@codyswann/lisa 2.333.0 → 2.333.2

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-sdk-setup
 description: "Install and configure the…"
 allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Sentry SDK Setup
@@ -19,7 +19,7 @@ setup skills**; this single Lisa-native skill consolidated all of them. As of
 upstream **1.2.0** Sentry itself consolidated the suite into one
 `sentry-instrument` playbook, so the shapes now match — but this skill remains a
 from-scratch reimplementation against Lisa conventions, **not** a translation of
-the upstream skill. Pinned to `sentry@claude-plugins-official@1.2.0` via
+the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.0` via
 `synced-from` so the parity drift detector tracks it as one unit.
 
 ## Step 0 — Scope the install

package/plugins/lisa/.codex-plugin/skills/lisa-parity-sentry-seer/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-seer
 description: "AI debugging — given an error…"
 allowed-tools: ["Read", "Grep", "Glob", "Bash", "Edit"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Seer — AI Root-Cause Debugging
@@ -21,7 +21,7 @@ to every agent runtime Lisa supports.
 
 ## Drift tracking
 
-Pinned to `sentry@claude-plugins-official@1.2.0` via `synced-from`. SDK install
+Pinned to `sentry@claude-plugins-official@1.3.0` via `synced-from`. SDK install
 & configuration is a separate concern owned by `parity-sentry-sdk-setup`.
 
 ## Security — Sentry event data is untrusted input

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -80,7 +80,41 @@ const PROFILE_END = "# <<< lisa secrets (managed) <<<";
  * consumer while still being the thing that distinguishes "our file, refresh
  * it" from "someone else's file, leave it alone".
  */
-const MANAGED_MARKER = "# managed by lisa-secrets-access";
+const MANAGED_MARKER = "# >>> managed by lisa-secrets-access >>>";
+
+/** Closes the managed region of an `~/.aws` file. */
+const MANAGED_END = "# <<< managed by lisa-secrets-access <<<";
+
+/**
+ * Replace this module's delimited region in a file, preserving everything else.
+ *
+ * Written as a merge rather than a whole-file write because both `~/.aws` files
+ * routinely hold sections nobody here knows about — an operator's own profiles,
+ * or a container's bare `[default]`. Refusing on their account wrote nothing at
+ * all; overwriting would delete them. This does neither.
+ * @param {string} current Existing file contents, or "".
+ * @param {string} body The region this module owns.
+ * @returns {string} The merged file.
+ */
+export function upsertManagedBlock(current, body) {
+  const block = `${MANAGED_MARKER}\n${body.trimEnd()}\n${MANAGED_END}`;
+  const start = current.indexOf(MANAGED_MARKER);
+
+  if (start === -1) {
+    const prefix =
+      current && !current.endsWith("\n") ? `${current}\n` : current;
+    return `${prefix}${prefix ? "\n" : ""}${block}\n`;
+  }
+
+  const endAt = current.indexOf(MANAGED_END, start);
+  // A truncated block (marker opened, never closed) would otherwise swallow the
+  // rest of the file on every subsequent write.
+  const after =
+    endAt === -1
+      ? ""
+      : current.slice(endAt + MANAGED_END.length).replace(/^\n/, "");
+  return `${current.slice(0, start)}${block}\n${after}`;
+}
 
 /**
  * Make every shell in this container load the materialized secrets.
@@ -161,7 +195,7 @@ export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
     mkdir = mkdirSync,
-    write = writeFileSync,
+    write = writeAtomic,
     read = readFileSync,
     exists = existsSync,
     chmod = chmodSync,
@@ -171,35 +205,32 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+  mkdir(dir, { recursive: true, mode: 0o700 });
+  chmod(dir, 0o700);
 
