@codyswann/lisa 3.47.2 → 3.47.3

package/dist/core/upstream-evidence-manifest.js

@@ -485,7 +485,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/scripts/design-source-gate.mjs": "5eadc5184a8c22d1d35c8be1bf4589aeedff0d1aa578563e4d33cdb193dbc5af",
     "plugins/src/base/scripts/design-variable-ids.mjs": "0fb40c52d9297a1682f875d5c4213ecbfa772e213160b34aafa5c10d5b58125a",
     "plugins/src/base/scripts/doctor-report.mjs": "f183e62848ac539da56a525fe2105fc6251a49e555a01dd1bba10d9227b1a6bf",
-    "plugins/src/base/scripts/install-remote-agent-aws.mjs": "5ef1c323d7cbfda8976f6fb0c24f7a8e5f5757475fd1d71c6e5bec91023cebe3",
+    "plugins/src/base/scripts/install-remote-agent-aws.mjs": "c15020b5411d100a7393769e7006ad2e960181d92e616690cdadfc4672680296",
     "plugins/src/base/scripts/intake-blocker-reprobe.mjs": "135a9b5a0894f70562b54d2071caff1e679c0fe542a606caca39e9e6a5b65f24",
     "plugins/src/base/scripts/intake-prework-denominator.mjs": "0a40cb91ab1c0e810f42d035d9652af3033e97c692b93b911de851991c12eca1",
     "plugins/src/base/scripts/lifecycle-label-trust.mjs": "0a9892890da6011733bf9b1186fbe936253c2796c4ac448f1a55f63b8daaa154",
@@ -1066,11 +1066,11 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/build-plugins.sh": "00a3207bb5a485bfee80fb71be6e9577979fd156b15a85517e88a2f9261bc9f4",
     "scripts/check-conflict-markers.mjs": "3a2ab8dde9deab3e8ee750d5678b6653751abad2eb8f961500585ba38f502047",
     "scripts/check-delivery-deletion-conflicts.mjs": "e7fe0064ad82a4dba17436657630a46891568a3d18930eb172fe9ee3f54196aa",
-    "scripts/check-derived-artifacts.mjs": "1a35cc935515d29f0223a87d56dbfd5537aba19162d9d20e70fce8255688b76f",
-    "scripts/check-duplicate-versions.mjs": "84d97e94eb834522848ddce951bb54ae9da1e4be252e2c51fed0c01c4f4d6b72",
+    "scripts/check-derived-artifacts.mjs": "62c895baffad41c25fa919b798a53e2e969163897bcbb09b0e26345c61f61320",
+    "scripts/check-duplicate-versions.mjs": "26b26351dd2735dfd8d9a2436b89e876ce2ed93871d0b264f611215dd03d70ae",
     "scripts/check-learnings-budget.ts": "007430c2d6938efcc79ccbfd5717ebe2c7cf66b4de9a21a3e67b8db7f3600349",
     "scripts/check-plugins-sync.sh": "3a99cbff0e8ec5e7c944690eae003a6d51b51c85436d77bd37faea4d553728af",
-    "scripts/check-required-check-promotions.mjs": "3f1e8915dc9a467f16ca74cc016d6cd0216c6c790573f44886b41afbb829a269",
+    "scripts/check-required-check-promotions.mjs": "5e630ed713d7942a8f083f9171457c0559a830cdeb3e9c81da7ea113793248ad",
     "scripts/check-rules-pairing.sh": "4d4a0d9e8d36794a22020f419c879d7336b1c5bfe883acdcc826d26764560c7a",
     "scripts/check-security-floors.mjs": "ab265847a4c7766ded0c45b693f352ff1a82ee1797f50beda872a55b9a384966",
     "scripts/check-state-classification.mjs": "26baaa85c0758fa41f1f66257f7d3a31ea4dd5cf17a9c0acaa3e89caaaf6265a",
@@ -1088,7 +1088,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/fix-test-assertions-pass2.mjs": "baca043a291120ff52ce61c06397206dc21ca3bef9c23a5975b9c1f896d963c7",
     "scripts/fix-test-assertions.mjs": "59b5e8cc31e7c7323d20bd180f2ae97c08a9685758483b6fe00ba77317a845f2",
     "scripts/generate-agy-plugin-artifacts.mjs": "a952d25eeb83aa21d71ea7e46c7ba06c8c1ecd0fcf25a734900728191ce52105",
-    "scripts/generate-codex-plugin-artifacts.mjs": "96df6b67d4dad87a2277b90463ed15cef96bf20e641f31a35ff346522b0dc383",
+    "scripts/generate-codex-plugin-artifacts.mjs": "facb86910c07d1b8025868d24425fdaea7b6efbe282bace5ee5bf23957d6b51a",
     "scripts/generate-copilot-plugin-artifacts.mjs": "7af923118c49101e6ba46da73a8eee8aee9b797e074618aa5345913e638d7cdb",
     "scripts/generate-cursor-plugin-artifacts.mjs": "45d3bde7b6c55310f0d9436dd68a1bdeefb6fa817be4d15ef745421b39a2cf47",
     "scripts/generate-lisa-owned-hash-ledger.mjs": "4e7a6dd9325fff77faec49c1dcbf8a8cfeb987052eeed89885deb4f7b0a107bc",
@@ -1117,7 +1117,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "scripts/lisa-remote-env/setup.sh": "c30d98a5645f033fc1d3a723043691b9ad997ae5666df539ff6aa19c563431b2",
     "scripts/lisa-update-local.sh": "c811f9e10dbcb38499a9791c1ae9051460b347051d04a1d2046925bab9a53c96",
     "scripts/lisa-work-item.mjs": "51081847e980f314a764c2e50a7a121b1ced9ef4b980f33898057de4c7b852e6",
-    "scripts/materialize-copy-overwrite.mjs": "3f8dea8027087b83d0f985dc070a529b5e62755643d946684d780b86c498a411",
+    "scripts/materialize-copy-overwrite.mjs": "096271af0377b1ecd2725632973793549310a437fc3789979a71067b09ae2fe6",
     "scripts/plugin-parity-drift.mjs": "d53dc9b1f60bbfe0de64ade5f205d4222cf7959f40073cd8e8928c36339994e8",
     "scripts/plugin-routing-validate.mjs": "72c7dbaa23fbe30795da396f728585412db8adc543769c8a80eb3d790c678b0f",
     "scripts/probes/wave3-verification.sh": "c341c3682f2401339a433a48efc8b8dd80c9c190f12ec6287139bebd1e47c049",

