@codyswann/lisa 2.162.0 → 2.163.0

package/package.json

@@ -85,7 +85,7 @@
     "lodash": ">=4.18.1"
   },
   "name": "@codyswann/lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"
@@ -20,6 +20,17 @@
         ]
       }
     ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/enforce-config-extensions.sh"
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "matcher": "",

package/plugins/lisa-harper-fabric/.codex-plugin/hooks.json

@@ -11,6 +11,17 @@
         ]
       }
     ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/enforce-config-extensions.sh"
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "matcher": "",

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+const BLOCKED = 2;
+const ALLOWED = 0;
+const CONFIG_PATH = "harper-app/config.yaml";
+const ALLOWLIST_PATH = ".lisa/harper-config-extension-allowlist.json";
+
+const readStdin = () => {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+};
+
+const parseHookInput = raw => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+};
+
+const normalizePath = filePath =>
+  filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+
+const isConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  return normalized === CONFIG_PATH || normalized.endsWith(`/${CONFIG_PATH}`);
+};
+
+const repoRelativeConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  const index = normalized.lastIndexOf(CONFIG_PATH);
+  return index === -1 ? normalized : normalized.slice(index);
+};
+
+const loadYaml = () => {
+  const require = createRequire(import.meta.url);
+  return require("js-yaml");
+};
+
+const topLevelExtensionKeys = yamlText => {
+  const yaml = loadYaml();
+  let parsed;
+  try {
+    parsed = yaml.load(yamlText);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+  return Object.keys(parsed).sort();
+};
+
+const gitEnv = () =>
+  Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
+  );
+
+const readGitBlob = repoRoot => {
+  const result = spawnSync(
+    "git",
+    ["-C", repoRoot, "show", `HEAD:${CONFIG_PATH}`],
+    {
+      encoding: "utf8",
+      env: gitEnv(),
+    }
+  );
+  return result.status === 0 ? result.stdout : null;
+};
+
+const readAllowlist = (repoRoot, configPath) => {
+  const allowlistFile = path.join(repoRoot, ALLOWLIST_PATH);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(allowlistFile, "utf8"));
+  } catch {
+    return new Set();
+  }
+
+  const entry = parsed?.[configPath] ?? parsed?.[CONFIG_PATH];
+  const values = Array.isArray(entry)
+    ? entry
+    : Array.isArray(entry?.allowedRemovedExtensions)
+      ? entry.allowedRemovedExtensions
+      : [];
+  return new Set(values.filter(value => typeof value === "string"));
+};
+
+const main = () => {
+  const input = parseHookInput(readStdin());
+  const filePath = input?.tool_input?.file_path;
+  if (typeof filePath !== "string" || !isConfigPath(filePath)) return ALLOWED;
+
+  const repoRoot = process.cwd();
+  const configPath = repoRelativeConfigPath(filePath);
+  let currentText;
+  try {
+    currentText = readFileSync(path.join(repoRoot, configPath), "utf8");
+  } catch {
+    return ALLOWED;
+  }
+
+  const previousText = readGitBlob(repoRoot);
+  if (previousText === null) return ALLOWED;
+
+  const previousExtensions = topLevelExtensionKeys(previousText);
+  const currentExtensionKeys = topLevelExtensionKeys(currentText);
+  if (previousExtensions === null || currentExtensionKeys === null)
+    return ALLOWED;
+  const currentExtensions = new Set(currentExtensionKeys);
+  const allowedRemovals = readAllowlist(repoRoot, configPath);
+  const missing = previousExtensions.filter(
+    extension =>
+      !currentExtensions.has(extension) && !allowedRemovals.has(extension)
+  );
+
+  if (missing.length === 0) return ALLOWED;
+
+  process.stderr
+    .write(`Blocked: harper-app/config.yaml dropped required Harper extension(s).
+
+Missing extension(s): ${missing.join(", ")}
+
+Harper does not merge a custom config.yaml with defaults. Removing a top-level
+extension silently disables that runtime surface and may only fail after deploy.
+Re-add the missing extension(s), or document an intentional removal in
+${ALLOWLIST_PATH}:
+
+{
+  "${CONFIG_PATH}": {
+    "allowedRemovedExtensions": ["${missing[0]}"]
+  }
+}
+`);
+  return BLOCKED;
+};
+
+process.exitCode = main();

