@codyswann/lisa 2.326.0 → 2.326.3

package/dist/core/upstream-evidence-manifest.js

@@ -426,7 +426,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-debrief/SKILL.md": "47e4cda36b07994ff47ab15fb04a17dd6b0c310ad804f9cae9d69637edaaa72a",
     "plugins/src/base/skills/lisa-delivery-effectiveness/SKILL.md": "21bc55fa0e86a9694bd22269fd089dbfae0c54c199262f46a4955447acea0f35",
     "plugins/src/base/skills/lisa-detect-tooling/SKILL.md": "1778a009d06099b3bd2d9a33b37bec34836b295e21fad220ae926491d3557208",
-    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "05e0c4808e64fbdc277419ad00b6a68da96766a9261a5b97f3a4961bbab107c4",
+    "plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs": "d2ff0e79dd8a3f79252d425d8203dab54f9e2afd387d113cb8b1a7637a5082e7",
     "plugins/src/base/skills/lisa-doctor/SKILL.md": "fb41a1e63c5332d47a46e715aff52551f3df867033b5e4f37dfaeee30019b891",
     "plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md": "c78ae2ba32c830d0b2cd7d24de91adf99e2b3cef4c7cab1c417580d86f41351f",
     "plugins/src/base/skills/lisa-epic-triage/SKILL.md": "d02760411249bddbd396f283191fe3e82bb7b95bf9393a19a7025dc5a57c3ab7",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();

package/plugins/lisa/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.326.0",
+  "version": "2.326.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-detect-tooling/scripts/detect-tooling.mjs

@@ -22,9 +22,12 @@
  * @module detect-tooling
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
+/** The tool named by the Expo template's scripts and its flows directory. */
+const MAESTRO = "maestro";
+
 /**
  * Tools Lisa or its templates invoke, and how to recognise a need for them.
  *
@@ -33,9 +36,12 @@ import { join } from "node:path";
  * ones that only appear when the tool is genuinely used.
  */
 const KNOWN_TOOLS = Object.freeze({
-  maestro: {
+  [MAESTRO]: {
+    // A flows directory is the artifact maestro consumes; its presence is
+    // usage, where a synced threshold default is not.
+    artifacts: ".maestro",
     why: "Expo's template ships npm scripts that invoke `maestro`, and nothing installs the binary.",
-    mcpFallback: "maestro",
+    mcpFallback: MAESTRO,
   },
   gh: {
     why: "The work-item guardrails shell out to `gh` for every tracker read.",
@@ -199,22 +205,62 @@ export function toolsFromSecretNotes(notes) {
 }
 
 /**
- * Tools implied by quality configuration.
+ * Whether anything in the project actually reaches for this tool.
+ *
+ * Corroboration for a threshold, which on its own says only that a default was
+ * synced. Two independent witnesses: a script that names the binary, or the
+ * directory of artifacts the tool consumes.
+ * @param {string} tool Tool name.
+ * @param {object|null} pkg Parsed package.json.
+ * @param {string} cwd Project root.
+ * @returns {boolean} Whether the project uses it.
+ */
+function usedByProject(tool, pkg, cwd) {
+  const invoked = [...toolsFromScripts(pkg).keys()].includes(tool);
+  if (invoked) return true;
+  const artifacts = KNOWN_TOOLS[tool]?.artifacts;
+  if (!artifacts) return false;
+  // A DIRECTORY, not merely an entry with that name. `existsSync` is true for a
+  // regular file too, so a stray `.maestro` note or editor artifact would have
+  // corroborated the threshold and reintroduced the 300MB proposal this check
+  // exists to prevent — a false positive arriving through the very guard added
+  // to stop one.
+  try {
+    return statSync(join(cwd, artifacts)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Tools a project's quality configuration CORROBORATES — never establishes.
+ *
+ * A threshold is not usage. `quality.e2eCoverage` defaults are synced into
+ * every project by `src/sync/registry.ts`, so this repository carries a
+ * `maestro` entry while having no `.maestro` directory and no script that
+ * invokes it. Treating that as evidence proposed pinning a 300MB JVM
+ * application into a container for a tool nothing runs.
+ *
+ * Evidence that a tool is CONFIGURED is not evidence that it is NEEDED — the
+ * same mistake as proposing a binary npm already provides. So a threshold only
+ * counts when something corroborates it: a script that invokes the tool, or the
+ * artifacts it consumes. In a real Expo project the script signal fires and
+ * this adds nothing; in a project that merely inherited the defaults, it
+ * correctly stays quiet.
  * @param {object|null} config Parsed .lisa.config.json.
+ * @param {object|null} [pkg] Parsed package.json, for corroboration.
+ * @param {string} [cwd] Project root, for artifact corroboration.
  * @returns {Map<string, string>} Tool name to the setting that implies it.
  */
-export function toolsFromQuality(config) {
+export function toolsFromQuality(config, pkg = null, cwd = process.cwd()) {
   const found = new Map();
-  // Every runner under e2eCoverage, not a hardcoded one. Naming `playwright`
-  // explicitly meant `quality.e2eCoverage.maestro` — configured in this very
-  // repository — produced no signal at all, so the one tool that genuinely
-  // needs a pinned binary and genuinely was not declared stayed invisible to
-  // the detector built to find it. A gate that reports "nothing outstanding"
-  // while the gap is right there is worse than no gate.
   for (const runner of Object.keys(config?.quality?.e2eCoverage ?? {})) {
-    if (Object.hasOwn(KNOWN_TOOLS, runner)) {
-      found.set(runner, `quality.e2eCoverage.${runner} is configured`);
-    }
+    if (!Object.hasOwn(KNOWN_TOOLS, runner)) continue;
+    if (!usedByProject(runner, pkg, cwd)) continue;
+    found.set(
+      runner,
+      `quality.e2eCoverage.${runner} is configured, and the project uses it`
+    );
   }
   if (config?.quality?.sonar || config?.sonar) {
     found.set("sonar-scanner", "Sonar analysis is configured");
@@ -288,7 +334,7 @@ export function detectTooling(cwd = process.cwd()) {
     toolsFromScripts(pkg),
     toolsFromMcp(mcp),
     toolsFromSecretNotes(notes),
-    toolsFromQuality(config),
+    toolsFromQuality(config, pkg, cwd),
   ];
 
   const merged = new Map();