@codyswann/lisa 2.323.0 → 2.324.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/all/copy-overwrite/scripts/lisa-work-item.mjs +154 -15
- package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
- package/dist/core/upstream-evidence-manifest.js +13 -7
- package/dist/core/upstream-evidence-manifest.js.map +1 -1
- package/dist/strategies/package-lisa.d.ts.map +1 -1
- package/dist/strategies/package-lisa.js +67 -2
- package/dist/strategies/package-lisa.js.map +1 -1
- package/package.json +1 -1
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/lisa/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/lisa/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/lisa-agy/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/src/base/skills/lisa-setup-remote-env/SKILL.md +24 -0
- package/plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
- package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
- package/plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
- package/scripts/lisa-enforcement-fallback.sh +57 -0
- package/scripts/lisa-remote-env/session-start.sh +17 -0
- package/scripts/lisa-work-item.mjs +8 -1
|
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
|
|
|
148
148
|
* @param {object} tool Manifest entry.
|
|
149
149
|
*/
|
|
150
150
|
export function assertPinned(tool) {
|
|
151
|
-
|
|
151
|
+
// Both archive kinds carry the same obligation, and differ only in how they
|
|
152
|
+
// are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
|
|
153
|
+
// .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
|
|
154
|
+
// Lisa's own guardrails shell out to.
|
|
155
|
+
if (tool.install === "release-zip" || tool.install === "release-tar") {
|
|
152
156
|
if (!tool.url || !tool.sha256) {
|
|
153
157
|
throw new Error(
|
|
154
|
-
`${tool.name}: a
|
|
158
|
+
`${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
|
|
155
159
|
`A version bump must move the checksum in the same reviewed commit.`
|
|
156
160
|
);
|
|
157
161
|
}
|
|
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
|
|
|
164
168
|
}
|
|
165
169
|
throw new Error(
|
|
166
170
|
`${tool.name}: unknown install method "${tool.install}".\n` +
|
|
167
|
-
`Supported: release-zip, npm-global.`
|
|
171
|
+
`Supported: release-zip, release-tar, npm-global.`
|
|
168
172
|
);
|
|
169
173
|
}
|
|
@@ -107,6 +107,14 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
|
|
|
107
107
|
"url": "https://<vendor>/releases/download/bws-v2.1.0/bws-<platform>-2.1.0.zip",
|
|
108
108
|
"sha256": "<sha256 published with that exact release>"
|
|
109
109
|
},
|
|
110
|
+
{
|
|
111
|
+
"name": "gh",
|
|
112
|
+
"version": "2.83.0",
|
|
113
|
+
"install": "release-tar",
|
|
114
|
+
"url": "https://<vendor>/releases/download/v2.83.0/gh_2.83.0_linux_amd64.tar.gz",
|
|
115
|
+
"sha256": "<sha256 published with that exact release>",
|
|
116
|
+
"binary": "gh_2.83.0_linux_amd64/bin/gh"
|
|
117
|
+
},
|
|
110
118
|
{
|
|
111
119
|
"name": "codex",
|
|
112
120
|
"version": "0.144.6",
|
|
@@ -133,6 +141,22 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
|
|
|
133
141
|
|
|
134
142
|
Expected shape for most projects: a short `require` list, an empty or near-empty `install` list, and the provider CLI as the only thing always provisioned.
|
|
135
143
|
|
|
144
|
+
### The three `install` methods
|
|
145
|
+
|
|
146
|
+
| `install` | Required fields | Use it when |
|
|
147
|
+
| --- | --- | --- |
|
|
148
|
+
| `release-zip` | `url` **and** `sha256` | The vendor publishes a Linux zip of the release. |
|
|
149
|
+
| `release-tar` | `url` **and** `sha256` — plus `binary` in practice | The vendor publishes no zip for Linux, only a `.tar.gz`. |
|
|
150
|
+
| `npm-global` | `package` | The tool ships on the npm registry. |
|
|
151
|
+
|
|
152
|
+
Anything else is rejected by name at plan time, so a typo fails loudly rather than silently installing nothing.
