@codyswann/lisa 3.33.4 → 3.33.6

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.33.4",
+  "version": "3.33.6",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/check-conflict-markers.mjs

@@ -299,7 +299,7 @@ export function main(argv, io = {}) {
     scanned: files.length,
   });
   out.write(
-    (opts.json ? JSON.stringify(report, null, 2) : humanReport(report)) + "\n"
+    `${opts.json ? JSON.stringify(report, null, 2) : humanReport(report)}\n`
   );
   return results.length === 0 ? 0 : 1;
 }

package/scripts/check-required-check-promotions.mjs

@@ -140,6 +140,10 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import yaml from "js-yaml";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const HEADROOM_EVIDENCE_MISSING = "headroom-evidence-missing";
+
 /** Integration id GitHub Actions reports status checks under. */
 export const ACTIONS_INTEGRATION_ID = 15_368;
 
@@ -343,7 +347,7 @@ function budgetProblems(budget) {
   if (typeof subject !== "string" || typeof measuredOn !== "string") {
     return [
       {
-        rule: "headroom-evidence-missing",
+        rule: HEADROOM_EVIDENCE_MISSING,
         detail:
           "every headroom.budgets[] entry needs a subject and a measured_on_subject",
       },
@@ -391,7 +395,7 @@ function provenanceProblems(observedOn) {
   }
   return [
     {
-      rule: "headroom-evidence-missing",
+      rule: HEADROOM_EVIDENCE_MISSING,
       detail:
         'headroom.observed_on must be "pass": the run that produced observed_worst_ms must have COMPLETED within its budget, because a duration reported alongside a timeout measures contention, not cost',
     },
@@ -414,7 +418,7 @@ function ratioProblems(budgetMs, observedMs) {
   ) {
     return [
       {
-        rule: "headroom-evidence-missing",
+        rule: HEADROOM_EVIDENCE_MISSING,
         detail:
           "headroom needs a positive budget_ms and a positive observed_worst_ms",
       },
@@ -481,7 +485,7 @@ export function headroomProblems(headroom) {
   for (const [field, detail] of prose) {
     const value = headroom[field];
     if (typeof value !== "string" || value.trim() === "") {
-      problems.push({ rule: "headroom-evidence-missing", detail });
+      problems.push({ rule: HEADROOM_EVIDENCE_MISSING, detail });
     }
   }
   if (problems.length > 0) return problems;

package/scripts/detect-stale-workflow-inputs.mjs

@@ -231,9 +231,7 @@ function humanTable(report) {
  * @returns {void}
  */
 function emitReport(out, report, json) {
-  out.write(
-    (json ? JSON.stringify(report, null, 2) : humanTable(report)) + "\n"
-  );
+  out.write(`${json ? JSON.stringify(report, null, 2) : humanTable(report)}\n`);
 }
 
 /**

package/scripts/fix-namespace-test-assertions.mjs

@@ -2,7 +2,7 @@
 /**
  * Fix test assertions and a few skill references after lisa-* skill / lisa: command namespace migration.
  */
-import { readFileSync, writeFileSync, readdirSync, statSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 

package/scripts/generate-agy-plugin-artifacts.mjs

@@ -44,6 +44,11 @@ import { fileURLToPath } from "node:url";
 import { nestCommandsUnderLisa } from "./lib/nest-plugin-commands.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const CLAUDE_PLUGIN_DIR = ".claude-plugin";
+const PLUGIN_MANIFEST = "plugin.json";
+
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
@@ -115,7 +120,7 @@ function copyDir(src, dst, keep = () => true) {
  * @param {string} version Version string for the manifest.
  */
 export function generateAgyVariant(srcDir, outDir, version) {
-  const claudeManifest = path.join(srcDir, ".claude-plugin", "plugin.json");
+  const claudeManifest = path.join(srcDir, CLAUDE_PLUGIN_DIR, PLUGIN_MANIFEST);
   if (!fs.existsSync(claudeManifest)) return;
 
   const policy = readPolicy();
@@ -148,8 +153,8 @@ export function generateAgyVariant(srcDir, outDir, version) {
     }
     // Skip the .claude-plugin manifest — we'll write a bare plugin.json instead.
     if (
-      relPath === path.join(".claude-plugin", "plugin.json") ||
-      relPath === ".claude-plugin"
+      relPath === path.join(CLAUDE_PLUGIN_DIR, PLUGIN_MANIFEST) ||
+      relPath === CLAUDE_PLUGIN_DIR
     ) {
       return false;
     }
@@ -181,11 +186,11 @@ export function generateAgyVariant(srcDir, outDir, version) {
   delete manifest.hooks;
   delete manifest.mcpServers;
 
