@codyswann/lisa 2.195.3 → 2.195.6

package/plugins/lisa-harper-fabric/.codex-plugin/skills/harper-testing/SKILL.md

@@ -0,0 +1,254 @@
+---
+name: harper-testing
+description: "adding, repairing, or designing…"
+---
+
+# Harper Testing
+
+## Overview
+
+Test Harper apps at the layer that proves the risk:
+
+1. **Pure unit tests** for TypeScript helpers and data transforms.
+2. **Resource unit tests** for `Resource` methods with mocked Harper runtime globals.
+3. **Integration tests** against a running local Harper component with real schema,
+   resources, seed data, and REST/GraphQL responses.
+4. **Playwright e2e tests** against the same HTTP surface a user or client calls.
+
+Harper application source lives in TypeScript under `src/`; deployable
+`harper-app/resources.js`, `harper-app/resource-*.js`, and `harper-app/web/**` are
+generated. Build before integration or e2e tests so the runtime loads the code you
+just changed. See [[harper-build-and-deploy]].
+
+## Test pyramid
+
+| Layer | Tool | Use when | Avoid |
+| --- | --- | --- | --- |
+| Pure unit | Vitest | Validating transforms, validators, serializers, query builders, and other code with no Harper runtime dependency. | Mocking HTTP or tables for logic that can stay pure. |
+| Resource unit | Vitest | Exercising `get`, `post`, `search`, `patch`, or permission/error logic in a resource class without booting Harper. | Treating mocked tables as proof that `config.yaml`, `schema.graphql`, or REST exposure works. |
+| Integration | Vitest or shell smoke | Proving Harper boots, schema loads, `jsResource` registers code, data seeds, and endpoints respond. | Replacing this with resource mocks after config, schema, or generated artifact changes. |
+| E2E | Playwright | Verifying client-observable REST/GraphQL behavior, auth states, error paths, and browser workflows. | Re-testing every pure branch through the browser. |
+
+Use [[e2e-coverage-gaps]] after a suite exists to find missing routes and
+non-happy paths. Use this skill when creating or repairing the test patterns
+themselves.
+
+## Pure unit tests
+
+Keep business transforms importable without Harper globals:
+
+```typescript
+import { describe, expect, it } from 'vitest';
+import { normalizePetName } from '../src/pets/normalize';
+
+describe('normalizePetName', () => {
+  it('trims and title-cases names', () => {
+    expect(normalizePetName('  ada LOVELACE ')).toBe('Ada Lovelace');
+  });
+});
+```
+
+If a resource method contains complex transformation logic, extract the pure part
+and test it directly. Leave a thinner resource test for runtime wiring,
+authorization, and persistence behavior.
+
+## Resource unit tests
+
+Harper injects runtime globals such as `Resource` and `tables` when it loads
+`resources.js`. Unit tests do not get those globals automatically. Test resource
+methods by importing code through a seam that accepts mocks, or by setting the
+minimal globals before importing the resource module.
+
+Prefer dependency injection for new code:
+
+```typescript
+import { describe, expect, it, vi } from 'vitest';
+import { createPetsResource } from '../src/resources/pets';
+
+describe('PetsResource.get', () => {
+  it('adds adoption status from the table record', async () => {
+    const table = {
+      get: vi.fn(async () => ({ id: 'pet-1', name: 'Mina', adoptedAt: null })),
+    };
+    const Pets = createPetsResource({ Resource: class {}, table });
+
+    await expect(Pets.get({ id: 'pet-1' })).resolves.toMatchObject({
+      id: 'pet-1',
+      name: 'Mina',
+      adoptionStatus: 'available',
+    });
+    expect(table.get).toHaveBeenCalledWith({ id: 'pet-1' });
+  });
+});
+```
+
+When existing code must extend `tables.X` directly, isolate the runtime globals in
+a test helper and import the module after setup:
+
+```typescript
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+describe('Pets resource', () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.stubGlobal('Resource', class {});
+    vi.stubGlobal('tables', {
+      Pets: class {
+        static async get(target: { id: string }) {
+          return { id: target.id, name: 'Mina' };
+        }
+      },
+    });
+  });
+
+  it('wraps the runtime table', async () => {
+    const { Pets } = await import('../src/resources/pets');
+    await expect(Pets.get({ id: 'pet-1' })).resolves.toMatchObject({
+      id: 'pet-1',
+      name: 'Mina',
+    });
+  });
+});
+```
+
+Keep mocks narrow. Mock only the table methods, `Resource` base behavior,
+`server.resources`, or external fetch calls the method actually uses. If the test
+starts recreating Harper's schema, REST routing, or auth behavior, move it to an
+integration test.
+
+## Integration tests with local Harper
+
+Use integration tests to prove the component runs as Harper will load it:
+
+1. Install dependencies and build TypeScript: `bun install --frozen-lockfile`
+   when needed, then `bun run build`.
+2. Start a local Harper process against the component, usually
