@codyswann/lisa 2.312.0 → 2.313.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/core/upstream-evidence-manifest.js +1 -1
- package/package.json +1 -1
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/ui/index.html +74 -1
|
@@ -1050,7 +1050,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
|
|
|
1050
1050
|
"typescript/merge/.oxlintrc.json": "4debc093acfd263eb81ae15894073ebf098513204f45f40b83fb8fa5353fa1f8",
|
|
1051
1051
|
"typescript/package-lisa/package.lisa.json": "783e2a0a8d7463f4b32a68dae480f051b1814aa404fcbe10c713468d51727568",
|
|
1052
1052
|
"ui/README.md": "deeb35e767ea5dd2883268835ea3ad21cbad9fa63ec8d8ff5e200f0e2a7d2751",
|
|
1053
|
-
"ui/index.html": "
|
|
1053
|
+
"ui/index.html": "400088617ed6f16b4e52da5bfa81242d75cb09bc3ad6929eadb9f06e5365b4b6",
|
|
1054
1054
|
});
|
|
1055
1055
|
/** Exact paths tracked by the public Lisa repository at generation time. */
|
|
1056
1056
|
export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
|
package/package.json
CHANGED
|
@@ -115,7 +115,7 @@
|
|
|
115
115
|
"brace-expansion": ">=5.0.8"
|
|
116
116
|
},
|
|
117
117
|
"name": "@codyswann/lisa",
|
|
118
|
-
"version": "2.
|
|
118
|
+
"version": "2.313.1",
|
|
119
119
|
"description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
|
|
120
120
|
"main": "dist/index.js",
|
|
121
121
|
"exports": {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.313.1",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.313.1",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.313.1",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.313.1",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.313.1",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
package/ui/index.html
CHANGED
|
@@ -5688,6 +5688,25 @@
|
|
|
5688
5688
|
],
|
|
5689
5689
|
viaValue: "license-checker",
|
|
5690
5690
|
},
|
|
5691
|
+
{
|
|
5692
|
+
q: "What catches licensed or proprietary code reproduced directly into your source?",
|
|
5693
|
+
help: "TASC SI10. The allowlist above governs declared dependencies — code a model reproduces from memory, or an agent copies out of a repository it fetched while researching, carries no lockfile entry and no SBOM line, so every scanner above is blind to it. This gate detects verbatim and near-verbatim reuse and holds the merge until the source's license is identified and its obligations discharged. Attribution survives inlining: a permissive license on the allowlist is a permission with conditions, not an absence of them, and a notice file assembled by hand is a control nobody has measured.",
|
|
5694
|
+
kind: "select",
|
|
5695
|
+
options: [
|
|
5696
|
+
"Similarity gate on changed code, with attribution notices generated mechanically",
|
|
5697
|
+
"Similarity scanning, attribution handled by hand",
|
|
5698
|
+
"We rely on the model vendor's filter",
|
|
5699
|
+
"Nothing — review would have to notice",
|
|
5700
|
+
],
|
|
5701
|
+
via: [
|
|
5702
|
+
"SCANOSS",
|
|
5703
|
+
"FOSSA",
|
|
5704
|
+
"Black Duck",
|
|
5705
|
+
"ScanCode",
|
|
5706
|
+
"Vendor-side filter",
|
|
5707
|
+
"None",
|
|
5708
|
+
],
|
|
5709
|
+
},
|
|
5691
5710
|
],
|
|
5692
5711
|
},
|
|
5693
5712
|
{
|
|
@@ -5725,6 +5744,24 @@
|
|
|
5725
5744
|
"Anything",
|
|
5726
5745
|
],
|
|
5727
5746
|
},
|
|
5747
|
+
{
|
|
5748
|
+
q: "Which codebases may an agent draw from — and what stops one client's source reaching another's?",
|
|
5749
|
+
help: "TASC SI10. Reading the web is an injection surface; reading source is a licensing and confidentiality one. The permissible-source boundary — which repositories, corpora and engagement contexts an agent may draw from — has to be enforced by mechanism rather than instruction, because an instruction not to reuse another client's code is a rule with an unmeasured breach rate (AC5.7). Persisted memory and learnings carry source across that boundary exactly as context does, and the harm here is contractual rather than reputational.",
|
|
5750
|
+
kind: "select",
|
|
5751
|
+
options: [
|
|
5752
|
+
"Declared boundary, enforced mechanically, sources recorded per change",
|
|
5753
|
+
"Declared boundary, enforced by instruction",
