@codyswann/lisa 2.143.2 → 2.144.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/scripts/verify-wiki-safety.mjs +116 -0
- package/plugins/lisa-wiki/scripts/wiki-safety.mjs +78 -0
- package/plugins/lisa-wiki/skills/lisa-wiki-ingest/SKILL.md +7 -0
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/scripts/verify-wiki-safety.mjs +116 -0
- package/plugins/lisa-wiki-agy/scripts/wiki-safety.mjs +78 -0
- package/plugins/lisa-wiki-agy/skills/lisa-wiki-ingest/SKILL.md +7 -0
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/scripts/verify-wiki-safety.mjs +116 -0
- package/plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs +78 -0
- package/plugins/lisa-wiki-copilot/skills/lisa-wiki-ingest/SKILL.md +7 -0
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/scripts/verify-wiki-safety.mjs +116 -0
- package/plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs +78 -0
- package/plugins/lisa-wiki-cursor/skills/lisa-wiki-ingest/SKILL.md +7 -0
- package/plugins/src/wiki/scripts/verify-wiki-safety.mjs +116 -0
- package/plugins/src/wiki/scripts/wiki-safety.mjs +78 -0
- package/plugins/src/wiki/skills/lisa-wiki-ingest/SKILL.md +7 -0
package/package.json
CHANGED
|
@@ -84,7 +84,7 @@
|
|
|
84
84
|
"lodash": ">=4.18.1"
|
|
85
85
|
},
|
|
86
86
|
"name": "@codyswann/lisa",
|
|
87
|
-
"version": "2.
|
|
87
|
+
"version": "2.144.0",
|
|
88
88
|
"description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
|
|
89
89
|
"main": "dist/index.js",
|
|
90
90
|
"exports": {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.144.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.144.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.144.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.144.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.144.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -0,0 +1,116 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/**
|
|
3
|
+
* Pre-commit safety gate for generated wiki output.
|
|
4
|
+
*
|
|
5
|
+
* Scans only explicit wiki paths, or current git changes under the configured
|
|
6
|
+
* wiki root when no paths are passed. Reports safe metadata only.
|
|
7
|
+
*/
|
|
8
|
+
import { execFileSync } from "node:child_process";
|
|
9
|
+
import fs from "node:fs";
|
|
10
|
+
import path from "node:path";
|
|
11
|
+
import { loadConfig } from "./_wiki-lib.mjs";
|
|
12
|
+
import { scanWikiGeneratedFiles } from "./wiki-safety.mjs";
|
|
13
|
+
|
|
14
|
+
const argv = process.argv.slice(2);
|
|
15
|
+
const flag = name => argv.includes(name);
|
|
16
|
+
const opt = name => {
|
|
17
|
+
const i = argv.indexOf(name);
|
|
18
|
+
return i !== -1 ? argv[i + 1] : undefined;
|
|
19
|
+
};
|
|
20
|
+
const repeated = name => {
|
|
21
|
+
const values = [];
|
|
22
|
+
for (let i = 0; i < argv.length; i += 1) {
|
|
23
|
+
if (argv[i] === name && argv[i + 1]) values.push(argv[i + 1]);
|
|
24
|
+
}
|
|
25
|
+
return values;
|
|
26
|
+
};
|
|
27
|
+
|
|
28
|
+
const { config } = loadConfig(opt("--config"));
|
|
29
|
+
const wikiRoot = path.resolve(opt("--wiki") ?? config?.wikiRoot ?? "wiki");
|
|
30
|
+
const asJson = flag("--json");
|
|
31
|
+
const scanner = opt("--scanner") ?? "builtin";
|
|
32
|
+
|
|
33
|
+
function commandExists(command) {
|
|
34
|
+
try {
|
|
35
|
+
execFileSync("sh", ["-c", `command -v ${command}`], {
|
|
36
|
+
stdio: "ignore",
|
|
37
|
+
});
|
|
38
|
+
return true;
|
|
39
|
+
} catch {
|
|
40
|
+
return false;
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
function gitChangedPaths() {
|
|
45
|
+
let out = "";
|
|
46
|
+
try {
