@codyswann/lisa 2.178.5 → 2.179.0

package/plugins/lisa-phaser-cursor/skills/phaser-services/SKILL.md

@@ -0,0 +1,208 @@
+---
+name: phaser-services
+description: This skill should be used when wiring cross-cutting services and shared state in a Phaser 4 game — the typed registry wrapper for global state, a single dedicated EventsCenter bus (never game.events), the .on()/.off() listener discipline enforced in scene shutdown, SoundService (mobile audio unlock on first gesture), InputService (semantic actions instead of raw keys), and SaveService (versioned localStorage with a migration chain). Use it when adding global state, an event bus, audio/input/save plumbing, or fixing listener leaks and lost saves. Pairs with phaser-scenes, phaser-testing, and phaser-i18n.
+---
+
+# Phaser 4 Services and Shared State
+
+## Overview
+
+Cross-cutting concerns — global state, app events, sound, input, save — live in
+`src/services/**` as thin, typed singletons, **not** scattered through scenes.
+Two rules anchor everything: state flows through a typed registry wrapper, and
+app messaging flows through **one dedicated EventsCenter** that is never
+`game.events`. Direct `localStorage` access outside `src/services/**` is
+lint-banned — persistence goes through SaveService.
+
+## Global state: a typed wrapper over the registry
+
+`this.registry` is a game-wide key/value `DataManager` shared across scenes. Raw
+access is stringly-typed and untestable, so wrap it once:
+
+```ts
+// src/services/state.ts
+interface GameState { coins: number; level: number; muted: boolean; seed: number; }
+const DEFAULTS: GameState = { coins: 0, level: 1, muted: false, seed: 0 };
+
+export class GameStore {
+  constructor(private reg: Phaser.Data.DataManager) {
+    for (const k in DEFAULTS) if (!reg.has(k)) reg.set(k, (DEFAULTS as any)[k]);
+  }
+  get<K extends keyof GameState>(k: K): GameState[K] { return this.reg.get(k); }
+  set<K extends keyof GameState>(k: K, v: GameState[K]) { this.reg.set(k, v); }
+  onChange<K extends keyof GameState>(k: K, fn: (v: GameState[K]) => void) {
+    const h = (_p: unknown, key: string, v: GameState[K]) => { if (key === k) fn(v); };
+    this.reg.events.on(Phaser.Data.Events.CHANGE_DATA, h);
+    return () => this.reg.events.off(Phaser.Data.Events.CHANGE_DATA, h); // caller .off()s in shutdown
+  }
+}
+```
+
+Construct it once (in Boot) and read it via the registry. Keys are typed by
+`GameState`, so a typo is a compile error. The registry holds *small* shared
+state (settings, run seed, currency) — not GameObjects and not per-frame data.
+
+## The EventsCenter bus (never `game.events`)
+
+App-level messaging ("enemy-died", "score-changed", "level-cleared") uses a
+single dedicated emitter. Reusing `game.events` (the engine's own bus) is
+lint-banned — it mixes your events with engine lifecycle events and is
+impossible to fully tear down.
+
+```ts
+// src/services/event-center.ts
+export const EventCenter = new Phaser.Events.EventEmitter();
+
+// typed key constants come from src/assets.ts (generated) — no raw strings
+import { GameEvent } from "../assets";
+EventCenter.emit(GameEvent.ScoreChanged, score);
+```
+
+## Listener discipline: every `.on()` has a matching `.off()`
+
+This is the leak rule the `require-shutdown-cleanup` lint rule and the testing
+leak gate ([[phaser-testing]]) enforce. **Any** external listener — `EventCenter`,
+`this.input`, `this.scale`, `this.time`, `window`, the registry — must be removed
+in the scene's `shutdown`. Listeners on the scene's own display objects die with
+the scene; external ones do not, and they fire again (doubled) after a restart.
+
+```ts
+export class Game extends Phaser.Scene {
+  private cleanups: Array<() => void> = [];
+
+  create() {
+    const onResize = (s: Phaser.Structs.Size) => this.layout(s.width, s.height);
+    this.scale.on(Phaser.Scale.Events.RESIZE, onResize);
+    this.cleanups.push(() => this.scale.off(Phaser.Scale.Events.RESIZE, onResize));
+
+    const onScore = (n: number) => this.hud.setScore(n);
+    EventCenter.on(GameEvent.ScoreChanged, onScore);
+    this.cleanups.push(() => EventCenter.off(GameEvent.ScoreChanged, onScore));
+
+    this.events.once(Phaser.Scenes.Events.SHUTDOWN, this.shutdown, this);
+  }
+
+  shutdown() { this.cleanups.forEach(fn => fn()); this.cleanups.length = 0; }
+}
+```
+
+Keeping the matching `.off()` next to each `.on()` (a `cleanups` array, or named
+handler methods you remove in `shutdown`) is the pattern that survives the leak
+gate. Prefer `.once()` where a listener should fire only once.
+
+## SoundService — audio unlock on first gesture
+
+Web Audio starts **suspended** until a user gesture; sound played before then is
+silently dropped ("works on my machine, silent on the phone"). Centralize the
+unlock and all playback:
+
+```ts
+// src/services/sound-service.ts
+export class SoundService {
+  private unlocked = false;