+   `harper dev harper-app` for watch mode or `harper run harper-app` for a
+   one-shot test process. Use the project's wrapper command when present.
+3. If the test lives outside the app repo, symlink the built component into
+   Harper's component directory rather than copying generated artifacts by hand.
+   Clean the symlink in teardown.
+4. Seed data through `dataLoader` fixtures when the project owns static fixtures,
+   or through REST/Operations API calls when each test needs dynamic setup.
+5. Assert the real REST/GraphQL endpoint and response body.
+6. Stop Harper and remove test data, temp components, and symlinks.
+
+Shell smoke tests are acceptable when the project already has that convention.
+Keep them strict: exit non-zero on boot failure, seed failure, missing endpoint,
+wrong status, or wrong response shape.
+
+Example integration skeleton:
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+bun run build
+
+HARPER_APP_DIR="${PWD}/harper-app"
+HARPER_HOME="${HARPER_HOME:-${PWD}/.harper-test}"
+BASE_URL="${BASE_URL:-http://127.0.0.1:9926}"
+
+mkdir -p "$HARPER_HOME/components"
+ln -sfn "$HARPER_APP_DIR" "$HARPER_HOME/components/pets"
+
+HARPER_HOME="$HARPER_HOME" harper run "$HARPER_APP_DIR" > /tmp/harper-test.log 2>&1 &
+HARPER_PID=$!
+trap 'kill "$HARPER_PID" 2>/dev/null || true; rm -f "$HARPER_HOME/components/pets"' EXIT
+
+for _ in {1..30}; do
+  curl -fsS "$BASE_URL/health" >/dev/null && break
+  sleep 1
+done
+
+curl -fsS -X POST "$BASE_URL/Pets" \
+  -H 'content-type: application/json' \
+  --data '{"id":"pet-it-1","name":"Mina"}' >/dev/null
+
+curl -fsS "$BASE_URL/Pets/pet-it-1" | jq -e '.name == "Mina"'
+```
+
+Adjust the health path, component name, port, and endpoint names to the project.
+Do not commit local `HARPER_HOME`, logs, generated component copies, or secrets.
+
+## Seeding and isolation
+
+Use deterministic test data that cannot collide with developer or CI data:
+
+- Prefix IDs with the test name and a run ID, for example
+  `pet-${process.env.GITHUB_RUN_ID ?? Date.now()}`.
+- Prefer per-test setup/teardown through REST or Operations API when tests mutate
+  records.
+- Prefer `dataLoader` fixtures for stable baseline data that every local boot
+  should have.
+- Make teardown idempotent; deleting a record that is already gone should not fail
+  the suite.
+- Keep seed fixtures aligned with [[harper-schema-graphql]]. A field or type rename
+  must update fixtures, resource tests, verify scripts, and Playwright assertions in
+  the same PR.
+
+`dataLoader` is good for fast, declarative baseline rows. REST seeding is better
+when the test must exercise validation, defaults, auth, or generated IDs exactly as
+clients see them.
+
+## Playwright endpoint tests
+
+Use Playwright for HTTP behavior that needs browser tooling, request contexts,
+storage state, tracing, or cross-browser/project coverage. A first endpoint spec
+should cover one happy path and one non-happy path:
+
+```typescript
+import { expect, test } from '@playwright/test';
+
+test.describe('Pets REST endpoint', () => {
+  test('creates and reads a pet', async ({ request }) => {
+    const id = `pet-pw-${Date.now()}`;
+
+    const create = await request.post('/Pets', {
+      data: { id, name: 'Mina' },
+    });
+    expect(create.ok()).toBe(true);
+
+    const read = await request.get(`/Pets/${id}`);
+    expect(read.status()).toBe(200);
+    await expect(read).toHaveJSON(expect.objectContaining({ id, name: 'Mina' }));
+  });
+
+  test('rejects invalid payloads', async ({ request }) => {
+    const response = await request.post('/Pets', {
+      data: { name: '' },
+    });
+
+    expect(response.status()).toBeGreaterThanOrEqual(400);
+    await expect(response).toHaveJSON(
+      expect.objectContaining({
+        error: expect.any(String),
+      }),
+    );
+  });
+});
+```
+
+If the project uses custom auth, set `storageState`, headers, or a request fixture
+in Playwright config instead of embedding credentials in specs. Never commit
+tokens or local `.env` values.
+
+## Schema and verify coupling
+
+A schema rename or resource route change is a breaking change for every verify
+path that names that table, field, endpoint, fixture, or response shape.
+
+In the same PR as a schema/resource change:
+
+- Update `schema.graphql`, TypeScript resources, fixtures, and data loaders.
+- Update Vitest resource tests and Playwright endpoint specs.
+- Update shell smoke or `scripts/verify*` paths that assert row counts, joins, or
+  response keys.
+- Run `bun run build`, `bun run typecheck`, and the smallest relevant test command.
+- For deploy-affecting changes, boot local Harper or run the project smoke command
+  against the deployed endpoint. See [[harper-build-and-deploy]].
+
+Do not report a Harper test change done only because mocks pass. At least one
+verify path must prove the generated app still boots and exposes the expected
+surface whenever config, schema, resources, generated artifacts, or endpoints are
+part of the change.

