@codyswann/lisa 2.192.0 → 2.193.0

package/dist/configs/eslint/harper-fabric.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harper-fabric.d.ts","sourceRoot":"","sources":["../../../src/configs/eslint/harper-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,cAAc,EACd,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,UAUtC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,eAAe,EACf,cAA2C,EAC3C,UAA8B,GAC/B,EAAE;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,iBAAiB,CAAC;CACvC,GAAG,MAAM,CAAC,MAAM,EAAE,CAkClB"}
+{"version":3,"file":"harper-fabric.d.ts","sourceRoot":"","sources":["../../../src/configs/eslint/harper-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,cAAc,EACd,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,0BAA0B,UAetC,CAAC;AAwCF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,eAAe,EACf,cAA2C,EAC3C,UAA8B,GAC/B,EAAE;IACD,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,iBAAiB,CAAC;CACvC,GAAG,MAAM,CAAC,MAAM,EAAE,CA4DlB"}

package/dist/configs/eslint/harper-fabric.js

@@ -11,9 +11,51 @@ export const defaultHarperFabricIgnores = [
     "*.config.local.ts",
     "harper-app/resources.js",
     "harper-app/resource-*.js",
+    // Root-level compiled Harper modules (resources.js, resource-*.js, and any
+    // other build output emitted straight into harper-app/). The single-star does
+    // not cross a directory separator, so hand-written shims one level down
+    // (harper-app/<route>/index.js) are still linted.
+    "harper-app/*.js",
     "harper-app/web/**",
     "harper-app/lib/**",
 ];
+/**
+ * Platform built-ins declared trusted-immutable leaves for the
+ * `type-declaration-immutability` check. `Date`/`URL` and the DOM
+ * node/element/event types expose mutating methods, so `is-immutable-type`
+ * rates them "Mutable" — and because Harper row types hold `Date` (returned
+ * in-process) and any web layer holds DOM refs in its readonly option bags,
+ * that caps nearly every type below `ReadonlyDeep`. A readonly field holding
+ * one of these is not a mutation vector, so treating them as opaque immutable
+ * leaves is the standard `is-immutable-type` override pattern. Project-specific
+ * leaf types belong in the consumer's `eslint.config.local.ts`.
+ */
+const immutabilityLeafOverrides = [
+    "Date",
+    "URL",
+    "Node",
+    "Element",
+    "HTMLElement",
+    "SVGElement",
+    "Event",
+    "EventTarget",
+    "Blob",
+    "HTMLInputElement",
+    "HTMLSelectElement",
+    "HTMLTextAreaElement",
+    "HTMLButtonElement",
+    "HTMLAnchorElement",
+    "HTMLFormElement",
+    "HTMLImageElement",
+    "HTMLDivElement",
+    "HTMLSpanElement",
+    "KeyboardEvent",
+    "MouseEvent",
+    "InputEvent",
+    "SubmitEvent",
+    "FocusEvent",
+    "PointerEvent",
+].map(type => ({ type, to: "Immutable" }));
 /**
  * Creates the Harper/Fabric ESLint configuration.
  * @param options - Configuration options
@@ -31,12 +73,32 @@ export function getHarperFabricConfig({ tsconfigRootDir, ignorePatterns = defaul
         }),
         {
             files: ["src/**/*.ts"],
+            settings: { immutability: { overrides: immutabilityLeafOverrides } },
             rules: {
                 "functional/immutable-data": "error",
                 "functional/no-let": "error",
                 "functional/prefer-readonly-type": "error",
                 "functional/readonly-type": "error",
-                "functional/type-declaration-immutability": "error",
+                // Enforced at `ReadonlyDeep` (every property recursively `readonly`),
+                // NOT the plugin default of `Immutable`. `Immutable` additionally
+                // rejects function-typed properties, `Record`/index-signature bags,
+                // and mutable-method built-ins (`Date`, DOM types) — none of which a
+                // Harper app can shed without restructuring legitimate shapes, which
+                // is why projects were forced to disable this rule wholesale.
+                // `ReadonlyDeep` + the platform-leaf overrides above is the strongest
+                // achievable bar and the real immutability guarantee.
+                "functional/type-declaration-immutability": [
+                    "error",
+                    {
+                        rules: [
+                            {
+                                identifiers: [".+"],
+                                immutability: "ReadonlyDeep",
+                                comparator: "AtLeast",
+                            },
+                        ],
+                    },
+                ],
             },
         },
         {
@@ -47,6 +109,12 @@ export function getHarperFabricConfig({ tsconfigRootDir, ignorePatterns = defaul
                 "functional/prefer-readonly-type": "off",
                 "functional/readonly-type": "off",
                 "functional/type-declaration-immutability": "off",
+                // Statement-order is a production-code discipline. Smoke/integration
+                // tests interleave arrange-act-assert with sequential awaited UI/HTTP
+                // interactions where the await ORDER is the test logic — reordering
+                // would change behavior. Exempt tests, consistent with the
+                // immutability relaxations above.
+                "code-organization/enforce-statement-order": "off",
             },
         },
         {