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly - changes will be overwritten on the next `lisa` run.
+
+# PostToolUse hook: after a harper-app/config.yaml edit, compare the edited
+# extension set against HEAD and block silent removals. Harper does not merge a
+# custom config.yaml with defaults, so removing a top-level extension can disable
+# runtime surfaces without a build-time failure.
+
+PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
+if [ -z "$PLUGIN_ROOT" ]; then
+  PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fi
+
+if command -v bun >/dev/null 2>&1; then
+  exec bun "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+fi
+
+exec node "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"

package/plugins/lisa-harper-fabric/rules/harper-fabric.md

@@ -12,6 +12,7 @@ These rules apply to Harper/Fabric component apps managed by Lisa.
 
 - TypeScript under `src/` is the source of truth for Harper resources, browser modules, shared libraries, and operational scripts.
 - `harper-app/config.yaml`, `harper-app/schema.graphql`, HTML, CSS, docs, and research fixtures are source assets.
+- `harper-app/config.yaml` does not merge with Harper defaults. Keep every required top-level extension declared when editing it; the Harper Fabric hook blocks accidental extension drops unless the removal is documented in `.lisa/harper-config-extension-allowlist.json`.
 - `harper-app/resources.js` and `harper-app/web/**/*.js` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`.
 - Deployment, bootstrap, smoke, seed, verify, preview, token, crawl, ingest, and extraction commands must run from compiled JavaScript or generated Harper assets, not stale checked-in JavaScript.
 

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"
@@ -20,6 +20,17 @@
         ]
       }
     ],
+    "postToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/enforce-config-extensions.sh"
+          }
+        ]
+      }
+    ],
     "sessionStart": [
       {
         "matcher": "",

