisa's setup contract, and show healthy recent activity. Read-only by default."
+---
+
+Use the /lisa:automation-status skill to inspect the current project's expected Lisa automations, compare them with the runtime's scheduler metadata, and report fleet health, drift, staleness, unsupported jobs, and remediation hints. $ARGUMENTS
+
+Common operator usage:
+
+- `/lisa:automation-status`
+- `/lisa:automation-status --verbose`
+
+This surface is read-only in v1. Use it to understand whether Lisa's unattended jobs are healthy before deciding whether to rerun `/lisa:setup-automations`, inspect scheduler errors, or use `/lisa:intake` / `/lisa:repair-intake` to address queue fallout.

package/plugins/lisa-copilot/commands/codify-verification.md

@@ -0,0 +1,6 @@
+---
+description: "Convert empirical verification into a regression test (Playwright for UI, integration test for API/DB, benchmark for performance, etc.) so it doesn't regress. Mandatory step after verification passes — invoked from verification-lifecycle and from each Build/Fix/Improve flow."
+argument-hint: "<verification-type> <what-was-verified>"
+---
+
+Use the /lisa:codify-verification skill to encode the empirical verification that just passed as a regression test, in the appropriate framework for the verification type. $ARGUMENTS

package/plugins/lisa-copilot/commands/debrief/apply.md

@@ -0,0 +1,6 @@
+---
+description: "Apply human-marked dispositions from a Debrief triage document — route accepted learnings to their persistence destinations (Edge Case Brainstorm checklist, project rules, memory, tracker tickets). Reads the triage doc produced by /lisa:debrief; deterministic and idempotent."
+argument-hint: "<path to triage doc | URL>"
+---
+
+Use the /lisa:debrief:apply command (which invokes the `lisa:debrief-apply` skill) to read the triage document at $ARGUMENTS, parse human dispositions, and persist accepted learnings to their categorized destinations.

package/plugins/lisa-copilot/commands/debrief.md

@@ -0,0 +1,6 @@
+---
+description: "Debrief a shipped initiative — mine tickets, PRs, and review threads to surface candidate learnings (edge cases, gotchas, friction, tooling gaps, convention drift) for human triage. Stops after producing the triage doc; persistence happens in /lisa:debrief:apply."
+argument-hint: "<PRD URL | epic key | epic URL>"
+---
+
+Use the /lisa:debrief skill to walk the original Plan, mine completed work units and their PRs, and produce a triage-ready learnings document for $ARGUMENTS.

package/plugins/lisa-copilot/commands/doctor.md

@@ -0,0 +1,6 @@
+---
+description: "Audit whether the current repository is ready to use Lisa. Runs grouped read-only readiness checks for config, runtime surfaces, tracker/source access, automation prerequisites, and optional GitHub Project/wiki coordination, then reports PASS/WARN/FAIL/SKIP results plus an overall verdict."
+argument-hint: "[--fix=false]"
+---
+
+Use the /lisa:doctor skill to audit whether the current repository is ready to use Lisa, report grouped PASS/WARN/FAIL/SKIP checks, and emit an overall readiness verdict. $ARGUMENTS

package/plugins/lisa-copilot/commands/fix/linter-error.md

@@ -0,0 +1,7 @@
+---
+description: "Fix all violations of one or more ESLint rules across the codebase"
+allowed-tools: ["Skill"]
+argument-hint: "<rule-1> [rule-2] [rule-3] ..."
+---
+
+Use the /lisa:fix-linter-error skill to fix linter errors. $ARGUMENTS

package/plugins/lisa-copilot/commands/git/commit.md

@@ -0,0 +1,7 @@
+---
+description: "Create conventional commits for current changes"
+allowed-tools: ["Skill"]
+argument-hint: "[commit-message-hint]"
+---
+
+Use the /lisa:git-commit skill to create conventional commits for current changes. $ARGUMENTS

package/plugins/lisa-copilot/commands/git/prune.md

@@ -0,0 +1,6 @@
+---
+description: "Prune local branches that have been deleted on remote"
+allowed-tools: ["Skill"]
+---
+
+Use the /lisa:git-prune skill to prune local branches that have been deleted on remote.

