@codyswann/lisa 4.28.5 → 4.29.0

package/expo/package-lisa/package.lisa.json

@@ -4,12 +4,12 @@
       "setup:deploy-key": "setup-deploy-key",
       "lighthouse:check": "lhci autorun --collect.settings.chromeFlags='--no-sandbox --disable-gpu --headless' --assert.assertions.forced-reflow-insight=off && node scripts/check-lighthouse-details.mjs",
       "playwright:build": "expo export --platform web",
-      "playwright:test": "bun run playwright:build && playwright test",
-      "playwright:test:ui": "bun run playwright:build && playwright test --ui",
-      "maestro:test": "maestro test .maestro/flows",
-      "maestro:test:ios": "maestro test -p ios .maestro/flows",
-      "maestro:test:android": "maestro test -p android .maestro/flows",
-      "maestro:test:smoke": "maestro test -p ios --include-tags=smoke .maestro/flows",
+      "playwright:test": "bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test",
+      "playwright:test:ui": "bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test --ui",
+      "maestro:test": "lisa-test-run --profile expo --adapter direct -- maestro test .maestro/flows",
+      "maestro:test:ios": "lisa-test-run --profile expo --adapter direct -- maestro test -p ios .maestro/flows",
+      "maestro:test:android": "lisa-test-run --profile expo --adapter direct -- maestro test -p android .maestro/flows",
+      "maestro:test:smoke": "lisa-test-run --profile expo --adapter direct -- maestro test -p ios --include-tags=smoke .maestro/flows",
       "maestro:studio": "maestro studio",
       "maestro:classify": "node scripts/classify-maestro-failures.mjs",
       "bdd:coverage": "node scripts/check-bdd-coverage.mjs",
@@ -51,17 +51,17 @@
       "eas:publish:staging": "eas update --channel staging --environment preview --non-interactive",
       "eas:publish:production": "eas update --channel production --environment production --non-interactive",
       "security:zap": "bash scripts/zap-baseline.sh",
-      "test": "NODE_ENV=test jest",
-      "test:unit": "NODE_ENV=test jest --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:integration:lisa": "NODE_ENV=test jest --testPathPatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:cov": "NODE_ENV=test jest --coverage",
-      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit NODE_ENV=test jest --coverage --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:mutation": "node scripts/lisa-mutation.mjs",
-      "test:watch": "NODE_ENV=test jest --watch",
+      "test": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest",
+      "test:unit": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:integration:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathPatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:cov": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:watch": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --watch",
       "lint:lisa": "oxlint && eslint . --quiet",
       "lint:fix": "oxlint --fix && eslint . --fix",
       "start:atlas": "cp .env.development .env.local && STAGE=development EXPO_ATLAS=true expo start",
-      "test:node": "node scripts/lisa-test-node.mjs"
+      "test:node": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-test-node.mjs"
     },
     "dependencies": {
       "@apollo/client": "^3.10.8",

package/harper-fabric/package-lisa/package.lisa.json

@@ -4,8 +4,13 @@
       "bootstrap": "bash scripts/bootstrap.sh",
       "setup:deploy-key": "setup-deploy-key",
       "typecheck:lisa": "tsc --noEmit",
-      "test": "vitest run",
-      "test:cov": "vitest run --coverage",
+      "test": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run",
+      "test:unit": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --exclude='**/integration/**'",
+      "test:integration:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:cov": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage --exclude='**/integration/**'",
+      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:watch": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest",
       "lint:lisa": "oxlint && eslint . --quiet",
       "lint:fix": "oxlint --fix && eslint . --fix",
       "lint:slow:lisa": "eslint . --config eslint.slow.config.ts --quiet",
@@ -20,7 +25,7 @@
       "status": "harperdb status",
       "reset": "harperdb stop || true; [ -n \"$HOME\" ] && rm -rf \"$HOME/.harperdb\" && bun run bootstrap && bun run seed && bun run verify",
       "prepare": "husky install || true",
-      "test:node": "node scripts/lisa-test-node.mjs"
+      "test:node": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-test-node.mjs"
     },
     "dependencies": {
       "harperdb": "^4.7.29"

package/nestjs/create-only/vitest.config.local.ts

@@ -28,7 +28,11 @@
 import type { ViteUserConfig } from "vitest/config";
 
 const config: ViteUserConfig = {
-  // Add project-specific settings here
+  test: {
+    // Scratch redirection must install before the leak guard, and the guard's
+    // afterAll must run after project hooks so cleanup is attributed correctly.
+    sequence: { setupFiles: "list", hooks: "stack" },
+  },
 };
 
 export default config;