package/dist/configs/eslint/harper-fabric.js.map

@@ -1 +1 @@
-{"version":3,"file":"harper-fabric.js","sourceRoot":"","sources":["../../../src/configs/eslint/harper-fabric.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,GAAG,cAAc;IACjB,WAAW;IACX,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,yBAAyB;IACzB,0BAA0B;IAC1B,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,eAAe,EACf,cAAc,GAAG,0BAA0B,EAC3C,UAAU,GAAG,iBAAiB,GAK/B;IACC,OAAO;QACL,GAAG,mBAAmB,CAAC;YACrB,eAAe;YACf,cAAc;YACd,UAAU;SACX,CAAC;QACF;YACE,KAAK,EAAE,CAAC,aAAa,CAAC;YACtB,KAAK,EAAE;gBACL,2BAA2B,EAAE,OAAO;gBACpC,mBAAmB,EAAE,OAAO;gBAC5B,iCAAiC,EAAE,OAAO;gBAC1C,0BAA0B,EAAE,OAAO;gBACnC,0CAA0C,EAAE,OAAO;aACpD;SACF;QACD;YACE,KAAK,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;YACnD,KAAK,EAAE;gBACL,2BAA2B,EAAE,KAAK;gBAClC,mBAAmB,EAAE,KAAK;gBAC1B,iCAAiC,EAAE,KAAK;gBACxC,0BAA0B,EAAE,KAAK;gBACjC,0CAA0C,EAAE,KAAK;aAClD;SACF;QACD;YACE,KAAK,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC;YAC/C,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;KACiB,CAAC;AACvB,CAAC"}
+{"version":3,"file":"harper-fabric.js","sourceRoot":"","sources":["../../../src/configs/eslint/harper-fabric.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAE7C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,GAAG,cAAc;IACjB,WAAW;IACX,UAAU;IACV,WAAW;IACX,mBAAmB;IACnB,yBAAyB;IACzB,0BAA0B;IAC1B,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,kDAAkD;IAClD,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG;IAChC,MAAM;IACN,KAAK;IACL,MAAM;IACN,SAAS;IACT,aAAa;IACb,YAAY;IACZ,OAAO;IACP,aAAa;IACb,MAAM;IACN,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;CACf,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,eAAe,EACf,cAAc,GAAG,0BAA0B,EAC3C,UAAU,GAAG,iBAAiB,GAK/B;IACC,OAAO;QACL,GAAG,mBAAmB,CAAC;YACrB,eAAe;YACf,cAAc;YACd,UAAU;SACX,CAAC;QACF;YACE,KAAK,EAAE,CAAC,aAAa,CAAC;YACtB,QAAQ,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,EAAE;YACpE,KAAK,EAAE;gBACL,2BAA2B,EAAE,OAAO;gBACpC,mBAAmB,EAAE,OAAO;gBAC5B,iCAAiC,EAAE,OAAO;gBAC1C,0BAA0B,EAAE,OAAO;gBACnC,sEAAsE;gBACtE,kEAAkE;gBAClE,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,8DAA8D;gBAC9D,sEAAsE;gBACtE,sDAAsD;gBACtD,0CAA0C,EAAE;oBAC1C,OAAO;oBACP;wBACE,KAAK,EAAE;4BACL;gCACE,WAAW,EAAE,CAAC,IAAI,CAAC;gCACnB,YAAY,EAAE,cAAc;gCAC5B,UAAU,EAAE,SAAS;6BACtB;yBACF;qBACF;iBACF;aACF;SACF;QACD;YACE,KAAK,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;YACnD,KAAK,EAAE;gBACL,2BAA2B,EAAE,KAAK;gBAClC,mBAAmB,EAAE,KAAK;gBAC1B,iCAAiC,EAAE,KAAK;gBACxC,0BAA0B,EAAE,KAAK;gBACjC,0CAA0C,EAAE,KAAK;gBACjD,qEAAqE;gBACrE,sEAAsE;gBACtE,oEAAoE;gBACpE,2DAA2D;gBAC3D,kCAAkC;gBAClC,2CAA2C,EAAE,KAAK;aACnD;SACF;QACD;YACE,KAAK,EAAE,CAAC,qBAAqB,EAAE,eAAe,CAAC;YAC/C,KAAK,EAAE;gBACL,sBAAsB,EAAE,KAAK;aAC9B;SACF;KACiB,CAAC;AACvB,CAAC"}