package/plugins/lisa-copilot/commands/git/submit-pr.md

@@ -0,0 +1,7 @@
+---
+description: "Push changes and create or update a pull request"
+allowed-tools: ["Skill"]
+argument-hint: "[pr-title-or-description-hint]"
+---
+
+Use the /lisa:git-submit-pr skill to push changes and create or update a pull request. $ARGUMENTS

package/plugins/lisa-copilot/commands/implement.md

@@ -0,0 +1,6 @@
+---
+description: "Implement a single work item end-to-end. Vendor-agnostic: given a work-item URL/key (JIRA, Linear, GitHub Issues) or description, reads it, determines work type (Build/Fix/Improve/Investigate), assembles an agent team, runs the full lifecycle through PR + evidence. For batch processing of all Status=Ready tickets in a queue, use /lisa:intake instead."
+argument-hint: "<single-work-item-url | key | description>"
+---
+
+Use the /lisa:implement skill to take the work item from spec to shipped: read the source, determine work type, assemble an agent team, and run the full lifecycle through PR creation, code review, deploy, and empirical verification. $ARGUMENTS

package/plugins/lisa-copilot/commands/improve/code-complexity.md

@@ -0,0 +1,6 @@
+---
+description: "Reduce the cognitive complexity threshold by 2 and fix all violations"
+allowed-tools: ["Skill"]
+---
+
+Use the /lisa:improve-code-complexity skill to lower code complexity.

package/plugins/lisa-copilot/commands/improve/max-lines-per-function.md

@@ -0,0 +1,7 @@
+---
+description: "Reduce max lines per function threshold and fix violations"
+allowed-tools: ["Skill"]
+argument-hint: "<max-lines-per-function-value>"
+---
+
+Use the /lisa:improve-max-lines-per-function skill to reduce max function lines. $ARGUMENTS

package/plugins/lisa-copilot/commands/improve/max-lines.md

@@ -0,0 +1,7 @@
+---
+description: "Reduce max file lines threshold and fix violations"
+allowed-tools: ["Skill"]
+argument-hint: "<max-lines-value>"
+---
+
+Use the /lisa:improve-max-lines skill to reduce max lines. $ARGUMENTS

package/plugins/lisa-copilot/commands/improve/test-coverage.md

@@ -0,0 +1,7 @@
+---
+description: "Increase test coverage to a specified threshold percentage"
+allowed-tools: ["Skill"]
+argument-hint: "<threshold-percentage>"
+---
+
+Use the /lisa:improve-test-coverage skill to increase test coverage. $ARGUMENTS

package/plugins/lisa-copilot/commands/improve/tests.md

@@ -0,0 +1,7 @@
+---
+description: "Improve test quality by analyzing and strengthening weak, brittle, or poorly-written tests"
+allowed-tools: ["Skill"]
+argument-hint: "<target-description>"
+---
+
+Use the /lisa:improve-tests skill to improve test quality. $ARGUMENTS

package/plugins/lisa-copilot/commands/intake-explain.md

@@ -0,0 +1,31 @@
+---
+description: "Inspect one PRD or build item, explain how Lisa classifies it right now, and report the exact intake or repair gate affecting it. Read-only by default."
+argument-hint: "<item-ref>"
+---
+
+Use the /lisa:intake-explain skill to inspect a single repo-scoped PRD or build item, explain its current lifecycle role, and report whether Lisa would intake it, repair it, hold it, skip it, or leave it product-owned. $ARGUMENTS
+
+Common operator usage:
+
+- `/lisa:intake-explain https://github.com/acme/repo/issues/123`
+- `/lisa:intake-explain PRD-456`
+- `/lisa:intake-explain https://linear.app/acme/issue/ENG-123/example`
+
+The diagnosis uses stable verdicts:
+
+- `ELIGIBLE_FOR_INTAKE`: run `/lisa:intake <queue>` when normal pickup is the next move.
+- `ELIGIBLE_FOR_REPAIR`: run `/lisa:repair-intake <queue>` when Lisa-owned stuck work is actionable.
+- `WAITING_ON_STALENESS`: wait and re-check after the configured freshness window.
+- `HELD_BY_BLOCKERS`: clear the listed dependency or blocker before rerunning intake.
+- `NON_LEAF_CONTAINER`: decompose the item or move build-ready status to leaf work.
+- `PRODUCT_OWNED_STATE`: finish product clarification, promotion, or verification first.
+- `MISCONFIGURED`: fix lifecycle labels, repo scope, or queue configuration before relying on automation.
+
+Use it for these operator workflows:
+
+- Intake triage: confirm whether one item would be picked up by `/lisa:intake` right now.
+- Repair triage: decide whether a blocked or in-progress item is stale enough for `/lisa:repair-intake`.
+- Product follow-up: distinguish product-owned draft/shipped/verified states from Lisa-owned work.
+- Queue cleanup: identify leaf-only, repo-scope, dependency, or lifecycle-adoption fixes without mutating the item.
+
+This surface is read-only in v1. It never claims, relabels, comments on, repairs, or decomposes the item; it only reports the item facts, verdict, decisive gate, and smallest useful next action before an operator chooses `/lisa:intake`, `/lisa:repair-intake`, `/lisa:queue-status`, or a tracker-native fix.

