@codyswann/lisa 4.10.7 → 4.10.9

package/dist/health/declared-checks-inspection.d.ts

@@ -1,25 +1,3 @@
-/**
- * Hold the gates declaration against the live ruleset, on a path a machine
- * takes on its own.
- *
- * The comparison itself was not the missing piece. A finished reconciler has
- * existed for some time, unit- and mutation-covered, reporting MISSING, EXTRA,
- * MATCHED and a distinct UNPROVEN — and nothing invoked it. Its only callers
- * were copies of prose in a skill telling a human to type the command, which
- * makes it indistinguishable from a control that was never written. This module
- * is the same comparison sitting on a scheduled, machine-invoked path.
- *
- * Two rules it does not get to bend:
- *
- * - **A source this run could not read is `warn`, never `pass`.** A comparison
- *   that silently passes when it could not reach the live ruleset is the exact
- *   defect this check exists to catch, sited on the check itself.
- * - **Nothing here proposes removing a live required context.** A context no
- *   declaration asks for is reported so it can be told apart from a third-party
- *   check, not so it can be pruned. The remedy vocabulary in
- *   `core/gate-declaration-drift` structurally contains no removal.
- * @module health/declared-checks-inspection
- */
 import { type DeclarationDriftReport } from "../core/gate-declaration-drift.js";
 import type { HealthFinding } from "./contract.js";
 import { type RulesetReader } from "./ruleset-inspection.js";

package/dist/health/declared-checks-inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declared-checks-inspection.d.ts","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAiCjC;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,GAC7B,aAAa,CAmCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAkDxB"}
+{"version":3,"file":"declared-checks-inspection.d.ts","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AA0CA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,yBAAyB,CAAC;AAiCjC;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,sBAAsB,GAC7B,aAAa,CAqDf;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,aAAa,CAAC,CAgExB"}