package/harper-fabric/copy-contents/.prettierignore

@@ -4,6 +4,7 @@
 # source formatting inputs.
 harper-app/resources.js
 harper-app/resource-*.js
+harper-app/*.js
 harper-app/web/**
 harper-app/lib/**
 research/articles/

package/harper-fabric/copy-contents/gitignore

@@ -1,6 +1,13 @@
 # BEGIN: AI GUARDRAILS HARPER-FABRIC
+# Compiled Harper modules are emitted straight into harper-app/ from src/. The
+# root-level `harper-app/*.js` rule covers resources.js, resource-*.js, and any
+# other build output (e.g. detail-shell-negotiation.js) without matching
+# hand-written shims nested one level down (harper-app/<route>/index.js). If you
+# keep a hand-written .js at the harper-app root (e.g. an SEO shell), re-include
+# it with a `!harper-app/<file>.js` line placed BELOW this managed block.
 harper-app/resources.js
 harper-app/resource-*.js
+harper-app/*.js
 harper-app/web/**
 harper-app/lib/**
 .lisabak/

package/harper-fabric/copy-overwrite/knip.json

@@ -15,6 +15,7 @@
     "**/node_modules/**",
     "harper-app/resources.js",
     "harper-app/resource-*.js",
+    "harper-app/*.js",
     "harper-app/web/**",
     "harper-app/lib/**"
   ],

package/harper-fabric/copy-overwrite/tsconfig.eslint.json

@@ -22,6 +22,7 @@
     "coverage",
     "harper-app/resources.js",
     "harper-app/resource-*.js",
+    "harper-app/*.js",
     "harper-app/web/**",
     "harper-app/lib/**"
   ]

package/harper-fabric/merge/.oxlintrc.json

@@ -12,6 +12,7 @@
     "**/generated/**",
     "harper-app/resources.js",
     "harper-app/resource-*.js",
+    "harper-app/*.js",
     "harper-app/web/**",
     "harper-app/lib/**"
   ]

package/oxlint/harper-fabric.json

@@ -7,6 +7,7 @@
     "node_modules/**",
     "harper-app/resources.js",
     "harper-app/resource-*.js",
+    "harper-app/*.js",
     "harper-app/web/**",
     "harper-app/lib/**"
   ]

package/package.json

@@ -95,7 +95,7 @@
     "ws": ">=8.20.1"
   },
   "name": "@codyswann/lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/generated-artifact-globs.txt

@@ -1,4 +1,5 @@
 harper-app/resources.js
 harper-app/resource-*.js
+harper-app/*.js
 harper-app/web/**
 harper-app/lib/**

package/plugins/lisa-harper-fabric/hooks/block-generated-artifact-edits.sh

@@ -33,6 +33,7 @@ matches_glob() {
   local file="$1"
   local glob="$2"
 
+  # Recursive directory globs: "dir/**" matches everything under dir.
   if [ "${glob: -3}" = "/**" ]; then
     local dir="${glob%/**}"
     case "$file" in
@@ -41,6 +42,38 @@ matches_glob() {
     return 1
   fi
 
