@codyswann/lisa 4.22.8 → 4.22.10

package/plugins/lisa-cursor/skills/lisa-setup-notion/SKILL.md

@@ -173,9 +173,9 @@ read_notion_token() {
   # than "this function" is deliberate — the old wording asked for something
   # unachievable, and an unachievable rule is one that gets quietly dropped.
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -184,12 +184,9 @@ read_notion_token() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -208,7 +205,7 @@ read_notion_token() {
       local via_lisa
       via_lisa=$(node "$resolver" get NOTION_API_TOKEN 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Legacy fallback: the OS keychain written by the guided flow below, for

package/plugins/lisa-cursor/skills/lisa-setup-remote-aws/SKILL.md

@@ -64,13 +64,18 @@ The lock remains held through rollback and its deletion is verified before the
 command reports success:
 
 ```bash
-aws --profile shared secretsmanager get-secret-value \
-  --secret-id remote-agent-credentials \
+aws secretsmanager get-secret-value \
+  --secret-id <selected-secret-name> \
   --query SecretString \
   --output text \
   | node .claude/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs publish
 ```
 
+Use the same secret name passed to `--secret-name`; the default is
+`remote-agent-credentials`. Add `--profile <source-profile>` only when the
+operator's ambient AWS identity cannot read the emission and the project names
+a source profile. A named `shared` profile is not otherwise required.
+
 Resolve the script from the installed runtime or `node_modules` when the
 `.claude/skills` copy is not present. Never print or place the candidate in an
 argument or temporary file. A CDK deployment followed later by a human copy is

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/SKILL.md

@@ -97,9 +97,14 @@ A surface that **re-runs this script when a container resumes** — Codex Cloud
 A surface that **skips this script whenever a filesystem cache exists** — Claude Code web — must not. Materializing here would write the values once and then never refresh them, so a credential rotated on Tuesday would still be serving Monday's value until the cache expired days later. Those surfaces materialize from a session-start hook instead, which runs every session including a resumed one:
 
 ```sh
-bash scripts/lisa-remote-env/session-start.sh   # guard; reruns toolchain, secrets, then hook
+bash "$CLAUDE_PROJECT_DIR/scripts/lisa-remote-env/session-start.sh"   # project-scoped absolute hook
 ```
 
+The installer also registers a user-scoped hook using the checkout's resolved
+absolute path. If invoking this asset by hand, either use that absolute path or
+change to the repository root first; a bare checkout-relative command is not a
+portable session-start configuration.
+
 The selection comes from the surface's `materializeAt` capability in `lisa-secrets-access`, not from its name, so adding a surface does not mean editing a branch. The hook is committed to the repository, so it also fires on a developer's machine — it exits `0` immediately there rather than failing, because a correct local session must not look broken.
 
 ## Detect before you provision

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/session-start.sh

@@ -46,8 +46,27 @@ here="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)"
 # SessionStart hosts are fail-open, so they surface that result and still allow
 # the agent session to continue.
 bash "${here}/setup.sh" --phase=toolchain "$@"
+
+# The toolchain child cannot export into this parent shell. Its durable output
+# is linked into ~/.local/bin, so make that directory visible before the next
+# child tries to execute the provider CLI it just installed.
+case ":$PATH:" in
+  *":$HOME/.local/bin:"*) ;;
+  *) PATH="$HOME/.local/bin:$PATH"; export PATH ;;
+esac
+
 bash "${here}/setup.sh" --phase=secrets "$@"
 
+# Materialization writes a Lisa-owned block into .profile that sources the
+# generated environment and removes ambient AWS credential poison. The project
+# hook is another non-login child, so load that block here and let the child
+# inherit the exact environment materialization just produced.
+if [ -r "$HOME/.profile" ]; then
+  # The materializer owns this runtime path.
+  # shellcheck disable=SC1090
+  . "$HOME/.profile"
+fi
+
 # A project hook is part of the remote toolchain contract too. It covers tools
 # that cannot be expressed by the pinned manifest, so skipping it on a cached
 # session can leave fresh credentials with no client capable of using them.

