@codyswann/lisa 2.328.5 → 2.330.0

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -4,7 +4,8 @@
 # is not installed.
 #
 # Every PreToolUse guard — block-no-verify, parity-safety-net,
-# block-shell-json-parsing — is declared in the Lisa plugin. A cloud session
+# block-shell-json-parsing, block-instruction-file-edits — is declared in the
+# Lisa plugin. A cloud session
 # installs plugins at session start from the marketplace the repository
 # declares, and when that does not happen the container runs with
 # `installed_plugins.json` empty and no enforcement whatsoever.
@@ -41,7 +42,8 @@ fi
 # host project whose plugin install fails has exactly the same hole and no
 # `plugins/` directory to fall back on.
 status=0
-for guard in block-no-verify parity-safety-net block-shell-json-parsing; do
+for guard in block-no-verify parity-safety-net block-shell-json-parsing \
+  block-instruction-file-edits; do
   script=""
   for candidate in \
     "$repo_root/scripts/lisa-hooks/$guard.sh" \

package/all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# PreToolUse hook: refuse agent writes to the session-instruction files.
+#
+# `AGENTS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` are the files
+# every agent loads at session start. They are human-authored and curated on
+# purpose — Lisa's own contract says so in two places:
+#   - plugins/src/base/rules/reference/project-learnings.md
+#   - plugins/src/base/skills/lisa-debrief-apply/SKILL.md ("CLAUDE.md is
+#     human-authored ... apply never writes to any of the three")
+#
+# Nothing enforced it, so agents appended their own findings anyway: one fleet
+# repo reached 949 lines of ticket-keyed trap dumps in `AGENTS.md` while its
+# learnings ledger held 22. Every one of those lines is charged to the context
+# of every later session in that project, forever. Prose did not hold; this is
+# the executable control that does.
+#
+# Blocked signatures:
+#   1. Write / Edit / MultiEdit / NotebookEdit whose target basename is one of
+#      the instruction files;
+#   2. Bash output redirection (`>`, `>>`), `tee`, or `sed -i` aimed at one.
+#      Reads (`cat AGENTS.md`, `rg pattern AGENTS.md`) never fire.
+#
+# Exemptions (allowed):
+#   - `LISA_ALLOW_INSTRUCTION_FILE_WRITE` set — the operator's explicit override,
+#     named in the refusal so a human who really wants the edit can take it;
+#   - payloads carrying a `<!-- LISA_` marker: Lisa's own marker-bounded regions
+#     (the agy project-learnings bridge, cross-pollinate's rule section) replace
+#     in place on re-run and cannot grow the file;
+#   - paths under `node_modules/` or `dist/` — vendored copies, not the host's.
+set -euo pipefail
+
+input="$(cat)"
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+# The operator's override. Checked before anything else so it is always the
+# cheapest way out of a refusal a human deliberately wants to overrule.
+if [ -n "${LISA_ALLOW_INSTRUCTION_FILE_WRITE:-}" ]; then
+  exit 0
+fi
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
+[ -n "$tool_name" ] || exit 0
+
+# Lisa's own bounded bridges write marked regions. A payload carrying a marker
+# is replacing a delimited block, not appending prose, so it cannot be the
+# unbounded growth this guard exists to stop.
+if printf '%s' "$input" | grep -q '<!-- LISA_'; then
+  exit 0
+fi
+
+# Basename match, case-insensitively: `agents.md` and `AGENTS.md` are the same
+# file on the macOS checkouts this fleet runs on.
+is_instruction_file() {
+  local candidate="$1"
+  case "$candidate" in
+    */node_modules/* | node_modules/* | */dist/* | dist/*) return 1 ;;
+  esac
+  local base="${candidate##*/}"
+  case "$(printf '%s' "$base" | tr '[:upper:]' '[:lower:]')" in
+    agents.md | claude.md | copilot-instructions.md) return 0 ;;
+  esac
+  return 1
+}
+
+refuse() {
+  local target="$1"
+  cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this is a session-instruction file, not a place to record what you just
+learned. Every line in it is loaded into the context of every agent, in every
+future session, in this project, forever. It is human-curated on purpose. An
+agent appending its own findings is how these files grow into hundreds of lines
+of stale, ticket-specific trivia that every later session pays for and half of
+which was only ever true once.