+  # Single-star globs like "harper-app/*.js": the star must not cross a
+  # directory separator, so a broadened root-level pattern protects compiled
+  # modules emitted straight into harper-app/ (resources.js, resource-*.js, and
+  # any other build output such as detail-shell-negotiation.js) WITHOUT matching
+  # hand-written files nested one level down (e.g. harper-app/<route>/index.js).
+  case "$glob" in
+    */\** | \**)
+      local base_glob="${glob##*/}"
+      local dir_glob=""
+      case "$glob" in
+        */*) dir_glob="${glob%/*}" ;;
+      esac
+      local file_base="${file##*/}"
+      local file_dir=""
+      case "$file" in
+        */*) file_dir="${file%/*}" ;;
+      esac
+      case "$file_base" in
+        $base_glob) ;;
+        *) return 1 ;;
+      esac
+      [ -z "$dir_glob" ] && return 0
+      # Match the directory exactly, or as a suffix so absolute/prefixed paths
+      # (e.g. /repo/harper-app/foo.js) still resolve.
+      case "$file_dir" in
+        $dir_glob | */"$dir_glob") return 0 ;;
+      esac
+      return 1
+      ;;
+  esac
+
+  # Literal (wildcard-free) globs.
   case "$file" in
     $glob | */$glob) return 0 ;;
   esac
@@ -50,6 +83,24 @@ matches_glob() {
 
 NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
 
+# Project-owned allowlist of hand-written files that live under harper-app/ and
+# must NOT be treated as generated (e.g. a hand-authored SEO shell, or route
+# index.js shims kept at the harper-app root). The broadened root-level
+# `harper-app/*.js` protection would otherwise block editing them. One glob per
+# line (same syntax as the globs file); blank lines and `#` comments ignored.
+# Prefer naming compiled resource modules `resource-*.ts` so their JS output is
+# unambiguously generated and never needs allowlisting.
+ALLOWLIST_FILE="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
+if [ -f "$ALLOWLIST_FILE" ]; then
+  while IFS= read -r allow || [ -n "$allow" ]; do
+    [ -n "$allow" ] || continue
+    case "$allow" in \#*) continue ;; esac
+    if matches_glob "$NORMALIZED_FILE" "$allow"; then
+      exit 0
+    fi
+  done <"$ALLOWLIST_FILE"
+fi
+
 while IFS= read -r glob || [ -n "$glob" ]; do
   [ -n "$glob" ] || continue
   case "$glob" in \#*) continue ;; esac

package/plugins/lisa-harper-fabric/rules/harper-fabric.md

@@ -13,7 +13,7 @@ These rules apply to Harper/Fabric component apps managed by Lisa.
 - TypeScript under `src/` is the source of truth for Harper resources, browser modules, shared libraries, and operational scripts.
 - `harper-app/config.yaml`, `harper-app/schema.graphql`, HTML, CSS, docs, and research fixtures are source assets.
 - `harper-app/config.yaml` does not merge with Harper defaults. Keep every required top-level extension declared when editing it; the Harper Fabric hook blocks accidental extension drops unless the removal is documented in `.lisa/harper-config-extension-allowlist.json`.
-- `harper-app/resources.js` and `harper-app/web/**/*.js` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`.
+- Every `.js` at the harper-app root (`harper-app/*.js` — `resources.js`, `resource-*.js`, and any other compiled module) plus `harper-app/web/**/*.js` and `harper-app/lib/**` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`. Name compiled resource modules `resource-*.ts` so their output is unambiguously generated; a hand-written `.js` kept at the harper-app root must be re-included in `.gitignore` and listed in `.lisa/harper-generated-artifact-allowlist.txt` so the block hook allows editing it.
 - Deployment, bootstrap, smoke, seed, verify, preview, token, crawl, ingest, and extraction commands must run from compiled JavaScript or generated Harper assets, not stale checked-in JavaScript.
 