-  const bareManifestPath = path.join(outDir, "plugin.json");
-  fs.writeFileSync(bareManifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  const bareManifestPath = path.join(outDir, PLUGIN_MANIFEST);
+  fs.writeFileSync(bareManifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 
   // 3. Ensure no .claude-plugin/ directory survives.
-  const ghostDir = path.join(outDir, ".claude-plugin");
+  const ghostDir = path.join(outDir, CLAUDE_PLUGIN_DIR);
   if (fs.existsSync(ghostDir)) {
     fs.rmSync(ghostDir, { recursive: true, force: true });
   }
@@ -328,7 +333,7 @@ function emitAgyPluginHooks(srcDir, outDir, sourceHooks, installDirName) {
   );
   fs.writeFileSync(
     path.join(outDir, "hooks.json"),
-    JSON.stringify(hooksConfig, null, 2) + "\n"
+    `${JSON.stringify(hooksConfig, null, 2)}\n`
   );
 
   // Copy the agy-protocol scripts into the variant's hooks/ subdir.

package/scripts/generate-codex-plugin-artifacts.mjs

@@ -38,6 +38,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const CODEX_PLUGIN_DIR = ".codex-plugin";
+const HOOKS_MANIFEST = "hooks.json";
+
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
@@ -469,7 +474,7 @@ function writeSkillAgentsInRoot(skillsDir) {
 function codexSkillRoots(pluginDir) {
   return [
     path.join(pluginDir, "skills"),
-    path.join(pluginDir, ".codex-plugin", "skills"),
+    path.join(pluginDir, CODEX_PLUGIN_DIR, "skills"),
   ].filter(skillRoot => fs.existsSync(skillRoot));
 }
 
@@ -482,7 +487,7 @@ function codexSkillRoots(pluginDir) {
  * @returns {readonly string[]} Generated skill names.
  */
 export function emitCommandSkills(pluginDir) {
-  const generatedRoot = path.join(pluginDir, ".codex-plugin", "skills");
+  const generatedRoot = path.join(pluginDir, CODEX_PLUGIN_DIR, "skills");
   const commandsRoot = path.join(pluginDir, "commands");
   if (!fs.existsSync(commandsRoot)) {
     return [];
@@ -536,7 +541,7 @@ export function emitCommandSkills(pluginDir) {
  */
 export function emitCodexSkillVariants(pluginDir) {
   const authoredRoot = path.join(pluginDir, "skills");
-  const codexRoot = path.join(pluginDir, ".codex-plugin", "skills");
+  const codexRoot = path.join(pluginDir, CODEX_PLUGIN_DIR, "skills");
   fs.rmSync(codexRoot, { force: true, recursive: true });
   if (!fs.existsSync(authoredRoot)) return [];
 
@@ -799,14 +804,14 @@ function main() {
  * @param {object} claudeManifest Parsed contents of .claude-plugin/plugin.json.
  */
 export function emitCodexHooks(pluginDir, claudeManifest) {
-  const codexPluginDir = path.join(pluginDir, ".codex-plugin");
-  const hooksJsonPath = path.join(codexPluginDir, "hooks.json");
+  const codexPluginDir = path.join(pluginDir, CODEX_PLUGIN_DIR);
+  const hooksJsonPath = path.join(codexPluginDir, HOOKS_MANIFEST);
   // Purge the older layouts so a rebuilt plugin never ships a stale/duplicate
   // file:
   //   - <plugin-root>/hooks/hooks.json     (2.121–2.124; broke Claude startup)
   //   - <plugin-root>/.codex-plugin/hooks/ (pre-2.121 copied-scripts dir)
   // The shared .sh scripts at <plugin-root>/hooks/ are left untouched.
-  fs.rmSync(path.join(pluginDir, "hooks", "hooks.json"), { force: true });
+  fs.rmSync(path.join(pluginDir, "hooks", HOOKS_MANIFEST), { force: true });
   fs.rmSync(path.join(codexPluginDir, "hooks"), {
     force: true,
     recursive: true,
@@ -861,7 +866,7 @@ function writeCodexManifest(pluginDir, claudeManifest, pluginName, version) {
     },
   };
 