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/assets/setup.sh

@@ -132,6 +132,7 @@ for candidate in \
   ".claude/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".agents/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   ".codex/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
+  ".opencode/skills/lisa/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs" \
   "node_modules/@codyswann/lisa/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs"; do
   if [ -f "$candidate" ]; then

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -51,7 +51,10 @@ import { pathDirs } from "../../lisa-setup-workstation/scripts/catalogue.mjs";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
 
-import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -173,12 +176,14 @@ function installReleaseZip(tool, binDir) {
     const archive = join(temporary, "download.zip");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, not after. An unexpected archive must fail
     // before any of its contents reach a directory that is on PATH.
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("unzip", ["-q", "-o", archive, "-d", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     const binary = join(temporary, tool.binary ?? tool.name);
     boundedChildOutput(
@@ -186,6 +191,7 @@ function installReleaseZip(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -210,10 +216,12 @@ function installReleaseTar(tool, binDir) {
     const archive = join(temporary, "download.tar.gz");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     verifyChecksum(archive, tool.sha256, tool.name);
     boundedChildOutput("tar", ["-xzf", archive, "-C", temporary], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Release tarballs usually nest under a versioned directory, so `binary` is
     // a path within the archive rather than a bare name.
@@ -223,6 +231,7 @@ function installReleaseTar(tool, binDir) {
       ["-m", "0755", binary, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -272,6 +281,7 @@ function installReleaseTree(tool, binDir) {
     const archive = join(temporary, "download.archive");
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", archive], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before unpacking, as everywhere else here: an unexpected archive
     // must fail before any of its contents reach the filesystem.
@@ -285,10 +295,12 @@ function installReleaseTree(tool, binDir) {
     if (tool.url.endsWith(".zip")) {
       boundedChildOutput("unzip", ["-q", "-o", archive, "-d", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     } else {
       boundedChildOutput("tar", ["-xzf", archive, "-C", prefix], {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       });
     }
 
@@ -342,6 +354,7 @@ function installReleaseBinary(tool, binDir) {
     const artifact = join(temporary, tool.name);
     boundedChildOutput("curl", ["-fsSL", tool.url, "-o", artifact], {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     });
     // Verify before it reaches a directory on PATH. For this kind that ordering
     // matters more than for the archives: the downloaded file is directly
@@ -353,6 +366,7 @@ function installReleaseBinary(tool, binDir) {
       ["-m", "0755", artifact, join(binDir, tool.name)],
       {
         stdio: "inherit",
+        timeout: SETUP_OPERATION_BUDGET_MS,
       }
     );
   } finally {
@@ -370,6 +384,7 @@ function installNpmGlobal(tool) {
     ["install", "--global", `${tool.package}@${tool.version}`],
     {
       stdio: "inherit",
+      timeout: SETUP_OPERATION_BUDGET_MS,
     }
   );
 }
@@ -509,7 +524,10 @@ function runHook(hook, dryRun) {
   console.log(`\nProject hook: ${hook}`);
   if (dryRun) return;
   chmodSync(path, 0o755);
-  boundedChildOutput("bash", [path], { stdio: "inherit" });
+  boundedChildOutput("bash", [path], {
+    stdio: "inherit",
+    timeout: SETUP_OPERATION_BUDGET_MS,
+  });
 }
 
 /** Phases this runner can execute, in the order they must happen. */
@@ -789,7 +807,10 @@ export function installUserSessionHook(repoRoot, options = {}) {
 
   const dir = join(home, ".claude");
   const settingsPath = join(dir, "settings.json");
-  const command = `bash ${script}`;
+  // Settings stores shell source, so the absolute path still needs quoting.
+  // JSON string syntax is accepted by the shell for ordinary path text and
+  // safely escapes spaces, quotes, dollars and backticks.
+  const command = `bash ${JSON.stringify(script)}`;
 
   let settings = {};
   if (exists(settingsPath)) {
@@ -1506,7 +1527,7 @@ async function main() {
       boundedChildOutput(
         "node",
         dryRun ? [materialize, "--dry-run"] : [materialize],
-        { stdio: "inherit" }
+        { stdio: "inherit", timeout: SETUP_OPERATION_BUDGET_MS }
       );
     } catch (err) {
       if (!retried) throw err;

package/plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/bounded-child.mjs

