@codyswann/lisa 2.195.3 → 2.195.6

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-status/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: lisa-wiki-status
+description: "Report Lisa wiki source…"
+allowed-tools: ["Bash", "Read"]
+---
+
+# lisa-wiki-status
+
+Render the Lisa wiki source freshness report without changing the repository.
+
+## Scope
+
+This skill answers a narrower question than `lisa-wiki-doctor` or `lisa-wiki-lint`: whether each enabled, non-external-write ingestion connector has current source evidence and what the operator should do next.
+
+Read these repository files as the source of truth:
+
+- `wiki/lisa-wiki.config.json` for enabled connectors and wiki root.
+- `wiki/log.md` for latest ingest, skip, and blocker notes.
+- `wiki/sources/**` for reader-safe source notes.
+- `wiki/state/**` for connector state cursors and source-note references.
+
+## Workflow
+
+1. Resolve the wiki root from `wiki/lisa-wiki.config.json`, unless `--wiki` or `--config` is passed.
+2. Run the bundled deterministic renderer:
+
+   ```bash
+   node plugins/lisa-wiki/scripts/wiki-status.mjs $ARGUMENTS
+   ```
+
+   If running from the source plugin tree before distribution, use `plugins/src/wiki/scripts/wiki-status.mjs`.
+3. Report the rendered connector table. Preserve connector verdicts exactly:
+   `fresh`, `stale`, `never_ingested`, `skipped`, or `blocked`.
+4. Include the evidence paths, last observed date, skip/blocker reason when present, and exact next action for each non-fresh connector.
+5. Mention `lisa-wiki-lint` only as a separate integrity follow-up. Do not conflate freshness with broken links, stale claims, or structure linting.
+
+## Rules
+
+- **Read-only.** Do not ingest, edit wiki pages, edit config, advance state, branch, commit, push, open PRs, or run repair flows.
+- Do **not** ask for confirmation before rendering. This status command has no write side effects.
+- Do **not** use global Codex memory or non-project memory as fresh wiki evidence. Only project-scoped source notes, state, and log entries count.
+- If the wiki/config is missing, surface the renderer output or error directly and stop.
+- If a connector is skipped because project-scoped memory is unavailable, preserve that reason and treat accepting the expected skip as a valid next action.
+
+## Related
+
+`lisa-wiki-ingest` refreshes sources, `lisa-wiki-lint` checks wiki integrity, and `lisa-wiki-doctor` verifies setup/readiness.

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-status/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Wiki Status"
+short_description: "Report Lisa wiki source…"
+default_prompt:
+  - "Use $lisa-wiki-status: Report Lisa wiki source…."

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-tear-down-automations/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: lisa-wiki-tear-down-automations
+description: "Remove the recurring LLM Wiki…"
+allowed-tools: ["Skill", "Bash", "Read"]
+---
+
+# Tear down LLM Wiki automations: $ARGUMENTS
+
+This skill is a **specification, not a script.** It tells the current runtime which recurring wiki
+automation to remove — the one `/lisa-wiki:setup-automations` created for THIS project — and the
+runtime removes it with its **native** scheduling mechanism.
+
+## Runtime scheduler (branch on the current runtime)
+
+- **Codex** → list Codex automations and delete the `lisa-wiki-auto-<project>-*` set via the native
+  automations mechanism (prefer the native delete over hand-removing
+  `~/.codex/automations/<id>/`, which is only the backing store).
+- **Claude** → use **`/schedule`** to list and remove the matching recurring routine.
+- **Other runtimes** → use the runtime's native recurring-task mechanism. If it has none, state that
+  and stop.
+
+## Scope (remove only what setup created)
+
+- Remove the wiki automation `/lisa-wiki:setup-automations` creates for the current project, matched
+  by the stable `lisa-wiki-auto-<project>-` name prefix: `wiki-ingest`.
+- **Never** remove the base `lisa-auto-<project>-*` automations, automations for a different project,
+  or any non-Lisa automation (e.g. unrelated crawlers/ingestors). Match strictly on the
+  `lisa-wiki-auto-<project>-` prefix for THIS project; when in doubt about an automation's ownership,
+  leave it and report it rather than deleting it.
+- **Idempotent** — an automation that is already absent is a no-op, not an error.
+
+## Report
+
+List the automation removed, or report it as already absent.