|
|
153
|
+
|
|
154
|
+
Both archive kinds carry the **same** obligation and differ only in how they are unpacked: `url` and `sha256` are both mandatory, the checksum is verified *before* the archive is unpacked, and a version bump must move the checksum in the same reviewed commit. Neither is a weaker path than the other — `release-tar` exists because some tools worth pinning simply do not publish a zip. `gh` is the case that forced it: it ships `.deb`, `.rpm` and `.tar.gz` and nothing else, so a zip-only installer could not pin the CLI that Lisa's own commit guardrails shell out to.
|
|
155
|
+
|
|
156
|
+
**`binary` means something different for a tarball.** It defaults to the tool's `name` and is resolved relative to the unpacked directory. Release tarballs almost always nest their contents under a versioned top-level directory, so for `release-tar` it must be the path *within* the archive — `gh_2.83.0_linux_amd64/bin/gh`, not `gh`. A bare name there resolves to nothing after a download that otherwise succeeded, and the install fails at the copy step rather than at the fetch, which reads as a broken release when it is a manifest mistake. Bump the version and this path moves with it, alongside the `url` and the `sha256`.
|
|
157
|
+
|
|
158
|
+
Because `release-tar` unpacks with `tar` rather than `unzip`, a project using it should assert `tar` in its `require` list the same way a zip-installing project asserts `unzip` — the base image providing it is an assumption, not a contract.
|
|
159
|
+
|
|
136
160
|
### Rules
|
|
137
161
|
|
|
138
162
|
- **The base image is not a contract.** A vendor can change it. A project quietly depending on a preinstalled `jq` should break loudly at setup when that happens, not mysteriously mid-task weeks later. `require` is what converts an implicit assumption into an explicit check.
|
|
@@ -27,4 +27,21 @@ if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
|
|
|
27
27
|
fi
|
|
28
28
|
|
|
29
29
|
here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
|
|
30
|
+
|
|
31
|
+
# The toolchain first, for the same reason the secrets are here at all.
|
|
32
|
+
#
|
|
33
|
+
# It used to run only from the environment setup script, which a cached
|
|
34
|
+
# environment skips — so a tool added to remoteEnv.tools was invisible until the
|
|
35
|
+
# cache expired about a week later, or until someone edited the vendor's setup
|
|
36
|
+
# field to force a rebuild. Neither is a thing a project can rely on, and the
|
|
37
|
+
# symptom is a container missing a tool its own committed config pins.
|
|
38
|
+
#
|
|
39
|
+
# It is cheap to repeat: the plan probes each tool and installs only what is
|
|
40
|
+
# absent or below its pinned version, so on a warm container this is a handful
|
|
41
|
+
# of --version calls and nothing else.
|
|
42
|
+
#
|
|
43
|
+
# Before secrets, because materializing needs the provider CLI that this step
|
|
44
|
+
# installs. A failure here is fatal for the same reason: continuing would report
|
|
45
|
+
# a missing credential when the real fault was a missing binary.
|
|
46
|
+
bash "${here}/setup.sh" --phase=toolchain "$@"
|
|
30
47
|
exec bash "${here}/setup.sh" --phase=secrets "$@"
|
|
@@ -153,6 +153,42 @@ function installReleaseZip(tool, binDir) {
|
|
|
153
153
|
}
|
|
154
154
|
}
|
|
155
155
|
|
|
156
|
+
/**
|
|
157
|
+
* Install a pinned tarball, refusing anything whose checksum does not match.
|
|
158
|
+
*
|
|
159
|
+
* Same contract as the zip path and the same ordering — verify, then unpack —
|
|
160
|
+
* because an unexpected archive must fail before any of its contents reach a
|
|
161
|
+
* directory that is on PATH. It exists because several tools worth pinning
|
|
162
|
+
* publish no zip for Linux: gh ships .deb, .rpm and .tar.gz and nothing else.
|
|
163
|
+
* @param {object} tool Manifest entry.
|
|
164
|
+
* @param {string} binDir Directory to install into.
