@codyswann/lisa 3.54.1 โ†’ 3.54.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/all/copy-overwrite/scripts/lisa-gates.mjs +12 -1
  2. package/dist/cli/ui-ci-quality-jobs-compute.d.ts.map +1 -1
  3. package/dist/cli/ui-ci-quality-jobs-compute.js +0 -1
  4. package/dist/cli/ui-ci-quality-jobs-compute.js.map +1 -1
  5. package/dist/core/lisa-owned-hash-ledger.d.ts.map +1 -1
  6. package/dist/core/lisa-owned-hash-ledger.js +3 -0
  7. package/dist/core/lisa-owned-hash-ledger.js.map +1 -1
  8. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  9. package/dist/core/upstream-evidence-manifest.js +10 -9
  10. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  11. package/expo/create-only/.github/required-checks.json +1 -1
  12. package/nestjs/create-only/.github/required-checks.json +1 -1
  13. package/package.json +1 -1
  14. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  15. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  16. package/plugins/lisa/hooks/threshold-ratchet.mjs +17 -0
  17. package/plugins/lisa/scripts/plugin-sync-explain.mjs +27 -1
  18. package/plugins/lisa-agy/plugin.json +1 -1
  19. package/plugins/lisa-agy/scripts/plugin-sync-explain.mjs +27 -1
  20. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  21. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  22. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  23. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  24. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  25. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  26. package/plugins/lisa-copilot/hooks/threshold-ratchet.mjs +17 -0
  27. package/plugins/lisa-copilot/scripts/plugin-sync-explain.mjs +27 -1
  28. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  29. package/plugins/lisa-cursor/hooks/threshold-ratchet.mjs +17 -0
  30. package/plugins/lisa-cursor/scripts/plugin-sync-explain.mjs +27 -1
  31. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  32. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  33. package/plugins/lisa-expo-agy/plugin.json +1 -1
  34. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  35. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  36. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  37. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  38. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  39. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  40. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  41. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  42. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  43. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  44. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  45. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  46. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  47. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  48. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  49. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  50. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  51. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  52. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  53. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  54. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  55. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  56. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  57. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  58. package/plugins/lisa-rails-agy/plugin.json +1 -1
  59. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  60. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  61. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  62. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  63. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  64. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  65. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  66. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  67. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  68. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  69. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  70. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  71. package/plugins/src/base/hooks/threshold-ratchet.mjs +17 -0
  72. package/plugins/src/base/scripts/plugin-sync-explain.mjs +27 -1
  73. package/rails/copy-overwrite/scripts/check-threshold-ratchet.mjs +17 -0
  74. package/scripts/check-security-floors.mjs +36 -10
  75. package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs +17 -0
  76. package/ui/index.html +0 -13
@@ -42,7 +42,7 @@
42
42
  "๐Ÿ” Quality Checks / ๐Ÿงช Run E2E Tests"
43
43
  ],
44
44
  "ruleset_required": false,
45
- "reason": "A fresh Expo project has no `test:e2e` script. Lisa's quality callee guards each job on script existence, so un-skipping it would produce a real run that succeeds having tested nothing โ€” a worse false green than the skip. Not a required context, so skipping removes a check rather than faking one."
45
+ "reason": "Inert since the `test_e2e` job was deleted from Lisa's quality callee โ€” the browser suite lives in `playwright-e2e.yml`, governed by the `e2e-browser` gate, and no job posts this context any more. The token stays in `skip_jobs` and stays declared here because a token with no declaration is reported as `undeclared_skip_token`. If your ruleset still requires \"๐Ÿ” Quality Checks / ๐Ÿงช Run E2E Tests\", DE-REQUIRE IT: a required context that never reports is pending forever and blocks every open pull request."