+
+WHERE IT GOES INSTEAD — take the first one that fits:
+
+1. Every agent genuinely needs this in every session, and only in this project.
+   That is a project rule — but do not write it yourself. Capture it with
+   \`/lisa:persist-learning\` so it lands in the learnings ledger with provenance
+   and a confidence score. The gardener (\`/lisa:learnings:audit\`) then proposes
+   promotion into \`.claude/rules/PROJECT_RULES.md\` as a human-gated ticket.
+
+2. It changes how an existing skill should behave. Edit that skill's SKILL.md.
+   Knowledge belongs next to the procedure it modifies, not in a global preamble.
+
+3. It is true beyond this project. Propose it upstream to Lisa via
+   \`/lisa:cross-pollinate\`, or open an issue on CodySwannGT/lisa. A local copy of
+   a general rule silently drifts the moment upstream changes.
+
+4. None of the above — it is background someone may want to look up, not a
+   standing instruction. Write it into the project documentation (\`wiki/\` or
+   \`docs/\`).
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_INSTRUCTION_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+  exit 2
+}
+
+case "$tool_name" in
+  Write | Edit | MultiEdit | NotebookEdit | Update)
+    # `file_path` covers Write/Edit; `edits[].file_path` covers the MultiEdit
+    # shapes that carry a path per edit; `notebook_path` covers NotebookEdit.
+    paths="$(printf '%s' "$input" | jq -r '
+      [ .tool_input.file_path?,
+        .tool_input.path?,
+        .tool_input.notebook_path?,
+        (.tool_input.edits? // [] | .[].file_path?)
+      ] | map(select(. != null and . != "")) | .[]' 2>/dev/null || true)"
+    while IFS= read -r candidate; do
+      [ -n "$candidate" ] || continue
+      if is_instruction_file "$candidate"; then
+        refuse "$candidate"
+      fi
+    done <<EOF
+$paths
+EOF
+    ;;
+  Bash)
+    command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
+    [ -n "$command_str" ] || exit 0
+    # Fast path: no instruction filename mentioned means nothing to classify.
+    if ! printf '%s' "$command_str" |
+      grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
+      exit 0
+    fi
+    # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
+    # is a read and must stay allowed — the filename has to appear as the target
+    # of a redirection, a tee, or an in-place sed.
+    write_target='[^ |;&]*(agents|claude|copilot-instructions)\.md'
+    if printf '%s' "$command_str" |
+      grep -Eqi ">>?[[:space:]]*['\"]?$write_target|tee([[:space:]]+-[a-z]+)*[[:space:]]+['\"]?$write_target|sed[[:space:]]+[^|;&]*-i[^|;&]*$write_target"; then
+      refuse "$(printf '%s' "$command_str" |
+        grep -Eoi "$write_target" | head -1)"
+    fi
+    ;;
+esac
+
+exit 0

package/all/merge/.claude/settings.json

@@ -48,6 +48,15 @@
             "command": "bash \"$CLAUDE_PROJECT_DIR\"/scripts/lisa-enforcement-fallback.sh"
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR\"/scripts/lisa-enforcement-fallback.sh"
+          }
+        ]
       }
     ]
   }

package/dist/core/upstream-evidence-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0oEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAynNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}
+{"version":3,"file":"upstream-evidence-manifest.d.ts","sourceRoot":"","sources":["../../src/core/upstream-evidence-manifest.ts"],"names":[],"mappings":"AACA,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0pEpE,CAAC;AAEL,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAuqNjE,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAk6I/D,CAAC"}

package/dist/core/upstream-evidence-manifest.js

@@ -3,8 +3,9 @@
 export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-contents/.gitattributes": "9d3831007e681186a3673e1037ef3fc82980cab2fc04e27c0868e562912c9e9f",