package/nestjs/package-lisa/package.lisa.json

@@ -41,16 +41,16 @@
       "deploy:staging": "sls deploy --stage staging",
       "deploy:production": "sls deploy --stage production",
       "security:zap": "bash scripts/zap-baseline.sh",
-      "test": "vitest run",
-      "test:unit": "vitest run --exclude='**/integration/**'",
-      "test:integration:lisa": "vitest run '.integration.' 'integration/'",
-      "test:cov": "vitest run --coverage",
-      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:mutation": "node scripts/lisa-mutation.mjs",
-      "test:watch": "vitest",
+      "test": "lisa-test-run --profile nestjs --adapter vitest -- vitest run",
+      "test:unit": "lisa-test-run --profile nestjs --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:integration:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:cov": "lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:watch": "lisa-test-run --profile nestjs --adapter vitest -- vitest",
       "lint:lisa": "oxlint && eslint . --quiet",
       "lint:fix": "oxlint --fix && eslint . --fix",
-      "test:node": "node scripts/lisa-test-node.mjs"
+      "test:node": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-test-node.mjs"
     },
     "dependencies": {
       "@apollo/server": "^5.4.0",
@@ -110,6 +110,12 @@
   "adopt": {
     "scripts": {
       "test:integration": [
+        "lisa-test-run --profile nestjs --adapter vitest -- vitest run '.integration.' 'integration/' --passWithNoTests",
+        "lisa-test-run --profile nestjs --adapter vitest -- vitest run '.integration.' 'integration/'",
+        "lisa-test-run --profile nestjs -- vitest run '.integration.' 'integration/' --passWithNoTests",
+        "lisa-test-run --profile nestjs -- vitest run '.integration.' 'integration/'",
+        "lisa-test-run -- vitest run '.integration.' 'integration/' --passWithNoTests",
+        "lisa-test-run -- vitest run '.integration.' 'integration/'",
         "vitest run '.integration.' 'integration/' --passWithNoTests",
         "vitest run '.integration.' 'integration/'",
         "vitest run '.integration.'",

package/npm-package/package-lisa/package.lisa.json

@@ -3,6 +3,14 @@
     "scripts": {
       "prepublishOnly": "$npm_execpath run build",
       "setup:deploy-key": "setup-deploy-key",
+      "test": "lisa-test-run --profile npm-package --adapter vitest -- vitest run",
+      "test:unit": "lisa-test-run --profile npm-package --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:integration:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:cov": "lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:watch": "lisa-test-run --profile npm-package --adapter vitest -- vitest",
+      "test:node": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-test-node.mjs",
       "prepare": "$npm_execpath run build && husky install || true"
     },
     "devDependencies": {

package/package.json

@@ -3,17 +3,18 @@
     "build": "bun run build:dist && bun run build:plugins",
     "build:dist": "node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
     "build:dist:in-place": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
-    "test:integration": "vitest run tests/integration",
-    "test:integration:push": "vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",
+    "lisa-test-run": "([ -d dist/configs ] || bun run build) && node dist/cli/lisa-test-run.js --profile lisa",
+    "test:integration": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration",
+    "test:integration:push": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",
     "postinstall": "bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ -d dist/configs ] || tsc || true",
     "pretest": "[ -d dist/configs ] || bun run build",
-    "test": "vitest run",
-    "test:unit": "vitest run --exclude='**/integration/**'",
-    "test:cov": "vitest run --coverage",
-    "test:cov:unit": "LISA_COVERAGE_SCOPE=unit vitest run --coverage --exclude='**/integration/**'",
+    "test": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run",
+    "test:unit": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+    "test:cov": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage",
+    "test:cov:unit": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
     "pretest:mutation": "[ -d dist/configs ] || bun run build",
-    "test:mutation": "node scripts/lisa-mutation.mjs",
-    "test:mutation:full": "node scripts/lisa-mutation.mjs --all",
+    "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs",
+    "test:mutation:full": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs --all",
     "lint": "oxlint --disable-nested-config && eslint . --quiet",
     "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",
     "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",
@@ -28,7 +29,7 @@
     "prepare": "node -e \"if (process.env.INIT_CWD?.includes('.serverless')) process.exit(0); process.exit(1);\" || husky install || true",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
-    "test:watch": "vitest",
+    "test:watch": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest",
     "update-node-version": "tsx scripts/update-node-version.ts",
     "cleanup:amplify-branches": "bash scripts/cleanup-amplify-branches.sh",
     "cleanup:github-branches": "bash scripts/cleanup-github-branches.sh",
@@ -58,7 +59,7 @@
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:whole-output-guards": "node scripts/check-whole-output-guards.mjs",
-    "check:shell-guard-refusals": "([ -d dist/configs ] || bun run build) && node scripts/check-shell-guard-refusal-coverage.mjs",
+    "check:shell-guard-refusals": "([ -d dist/configs ] || bun run build) && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
     "check:vacuous-required-checks": "node typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs --vacuity",
@@ -162,7 +163,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -211,6 +212,7 @@
   },
   "bin": {
     "lisa": "dist/index.js",
+    "lisa-test-run": "dist/cli/lisa-test-run.js",
     "setup-deploy-key": "scripts/setup-deploy-key.sh"
   },
   "keywords": [
@@ -295,6 +297,8 @@
     "@stryker-mutator/vitest-runner": "^9.0.0",
     "@types/js-yaml": "^4.0.9",
     "@types/semver": "^7.7.1",
+    "aws-cdk-lib": "2.260.0",
+    "constructs": "^10.5.0",
     "eslint-plugin-oxlint": "^1.62.0",
     "fast-check": "^4.9.0",
     "oxlint": "^1.62.0",
@@ -307,6 +311,6 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "2af88022a9f354acb80903d57bca5c26155302b7",
-  "gitHead": "2af88022a9f354acb80903d57bca5c26155302b7"
+  "lisaReleaseCommit": "1d601d3045b937aeb2465350044fee99c37bdc39",
+  "gitHead": "1d601d3045b937aeb2465350044fee99c37bdc39"
 }

