@codyswann/lisa 2.336.1 → 2.336.2

package/all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh

@@ -81,11 +81,37 @@ is_inactive() {
 # `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
 # `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
 # portable form. A timeout leaves `value` empty, which the caller treats as "the
-# provider had nothing" — the warn path, never a block. `|| true` because `read`
-# also reports failure at EOF on the resolver's deliberately unterminated output.
+# provider had nothing" — the warn path, never a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700.
 resolve_secret() {
-  local resolver="$1" name="$2" value=""
-  IFS= read -r -t 10 value < <(node "$resolver" get "$name" 2>/dev/null) || true
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d)" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t 10 value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
   printf '%s' "$value"
 }
 

package/dist/core/upstream-evidence-manifest.js

@@ -9,7 +9,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "a6ed91576efebb6ba40cfa4e9d8a3e8566314909210ae8d5860be62a3feb4cff",
     "all/copy-overwrite/scripts/lisa-hooks/block-shell-json-parsing.sh": "3b5f074f3ab5708030af507eea962389f3b067c5dbdc76580bd9e44d3ac6c603",
     "all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
-    "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "945453fb275a58aa7185e150e6b05e5810739750928ab5bd6edfbf87d1c8aa0d",
+    "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
     "all/copy-overwrite/scripts/lisa-work-item.mjs": "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",
     "all/create-only/.claude/rules/PROJECT_RULES.md": "6e1c7923ad2a15356babc60c97e7f97be728d790af285b6a7cd7d1b4d39cd97f",
     "all/create-only/.lisaignore": "3c9827e7e98daa46510b5357cd6dd9406da1821e64cc46d2eea9f311cd6d06b9",
@@ -313,7 +313,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/parity-safety-net.sh": "062c69eea85157f1e941ec3626d8912aa9f182af6ccdbe19687588a6074db5ce",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
-    "plugins/src/base/hooks/sonar-secrets.sh": "945453fb275a58aa7185e150e6b05e5810739750928ab5bd6edfbf87d1c8aa0d",
+    "plugins/src/base/hooks/sonar-secrets.sh": "bf4132e49ba18e2f7e941520c299c15aeeacfd220e489f3d2eb8397f2048157b",
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "4535a145c5c5cbee13bdf970bc91d390a264043604e607288cdd6bf28de56192",
     "plugins/src/base/hooks/threshold-ratchet-families.mjs": "db14245ed89b483912af287bdee917a7a921dc21bb29b49be37fc799c05c413f",
     "plugins/src/base/hooks/threshold-ratchet.mjs": "04f660131bf50864239eb09cbf4d9555e53921254f6ab45ff2b85c173e160901",

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/sonar-secrets.sh

@@ -81,11 +81,37 @@ is_inactive() {
 # `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
 # `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
 # portable form. A timeout leaves `value` empty, which the caller treats as "the
-# provider had nothing" — the warn path, never a block. `|| true` because `read`
-# also reports failure at EOF on the resolver's deliberately unterminated output.
+# provider had nothing" — the warn path, never a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700.
 resolve_secret() {
-  local resolver="$1" name="$2" value=""
-  IFS= read -r -t 10 value < <(node "$resolver" get "$name" 2>/dev/null) || true
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d)" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t 10 value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
   printf '%s' "$value"
 }
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/sonar-secrets.sh

@@ -81,11 +81,37 @@ is_inactive() {
 # `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
 # `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
 # portable form. A timeout leaves `value` empty, which the caller treats as "the
-# provider had nothing" — the warn path, never a block. `|| true` because `read`
-# also reports failure at EOF on the resolver's deliberately unterminated output.
+# provider had nothing" — the warn path, never a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700.
 resolve_secret() {
-  local resolver="$1" name="$2" value=""
-  IFS= read -r -t 10 value < <(node "$resolver" get "$name" 2>/dev/null) || true
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d)" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t 10 value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
   printf '%s' "$value"
 }
 

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/sonar-secrets.sh

@@ -81,11 +81,37 @@ is_inactive() {
 # `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
 # `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
 # portable form. A timeout leaves `value` empty, which the caller treats as "the
-# provider had nothing" — the warn path, never a block. `|| true` because `read`
-# also reports failure at EOF on the resolver's deliberately unterminated output.
+# provider had nothing" — the warn path, never a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700.
 resolve_secret() {
-  local resolver="$1" name="$2" value=""
-  IFS= read -r -t 10 value < <(node "$resolver" get "$name" 2>/dev/null) || true
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d)" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t 10 value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
   printf '%s' "$value"
 }
 

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.336.1",
+  "version": "2.336.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/sonar-secrets.sh

@@ -81,11 +81,37 @@ is_inactive() {
 # `read -t` supplies the ceiling. `timeout` is absent on a stock macOS and
 # `coproc` needs Bash 4 (the hooks run under /bin/bash 3.2 there), so this is the
 # portable form. A timeout leaves `value` empty, which the caller treats as "the
-# provider had nothing" — the warn path, never a block. `|| true` because `read`
-# also reports failure at EOF on the resolver's deliberately unterminated output.
+# provider had nothing" — the warn path, never a block.
+#
+# Giving up on the read is not the same as stopping the work: a resolver blocked
+# on the network otherwise outlives the hook that started it, and this runs in
+# front of every prompt and every file read. So the child is killed and reaped,
+# which requires knowing its PID — and that is why the transport is a FIFO and
+# not the process substitution this function used to read from.
+#
+# On /bin/bash 3.2, `$!` after `< <(cmd)` is the SHELL'S OWN PID, not the
+# substitution's child (verified: the child's PPID is the shell, and `$!` equals
+# the shell). A `kill -9 "$!"` there tells the hook to kill itself. Backgrounding
+# the resolver explicitly is what makes `$!` mean the resolver.
+#
+# The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
+# the value still never lands on disk (CWE-922) and a kill at any point leaves an
+# empty pipe behind rather than a readable token. The directory is `mktemp -d`,
+# which is 0700.
 resolve_secret() {
-  local resolver="$1" name="$2" value=""
-  IFS= read -r -t 10 value < <(node "$resolver" get "$name" 2>/dev/null) || true
+  local resolver="$1" name="$2" value="" child="" dir="" fifo=""
+  dir="$(mktemp -d)" || return 0
+  fifo="$dir/resolver"
+  if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
+    rm -rf "$dir"
+    return 0
+  fi
+  node "$resolver" get "$name" >"$fifo" 2>/dev/null &
+  child=$!
+  IFS= read -r -t 10 value < "$fifo" || true
+  kill -9 "$child" 2>/dev/null
+  wait "$child" 2>/dev/null
+  rm -rf "$dir"
   printf '%s' "$value"
 }