     "all/copy-contents/gitignore": "2dbf7fd2f2020fc7824c432342002d9ca3ebb57b2872e761b14e942b23479a11",
-    "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "9cab71562d01421d57c6719318a4d03a6249a45c1aea434db3ff26e3065eeb66",
+    "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "a612f172282d13ba9318fe5e03689d7c6ff42a0122d0c9d5d39051e1967b93dc",
+    "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "8996e0bcbf1db085a5d99734e797c91f5025997bd967bc374efff8348dac14c2",
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "aa95a84f9f9224914947a09b858535aa8bd052199ff64cb53768cf78fb69b687",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "3b5f074f3ab5708030af507eea962389f3b067c5dbdc76580bd9e44d3ac6c603",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
@@ -17,7 +18,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/github-rulesets/base.json": "58b9606f185cdca8b17218829aac333b7d8c08f0f2b4f86d7e360f7be1de4787",
     "all/github-rulesets/prevent-delete.json": "e4fb26390a8bfee34b27be5b369f376a1a9a00b797fd8d3ce51cb71facb826a4",
     "all/github-rulesets/protect-tags.json": "387f824e3ea58a803223e42e08326504a39e6a7a0c650a0bbfdfb4653854b722",
-    "all/merge/.claude/settings.json": "4d41a745030e5f33eb4d4fe1f1b12268680f104ea55a30c4d9f55a6e22ad6fca",
+    "all/merge/.claude/settings.json": "c3ea6760913c0104350f731646fc5abd22122ce0a303c95536e7769f12294654",
     "cdk/copy-overwrite/.github/workflows/.keep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "cdk/copy-overwrite/eslint.cdk.ts": "074fe7a638ed95210339a9215abf75fa52bb10e678f2fd58523ff8a9d32ea4b6",
     "cdk/copy-overwrite/eslint.config.ts": "f1917ade3f1170ac8027110b44499732b9d9d3a2d42f256e37cd09930970298c",
@@ -284,6 +285,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/setup/notion.md": "2d705679db0dbb6c77728592a020430a529af9d0ef24ac7c434969d590d9f5a6",
     "plugins/src/base/commands/setup/remote-env.md": "b1e8ec93bc660cc5ccf9e4c74a3a7bb6c94d5ff06c75f150479991fa1d564f2d",
     "plugins/src/base/commands/setup/sonar.md": "1d2e94fd9f21988ce6d4be2ce4268b8c0bb020eb7cd7baf8ca65def7d8a4f5bc",
+    "plugins/src/base/commands/setup/workstation.md": "2da226aa1a7efea41735eeb58d61ad70896eccadc59765f86c971aa331d11358",
     "plugins/src/base/commands/sync-down.md": "4e974cb9745a4fd680f4a55f859d31fa8cf3cb28afa739b40a2e1a99de31e034",
     "plugins/src/base/commands/tear-down-automations.md": "969f28850326f0ceab5c09763266c60265951db30e88c738d2425ff82f088aac",
     "plugins/src/base/commands/track.md": "ae655031c3698f9bf449c4b9d8654cfab2586ca82164a710ae3f66be37c831fb",
@@ -292,6 +294,8 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/verify-workflow-change.md": "2d3e519ddf5292c8e10bed5190e9bcd701a48fed6a277e8ef7fb3bf8326315af",
     "plugins/src/base/commands/verify.md": "ffbc553ec86e77845da72b5b0eb0dbb2b5a93b781ac8a7dbb2ef0f31f38f7b96",
     "plugins/src/base/commands/wiki/install.md": "51392cf053c17edd549bfbaba5d19ce669dc79021aafa7cfa100324ad38de11f",
+    "plugins/src/base/hooks/block-instruction-file-edits.agy.sh": "aa249cae53caeb3e0fb6d6af114e2756084f45a2896332fb063a9f20e4902125",
+    "plugins/src/base/hooks/block-instruction-file-edits.sh": "8996e0bcbf1db085a5d99734e797c91f5025997bd967bc374efff8348dac14c2",
     "plugins/src/base/hooks/block-no-verify.agy.sh": "1a36c841b6339a2c664938d65c5a4542f97d05f584e467de448bb72ac6bdba55",
     "plugins/src/base/hooks/block-no-verify.sh": "aa95a84f9f9224914947a09b858535aa8bd052199ff64cb53768cf78fb69b687",
     "plugins/src/base/hooks/block-shell-json-parsing.agy.sh": "dc688efe382e7b8fe6f6c88bb0fde851527128cae778599559f23a93f1c9ec86",
@@ -578,6 +582,10 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": "cb98159f9432ce0c4f93a8b5386c61fc1b7d3a299bbb041d6bd005b790291277",
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": "82bc2a27a0a5afb2ff413a88365c619fd7f0eaada5de3ccabf2000938f0607a4",