package/package.json

@@ -138,7 +138,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/scripts/install-remote-agent-aws.mjs

@@ -11,11 +11,43 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The obvious spelling — comparing `import.meta.url` against a raw
+ * `process.argv[1]` — is false whenever the script is reached through a
+ * symlinked path: a symlinked checkout, a bin shim, a git worktree, or `/tmp`
+ * on macOS, which is itself a symlink to `/private/tmp`. `main()` then never
+ * runs and the process exits 0 having done nothing. That is what this module
+ * used to do, and an installer that silently installs nothing reports success
+ * while leaving the host unconfigured.
+ *
+ * Both sides are realpath'd, not just `argv[1]`: `import.meta.url` is the real
+ * path by default and the symlinked one under `--preserve-symlinks-main`, so
+ * normalizing one side reopens the same hole on that flag.
+ *
+ * Written out rather than imported: this is a plugin payload, which has no
+ * `./lib/` to resolve against. Same rule and same reasoning as
+ * `scripts/lib/invoked-as-script.mjs`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
 const SCRIPT_NAME = "remote-agent-aws-setup.sh";
 const INSTALL_COMMAND = `bash scripts/${SCRIPT_NAME}`;
 const VALID_PLATFORMS = new Set([
@@ -333,7 +365,7 @@ export function installRemoteAgentAws(arguments_ = process.argv.slice(2)) {
   return { project, platform, secretName, written };
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   try {
     process.stdout.write(
       `${JSON.stringify(installRemoteAgentAws(), null, 2)}\n`

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/scripts/install-remote-agent-aws.mjs