+  constructor(private sound: Phaser.Sound.BaseSoundManager, private store: GameStore) {}
+
+  attachUnlock(scene: Phaser.Scene) {
+    if (this.unlocked) return;
+    scene.input.once(Phaser.Input.Events.POINTER_DOWN, () => this.resume());
+    // Phaser also fires its own unlock; resume() is idempotent
+    this.sound.once(Phaser.Sound.Events.UNLOCKED, () => this.resume());
+  }
+  private resume() { if ((this.sound as any).context?.state === "suspended") (this.sound as any).context.resume(); this.unlocked = true; }
+  play(key: string, cfg?: Phaser.Types.Sound.SoundConfig) { if (!this.store.get("muted")) this.sound.play(key, cfg); }
+}
+```
+
+Scenes call `soundService.play(Sfx.Jump)` — never `this.sound.play("jump")`.
+Sound keys are generated constants ([[phaser-asset-pipeline]]).
+
+## InputService — semantic actions, not raw keys
+
+Scenes should ask "is *jump* down?", not "is the spacebar down?". A semantic
+layer makes rebinding, gamepads, and touch swap in without touching game code,
+and keeps replays deterministic (record actions, not hardware).
+
+```ts
+// src/services/input-service.ts
+export type Action = "left" | "right" | "jump" | "fire" | "pause";
+
+export class InputService {
+  private down = new Set<Action>();
+  private bindings: Record<number, Action> = {};
+  constructor(kb: Phaser.Input.Keyboard.KeyboardPlugin) {
+    this.bindings[Phaser.Input.Keyboard.KeyCodes.LEFT] = "left";
+    this.bindings[Phaser.Input.Keyboard.KeyCodes.SPACE] = "jump";
+    kb.on("keydown", (e: KeyboardEvent) => { const a = this.bindings[e.keyCode]; if (a) this.down.add(a); });
+    kb.on("keyup",   (e: KeyboardEvent) => { const a = this.bindings[e.keyCode]; if (a) this.down.delete(a); });
+  }
+  isDown(a: Action) { return this.down.has(a); }
+  snapshot(): readonly Action[] { return [...this.down]; } // for replay capture
+}
+```
+
+`update()` reads `input.isDown("jump")` and forwards the action set to pure logic
+in `src/logic/**`. (Register/remove the keyboard listeners with the same on/off
+discipline above.)
+
+## SaveService — versioned localStorage with a migration chain
+
+Raw `localStorage` outside `src/services/**` is lint-banned. Saves carry a schema
+`VERSION`; on load, unknown-but-older saves run forward through a migration chain,
+so an old player's data is never silently lost or crash-loaded.
+
+```ts
+// src/services/save-service.ts
+const KEY = "save:v"; const VERSION = 3;
+interface SaveV3 { version: 3; coins: number; unlocked: string[]; settings: { muted: boolean } }
+
+const migrations: Record<number, (s: any) => any> = {
+  1: s => ({ ...s, unlocked: [], version: 2 }),                 // v1 -> v2
+  2: s => ({ ...s, settings: { muted: false }, version: 3 }),  // v2 -> v3
+};
+
+export class SaveService {
+  load(): SaveV3 {
+    const raw = localStorage.getItem(KEY);                 // only legal localStorage access lives here
+    if (!raw) return this.fresh();
+    try {
+      let s = JSON.parse(raw);
+      while (s.version < VERSION) s = migrations[s.version](s);
+      return s as SaveV3;
+    } catch { return this.fresh(); }                       // corrupt save -> fresh, never crash
+  }
+  save(s: SaveV3) { localStorage.setItem(KEY, JSON.stringify({ ...s, version: VERSION })); }
+  private fresh(): SaveV3 { return { version: VERSION, coins: 0, unlocked: [], settings: { muted: false } }; }
+}
+```
+
+Bump `VERSION` and add the `n -> n+1` migration whenever the shape changes; never
+mutate the read path to "just handle" an old shape inline.
+
+## Errors and telemetry
+
+A vendor-neutral telemetry/analytics abstraction (`src/services/telemetry.ts`)
+exposes `track(event, props)` and `captureError(err, ctx)` behind a stable
+interface so the concrete sink (PostHog, Sentry, none) swaps without touching
+game code. Wire Phaser's error surfaces to it — `window.onerror`, the loader's
+`FILE_LOAD_ERROR`, and `try/catch` around scene transitions all route to
+`captureError`. Strings shown to players come from the i18n catalog
+([[phaser-i18n]]), never hardcoded.
+
+## Project conventions
+
+- Services live in `src/services/**`; that directory is the **only** place raw
+  `localStorage` is permitted.
+- One EventsCenter instance, exported once; never `game.events` for app events.
+- Every external `.on()` is paired with an `.off()` removed in `shutdown` (lint:
+  `require-shutdown-cleanup`; verified by the leak gate in [[phaser-testing]]).
+- Service logic that is pure (migrations, action mapping, mute gating) belongs in
+  or beside `src/logic/**` so Vitest covers it.
+
+## Verification
+
+Services are verified by the runtime gates: the leak gate ([[phaser-testing]])
+proves listeners are removed (start/stop a scene N times, counts return to
+baseline); a SaveService unit test feeds each old version through the migration
+chain and asserts the current shape; and on a real phone, the first tap unlocks
+audio (sound plays) — confirm before committing.
+</content>