package/plugins/lisa-harper-fabric/.codex-plugin/skills/harper-testing/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Harper Testing"
+short_description: "adding, repairing, or designing…"
+default_prompt:
+  - "Use $harper-testing: adding, repairing, or designing…."

package/plugins/lisa-harper-fabric/.codex-plugin/skills/lisa-e2e-coverage-gaps/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: lisa-e2e-coverage-gaps
+description: "Explore gaps in the automated…"
+---
+## Lisa Command Compatibility
+
+- Original Claude command: `/lisa:e2e-coverage-gaps`
+- Codex invocation: `$lisa-e2e-coverage-gaps` or a plain-English request that matches this skill.
+- Treat the user's surrounding request as the command arguments.
+- Claude argument hint: `[target-url | env] [ready=true|false]`
+- Claude allowed tools: `Skill`. Codex tool access is governed by the active Codex runtime and project policy.
+
+Use the /lisa-harper-fabric:e2e-coverage-gaps skill to inventory the app's routes and the existing Playwright suite, find uncovered and happy-path-only paths, confirm each gap in the running app, and file one build-ready missing-test ticket per gap via lisa:tracker-write (build-ready per the ready flag, default true). For human usability/experience findings, use /lisa:exploratory-qa. Use the user's surrounding request as this command's arguments.

package/plugins/lisa-harper-fabric/.codex-plugin/skills/lisa-e2e-coverage-gaps/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "E2e Coverage Gaps"
+short_description: "Explore gaps in the automated…"
+default_prompt:
+  - "Use $lisa-e2e-coverage-gaps: Explore gaps in the automated…."