@@ -11,11 +11,43 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The obvious spelling — comparing `import.meta.url` against a raw
+ * `process.argv[1]` — is false whenever the script is reached through a
+ * symlinked path: a symlinked checkout, a bin shim, a git worktree, or `/tmp`
+ * on macOS, which is itself a symlink to `/private/tmp`. `main()` then never
+ * runs and the process exits 0 having done nothing. That is what this module
+ * used to do, and an installer that silently installs nothing reports success
+ * while leaving the host unconfigured.
+ *
+ * Both sides are realpath'd, not just `argv[1]`: `import.meta.url` is the real
+ * path by default and the symlinked one under `--preserve-symlinks-main`, so
+ * normalizing one side reopens the same hole on that flag.
+ *
+ * Written out rather than imported: this is a plugin payload, which has no
+ * `./lib/` to resolve against. Same rule and same reasoning as
+ * `scripts/lib/invoked-as-script.mjs`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
 const SCRIPT_NAME = "remote-agent-aws-setup.sh";
 const INSTALL_COMMAND = `bash scripts/${SCRIPT_NAME}`;
 const VALID_PLATFORMS = new Set([
@@ -333,7 +365,7 @@ export function installRemoteAgentAws(arguments_ = process.argv.slice(2)) {
   return { project, platform, secretName, written };
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   try {
     process.stdout.write(
       `${JSON.stringify(installRemoteAgentAws(), null, 2)}\n`

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/scripts/install-remote-agent-aws.mjs

@@ -11,11 +11,43 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The obvious spelling — comparing `import.meta.url` against a raw
+ * `process.argv[1]` — is false whenever the script is reached through a
+ * symlinked path: a symlinked checkout, a bin shim, a git worktree, or `/tmp`
+ * on macOS, which is itself a symlink to `/private/tmp`. `main()` then never
+ * runs and the process exits 0 having done nothing. That is what this module
+ * used to do, and an installer that silently installs nothing reports success
+ * while leaving the host unconfigured.
+ *
+ * Both sides are realpath'd, not just `argv[1]`: `import.meta.url` is the real
+ * path by default and the symlinked one under `--preserve-symlinks-main`, so
+ * normalizing one side reopens the same hole on that flag.
+ *
+ * Written out rather than imported: this is a plugin payload, which has no
+ * `./lib/` to resolve against. Same rule and same reasoning as
+ * `scripts/lib/invoked-as-script.mjs`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
 const SCRIPT_NAME = "remote-agent-aws-setup.sh";
 const INSTALL_COMMAND = `bash scripts/${SCRIPT_NAME}`;
 const VALID_PLATFORMS = new Set([
@@ -333,7 +365,7 @@ export function installRemoteAgentAws(arguments_ = process.argv.slice(2)) {
   return { project, platform, secretName, written };
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   try {
     process.stdout.write(
       `${JSON.stringify(installRemoteAgentAws(), null, 2)}\n`

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/scripts/install-remote-agent-aws.mjs

@@ -11,11 +11,43 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The obvious spelling — comparing `import.meta.url` against a raw
+ * `process.argv[1]` — is false whenever the script is reached through a
+ * symlinked path: a symlinked checkout, a bin shim, a git worktree, or `/tmp`
+ * on macOS, which is itself a symlink to `/private/tmp`. `main()` then never
+ * runs and the process exits 0 having done nothing. That is what this module
+ * used to do, and an installer that silently installs nothing reports success
+ * while leaving the host unconfigured.
+ *
+ * Both sides are realpath'd, not just `argv[1]`: `import.meta.url` is the real
+ * path by default and the symlinked one under `--preserve-symlinks-main`, so
+ * normalizing one side reopens the same hole on that flag.
+ *
+ * Written out rather than imported: this is a plugin payload, which has no
+ * `./lib/` to resolve against. Same rule and same reasoning as
+ * `scripts/lib/invoked-as-script.mjs`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
 const SCRIPT_NAME = "remote-agent-aws-setup.sh";
 const INSTALL_COMMAND = `bash scripts/${SCRIPT_NAME}`;
 const VALID_PLATFORMS = new Set([
@@ -333,7 +365,7 @@ export function installRemoteAgentAws(arguments_ = process.argv.slice(2)) {
   return { project, platform, secretName, written };
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   try {
     process.stdout.write(
       `${JSON.stringify(installRemoteAgentAws(), null, 2)}\n`