package/plugins/lisa-copilot/commands/intake.md

@@ -0,0 +1,6 @@
+---
+description: "Vendor-agnostic batch scanner for Ready queues. Notion PRD database URL → finds Status=Ready PRDs and runs lisa:plan per item. Confluence space or parent-page URL → finds prd-ready PRDs and runs lisa:plan per item. Linear workspace or team URL → finds prd-ready Linear projects and runs lisa:plan per item. GitHub repo URL or org/repo token → finds prd-ready GitHub issues and runs lisa:plan per item (PRD-source mode), or finds status:ready issues and runs lisa:implement per item when tracker=github (build-queue mode). JIRA project key or JQL → finds Ready tickets and runs lisa:implement per item. Designed as the cron target for /schedule."
+argument-hint: "<Notion-PRD-database-URL | Confluence-space-URL | Confluence-parent-page-URL | Linear-workspace-URL | Linear-team-URL | GitHub-repo-URL | org/repo | JIRA-project-key | JQL-filter>"
+---
+
+Use the /lisa:intake skill to scan the queue for Ready items and dispatch one eligible Ready item per invocation through the appropriate single-item lifecycle skill — and, on the PRD side, close the loop by dispatching /lisa:verify-prd for one shipped PRD per cycle (shipped → verified on pass, or re-opened to ticketed with build-ready fix tickets that auto-build and re-verify on fail — never blocked). $ARGUMENTS

package/plugins/lisa-copilot/commands/monitor.md

@@ -0,0 +1,6 @@
+---
+description: "Monitor application health across environments. Health endpoints, recent logs, error-rate spikes, performance, optional browser UAT. Routes to the stack-specific ops-specialist."
+argument-hint: "[environment]"
+---
+
+Use the /lisa:monitor skill to check application health, logs, errors, and performance for the named environment. $ARGUMENTS

package/plugins/lisa-copilot/commands/plan.md

@@ -0,0 +1,6 @@
+---
+description: "Plan work from a single PRD or specification. Decomposes into ordered work items in the configured tracker (JIRA, GitHub Issues, or Linear per .lisa.config.json). Source can be a Notion / Confluence / Linear / GitHub Issue URL, a JIRA epic key, a markdown file, or a free-form description. For batch scanning of all Ready PRDs in a queue, use /lisa:intake instead."
+argument-hint: "<single-PRD-url | GitHub-issue-url | @file | ticket-id-or-url | description>"
+---
+
+Use the /lisa:plan skill to decompose the PRD/spec into ordered work items in the configured tracker. $ARGUMENTS

package/plugins/lisa-copilot/commands/plugin-sync-explain.md

@@ -0,0 +1,8 @@
+---
+description: "Explain plugin source/generated drift and marketplace registration gaps without modifying the working tree."
+argument-hint: "[path]"
+---
+
+Use the /lisa:plugin-sync-explain skill to inspect plugin source/generated synchronization for the current Lisa repo. $ARGUMENTS
+
+This command is read-only. It reports source-not-built edits, generated-only edits, marketplace registration drift, and the next source-first remediation step before an operator runs `bun run build:plugins` or `bun run check:plugins`.