package/plugins/lisa-phaser-cursor/skills/phaser-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: phaser-testing
-description: This skill should be used when writing or designing tests for a Phaser 4 game — unit-testing pure game logic with Vitest, keeping logic Phaser-free so it tests without a browser, the Phaser.HEADLESS renderer for logic-only boots, asset-manifest coverage tests, and Playwright smoke tests that prove the game actually boots and renders. Use it when adding tests, setting up CI verification, or deciding what is testable at which level. Pairs with phaser-project-structure, phaser-assets, and phaser-physics.
+description: This skill should be used when writing or designing tests for a Phaser 4 game — unit-testing pure game logic with Vitest, keeping logic Phaser-free so it tests without a browser, the Phaser.HEADLESS renderer for logic-only boots, asset-manifest coverage tests, and the CI runtime gates (boot smoke, allocation/perf budget, leak gate, determinism gate, deterministic Playwright visual regression, bundle-size budget) that verify scenes and entities that are excluded from unit coverage. Use it when adding tests, setting up CI verification, or deciding what is testable at which level. Pairs with phaser-project-structure, phaser-assets, and phaser-services.
 ---
 
 # Phaser 4 Testing
@@ -13,10 +13,17 @@ pyramid, bottom-up:
 1. **Vitest unit tests** over `src/logic/**` — the bulk of coverage.
 2. **Manifest/contract tests** — cheap structural checks (asset packs, scene
    keys, anim definitions).
-3. **Playwright smoke test** — the game boots in a real browser, renders past
-   the Preloader, no console errors.
-
-There is no official Phaser testing harness — this layering IS the strategy.
+3. **Headless integration** (sparingly) — `Phaser.HEADLESS` for things that
+   genuinely need the engine loop.
+4. **Playwright smoke** — the game boots in a real browser, renders past the
+   Preloader, no console errors.
+5. **CI runtime gates** — scenes/entities are excluded from unit coverage and
+   instead verified by deterministic runtime gates: boot smoke, allocation/perf
+   budget, leak gate, determinism gate, visual regression, bundle-size budget.
+
+There is no official Phaser testing harness — this layering IS the strategy. The
+dividing line: pure logic is unit-tested; everything that needs the engine is a
+runtime gate, never a brittle unit test that mocks the world.
 