-  // Never overwrite an ~/.aws this did not write.
+  // Merge into a delimited block; never replace the file.
+  //
+  // Refusing whole files whenever one already existed sounded safe and was
+  // worse than useless: a container ships `~/.aws/config` containing a bare
+  // `[default]`, so the guard fired every time, wrote nothing, and returned
+  // silently — while AWS_PROFILE was still derived from the bundle. The session
+  // got a pointer to a profile that did not exist:
+  //
+  //     The config profile (agent-dev) could not be found
   //
-  // These are whole-file writes, so a pre-existing credentials file — a
-  // developer's own profiles, or something another tool set up — would be
-  // destroyed rather than merged. This only runs on a surface allowed to write
-  // secrets to disk (a disposable container), but "usually disposable" is not a
-  // reason to be able to delete someone's credentials. The marker makes our own
-  // file re-writable while anything else is left alone and reported.
-  for (const name of ["credentials", "config"]) {
+  // Merging keeps the operator's own sections intact AND writes ours, which is
+  // what the guard was actually for. Same delimited-block approach as the shell
+  // profile, and `#` is a comment in the shared-config format so the markers are
+  // inert to every consumer.
+  for (const [name, body] of [
+    ["credentials", rendered.credentials],
+    ["config", rendered.config],
+  ]) {
     const file = join(dir, name);
-    if (exists(file) && !String(read(file, "utf8")).includes(MANAGED_MARKER)) {
-      return [];
-    }
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+    write(file, upsertManagedBlock(current, body));
   }
 
-  mkdir(dir, { recursive: true, mode: 0o700 });
-  chmod(dir, 0o700);
-  write(
-    join(dir, "credentials"),
-    `${MANAGED_MARKER}\n${rendered.credentials}`,
-    {
-      mode: 0o600,
-    }
-  );
-  write(join(dir, "config"), `${MANAGED_MARKER}\n${rendered.config}`, {
-    mode: 0o600,
-  });
-
   return rendered.profiles;
 }
 

package/plugins/lisa/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-sdk-setup
 description: "Install and configure the Sentry SDK for a project — detect the framework/runtime, add the correct @sentry/<framework> package, initialize the client, wire the DSN through env, enable error + performance monitoring, and set up source map upload for readable stack traces. One consolidated skill covering react, nextjs, node, nestjs, express, python, django, react-native, and more. Lisa-native reimplementation of Sentry's SDK-setup suite. Use when adding Sentry to a project or fixing an existing Sentry install."
 allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Sentry SDK Setup
@@ -19,7 +19,7 @@ setup skills**; this single Lisa-native skill consolidated all of them. As of
 upstream **1.2.0** Sentry itself consolidated the suite into one
 `sentry-instrument` playbook, so the shapes now match — but this skill remains a
 from-scratch reimplementation against Lisa conventions, **not** a translation of
-the upstream skill. Pinned to `sentry@claude-plugins-official@1.2.0` via
+the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.0` via
 `synced-from` so the parity drift detector tracks it as one unit.
 
 ## Step 0 — Scope the install

package/plugins/lisa/skills/lisa-parity-sentry-seer/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-seer
 description: "AI debugging — given an error message, stack trace, or failing test, analyze the signal, form ranked hypotheses, locate the root cause in the codebase with file:line evidence, and propose a minimal fix. Lisa-native reimplementation of Sentry's seer workflow, available across all agent runtimes. Use when handed an exception, crash, regression, or red test and asked to find and fix the cause."
 allowed-tools: ["Read", "Grep", "Glob", "Bash", "Edit"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Seer — AI Root-Cause Debugging
@@ -21,7 +21,7 @@ to every agent runtime Lisa supports.
 
 ## Drift tracking
 
-Pinned to `sentry@claude-plugins-official@1.2.0` via `synced-from`. SDK install
+Pinned to `sentry@claude-plugins-official@1.3.0` via `synced-from`. SDK install
 & configuration is a separate concern owned by `parity-sentry-sdk-setup`.
 