|
|
165
|
+
*/
|
|
166
|
+
function installReleaseTar(tool, binDir) {
|
|
167
|
+
const temporary = join(binDir, `.${tool.name}-download`);
|
|
168
|
+
mkdirSync(temporary, { recursive: true });
|
|
169
|
+
try {
|
|
170
|
+
const archive = join(temporary, "download.tar.gz");
|
|
171
|
+
execFileSync("curl", ["-fsSL", tool.url, "-o", archive], {
|
|
172
|
+
stdio: "inherit",
|
|
173
|
+
});
|
|
174
|
+
execFileSync("sha256sum", ["-c", "-"], {
|
|
175
|
+
input: `${tool.sha256} ${archive}\n`,
|
|
176
|
+
stdio: ["pipe", "ignore", "inherit"],
|
|
177
|
+
});
|
|
178
|
+
execFileSync("tar", ["-xzf", archive, "-C", temporary], {
|
|
179
|
+
stdio: "inherit",
|
|
180
|
+
});
|
|
181
|
+
// Release tarballs usually nest under a versioned directory, so `binary` is
|
|
182
|
+
// a path within the archive rather than a bare name.
|
|
183
|
+
const binary = join(temporary, tool.binary ?? tool.name);
|
|
184
|
+
execFileSync("install", ["-m", "0755", binary, join(binDir, tool.name)], {
|
|
185
|
+
stdio: "inherit",
|
|
186
|
+
});
|
|
187
|
+
} finally {
|
|
188
|
+
rmSync(temporary, { recursive: true, force: true });
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
|
|
156
192
|
/**
|
|
157
193
|
* Install a pinned global npm package.
|
|
158
194
|
* @param {object} tool Manifest entry.
|
|
@@ -175,6 +211,7 @@ function installNpmGlobal(tool) {
|
|
|
175
211
|
function installTool(tool, binDir) {
|
|
176
212
|
assertPinned(tool);
|
|
177
213
|
if (tool.install === "release-zip") installReleaseZip(tool, binDir);
|
|
214
|
+
else if (tool.install === "release-tar") installReleaseTar(tool, binDir);
|
|
178
215
|
else installNpmGlobal(tool);
|
|
179
216
|
}
|
|
180
217
|
|
|
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
|
|
|
148
148
|
* @param {object} tool Manifest entry.
|
|
149
149
|
*/
|
|
150
150
|
export function assertPinned(tool) {
|
|
151
|
-
|
|
151
|
+
// Both archive kinds carry the same obligation, and differ only in how they
|
|
152
|
+
// are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
|
|
153
|
+
// .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
|
|
154
|
+
// Lisa's own guardrails shell out to.
|
|
155
|
+
if (tool.install === "release-zip" || tool.install === "release-tar") {
|
|
152
156
|
if (!tool.url || !tool.sha256) {
|
|
153
157
|
throw new Error(
|
|
154
|
-
`${tool.name}: a
|
|
158
|
+
`${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
|
|
155
159
|
`A version bump must move the checksum in the same reviewed commit.`
|
|
156
160
|
);
|
|
157
161
|
}
|
|
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
|
|
|
164
168
|
}
|
|
165
169
|
throw new Error(
|
|
166
170
|
`${tool.name}: unknown install method "${tool.install}".\n` +
|
|
167
|
-
`Supported: release-zip, npm-global.`
|
|
171
|
+
`Supported: release-zip, release-tar, npm-global.`
|
|
168
172
|
);
|
|
169
173
|
}
|
|
@@ -107,6 +107,14 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
|
|
|
107
107
|
"url": "https://<vendor>/releases/download/bws-v2.1.0/bws-<platform>-2.1.0.zip",
|
|
108
108
|
"sha256": "<sha256 published with that exact release>"
|
|
109
109
|
},
|
|
110
|
+
{
|
|
111
|
+
"name": "gh",
|
|
112
|
+
"version": "2.83.0",
|
|
113
|
+
"install": "release-tar",
|
|
114
|
+
"url": "https://<vendor>/releases/download/v2.83.0/gh_2.83.0_linux_amd64.tar.gz",
|
|
115
|
+
"sha256": "<sha256 published with that exact release>",
|
|
116
|
+
"binary": "gh_2.83.0_linux_amd64/bin/gh"
|
|
117
|
+
},
|
|
110
118
|
{
|
|
111
119
|
"name": "codex",
|
|
112
120
|
"version": "0.144.6",
|
|
@@ -133,6 +141,22 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
|
|
|
133
141
|
|
|
134
142
|
Expected shape for most projects: a short `require` list, an empty or near-empty `install` list, and the provider CLI as the only thing always provisioned.