package/dist/health/declared-checks-inspection.js

@@ -14,13 +14,33 @@
  * - **A source this run could not read is `warn`, never `pass`.** A comparison
  *   that silently passes when it could not reach the live ruleset is the exact
  *   defect this check exists to catch, sited on the check itself.
- * - **Nothing here proposes removing a live required context.** A context no
- *   declaration asks for is reported so it can be told apart from a third-party
- *   check, not so it can be pruned. The remedy vocabulary in
- *   `core/gate-declaration-drift` structurally contains no removal.
+ * - **Nothing here proposes removing a live required context, with one
+ *   evidenced exception.** A context no declaration asks for is reported so it
+ *   can be told apart from a third-party check, not so it can be pruned. The
+ *   sole removal in `core/gate-declaration-drift`'s vocabulary is reachable
+ *   only from a `previousLabels` match — Lisa's own record that Lisa renamed
+ *   the job — and is a REPORT even then: the ruleset carrying the retired name
+ *   is frequently one Lisa does not manage, and editing somebody else's
+ *   ruleset is not this check's decision to make.
+ *
+ * The live reader here lists every ruleset the repository has, managed or not,
+ * and the comparison runs over all of them. That breadth is the point: every
+ * RECONCILING surface is scoped per MANAGED ruleset name. The reconciliation
+ * in `lisa-github-rulesets.sh` makes Lisa's own templates match and never
+ * touches a ruleset somebody hand-made, and `health/ruleset-inspection`
+ * compares the same managed names — so a hand-made ruleset requiring a retired
+ * context was invisible to both. That is the #3067 failure.
+ *
+ * Since #3067, `lisa-github-rulesets.sh` also carries a REPORT-ONLY sweep
+ * (`report_retired_contexts`) that does read every live ruleset. An operator
+ * chasing a hand-made ruleset therefore has two places to look, and neither
+ * one edits it: that sweep prints what it found at the end of a run, and this
+ * module is the same finding on a scheduled, machine-invoked path. The
+ * managed-only scoping above still describes what either surface will CHANGE.
  * @module health/declared-checks-inspection
  */
-import { classifyDeclarationDrift, contextOwners, } from "../core/gate-declaration-drift.js";
+import { contextOwners } from "../core/gate-context-owners.js";
+import { classifyDeclarationDrift, } from "../core/gate-declaration-drift.js";
 import { loadGateRegistry } from "../cli/gate-report-registry.js";
 import { deterministicFinding, namedReason } from "./finding-utils.js";
 import { liveRequiredContexts, } from "./ruleset-inspection.js";
@@ -61,6 +81,15 @@ function githubTarget(config) {
  * @returns The finding
  */
 export function declaredChecksFinding(report) {
+    // FIRST, ahead of the contradictions. A retired context is the only verdict
+    // here that may be blocking every pull request in the repository at this
+    // moment, and it is the one an operator cannot find on their own: there is
+    // no failing job to open and no log to read, so the reason it blocks has to
+    // come from this line or from nowhere.
+    const retired = report.entries.filter(entry => entry.verdict === "enforced-context-retired");
+    if (retired.length > 0) {
+        return deterministicFinding(CHECK, "fail", namedReason("Live branch protection requires contexts nothing will ever post — these are not failing, they can never report, and every pull request here waits on them forever", retired.map(entry => entry.detail)));
+    }
     const contradictions = report.entries.filter(entry => entry.verdict === "declared-not-enforced" ||
         entry.verdict === "enforced-declared-off");
     if (contradictions.length > 0) {
@@ -100,6 +129,16 @@ export async function declaredChecksDriftFinding(projectRoot, config, reader, ti
     if (actual === undefined) {
         return deterministicFinding(CHECK, "warn", "Unproven: live branch protection could not be read within the deterministic deadline, so nothing here claims a declaration does or does not match it.");
     }
+    // An empty sweep and a clean repository are otherwise identical, and the
+    // empty one is the more likely: a token without the ruleset scope, an
+    // organization-level ruleset the reader cannot see, and a repository that
+    // genuinely has no protection all arrive here as zero rows. Comparing
+    // against zero rulesets would report every declared requirement as enforced
+    // by nothing — a different and false claim, and exactly what the
+    // comparator's own contract forbids its callers from asking it for.
+    if (actual.length === 0) {
+        return deterministicFinding(CHECK, "warn", "Unproven: the repository reported no rulesets at all. A token without the ruleset scope, an organization ruleset this reader cannot see, and a repository with no protection are indistinguishable from here — so this run inspected nothing rather than finding nothing.");
+    }
     const gates = readGatesSafely(registry, projectRoot);
     if (gates === null) {
         return deterministicFinding(CHECK, "warn", "Unproven: the gates block could not be read, so the contexts it implies could not be compared with live branch protection.");