package/plugins/lisa-copilot/commands/product-walkthrough.md

@@ -0,0 +1,7 @@
+---
+description: "Walk through the live product via a real browser (Playwright MCP) to ground PRD evaluation or ticket creation in what exists today. Captures current behavior, design-vs-product divergence, reuse candidates, and behavioral surprises."
+allowed-tools: ["Skill"]
+argument-hint: "<route or feature area to walk>"
+---
+
+Use the /lisa:product-walkthrough skill to walk through the live product, capture current state, and produce findings that ground PRD/ticket reasoning. $ARGUMENTS

package/plugins/lisa-copilot/commands/project-ideation.md

@@ -0,0 +1,6 @@
+---
+description: "Generate persona-grounded, verifiable product ideas for the host project, then create PRDs for the selected build-ready ideas via lisa:research. First derives the personas the project actually serves (from its docs, code, data model, and releases — never invented), ideates per persona, and gates each idea on an obtainable data/source path and an empirical verification plan. Creates one PRD by default (top-ranked idea); max_prds widens the batch. prd_ready=true creates them prd-ready for auto-pickup by lisa:intake; default is draft for human review."
+argument-hint: "[target path | external product] [prd_ready=true|false] [max_prds=<n>|all]"
+---
+
+Use the /lisa:project-ideation skill to derive evidence-grounded personas, ideate per persona, gate the ideas, and create PRDs for the selected build-ready ideas via lisa:research — in draft state by default, or prd-ready when prd_ready=true; one PRD by default, more with max_prds. $ARGUMENTS

package/plugins/lisa-copilot/commands/pull-request/review.md

@@ -0,0 +1,7 @@
+---
+description: "Checks for code review comments on a PR and implements them if required."
+allowed-tools: ["Skill"]
+argument-hint: "<github-pr-link>"
+---
+
+Use the /lisa:pull-request-review skill to check for code review comments and implement them. $ARGUMENTS

package/plugins/lisa-copilot/commands/queue-status.md

@@ -0,0 +1,34 @@
+---
+description: "Inspect the current project's PRD and build queues, summarize lifecycle counts, and surface actionable queue-health signals without mutating work."
+---
+
+Use the /lisa:queue-status skill to inspect the current project's configured PRD source and build tracker, report queue-health verdicts, and highlight actionable backlog or stuck-state signals. $ARGUMENTS
+
+Common operator usage:
+
+- `/lisa:queue-status`
+- `/lisa:queue-status queue=prd`
+- `/lisa:queue-status queue=build`
+
+Use this when you need to answer:
+
+- Is the queue actually idle, or is Lisa misconfigured?
+- Which queue item is the most actionable next?
+- Should the next command be `/lisa:intake`, `/lisa:repair-intake`, `/lisa:automation-status`, or `/lisa:verify-prd`?
+
+This surface is read-only in v1. Use it to understand whether the repo's PRD and build queues are idle, healthy, attention-needed, or misconfigured before deciding whether to run `/lisa:intake`, `/lisa:repair-intake`, `/lisa:automation-status`, `/lisa:verify-prd`, or deeper tracker-native investigation.
+
+Quick interpretation guide:
+
+- `IDLE`: the queue resolved correctly and nothing actionable is waiting. No immediate Lisa action is required.
+- `HEALTHY`: the queue resolved correctly and normal work is present. Follow the highlighted next step, usually `/lisa:intake`.
+- `ATTENTION_NEEDED`: blocked, stalled, or aging work needs operator follow-up. Use the highlighted item and remediation hint to choose the next command, usually `/lisa:repair-intake`.
+- `MISCONFIGURED`: queue resolution or lifecycle adoption is broken. Fix config, labels/statuses, or scheduler drift before trusting queue state.
+
+Highlighted-item semantics:
+
+- A highlighted item is the single oldest or most actionable queue item for that section, not a full dump of all matching work.
+- `ready` highlights usually point to `/lisa:intake`.
+- `blocked`, stalled, or long-claimed highlights usually point to `/lisa:repair-intake`.
+- Shipped PRD highlights usually point to `/lisa:verify-prd`.
+- If queue behavior looks wrong for both PRD and build lanes, inspect `/lisa:automation-status` before assuming the queue itself is the problem.