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-tear-down-automations/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Wiki Tear Down Automations"
+short_description: "Remove the recurring LLM Wiki…"
+default_prompt:
+  - "Use $lisa-wiki-tear-down-automations: Remove the recurring LLM Wiki…."

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-usage/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: lisa-wiki-usage
+description: "Explain how to browse, query…"
+---
+
+# lisa-wiki-usage
+
+Orient a human or agent to the project's LLM Wiki and point them at the right entry points and
+canonical commands. This skill is **read-only guidance** — it never writes wiki pages, advances
+state, or opens PRs.
+
+## What the wiki is
+
+A git-native markdown knowledge base under `wiki/`, maintained by the `lisa-wiki` plugin. It follows
+the three-layer model: immutable **raw sources** (`wiki/sources/`), the LLM-owned **synthesis** layer
+(category directories like `concepts/`, `entities/`, `architecture/`, …), and the **schema** that
+governs it (`wiki/schema/llm-wiki-contract.md`, rendered from the project's `wiki/lisa-wiki.config.json`).
+
+## Entry points (read these first)
+
+1. `wiki/start-here.md` — orientation and the wiki's stated purpose.
+2. `wiki/index.md` — the navigation map of every page (grouped by category).
+3. `wiki/schema/llm-wiki-contract.md` — the rules this wiki follows.
+4. `wiki/log.md` — the append-only history of every ingestion/maintenance operation.
+
+## How to do things
+
+On **Claude** these are slash commands; on **Codex** invoke the same skills from the app slash list
+(e.g. `$lisa-wiki-query`).
+
+- **Find or answer something:** `/query "<your question>"` (Codex: `$lisa-wiki-query`) — read-only by
+  default; returns a cited answer drawn from the wiki. Or browse `wiki/index.md` manually.
+- **Get oriented as a new user:** `/onboard-me` (Codex: `$lisa-wiki-onboard-me`) — a guided tour plus
+  sample questions tuned to your role.
+- **Add knowledge:** `/ingest <url|file|prompt>` (Codex: `$lisa-wiki-ingest`) for a single source, or
+  `/ingest` with no argument for a full ingest across all enabled **non-external-write** sources
+  (external-write sources like Slack OAuth require explicit intent). Do not hand-edit synthesis pages
+  to add facts — route them through `/ingest` so provenance, the index, and the log stay consistent.
+- **Check the wiki's health:** `/lint` (Codex: `$lisa-wiki-lint`) — orphans, contradictions, stale
+  claims, broken links.
+
+## Citations & trust
+
+Every synthesized claim should cite a source note (e.g. `Source: wiki/sources/<system>/<note>.md`).
+If you find an uncited or contradictory claim, that is a `/lint` finding — surface it rather than
+trusting it. Weak or unverified material belongs in `wiki/open-questions/`, not stated as fact.
+
+## Related skills
+
+`lisa-wiki-ingest`, `lisa-wiki-query`, `lisa-wiki-lint`, `lisa-wiki-onboard-me`, `lisa-wiki-setup`.

package/plugins/lisa-wiki/.codex-plugin/skills/lisa-wiki-usage/agents/openai.yaml

@@ -0,0 +1,4 @@
+display_name: "Wiki Usage"
+short_description: "Explain how to browse, query…"
+default_prompt:
+  - "Use $lisa-wiki-usage: Explain how to browse, query…."

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.195.3",
+  "version": "2.195.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.195.3",
+  "version": "2.195.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.195.3",
+  "version": "2.195.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/inject-rules.sh

@@ -16,12 +16,13 @@ else
   HOOK_EVENT="SessionStart"
 fi
 
-RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules/eager"
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+RULES_DIR="$ROOT/rules/eager"
 
 # Backward compatibility: if the eager subdir is absent (older Lisa install),
 # fall back to the flat rules/ directory so a partial upgrade still ships rules.
 if [ ! -d "$RULES_DIR" ]; then
-  RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules"
+  RULES_DIR="$ROOT/rules"
 fi
 
 # Bail silently if no rules directory at all

package/plugins/src/base/hooks/install-pkgs.sh

@@ -2,6 +2,10 @@
 # This file is managed by Lisa.
 # Do not edit directly — changes will be overwritten on the next `lisa` run.
 