package/plugins/lisa-harper-fabric/hooks/block-generated-artifact-edits.sh

@@ -13,14 +13,23 @@ JSON_INPUT=$(cat)
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
-[ -n "$FILE_PATH" ] || exit 0
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FILE_PATHS=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+if [ -z "$FILE_PATHS" ] && [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+fi
+[ -n "$FILE_PATHS" ] || exit 0
 
 PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
 if [ -z "$PLUGIN_ROOT" ]; then
   PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 fi
 GLOBS_FILE="$PLUGIN_ROOT/generated-artifact-globs.txt"
+if [ ! -f "$GLOBS_FILE" ]; then
+  GLOBS_FILE="$SCRIPT_DIR/generated-artifact-globs.txt"
+fi
 [ -f "$GLOBS_FILE" ] || exit 0
 
 normalize_path() {
@@ -81,8 +90,6 @@ matches_glob() {
   return 1
 }
 
-NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
-
 # Project-owned allowlist of hand-written files that live under harper-app/ and
 # must NOT be treated as generated (e.g. a hand-authored SEO shell, or route
 # index.js shims kept at the harper-app root). The broadened root-level
@@ -90,34 +97,45 @@ NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
 # line (same syntax as the globs file); blank lines and `#` comments ignored.
 # Prefer naming compiled resource modules `resource-*.ts` so their JS output is
 # unambiguously generated and never needs allowlisting.
-ALLOWLIST_FILE="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
-if [ -f "$ALLOWLIST_FILE" ]; then
-  while IFS= read -r allow || [ -n "$allow" ]; do
-    [ -n "$allow" ] || continue
-    case "$allow" in \#*) continue ;; esac
-    if matches_glob "$NORMALIZED_FILE" "$allow"; then
-      exit 0
-    fi
-  done <"$ALLOWLIST_FILE"
-fi
-
-while IFS= read -r glob || [ -n "$glob" ]; do
-  [ -n "$glob" ] || continue
-  case "$glob" in \#*) continue ;; esac
+check_file() {
+  local file_path="$1"
+  local normalized_file
+  normalized_file=$(normalize_path "$file_path")
+  local allowlist_file="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
+  if [ -f "$allowlist_file" ]; then
+    while IFS= read -r allow || [ -n "$allow" ]; do
+      [ -n "$allow" ] || continue
+      case "$allow" in \#*) continue ;; esac
+      if matches_glob "$normalized_file" "$allow"; then
+        return 0
+      fi
+    done <"$allowlist_file"
+  fi
 
-  if matches_glob "$NORMALIZED_FILE" "$glob"; then
-    cat >&2 <<MSG
+  while IFS= read -r glob || [ -n "$glob" ]; do
+    [ -n "$glob" ] || continue
+    case "$glob" in \#*) continue ;; esac
+    if matches_glob "$normalized_file" "$glob"; then
+      cat >&2 <<MSG
 Blocked: direct edit to generated Harper/Fabric artifact.
 
-File: $FILE_PATH
+File: $file_path
 Matched generated artifact pattern: $glob
 
 TypeScript under src/ is the source of truth for Harper resources, web assets,
 and shared libraries. Change the matching TypeScript source under src/ and run
 the project build to regenerate harper-app outputs.
 MSG
-    exit 2
-  fi
-done <"$GLOBS_FILE"
+      return 2
+    fi
+  done <"$GLOBS_FILE"
+}
+
+while IFS= read -r FILE_PATH; do
+  [ -n "$FILE_PATH" ] || continue
+  check_file "$FILE_PATH" || exit $?
+done <<EOF
+$FILE_PATHS
+EOF
 
 exit 0

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.mjs

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
@@ -39,21 +38,20 @@ const repoRelativeConfigPath = filePath => {
   return index === -1 ? normalized : normalized.slice(index);
 };
 