46
46
  },
47
47
  "playwright_e2e": {
48
48
  "suppressed_contexts": [
@@ -41,7 +41,7 @@
41
41
  "๐Ÿ” Quality Checks / ๐Ÿงช Run E2E Tests"
42
42
  ],
43
43
  "ruleset_required": false,
44
- "reason": "A NestJS API's end-to-end suite needs a database and a booted app, which the shipped ci.yml does not provision. Lisa's quality callee guards each job on script existence, so un-skipping it without that scaffolding would produce a run that succeeds having tested nothing โ€” a worse false green than the skip. Not a required context, so skipping removes a check rather than faking one."
44
+ "reason": "Inert since the `test_e2e` job was deleted from Lisa's quality callee โ€” the browser suite lives in `playwright-e2e.yml`, governed by the `e2e-browser` gate, and no job posts this context any more. The token stays in `skip_jobs` and stays declared here because a token with no declaration is reported as `undeclared_skip_token`. If your ruleset still requires \"๐Ÿ” Quality Checks / ๐Ÿงช Run E2E Tests\", DE-REQUIRE IT: a required context that never reports is pending forever and blocks every open pull request."
45
45
  },
46
46
  "playwright_e2e": {
47
47
  "suppressed_contexts": [
package/package.json CHANGED
@@ -141,7 +141,7 @@
141
141
  "zod-validation-error": "^4.0.0"
142
142
  },
143
143
  "name": "@codyswann/lisa",
144
- "version": "3.54.1",
144
+ "version": "3.54.3",
145
145
  "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
146
146
  "main": "dist/index.js",
147
147
  "exports": {
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Universal governance โ€” agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -53,8 +53,25 @@ import {
53
53
  * Standard git locations, checked in order so the executable comes from a
54
54
  * fixed, unwriteable directory rather than a PATH lookup. The bare "git"
55
55
  * fallback keeps unusual layouts (e.g. Windows git-bash) working.
56
+ *
57
+ * Order within that constraint is set by measurement, not by convention. On
58
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
59
+ * developer directory and re-executes the real binary there. Dispatching
60
+ * through it costs a **median 33 ms against 15 ms** for either
61
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
62
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
63
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
64
+ *
65
+ * The two entries promoted ahead of it are the developer-directory gits the
66
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
67
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
68
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
69
+ * they already were. Neither promoted path exists on Linux, so every CI runner
70
+ * resolves precisely what it resolved before.
56
71
  */
57
72
  const GIT_LOCATIONS = [
73
+ "/Library/Developer/CommandLineTools/usr/bin/git",
74
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
75
  "/usr/bin/git",
59
76
  "/usr/local/bin/git",
60
77
  "/opt/homebrew/bin/git",
@@ -33,7 +33,33 @@ export const PLUGIN_SYNC_CLASSIFICATIONS = [
33
33
  const PLUGINS_DIR = "plugins";
34
34
  const SOURCE_ROOT = "plugins/src";
35
35
  const MARKETPLACE = ".claude-plugin/marketplace.json";
36
- const GIT_BIN = "/usr/bin/git";
36
+ /**
37
+ * Fixed absolute git locations, tried in order rather than a bare command name
38
+ * so a writeable directory early on `PATH` cannot decide which binary runs.
39
+ *
40
+ * Order within that constraint is set by measurement, not by convention. On
41
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
42
+ * developer directory and re-executes the real binary there. Dispatching
43
+ * through it costs a **median 33 ms against 15 ms** for either
44
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
45
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
46
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
47
+ *
48
+ * The two entries promoted ahead of it are the developer-directory gits the
49
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
50
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
51
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
52
+ * they already were. Neither promoted path exists on Linux, so every CI runner
53
+ * resolves precisely what it resolved before.