+# Drain the hook envelope before any early return. The script does not inspect
+# it, but Codex/Cursor-compatible runners may stream it through a bounded pipe.
+cat >/dev/null 2>&1 || true
+
 link_primary_worktree_node_modules() {
   [ -f "package.json" ] || return 1
   [ ! -e "node_modules" ] && [ ! -L "node_modules" ] || return 1
@@ -68,49 +72,4 @@ case "$PACKAGE_MANAGER" in
   *) npm install >&2 ;;
 esac
 
-# The tools below use Linux-specific binaries and paths — skip on other platforms.
-if [ "$(uname -s)" != "Linux" ]; then
-  exit 0
-fi
-
-# Install Gitleaks for secret detection (pre-commit hook)
-echo "Installing Gitleaks for secret detection..." >&2
-GITLEAKS_VERSION="8.18.4"
-curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz -C /usr/local/bin gitleaks
-echo "Gitleaks installed: $(gitleaks version)" >&2
-
-# Install jira-cli for JIRA integration
-# The tarball nests the binary at jira_VERSION_linux_x86_64/bin/jira,
-# so we extract to a temp dir and copy the binary out.
-echo "Installing jira-cli for JIRA integration..." >&2
-JIRA_CLI_VERSION="1.7.0"
-JIRA_TMPDIR=$(mktemp -d)
-curl -sSfL "https://github.com/ankitpokhrel/jira-cli/releases/download/v${JIRA_CLI_VERSION}/jira_${JIRA_CLI_VERSION}_linux_x86_64.tar.gz" \
-  | tar -xz -C "${JIRA_TMPDIR}"
-cp "${JIRA_TMPDIR}/jira_${JIRA_CLI_VERSION}_linux_x86_64/bin/jira" /usr/local/bin/jira
-chmod +x /usr/local/bin/jira
-rm -rf "${JIRA_TMPDIR}"
-echo "jira-cli installed: $(jira version)" >&2
-
-# Install Chromium for Lighthouse CI (pre-push hook)
-# Playwright's bundled Chromium works with @lhci/cli
-echo "Installing Chromium for Lighthouse CI..." >&2
-npx playwright install chromium >&2
-
-# Find and export CHROME_PATH for Lighthouse CI
-# Use sort to ensure deterministic selection of the latest version
-CHROME_PATH=$(find ~/.cache/ms-playwright -name "chrome" -type f 2>/dev/null | grep "chrome-linux" | sort | tail -n 1)
-if [ -n "$CHROME_PATH" ]; then
-  # Append to ~/.bashrc for shell sessions (idempotent)
-  if ! grep -q "export CHROME_PATH=" ~/.bashrc 2>/dev/null; then
-    echo "export CHROME_PATH=\"$CHROME_PATH\"" >> ~/.bashrc
-  else
-    # Update existing CHROME_PATH in bashrc
-    sed -i "s|^export CHROME_PATH=.*|export CHROME_PATH=\"$CHROME_PATH\"|" ~/.bashrc
-  fi
-
-  export CHROME_PATH="$CHROME_PATH"
-  echo "Chromium installed at: $CHROME_PATH" >&2
-fi
-
 exit 0

package/plugins/src/base/hooks/setup-jira-cli.sh

@@ -16,19 +16,11 @@
 
 set -euo pipefail
 
-# Fix jira-cli installation if install-pkgs.sh failed to extract correctly.
-# Only attempt on Linux — the binary download is Linux-only.
-if [[ "$(uname -s)" == "Linux" ]] && ! command -v jira &>/dev/null; then
-  JIRA_CLI_VERSION="1.7.0"
-  TMPDIR=$(mktemp -d)
-  curl -sSfL "https://github.com/ankitpokhrel/jira-cli/releases/download/v${JIRA_CLI_VERSION}/jira_${JIRA_CLI_VERSION}_linux_x86_64.tar.gz" \
-    | tar -xz -C "${TMPDIR}"
-  cp "${TMPDIR}/jira_${JIRA_CLI_VERSION}_linux_x86_64/bin/jira" /usr/local/bin/jira
-  chmod +x /usr/local/bin/jira
-  rm -rf "${TMPDIR}"
-fi
+# Drain the hook envelope before any early return.
+cat >/dev/null 2>&1 || true
 
