@codyswann/lisa 2.316.2 → 2.317.0

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/toolchain.mjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+/**
+ * Decide what a remote environment already has and what it still needs.
+ *
+ * Remote environments arrive with a base image that already provides much of
+ * what a project needs, so the manifest has two entry kinds rather than one:
+ *
+ *   require — assert present, fail setup with a clear message if missing
+ *   install — provision it, pinned and checksummed
+ *
+ * The distinction is not bookkeeping. A base image is **not a contract**: the
+ * vendor can change it. A project quietly depending on a preinstalled tool
+ * should break loudly at setup when that happens, rather than mysteriously
+ * mid-task weeks later. `require` is what converts an implicit assumption into
+ * an explicit check.
+ *
+ * Planning is separated from execution so the whole decision table is testable
+ * without a container, a network, or a real binary anywhere.
+ * @module toolchain
+ */
+
+/**
+ * Compare dotted version strings numerically.
+ *
+ * String comparison gets this wrong in the case that matters: "10" sorts before
+ * "9", so a base-image bump to a newer major would read as a downgrade and pass
+ * a minimum-version check it should fail.
+ * @param {string} a Left version.
+ * @param {string} b Right version.
+ * @returns {number} Negative, zero, or positive.
+ */
+export function compareVersions(a, b) {
+  const left = String(a).split(".").map(Number);
+  const right = String(b).split(".").map(Number);
+  for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+    const diff = (left[i] || 0) - (right[i] || 0);
+    if (diff) return diff;
+  }
+  return 0;
+}
+
+/**
+ * Pull a dotted version out of whatever a tool prints for `--version`.
+ *
+ * Tools are wildly inconsistent here ("bws 2.1.0", "v20.11.0", "Python 3.12.1"),
+ * and normalising with a regex is more honest than maintaining a per-tool parser
+ * table that silently rots.
+ * @param {string} output Raw `--version` output.
+ * @returns {string|null} The version, or null when none is recognisable.
+ */
+export function extractVersion(output) {
+  const match = /(\d+(?:\.\d+)*)/.exec(String(output ?? ""));
+  return match ? match[1] : null;
+}
+
+/**
+ * Classify one required tool against what the environment actually provides.
+ * @param {object} tool Manifest entry.
+ * @param {{version: string|null, present: boolean}} found Probe result.
+ * @returns {{name: string, action: string, reason: string}} The decision.
+ */
+function planRequired(tool, found) {
+  if (!found.present) {
+    return {
+      name: tool.name,
+      action: "missing",
+      reason:
+        `${tool.name} is required but not present. The base image is not a ` +
+        `contract — if it used to provide this, the vendor has changed it. ` +
+        `Either add an install entry or pin a different image.`,
+    };
+  }
+  if (
+    tool.minVersion &&
+    compareVersions(found.version ?? "0", tool.minVersion) < 0
+  ) {
+    return {
+      name: tool.name,
+      action: "missing",
+      reason:
+        `${tool.name} ${found.version ?? "(unknown)"} is older than the ` +
+        `required ${tool.minVersion}. Presence alone is not enough when a ` +
+        `project depends on a specific version.`,
+    };
+  }
+  return {
+    name: tool.name,
+    action: "present",
+    reason: `${tool.name} ${found.version ?? ""}`.trim(),
+  };
+}
+
+/**
+ * Classify one installable tool against what is already on disk.
+ *
+ * Detect first, install second. Skipping a matching version is what makes setup
+ * and maintenance the same script, and it is the cheap path when a container
+ * resumes from cache rather than being built fresh.
+ * @param {object} tool Manifest entry.
+ * @param {{version: string|null, present: boolean}} found Probe result.
+ * @returns {{name: string, action: string, reason: string}} The decision.
+ */
+function planInstallable(tool, found) {
+  if (!tool.version) {
+    return {
+      name: tool.name,
+      action: "invalid",
+      reason: `${tool.name} has no pinned version. An unpinned install is not reproducible.`,
+    };
+  }
+  if (found.present && found.version === tool.version) {
+    return {
+      name: tool.name,
+      action: "skip",
+      reason: `${tool.name} ${tool.version} already installed`,
+    };
+  }
+  return {
+    name: tool.name,
+    action: "install",
+    reason: found.present
+      ? `${tool.name} ${found.version ?? "(unknown)"} does not match pin ${tool.version}`
+      : `${tool.name} ${tool.version} not installed`,
+  };
+}
+
+/**
+ * Produce the complete plan for a toolchain manifest.
+ * @param {{require?: object[], install?: object[]}} tools Manifest.
+ * @param {(name: string) => {version: string|null, present: boolean}} probe Version probe.
+ * @returns {Array<{name: string, action: string, reason: string}>} Ordered decisions.
+ */
+export function planToolchain(tools, probe) {
+  const plan = [];
+  for (const tool of tools.require ?? [])
+    plan.push(planRequired(tool, probe(tool.name)));
+  for (const tool of tools.install ?? [])
+    plan.push(planInstallable(tool, probe(tool.name)));
+  return plan;
+}
+
+/**
+ * Reject a manifest entry that could install something unverifiable.
+ *
+ * A pinned version with no checksum still trusts whatever the URL serves today.
+ * Requiring both, changed together in one reviewed commit, is what makes an
+ * unexpected archive fail before installation rather than after.
+ * @param {object} tool Manifest entry.
+ */
+export function assertPinned(tool) {
+  if (tool.install === "release-zip") {
+    if (!tool.url || !tool.sha256) {
+      throw new Error(
+        `${tool.name}: a release-zip install needs both url and sha256.\n` +
+          `A version bump must move the checksum in the same reviewed commit.`
+      );
+    }
+    return;
+  }
+  if (tool.install === "npm-global") {
+    if (!tool.package)
+      throw new Error(`${tool.name}: npm-global install needs a package`);
+    return;
+  }
+  throw new Error(
+    `${tool.name}: unknown install method "${tool.install}".\n` +
+      `Supported: release-zip, npm-global.`
+  );
+}