54
+ */
55
+ const GIT_LOCATIONS = [
56
+ "/Library/Developer/CommandLineTools/usr/bin/git",
57
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
+ "/usr/bin/git",
59
+ "/usr/local/bin/git",
60
+ "/opt/homebrew/bin/git",
61
+ ];
62
+ const GIT_BIN = GIT_LOCATIONS.find(candidate => existsSync(candidate)) ?? "git";
37
63
 
38
64
  /**
39
65
  * @typedef {{
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Universal governance โ€” agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -33,7 +33,33 @@ export const PLUGIN_SYNC_CLASSIFICATIONS = [
33
33
  const PLUGINS_DIR = "plugins";
34
34
  const SOURCE_ROOT = "plugins/src";
35
35
  const MARKETPLACE = ".claude-plugin/marketplace.json";
36
- const GIT_BIN = "/usr/bin/git";
36
+ /**
37
+ * Fixed absolute git locations, tried in order rather than a bare command name
38
+ * so a writeable directory early on `PATH` cannot decide which binary runs.
39
+ *
40
+ * Order within that constraint is set by measurement, not by convention. On
41
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
42
+ * developer directory and re-executes the real binary there. Dispatching
43
+ * through it costs a **median 33 ms against 15 ms** for either
44
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
45
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
46
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
47
+ *
48
+ * The two entries promoted ahead of it are the developer-directory gits the
49
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
50
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
51
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
52
+ * they already were. Neither promoted path exists on Linux, so every CI runner
53
+ * resolves precisely what it resolved before.
54
+ */
55
+ const GIT_LOCATIONS = [
56
+ "/Library/Developer/CommandLineTools/usr/bin/git",
57
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
+ "/usr/bin/git",
59
+ "/usr/local/bin/git",
60
+ "/opt/homebrew/bin/git",
61
+ ];
62
+ const GIT_BIN = GIT_LOCATIONS.find(candidate => existsSync(candidate)) ?? "git";
37
63
 
38
64
  /**
39
65
  * @typedef {{
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "AWS CDK-specific Lisa plugin.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Universal governance โ€” agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -53,8 +53,25 @@ import {
53
53
  * Standard git locations, checked in order so the executable comes from a
54
54
  * fixed, unwriteable directory rather than a PATH lookup. The bare "git"
55
55
  * fallback keeps unusual layouts (e.g. Windows git-bash) working.
56
+ *
57
+ * Order within that constraint is set by measurement, not by convention. On
58
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
59
+ * developer directory and re-executes the real binary there. Dispatching
60
+ * through it costs a **median 33 ms against 15 ms** for either
61
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
62
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
63
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
64
+ *
65
+ * The two entries promoted ahead of it are the developer-directory gits the
66
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
67
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
68
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
69
+ * they already were. Neither promoted path exists on Linux, so every CI runner
70
+ * resolves precisely what it resolved before.
56
71
  */
57
72
  const GIT_LOCATIONS = [
73
+ "/Library/Developer/CommandLineTools/usr/bin/git",
74
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
75
  "/usr/bin/git",
59
76
  "/usr/local/bin/git",
60
77
  "/opt/homebrew/bin/git",
@@ -33,7 +33,33 @@ export const PLUGIN_SYNC_CLASSIFICATIONS = [
33
33
  const PLUGINS_DIR = "plugins";
34
34
  const SOURCE_ROOT = "plugins/src";
35
35
  const MARKETPLACE = ".claude-plugin/marketplace.json";
36
- const GIT_BIN = "/usr/bin/git";
36
+ /**
37
+ * Fixed absolute git locations, tried in order rather than a bare command name
38
+ * so a writeable directory early on `PATH` cannot decide which binary runs.
39
+ *
40
+ * Order within that constraint is set by measurement, not by convention. On
41
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
42
+ * developer directory and re-executes the real binary there. Dispatching
43
+ * through it costs a **median 33 ms against 15 ms** for either
44
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
45
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
46
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
47
+ *
48
+ * The two entries promoted ahead of it are the developer-directory gits the
49
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
50
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
51
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
52
+ * they already were. Neither promoted path exists on Linux, so every CI runner
53
+ * resolves precisely what it resolved before.
