@codyswann/lisa 2.323.0 → 2.324.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (85) hide show
  1. package/all/copy-overwrite/scripts/lisa-work-item.mjs +154 -15
  2. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  3. package/dist/core/upstream-evidence-manifest.js +13 -7
  4. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  5. package/dist/strategies/package-lisa.d.ts.map +1 -1
  6. package/dist/strategies/package-lisa.js +67 -2
  7. package/dist/strategies/package-lisa.js.map +1 -1
  8. package/package.json +1 -1
  9. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  10. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  11. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/SKILL.md +24 -0
  12. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  13. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  14. package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  15. package/plugins/lisa/skills/lisa-setup-remote-env/SKILL.md +24 -0
  16. package/plugins/lisa/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  17. package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  18. package/plugins/lisa/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  19. package/plugins/lisa-agy/plugin.json +1 -1
  20. package/plugins/lisa-agy/skills/lisa-setup-remote-env/SKILL.md +24 -0
  21. package/plugins/lisa-agy/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  22. package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  23. package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  24. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  25. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  26. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  27. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  28. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  29. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  30. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/SKILL.md +24 -0
  31. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  32. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  33. package/plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  34. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  35. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/SKILL.md +24 -0
  36. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  37. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  38. package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  39. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  40. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  41. package/plugins/lisa-expo-agy/plugin.json +1 -1
  42. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  43. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  44. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  45. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  46. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  47. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  48. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  49. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  50. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  51. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  52. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  53. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  54. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  55. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  56. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  57. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  58. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  59. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  60. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  61. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  62. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  63. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  64. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  65. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  66. package/plugins/lisa-rails-agy/plugin.json +1 -1
  67. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  68. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  69. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  70. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  71. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  72. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  73. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  74. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  75. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  76. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  77. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  78. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  79. package/plugins/src/base/skills/lisa-setup-remote-env/SKILL.md +24 -0
  80. package/plugins/src/base/skills/lisa-setup-remote-env/assets/session-start.sh +17 -0
  81. package/plugins/src/base/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs +37 -0
  82. package/plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs +7 -3
  83. package/scripts/lisa-enforcement-fallback.sh +57 -0
  84. package/scripts/lisa-remote-env/session-start.sh +17 -0
  85. package/scripts/lisa-work-item.mjs +8 -1
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
148
148
  * @param {object} tool Manifest entry.
149
149
  */
150
150
  export function assertPinned(tool) {
151
- if (tool.install === "release-zip") {
151
+ // Both archive kinds carry the same obligation, and differ only in how they
152
+ // are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
153
+ // .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
154
+ // Lisa's own guardrails shell out to.
155
+ if (tool.install === "release-zip" || tool.install === "release-tar") {
152
156
  if (!tool.url || !tool.sha256) {
153
157
  throw new Error(
154
- `${tool.name}: a release-zip install needs both url and sha256.\n` +
158
+ `${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
155
159
  `A version bump must move the checksum in the same reviewed commit.`
156
160
  );
157
161
  }
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
164
168
  }
165
169
  throw new Error(
166
170
  `${tool.name}: unknown install method "${tool.install}".\n` +
167
- `Supported: release-zip, npm-global.`
171
+ `Supported: release-zip, release-tar, npm-global.`
168
172
  );
169
173
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "AWS CDK-specific Lisa plugin.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -107,6 +107,14 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
107
107
  "url": "https://<vendor>/releases/download/bws-v2.1.0/bws-<platform>-2.1.0.zip",
108
108
  "sha256": "<sha256 published with that exact release>"
109
109
  },
110
+ {
111
+ "name": "gh",
112
+ "version": "2.83.0",
113
+ "install": "release-tar",
114
+ "url": "https://<vendor>/releases/download/v2.83.0/gh_2.83.0_linux_amd64.tar.gz",
115
+ "sha256": "<sha256 published with that exact release>",
116
+ "binary": "gh_2.83.0_linux_amd64/bin/gh"
117
+ },
110
118
  {
111
119
  "name": "codex",
112
120
  "version": "0.144.6",
@@ -133,6 +141,22 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
133
141
 
134
142
  Expected shape for most projects: a short `require` list, an empty or near-empty `install` list, and the provider CLI as the only thing always provisioned.
135
143
 
