@codyswann/lisa 2.333.1 → 2.333.3

package/plugins/lisa-cursor/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -14,9 +14,18 @@ merges" loop. Other skills delegate here instead of re-implementing it. Runs
 
 - `pr=<number|url>` — the PR to drive. Default: the PR for the current branch
   (`gh pr view --json number,url,baseRefName,headRefName,state`).
-- `merge_method=<merge|rebase>` — strategy for both auto-merge and the direct-merge
-  fallback. Default `merge`. **Never squash** — squashing flattens
-  `chore(release): X.Y.Z [skip ci]` commits and breaks release promotion detection.
+- `merge_method=<merge>` — strategy for both auto-merge and the direct-merge
+  fallback. Default and only accepted value: `merge`.
+  - **Never squash** — squashing flattens `chore(release): X.Y.Z [skip ci]`
+    commits and breaks release promotion detection.
+  - **Never rebase.** REJECT `merge_method=rebase` up front with a clear message
+    rather than accepting it and verifying it wrongly. GitHub's rebase-and-merge
+    rewrites the commits — new SHAs — and creates no merge commit, so the
+    shipped-verification in section 3 cannot succeed: `verify_commit` is the
+    pre-rebase SHA and is not an ancestor of the base branch afterwards, and the
+    merge-parent assertion has nothing to assert against. A successful merge
+    would then report as a FAILED verification and drive a false fix-forward,
+    which is worse than refusing the input. See CodySwannGT/lisa#2316.
 - `verify_commit=<sha>` — the commit that MUST end up in the merged base (for the
   ancestry check). Default: the PR head at the time this skill starts.
 - `auto_merge=<true|false>` — whether this skill is allowed to merge the PR at

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs

@@ -80,7 +80,41 @@ const PROFILE_END = "# <<< lisa secrets (managed) <<<";
  * consumer while still being the thing that distinguishes "our file, refresh
  * it" from "someone else's file, leave it alone".
  */
-const MANAGED_MARKER = "# managed by lisa-secrets-access";
+const MANAGED_MARKER = "# >>> managed by lisa-secrets-access >>>";
+
+/** Closes the managed region of an `~/.aws` file. */
+const MANAGED_END = "# <<< managed by lisa-secrets-access <<<";
+
+/**
+ * Replace this module's delimited region in a file, preserving everything else.
+ *
+ * Written as a merge rather than a whole-file write because both `~/.aws` files
+ * routinely hold sections nobody here knows about — an operator's own profiles,
+ * or a container's bare `[default]`. Refusing on their account wrote nothing at
+ * all; overwriting would delete them. This does neither.
+ * @param {string} current Existing file contents, or "".
+ * @param {string} body The region this module owns.
+ * @returns {string} The merged file.
+ */
+export function upsertManagedBlock(current, body) {
+  const block = `${MANAGED_MARKER}\n${body.trimEnd()}\n${MANAGED_END}`;
+  const start = current.indexOf(MANAGED_MARKER);
+
+  if (start === -1) {
+    const prefix =
+      current && !current.endsWith("\n") ? `${current}\n` : current;
+    return `${prefix}${prefix ? "\n" : ""}${block}\n`;
+  }
+
+  const endAt = current.indexOf(MANAGED_END, start);
+  // A truncated block (marker opened, never closed) would otherwise swallow the
+  // rest of the file on every subsequent write.
+  const after =
+    endAt === -1
+      ? ""
+      : current.slice(endAt + MANAGED_END.length).replace(/^\n/, "");
+  return `${current.slice(0, start)}${block}\n${after}`;
+}
 
 /**
  * Make every shell in this container load the materialized secrets.
@@ -161,7 +195,7 @@ export function installAwsProfiles(bundle, options = {}) {
   const {
     home = process.env.HOME || homedir(),
     mkdir = mkdirSync,
-    write = writeFileSync,
+    write = writeAtomic,
     read = readFileSync,
     exists = existsSync,
     chmod = chmodSync,
@@ -171,35 +205,32 @@ export function installAwsProfiles(bundle, options = {}) {
   if (!rendered) return [];
 
   const dir = join(home, ".aws");
+  mkdir(dir, { recursive: true, mode: 0o700 });
+  chmod(dir, 0o700);
 