     "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": "53fbd8acce4b5e47e88195a7b90d5be424fa6ef7ad872f52c50467c690664c3b",
+    "plugins/src/base/skills/lisa-setup-workstation/SKILL.md": "433168d83749709f9808fa0b45ff74e0944707a26fb0039d1de28ffaadaa8db1",
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/catalogue.mjs": "3fa13e7e2885aa5f3b4efdd12fc87958494a57d8bfeb81ab8489558592780b90",
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/cli.mjs": "cb64e501a6e8bf0b12fd865aa0be3407f54c5a08537a36dc71d2ead4764f5da0",
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/workstation.mjs": "8f9d066bb4c60095831c9549af89f9a8d49cc2bcadf37189982d276ad9270759",
     "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": "031acb01195ae59010a65335da98d46a1d6080e749823d6f6d157938d9e96648",
     "plugins/src/base/skills/lisa-spec-conformance/SKILL.md": "ed43ca160a8b4b6e8d226d459419f0c28f8036ba1b6d3c204255c965a3223c3b",
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": "c32e6a4e3115ca32b7d335e90d0a73b243c6c631a2d192568423be0cb5944e84",
@@ -961,7 +969,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "rails/deletions.json": "eeadf9a2b1677913199a235091a8d6190477f3e2a5fd598d62cf658cb59a8099",
     "rails/github-rulesets/quality-checks.json": "0ec1c366589edbaa6b8f45f940cef3ada5ed7b1a956d98d3fa6034b0f78fbc7c",
     "rails/merge/.claude/settings.json": "9c49f8c7c453f8749c90def3e22d412c3345c533d24b30dc7745ffa052ad6fa1",
-    "scripts/build-plugins.sh": "b57413e6e003be102e82e0a8a6b44a137f5d0aeed8da4c1f4f99919a0d7e8b04",
+    "scripts/build-plugins.sh": "d4332a862d57798280e0d0c96826bbdc6b07855659dae529f8de32de994d2da9",
     "scripts/check-duplicate-versions.mjs": "84d97e94eb834522848ddce951bb54ae9da1e4be252e2c51fed0c01c4f4d6b72",
     "scripts/check-learnings-budget.ts": "007430c2d6938efcc79ccbfd5717ebe2c7cf66b4de9a21a3e67b8db7f3600349",
     "scripts/check-plugins-sync.sh": "3a99cbff0e8ec5e7c944690eae003a6d51b51c85436d77bd37faea4d553728af",
@@ -979,7 +987,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/fix-namespace-test-assertions.mjs": "bfed6f27753660b38457c3f0a032a6c866691666d2d5d61fc10c3fb2f4f4f412",
     "scripts/fix-test-assertions-pass2.mjs": "baca043a291120ff52ce61c06397206dc21ca3bef9c23a5975b9c1f896d963c7",
     "scripts/fix-test-assertions.mjs": "59b5e8cc31e7c7323d20bd180f2ae97c08a9685758483b6fe00ba77317a845f2",
-    "scripts/generate-agy-plugin-artifacts.mjs": "bcecec726f2590036c57247d41eadf361b8613d827d93366e18b419bbd801346",
+    "scripts/generate-agy-plugin-artifacts.mjs": "0d9380e0533b2cd24ab418da64817a06672f0d12c9a7f648a3d57286d35c7983",
     "scripts/generate-codex-plugin-artifacts.mjs": "1d1a362afb8dba408741a3eed9fe583296f6bcb048608979f73f359cd609c03d",
     "scripts/generate-copilot-plugin-artifacts.mjs": "70d283eed7cb7c1351d13cf0497f06dec175562c5918921c404393a76f11278f",
     "scripts/generate-cursor-plugin-artifacts.mjs": "d8806197a723f0c2b50a8155ffc5b6f0abc30c68dc2385cb80b0dd066d061231",
@@ -993,11 +1001,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/internal-cursor-skill-policy.json": "c2ce87d2eeebfdc9f24d6486425c010cf9289376f8a459f4767ca22d2bf8670d",
     "scripts/internal-opencode-skill-policy.json": "d7191650d8a12727549b67df61dbfa61e16cfb9cc31e461cd98d253ceab1612a",
     "scripts/lib/nest-plugin-commands.mjs": "c52b2f48edbc17edcc60ae33536549829cbc279c60c5d85d912ac6609cae9bea",
-    "scripts/lib/per-agent-hook-filter.mjs": "2565e2cb414f253fa7fd014021120ec9760f4e716bf0ae69e5f7de09a5b966c1",
+    "scripts/lib/per-agent-hook-filter.mjs": "6038a4ebee750672042ba706269b8a4c1d9055cfd83c436364e2e40d6242dcd9",
     "scripts/lib/reusable-workflow-contract.d.mts": "791f01b55dd7a6b5d9a5f4cb9c44167caa146c2fc3c31a2ae4c2d8a350adc2f1",
     "scripts/lib/reusable-workflow-contract.mjs": "134ee2a327290f066f1eb318b5ed53c711557c3e10ed462c00ff5c97cfb20863",
