@codyswann/lisa 2.225.0 → 2.225.2

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.225.0",
+  "version": "2.225.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-doctor/SKILL.md

@@ -307,31 +307,63 @@ pull Lisa's own git history and read what actually changed:
 
    ```bash
    gh api "repos/CodySwannGT/lisa/compare/v<installed>...v<latest>" \
-     --paginate --slurp \
-     --jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | .commit.message | split("\n")[0]]}'
+     --paginate --slurp |
+     jq '{total_commits: .[0].total_commits, files: [.[0].files[]?.filename], commits: [.[].commits[]? | {sha, subject: (.commit.message | split("\n")[0]), api_url: .url, html_url, parents: [.parents[]?.sha]}]}'
    ```
 
    `--paginate` fetches every page of commits, and `--slurp` gathers those pages into a single
-   array before `--jq` runs — without `--slurp`, `--jq` applies per page and prints one JSON object
-   per page instead of one merged result. `total_commits` and `files` only need the first page
-   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages.
+   array before the external `jq` projection runs. GitHub CLI does not permit its built-in `--jq`
+   flag together with `--slurp`, so keep the pipe as shown; without `--slurp`, paginated responses
+   are not one merged input. `total_commits` and `files` only need the first page
+   (files are capped at 300 and not repeated on later pages); `commits` flattens across all pages
+   while retaining each commit SHA and URLs needed for accurate follow-up.
+
+   After path-scoping identifies a candidate commit, fetch its targeted file-level diff context by
+   the retained SHA rather than attributing from the subject alone:
+
+   ```bash
+   gh api "repos/CodySwannGT/lisa/commits/<sha>" \
+     --jq '{sha, files: [.files[]? | select(.filename == "<relevant-path>" or (.filename | startswith("<relevant-prefix>/"))) | {filename, status, additions, deletions, changes, patch}]}'
+   ```
+
+   Preserve the returned filename, status, counts, and available patch with the SHA in the
+   upstream-history projection. A missing or truncated `patch` is not proof of no relevant change;
+   use the compare diff fallback below or downgrade attribution to `WARN` when commit-level context
+   cannot be established.
 
    The compare endpoint paginates commits (250 without `--paginate`) and only lists changed files
    on the first page, capped at 300 total — a large version window can silently drop commits or
    files. If `total_commits` or the file count looks truncated, re-run with the
    `application/vnd.github.diff` accept header (`gh api ... -H "Accept: application/vnd.github.diff"`)
-   to pull the full patch text, or fall back to the shallow-clone `git log` below. When completeness
+   to pull the full patch text, or fall back to the bounded-fetch `git log` below. When completeness
    still can't be established, say so in the finding and mark it `WARN` rather than attributing
    drift with unverified confidence.
 
    Fallbacks, in order: `gh api repos/CodySwannGT/lisa/commits?path=<template-path>` for a
    path-scoped view — note this endpoint has no way to bound results to the `v<installed>..v<latest>`
-   window, so treat its output as best-effort context only, not authoritative attribution; a shallow
-   clone (`git clone --filter=blob:none --no-checkout` then `git log v<installed>..v<latest> --
-   <paths>`), which *is* bounded to the window and should be preferred for definitive attribution; or
-   the local marketplace/plugin cache checkout when the runtime has one. If none are reachable, or
-   only the unbounded path-scoped fallback is reachable, report the gap as a `WARN`-level
-   observability note — never fail the audit because history was unavailable or incomplete.
+   window, so treat its output as best-effort context only, not authoritative attribution; a
+   finite-depth, explicit-tag fetch, which is bounded to the two version refs and should be preferred
+   for definitive attribution; or the local marketplace/plugin cache checkout when the runtime has
+   one. For the fetch fallback, use a temporary directory and a fixed history ceiling:
+
+   ```bash
+   lisa_history_dir="$(mktemp -d)"
+   git init "$lisa_history_dir"
+   git -C "$lisa_history_dir" remote add origin https://github.com/CodySwannGT/lisa.git
+   git -C "$lisa_history_dir" fetch --no-tags --filter=blob:none --depth=256 origin \
+     refs/tags/v<installed>:refs/tags/v<installed> \
+     refs/tags/v<latest>:refs/tags/v<latest>
+   git -C "$lisa_history_dir" merge-base --is-ancestor v<installed> v<latest>
+   git -C "$lisa_history_dir" log --format='%H%x09%s' v<installed>..v<latest> -- <paths>
+   git -C "$lisa_history_dir" show --format=fuller --stat --patch <relevant-sha> -- <paths>
+   ```
+
+   The explicit tag refspecs, `--no-tags`, and finite `--depth=256` make this fetch bounded. Do not
+   silently deepen beyond that ceiling. If `merge-base --is-ancestor` fails, the shallow window is
+   incomplete (or the tags are not on one ancestry line): do not make definitive attribution from
+   it. If none of the bounded sources are reachable, or only the unbounded path-scoped fallback is
+   reachable, report the gap as a `WARN`-level observability note — never fail the audit because
+   history was unavailable or incomplete.
 3. **Scope the reading to what the finding touches.** Filter the commit list to the paths that
    generate the failing surface: the detected stacks' template dirs (`typescript/`, `expo/`, …),
    `plugins/src/base/` for skills/hooks/rules, `scripts/` for governance scripts, and the shipped