-const loadYaml = () => {
-  const require = createRequire(import.meta.url);
-  return require("js-yaml");
-};
-
 const topLevelExtensionKeys = yamlText => {
-  const yaml = loadYaml();
-  let parsed;
-  try {
-    parsed = yaml.load(yamlText);
-  } catch {
-    return null;
+  const keys = [];
+  for (const line of yamlText.split(/\r?\n/)) {
+    if (/^\s*(?:#.*)?$/.test(line) || /^---\s*$/.test(line)) continue;
+    if (/^\s/.test(line)) continue;
+    if (line.startsWith("!!") || ["[", "]", "{", "}"].includes(line[0])) {
+      return null;
+    }
+    const match = line.match(/^(?:"([^"]+)"|'([^']+)'|([^:#][^:]*?)):\s*/);
+    if (!match) return null;
+    const key = match[1] ?? match[2] ?? match[3]?.trim();
+    if (key) keys.push(key);
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
-  return Object.keys(parsed).sort();
+  return Array.from(new Set(keys)).sort();
 };
 
 const gitEnv = () =>

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.sh

@@ -11,9 +11,36 @@ PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
 if [ -z "$PLUGIN_ROOT" ]; then
   PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_PATH="$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+if [ ! -f "$SCRIPT_PATH" ]; then
+  SCRIPT_PATH="$SCRIPT_DIR/enforce-config-extensions.mjs"
+fi
+
+JSON_INPUT=$(cat)
+
+run_check() {
+  if command -v bun >/dev/null 2>&1; then
+    printf '%s' "$1" | bun "$SCRIPT_PATH"
+  else
+    printf '%s' "$1" | node "$SCRIPT_PATH"
+  fi
+}
 
-if command -v bun >/dev/null 2>&1; then
-  exec bun "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+if [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+  if [ -n "$FILE_PATHS" ]; then
+    while IFS= read -r FILE_PATH; do
+      [ -n "$FILE_PATH" ] || continue
+      FILE_INPUT=$(printf '%s' "$JSON_INPUT" | jq --arg path "$FILE_PATH" '.tool_input.file_path = $path')
+      run_check "$FILE_INPUT" || exit $?
+    done <<EOF
+$FILE_PATHS
+EOF
+    exit 0
+  fi
 fi
 
-exec node "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+run_check "$JSON_INPUT"

package/plugins/lisa-harper-fabric/hooks/inject-rules.sh

@@ -3,7 +3,7 @@
 # into Claude context at session/subagent start.
 set -euo pipefail
 
-ROOT="${CLAUDE_PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}}"
 RULES_DIR="$ROOT/rules"
 
 [ -d "$RULES_DIR" ] || exit 0

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.195.3",
+  "version": "2.195.6",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.195.3",
+  "version": "2.195.6",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/hooks/block-generated-artifact-edits.sh

@@ -13,14 +13,23 @@ JSON_INPUT=$(cat)
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
-[ -n "$FILE_PATH" ] || exit 0
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FILE_PATHS=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+if [ -z "$FILE_PATHS" ] && [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+fi
+[ -n "$FILE_PATHS" ] || exit 0
 
 PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
 if [ -z "$PLUGIN_ROOT" ]; then
   PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 fi
 GLOBS_FILE="$PLUGIN_ROOT/generated-artifact-globs.txt"
+if [ ! -f "$GLOBS_FILE" ]; then
+  GLOBS_FILE="$SCRIPT_DIR/generated-artifact-globs.txt"
+fi
 [ -f "$GLOBS_FILE" ] || exit 0
 