144
+ ### The three `install` methods
145
+
146
+ | `install` | Required fields | Use it when |
147
+ | --- | --- | --- |
148
+ | `release-zip` | `url` **and** `sha256` | The vendor publishes a Linux zip of the release. |
149
+ | `release-tar` | `url` **and** `sha256` — plus `binary` in practice | The vendor publishes no zip for Linux, only a `.tar.gz`. |
150
+ | `npm-global` | `package` | The tool ships on the npm registry. |
151
+
152
+ Anything else is rejected by name at plan time, so a typo fails loudly rather than silently installing nothing.
153
+
154
+ Both archive kinds carry the **same** obligation and differ only in how they are unpacked: `url` and `sha256` are both mandatory, the checksum is verified *before* the archive is unpacked, and a version bump must move the checksum in the same reviewed commit. Neither is a weaker path than the other — `release-tar` exists because some tools worth pinning simply do not publish a zip. `gh` is the case that forced it: it ships `.deb`, `.rpm` and `.tar.gz` and nothing else, so a zip-only installer could not pin the CLI that Lisa's own commit guardrails shell out to.
155
+
156
+ **`binary` means something different for a tarball.** It defaults to the tool's `name` and is resolved relative to the unpacked directory. Release tarballs almost always nest their contents under a versioned top-level directory, so for `release-tar` it must be the path *within* the archive — `gh_2.83.0_linux_amd64/bin/gh`, not `gh`. A bare name there resolves to nothing after a download that otherwise succeeded, and the install fails at the copy step rather than at the fetch, which reads as a broken release when it is a manifest mistake. Bump the version and this path moves with it, alongside the `url` and the `sha256`.
157
+
158
+ Because `release-tar` unpacks with `tar` rather than `unzip`, a project using it should assert `tar` in its `require` list the same way a zip-installing project asserts `unzip` — the base image providing it is an assumption, not a contract.
159
+
136
160
  ### Rules
137
161
 
138
162
  - **The base image is not a contract.** A vendor can change it. A project quietly depending on a preinstalled `jq` should break loudly at setup when that happens, not mysteriously mid-task weeks later. `require` is what converts an implicit assumption into an explicit check.
@@ -27,4 +27,21 @@ if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
27
27
  fi
28
28
 
29
29
  here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
30
+
31
+ # The toolchain first, for the same reason the secrets are here at all.
32
+ #
33
+ # It used to run only from the environment setup script, which a cached
34
+ # environment skips — so a tool added to remoteEnv.tools was invisible until the
35
+ # cache expired about a week later, or until someone edited the vendor's setup
36
+ # field to force a rebuild. Neither is a thing a project can rely on, and the
37
+ # symptom is a container missing a tool its own committed config pins.
38
+ #
39
+ # It is cheap to repeat: the plan probes each tool and installs only what is
40
+ # absent or below its pinned version, so on a warm container this is a handful
41
+ # of --version calls and nothing else.
42
+ #
43
+ # Before secrets, because materializing needs the provider CLI that this step
44
+ # installs. A failure here is fatal for the same reason: continuing would report
45
+ # a missing credential when the real fault was a missing binary.
46
+ bash "${here}/setup.sh" --phase=toolchain "$@"
30
47
  exec bash "${here}/setup.sh" --phase=secrets "$@"
@@ -153,6 +153,42 @@ function installReleaseZip(tool, binDir) {
153
153
  }
154
154
  }
155
155
 
156
+ /**
157
+ * Install a pinned tarball, refusing anything whose checksum does not match.
158
+ *
159
+ * Same contract as the zip path and the same ordering — verify, then unpack —
160
+ * because an unexpected archive must fail before any of its contents reach a
161
+ * directory that is on PATH. It exists because several tools worth pinning
162
+ * publish no zip for Linux: gh ships .deb, .rpm and .tar.gz and nothing else.
163
+ * @param {object} tool Manifest entry.
164
+ * @param {string} binDir Directory to install into.
165
+ */
166
+ function installReleaseTar(tool, binDir) {
167
+ const temporary = join(binDir, `.${tool.name}-download`);
168
+ mkdirSync(temporary, { recursive: true });
169
+ try {
170
+ const archive = join(temporary, "download.tar.gz");
171
+ execFileSync("curl", ["-fsSL", tool.url, "-o", archive], {
172
+ stdio: "inherit",
173
+ });
174
+ execFileSync("sha256sum", ["-c", "-"], {
175
+ input: `${tool.sha256} ${archive}\n`,
176
+ stdio: ["pipe", "ignore", "inherit"],
177
+ });
178
+ execFileSync("tar", ["-xzf", archive, "-C", temporary], {
179
+ stdio: "inherit",
180
+ });
181
+ // Release tarballs usually nest under a versioned directory, so `binary` is
182
+ // a path within the archive rather than a bare name.
183
+ const binary = join(temporary, tool.binary ?? tool.name);
184
+ execFileSync("install", ["-m", "0755", binary, join(binDir, tool.name)], {
185
+ stdio: "inherit",
186
+ });
187
+ } finally {
188
+ rmSync(temporary, { recursive: true, force: true });
189
+ }
190
+ }
191
+
156
192
  /**
157
193
  * Install a pinned global npm package.
158
194
  * @param {object} tool Manifest entry.
@@ -175,6 +211,7 @@ function installNpmGlobal(tool) {
175
211
  function installTool(tool, binDir) {
176
212
  assertPinned(tool);
177
213
  if (tool.install === "release-zip") installReleaseZip(tool, binDir);
214
+ else if (tool.install === "release-tar") installReleaseTar(tool, binDir);
178
215
  else installNpmGlobal(tool);
179
216
  }
180
217
 