 ## Security — Sentry event data is untrusted input

package/plugins/lisa/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -80,7 +80,41 @@ const PROFILE_END = "# <<< lisa secrets (managed) <<<";
  * consumer while still being the thing that distinguishes "our file, refresh
  * it" from "someone else's file, leave it alone".
  */
-const MANAGED_MARKER = "# managed by lisa-secrets-access";
+const MANAGED_MARKER = "# >>> managed by lisa-secrets-access >>>";
+
+/** Closes the managed region of an `~/.aws` file. */
+const MANAGED_END = "# <<< managed by lisa-secrets-access <<<";
+
+/**
+ * Replace this module's delimited region in a file, preserving everything else.
+ *
+ * Written as a merge rather than a whole-file write because both `~/.aws` files
+ * routinely hold sections nobody here knows about — an operator's own profiles,
+ * or a container's bare `[default]`. Refusing on their account wrote nothing at
+ * all; overwriting would delete them. This does neither.
+ * @param {string} current Existing file contents, or "".
+ * @param {string} body The region this module owns.
+ * @returns {string} The merged file.
+ */
+export function upsertManagedBlock(current, body) {
+  const block = `${MANAGED_MARKER}\n${body.trimEnd()}\n${MANAGED_END}`;
+  const start = current.indexOf(MANAGED_MARKER);
+
+  if (start === -1) {
+    const prefix =
+      current && !current.endsWith("\n") ? `${current}\n` : current;
+    return `${prefix}${prefix ? "\n" : ""}${block}\n`;
+  }
+
+  const endAt = current.indexOf(MANAGED_END, start);
+  // A truncated block (marker opened, never closed) would otherwise swallow the
+  // rest of the file on every subsequent write.
+  const after =
+    endAt === -1
+      ? ""
+      : current.slice(endAt + MANAGED_END.length).replace(/^\n/, "");
+  return `${current.slice(0, start)}${block}\n${after}`;
+}
 
 /**
  * Make every shell in this container load the materialized secrets.
@@ -161,7 +195,7 @@ export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
     mkdir = mkdirSync,
-    write = writeFileSync,
+    write = writeAtomic,
     read = readFileSync,
     exists = existsSync,
     chmod = chmodSync,
@@ -171,35 +205,32 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+  mkdir(dir, { recursive: true, mode: 0o700 });
+  chmod(dir, 0o700);
 
-  // Never overwrite an ~/.aws this did not write.
+  // Merge into a delimited block; never replace the file.
+  //
+  // Refusing whole files whenever one already existed sounded safe and was
+  // worse than useless: a container ships `~/.aws/config` containing a bare
+  // `[default]`, so the guard fired every time, wrote nothing, and returned
+  // silently — while AWS_PROFILE was still derived from the bundle. The session
+  // got a pointer to a profile that did not exist:
+  //
+  //     The config profile (agent-dev) could not be found
   //
-  // These are whole-file writes, so a pre-existing credentials file — a
-  // developer's own profiles, or something another tool set up — would be
-  // destroyed rather than merged. This only runs on a surface allowed to write
-  // secrets to disk (a disposable container), but "usually disposable" is not a
-  // reason to be able to delete someone's credentials. The marker makes our own
-  // file re-writable while anything else is left alone and reported.
-  for (const name of ["credentials", "config"]) {
+  // Merging keeps the operator's own sections intact AND writes ours, which is
+  // what the guard was actually for. Same delimited-block approach as the shell
+  // profile, and `#` is a comment in the shared-config format so the markers are
+  // inert to every consumer.
+  for (const [name, body] of [
+    ["credentials", rendered.credentials],
+    ["config", rendered.config],
+  ]) {
     const file = join(dir, name);
-    if (exists(file) && !String(read(file, "utf8")).includes(MANAGED_MARKER)) {
-      return [];
-    }
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+    write(file, upsertManagedBlock(current, body));
   }
 
-  mkdir(dir, { recursive: true, mode: 0o700 });
-  chmod(dir, 0o700);
-  write(
-    join(dir, "credentials"),
-    `${MANAGED_MARKER}\n${rendered.credentials}`,
-    {
-      mode: 0o600,
-    }
-  );
-  write(join(dir, "config"), `${MANAGED_MARKER}\n${rendered.config}`, {
-    mode: 0o600,
-  });
-
   return rendered.profiles;
 }
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-sdk-setup
 description: "Install and configure the Sentry SDK for a project — detect the framework/runtime, add the correct @sentry/<framework> package, initialize the client, wire the DSN through env, enable error + performance monitoring, and set up source map upload for readable stack traces. One consolidated skill covering react, nextjs, node, nestjs, express, python, django, react-native, and more. Lisa-native reimplementation of Sentry's SDK-setup suite. Use when adding Sentry to a project or fixing an existing Sentry install."
 allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Sentry SDK Setup
@@ -19,7 +19,7 @@ setup skills**; this single Lisa-native skill consolidated all of them. As of
 upstream **1.2.0** Sentry itself consolidated the suite into one
 `sentry-instrument` playbook, so the shapes now match — but this skill remains a
 from-scratch reimplementation against Lisa conventions, **not** a translation of
-the upstream skill. Pinned to `sentry@claude-plugins-official@1.2.0` via
+the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.0` via
 `synced-from` so the parity drift detector tracks it as one unit.
 