     "scripts/lisa-commit-and-pr-local.sh": "605409c3ce6ec38ad3275604291a1ceae98f7807a605654263bc14f811c03903",
-    "scripts/lisa-enforcement-fallback.sh": "9cab71562d01421d57c6719318a4d03a6249a45c1aea434db3ff26e3065eeb66",
+    "scripts/lisa-enforcement-fallback.sh": "e17c45f7cadf0fb55dd07270776caf211af99b7d4771a4fde75aafe5919e8dbe",
     "scripts/lisa-github-environments.sh": "0a76e92f108519abaf3e29991299ec3b0db20ea533e69e6d2a53d802dba9c370",
     "scripts/lisa-github-repo-settings.sh": "4afbccdfb08c62ba13afee42ec8561a28facf87c61f6f4b80000115328364d54",
     "scripts/lisa-github-repo-setup.sh": "dc2f1c9d718aa34ba57161120d9319b5f78fe6b0b496d8e3c77226a08795aa36",
@@ -1244,6 +1252,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "all/copy-contents/gitignore": true,
     "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": true,
     "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": true,
+    "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": true,
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": true,
@@ -2010,6 +2019,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-agy/commands/lisa/setup/notion.md": true,
     "plugins/lisa-agy/commands/lisa/setup/remote-env.md": true,
     "plugins/lisa-agy/commands/lisa/setup/sonar.md": true,
+    "plugins/lisa-agy/commands/lisa/setup/workstation.md": true,
     "plugins/lisa-agy/commands/lisa/sync-down.md": true,
     "plugins/lisa-agy/commands/lisa/tear-down-automations.md": true,
     "plugins/lisa-agy/commands/lisa/track.md": true,
@@ -2019,6 +2029,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-agy/commands/lisa/verify.md": true,
     "plugins/lisa-agy/commands/lisa/wiki/install.md": true,
     "plugins/lisa-agy/hooks.json": true,
+    "plugins/lisa-agy/hooks/block-instruction-file-edits.agy.sh": true,
+    "plugins/lisa-agy/hooks/block-instruction-file-edits.sh": true,
     "plugins/lisa-agy/hooks/block-no-verify.agy.sh": true,
     "plugins/lisa-agy/hooks/block-shell-json-parsing.agy.sh": true,
     "plugins/lisa-agy/hooks/block-shell-json-parsing.sh": true,
@@ -2213,6 +2225,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/toolchain.mjs": true,
     "plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/lisa-agy/skills/lisa-setup-sonar/SKILL.md": true,
+    "plugins/lisa-agy/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/lisa-agy/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/lisa-agy/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/lisa-agy/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/lisa-agy/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/lisa-agy/skills/lisa-spec-conformance/SKILL.md": true,
     "plugins/lisa-agy/skills/lisa-sync-down/SKILL.md": true,
@@ -2350,6 +2366,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/commands/lisa/setup/notion.md": true,
     "plugins/lisa-copilot/commands/lisa/setup/remote-env.md": true,
     "plugins/lisa-copilot/commands/lisa/setup/sonar.md": true,
+    "plugins/lisa-copilot/commands/lisa/setup/workstation.md": true,
     "plugins/lisa-copilot/commands/lisa/sync-down.md": true,
     "plugins/lisa-copilot/commands/lisa/tear-down-automations.md": true,
     "plugins/lisa-copilot/commands/lisa/track.md": true,
@@ -2358,6 +2375,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/commands/lisa/verify-workflow-change.md": true,
     "plugins/lisa-copilot/commands/lisa/verify.md": true,
     "plugins/lisa-copilot/commands/lisa/wiki/install.md": true,
+    "plugins/lisa-copilot/hooks/block-instruction-file-edits.sh": true,
     "plugins/lisa-copilot/hooks/block-no-verify.sh": true,
     "plugins/lisa-copilot/hooks/block-shell-json-parsing.sh": true,
     "plugins/lisa-copilot/hooks/cleanup-stale-worktrees.sh": true,
@@ -2635,6 +2653,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/toolchain.mjs": true,