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
148
148
  * @param {object} tool Manifest entry.
149
149
  */
150
150
  export function assertPinned(tool) {
151
- if (tool.install === "release-zip") {
151
+ // Both archive kinds carry the same obligation, and differ only in how they
152
+ // are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
153
+ // .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
154
+ // Lisa's own guardrails shell out to.
155
+ if (tool.install === "release-zip" || tool.install === "release-tar") {
152
156
  if (!tool.url || !tool.sha256) {
153
157
  throw new Error(
154
- `${tool.name}: a release-zip install needs both url and sha256.\n` +
158
+ `${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
155
159
  `A version bump must move the checksum in the same reviewed commit.`
156
160
  );
157
161
  }
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
164
168
  }
165
169
  throw new Error(
166
170
  `${tool.name}: unknown install method "${tool.install}".\n` +
167
- `Supported: release-zip, npm-global.`
171
+ `Supported: release-zip, release-tar, npm-global.`
168
172
  );
169
173
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -107,6 +107,14 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
107
107
  "url": "https://<vendor>/releases/download/bws-v2.1.0/bws-<platform>-2.1.0.zip",
108
108
  "sha256": "<sha256 published with that exact release>"
109
109
  },
110
+ {
111
+ "name": "gh",
112
+ "version": "2.83.0",
113
+ "install": "release-tar",
114
+ "url": "https://<vendor>/releases/download/v2.83.0/gh_2.83.0_linux_amd64.tar.gz",
115
+ "sha256": "<sha256 published with that exact release>",
116
+ "binary": "gh_2.83.0_linux_amd64/bin/gh"
117
+ },
110
118
  {
111
119
  "name": "codex",
112
120
  "version": "0.144.6",
@@ -133,6 +141,22 @@ The selection comes from the surface's `materializeAt` capability in `lisa-secre
133
141
 
134
142
  Expected shape for most projects: a short `require` list, an empty or near-empty `install` list, and the provider CLI as the only thing always provisioned.
135
143
 
144
+ ### The three `install` methods
145
+
146
+ | `install` | Required fields | Use it when |
147
+ | --- | --- | --- |
148
+ | `release-zip` | `url` **and** `sha256` | The vendor publishes a Linux zip of the release. |
149
+ | `release-tar` | `url` **and** `sha256` — plus `binary` in practice | The vendor publishes no zip for Linux, only a `.tar.gz`. |
150
+ | `npm-global` | `package` | The tool ships on the npm registry. |
151
+
152
+ Anything else is rejected by name at plan time, so a typo fails loudly rather than silently installing nothing.
153
+
154
+ Both archive kinds carry the **same** obligation and differ only in how they are unpacked: `url` and `sha256` are both mandatory, the checksum is verified *before* the archive is unpacked, and a version bump must move the checksum in the same reviewed commit. Neither is a weaker path than the other — `release-tar` exists because some tools worth pinning simply do not publish a zip. `gh` is the case that forced it: it ships `.deb`, `.rpm` and `.tar.gz` and nothing else, so a zip-only installer could not pin the CLI that Lisa's own commit guardrails shell out to.
155
+
156
+ **`binary` means something different for a tarball.** It defaults to the tool's `name` and is resolved relative to the unpacked directory. Release tarballs almost always nest their contents under a versioned top-level directory, so for `release-tar` it must be the path *within* the archive — `gh_2.83.0_linux_amd64/bin/gh`, not `gh`. A bare name there resolves to nothing after a download that otherwise succeeded, and the install fails at the copy step rather than at the fetch, which reads as a broken release when it is a manifest mistake. Bump the version and this path moves with it, alongside the `url` and the `sha256`.
157
+
158
+ Because `release-tar` unpacks with `tar` rather than `unzip`, a project using it should assert `tar` in its `require` list the same way a zip-installing project asserts `unzip` — the base image providing it is an assumption, not a contract.
159
+
136
160
  ### Rules
137
161
 
138
162
  - **The base image is not a contract.** A vendor can change it. A project quietly depending on a preinstalled `jq` should break loudly at setup when that happens, not mysteriously mid-task weeks later. `require` is what converts an implicit assumption into an explicit check.
@@ -27,4 +27,21 @@ if [ "${CLAUDE_CODE_REMOTE:-}" != "true" ]; then
27
27
  fi
28
28
 