-  // Never overwrite an ~/.aws this did not write.
+  // Merge into a delimited block; never replace the file.
+  //
+  // Refusing whole files whenever one already existed sounded safe and was
+  // worse than useless: a container ships `~/.aws/config` containing a bare
+  // `[default]`, so the guard fired every time, wrote nothing, and returned
+  // silently — while AWS_PROFILE was still derived from the bundle. The session
+  // got a pointer to a profile that did not exist:
+  //
+  //     The config profile (agent-dev) could not be found
   //
-  // These are whole-file writes, so a pre-existing credentials file — a
-  // developer's own profiles, or something another tool set up — would be
-  // destroyed rather than merged. This only runs on a surface allowed to write
-  // secrets to disk (a disposable container), but "usually disposable" is not a
-  // reason to be able to delete someone's credentials. The marker makes our own
-  // file re-writable while anything else is left alone and reported.
-  for (const name of ["credentials", "config"]) {
+  // Merging keeps the operator's own sections intact AND writes ours, which is
+  // what the guard was actually for. Same delimited-block approach as the shell
+  // profile, and `#` is a comment in the shared-config format so the markers are
+  // inert to every consumer.
+  for (const [name, body] of [
+    ["credentials", rendered.credentials],
+    ["config", rendered.config],
+  ]) {
     const file = join(dir, name);
-    if (exists(file) && !String(read(file, "utf8")).includes(MANAGED_MARKER)) {
-      return [];
-    }
+    const current = exists(file) ? String(read(file, "utf8")) : "";
+    write(file, upsertManagedBlock(current, body));
   }
 
-  mkdir(dir, { recursive: true, mode: 0o700 });
-  chmod(dir, 0o700);
-  write(
-    join(dir, "credentials"),
-    `${MANAGED_MARKER}\n${rendered.credentials}`,
-    {
-      mode: 0o600,
-    }
-  );
-  write(join(dir, "config"), `${MANAGED_MARKER}\n${rendered.config}`, {
-    mode: 0o600,
-  });
-
   return rendered.profiles;
 }
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.333.1",
+  "version": "2.333.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -14,9 +14,18 @@ merges" loop. Other skills delegate here instead of re-implementing it. Runs
 
 - `pr=<number|url>` — the PR to drive. Default: the PR for the current branch
   (`gh pr view --json number,url,baseRefName,headRefName,state`).
-- `merge_method=<merge|rebase>` — strategy for both auto-merge and the direct-merge
-  fallback. Default `merge`. **Never squash** — squashing flattens
-  `chore(release): X.Y.Z [skip ci]` commits and breaks release promotion detection.
+- `merge_method=<merge>` — strategy for both auto-merge and the direct-merge
+  fallback. Default and only accepted value: `merge`.
+  - **Never squash** — squashing flattens `chore(release): X.Y.Z [skip ci]`
+    commits and breaks release promotion detection.
+  - **Never rebase.** REJECT `merge_method=rebase` up front with a clear message
+    rather than accepting it and verifying it wrongly. GitHub's rebase-and-merge
+    rewrites the commits — new SHAs — and creates no merge commit, so the
+    shipped-verification in section 3 cannot succeed: `verify_commit` is the
+    pre-rebase SHA and is not an ancestor of the base branch afterwards, and the
+    merge-parent assertion has nothing to assert against. A successful merge
+    would then report as a FAILED verification and drive a false fix-forward,
+    which is worse than refusing the input. See CodySwannGT/lisa#2316.
 - `verify_commit=<sha>` — the commit that MUST end up in the merged base (for the
   ancestry check). Default: the PR head at the time this skill starts.
 - `auto_merge=<true|false>` — whether this skill is allowed to merge the PR at