-CONFIG_DIR="${HOME}/.config/.jira"
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
+CONFIG_DIR="${PROJECT_DIR}/.lisa/jira-cli"
 CONFIG_FILE="${CONFIG_DIR}/.config.yml"
 
 read_lisa_config() {

package/plugins/src/base/skills/lisa-setup-linear/SKILL.md

@@ -156,7 +156,7 @@ read_role() {  # $1=namespace (build|prd) $2=role $3=default
 
 Probe with `lisa-linear-access operation: list-issue-labels` (scoped to the team). For each role's resolved name, create it via `lisa-linear-access operation: create-issue-label` only if absent. The `done` role is env-keyed — create all three defaults; collapse to a single string in config later if the project's terminal state is env-independent.
 
-| Role | Default | 
+| Role | Default |
 |------|---------|
 | `ready` | `status:ready` |
 | `claimed` | `status:in-progress` |

package/plugins/src/expo/.mcp.json

@@ -3,10 +3,6 @@
     "expo": {
       "type": "http",
       "url": "https://mcp.expo.dev/mcp"
-    },
-    "maestro": {
-      "command": "maestro",
-      "args": ["mcp"]
     }
   }
 }

package/plugins/src/expo/THIRD-PARTY-NOTICES.md

@@ -30,12 +30,20 @@ The accompanying `expo` MCP server in `.mcp.json` points at Expo's official
 remote server (`https://mcp.expo.dev/mcp`), replacing the previously bundled
 third-party `expo-local-docs-mcp` stdio server.
 
-The `maestro` MCP server in `.mcp.json` runs the official Maestro CLI's
-built-in MCP server (`maestro mcp`, STDIO) — nothing is bundled; it requires
-the host machine's own Maestro CLI (with a Java runtime) and exposes device
-automation tools (list_devices, inspect_screen, take_screenshot, run flows,
-cheat_sheet, and Maestro Cloud variants) to coding agents. Servers whose CLI
-is absent simply fail to start without affecting the rest of the plugin.
+The Maestro CLI's built-in MCP server (`maestro mcp`, STDIO) is intentionally
+NOT registered in `.mcp.json`. Coding agents spawn stdio servers with a
+non-login PATH, so an always-on entry fails visibly (Claude Code shows a
+"Failed to reconnect … -32000" error every session) on any machine missing the
+Maestro CLI or a resolvable Java runtime — which is most of the fleet. Opt in
+per machine instead, e.g.:
+
+```
+claude mcp add --scope local maestro -- maestro mcp
+```
+
+ensuring `maestro` and a Java runtime are on the non-interactive PATH (mise
+users: `claude mcp add --scope local maestro -- mise exec java -- maestro mcp`
+from a directory where Java is active).
 
 ### MIT License
 

package/plugins/src/expo/skills/building-native-ui/SKILL.md

@@ -15,7 +15,7 @@ Consult these resources as needed:
 references/
   animations.md          Reanimated: entering, exiting, layout, scroll-driven, gestures
   controls.md            Native iOS: Switch, Slider, SegmentedControl, DateTimePicker, Picker
-  form-sheet.md          Form sheets in expo-router: configuration, footers and background interaction. 
+  form-sheet.md          Form sheets in expo-router: configuration, footers and background interaction.
   gradients.md           CSS gradients via experimental_backgroundImage (New Arch only)
   icons.md               SF Symbols via expo-image (sf: source), names, animations, weights
   media.md               Camera, audio, video, and file saving

package/plugins/src/harper-fabric/hooks/block-generated-artifact-edits.sh

@@ -13,14 +13,23 @@ JSON_INPUT=$(cat)
 
 command -v jq >/dev/null 2>&1 || exit 0
 
-FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
-[ -n "$FILE_PATH" ] || exit 0
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FILE_PATHS=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+if [ -z "$FILE_PATHS" ] && [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+fi
+[ -n "$FILE_PATHS" ] || exit 0
 
 PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
 if [ -z "$PLUGIN_ROOT" ]; then
   PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 fi
 GLOBS_FILE="$PLUGIN_ROOT/generated-artifact-globs.txt"
+if [ ! -f "$GLOBS_FILE" ]; then
+  GLOBS_FILE="$SCRIPT_DIR/generated-artifact-globs.txt"
+fi
 [ -f "$GLOBS_FILE" ] || exit 0
 
 normalize_path() {
@@ -81,8 +90,6 @@ matches_glob() {
   return 1
 }
 
-NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
-
 # Project-owned allowlist of hand-written files that live under harper-app/ and
 # must NOT be treated as generated (e.g. a hand-authored SEO shell, or route
 # index.js shims kept at the harper-app root). The broadened root-level
@@ -90,34 +97,45 @@ NORMALIZED_FILE=$(normalize_path "$FILE_PATH")
 # line (same syntax as the globs file); blank lines and `#` comments ignored.
 # Prefer naming compiled resource modules `resource-*.ts` so their JS output is
 # unambiguously generated and never needs allowlisting.
-ALLOWLIST_FILE="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
-if [ -f "$ALLOWLIST_FILE" ]; then
-  while IFS= read -r allow || [ -n "$allow" ]; do
-    [ -n "$allow" ] || continue
-    case "$allow" in \#*) continue ;; esac
-    if matches_glob "$NORMALIZED_FILE" "$allow"; then
-      exit 0
-    fi
-  done <"$ALLOWLIST_FILE"
-fi
-
-while IFS= read -r glob || [ -n "$glob" ]; do
-  [ -n "$glob" ] || continue
-  case "$glob" in \#*) continue ;; esac
+check_file() {
+  local file_path="$1"
+  local normalized_file
+  normalized_file=$(normalize_path "$file_path")
+  local allowlist_file="${CLAUDE_PROJECT_DIR:-.}/.lisa/harper-generated-artifact-allowlist.txt"
+  if [ -f "$allowlist_file" ]; then
+    while IFS= read -r allow || [ -n "$allow" ]; do
+      [ -n "$allow" ] || continue
+      case "$allow" in \#*) continue ;; esac
+      if matches_glob "$normalized_file" "$allow"; then
+        return 0
+      fi
+    done <"$allowlist_file"
+  fi
 
-  if matches_glob "$NORMALIZED_FILE" "$glob"; then
-    cat >&2 <<MSG
+  while IFS= read -r glob || [ -n "$glob" ]; do
+    [ -n "$glob" ] || continue
+    case "$glob" in \#*) continue ;; esac
+    if matches_glob "$normalized_file" "$glob"; then
+      cat >&2 <<MSG
 Blocked: direct edit to generated Harper/Fabric artifact.
 
-File: $FILE_PATH
+File: $file_path
 Matched generated artifact pattern: $glob
 
 TypeScript under src/ is the source of truth for Harper resources, web assets,
 and shared libraries. Change the matching TypeScript source under src/ and run
 the project build to regenerate harper-app outputs.
 MSG
-    exit 2
-  fi
-done <"$GLOBS_FILE"
+      return 2
+    fi
+  done <"$GLOBS_FILE"
+}
+
+while IFS= read -r FILE_PATH; do
+  [ -n "$FILE_PATH" ] || continue
+  check_file "$FILE_PATH" || exit $?
+done <<EOF
+$FILE_PATHS
+EOF
 
 exit 0

package/plugins/src/harper-fabric/hooks/enforce-config-extensions.mjs

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
@@ -39,21 +38,20 @@ const repoRelativeConfigPath = filePath => {
   return index === -1 ? normalized : normalized.slice(index);
 };
 
-const loadYaml = () => {
-  const require = createRequire(import.meta.url);
-  return require("js-yaml");
-};
-
 const topLevelExtensionKeys = yamlText => {
-  const yaml = loadYaml();
-  let parsed;
-  try {
-    parsed = yaml.load(yamlText);
-  } catch {
-    return null;
+  const keys = [];
+  for (const line of yamlText.split(/\r?\n/)) {
+    if (/^\s*(?:#.*)?$/.test(line) || /^---\s*$/.test(line)) continue;
+    if (/^\s/.test(line)) continue;
+    if (line.startsWith("!!") || ["[", "]", "{", "}"].includes(line[0])) {
+      return null;
+    }
+    const match = line.match(/^(?:"([^"]+)"|'([^']+)'|([^:#][^:]*?)):\s*/);
+    if (!match) return null;
+    const key = match[1] ?? match[2] ?? match[3]?.trim();
+    if (key) keys.push(key);
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return [];
-  return Object.keys(parsed).sort();
+  return Array.from(new Set(keys)).sort();
 };
 