@@ -83,6 +83,15 @@ import { execFileSync, spawnSync } from "node:child_process";
  */
 export const CHILD_BUDGET_MS = 30_000;
 
+/**
+ * Deadline for setup operations that legitimately include downloads, package
+ * installation, secret-provider calls, or a project-declared hook.
+ *
+ * Kept separate from {@link CHILD_BUDGET_MS}: probes should still fail quickly,
+ * while a cold network install must not be killed by the probe budget.
+ */
+export const SETUP_OPERATION_BUDGET_MS = 10 * 60_000;
+
 /**
  * Whether this value is a child that was killed at its deadline.
  *

package/plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -36,7 +36,10 @@
 import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 
-import { boundedChildOutput } from "./bounded-child.mjs";
+import {
+  boundedChildOutput,
+  SETUP_OPERATION_BUDGET_MS,
+} from "./bounded-child.mjs";
 
 import {
   AGENTS,
@@ -387,7 +390,9 @@ export function installEntry(entry, row, deps = {}) {
 
   try {
     if (entry.kind === "npm-global") {
-      run("npm", ["install", "-g", entry.package]);
+      run("npm", ["install", "-g", entry.package], {
+        timeout: SETUP_OPERATION_BUDGET_MS,
+      });
     } else if (entry.kind === "vendor-script") {
       if (!entry.script) {
         return {
@@ -410,12 +415,11 @@ export function installEntry(entry, row, deps = {}) {
       // exit status is the SHELL's, not curl's, so a 404 feeds an empty script
       // to bash, bash exits 0, and a tool that was never installed is reported
       // as installed. That is exactly what `sonarsource.com/install` did.
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
-        `curl -fsSL ${entry.script} | bash`,
-      ]);
+      run(
+        "bash",
+        ["-o", "pipefail", "-c", `curl -fsSL ${entry.script} | bash`],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (entry.kind === "aws-cli") {
       // macOS ships a .pkg that wants an administrator, which a headless run
       // has no business prompting for. Reported as manual with the one-line
@@ -436,20 +440,24 @@ export function installEntry(entry, row, deps = {}) {
       const url = `https://awscli.amazonaws.com/awscli-exe-linux-${
         process.arch === "arm64" ? "aarch64" : "x86_64"
       }.zip`;
-      run("bash", [
-        "-o",
-        "pipefail",
-        "-c",
+      run(
+        "bash",
         [
-          "set -e",
-          'tmp="$(mktemp -d)"',
-          `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
-          'unzip -q "$tmp/awscli.zip" -d "$tmp"',
-          `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
-            `--bin-dir "${home}/.local/bin" --update`,
-          'rm -rf "$tmp"',
-        ].join("\n"),
-      ]);
+          "-o",
+          "pipefail",
+          "-c",
+          [
+            "set -e",
+            'tmp="$(mktemp -d)"',
+            `curl -fsSL "${url}" -o "$tmp/awscli.zip"`,
+            'unzip -q "$tmp/awscli.zip" -d "$tmp"',
+            `"$tmp/aws/install" --install-dir "${home}/.local/aws-cli" ` +
+              `--bin-dir "${home}/.local/bin" --update`,
+            'rm -rf "$tmp"',
+          ].join("\n"),
+        ],
+        { timeout: SETUP_OPERATION_BUDGET_MS }
+      );
     } else if (CHECKSUMMED.has(entry.kind)) {
       // The pinned, checksummed path belongs to the remote-env installer. It is
       // borrowed rather than reimplemented so the pins and checksums cannot