 normalize_path() {
@@ -81,8 +90,6 @@ matches_glob() {
   return 1
 }
 
-NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
-
 # Project-owned allowlist of hand-written files that live under harper-app/ and
 # must NOT be treated as generated (e.g. a hand-authored SEO shell, or route
 # index.js shims kept at the harper-app root). The broadened root-level
@@ -90,34 +97,45 @@ NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
 # line (same syntax as the globs file); blank lines and `#` comments ignored.
 # Prefer naming compiled resource modules `resource-*.ts` so their JS output is
 # unambiguously generated and never needs allowlisting.
-ALLOWLIST_FILE="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
-if [ -f "$ALLOWLIST_FILE" ]; then
-  while IFS= read -r allow || [ -n "$allow" ]; do
-    [ -n "$allow" ] || continue
-    case "$allow" in \#*) continue ;; esac
-    if matches_glob "$NORMALIZED_FILE" "$allow"; then
-      exit 0
-    fi
-  done <"$ALLOWLIST_FILE"
-fi
-
-while IFS= read -r glob || [ -n "$glob" ]; do
-  [ -n "$glob" ] || continue
-  case "$glob" in \#*) continue ;; esac
+check_file() {
+  local file_path="$1"
+  local normalized_file
+  normalized_file=$(normalize_path "$file_path")
+  local allowlist_file="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
+  if [ -f "$allowlist_file" ]; then
+    while IFS= read -r allow || [ -n "$allow" ]; do
+      [ -n "$allow" ] || continue
+      case "$allow" in \#*) continue ;; esac
+      if matches_glob "$normalized_file" "$allow"; then
+        return 0
+      fi
+    done <"$allowlist_file"
+  fi
 
-  if matches_glob "$NORMALIZED_FILE" "$glob"; then
-    cat >&2 <<MSG
+  while IFS= read -r glob || [ -n "$glob" ]; do
+    [ -n "$glob" ] || continue
+    case "$glob" in \#*) continue ;; esac
+    if matches_glob "$normalized_file" "$glob"; then
+      cat >&2 <<MSG
 Blocked: direct edit to generated Harper/Fabric artifact.
 
-File: $FILE_PATH
+File: $file_path
 Matched generated artifact pattern: $glob
 
 TypeScript under src/ is the source of truth for Harper resources, web assets,
 and shared libraries. Change the matching TypeScript source under src/ and run
 the project build to regenerate harper-app outputs.
 MSG
-    exit 2
-  fi
-done <"$GLOBS_FILE"
+      return 2
+    fi
+  done <"$GLOBS_FILE"
+}
+
+while IFS= read -r FILE_PATH; do
+  [ -n "$FILE_PATH" ] || continue
+  check_file "$FILE_PATH" || exit $?
+done <<EOF
+$FILE_PATHS
+EOF
 
 exit 0

package/plugins/lisa-harper-fabric-copilot/hooks/enforce-config-extensions.mjs

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
@@ -39,21 +38,20 @@ const repoRelativeConfigPath = filePath => {
   return index === -1 ? normalized : normalized.slice(index);
 };
 
-const loadYaml = () => {
-  const require = createRequire(import.meta.url);
-  return require("js-yaml");
-};
-
 const topLevelExtensionKeys = yamlText => {
-  const yaml = loadYaml();
-  let parsed;
-  try {
-    parsed = yaml.load(yamlText);
-  } catch {
-    return null;
+  const keys = [];
+  for (const line of yamlText.split(/\r?\n/)) {
+    if (/^\s*(?:#.*)?$/.test(line) || /^---\s*$/.test(line)) continue;
+    if (/^\s/.test(line)) continue;
+    if (line.startsWith("!!") || ["[", "]", "{", "}"].includes(line[0])) {
+      return null;
+    }
+    const match = line.match(/^(?:"([^"]+)"|'([^']+)'|([^:#][^:]*?)):\s*/);
+    if (!match) return null;
+    const key = match[1] ?? match[2] ?? match[3]?.trim();
+    if (key) keys.push(key);
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
-  return Object.keys(parsed).sort();
+  return Array.from(new Set(keys)).sort();
 };
 
 const gitEnv = () =>