 const gitEnv = () =>

package/plugins/src/harper-fabric/hooks/enforce-config-extensions.sh

@@ -11,9 +11,36 @@ PLUGIN_ROOT=${CLAUDE_PLUGIN_ROOT:-}
 if [ -z "$PLUGIN_ROOT" ]; then
   PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_PATH="$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+if [ ! -f "$SCRIPT_PATH" ]; then
+  SCRIPT_PATH="$SCRIPT_DIR/enforce-config-extensions.mjs"
+fi
+
+JSON_INPUT=$(cat)
+
+run_check() {
+  if command -v bun >/dev/null 2>&1; then
+    printf '%s' "$1" | bun "$SCRIPT_PATH"
+  else
+    printf '%s' "$1" | node "$SCRIPT_PATH"
+  fi
+}
 
-if command -v bun >/dev/null 2>&1; then
-  exec bun "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+if [ -f "$SCRIPT_DIR/_extract-edit-paths.sh" ]; then
+  # shellcheck source=/dev/null
+  . "$SCRIPT_DIR/_extract-edit-paths.sh"
+  FILE_PATHS=$(lisa_extract_edit_paths "$JSON_INPUT")
+  if [ -n "$FILE_PATHS" ]; then
+    while IFS= read -r FILE_PATH; do
+      [ -n "$FILE_PATH" ] || continue
+      FILE_INPUT=$(printf '%s' "$JSON_INPUT" | jq --arg path "$FILE_PATH" '.tool_input.file_path = $path')
+      run_check "$FILE_INPUT" || exit $?
+    done <<EOF
+$FILE_PATHS
+EOF
+    exit 0
+  fi
 fi
 
-exec node "$PLUGIN_ROOT/hooks/enforce-config-extensions.mjs"
+run_check "$JSON_INPUT"

package/plugins/src/harper-fabric/hooks/inject-rules.sh

@@ -3,7 +3,7 @@
 # into Claude context at session/subagent start.
 set -euo pipefail
 
-ROOT="${CLAUDE_PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}}"
 RULES_DIR="$ROOT/rules"
 
 [ -d "$RULES_DIR" ] || exit 0

package/plugins/src/nestjs/skills/typeorm-patterns/references/configuration-patterns.md

@@ -398,11 +398,11 @@ export default new DataSource({
 
 ```bash
 # Database Configuration
-DATABASE_HOST=localhost
-DATABASE_PORT=5432
-DATABASE_USER=acme
-DATABASE_PASSWORD=acme_local
-DATABASE_NAME=acme
+DATABASE_HOST=
+DATABASE_PORT=
+DATABASE_USER=
+DATABASE_PASSWORD=
+DATABASE_NAME=
 DATABASE_SSL=false
 DATABASE_SSL_REJECT_UNAUTHORIZED=true
 

package/plugins/src/phaser/hooks/inject-rules.sh

@@ -3,7 +3,7 @@
 # into Claude context at session/subagent start.
 set -euo pipefail
 
-ROOT="${CLAUDE_PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-${CODEX_PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}}"
 RULES_DIR="$ROOT/rules"
 
 [ -d "$RULES_DIR" ] || exit 0

package/plugins/src/rails/hooks/inject-rules.sh

@@ -11,7 +11,8 @@ else
   HOOK_EVENT="SessionStart"
 fi
 
-RULES_DIR="${CLAUDE_PLUGIN_ROOT}/rules"
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+RULES_DIR="$ROOT/rules"
 
 # Bail silently if no rules directory
 [ -d "$RULES_DIR" ] || exit 0

package/scripts/clean-dist.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+/** Remove stale compiled output before TypeScript rebuilds `dist/`. */
+import { rm } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+
+const distDir = fileURLToPath(new URL("../dist", import.meta.url));
+await rm(distDir, { force: true, recursive: true });