package/plugins/src/base/skills/lisa-github-validate-issue/SKILL.md

@@ -366,13 +366,23 @@ reach every external surface the work requires. Enumerate the surfaces this issu
   alarms", "pull the copy from the Google Doc", "check the Sentry issues"),
 - tooling the work plainly implies (a deploy target, a database, a third-party API).
 
-For each surface, prove **read** access from the current runtime with the cheapest read-only probe
-through the sanctioned access layer: the matching MCP tool or `lisa-*-access` skill, CLI auth
-(`aws sts get-caller-identity`, `gh auth status`, vendor equivalents), or an authenticated fetch of
-the linked artifact. Attempt to resolve a gap before failing — an alternate substrate, a configured
-access layer, a keychain credential — mirroring the intake agent's discover-first duty.
-
-- `PASS` — every required surface is provably readable.
+For each surface, prove **read** access from the current runtime with a target-resource-specific,
+read-only probe through its sanctioned access layer: the matching MCP tool or `lisa-*-access` skill,
+or an authenticated fetch using environment-injected authentication. Identity-only commands such as
+`aws sts get-caller-identity`, `gh auth status`, and vendor equivalents are preflight checks only;
+they never satisfy F5 by themselves. A successful probe for one surface does not cover another:
+reading the named GitHub repository, CloudWatch log group, Sentry project, or linked document must
+each succeed separately when that surface is required.
+
+Attempt to resolve a gap before failing, but only through another configured brokered access layer
+or environment-injected authentication. A sanctioned broker may use its own credential store
+internally; the validator must never autonomously inspect, read, copy, print, or export raw
+credentials, keychains, credential files, or token stores, and must never invoke low-level secret
+tools to recover them. This preserves the intake agent's discover-first duty without exposing
+credential material.
+
+- `PASS` — every required surface has its own successful target-resource read probe or authenticated
+  fetch through the sanctioned access layer.
 - `N/A` — the issue needs nothing beyond the repository and the tracker itself.
 - `FAIL` — a required surface is unreachable after the resolution attempt. Name the exact surface
   and what was probed. Intake callers must route this to `blocked` + human escalation with the

package/plugins/src/base/skills/lisa-jira-validate-ticket/SKILL.md

@@ -297,13 +297,23 @@ reach every external surface the work requires. Enumerate the surfaces this item
   alarms", "pull the copy from the Google Doc", "check the Sentry issues"),
 - tooling the work plainly implies (a deploy target, a database, a third-party API).
 