 ## Harper/Fabric Deploy Surface

package/plugins/lisa-harper-fabric/skills/harper-build-and-deploy/SKILL.md

@@ -50,15 +50,30 @@ What the build actually does:
 
 Generated Harper deploy artifacts usually include:
 
-- `harper-app/resources.js`
-- `harper-app/resource-*.js`
+- `harper-app/*.js` — every compiled module the build emits to the harper-app
+  root (`resources.js`, `resource-*.js`, and any other output such as a route
+  negotiation module). The single-star does **not** cross a directory separator,
+  so it does not match hand-written shims one level down.
 - `harper-app/web/**`
 - `harper-app/lib/**`
 
+The guard surfaces (`generated-artifact-globs.txt` for the PreToolUse block hook,
+`.gitignore`, `.prettierignore`, the ESLint/oxlint/knip ignores, and
+`tsconfig.eslint.json`) all key off `harper-app/*.js` so a newly-named compiled
+module is protected automatically. **Name compiled resource modules
+`resource-*.ts`** so their JS output is unambiguously generated.
+
+If you keep a *hand-written* `.js` at the harper-app root (e.g. an SEO shell),
+the root-level rule would otherwise treat it as generated: re-include it with a
+`!harper-app/<file>.js` line below the managed gitignore block, and add it to
+`.lisa/harper-generated-artifact-allowlist.txt` so the block hook lets you edit
+it. Hand-written shims nested under `harper-app/<route>/index.js` need no
+exemption — the root-level rule never matches them.
+
 Every lint, format, dead-code, search, or generated-artifact guard must ignore
-those generated paths unless it is explicitly validating the build output itself.
-When a new generated path appears, add it to every relevant ignore surface in the
-same change; partial ignores fail later gates in non-obvious ways.
+generated paths unless it is explicitly validating the build output itself. When
+a new generated *directory* appears, add it to every relevant ignore surface in
+the same change; partial ignores fail later gates in non-obvious ways.
 
 - **TypeScript under `src/` is source.** `bun run build` produces the deployable
   Harper assets from it.

package/plugins/lisa-harper-fabric-agy/generated-artifact-globs.txt

@@ -1,4 +1,5 @@
 harper-app/resources.js
 harper-app/resource-*.js
+harper-app/*.js
 harper-app/web/**
 harper-app/lib/**

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/skills/harper-build-and-deploy/SKILL.md

@@ -50,15 +50,30 @@ What the build actually does:
 
 Generated Harper deploy artifacts usually include:
 
-- `harper-app/resources.js`
-- `harper-app/resource-*.js`
+- `harper-app/*.js` — every compiled module the build emits to the harper-app
+  root (`resources.js`, `resource-*.js`, and any other output such as a route
+  negotiation module). The single-star does **not** cross a directory separator,
+  so it does not match hand-written shims one level down.
 - `harper-app/web/**`
 - `harper-app/lib/**`
 
+The guard surfaces (`generated-artifact-globs.txt` for the PreToolUse block hook,
+`.gitignore`, `.prettierignore`, the ESLint/oxlint/knip ignores, and
+`tsconfig.eslint.json`) all key off `harper-app/*.js` so a newly-named compiled
+module is protected automatically. **Name compiled resource modules
+`resource-*.ts`** so their JS output is unambiguously generated.
+
+If you keep a *hand-written* `.js` at the harper-app root (e.g. an SEO shell),
+the root-level rule would otherwise treat it as generated: re-include it with a
+`!harper-app/<file>.js` line below the managed gitignore block, and add it to
+`.lisa/harper-generated-artifact-allowlist.txt` so the block hook lets you edit
+it. Hand-written shims nested under `harper-app/<route>/index.js` need no
+exemption — the root-level rule never matches them.
+
 Every lint, format, dead-code, search, or generated-artifact guard must ignore
-those generated paths unless it is explicitly validating the build output itself.
-When a new generated path appears, add it to every relevant ignore surface in the
-same change; partial ignores fail later gates in non-obvious ways.
+generated paths unless it is explicitly validating the build output itself. When
+a new generated *directory* appears, add it to every relevant ignore surface in
+the same change; partial ignores fail later gates in non-obvious ways.
 
 - **TypeScript under `src/` is source.** `bun run build` produces the deployable
   Harper assets from it.