54
+ */
55
+ const GIT_LOCATIONS = [
56
+ "/Library/Developer/CommandLineTools/usr/bin/git",
57
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
+ "/usr/bin/git",
59
+ "/usr/local/bin/git",
60
+ "/opt/homebrew/bin/git",
61
+ ];
62
+ const GIT_BIN = GIT_LOCATIONS.find(candidate => existsSync(candidate)) ?? "git";
37
63
 
38
64
  /**
39
65
  * @typedef {{
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Universal governance โ€” agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -53,8 +53,25 @@ import {
53
53
  * Standard git locations, checked in order so the executable comes from a
54
54
  * fixed, unwriteable directory rather than a PATH lookup. The bare "git"
55
55
  * fallback keeps unusual layouts (e.g. Windows git-bash) working.
56
+ *
57
+ * Order within that constraint is set by measurement, not by convention. On
58
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
59
+ * developer directory and re-executes the real binary there. Dispatching
60
+ * through it costs a **median 33 ms against 15 ms** for either
61
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
62
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
63
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
64
+ *
65
+ * The two entries promoted ahead of it are the developer-directory gits the
66
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
67
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
68
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
69
+ * they already were. Neither promoted path exists on Linux, so every CI runner
70
+ * resolves precisely what it resolved before.
56
71
  */
57
72
  const GIT_LOCATIONS = [
73
+ "/Library/Developer/CommandLineTools/usr/bin/git",
74
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
75
  "/usr/bin/git",
59
76
  "/usr/local/bin/git",
60
77
  "/opt/homebrew/bin/git",
@@ -33,7 +33,33 @@ export const PLUGIN_SYNC_CLASSIFICATIONS = [
33
33
  const PLUGINS_DIR = "plugins";
34
34
  const SOURCE_ROOT = "plugins/src";
35
35
  const MARKETPLACE = ".claude-plugin/marketplace.json";
36
- const GIT_BIN = "/usr/bin/git";
36
+ /**
37
+ * Fixed absolute git locations, tried in order rather than a bare command name
38
+ * so a writeable directory early on `PATH` cannot decide which binary runs.
39
+ *
40
+ * Order within that constraint is set by measurement, not by convention. On
41
+ * macOS `/usr/bin/git` is not git: it is Apple's `xcrun` shim, which locates a
42
+ * developer directory and re-executes the real binary there. Dispatching
43
+ * through it costs a **median 33 ms against 15 ms** for either
44
+ * developer-directory git, and **100 ms against 21 ms at p90** โ€” randomized
45
+ * call order, fixed inter-call gaps, `git rev-parse --show-toplevel`, n=30 each
46
+ * (lisa#2898). The call does no work at all; the difference is the dispatch.
47
+ *
48
+ * The two entries promoted ahead of it are the developer-directory gits the
49
+ * shim itself re-executes. Both are `root:wheel` files in system locations, so
50
+ * this is the same trust class as `/usr/bin/git` and not a relaxation: the
51
+ * user-writable `/usr/local` and Homebrew entries stay behind it, exactly where
52
+ * they already were. Neither promoted path exists on Linux, so every CI runner
53
+ * resolves precisely what it resolved before.
54
+ */
55
+ const GIT_LOCATIONS = [
56
+ "/Library/Developer/CommandLineTools/usr/bin/git",
57
+ "/Applications/Xcode.app/Contents/Developer/usr/bin/git",
58
+ "/usr/bin/git",
59
+ "/usr/local/bin/git",
60
+ "/opt/homebrew/bin/git",
61
+ ];
62
+ const GIT_BIN = GIT_LOCATIONS.find(candidate => existsSync(candidate)) ?? "git";
37
63
 
38
64
  /**
39
65
  * @typedef {{
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw โ€” facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw โ€” facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw โ€” facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw โ€” facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw โ€” facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Ruby on Rails-specific hooks โ€” RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Ruby on Rails-specific hooks โ€” RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.54.1",
3
+ "version": "3.54.3",
4
4
  "description": "Ruby on Rails-specific hooks โ€” RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"