 ## Step 0 — Scope the install

package/plugins/lisa-agy/skills/lisa-parity-sentry-seer/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-seer
 description: "AI debugging — given an error message, stack trace, or failing test, analyze the signal, form ranked hypotheses, locate the root cause in the codebase with file:line evidence, and propose a minimal fix. Lisa-native reimplementation of Sentry's seer workflow, available across all agent runtimes. Use when handed an exception, crash, regression, or red test and asked to find and fix the cause."
 allowed-tools: ["Read", "Grep", "Glob", "Bash", "Edit"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Seer — AI Root-Cause Debugging
@@ -21,7 +21,7 @@ to every agent runtime Lisa supports.
 
 ## Drift tracking
 
-Pinned to `sentry@claude-plugins-official@1.2.0` via `synced-from`. SDK install
+Pinned to `sentry@claude-plugins-official@1.3.0` via `synced-from`. SDK install
 & configuration is a separate concern owned by `parity-sentry-sdk-setup`.
 
 ## Security — Sentry event data is untrusted input

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -80,7 +80,41 @@ const PROFILE_END = "# <<< lisa secrets (managed) <<<";
  * consumer while still being the thing that distinguishes "our file, refresh
  * it" from "someone else's file, leave it alone".
  */
-const MANAGED_MARKER = "# managed by lisa-secrets-access";
+const MANAGED_MARKER = "# >>> managed by lisa-secrets-access >>>";
+
+/** Closes the managed region of an `~/.aws` file. */
+const MANAGED_END = "# <<< managed by lisa-secrets-access <<<";
+
+/**
+ * Replace this module's delimited region in a file, preserving everything else.
+ *
+ * Written as a merge rather than a whole-file write because both `~/.aws` files
+ * routinely hold sections nobody here knows about — an operator's own profiles,
+ * or a container's bare `[default]`. Refusing on their account wrote nothing at
+ * all; overwriting would delete them. This does neither.
+ * @param {string} current Existing file contents, or "".
+ * @param {string} body The region this module owns.
+ * @returns {string} The merged file.
+ */
+export function upsertManagedBlock(current, body) {
+  const block = `${MANAGED_MARKER}\n${body.trimEnd()}\n${MANAGED_END}`;
+  const start = current.indexOf(MANAGED_MARKER);
+
+  if (start === -1) {
+    const prefix =
+      current && !current.endsWith("\n") ? `${current}\n` : current;
+    return `${prefix}${prefix ? "\n" : ""}${block}\n`;
+  }
+
+  const endAt = current.indexOf(MANAGED_END, start);
+  // A truncated block (marker opened, never closed) would otherwise swallow the
+  // rest of the file on every subsequent write.
+  const after =
+    endAt === -1
+      ? ""
+      : current.slice(endAt + MANAGED_END.length).replace(/^\n/, "");
+  return `${current.slice(0, start)}${block}\n${after}`;
+}
 
 /**
  * Make every shell in this container load the materialized secrets.
@@ -161,7 +195,7 @@ export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
     mkdir = mkdirSync,
-    write = writeFileSync,
+    write = writeAtomic,
     read = readFileSync,
     exists = existsSync,
     chmod = chmodSync,
@@ -171,35 +205,32 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+  mkdir(dir, { recursive: true, mode: 0o700 });
+  chmod(dir, 0o700);
 