 ## Layer 1: pure logic under Vitest (the rule that makes it possible)
 
@@ -85,15 +92,101 @@ Convention: scenes set `window.__sceneReady = key` in `create()` (dev/test
 builds) so tests await real readiness instead of sleeping. Run against
 `bun run dev` (or `vite preview` in CI).
 
+## Layer 5: CI runtime gates (how scenes get verified)
+
+Scenes and entities are deliberately **excluded from unit coverage** — mocking
+the engine to "unit test" a scene tests the mock. Instead, CI runs a set of
+deterministic gates against a real (or headless) game. Each gate fails the build
+on regression; together they are the contract that the engine-coupled layer
+keeps working.
+
+**Boot smoke** — the Playwright test above, hardened: page error listener, wait
+for `__sceneReady`, assert zero console errors. This is the floor.
+
+**Allocation / perf budget** — run the game for N frames and assert the frame
+budget and heap growth. Per-frame allocation is what the `no-allocation-in-update`
+and `no-create-in-update` lint rules forbid statically; this gate catches what
+slips through dynamically.
+
+```ts
+test("steady-state frames stay within budget", async ({ page }) => {
+  await page.goto("/"); await bootTo(page, "Game");
+  const stats = await page.evaluate(async () => {
+    const g = (window as any).__game as Phaser.Game;
+    const frames: number[] = []; let last = performance.now();
+    for (let i = 0; i < 600; i++) { await new Promise(r => g.events.once("postrender", r)); const n = performance.now(); frames.push(n - last); last = n; }
+    return { p95: frames.sort((a,b)=>a-b)[Math.floor(frames.length*0.95)], heap: (performance as any).memory?.usedJSHeapSize };
+  });
+  expect(stats.p95).toBeLessThan(20); // ~50fps floor on CI hardware
+});
+```
+
+**Leak gate** — start and stop a scene N times and assert that texture count,
+event-listener count, active tweens, and timers all return to baseline. This is
+the runtime enforcement of the `require-shutdown-cleanup` rule and the
+on/off-discipline in [[phaser-services]].
+
+```ts
+test("scene start/stop leaves no leaks", async ({ page }) => {
+  await page.goto("/"); await bootTo(page, "MainMenu");
+  const before = await page.evaluate(() => (window as any).__game.textures.getTextureKeys().length);
+  for (let i = 0; i < 20; i++) await page.evaluate(async () => {
+    const g = (window as any).__game as Phaser.Game; g.scene.start("Game");
+    await new Promise(r => setTimeout(r, 50)); g.scene.stop("Game");
+    await new Promise(r => setTimeout(r, 50));
+  });
+  const after = await page.evaluate(() => (window as any).__game.textures.getTextureKeys().length);
+  expect(after).toBeLessThanOrEqual(before); // no per-cycle texture growth
+});
+```
+
+**Determinism gate** — boot twice with the same seed, drive the same inputs, and
+assert an identical state hash. Logic exposes a serializable snapshot; the gate
+hashes it. Same seed → same hash, always. This is the runtime backstop for the
+no-`Math.random()`/`Date.now()`/`performance.now()` rules ([[phaser-services]]).
+
+```ts
+const run = (seed: number) => page.evaluate(s => (window as any).__sim(s, REPLAY), seed);
+expect(hash(await run(1234))).toBe(hash(await run(1234)));
+```
+
+**Deterministic visual regression** — `toHaveScreenshot` under **software GL**
+(`--use-gl=swiftshader`), a **frozen frame** (pause the loop / step a fixed
+number of ticks at a fixed delta), and **masked dynamic regions** (timers,
+particles). Without all three, screenshots flake. Pin Playwright's browser and
+OS in CI so the baseline is stable.
+
+```ts
+await page.evaluate(() => { const g=(window as any).__game; g.loop.sleep(); g.step(0,16.6); });
+await expect(page).toHaveScreenshot("game.png", { mask: [page.locator("#timer")], maxDiffPixelRatio: 0.01 });
+```
+
+**Bundle-size budget** — assert the built bundle stays under a byte budget so a
+stray dependency or an un-split `phaser` chunk fails the PR. Wire it to the prod
+build's `manualChunks` split ([[phaser-build-deploy]]).
+
+```jsonc
+// size-limit / custom check after `bun run build`
+[{ "path": "dist/assets/index-*.js", "limit": "60 kB" },
+ { "path": "dist/assets/phaser-*.js", "limit": "400 kB" }]
+```
+
 ## Project conventions
 
