@codyswann/lisa 3.17.2 → 3.17.3

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.17.2",
+  "version": "3.17.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.17.2",
+  "version": "3.17.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/threshold-ratchet.mjs

@@ -430,9 +430,49 @@ function main() {
   return 0;
 }
 
-const isDirectRun =
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
-if (isDirectRun) {
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The one implementation of this lives at `scripts/lib/invoked-as-script.mjs`,
+ * and every other shipped entry point imports it. This file cannot: it is
+ * materialized from `plugins/src/base/hooks/`, where it also runs as an
+ * agent-time hook, and a plugin payload has no `./lib/` to import from. So the
+ * rule is written out here rather than pointed at — the same accommodation
+ * `preflight-secrets.mjs` makes, for the same reason.
+ *
+ * Both sides are realpath'd. The previous spelling compared
+ * `fileURLToPath(import.meta.url)` against `path.resolve(process.argv[1])`, and
+ * `resolve` makes a path absolute without following symlinks. `import.meta.url`
+ * is the REAL path — node resolves ESM through realpath unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever the caller typed. Reached through a symlinked checkout, a git
+ * worktree, or a `/tmp` path on macOS (`/tmp` being a symlink to `/private/tmp`),
+ * the two disagreed, `main()` never ran, and the process exited 0.
+ *
+ * For a CHECK that is a fail-OPEN, not a mild degradation: no output, exit 0,
+ * the npm script "succeeds", and the ratchet silently stops having an opinion.
+ * It was measured, not theorised — every control in the #2531 promotion tests
+ * no-opped until the fixture directory was realpath'd.
+ *
+ * Realpathing BOTH sides rather than only `argv[1]` matters under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry:
+ * normalizing one side then compares a real path against a symlinked one and
+ * answers `false` for an entry point that WAS invoked directly. Any resolution
+ * error returns `false` — node loaded the entry from that path moments ago, so
+ * a path that will not resolve now is not the path this module came through.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return fs.realpathSync(argv1) === fs.realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   process.exit(main());
 }

package/rails/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -433,9 +433,49 @@ function main() {
   return 0;
 }
 
-const isDirectRun =
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
-if (isDirectRun) {
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The one implementation of this lives at `scripts/lib/invoked-as-script.mjs`,
+ * and every other shipped entry point imports it. This file cannot: it is
+ * materialized from `plugins/src/base/hooks/`, where it also runs as an
+ * agent-time hook, and a plugin payload has no `./lib/` to import from. So the
+ * rule is written out here rather than pointed at — the same accommodation
+ * `preflight-secrets.mjs` makes, for the same reason.
+ *
+ * Both sides are realpath'd. The previous spelling compared
+ * `fileURLToPath(import.meta.url)` against `path.resolve(process.argv[1])`, and
+ * `resolve` makes a path absolute without following symlinks. `import.meta.url`
+ * is the REAL path — node resolves ESM through realpath unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever the caller typed. Reached through a symlinked checkout, a git
+ * worktree, or a `/tmp` path on macOS (`/tmp` being a symlink to `/private/tmp`),
+ * the two disagreed, `main()` never ran, and the process exited 0.
+ *
+ * For a CHECK that is a fail-OPEN, not a mild degradation: no output, exit 0,
+ * the npm script "succeeds", and the ratchet silently stops having an opinion.
+ * It was measured, not theorised — every control in the #2531 promotion tests
+ * no-opped until the fixture directory was realpath'd.
+ *
+ * Realpathing BOTH sides rather than only `argv[1]` matters under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry:
+ * normalizing one side then compares a real path against a symlinked one and
+ * answers `false` for an entry point that WAS invoked directly. Any resolution
+ * error returns `false` — node loaded the entry from that path moments ago, so
+ * a path that will not resolve now is not the path this module came through.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return fs.realpathSync(argv1) === fs.realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   process.exit(main());
 }

package/typescript/copy-contents/.husky/commit-msg

@@ -54,15 +54,22 @@ fi
 
 # Check for Co-Authored-By line (skip for merge commits)
 COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
+# `printf '%s\n'`, never `echo "$COMMIT_MSG"`. Under a POSIX/XSI `echo` the
+# backslash escapes are interpreted, and `\c` means "stop output here" — so a
+# message containing `\copy`, `\cite`, or a Windows path like `C:\config` is
+# silently truncated at that point before grep ever sees it. The
+# `Co-Authored-By:` trailer is always the last line, so it is always the part
+# lost, and the hook then rejects a commit whose trailer is present and
+# correctly formatted while pointing the author at the trailer.
 
