@codyswann/lisa 4.27.3 → 4.27.5

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.27.3",
+  "version": "4.27.5",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-sync-down/SKILL.md

@@ -127,8 +127,15 @@ source-only work downward.
 If residue remains after applying the appropriate pattern, abort that hop and
 report the unresolved files and the evidence gathered. Do not silently choose
 source-wins when the target may already contain the change or has moved the code.
-5. **Push** the sync branch: `git push -u origin sync/<source>-to-<target> --force-with-lease`.
+5. **Push** the sync branch with a fully qualified destination refspec:
+   `git push origin sync/<source>-to-<target>:refs/heads/sync/<source>-to-<target> --force-with-lease`.
    Only ever force-push the sync branch — never the target environment branch.
+   The refspec is not decoration. `push -u origin <branch>` names only a
+   source, so git resolves the destination from the branch's upstream; where
+   `push.default` is `upstream` and the sync branch was created from the
+   target, that resolves to the TARGET ENVIRONMENT BRANCH and a force-push
+   lands there (CodySwannGT/lisa#3495). Naming the destination in full is
+   what makes the sentence above enforceable rather than advisory.
 6. **Open or update the PR.** Check for an existing open PR
    (`gh pr list --head sync/<source>-to-<target> --base <target> --state open`).
    Update its body if it exists, otherwise create it

package/scripts/lisa-commit-and-pr-local.sh

@@ -148,9 +148,18 @@ while IFS=$'\t' read -r project_path target_branch; do
     continue
   fi
 
-  # Create branch
+  # Create branch.
+  #
+  # `--no-track` is load-bearing, not tidiness. Without it the new branch
+  # inherits "$target_branch" as its upstream, and in any repository where
+  # push.default is "upstream" or "tracking" git resolves a push's destination
+  # from that upstream rather than from the branch name — so the push below
+  # would land on the environment branch itself, bypassing branch protection
+  # and every required check, while reporting success (CodySwannGT/lisa#3495).
+  # This script runs across a whole fleet of repositories at once, so it cannot
+  # assume any one of them has a safe push.default.
   log_info "Creating branch: $branch_name"
-  if ! git -C "$expanded_path" checkout -b "$branch_name" "$target_branch" 2>&1; then
+  if ! git -C "$expanded_path" switch -c "$branch_name" --no-track "$target_branch" 2>&1; then
     log_error "Failed to create branch $branch_name in $expanded_path"
     ((fail_count++)) || true
     continue
@@ -169,17 +178,24 @@ while IFS=$'\t' read -r project_path target_branch; do
     continue
   fi
 
-  # Push
+  # Push with a FULLY QUALIFIED destination refspec. `push -u origin <branch>`
+  # names only a source, which leaves the destination for push.default to
+  # resolve; `<branch>:refs/heads/<branch>` states it, so no config can move it.
+  # Belt and braces with --no-track above: either alone closes the hole, and
+  # this script has no way to verify which of them a given host repository
+  # needed.
   log_info "Pushing to origin/$branch_name..."
-  if ! GIT_SSH_COMMAND="ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=5" git -C "$expanded_path" push -u origin "$branch_name" 2>&1; then
+  if ! GIT_SSH_COMMAND="ssh -o ServerAliveInterval=30 -o ServerAliveCountMax=5" git -C "$expanded_path" push origin "$branch_name:refs/heads/$branch_name" 2>&1; then
     log_error "Failed to push $branch_name in $expanded_path"
     ((fail_count++)) || true
     continue
   fi
 
-  # Create PR
+  # Create PR. `--head` is explicit because the push above deliberately does not
+  # set an upstream, and without one `gh` would fall back to guessing (or
+  # prompting for) the head branch.
   log_info "Creating pull request..."
-  if ! (cd "$expanded_path" && gh pr create --title "chore: update Lisa configuration" --base "$target_branch" --body "Automated Lisa configuration update applied on $DATE_STAMP."); then
+  if ! (cd "$expanded_path" && gh pr create --title "chore: update Lisa configuration" --base "$target_branch" --head "$branch_name" --body "Automated Lisa configuration update applied on $DATE_STAMP."); then
     log_error "Failed to create PR for $expanded_path"
     ((fail_count++)) || true
     continue