|
|
135
143
|
|
|
144
|
+
### The three `install` methods
|
|
145
|
+
|
|
146
|
+
| `install` | Required fields | Use it when |
|
|
147
|
+
| --- | --- | --- |
|
|
148
|
+
| `release-zip` | `url` **and** `sha256` | The vendor publishes a Linux zip of the release. |
|
|
149
|
+
| `release-tar` | `url` **and** `sha256` — plus `binary` in practice | The vendor publishes no zip for Linux, only a `.tar.gz`. |
|
|
150
|
+
| `npm-global` | `package` | The tool ships on the npm registry. |
|
|
151
|
+
|
|
152
|
+
Anything else is rejected by name at plan time, so a typo fails loudly rather than silently installing nothing.
|
|
153
|
+
|
|
154
|
+
Both archive kinds carry the **same** obligation and differ only in how they are unpacked: `url` and `sha256` are both mandatory, the checksum is verified *before* the archive is unpacked, and a version bump must move the checksum in the same reviewed commit. Neither is a weaker path than the other — `release-tar` exists because some tools worth pinning simply do not publish a zip. `gh` is the case that forced it: it ships `.deb`, `.rpm` and `.tar.gz` and nothing else, so a zip-only installer could not pin the CLI that Lisa's own commit guardrails shell out to.
|
|
155
|
+
|
|
156
|
+
**`binary` means something different for a tarball.** It defaults to the tool's `name` and is resolved relative to the unpacked directory. Release tarballs almost always nest their contents under a versioned top-level directory, so for `release-tar` it must be the path *within* the archive — `gh_2.83.0_linux_amd64/bin/gh`, not `gh`. A bare name there resolves to nothing after a download that otherwise succeeded, and the install fails at the copy step rather than at the fetch, which reads as a broken release when it is a manifest mistake. Bump the version and this path moves with it, alongside the `url` and the `sha256`.
|
|
157
|
+
|
|
158
|
+
Because `release-tar` unpacks with `tar` rather than `unzip`, a project using it should assert `tar` in its `require` list the same way a zip-installing project asserts `unzip` — the base image providing it is an assumption, not a contract.
|
|
159
|
+
|
|
136
160
|
### Rules
|
|
137
161
|
|
|
138
162
|
- **The base image is not a contract.** A vendor can change it. A project quietly depending on a preinstalled `jq` should break loudly at setup when that happens, not mysteriously mid-task weeks later. `require` is what converts an implicit assumption into an explicit check.
|
|
@@ -27,4 +27,21 @@ if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
|
|
|
27
27
|
fi
|
|
28
28
|
|
|
29
29
|
here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
|
|
30
|
+
|
|
31
|
+
# The toolchain first, for the same reason the secrets are here at all.
|
|
32
|
+
#
|
|
33
|
+
# It used to run only from the environment setup script, which a cached
|
|
34
|
+
# environment skips — so a tool added to remoteEnv.tools was invisible until the
|
|
35
|
+
# cache expired about a week later, or until someone edited the vendor's setup
|
|
36
|
+
# field to force a rebuild. Neither is a thing a project can rely on, and the
|
|
37
|
+
# symptom is a container missing a tool its own committed config pins.
|
|
38
|
+
#
|
|
39
|
+
# It is cheap to repeat: the plan probes each tool and installs only what is
|
|
40
|
+
# absent or below its pinned version, so on a warm container this is a handful
|
|
41
|
+
# of --version calls and nothing else.
|
|
42
|
+
#
|
|
43
|
+
# Before secrets, because materializing needs the provider CLI that this step
|
|
44
|
+
# installs. A failure here is fatal for the same reason: continuing would report
|
|
45
|
+
# a missing credential when the real fault was a missing binary.
|
|
46
|
+
bash "${here}/setup.sh" --phase=toolchain "$@"
|
|
30
47
|
exec bash "${here}/setup.sh" --phase=secrets "$@"
|
|
@@ -153,6 +153,42 @@ function installReleaseZip(tool, binDir) {
|
|
|
153
153
|
}
|
|
154
154
|
}
|
|
155
155
|
|
|
156
|
+
/**
|
|
157
|
+
* Install a pinned tarball, refusing anything whose checksum does not match.