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+/**
+ * Prove a remote environment is actually configured the way it was meant to be.
+ *
+ * This runs identically whatever provisioned the environment — an API, a driven
+ * browser, or a human pasting emitted config. That is the point: trust comes
+ * from the read-back, not from the mechanism, so the weakest provisioning tier
+ * ends up as trustworthy as the strongest.
+ *
+ * Every assertion is made **without printing a value**. Presence, mode, and
+ * shape are all checkable without revealing content, and an environment proof
+ * that leaks the thing it is proving is not a proof worth having.
+ *
+ * One rule this encodes the hard way: never verify against a vendor's own UI.
+ * A dashboard counter reported zero tasks for an environment that had
+ * demonstrably completed one, because the underlying records carried no
+ * environment identifier. Assert against durable state instead.
+ *
+ * Usage:
+ *   verify-remote-env.mjs
+ * @module verify-remote-env
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, statSync } from "node:fs";
+
+import { readRemoteEnvConfig } from "./setup-remote-env.mjs";
+import { extractVersion } from "./toolchain.mjs";
+
+/** Collected results, so every check runs before anything reports failure. */
+const results = [];
+
+/**
+ * Record one assertion.
+ * @param {boolean} ok Whether it held.
+ * @param {string} label What was checked.
+ * @param {string} [detail] Extra context, never a secret value.
+ */
+function check(ok, label, detail = "") {
+  results.push({ ok, label, detail });
+}
+
+/**
+ * Assert a path exists with an exact permission mode.
+ *
+ * The mode is the assertion, not merely existence. A world-readable secrets
+ * file is present and wrong, and "present" is what a weaker check would report.
+ * @param {string} path Filesystem path.
+ * @param {number} mode Expected permission bits.
+ * @param {string} label What this path is.
+ */
+function checkMode(path, mode, label) {
+  if (!existsSync(path)) {
+    check(false, label, "absent");
+    return;
+  }
+  const actual = statSync(path).mode & 0o777;
+  check(
+    actual === mode,
+    label,
+    actual === mode
+      ? `mode ${mode.toString(8)}`
+      : `mode ${actual.toString(8)}, expected ${mode.toString(8)}`
+  );
+}
+
+/**
+ * Run a sibling skill's script and capture its output.
+ * @param {string[]} args Node arguments.
+ * @returns {{ok: boolean, out: string}} Result.
+ */
+function node(args) {
+  try {
+    const out = execFileSync("node", args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { ok: true, out: out.trim() };
+  } catch (err) {
+    return { ok: false, out: String(err.stderr ?? err.message).trim() };
+  }
+}
+
+/**
+ * Assert each declared tool is present at its pinned or minimum version.
+ * @param {object} tools Toolchain manifest.
+ */
+function verifyToolchain(tools) {
+  for (const tool of tools.require ?? []) {
+    try {
+      const out = execFileSync(tool.name, ["--version"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      });
+      check(true, `tool ${tool.name}`, extractVersion(out) ?? "present");
+    } catch {
+      check(false, `tool ${tool.name}`, "required but not present");
+    }
+  }
+  for (const tool of tools.install ?? []) {
+    try {
+      const out = execFileSync(tool.name, ["--version"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      });
+      const found = extractVersion(out);
+      check(
+        found === tool.version,
+        `tool ${tool.name}`,
+        `${found} (pin ${tool.version})`
+      );
+    } catch {
+      check(
+        false,
+        `tool ${tool.name}`,
+        `pinned ${tool.version} but not installed`
+      );
+    }
+  }
+}
+
+/**
+ * Assert the working tree is clean.
+ *
+ * A remote environment that starts dirty will carry unrelated changes into
+ * whatever it produces, and the resulting diff is no longer attributable to the
+ * task that ran.
+ */
+function verifyCleanCheckout() {
+  try {
+    const out = execFileSync("git", ["status", "--porcelain"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    check(
+      out.trim() === "",
+      "clean checkout",
+      out.trim() ? "working tree is dirty" : ""
+    );
+  } catch {
+    check(false, "clean checkout", "not a git repository");
+  }
+}
+
+function main() {
+  const cfg = readRemoteEnvConfig();
+  const secretsDir = process.argv[2];
+
+  verifyToolchain(cfg.tools);
+
+  const surface = node([
+    new URL(
+      "../../lisa-secrets-access/scripts/resolve-secret.mjs",
+      import.meta.url
+    ).pathname,
+    "surface",
+  ]);
+  check(surface.ok, "surface detected", surface.out);
+
+  if (secretsDir) {
+    checkMode(secretsDir, 0o700, "secrets directory");
+    checkMode(`${secretsDir}/secrets.env`, 0o600, "values file");
+    checkMode(`${secretsDir}/secret-notes.json`, 0o600, "notes file");
+  }
+
+  verifyCleanCheckout();
+
+  let failed = 0;
+  for (const r of results) {
+    if (!r.ok) failed += 1;
+    console.log(
+      `  ${r.ok ? "ok  " : "FAIL"} ${r.label.padEnd(28)} ${r.detail}`
+    );
+  }
+  if (failed) throw new Error(`${failed} environment check(s) failed`);
+  console.log("\nRemote environment verified without revealing any value.");
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    main();
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+}

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.316.2",
+  "version": "2.317.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"