-  const manifestDir = path.join(pluginDir, ".codex-plugin");
+  const manifestDir = path.join(pluginDir, CODEX_PLUGIN_DIR);
   fs.mkdirSync(manifestDir, { recursive: true });
   fs.writeFileSync(
     path.join(manifestDir, "plugin.json"),
@@ -871,7 +876,7 @@ function writeCodexManifest(pluginDir, claudeManifest, pluginName, version) {
 
 export function componentPointers(pluginDir) {
   return {
-    ...(fs.existsSync(path.join(pluginDir, ".codex-plugin", "skills"))
+    ...(fs.existsSync(path.join(pluginDir, CODEX_PLUGIN_DIR, "skills"))
       ? { skills: "./.codex-plugin/skills/" }
       : fs.existsSync(path.join(pluginDir, "skills"))
         ? { skills: "./skills/" }
@@ -879,7 +884,7 @@ export function componentPointers(pluginDir) {
     ...(fs.existsSync(path.join(pluginDir, ".mcp.json"))
       ? { mcpServers: "./.mcp.json" }
       : {}),
-    ...(fs.existsSync(path.join(pluginDir, ".codex-plugin", "hooks.json"))
+    ...(fs.existsSync(path.join(pluginDir, CODEX_PLUGIN_DIR, HOOKS_MANIFEST))
       ? { hooks: "./.codex-plugin/hooks.json" }
       : {}),
   };

package/scripts/generate-copilot-plugin-artifacts.mjs

@@ -247,7 +247,7 @@ export function generateCopilotVariant(srcDir, outDir, version) {
     }
   }
 
-  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 
   // 4. Filter the hooks/ directory.
   const hooksDir = path.join(outDir, "hooks");

package/scripts/generate-cursor-plugin-artifacts.mjs

@@ -336,7 +336,7 @@ export function generateCursorVariant(srcDir, outDir, version) {
   manifest.version = version;
   const cursorHooks = buildCursorHooksJson(manifest.hooks ?? {});
   delete manifest.hooks;
-  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 
   // 2a. Emit hooks/hooks.json in Cursor's native shape when any hooks survive.
   if (cursorHooks) {
@@ -344,7 +344,7 @@ export function generateCursorVariant(srcDir, outDir, version) {
     fs.mkdirSync(cursorHooksDir, { recursive: true });
     fs.writeFileSync(
       path.join(cursorHooksDir, "hooks.json"),
-      JSON.stringify(cursorHooks, null, 2) + "\n"
+      `${JSON.stringify(cursorHooks, null, 2)}\n`
     );
   }
 

package/scripts/generate-upstream-evidence-manifest.mjs

@@ -123,7 +123,7 @@ const existingOutput = existsSync(outputPath)
   : "";
 const existingPublicCommits = [
   ...existingOutput.matchAll(
-    /^\s+(?:"([0-9][a-f0-9]{39})"|([a-f][a-f0-9]{39})):\s+true,$/gmu
+    /^\s+(?:"(\d[a-f0-9]{39})"|([a-f][a-f0-9]{39})):\s+true,$/gmu
   ),
 ]
   .map(match => match[1] ?? match[2] ?? "")

package/scripts/lisa-assert-eas-profile.mjs

@@ -88,9 +88,9 @@ export function resolveProfile(profiles, name) {
     if (!profile) {
       const known = Object.keys(profiles ?? {});
       throw new Error(
-        `eas.json has no build profile called "${current}"` +
-          (current === name ? "" : ` (reached by extending from "${name}")`) +
-          `. It defines: ${known.length ? known.join(", ") : "none"}.`
+        `eas.json has no build profile called "${current}"${
+          current === name ? "" : ` (reached by extending from "${name}")`
+        }. It defines: ${known.length ? known.join(", ") : "none"}.`
       );
     }
     seen.add(current);

package/scripts/plugin-parity-drift.mjs

@@ -44,17 +44,31 @@ import { fileURLToPath } from "node:url";
 
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const NOT_INSTALLED = "not-installed";
+
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
 );
 
 /**
- * Semver 2.0.0 grammar. Build metadata (`+...`) is accepted but ignored in
- * comparison; prerelease (`-...`) is accepted and sorts below its release.
+ * Semver 2.0.0 grammar, one clause per name. Build metadata (`+...`) is
+ * accepted but ignored in comparison; prerelease (`-...`) is accepted and sorts
+ * below its release.
+ *
+ * Assembled from fragments rather than written as one literal because the
+ * literal was unreadable — this is the semver.org grammar verbatim, and the
+ * composed `.source` is byte-identical to the literal it replaced.
  */
-const SEMVER_RE =
-  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const SEMVER_NUMERIC = "0|[1-9]\\d*";
+const SEMVER_PRERELEASE_ID = `(?:${SEMVER_NUMERIC}|\\d*[A-Za-z-][0-9A-Za-z-]*)`;
+const SEMVER_PRERELEASE = `(?:-(${SEMVER_PRERELEASE_ID}(?:\\.${SEMVER_PRERELEASE_ID})*))?`;
+const SEMVER_BUILD = "(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?";
+const SEMVER_RE = new RegExp(
+  `^(${SEMVER_NUMERIC})\\.(${SEMVER_NUMERIC})\\.(${SEMVER_NUMERIC})${SEMVER_PRERELEASE}${SEMVER_BUILD}$`
+);
 