|
|
158
|
+
*
|
|
159
|
+
* Same contract as the zip path and the same ordering — verify, then unpack —
|
|
160
|
+
* because an unexpected archive must fail before any of its contents reach a
|
|
161
|
+
* directory that is on PATH. It exists because several tools worth pinning
|
|
162
|
+
* publish no zip for Linux: gh ships .deb, .rpm and .tar.gz and nothing else.
|
|
163
|
+
* @param {object} tool Manifest entry.
|
|
164
|
+
* @param {string} binDir Directory to install into.
|
|
165
|
+
*/
|
|
166
|
+
function installReleaseTar(tool, binDir) {
|
|
167
|
+
const temporary = join(binDir, `.${tool.name}-download`);
|
|
168
|
+
mkdirSync(temporary, { recursive: true });
|
|
169
|
+
try {
|
|
170
|
+
const archive = join(temporary, "download.tar.gz");
|
|
171
|
+
execFileSync("curl", ["-fsSL", tool.url, "-o", archive], {
|
|
172
|
+
stdio: "inherit",
|
|
173
|
+
});
|
|
174
|
+
execFileSync("sha256sum", ["-c", "-"], {
|
|
175
|
+
input: `${tool.sha256} ${archive}\n`,
|
|
176
|
+
stdio: ["pipe", "ignore", "inherit"],
|
|
177
|
+
});
|
|
178
|
+
execFileSync("tar", ["-xzf", archive, "-C", temporary], {
|
|
179
|
+
stdio: "inherit",
|
|
180
|
+
});
|
|
181
|
+
// Release tarballs usually nest under a versioned directory, so `binary` is
|
|
182
|
+
// a path within the archive rather than a bare name.
|
|
183
|
+
const binary = join(temporary, tool.binary ?? tool.name);
|
|
184
|
+
execFileSync("install", ["-m", "0755", binary, join(binDir, tool.name)], {
|
|
185
|
+
stdio: "inherit",
|
|
186
|
+
});
|
|
187
|
+
} finally {
|
|
188
|
+
rmSync(temporary, { recursive: true, force: true });
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
|
|
156
192
|
/**
|
|
157
193
|
* Install a pinned global npm package.
|
|
158
194
|
* @param {object} tool Manifest entry.
|
|
@@ -175,6 +211,7 @@ function installNpmGlobal(tool) {
|
|
|
175
211
|
function installTool(tool, binDir) {
|
|
176
212
|
assertPinned(tool);
|
|
177
213
|
if (tool.install === "release-zip") installReleaseZip(tool, binDir);
|
|
214
|
+
else if (tool.install === "release-tar") installReleaseTar(tool, binDir);
|
|
178
215
|
else installNpmGlobal(tool);
|
|
179
216
|
}
|
|
180
217
|
|
|
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
|
|
|
148
148
|
* @param {object} tool Manifest entry.
|
|
149
149
|
*/
|
|
150
150
|
export function assertPinned(tool) {
|
|
151
|
-
|
|
151
|
+
// Both archive kinds carry the same obligation, and differ only in how they
|
|
152
|
+
// are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
|
|
153
|
+
// .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
|
|
154
|
+
// Lisa's own guardrails shell out to.
|
|
155
|
+
if (tool.install === "release-zip" || tool.install === "release-tar") {
|
|
152
156
|
if (!tool.url || !tool.sha256) {
|
|
153
157
|
throw new Error(
|
|
154
|
-
`${tool.name}: a
|
|
158
|
+
`${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
|
|
155
159
|
`A version bump must move the checksum in the same reviewed commit.`
|
|
156
160
|
);
|
|
157
161
|
}
|
|
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
|
|
|
164
168
|
}
|
|
165
169
|
throw new Error(
|
|
166
170
|
`${tool.name}: unknown install method "${tool.install}".\n` +
|
|
167
|
-
`Supported: release-zip, npm-global.`
|
|
171
|
+
`Supported: release-zip, release-tar, npm-global.`
|
|
168
172
|
);
|
|
169
173
|
}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.324.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.324.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.324.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.324.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.324.0",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|