@codyswann/lisa 4.21.4 → 4.21.5

package/dist/core/upstream-evidence-manifest.js

@@ -655,7 +655,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/skills/lisa-secrets-access/scripts/preflight-secrets.mjs": "98a0a541041d543fe91e6260da4a25e383123a0eb40bad32a4d59551b7da8db8",
     "plugins/src/base/skills/lisa-secrets-access/scripts/prompt-secret.mjs": "22b28bcdf49b9b0fcd1b15639e031655efacc028b74d48d57e2275f3e1557508",
     "plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs": "bc0c75528f82f92478b10d75c9c60349c50160594255f5bafd7bfc03e8a54fee",
-    "plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs": "992b26b13a96d358e388d070fb4cfeaf628f527e9a23f19aba662d190560879f",
+    "plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs": "69a614f2bdb7a169dc19561457fc09fb45402d4617e9802004243aeb74abd1db",
     "plugins/src/base/skills/lisa-secrets-access/scripts/read-secret-note.mjs": "735434e25bf1db9f2f7eb3d5ede8361cba01b922d65931393bd36e6f96531654",
     "plugins/src/base/skills/lisa-secrets-access/scripts/resolve-secret.mjs": "4170220c95f410072f3871f58938b7575684254480d0645e3dbb1535cf09d7a7",
     "plugins/src/base/skills/lisa-secrets-access/scripts/rotate-secret.mjs": "adada60f766760395858c69ef784654e9e096943485ed237c395c8fc2ca8e20f",

package/package.json

@@ -159,7 +159,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -298,5 +298,5 @@
     "vite": "^8.0.16"
   },
   "type": "module",
-  "lisaReleaseCommit": "5f434c7c7b16ad75f5c91e8403f3f338820cb7d0"
+  "lisaReleaseCommit": "3058845dd698f4d6fd2bb7356825d96f65e008ce"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.4",
+  "version": "4.21.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -126,6 +126,10 @@ export function candidateAwsEnvironment(bundle) {
   env.AWS_SECRET_ACCESS_KEY = String(
     bundle.secretAccessKey ?? bundle.aws_secret_access_key
   );
+  // STS verification must reach AWS, not an endpoint inherited from the host.
+  // A redirected endpoint could otherwise answer the probe and turn a green
+  // result into evidence about a local emulator or an attacker-controlled URL.
+  env.AWS_IGNORE_CONFIGURED_ENDPOINT_URLS = "true";
   env.AWS_PAGER = "";
   return env;
 }
@@ -228,12 +232,17 @@ export function preflightAwsBootstrap(cfg, operations = {}) {
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
  * @param {{id: string, value: string}} previous Previous entry.
+ * @param {string} candidateRaw Exact value written by this publication.
  * @param {Function} fetch Provider reader.
  * @param {Function} write Provider writer.
  * @returns {string} Human-readable rollback outcome with no secret material.
  */
-function rollback(cfg, previous, fetch, write) {
+function rollback(cfg, previous, candidateRaw, fetch, write) {
   try {
+    const current = currentEntry(cfg, fetch);
+    if (current.value !== candidateRaw) {
+      return "rollback skipped because the provider changed after this publication";
+    }
     write(cfg, previous.id, previous.value);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
@@ -288,7 +297,13 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   } catch (error) {
     const reason =
       error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(cfg, previous, fetch, write);
+    const rollbackOutcome = rollback(
+      cfg,
+      previous,
+      candidate.raw,
+      fetch,
+      write
+    );
     throw new Error(
       `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
     );