@codyswann/lisa 4.21.6 → 4.22.2

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.21.6",
+  "version": "4.22.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -281,7 +281,7 @@ Values never enter that process, so its output cannot leak one even if logged.
 
 | Provider | Read | Write (rotation only) |
 | --- | --- | --- |
-| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit` |
+| `bitwarden` | `bws secret list --output json` → index by `key` | `bws secret edit`; temporary `create`/`delete` for AWS publication coordination |
 | `doppler` | `doppler secrets download --no-file --format json` | not implemented |
 | `env` | environment only; the provider is the environment | n/a |
 | `1password` | `op read "op://<vault>/<name>/credential"` | not implemented |
@@ -297,6 +297,31 @@ secret you would otherwise store inside it.
 
 Unimplemented providers fail with a message naming where to add them, rather than failing obscurely. Do not claim support that does not exist.
 
+### AWS bootstrap publication coordination
+
+`publish-aws-bootstrap.mjs publish` and `preflight` serialize mutations of
+`LISA_AWS_BOOTSTRAP_JSON` in the provider. Each contender creates a unique,
+non-secret coordination record in the target record's Bitwarden project. The
+oldest active contender wins by provider-issued `creationDate`, with the
+provider id as a deterministic tie-breaker. Later contenders remove themselves
+and stop before the bundle is written.
+
+The winner re-reads the target after acquisition, then holds the coordination
+record across the no-op write check, candidate verification, replacement,
+read-back, post-write verification, and any rollback. Cleanup deletes the
+coordination record and proves it no longer appears in the provider. Records
+older than 30 minutes are expired and removed on the next attempt, covering a
+killed host without permitting a permanent lock.
+
+Coordination keys start with `LISA_COORDINATION_` and are excluded before
+normal secret selection, so they can never resolve or materialize as
+credentials. Their value is a fixed public sentinel; no credential is copied
+into them. This publication lock is separate from the advisory rotation lease
+record used by `rotate-secret.mjs`.
+
+Ordinary session refresh only reads and materializes existing provider values.
+It neither creates coordination records nor writes the AWS bundle.
+
 Cache **in-process only**. Never write a resolved value to disk except through the materialization contract above.
 
 ## Doctor checks worth wiring

package/plugins/src/base/skills/lisa-secrets-access/scripts/providers.mjs

@@ -33,6 +33,17 @@ export const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
  */
 export const LEASE_KEY = "LISA_ROTATION_LEASES";
 
+/**
+ * Prefix reserved for provider-side coordination records.
+ *
+ * These records contain no credential material. They exist only long enough
+ * to serialize a provider mutation and must never cross the exposure boundary
+ * into a shell, file, hook, or CI environment.
+ */
+export const COORDINATION_KEY_PREFIX = "LISA_COORDINATION_";
+
+const COORDINATION_VALUE = "coordination-only";
+
 /**
  * The environment variable each provider's CLI reads its own bootstrap from.
  *
@@ -177,7 +188,7 @@ function fromKeychain(key) {
  * caller may see, so the set it returns *is* the permitted set. Restating that
  * as a list in config would duplicate a boundary the provider already enforces.
  * @param {object} cfg Resolved configuration.
- * @returns {Array<{key: string, value: string, note: string, projectId: string|null}>} Rows.
+ * @returns {Array<{key: string, value: string, note: string, projectId: string|null, id?: string|null, creationDate?: string|null, revisionDate?: string|null}>} Rows.
  */
 export function fetchRaw(cfg) {
   const env = providerEnv(cfg);
@@ -201,6 +212,8 @@ export function fetchRaw(cfg) {
       note: s.note ?? "",
       projectId: s.projectId ?? null,
       id: s.id ?? null,
+      creationDate: s.creationDate ?? null,
+      revisionDate: s.revisionDate ?? null,
     }));
   }
 
@@ -248,7 +261,7 @@ function run(bin, args, env) {
  * which is neither stable nor visible at the call site.
  * @param {Array<object>} rows Raw provider rows.
  * @param {{projectIds: string[], excludeKeys: string[]}} narrow Narrowing controls.
- * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ * @returns {Map<string, {value: string, note: string, id: string|null, projectId: string|null, creationDate: string|null, revisionDate: string|null}>} Selected secrets by name.
  */
 export function normalizeRows(
   rows,
@@ -260,6 +273,12 @@ export function normalizeRows(
 
   for (const row of rows) {
     if (projects.size && !projects.has(row.projectId)) continue;
+    if (
+      typeof row.key === "string" &&
+      row.key.startsWith(COORDINATION_KEY_PREFIX)
+    ) {
+      continue;
+    }
     if (typeof row.key !== "string" || !ENV_KEY.test(row.key)) continue;
     if (excluded.has(row.key)) continue;
     if (out.has(row.key)) {
@@ -276,6 +295,9 @@ export function normalizeRows(
       value: row.value,
       note: row.note ?? "",
       id: row.id ?? null,
+      projectId: row.projectId ?? null,
+      creationDate: row.creationDate ?? null,
+      revisionDate: row.revisionDate ?? null,
     });
   }
   return out;
@@ -370,3 +392,69 @@ export function writeSecret(cfg, id, value) {
       `Rotation requires a proven write path; add one in providers.mjs.`
   );
 }
+
+/**
+ * Create one provider-issued publication contender in the target project.
+ *
+ * The deliberately constrained interface accepts no value: coordination
+ * records always contain the same public sentinel, which prevents this helper
+ * from becoming an alternate credential-write path.
+ * @param {object} cfg Resolved configuration.
+ * @param {string} key Unique coordination key.
+ * @param {string} projectId Project containing the target provider record.
+ * @param {string} note Non-sensitive lifecycle metadata.
+ * @returns {object} The provider-issued coordination row.
+ */
+export function createCoordinationRecord(cfg, key, projectId, note) {
+  const env = providerEnv(cfg);
+
+  if (cfg.provider === "bitwarden") {
+    const raw = run(
+      "bws",
+      [
+        "secret",
+        "create",
+        key,
+        COORDINATION_VALUE,
+        projectId,
+        "--note",
+        note,
+        "--output",
+        "json",
+      ],
+      env
+    );
+    const created = JSON.parse(raw);
+    return {
+      key: created.key,
+      value: created.value,
+      note: created.note ?? "",
+      projectId: created.projectId ?? null,
+      id: created.id ?? null,
+      creationDate: created.creationDate ?? null,
+      revisionDate: created.revisionDate ?? null,
+    };
+  }
+  throw new Error(
+    `provider "${cfg.provider}" has no coordination-record creation implemented.\n` +
+      `AWS bootstrap publication requires a provider-backed single-writer lock.`
+  );
+}
+
+/**
+ * Remove one provider-side coordination record by its provider identifier.
+ * @param {object} cfg Resolved configuration.
+ * @param {string} id Provider-side identifier for the coordination record.
+ */
+export function removeCoordinationRecord(cfg, id) {
+  const env = providerEnv(cfg);
+
+  if (cfg.provider === "bitwarden") {
+    run("bws", ["secret", "delete", id, "--output", "none"], env);
+    return;
+  }
+  throw new Error(
+    `provider "${cfg.provider}" has no coordination-record deletion implemented.\n` +
+      `AWS bootstrap publication requires verified lock cleanup.`
+  );
+}