 # Skip AI co-authorship check for merge commits (e.g., from git pull)
-if echo "$COMMIT_MSG" | grep -qE "^Merge (branch|pull request|remote-tracking)"; then
+if printf '%s\n' "$COMMIT_MSG" | grep -qE "^Merge (branch|pull request|remote-tracking)"; then
   echo "🔀 Merge commit detected, skipping AI co-authorship check"
   exit 0
 fi
 
 # Skip AI co-authorship check for automated release commits (e.g., from standard-version in CI)
-if echo "$COMMIT_MSG" | grep -qE "^chore\(release\):"; then
+if printf '%s\n' "$COMMIT_MSG" | grep -qE "^chore\(release\):"; then
   echo "🚀 Release commit detected, skipping AI co-authorship check"
   exit 0
 fi
@@ -72,7 +79,7 @@ echo "🤖 Checking for AI co-authorship..."
 # Accept attribution from any supported coding agent (Claude or Codex),
 # case-insensitively. Claude Code emits "Co-Authored-By: Claude"; the Codex CLI
 # emits "Co-authored-by: Codex <noreply@openai.com>".
-if ! echo "$COMMIT_MSG" | grep -Eiq "Co-authored-by:.*(Claude|Codex)"; then
+if ! printf '%s\n' "$COMMIT_MSG" | grep -Eiq "Co-authored-by:.*(Claude|Codex)"; then
   echo ""
   echo "❌ Commit message must include AI co-authorship!"
   echo ""

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -433,9 +433,49 @@ function main() {
   return 0;
 }
 
-const isDirectRun =
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
-if (isDirectRun) {
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The one implementation of this lives at `scripts/lib/invoked-as-script.mjs`,
+ * and every other shipped entry point imports it. This file cannot: it is
+ * materialized from `plugins/src/base/hooks/`, where it also runs as an
+ * agent-time hook, and a plugin payload has no `./lib/` to import from. So the
+ * rule is written out here rather than pointed at — the same accommodation
+ * `preflight-secrets.mjs` makes, for the same reason.
+ *
+ * Both sides are realpath'd. The previous spelling compared
+ * `fileURLToPath(import.meta.url)` against `path.resolve(process.argv[1])`, and
+ * `resolve` makes a path absolute without following symlinks. `import.meta.url`
+ * is the REAL path — node resolves ESM through realpath unless
+ * `--preserve-symlinks` or `--preserve-symlinks-main` is set — while `argv[1]`
+ * is whatever the caller typed. Reached through a symlinked checkout, a git
+ * worktree, or a `/tmp` path on macOS (`/tmp` being a symlink to `/private/tmp`),
+ * the two disagreed, `main()` never ran, and the process exited 0.
+ *
+ * For a CHECK that is a fail-OPEN, not a mild degradation: no output, exit 0,
+ * the npm script "succeeds", and the ratchet silently stops having an opinion.
+ * It was measured, not theorised — every control in the #2531 promotion tests
+ * no-opped until the fixture directory was realpath'd.
+ *
+ * Realpathing BOTH sides rather than only `argv[1]` matters under
+ * `--preserve-symlinks-main`, which tells node not to resolve the main entry:
+ * normalizing one side then compares a real path against a symlinked one and
+ * answers `false` for an entry point that WAS invoked directly. Any resolution
+ * error returns `false` — node loaded the entry from that path moments ago, so
+ * a path that will not resolve now is not the path this module came through.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return fs.realpathSync(argv1) === fs.realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedAsScript(import.meta.url)) {
   process.exit(main());
 }