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "3.47.2",
+  "version": "3.47.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/scripts/install-remote-agent-aws.mjs

@@ -11,11 +11,43 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  realpathSync,
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+/**
+ * True when `moduleUrl` names the module node was asked to run.
+ *
+ * The obvious spelling — comparing `import.meta.url` against a raw
+ * `process.argv[1]` — is false whenever the script is reached through a
+ * symlinked path: a symlinked checkout, a bin shim, a git worktree, or `/tmp`
+ * on macOS, which is itself a symlink to `/private/tmp`. `main()` then never
+ * runs and the process exits 0 having done nothing. That is what this module
+ * used to do, and an installer that silently installs nothing reports success
+ * while leaving the host unconfigured.
+ *
+ * Both sides are realpath'd, not just `argv[1]`: `import.meta.url` is the real
+ * path by default and the symlinked one under `--preserve-symlinks-main`, so
+ * normalizing one side reopens the same hole on that flag.
+ *
+ * Written out rather than imported: this is a plugin payload, which has no
+ * `./lib/` to resolve against. Same rule and same reasoning as
+ * `scripts/lib/invoked-as-script.mjs`.
+ * @param {string} moduleUrl - The caller's own `import.meta.url`.
+ * @param {string | undefined} [argv1] - Entry path; defaults to `process.argv[1]`.
+ * @returns {boolean} Whether the caller should run its CLI body.
+ */
+export function invokedAsScript(moduleUrl, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+  } catch {
+    return false;
+  }
+}
+
 const SCRIPT_NAME = "remote-agent-aws-setup.sh";
 const INSTALL_COMMAND = `bash scripts/${SCRIPT_NAME}`;
 const VALID_PLATFORMS = new Set([
@@ -333,7 +365,7 @@ export function installRemoteAgentAws(arguments_ = process.argv.slice(2)) {
   return { project, platform, secretName, written };
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   try {
     process.stdout.write(
       `${JSON.stringify(installRemoteAgentAws(), null, 2)}\n`

package/scripts/check-derived-artifacts.mjs

@@ -41,7 +41,8 @@
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import process from "node:process";
-import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const repoRoot = path.resolve(import.meta.dirname, "..");
 
@@ -232,6 +233,6 @@ function main() {
   process.exit(1);
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/scripts/check-duplicate-versions.mjs

@@ -93,6 +93,8 @@ import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
 const REPO_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   ".."
@@ -710,6 +712,6 @@ function main() {
   if (options.strict && violations > 0) process.exitCode = 1;
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/scripts/check-required-check-promotions.mjs

@@ -137,9 +137,10 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import yaml from "js-yaml";
 
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const HEADROOM_EVIDENCE_MISSING = "headroom-evidence-missing";
@@ -775,6 +776,6 @@ function main() {
   if (result.violations.length > 0) process.exitCode = 1;
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/scripts/generate-codex-plugin-artifacts.mjs

@@ -38,6 +38,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const CODEX_PLUGIN_DIR = ".codex-plugin";
@@ -1115,9 +1117,6 @@ function metadataFor(pluginName, claudeManifest) {
 
 // Run the generator only when invoked directly (e.g. via build-plugins.sh),
 // not when this module is imported (e.g. by unit tests for the parser).
-if (
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === fs.realpathSync(process.argv[1])
-) {
+if (invokedAsScript(import.meta.url)) {
   main();
 }

package/scripts/materialize-copy-overwrite.mjs

@@ -25,7 +25,8 @@
  */
 import { readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+
+import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /**
  * The `copy-overwrite` ownership contract, verbatim from the header #2545
@@ -151,7 +152,7 @@ export const materialize = (source, destination) => {
   );
 };
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
+if (invokedAsScript(import.meta.url)) {
   const [source, destination] = process.argv.slice(2);
   if (!source || !destination) {
     console.error(