|
|
47
|
+
out = execFileSync("git", ["status", "--porcelain=v1", "-z"], {
|
|
48
|
+
encoding: "utf8",
|
|
49
|
+
});
|
|
50
|
+
} catch {
|
|
51
|
+
return [];
|
|
52
|
+
}
|
|
53
|
+
const entries = out.split("\0").filter(Boolean);
|
|
54
|
+
const paths = [];
|
|
55
|
+
for (let i = 0; i < entries.length; i += 1) {
|
|
56
|
+
const entry = entries[i];
|
|
57
|
+
const status = entry.slice(0, 2);
|
|
58
|
+
const file = entry.slice(3);
|
|
59
|
+
if (!file || status.includes("D")) continue;
|
|
60
|
+
paths.push(file);
|
|
61
|
+
if (status[0] === "R" || status[0] === "C") i += 1;
|
|
62
|
+
}
|
|
63
|
+
return paths;
|
|
64
|
+
}
|
|
65
|
+
|
|
66
|
+
const explicitPaths = repeated("--path");
|
|
67
|
+
const files = explicitPaths.length > 0 ? explicitPaths : gitChangedPaths();
|
|
68
|
+
|
|
69
|
+
const externalScanner =
|
|
70
|
+
scanner === "gitleaks" || scanner === "trufflehog" ? scanner : undefined;
|
|
71
|
+
const externalScannerMissing =
|
|
72
|
+
externalScanner !== undefined && !commandExists(externalScanner);
|
|
73
|
+
|
|
74
|
+
const result = scanWikiGeneratedFiles(files, {
|
|
75
|
+
fsModule: fs,
|
|
76
|
+
pathModule: path,
|
|
77
|
+
wikiRoot,
|
|
78
|
+
});
|
|
79
|
+
|
|
80
|
+
const finalResult = {
|
|
81
|
+
...result,
|
|
82
|
+
scanner: {
|
|
83
|
+
selected: scanner,
|
|
84
|
+
externalAvailable: externalScanner ? !externalScannerMissing : undefined,
|
|
85
|
+
},
|
|
86
|
+
ok: result.ok && !externalScannerMissing,
|
|
87
|
+
errors: [
|
|
88
|
+
...result.errors,
|
|
89
|
+
...(externalScannerMissing
|
|
90
|
+
? [
|
|
91
|
+
{
|
|
92
|
+
file: path.relative(process.cwd(), wikiRoot) || ".",
|
|
93
|
+
message: `${externalScanner} scanner selected but unavailable`,
|
|
94
|
+
},
|
|
95
|
+
]
|
|
96
|
+
: []),
|
|
97
|
+
],
|
|
98
|
+
};
|
|
99
|
+
|
|
100
|
+
if (asJson) {
|
|
101
|
+
console.log(JSON.stringify(finalResult, null, 2));
|
|
102
|
+
} else {
|
|
103
|
+
for (const finding of finalResult.findings) {
|
|
104
|
+
console.log(
|
|
105
|
+
`x [wiki-safety] possible ${finding.entityType} (${finding.confidence}) in ${finding.sourceId}; count=${finding.count}`
|
|
106
|
+
);
|
|
107
|
+
}
|
|
108
|
+
for (const error of finalResult.errors) {
|
|
109
|
+
console.log(`x [wiki-safety] ${error.message} (${error.file})`);
|
|
110
|
+
}
|
|
111
|
+
console.log(
|
|
112
|
+
`\n${finalResult.findings.length} finding${finalResult.findings.length === 1 ? "" : "s"}, ${finalResult.errors.length} error${finalResult.errors.length === 1 ? "" : "s"} across ${finalResult.scanned.length} wiki file${finalResult.scanned.length === 1 ? "" : "s"} — ${finalResult.ok ? "OK" : "BLOCKING"}`
|
|
113
|
+
);
|
|
114
|
+
}
|
|
115
|
+
|
|
116
|
+
process.exitCode = finalResult.ok ? 0 : 1;
|
|
@@ -61,6 +61,19 @@ const PATTERNS = [
|
|
|
61
61
|
},
|
|
62
62
|
];
|
|
63
63
|
|
|
64
|
+
const TEXTISH_EXTS = new Set([
|
|
65
|
+
".md",
|
|
66
|
+
".mdx",
|
|
67
|
+
".json",
|
|
68
|
+
".jsonl",
|
|
69
|
+
".txt",
|
|
70
|
+
".yml",
|
|
71
|
+
".yaml",
|
|
72
|
+
".toml",
|
|
73
|
+
".csv",
|
|
74
|
+
".tsv",
|
|
75
|
+
]);
|
|
76
|
+
|
|
64
77
|
function luhnValid(candidate) {
|
|
65
78
|
const digits = candidate.replace(/\D/g, "");
|
|
66
79
|
if (digits.length < 13 || digits.length > 19) return false;
|
|
@@ -222,3 +235,68 @@ export function serializeWikiSafetyFindings(result) {
|
|
|
222
235
|
2
|
|
223
236
|
);
|
|
224
237
|
}
|
|
238
|
+
|
|
239
|
+
export function isWikiSafetyScanTarget(filePath, options = {}) {
|
|
240
|
+
const pathModule = options.pathModule;
|
|
241
|
+