-- `bun run test` = Vitest (layers 1–2, coverage-gated). Playwright smoke runs as
-  its own script/CI job against a built preview.
+- `bun run test` = Vitest (layers 1–2, coverage-gated **over `src/logic/**`
+  only** — scenes/entities are out of scope here). The layer-5 gates run as their
+  own CI jobs against a built `vite preview` (and a headless boot for the
+  determinism gate).
+- Build pins are part of the contract: `phaser ^4.2.0`, Vite, TypeScript 6.
 - Tests never assert on private scene fields; they assert on logic outputs
-  (layer 1) or observable behavior (layer 4).
+  (layer 1), observable behavior (layer 4), or the runtime invariants the gates
+  measure (layer 5).
 
 ## Verification
 
 The testing setup itself is verified when `bun run test` passes with coverage
-over `src/logic/**`, and the Playwright smoke fails when you deliberately break
-boot (rename a pack file) — a smoke test that can't fail is decoration.
+over `src/logic/**`, the Playwright smoke fails when you deliberately break boot
+(rename a pack file), and each layer-5 gate fails on its targeted regression —
+leak gate when a listener loses its `.off()`, determinism gate when a
+`Math.random()` sneaks in, visual gate when the frame changes. A gate that
+can't fail is decoration.

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/agents/ops-specialist.md

@@ -206,7 +206,7 @@ check_env() {
 | Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
 | Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
 | `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
-| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| AWS credentials expired | SSO session timed out locally, or missing env-backed profile headless | Interactive local: refresh the local AWS profile outside headless automation. Headless: use the configured environment-backed assume-role profile |
 | ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
 | OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
 | `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |

package/plugins/lisa-rails-agy/agents/ops-specialist.md

@@ -206,7 +206,7 @@ check_env() {
 | Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
 | Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
 | `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
-| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| AWS credentials expired | SSO session timed out locally, or missing env-backed profile headless | Interactive local: refresh the local AWS profile outside headless automation. Headless: use the configured environment-backed assume-role profile |
 | ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
 | OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
 | `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/agents/ops-specialist.agent.md

@@ -206,7 +206,7 @@ check_env() {
 | Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
 | Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
 | `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
-| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| AWS credentials expired | SSO session timed out locally, or missing env-backed profile headless | Interactive local: refresh the local AWS profile outside headless automation. Headless: use the configured environment-backed assume-role profile |
 | ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
 | OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
 | `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/agents/ops-specialist.md

@@ -206,7 +206,7 @@ check_env() {
 | Solid Queue jobs stuck | Worker process crashed | Check `docker compose logs worker`; restart worker container |
 | Migrations fail on deploy | Unsafe migration detected by Strong Migrations | Fix the migration per Strong Migrations guidance, then redeploy |
 | `ActiveRecord::NoDatabaseError` | Database not created | `bin/rails db:create` (local) or check ECS task definition env vars |
-| AWS credentials expired | SSO session timed out | `aws sso login --profile {profile}` |
+| AWS credentials expired | SSO session timed out locally, or missing env-backed profile headless | Interactive local: refresh the local AWS profile outside headless automation. Headless: use the configured environment-backed assume-role profile |
 | ECS tasks keep restarting | Health check failing or OOM | Check CloudWatch logs for the task; verify `/up` returns 200; check memory limits |
 | OpenTelemetry traces missing | Collector not configured or endpoint wrong | Verify `OTEL_EXPORTER_OTLP_ENDPOINT` in environment; check collector sidecar logs |
 | `Bundler::GemNotFound` | Missing `bundle install` after Gemfile change | `bundle install` locally; for deploy, rebuild Docker image |