package/plugins/lisa-copilot/commands/repair-intake.md

@@ -0,0 +1,6 @@
+---
+description: "Repair counterpart to /lisa:intake. Vendor-agnostic batch scanner that finds stuck or half-closed work — items left in `blocked`, stalled in an in-progress role (build `claimed`, PRD `in_review`), terminal-labeled items still natively open, and rollups whose children are all terminal — across the same queues /lisa:intake serves (Notion / Confluence / Linear / GitHub PRDs; JIRA / GitHub / Linear build issues). Repairs every materially actionable candidate inside the `max_candidates` cap: resumes stalled in-progress work in place — but for a stalled build it first diagnoses the PR/deploy state and, if the PR cannot merge (conflict, rebase, failing checks, unaddressed CodeRabbit/changes-requested) or a deploy failed, files a build-ready fix ticket and moves the item to `blocked` (blocked by it) instead of re-dispatching — re-validates blocked PRDs, re-dispatches blocked build items whose blockers have cleared, performs terminal native closure, and closes out completed rollups. Cron-safe and bounded; default GitHub intake_mode is both and default max_candidates is 100."
+argument-hint: "<Notion-PRD-database-URL | Confluence-space-URL | Confluence-parent-page-URL | Linear-workspace-URL | Linear-team-URL | GitHub-repo-URL | org/repo | JIRA-project-key | JQL-filter> [intake_mode=prd|build|both] [stale_after=2h] [max_candidates=100] [force=true]"
+---
+
+Use the /lisa:repair-intake skill to scan the queue for stuck or half-closed items and repair every materially actionable candidate inside `max_candidates` (default 100). For GitHub queues, default `intake_mode` to `both` when the caller omits it. $ARGUMENTS

package/plugins/lisa-copilot/commands/research.md

@@ -0,0 +1,6 @@
+---
+description: "Research a problem space and create a PRD in the configured PRD source. Investigates the codebase, defines user flows, assesses technical feasibility, synthesizes the spec, then creates it in the source (Notion / Confluence / GitHub / Linear) via lisa:prd-source-write — no loose document. prd_ready=true creates it prd-ready for auto-pickup by lisa:intake; default is draft for the Plan flow / human review."
+argument-hint: "<problem-statement-or-feature-idea> [prd_ready=true|false]"
+---
+
+Use the /lisa:research skill to research the problem and create a PRD in the configured source — in draft state by default, or prd-ready when prd_ready=true. $ARGUMENTS

package/plugins/lisa-copilot/commands/review/local.md

@@ -0,0 +1,6 @@
+---
+description: "Review local branch changes compared to main"
+allowed-tools: ["Skill"]
+---
+
+Use the /lisa:review-local skill to review local changes.

package/plugins/lisa-copilot/commands/security/zap-scan.md

@@ -0,0 +1,6 @@
+---
+description: "Run an OWASP ZAP baseline security scan locally using Docker"
+allowed-tools: ["Skill"]
+---
+
+Use the /lisa:security-zap-scan skill to run an OWASP ZAP baseline security scan.

package/plugins/lisa-copilot/commands/setup/atlassian.md

@@ -0,0 +1,7 @@
+---
+description: "Set up Atlassian (cloudId + acli profile) for this project. Writes the `atlassian` section of `.lisa.config.json` and enables the Atlassian MCP and/or installs acli as needed. Prerequisite for /lisa:setup:jira and /lisa:setup:confluence."
+allowed-tools: ["Skill"]
+argument-hint: "[--site=<site>] [--email=<email>]"
+---
+
+Use the /lisa:setup-atlassian skill to configure Atlassian access for this project. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup/confluence.md

@@ -0,0 +1,7 @@
+---
+description: "Set up Confluence as the PRD source for this project. Writes the `confluence` section of `.lisa.config.json` (spaceKey and/or parentPageId) and offers to set top-level `source: \"confluence\"`. Depends on /lisa:setup:atlassian."
+allowed-tools: ["Skill"]
+argument-hint: "[--space=<KEY>] [--parent=<pageId>]"
+---
+
+Use the /lisa:setup-confluence skill to configure Confluence as the PRD source. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup/github.md

@@ -0,0 +1,7 @@
+---
+description: "Set up GitHub Issues as the tracker and/or PRD source for this project. Verifies the gh CLI, resolves org/repo, scaffolds the `status:*` (build) and/or `prd-*` (PRD) label namespaces, writes the `github` section of `.lisa.config.json`, and can document optional GitHub ProjectV2 coordination before offering top-level `tracker: \"github\"` / `source: \"github\"`. No /lisa:setup:atlassian prerequisite."
+allowed-tools: ["Skill"]
+argument-hint: "[--repo=<org/repo>]"
+---
+
+Use the /lisa:setup-github skill to configure GitHub as the tracker and/or PRD source. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup/jira.md