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.192.0",
+  "version": "2.193.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/generated-artifact-globs.txt

@@ -1,4 +1,5 @@
 harper-app/resources.js
 harper-app/resource-*.js
+harper-app/*.js
 harper-app/web/**
 harper-app/lib/**

package/plugins/lisa-harper-fabric-copilot/hooks/block-generated-artifact-edits.sh

@@ -33,6 +33,7 @@ matches_glob() {
   local file="$1"
   local glob="$2"
 
+  # Recursive directory globs: "dir/**" matches everything under dir.
   if [ "${glob: -3}" = "/**" ]; then
     local dir="${glob%/**}"
     case "$file" in
@@ -41,6 +42,38 @@ matches_glob() {
     return 1
   fi
 
+  # Single-star globs like "harper-app/*.js": the star must not cross a
+  # directory separator, so a broadened root-level pattern protects compiled
+  # modules emitted straight into harper-app/ (resources.js, resource-*.js, and
+  # any other build output such as detail-shell-negotiation.js) WITHOUT matching
+  # hand-written files nested one level down (e.g. harper-app/<route>/index.js).
+  case "$glob" in
+    */\** | \**)
+      local base_glob="${glob##*/}"
+      local dir_glob=""
+      case "$glob" in
+        */*) dir_glob="${glob%/*}" ;;
+      esac
+      local file_base="${file##*/}"
+      local file_dir=""
+      case "$file" in
+        */*) file_dir="${file%/*}" ;;
+      esac
+      case "$file_base" in
+        $base_glob) ;;
+        *) return 1 ;;
+      esac
+      [ -z "$dir_glob" ] && return 0
+      # Match the directory exactly, or as a suffix so absolute/prefixed paths
+      # (e.g. /repo/harper-app/foo.js) still resolve.
+      case "$file_dir" in
+        $dir_glob | */"$dir_glob") return 0 ;;
+      esac
+      return 1
+      ;;
+  esac
+
+  # Literal (wildcard-free) globs.
   case "$file" in
     $glob | */$glob) return 0 ;;
   esac
@@ -50,6 +83,24 @@ matches_glob() {
 
 NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
 
+# Project-owned allowlist of hand-written files that live under harper-app/ and
+# must NOT be treated as generated (e.g. a hand-authored SEO shell, or route
+# index.js shims kept at the harper-app root). The broadened root-level
+# `harper-app/*.js` protection would otherwise block editing them. One glob per
+# line (same syntax as the globs file); blank lines and `#` comments ignored.
+# Prefer naming compiled resource modules `resource-*.ts` so their JS output is
+# unambiguously generated and never needs allowlisting.
+ALLOWLIST_FILE="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
+if [ -f "$ALLOWLIST_FILE" ]; then
+  while IFS= read -r allow || [ -n "$allow" ]; do
+    [ -n "$allow" ] || continue
+    case "$allow" in \#*) continue ;; esac
+    if matches_glob "$NORMALIZED_FILE" "$allow"; then
+      exit 0
+    fi
+  done <"$ALLOWLIST_FILE"
+fi
+
 while IFS= read -r glob || [ -n "$glob" ]; do
   [ -n "$glob" ] || continue
   case "$glob" in \#*) continue ;; esac

package/plugins/lisa-harper-fabric-copilot/rules/harper-fabric.md

@@ -13,7 +13,7 @@ These rules apply to Harper/Fabric component apps managed by Lisa.
 - TypeScript under `src/` is the source of truth for Harper resources, browser modules, shared libraries, and operational scripts.
 - `harper-app/config.yaml`, `harper-app/schema.graphql`, HTML, CSS, docs, and research fixtures are source assets.
 - `harper-app/config.yaml` does not merge with Harper defaults. Keep every required top-level extension declared when editing it; the Harper Fabric hook blocks accidental extension drops unless the removal is documented in `.lisa/harper-config-extension-allowlist.json`.
-- `harper-app/resources.js` and `harper-app/web/**/*.js` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`.
+- Every `.js` at the harper-app root (`harper-app/*.js` — `resources.js`, `resource-*.js`, and any other compiled module) plus `harper-app/web/**/*.js` and `harper-app/lib/**` are generated deploy artifacts. Never edit them directly; change the matching TypeScript and run `bun run build`. Name compiled resource modules `resource-*.ts` so their output is unambiguously generated; a hand-written `.js` kept at the harper-app root must be re-included in `.gitignore` and listed in `.lisa/harper-generated-artifact-allowlist.txt` so the block hook allows editing it.
 - Deployment, bootstrap, smoke, seed, verify, preview, token, crawl, ingest, and extraction commands must run from compiled JavaScript or generated Harper assets, not stale checked-in JavaScript.
 
 ## Harper/Fabric Deploy Surface