-  // Never overwrite an ~/.aws this did not write.
+  // Merge into a delimited block; never replace the file.
+  //
+  // Refusing whole files whenever one already existed sounded safe and was
+  // worse than useless: a container ships `~/.aws/config` containing a bare
+  // `[default]`, so the guard fired every time, wrote nothing, and returned
+  // silently — while AWS_PROFILE was still derived from the bundle. The session
+  // got a pointer to a profile that did not exist:
+  //
+  //     The config profile (agent-dev) could not be found
   //
-  // These are whole-file writes, so a pre-existing credentials file — a
-  // developer's own profiles, or something another tool set up — would be
-  // destroyed rather than merged. This only runs on a surface allowed to write
-  // secrets to disk (a disposable container), but "usually disposable" is not a
-  // reason to be able to delete someone's credentials. The marker makes our own
-  // file re-writable while anything else is left alone and reported.
-  for (const name of ["credentials", "config"]) {
+  // Merging keeps the operator's own sections intact AND writes ours, which is
+  // what the guard was actually for. Same delimited-block approach as the shell
+  // profile, and `#` is a comment in the shared-config format so the markers are
+  // inert to every consumer.
+  for (const [name, body] of [
+    ["credentials", rendered.credentials],
+    ["config", rendered.config],
+  ]) {
     const file = join(dir, name);
-    if (exists(file) && !String(read(file, "utf8")).includes(MANAGED_MARKER)) {
-      return [];
-    }
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+    write(file, upsertManagedBlock(current, body));
   }
 
-  mkdir(dir, { recursive: true, mode: 0o700 });
-  chmod(dir, 0o700);
-  write(
-    join(dir, "credentials"),
-    `${MANAGED_MARKER}\n${rendered.credentials}`,
-    {
-      mode: 0o600,
-    }
-  );
-  write(join(dir, "config"), `${MANAGED_MARKER}\n${rendered.config}`, {
-    mode: 0o600,
-  });
-
   return rendered.profiles;
 }
 

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.333.0",
+  "version": "2.333.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-sdk-setup
 description: "Install and configure the Sentry SDK for a project — detect the framework/runtime, add the correct @sentry/<framework> package, initialize the client, wire the DSN through env, enable error + performance monitoring, and set up source map upload for readable stack traces. One consolidated skill covering react, nextjs, node, nestjs, express, python, django, react-native, and more. Lisa-native reimplementation of Sentry's SDK-setup suite. Use when adding Sentry to a project or fixing an existing Sentry install."
 allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Sentry SDK Setup
@@ -19,7 +19,7 @@ setup skills**; this single Lisa-native skill consolidated all of them. As of
 upstream **1.2.0** Sentry itself consolidated the suite into one
 `sentry-instrument` playbook, so the shapes now match — but this skill remains a
 from-scratch reimplementation against Lisa conventions, **not** a translation of
-the upstream skill. Pinned to `sentry@claude-plugins-official@1.2.0` via
+the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.0` via
 `synced-from` so the parity drift detector tracks it as one unit.
 
 ## Step 0 — Scope the install

package/plugins/lisa-copilot/skills/lisa-parity-sentry-seer/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-seer
 description: "AI debugging — given an error message, stack trace, or failing test, analyze the signal, form ranked hypotheses, locate the root cause in the codebase with file:line evidence, and propose a minimal fix. Lisa-native reimplementation of Sentry's seer workflow, available across all agent runtimes. Use when handed an exception, crash, regression, or red test and asked to find and fix the cause."
 allowed-tools: ["Read", "Grep", "Glob", "Bash", "Edit"]
-synced-from: sentry@claude-plugins-official@1.2.0
+synced-from: sentry@claude-plugins-official@1.3.0
 ---
 
 # Seer — AI Root-Cause Debugging
@@ -21,7 +21,7 @@ to every agent runtime Lisa supports.
 
 ## Drift tracking
 
-Pinned to `sentry@claude-plugins-official@1.2.0` via `synced-from`. SDK install
+Pinned to `sentry@claude-plugins-official@1.3.0` via `synced-from`. SDK install
 & configuration is a separate concern owned by `parity-sentry-sdk-setup`.
 
 ## Security — Sentry event data is untrusted input