package/plugins/lisa-cursor/skills/lisa-sonarcloud-access/SKILL.md

@@ -63,9 +63,9 @@ read_sonar_secret() {
   local name="$1"
   [ -n "${!name:-}" ] && { echo "${!name}"; return; }
   #
-  # Ordered repo-first, ending at the plugin's own copy. Repo-relative rungs
-  # lead because a project that vendors the resolver has declared which copy it
-  # wants used, and that decision must survive this change untouched. The plugin
+  # Ordered across trusted machine-managed substrates, ending at the installed
+  # package. Checkout-local paths are deliberately absent: a familiar generated
+  # destination is still repository-controlled executable code. The plugin
   # rungs are the floor: `resolve-secret.mjs` ships beside this skill, so a rung
   # pointing at it is reachable from anywhere the plugin itself is installed.
   # Without one, a consumer repository that vendors none of the leading paths
@@ -74,12 +74,9 @@ read_sonar_secret() {
   # lookups. This LADDER is identical in every skill that resolves a credential
   # and `credential-resolver-ladder` fails if any copy diverges. Only what
   # happens AFTER the ladder may differ between them.
-  local candidates=(
-    .claude/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .agents/skills/lisa-secrets-access/scripts/resolve-secret.mjs
-    .opencode/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-    .codex/skills/lisa/lisa-secrets-access/scripts/resolve-secret.mjs
-  )
+  # Execute only machine-managed plugin/package resolvers. Checkout-local
+  # candidates are repository-controlled code, not trusted merely by path.
+  local candidates=()
   if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ]; then
     candidates+=("$CLAUDE_PLUGIN_ROOT/skills/lisa-secrets-access/scripts/resolve-secret.mjs")
   fi
@@ -98,7 +95,7 @@ read_sonar_secret() {
       local via_lisa
       via_lisa=$(node "$resolver" get "$name" 2>/dev/null) \
         && [ -n "$via_lisa" ] && { echo "$via_lisa"; return; }
-      break
+      # Empty/error means this substrate had no answer; try the next trusted one.
     fi
   done
   # Name every path. A bare `return 1` sends the next reader hunting for a

package/plugins/lisa-cursor/skills/lisa-tracker-sync/SKILL.md

@@ -58,7 +58,7 @@ The state machine (first match wins, evaluated over the **required** leaves only
 | else any leaf has **started** (claimed or in review, or shipped while a sibling has not) | active / in-progress | `claimed` (or `review` where supported) |
 | else (leaves exist, none started) | unchanged | — |
 
-- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold; run `scripts/rollup-blocker-classification.mjs` over the resolved child graph and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A non-zero exit means it classified nothing; that is a failure to report, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
+- **Blocked dominates** — one blocked leaf surfaces blocked on the parent even while others progress. It never says *which* child or *which kind* of hold. Resolve the shared classifier from `${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-plugins/lisa}}/scripts/rollup-blocker-classification.mjs` (the current-directory fallback supports a Lisa checkout), run it over the resolved child graph, and carry its per-class report — blocking leaf, path, and who must act — into the rollup note. A missing classifier or non-zero exit is a strict **no-write** result for every vendor: no lifecycle mutation and no rollup-comment mutation. Report the failure, never an all-clear. See `leaf-only-lifecycle` → **Classifying a hold**.
 - **Least-advanced env wins** — a parent reaches an env only once all required leaves have reached at least that env (all `On Stg` → `On Stg`; mixed dev/staging → the dev value). Native terminal closure fires only at the production `done`, never at an intermediate env.
 - **The parent never carries `ready`** — `ready` is a human "claim this leaf" signal; rollup only moves a parent between non-ready container states.
 - **Rollup is recursive** — an Epic rolls up from its Stories, each of which rolls up from its own leaves. Evaluate bottom-up.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.22.8",
+  "version": "4.22.10",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"