-For each surface, prove **read** access from the current runtime with the cheapest read-only probe
-through the sanctioned access layer: the matching MCP tool or `lisa-*-access` skill, CLI auth
-(`aws sts get-caller-identity`, `gh auth status`, vendor equivalents), or an authenticated fetch of
-the linked artifact. Attempt to resolve a gap before failing — an alternate substrate, a configured
-access layer, a keychain credential — mirroring the intake agent's discover-first duty.
-
-- `PASS` — every required surface is provably readable.
+For each surface, prove **read** access from the current runtime with a target-resource-specific,
+read-only probe through its sanctioned access layer: the matching MCP tool or `lisa-*-access` skill,
+or an authenticated fetch using environment-injected authentication. Identity-only commands such as
+`aws sts get-caller-identity`, `gh auth status`, and vendor equivalents are preflight checks only;
+they never satisfy F5 by themselves. A successful probe for one surface does not cover another:
+reading the named GitHub repository, CloudWatch log group, Sentry project, or linked document must
+each succeed separately when that surface is required.
+
+Attempt to resolve a gap before failing, but only through another configured brokered access layer
+or environment-injected authentication. A sanctioned broker may use its own credential store
+internally; the validator must never autonomously inspect, read, copy, print, or export raw
+credentials, keychains, credential files, or token stores, and must never invoke low-level secret
+tools to recover them. This preserves the intake agent's discover-first duty without exposing
+credential material.
+
+- `PASS` — every required surface has its own successful target-resource read probe or authenticated
+  fetch through the sanctioned access layer.
 - `N/A` — the item needs nothing beyond the repository and the tracker itself.
 - `FAIL` — a required surface is unreachable after the resolution attempt. Name the exact surface
   and what was probed. Intake callers must route this to `blocked` + human escalation with the

package/plugins/src/base/skills/lisa-linear-validate-issue/SKILL.md

@@ -303,13 +303,23 @@ reach every external surface the work requires. Enumerate the surfaces this item
   alarms", "pull the copy from the Google Doc", "check the Sentry issues"),
 - tooling the work plainly implies (a deploy target, a database, a third-party API).
 
-For each surface, prove **read** access from the current runtime with the cheapest read-only probe
-through the sanctioned access layer: the matching MCP tool or `lisa-*-access` skill, CLI auth
-(`aws sts get-caller-identity`, `gh auth status`, vendor equivalents), or an authenticated fetch of
-the linked artifact. Attempt to resolve a gap before failing — an alternate substrate, a configured
-access layer, a keychain credential — mirroring the intake agent's discover-first duty.
-
-- `PASS` — every required surface is provably readable.
+For each surface, prove **read** access from the current runtime with a target-resource-specific,
+read-only probe through its sanctioned access layer: the matching MCP tool or `lisa-*-access` skill,
+or an authenticated fetch using environment-injected authentication. Identity-only commands such as
+`aws sts get-caller-identity`, `gh auth status`, and vendor equivalents are preflight checks only;
+they never satisfy F5 by themselves. A successful probe for one surface does not cover another:
+reading the named GitHub repository, CloudWatch log group, Sentry project, or linked document must
+each succeed separately when that surface is required.
+
+Attempt to resolve a gap before failing, but only through another configured brokered access layer
+or environment-injected authentication. A sanctioned broker may use its own credential store
+internally; the validator must never autonomously inspect, read, copy, print, or export raw
+credentials, keychains, credential files, or token stores, and must never invoke low-level secret
+tools to recover them. This preserves the intake agent's discover-first duty without exposing
+credential material.
+
+- `PASS` — every required surface has its own successful target-resource read probe or authenticated
+  fetch through the sanctioned access layer.
 - `N/A` — the item needs nothing beyond the repository and the tracker itself.
 - `FAIL` — a required surface is unreachable after the resolution attempt. Name the exact surface
   and what was probed. Intake callers must route this to `blocked` + human escalation with the

package/typescript/copy-overwrite/.github/GITHUB_ACTIONS.md

@@ -601,15 +601,14 @@ Enable compliance validation:
 uses: ./.github/workflows/quality.yml
 with:
   compliance_framework: 'soc2'  # or iso27001, hipaa, pci-dss
-  require_approval: true
-  approval_environment: 'production'
 ```
 
-**Note**: Create the environment in **Settings** > **Environments** first (or
-declare it under `github.environments` in `.lisa.config.json` and run
-`/lisa:setup:github-repo`). Unlike release.yml's environment-enforced gate,
-quality.yml's `approval_gate` job only records an audit artifact — it does not
-pause the run. For an enforced human gate, use release.yml's `require_approval`.
+**Note**: quality.yml's `approval_gate` job only records an audit artifact; it
+does not pause the run. Do not pass `require_approval` or `approval_environment`
+to this quality.yml example. For an enforced human gate, pass those inputs to
+release.yml and create the environment in **Settings** > **Environments** first
+(or declare it under `github.environments` in `.lisa.config.json` and run
+`/lisa:setup:github-repo`).
 
 ### Custom Node Version