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.178.5",
+  "version": "2.179.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/analyze-claude-remote/SKILL.md

@@ -78,13 +78,18 @@ Group the findings as:
    git, and coreutils are present; `gh` is available but should be installed explicitly if scripts
    call it. Classify each `REQUIRED` (core path uses it) vs `OPTIONAL` (only a dormant stack/skill
    uses it). Typical finds: `gh`, `jq`, `docker` (ZAP), `aws`, `acli`, `ruby`/`rubocop`,
-   `python3`, `playwright`/chromium, secret scanners.
+   `python3`, `playwright`/chromium, secret scanners. Treat AWS as more than a
+   binary install: if the repo invokes `aws`, imports AWS SDK packages, uses CDK/Serverless/SST,
+   references `AWS_*` env vars, or documents `aws sso login` / `sso_*` profile setup, add the AWS
+   credential findings in group 4b as well as the `aws` CLI tool finding.
 
 4. **Environment variables & secrets** — scan for `process.env.*`, `${VAR}`/`$VAR` in shell,
    `secrets.*`/`env:` in CI, and config-referenced tokens. Group by integration (GitHub, AWS,
    Atlassian/JIRA/Confluence, Notion, Linear, Anthropic, notifications, feature flags, other).
    Cross-reference `.lisa.config.json` `tracker`/`source` to mark which credentials are **active**
-   for this repo vs **dormant** (`OPTIONAL`). Distinguish *where* each var must be set, because the
+   for this repo vs **dormant** (`OPTIONAL`). Separately classify host-project AWS usage in group 4b:
+   AWS can be required even when it is not the tracker or PRD source. Distinguish *where* each var
+   must be set, because the
    answer differs and getting it wrong sends the user to do redundant work:
 
    - **Committed `.claude/settings.json` `env` flags** (e.g. `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS`,
@@ -128,6 +133,34 @@ Group the findings as:
    guessed. If a value the table needs (server URL, project key, workspace id, email, team key) is
    missing from `.lisa.config.json`, flag it as a `GAP`/`Action:` to set it, rather than inventing one.
 
+4b. **AWS operations credentials** — scan the host project for AWS usage independent of Lisa's
+   tracker/source config:
+
+   - `aws` CLI invocations in `scripts/`, package scripts, committed skills/agents, or
+     `.github/workflows/`.
+   - AWS SDK imports/packages (`@aws-sdk/*`, `aws-sdk`, `boto3`, CDK, Serverless, SST, Amplify,
+     Terraform providers).
+   - `aws sso login`, `aws:signin:*`, `sso_start_url`, `sso_account_id`, `sso_role_name`, or
+     `sso_session` in docs or config.
+   - `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_DEFAULT_REGION`,
+     `AWS_PROFILE`, role ARN, external ID, account, or CloudWatch/STS references.
+
+   If AWS is present, emit an AWS credential finding and inventory entry. If the repo's current
+   local path is `aws sso login` or an `aws:signin:*` script, classify that local path as a `GAP`
+   for headless remote routines: it is an interactive browser/device-authorization flow and cannot
+   complete in the cloud. Route to the AWS row in the Credential reference instead of suggesting
+   SSO auth. The finding must name the headless substrate: a dedicated IAM principal (user or role)
+   with only permission to `sts:AssumeRole`, environment credentials in the routine UI, and
+   `~/.aws/config` profiles using `role_arn`, `credential_source = Environment`, optional
+   `external_id`, and `region`.
+
+   When the repository contains concrete non-secret AWS metadata (role ARNs, account aliases,
+   profile names, regions, or ExternalId values), include it in an `awsProfiles` inventory array so
+   `/lisa:generate-claude-remote-build-script` can write matching `~/.aws/config` profiles. Never
+   invent account IDs, ExternalIds, role names, or regions. If AWS is detected but profile metadata
+   is absent, emit the required AWS secret names plus an action to add project-specific profile
+   metadata to the generated artifact or environment notes.
+
 5. **MCP servers** — read every committed `.mcp.json`. For each server report transport and auth.
    Project-scoped HTTP/SSE servers with no interactive auth are `OK`. Flag stdio servers as
    `RISK`/`GAP` (need a local process — only viable if the cloud session can spawn them from the
@@ -234,6 +267,31 @@ unsuffixed `…_TOKEN`/`…_KEY` is the simplest to set in a single-account rout
 - Acquire: `https://linear.app/<workspace>/settings/account/security` → Personal API keys → New API key.
 - Access: the personal API key inherits the user's workspace permissions — the user must be able to read/create/update Issues in the destination team.
 