 /** A plugin name / marketplace token: `1*(ALPHA / DIGIT / "-" / "_")`. */
 const TOKEN_RE = /^[A-Za-z0-9_-]+$/;
@@ -283,11 +297,11 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
   // enforces this, but resolveCurrentVersion is a public export that no longer
   // co-locates with its validating caller.
   if (!TOKEN_RE.test(name) || !TOKEN_RE.test(marketplace)) {
-    return { status: "not-installed", version: null };
+    return { status: NOT_INSTALLED, version: null };
   }
   const dir = path.join(cacheRoot, marketplace, name);
   if (!isDirectory(dir)) {
-    return { status: "not-installed", version: null };
+    return { status: NOT_INSTALLED, version: null };
   }
   const versions = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
@@ -308,8 +322,12 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
   if (versions.length === 0) {
     return { status: "unresolved", version: null };
   }
-  const max = versions.reduce((acc, v) =>
-    compareSemver(v, acc) > 0 ? v : acc
+  // `versions` is non-empty (guarded above), so seeding with the first element
+  // is exactly what the no-seed form did — and it cannot throw if that guard is
+  // ever moved.
+  const max = versions.reduce(
+    (acc, v) => (compareSemver(v, acc) > 0 ? v : acc),
+    versions[0]
   );
   return { status: "ok", version: max };
 }
@@ -323,8 +341,8 @@ export function resolveCurrentVersion(cacheRoot, name, marketplace) {
  * @returns {"ok" | "stale" | "ahead" | "not-installed" | "unresolved"} the status.
  */
 export function classify(pinnedVersion, cur) {
-  if (cur.status === "not-installed") {
-    return "not-installed";
+  if (cur.status === NOT_INSTALLED) {
+    return NOT_INSTALLED;
   }
   // Defense-in-depth: any non-`ok` resolver state, or an `ok` state without a
   // string version, is treated as `unresolved` so compareSemver is never called
@@ -550,9 +568,7 @@ function collectSyncedSkills(roots) {
  * @returns {void}
  */
 function emitReport(out, report, json) {
-  out.write(
-    (json ? JSON.stringify(report, null, 2) : humanTable(report)) + "\n"
-  );
+  out.write(`${json ? JSON.stringify(report, null, 2) : humanTable(report)}\n`);
 }
 
 /**

package/scripts/plugin-routing-validate.mjs

@@ -152,7 +152,13 @@ export function cacheMaxVersion(cacheRoot, name, marketplace) {
   if (versions.length === 0) {
     return null;
   }
-  return versions.reduce((acc, v) => (compareSemver(v, acc) > 0 ? v : acc));
+  // `versions` is non-empty (guarded above), so seeding with the first element
+  // is exactly what the no-seed form did — and it cannot throw if that guard is
+  // ever moved.
+  return versions.reduce(
+    (acc, v) => (compareSemver(v, acc) > 0 ? v : acc),
+    versions[0]
+  );
 }
 
 /**
@@ -553,7 +559,7 @@ function humanReport(report) {
  */
 function emitReport(out, report, json) {
   out.write(
-    (json ? JSON.stringify(report, null, 2) : humanReport(report)) + "\n"
+    `${json ? JSON.stringify(report, null, 2) : humanReport(report)}\n`
   );
 }
 

package/scripts/update-node-version.ts

@@ -18,6 +18,10 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 
+// Literals named once — each was repeated enough times that a typo in one
+// copy would diverge silently.
+const VERSION_REPLACEMENT = "$1{{version}}$2";
+
 const PROJECT_ROOT = path.resolve(import.meta.dirname, "..");
 
 /**
@@ -34,12 +38,12 @@ const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
   // node_version: '22.21.1' (workflow input defaults)
   {
     pattern: /(node_version:\s*['"])[\d.]+(['"])/g,
-    replacement: "$1{{version}}$2",
+    replacement: VERSION_REPLACEMENT,
   },
   // node-version: '22.21.1' (actions/setup-node)
   {
     pattern: /(node-version:\s*['"])[\d.]+(['"])/g,
-    replacement: "$1{{version}}$2",
+    replacement: VERSION_REPLACEMENT,
   },
   // node-version: '22.x' (major version pattern)
   {
@@ -50,7 +54,7 @@ const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
 
 const PACKAGE_JSON_PATTERN: ReplacementPattern = {
   pattern: /("node":\s*["'])[\d.]+(["'])/g,
-  replacement: "$1{{version}}$2",
+  replacement: VERSION_REPLACEMENT,
 };
 
 /**