package/dist/health/declared-checks-inspection.js.map

@@ -1 +1 @@
-{"version":3,"file":"declared-checks-inspection.js","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,wBAAwB,EACxB,aAAa,GAEd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,oBAAoB,GAGrB,MAAM,yBAAyB,CAAC;AAEjC,8BAA8B;AAC9B,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,qDAAqD;AACrD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;GAIG;AACH,SAAS,YAAY,CACnB,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,KAAK,QAAQ;QACxB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA8B;IAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAC1C,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,uBAAuB;QACzC,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAC5C,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,WAAW,CACT,sDAAsD,EACtD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAChC,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,qBAAqB;QACvC,KAAK,CAAC,OAAO,KAAK,4BAA4B,CACjD,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,mFAAmF,CACpF;QACH,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,WAAW,CACT,iEAAiE,EACjE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACzD,CACF,CAAC;AACR,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,MAAyC,EACzC,MAAqB,EACrB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC;QACvB,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,aAAa,CAAC;YACpB,QAAQ;YACR,KAAK;YACL,YAAY,EAAE,qBAAqB;SACpC,CAAC;QACF,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,QAAQ,CACrB,MAAqB,EACrB,OAMC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CACjB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAqB,EACrB,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"declared-checks-inspection.js","sourceRoot":"","sources":["../../src/health/declared-checks-inspection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,oBAAoB,GAGrB,MAAM,yBAAyB,CAAC;AAEjC,8BAA8B;AAC9B,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,qDAAqD;AACrD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;GAIG;AACH,SAAS,YAAY,CACnB,MAAyC;IAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,OAAO,IAAI,KAAK,QAAQ;QACxB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA8B;IAE9B,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACnC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,0BAA0B,CACtD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,WAAW,CACT,mKAAmK,EACnK,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAC1C,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,uBAAuB;QACzC,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAC5C,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,WAAW,CACT,sDAAsD,EACtD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACnE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAChC,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,OAAO,KAAK,qBAAqB;QACvC,KAAK,CAAC,OAAO,KAAK,4BAA4B,CACjD,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,mFAAmF,CACpF;QACH,CAAC,CAAC,oBAAoB,CAClB,KAAK,EACL,MAAM,EACN,WAAW,CACT,iEAAiE,EACjE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CACzD,CACF,CAAC;AACR,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,MAAyC,EACzC,MAAqB,EACrB,SAAiB,EACjB,MAAmB;IAEnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW;QACX,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,iEAAiE;IACjE,oEAAoE;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,2QAA2Q,CAC5Q,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,oBAAoB,CACzB,KAAK,EACL,MAAM,EACN,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAC1B,wBAAwB,CAAC;QACvB,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,aAAa,CAAC;YACpB,QAAQ;YACR,KAAK;YACL,YAAY,EAAE,qBAAqB;SACpC,CAAC;QACF,QAAQ,EAAE,oBAAoB,CAAC,MAAM,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,QAAQ,CACrB,MAAqB,EACrB,OAMC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CACjB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAOD;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAqB,EACrB,WAAmB;IAEnB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/opencode/plugin-templates/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -449,7 +449,7 @@ for i, token in enumerate(normalized_tokens):
     # `git -c` propagates command-scope config through GIT_CONFIG_PARAMETERS.
     # Parsing the value as Git's shell-quoted parameter list distinguishes the
     # key from an unrelated value that merely contains the same text.
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/package.json

@@ -149,7 +149,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-no-verify.agy.sh

@@ -356,7 +356,7 @@ for i, token in enumerate(normalized_tokens):
     key_match = re.match(r"git_config_key_\d+=(.*)$", lowered, re.DOTALL)
     if key_match and key_match.group(1).strip().strip("'\"") == "core.hookspath":
         sys.exit(1)
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/plugins/lisa/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -449,7 +449,7 @@ for i, token in enumerate(normalized_tokens):
     # `git -c` propagates command-scope config through GIT_CONFIG_PARAMETERS.
     # Parsing the value as Git's shell-quoted parameter list distinguishes the
     # key from an unrelated value that merely contains the same text.
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/plugins/lisa-agy/hooks/block-no-verify.agy.sh

@@ -356,7 +356,7 @@ for i, token in enumerate(normalized_tokens):
     key_match = re.match(r"git_config_key_\d+=(.*)$", lowered, re.DOTALL)
     if key_match and key_match.group(1).strip().strip("'\"") == "core.hookspath":
         sys.exit(1)
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -449,7 +449,7 @@ for i, token in enumerate(normalized_tokens):
     # `git -c` propagates command-scope config through GIT_CONFIG_PARAMETERS.
     # Parsing the value as Git's shell-quoted parameter list distinguishes the
     # key from an unrelated value that merely contains the same text.
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -449,7 +449,7 @@ for i, token in enumerate(normalized_tokens):
     # `git -c` propagates command-scope config through GIT_CONFIG_PARAMETERS.
     # Parsing the value as Git's shell-quoted parameter list distinguishes the
     # key from an unrelated value that merely contains the same text.
-    if lowered.startswith("git_config_parameters="):
+    if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
         try:
             configured = shlex.split(parameters, posix=True)

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.7",
+  "version": "4.10.9",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"