|
|
5754
|
+
"Isolation is per-repo by convention",
|
|
5755
|
+
"No declared boundary",
|
|
5756
|
+
],
|
|
5757
|
+
via: [
|
|
5758
|
+
"Per-engagement workspace isolation",
|
|
5759
|
+
"Sandbox / container scoping",
|
|
5760
|
+
"Repository allowlist",
|
|
5761
|
+
"Context provenance log",
|
|
5762
|
+
"None",
|
|
5763
|
+
],
|
|
5764
|
+
},
|
|
5728
5765
|
{
|
|
5729
5766
|
q: "Can an agent add a new dependency unreviewed?",
|
|
5730
5767
|
help: "Models hallucinate plausible package names and attackers register them (slopsquatting), alongside classic typosquats. An agent that can install unreviewed is the softest supply-chain target there is.",
|
|
@@ -5966,7 +6003,7 @@
|
|
|
5966
6003
|
],
|
|
5967
6004
|
},
|
|
5968
6005
|
{
|
|
5969
|
-
label: "Review & merge (AC8.1 · AC5 · AC5.7 · AC8.8)",
|
|
6006
|
+
label: "Review & merge (AC8.1 · AC5 · AC5.7–AC5.9 · AC8.8)",
|
|
5970
6007
|
items: [
|
|
5971
6008
|
{
|
|
5972
6009
|
q: "What reviews every diff before merge?",
|
|
@@ -6052,6 +6089,42 @@
|
|
|
6052
6089
|
"We assume the instructions are followed",
|
|
6053
6090
|
],
|
|
6054
6091
|
},
|
|
6092
|
+
{
|
|
6093
|
+
q: "Where do your control obligations live — and do the gates come from there?",
|
|
6094
|
+
help: "TASC AC5.8. A rule transcribed into a CI config, a lint rule and an instruction file has three sources of truth and therefore none, and nothing can detect drift between them. Each obligation should be one versioned, machine-readable artifact naming its enforcement tier and the independent mechanism that measures it — a coverage floor that doesn't say which system computes coverage has declared an intention, not a control — with every enforcement point and every agent-facing rendering generated from it.",
|
|
6095
|
+
kind: "select",
|
|
6096
|
+
options: [
|
|
6097
|
+
"Declared as machine-readable artifacts, with enforcement points and agent context generated from them",
|
|
6098
|
+
"Machine-readable, but each enforcement point is configured separately",
|
|
6099
|
+
"Written as prose policy documents",
|
|
6100
|
+
"Only as whatever each tool happens to be configured to do",
|
|
6101
|
+
],
|
|
6102
|
+
via: [
|
|
6103
|
+
"Policy-as-code in the repo",
|
|
6104
|
+
"OPA / Rego",
|
|
6105
|
+
"Generated CI configuration",
|
|
6106
|
+
"In-house policy engine",
|
|
6107
|
+
"None",
|
|
6108
|
+
],
|
|
6109
|
+
},
|
|
6110
|
+
{
|
|
6111
|
+
q: "Can you enumerate every control, where it is enforced, and when it last fired?",
|
|
6112
|
+
help: "TASC AC5.9 — the first question an attestor asks, and the one a factory with its control configuration scattered across a pipeline cannot answer. The register carries each obligation's enforcement tier, its measuring mechanism, its last exercised evidence and freshness, measured adherence for the advisory ones, and who answers for it. It has to reconcile both ways against the running system: an obligation with no enforcement point and an enforcement point with no declared obligation are each findings. Unreconciled, a register records what you believe you enforce, and the gap from what you actually enforce is invisible in the direction that matters.",
|
|
6113
|
+
kind: "select",
|
|
6114
|
+
options: [
|
|
6115
|
+
"Live register, reconciled both ways against the running system",
|
|
6116
|
+
"A register exists, maintained by hand",
|
|
6117
|
+
"It's spread across CI config, branch rules and instruction files",
|
|
6118
|
+
"No — we would have to go and look",
|
|
6119
|
+
],
|
|
6120
|
+
via: [
|
|
6121
|
+
"Generated from policy-as-code",
|
|
6122
|
+
"Compliance platform",
|
|
6123
|
+
"In-house control dashboard",
|
|
6124
|
+
"Spreadsheet",
|
|
6125
|
+
"None",
|
|
6126
|
+
],
|
|
6127
|
+
},
|
|
6055
6128
|
{
|
|
6056
6129
|
q: "Is autonomy the same everywhere, or tiered by risk?",
|
|
6057
6130
|
help: "TASC AC8.8 — organizations running agent-authored code at scale tier the codebase and decide per tier what agents may do unattended, with whole codebases kept under mandatory human approval. Uniform autonomy is a decision nobody made: a tier no one chose is a tier no one is accountable for.",
|