+### AWS — host-project operations, logs, deploys, CDK/Serverless/SST, or AWS SDK usage
+- Headless substrate: a dedicated IAM principal (user or role) with long-lived bootstrap credentials
+  stored in the routine environment, used only to call `sts:AssumeRole` into per-account operational
+  roles. The routine writes `~/.aws/config` profiles with `role_arn`, `credential_source =
+  Environment`, optional `external_id`, and `region`; agents use `aws --profile <profile> ...`.
+- Env: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`; optional `AWS_SESSION_TOKEN` for temporary
+  bootstrap credentials; `AWS_DEFAULT_REGION` when no profile region is provided. Role ARNs,
+  ExternalIds, profile names, and regions are non-secret project metadata and belong in generated
+  artifacts or project docs, not in the skill's global guidance.
+- Allowlist: `*.amazonaws.com`, or narrower service hosts such as `sts.amazonaws.com`,
+  `logs.<region>.amazonaws.com`, `cloudwatch.<region>.amazonaws.com`,
+  `xray.<region>.amazonaws.com`, `ssm.<region>.amazonaws.com`, and service-specific endpoints the
+  repo uses.
+- Access: the bootstrap principal should have only `sts:AssumeRole` on the scoped operational role
+  ARNs, preferably guarded by an `ExternalId` condition. The assumed roles carry the real
+  permissions needed by the repo (CloudWatch Logs, deploy, SSM, etc.) as short-lived STS
+  credentials.
+- IAM Identity Center caveat: an IAM Identity Center permission set provisions an `AWSReservedSSO_*`
+  role whose trust allows the SSO service, not an arbitrary IAM principal. A headless IAM principal
+  cannot directly assume that reserved role. Use a separate assumable role that attaches the same
+  policy as the permission set, with the delegated Identity Center admin keeping that policy as the
+  source of truth.
+- Alternative: IAM Roles Anywhere (X.509 to STS) when long-lived bootstrap access keys are
+  unacceptable.
+
 ## Output
 
 Render the report grouped exactly as above. Start with one `Summary:` line, then a `Counts:` line
@@ -296,6 +354,15 @@ so the generator can render acquisition comments into its template:
     { "name": "jam", "transport": "http", "auth": "oauth", "headlessUsable": true, "replacedBy": "jam CLI + JAM_PAT", "dormant": true },
     { "name": "sonarqube", "transport": "stdio", "auth": "local-wrapper", "headlessUsable": true, "replacedBy": "SONAR_TOKEN + SonarCloud Web API", "dormant": true }
   ],
+  "awsProfiles": [
+    {
+      "name": "dev",
+      "roleArn": "arn:aws:iam::<account-id>:role/<role-name>",
+      "credentialSource": "Environment",
+      "externalId": "<project-external-id>",
+      "region": "us-east-1"
+    }
+  ],
   "gaps": [ "auto-memory not synced to cloud", "bun package fetch behind proxy", "OS keychain absent — env-var token form only" ],
   "platform": {
     "githubProxy": {
@@ -346,6 +413,9 @@ so the generator can render acquisition comments into its template:
   to environment editors; never imply the generated script can hide them.
 - A browser-OAuth MCP (or interactively-authed CLI) backing an active integration is a `GAP`; the
   remediation is its token substrate from the table, not "authenticate the MCP".
+- `aws sso login`, `sso_*` profile configuration, and project scripts that wrap AWS SSO are
+  interactive-auth paths. In a headless routine they are a `GAP`, not a setup step. Route AWS access
+  to env-var bootstrap credentials plus assume-role profiles.
 - For non-tracker MCPs, a documented CLI, PAT/API-key, or REST substrate converts the finding from
   a flat `GAP` into an `OPTIONAL` headless recovery path; unknown vendors remain gaps with a
   vendor-substrate follow-up, not invented credentials.