@@ -0,0 +1,7 @@
+---
+description: "Set up JIRA as the tracker for this project. Writes `jira.project` and offers to set top-level `tracker: \"jira\"` in `.lisa.config.json`. Depends on /lisa:setup:atlassian (needs cloudId)."
+allowed-tools: ["Skill"]
+argument-hint: "[--project=<KEY>]"
+---
+
+Use the /lisa:setup-jira skill to configure JIRA as the project tracker. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup/linear.md

@@ -0,0 +1,7 @@
+---
+description: "Set up Linear as the tracker and/or PRD source for this project. Verifies Linear access (MCP OAuth or a personal API key in keychain), resolves the workspace slug and team key, scaffolds the `status:*` issue-label (build) and/or `prd-*` project-label (PRD) namespaces, writes the `linear` section of `.lisa.config.json`, and offers to set top-level `tracker: \"linear\"` / `source: \"linear\"`. No /lisa:setup:atlassian prerequisite."
+allowed-tools: ["Skill"]
+argument-hint: "[--workspace=<slug>] [--team=<KEY>]"
+---
+
+Use the /lisa:setup-linear skill to configure Linear as the tracker and/or PRD source. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup/notion.md

@@ -0,0 +1,7 @@
+---
+description: "Set up Notion as the PRD source for this project. Walks the user through creating a workspace-scoped internal-integration token, sharing the PRD database with it, and stores the token in OS keychain. Writes `notion.workspaceId`, `notion.prdDatabaseId`, and `notion.values` into `.lisa.config.json`. Offers to set top-level `source: \"notion\"`."
+allowed-tools: ["Skill"]
+argument-hint: "[--database=<uuid>] [--workspace=<slug>]"
+---
+
+Use the /lisa:setup-notion skill to configure Notion as the PRD source. $ARGUMENTS

package/plugins/lisa-copilot/commands/setup-automations.md

@@ -0,0 +1,6 @@
+---
+description: "Set up the recurring Lisa automations on the local workstation using the runtime's native scheduler (Codex automations / Claude /schedule): intake-repair (60 min), intake PRD (60 min), intake tickets (10 min), exploratory-bugs (daily), exploratory-prds (daily). A declarative spec — it states what to schedule and how often; the runtime's native automation mechanism does the creating. auto-start-prds / auto-start-tickets control whether ideated PRDs / filed bug tickets are created auto-pickup-ready (default: left for human review)."
+argument-hint: "[auto-start-prds=true|false] [auto-start-tickets=true|false]"
+---
+
+Use the /lisa:setup-automations skill to create the five recurring Lisa automations via this runtime's native scheduler (Codex automations / Claude /schedule), passing the auto-start-prds / auto-start-tickets flags through to the exploratory automations. $ARGUMENTS

package/plugins/lisa-copilot/commands/tear-down-automations.md

@@ -0,0 +1,6 @@
+---
+description: "Remove the recurring Lisa automations /setup-automations created for this project (the lisa-auto-<project>-* set) using the runtime's native scheduler (Codex automations / Claude /schedule). A declarative spec — it states which automations to remove; the runtime's native mechanism does the removing. Removes only this project's Lisa automations, never others."
+argument-hint: ""
+---
+
+Use the /lisa:tear-down-automations skill to remove this project's lisa-auto-<project>-* automations via this runtime's native scheduler (Codex automations / Claude /schedule), leaving other projects' and non-Lisa automations untouched. $ARGUMENTS

package/plugins/lisa-copilot/commands/verify-prd.md

@@ -0,0 +1,6 @@
+---
+description: "Initiative-level PRD acceptance gate. Reads a shipped PRD and its generated child work, confirms all generated top-level work is terminal, then runs spec-conformance against the PRD plus empirical verification of the shipped surface. On a CONFORMS verdict with all checks passing it transitions the PRD shipped → verified with evidence; on a conformance miss (PARTIAL/DIVERGES) or any failing empirical check it re-opens the PRD shipped → ticketed (never blocked), creates build-ready fix tickets for the gaps, and posts a failure report — the fix tickets auto-build, the PRD re-ships, and it re-verifies (a self-healing loop). Idempotent across re-runs."
+argument-hint: "<prd>"
+---
+
+Use the /lisa:verify-prd skill to read the PRD, confirm its generated top-level work is terminal, run spec-conformance against the PRD and empirical verification of the shipped surface, then transition the PRD shipped → verified with evidence on a pass, or — on a fail — re-open it shipped → ticketed (never blocked) and create build-ready fix tickets that auto-build and trigger a re-verify. $ARGUMENTS