     "plugins/lisa-copilot/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/lisa-copilot/skills/lisa-setup-sonar/SKILL.md": true,
+    "plugins/lisa-copilot/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/lisa-copilot/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/lisa-copilot/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/lisa-copilot/skills/lisa-spec-conformance/SKILL.md": true,
     "plugins/lisa-copilot/skills/lisa-sync-down/SKILL.md": true,
@@ -2757,6 +2779,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/commands/lisa/setup/notion.md": true,
     "plugins/lisa-cursor/commands/lisa/setup/remote-env.md": true,
     "plugins/lisa-cursor/commands/lisa/setup/sonar.md": true,
+    "plugins/lisa-cursor/commands/lisa/setup/workstation.md": true,
     "plugins/lisa-cursor/commands/lisa/sync-down.md": true,
     "plugins/lisa-cursor/commands/lisa/tear-down-automations.md": true,
     "plugins/lisa-cursor/commands/lisa/track.md": true,
@@ -2765,6 +2788,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/commands/lisa/verify-workflow-change.md": true,
     "plugins/lisa-cursor/commands/lisa/verify.md": true,
     "plugins/lisa-cursor/commands/lisa/wiki/install.md": true,
+    "plugins/lisa-cursor/hooks/block-instruction-file-edits.sh": true,
     "plugins/lisa-cursor/hooks/block-no-verify.sh": true,
     "plugins/lisa-cursor/hooks/block-shell-json-parsing.sh": true,
     "plugins/lisa-cursor/hooks/cleanup-stale-worktrees.sh": true,
@@ -3043,6 +3067,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/toolchain.mjs": true,
     "plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/lisa-cursor/skills/lisa-setup-sonar/SKILL.md": true,
+    "plugins/lisa-cursor/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/lisa-cursor/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/lisa-cursor/skills/lisa-spec-conformance/SKILL.md": true,
     "plugins/lisa-cursor/skills/lisa-sync-down/SKILL.md": true,
@@ -5084,6 +5112,11 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/lisa/.codex-plugin/skills/lisa-setup-sonar/SKILL.md": true,
     "plugins/lisa/.codex-plugin/skills/lisa-setup-sonar/agents/openai.yaml": true,
+    "plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/agents/openai.yaml": true,
+    "plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/lisa/.codex-plugin/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/lisa/.codex-plugin/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/lisa/.codex-plugin/skills/lisa-sonarcloud-access/agents/openai.yaml": true,
     "plugins/lisa/.codex-plugin/skills/lisa-spec-conformance/SKILL.md": true,
@@ -5236,6 +5269,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/commands/setup/notion.md": true,
     "plugins/lisa/commands/setup/remote-env.md": true,
     "plugins/lisa/commands/setup/sonar.md": true,
+    "plugins/lisa/commands/setup/workstation.md": true,
     "plugins/lisa/commands/sync-down.md": true,
     "plugins/lisa/commands/tear-down-automations.md": true,
     "plugins/lisa/commands/track.md": true,
@@ -5244,6 +5278,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/commands/verify-workflow-change.md": true,
     "plugins/lisa/commands/verify.md": true,
     "plugins/lisa/commands/wiki/install.md": true,
+    "plugins/lisa/hooks/block-instruction-file-edits.agy.sh": true,
+    "plugins/lisa/hooks/block-instruction-file-edits.sh": true,
     "plugins/lisa/hooks/block-no-verify.agy.sh": true,
     "plugins/lisa/hooks/block-no-verify.sh": true,
     "plugins/lisa/hooks/block-shell-json-parsing.agy.sh": true,
@@ -5670,6 +5706,11 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/lisa/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/lisa/skills/lisa-setup-sonar/SKILL.md": true,
     "plugins/lisa/skills/lisa-setup-sonar/agents/openai.yaml": true,