29
29
  here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
30
+
31
+ # The toolchain first, for the same reason the secrets are here at all.
32
+ #
33
+ # It used to run only from the environment setup script, which a cached
34
+ # environment skips — so a tool added to remoteEnv.tools was invisible until the
35
+ # cache expired about a week later, or until someone edited the vendor's setup
36
+ # field to force a rebuild. Neither is a thing a project can rely on, and the
37
+ # symptom is a container missing a tool its own committed config pins.
38
+ #
39
+ # It is cheap to repeat: the plan probes each tool and installs only what is
40
+ # absent or below its pinned version, so on a warm container this is a handful
41
+ # of --version calls and nothing else.
42
+ #
43
+ # Before secrets, because materializing needs the provider CLI that this step
44
+ # installs. A failure here is fatal for the same reason: continuing would report
45
+ # a missing credential when the real fault was a missing binary.
46
+ bash "${here}/setup.sh" --phase=toolchain "$@"
30
47
  exec bash "${here}/setup.sh" --phase=secrets "$@"
@@ -153,6 +153,42 @@ function installReleaseZip(tool, binDir) {
153
153
  }
154
154
  }
155
155
 
156
+ /**
157
+ * Install a pinned tarball, refusing anything whose checksum does not match.
158
+ *
159
+ * Same contract as the zip path and the same ordering — verify, then unpack —
160
+ * because an unexpected archive must fail before any of its contents reach a
161
+ * directory that is on PATH. It exists because several tools worth pinning
162
+ * publish no zip for Linux: gh ships .deb, .rpm and .tar.gz and nothing else.
163
+ * @param {object} tool Manifest entry.
164
+ * @param {string} binDir Directory to install into.
165
+ */
166
+ function installReleaseTar(tool, binDir) {
167
+ const temporary = join(binDir, `.${tool.name}-download`);
168
+ mkdirSync(temporary, { recursive: true });
169
+ try {
170
+ const archive = join(temporary, "download.tar.gz");
171
+ execFileSync("curl", ["-fsSL", tool.url, "-o", archive], {
172
+ stdio: "inherit",
173
+ });
174
+ execFileSync("sha256sum", ["-c", "-"], {
175
+ input: `${tool.sha256} ${archive}\n`,
176
+ stdio: ["pipe", "ignore", "inherit"],
177
+ });
178
+ execFileSync("tar", ["-xzf", archive, "-C", temporary], {
179
+ stdio: "inherit",
180
+ });
181
+ // Release tarballs usually nest under a versioned directory, so `binary` is
182
+ // a path within the archive rather than a bare name.
183
+ const binary = join(temporary, tool.binary ?? tool.name);
184
+ execFileSync("install", ["-m", "0755", binary, join(binDir, tool.name)], {
185
+ stdio: "inherit",
186
+ });
187
+ } finally {
188
+ rmSync(temporary, { recursive: true, force: true });
189
+ }
190
+ }
191
+
156
192
  /**
157
193
  * Install a pinned global npm package.
158
194
  * @param {object} tool Manifest entry.
@@ -175,6 +211,7 @@ function installNpmGlobal(tool) {
175
211
  function installTool(tool, binDir) {
176
212
  assertPinned(tool);
177
213
  if (tool.install === "release-zip") installReleaseZip(tool, binDir);
214
+ else if (tool.install === "release-tar") installReleaseTar(tool, binDir);
178
215
  else installNpmGlobal(tool);
179
216
  }
180
217
 
@@ -148,10 +148,14 @@ export function planToolchain(tools, probe) {
148
148
  * @param {object} tool Manifest entry.
149
149
  */
150
150
  export function assertPinned(tool) {
151
- if (tool.install === "release-zip") {
151
+ // Both archive kinds carry the same obligation, and differ only in how they
152
+ // are unpacked. gh, for one, publishes no zip for Linux at all — only .deb,
153
+ // .rpm and .tar.gz — so a zip-only installer could not pin the CLI that
154
+ // Lisa's own guardrails shell out to.
155
+ if (tool.install === "release-zip" || tool.install === "release-tar") {
152
156
  if (!tool.url || !tool.sha256) {
153
157
  throw new Error(
154
- `${tool.name}: a release-zip install needs both url and sha256.\n` +
158
+ `${tool.name}: a ${tool.install} install needs both url and sha256.\n` +
155
159
  `A version bump must move the checksum in the same reviewed commit.`
156
160
  );
157
161
  }
@@ -164,6 +168,6 @@ export function assertPinned(tool) {
164
168
  }
165
169
  throw new Error(
166
170
  `${tool.name}: unknown install method "${tool.install}".\n` +
167
- `Supported: release-zip, npm-global.`
171
+ `Supported: release-zip, release-tar, npm-global.`
168
172
  );
169
173
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "2.323.0",
3
+ "version": "2.324.0",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"