if (!pathModule) {
|
|
242
|
+
throw new Error("isWikiSafetyScanTarget requires options.pathModule");
|
|
243
|
+
}
|
|
244
|
+
const wikiRoot = pathModule.resolve(options.wikiRoot ?? "wiki");
|
|
245
|
+
const resolved = pathModule.resolve(filePath);
|
|
246
|
+
const relative = pathModule.relative(wikiRoot, resolved);
|
|
247
|
+
if (
|
|
248
|
+
!relative ||
|
|
249
|
+
relative.startsWith("..") ||
|
|
250
|
+
pathModule.isAbsolute(relative)
|
|
251
|
+
) {
|
|
252
|
+
return false;
|
|
253
|
+
}
|
|
254
|
+
const ext = pathModule.extname(resolved);
|
|
255
|
+
return TEXTISH_EXTS.has(ext);
|
|
256
|
+
}
|
|
257
|
+
|
|
258
|
+
export function scanWikiGeneratedFiles(files, options = {}) {
|
|
259
|
+
const fsModule = options.fsModule;
|
|
260
|
+
const pathModule = options.pathModule;
|
|
261
|
+
if (!fsModule || !pathModule) {
|
|
262
|
+
throw new Error("scanWikiGeneratedFiles requires fsModule and pathModule");
|
|
263
|
+
}
|
|
264
|
+
|
|
265
|
+
const wikiRoot = pathModule.resolve(options.wikiRoot ?? "wiki");
|
|
266
|
+
const candidates = [...new Set(files.map(file => pathModule.resolve(file)))]
|
|
267
|
+
.filter(file => isWikiSafetyScanTarget(file, { wikiRoot, pathModule }))
|
|
268
|
+
.sort();
|
|
269
|
+
|
|
270
|
+
const scanned = [];
|
|
271
|
+
const findings = [];
|
|
272
|
+
const errors = [];
|
|
273
|
+
|
|
274
|
+
for (const file of candidates) {
|
|
275
|
+
let text;
|
|
276
|
+
try {
|
|
277
|
+
if (!fsModule.existsSync(file) || !fsModule.statSync(file).isFile()) {
|
|
278
|
+
continue;
|
|
279
|
+
}
|
|
280
|
+
text = fsModule.readFileSync(file, "utf8");
|
|
281
|
+
} catch (error) {
|
|
282
|
+
errors.push({
|
|
283
|
+
file: pathModule.relative(process.cwd(), file),
|
|
284
|
+
message: error instanceof Error ? error.message : String(error),
|
|
285
|
+
});
|
|
286
|
+
continue;
|
|
287
|
+
}
|
|
288
|
+
|
|
289
|
+
const sourceId = pathModule.relative(wikiRoot, file);
|
|
290
|
+
scanned.push(sourceId);
|
|
291
|
+
const result = scanWikiSourceText(text, { sourceId });
|
|
292
|
+
findings.push(...result.findings);
|
|
293
|
+
}
|
|
294
|
+
|
|
295
|
+
return {
|
|
296
|
+
ok: findings.length === 0 && errors.length === 0,
|
|
297
|
+
wikiRoot: pathModule.relative(process.cwd(), wikiRoot) || ".",
|
|
298
|
+
scanned,
|
|
299
|
+
findings,
|
|
300
|
+
errors,
|
|
301
|
+
};
|
|
302
|
+
}
|
|
@@ -64,6 +64,13 @@ writes nothing). The point is to ingest on top of fresh state, never stale state
|
|
|
64
64
|
- Source-note-before-synthesis; state advanced **only** after verification.
|
|
65
65
|
- Project-scoped only; memory ingestion never touches global/Codex-global stores.
|
|
66
66
|
- Respect `sourceRetention` and `sensitivity`; do not invent facts.
|
|
67
|
+
- Before advancing state or committing, run the generated-output safety gate
|
|
68
|
+
(`scripts/verify-wiki-safety.mjs`) against the wiki files/source notes produced by
|
|
69
|
+
the ingest. The default built-in scan blocks unredacted private keys, tokens, and
|
|
70
|
+
common financial/person identifiers without printing raw values. Projects may
|
|
71
|
+
select `--scanner gitleaks` for local parity with Gitleaks, and may use
|
|
72
|
+
`--scanner trufflehog` as a stricter optional verification pass when installed;
|
|
73
|
+
if a selected scanner is unavailable, keep the ingest blocked for review.
|
|
67
74
|
- Connector execution and the connector contract are detailed in the connector skills (M2+); this
|
|
68
75
|
router defines and enforces the ordering and side-effect rules above.
|
|
69
76
|
|