+    "plugins/lisa/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/lisa/skills/lisa-setup-workstation/agents/openai.yaml": true,
+    "plugins/lisa/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/lisa/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/lisa/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/lisa/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/lisa/skills/lisa-sonarcloud-access/agents/openai.yaml": true,
     "plugins/lisa/skills/lisa-spec-conformance/SKILL.md": true,
@@ -5822,6 +5863,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/setup/notion.md": true,
     "plugins/src/base/commands/setup/remote-env.md": true,
     "plugins/src/base/commands/setup/sonar.md": true,
+    "plugins/src/base/commands/setup/workstation.md": true,
     "plugins/src/base/commands/sync-down.md": true,
     "plugins/src/base/commands/tear-down-automations.md": true,
     "plugins/src/base/commands/track.md": true,
@@ -5830,6 +5872,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/commands/verify-workflow-change.md": true,
     "plugins/src/base/commands/verify.md": true,
     "plugins/src/base/commands/wiki/install.md": true,
+    "plugins/src/base/hooks/block-instruction-file-edits.agy.sh": true,
+    "plugins/src/base/hooks/block-instruction-file-edits.sh": true,
     "plugins/src/base/hooks/block-no-verify.agy.sh": true,
     "plugins/src/base/hooks/block-no-verify.sh": true,
     "plugins/src/base/hooks/block-shell-json-parsing.agy.sh": true,
@@ -6116,6 +6160,10 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/toolchain.mjs": true,
     "plugins/src/base/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs": true,
     "plugins/src/base/skills/lisa-setup-sonar/SKILL.md": true,
+    "plugins/src/base/skills/lisa-setup-workstation/SKILL.md": true,
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/catalogue.mjs": true,
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/cli.mjs": true,
+    "plugins/src/base/skills/lisa-setup-workstation/scripts/workstation.mjs": true,
     "plugins/src/base/skills/lisa-sonarcloud-access/SKILL.md": true,
     "plugins/src/base/skills/lisa-spec-conformance/SKILL.md": true,
     "plugins/src/base/skills/lisa-sync-down/SKILL.md": true,
@@ -6874,6 +6922,8 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "src/opencode/hooks-installer.ts": true,
     "src/opencode/manifest.ts": true,
     "src/opencode/mcp-installer.ts": true,
+    "src/opencode/plugin-catalog.ts": true,
+    "src/opencode/plugin-templates/lisa-block-instruction-file-edits.ts": true,
     "src/opencode/plugin-templates/lisa-block-migration-edits.ts": true,
     "src/opencode/plugin-templates/lisa-block-suppress-directives.ts": true,
     "src/opencode/plugin-templates/lisa-lint-on-edit.ts": true,
@@ -7228,6 +7278,7 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/health/package-surfaces.test.ts": true,
     "tests/unit/health/storage.test.ts": true,
     "tests/unit/hooks/block-generated-artifact-edits.test.ts": true,
+    "tests/unit/hooks/block-instruction-file-edits.test.ts": true,
     "tests/unit/hooks/block-no-verify.test.ts": true,
     "tests/unit/hooks/block-shell-json-parsing.test.ts": true,
     "tests/unit/hooks/blocking-hook-exit.test.ts": true,
@@ -7544,6 +7595,9 @@ export const UPSTREAM_SURFACE_MANIFEST = Object.freeze({
     "tests/unit/utils/usage-accounting-table-normalization.test.ts": true,
     "tests/unit/utils/usage-accounting-token-serialization.test.ts": true,
     "tests/unit/utils/usage-accounting.test.ts": true,
+    "tests/unit/workstation/fixtures.ts": true,
+    "tests/unit/workstation/workstation-install.test.ts": true,
+    "tests/unit/workstation/workstation-plan.test.ts": true,
     "transcripts/.gitkeep": true,
     "tsconfig.eslint.json": true,
     "tsconfig.json": true,