package/typescript/copy-contents/.husky/pre-push

@@ -87,6 +87,76 @@ if ! command -v node >/dev/null 2>&1; then
   echo "❌ Push blocked: Node.js is required to validate tracker work items."
   exit 1
 fi
+
+# BEGIN: push destination guard
+# ---------------------------------------------------------------------------
+# Refuse a push whose RESOLVED destination is a deploy branch it was not aimed
+# at.
+#
+# `push.default=upstream` (and its deprecated spelling `tracking`) resolves a
+# push's destination from the branch's UPSTREAM rather than from the branch
+# named on the command line. A working branch created the ordinary way —
+# `git checkout -b <branch> origin/main` — has `main` as its upstream, so the
+# ordinary `git push -u origin <branch>` resolves to `refs/heads/main` and lands
+# there. The push reports success. Branch protection and every required check
+# are bypassed, and the operator is told only afterwards, if at all
+# (CodySwannGT/lisa#3495).
+#
+# Measured in Lisa's own repository: two commits reached the default branch this
+# way. Every detection control afterwards fired correctly — the bypass was
+# reported, an agent force-push was refused, the release run was caught and
+# cancelled — and the commits shipped in a published release regardless, because
+# an ordinary unrelated merge cut a release before anyone could rewind. Nothing
+# had prevented the original push. That is why this is a refusal and not a
+# warning.
+#
+# WHY HERE, and not folded into a check that already exists.
+#
+# It reads the RESOLVED DESTINATION, in the third field of the stdin lines. That
+# is the only place in the system where the destination git actually chose is
+# observable; `push.default`, the branch's upstream and the command line are all
+# proxies for it, and the accident is precisely a disagreement between the
+# proxies and the answer. So the check has to live at the push moment, on this
+# stream.
+#
+# It is UNCONDITIONAL. The traceability step below stands down when a project
+# declares `gates.traceability`, and a guard a declaration can switch off is not
+# a guard against an accident. It also runs BELOW the deletion-only guard, which
+# exits first, so deleting a branch still needs no node.
+#
+# WHAT IT ALLOWS, deliberately: `main -> main`, so a merge landed locally still
+# pushes; a `HEAD` local ref, which is how git spells a destination the pusher
+# wrote out in full and how release automation pushes from a detached checkout;
+# and every push whose destination is not a deploy branch at all.
+#
+# READING THE STREAM SPENDS IT — the same constraint the deletion guard above
+# documents, and the same remedy: capture, use, replay with `exec <`. If no
+# scratch file can be created this stands down without reading a byte, leaving
+# the hook exactly as it was; a guard that cannot read the stream must not also
+# starve the checks that can.
+# ---------------------------------------------------------------------------
+#
+# The `-f` test is not belt and braces. This is now the FIRST thing in the file
+# to invoke the validator, so a checkout where no candidate path exists would
+# fail every push with a Node module-resolution error instead of the hook's own
+# message. Standing down leaves that diagnosis to the traceability step below,
+# which owns it and words it properly.
+LISA_DEST_REFS="$(mktemp "${TMPDIR:-/tmp}/lisa-dest-refs.XXXXXXXX")" || LISA_DEST_REFS=""
+if [ -n "$LISA_DEST_REFS" ] && [ -f "$WORK_ITEM_SCRIPT" ]; then
+  cat > "$LISA_DEST_REFS"
+  if ! node "$WORK_ITEM_SCRIPT" validate-push-destination "${1:-origin}" --refs "$LISA_DEST_REFS"; then
+    rm -f "$LISA_DEST_REFS"
+    exit 1
+  fi
+  # Put the stream back, byte for byte, for the validator and every gate below.
+  exec < "$LISA_DEST_REFS"
+  # Unlinked while the descriptor above is still open, so nothing is left in
+  # TMPDIR and no later `trap ... EXIT` in this file can drop the cleanup.
+  rm -f "$LISA_DEST_REFS"
+fi
+unset LISA_DEST_REFS
+# END: push destination guard
+
 # ---------------------------------------------------------------------------
 # Work-item traceability, at the push moment.
 #