package/plugins/lisa-copilot/commands/verify.md

@@ -0,0 +1,6 @@
+---
+description: "Ship and verify code. Commits, opens PR, handles review loop, merges, monitors deploy, and runs remote verification in target environment. Folds in /ship."
+argument-hint: "[commit-message-hint]"
+---
+
+Use the /lisa:verify skill to commit, push, PR, merge, deploy, and verify in the target environment. $ARGUMENTS

package/plugins/lisa-copilot/commands/wiki/install.md

@@ -0,0 +1,7 @@
+---
+description: "Enable the LLM Wiki kernel (lisa-wiki plugin) in this project so its setup skill becomes discoverable. Edits .claude/settings.json to enable lisa-wiki@lisa and confirm the CodySwannGT/lisa marketplace, then verifies the Codex overlay (.codex/skills/lisa) already carries the wiki kernel. Does NOT scaffold the wiki itself — after install, reload the runtime and run /setup:wiki (Claude) or $lisa-wiki-setup (Codex)."
+allowed-tools: ["Skill"]
+argument-hint: ""
+---
+
+Use the /lisa:wiki-install skill to enable the lisa-wiki plugin in this project. $ARGUMENTS

package/plugins/lisa-copilot/hooks/block-no-verify.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# PreToolUse hook for Bash: blocks any command containing --no-verify.
+# --no-verify on git commit/push (and equivalents) bypasses pre-commit/pre-push
+# hooks that exist for a reason. The fix is to address the underlying issue,
+# not silence the check. See feedback_never_no_verify in user memory.
+#
+# Word-boundary match avoids false positives on flags like --no-verify-ssl,
+# --no-verify-host, etc.
+set -euo pipefail
+
+input="$(cat)"
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
+if [ "$tool_name" != "Bash" ]; then
+  exit 0
+fi
+
+command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
+if [ -z "$command_str" ]; then
+  exit 0
+fi
+
+# Match --no-verify bounded by non-token characters (not alphanumeric, _, or -).
+# This catches all syntactic positions including subshells (e.g. `(git commit --no-verify)`)
+# while excluding longer flags like --no-verify-ssl, --no-verify-host, etc.
+if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])--no-verify($|[^[:alnum:]_-])'; then
+  cat >&2 <<'EOF'
+Blocked: --no-verify bypasses pre-commit/pre-push hooks. Fix the underlying
+issue (lint error, failing test, formatting) or ask the user before bypassing.
+
+If the user has explicitly authorized the bypass for this specific command,
+re-run after they confirm.
+EOF
+  exit 2
+fi
+
+exit 0

package/plugins/lisa-copilot/hooks/inject-rules.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Reads all .md files from the plugin's rules/eager/ directory and injects them
+# into the session context via additionalContext.
+# Used by SessionStart and SubagentStart hooks.
+#
+# The split between eager and reference rules is documented in
+# rules/eager/00-bootstrap.md (or the equivalent README). Reference bodies
+# under rules/reference/ are installed alongside but loaded only when the
+# eager breadcrumb points to them.
+set -euo pipefail
+
+RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules/eager"
+
+# Backward compatibility: if the eager subdir is absent (older Lisa install),
+# fall back to the flat rules/ directory so a partial upgrade still ships rules.
+if [ ! -d "$RULES_DIR" ]; then
+  RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules"
+fi
+
+# Bail silently if no rules directory at all
+[ -d "$RULES_DIR" ] || exit 0
+
+CONTEXT=""
+for file in "$RULES_DIR"/*.md; do
+  [ -f "$file" ] || continue
+  CONTEXT+="$(cat "$file")"$'\n\n'
+done
+
+# Bail if no rules found
+[ -n "$CONTEXT" ] || exit 0
+
+# Output as JSON — jq handles escaping
+jq -n --arg ctx "$CONTEXT" '{"additionalContext": $ctx}'