package/plugins/lisa-harper-fabric-copilot/hooks/enforce-config-extensions.mjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import path from "node:path";
+
+const BLOCKED = 2;
+const ALLOWED = 0;
+const CONFIG_PATH = "harper-app/config.yaml";
+const ALLOWLIST_PATH = ".lisa/harper-config-extension-allowlist.json";
+
+const readStdin = () => {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+};
+
+const parseHookInput = raw => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+};
+
+const normalizePath = filePath =>
+  filePath.replace(/\\/g, "/").replace(/^\.\//, "");
+
+const isConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  return normalized === CONFIG_PATH || normalized.endsWith(`/${CONFIG_PATH}`);
+};
+
+const repoRelativeConfigPath = filePath => {
+  const normalized = normalizePath(filePath);
+  const index = normalized.lastIndexOf(CONFIG_PATH);
+  return index === -1 ? normalized : normalized.slice(index);
+};
+
+const loadYaml = () => {
+  const require = createRequire(import.meta.url);
+  return require("js-yaml");
+};
+
+const topLevelExtensionKeys = yamlText => {
+  const yaml = loadYaml();
+  let parsed;
+  try {
+    parsed = yaml.load(yamlText);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
+  return Object.keys(parsed).sort();
+};
+
+const gitEnv = () =>
+  Object.fromEntries(
+    Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
+  );
+
+const readGitBlob = repoRoot => {
+  const result = spawnSync(
+    "git",
+    ["-C", repoRoot, "show", `HEAD:${CONFIG_PATH}`],
+    {
+      encoding: "utf8",
+      env: gitEnv(),
+    }
+  );
+  return result.status === 0 ? result.stdout : null;
+};
+
+const readAllowlist = (repoRoot, configPath) => {
+  const allowlistFile = path.join(repoRoot, ALLOWLIST_PATH);
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(allowlistFile, "utf8"));
+  } catch {
+    return new Set();
+  }
+
+  const entry = parsed?.[configPath] ?? parsed?.[CONFIG_PATH];
+  const values = Array.isArray(entry)
+    ? entry
+    : Array.isArray(entry?.allowedRemovedExtensions)
+      ? entry.allowedRemovedExtensions
+      : [];
+  return new Set(values.filter(value => typeof value === "string"));
+};
+
+const main = () => {
+  const input = parseHookInput(readStdin());
+  const filePath = input?.tool_input?.file_path;
+  if (typeof filePath !== "string" || !isConfigPath(filePath)) return ALLOWED;
+
+  const repoRoot = process.cwd();
+  const configPath = repoRelativeConfigPath(filePath);
+  let currentText;
+  try {
+    currentText = readFileSync(path.join(repoRoot, configPath), "utf8");
+  } catch {
+    return ALLOWED;
+  }
+
+  const previousText = readGitBlob(repoRoot);
+  if (previousText === null) return ALLOWED;
+
+  const previousExtensions = topLevelExtensionKeys(previousText);
+  const currentExtensionKeys = topLevelExtensionKeys(currentText);
+  if (previousExtensions === null || currentExtensionKeys === null)
+    return ALLOWED;
+  const currentExtensions = new Set(currentExtensionKeys);
+  const allowedRemovals = readAllowlist(repoRoot, configPath);
+  const missing = previousExtensions.filter(
+    extension =>
+      !currentExtensions.has(extension) && !allowedRemovals.has(extension)
+  );
+
+  if (missing.length === 0) return ALLOWED;
+
+  process.stderr
+    .write(`Blocked: harper-app/config.yaml dropped required Harper extension(s).
+
+Missing extension(s): ${missing.join(", ")}
+
+Harper does not merge a custom config.yaml with defaults. Removing a top-level
+extension silently disables that runtime surface and may only fail after deploy.
+Re-add the missing extension(s), or document an intentional removal in
+${ALLOWLIST_PATH}:
+
+{
+  "${CONFIG_PATH}": {
+    "allowedRemovedExtensions": ["${missing[0]}"]
+  }
+}
+`);
+  return BLOCKED;
+};
+
+process.exitCode = main();

package/plugins/lisa-harper-fabric-copilot/hooks/enforce-config-extensions.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly - changes will be overwritten on the next `lisa` run.
+
+# PostToolUse hook: after a harper-app/config.yaml edit, compare the edited
+# extension set against HEAD and block silent removals. Harper does not merge a
+# custom config.yaml with defaults, so removing a top-level extension can disable
+# runtime surfaces without a build-time failure.
+
+PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
+if [ -z "$PLUGIN_ROOT" ]; then
+  PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+fi
+
+if command -v bun >/dev/null 2>&1; then
+  exec bun "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+fi
+
+exec node "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"

package/plugins/lisa-harper-fabric-copilot/rules/harper-fabric.md

@@ -12,6 +12,7 @@ These rules apply to Harper/Fabric component apps managed by Lisa.
 
 - TypeScript under `src/` is the source of truth for Harper resources, browser modules, shared libraries, and operational scripts.
 - `harper-app/config.yaml`, `harper-app/schema.graphql`, HTML, CSS, docs, and research fixtures are source assets.
+- `harper-app/config.yaml` does not merge with Harper defaults. Keep every required top-level extension declared when editing it; the Harper Fabric hook blocks accidental extension drops unless the removal is documented in `.lisa/harper-config-extension-allowlist.json`.
 - `harper-app/resources.js` and `harper-app/web/**/*.js` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`.
 - Deployment, bootstrap, smoke, seed, verify, preview, token, crawl, ingest, and extraction commands must run from compiled JavaScript or generated Harper assets, not stale checked-in JavaScript.
 

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.162.0",
+  "version": "2.163.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"