package/phaser/package-lisa/package.lisa.json

@@ -3,8 +3,14 @@
     "scripts": {
       "setup:deploy-key": "setup-deploy-key",
       "typecheck:lisa": "tsc --noEmit",
-      "test": "vitest run",
-      "test:cov": "vitest run --coverage",
+      "test": "lisa-test-run --profile phaser --adapter vitest -- vitest run",
+      "test:unit": "lisa-test-run --profile phaser --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:integration:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:cov": "lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage",
+      "test:cov:unit": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:watch": "lisa-test-run --profile phaser --adapter vitest -- vitest",
+      "test:e2e": "lisa-test-run --profile phaser --adapter direct -- playwright test",
       "lint:lisa": "oxlint && eslint . --quiet",
       "lint:fix": "oxlint --fix && eslint . --fix",
       "lint:slow:lisa": "eslint . --config eslint.slow.config.ts --quiet",
@@ -15,7 +21,7 @@
       "sg:scan:lisa": "ast-grep scan",
       "sg:test": "ast-grep test",
       "prepare": "husky install || true",
-      "test:node": "node scripts/lisa-test-node.mjs"
+      "test:node": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-test-node.mjs"
     },
     "devDependencies": {
       "@ast-grep/cli": "^0.40.4",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/sonar-secrets.sh

@@ -134,10 +134,11 @@ is_inactive() {
 # The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
 # the value still never lands on disk (CWE-922) and a kill at any point leaves an
 # empty pipe behind rather than a readable token. The directory is `mktemp -d`,
-# which is 0700.
+# which is 0700. Its explicit Lisa prefix makes an interrupted resolver
+# attributable to the owning scratch lifecycle instead of anonymous `tmp.*`.
 resolve_secret() {
   local resolver="$1" name="$2" value="" child="" dir="" fifo=""
-  dir="$(mktemp -d)" || return 0
+  dir="$(mktemp -d "${TMPDIR:-/tmp}/lisa-sonar-resolver.XXXXXXXX")" || return 0
   fifo="$dir/resolver"
   if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
     rm -rf "$dir"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/sonar-secrets.sh

@@ -134,10 +134,11 @@ is_inactive() {
 # The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
 # the value still never lands on disk (CWE-922) and a kill at any point leaves an
 # empty pipe behind rather than a readable token. The directory is `mktemp -d`,
-# which is 0700.
+# which is 0700. Its explicit Lisa prefix makes an interrupted resolver
+# attributable to the owning scratch lifecycle instead of anonymous `tmp.*`.
 resolve_secret() {
   local resolver="$1" name="$2" value="" child="" dir="" fifo=""
-  dir="$(mktemp -d)" || return 0
+  dir="$(mktemp -d "${TMPDIR:-/tmp}/lisa-sonar-resolver.XXXXXXXX")" || return 0
   fifo="$dir/resolver"
   if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
     rm -rf "$dir"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/sonar-secrets.sh

@@ -134,10 +134,11 @@ is_inactive() {
 # The FIFO is a rendezvous, not storage: a named pipe holds no data at rest, so
 # the value still never lands on disk (CWE-922) and a kill at any point leaves an
 # empty pipe behind rather than a readable token. The directory is `mktemp -d`,
-# which is 0700.
+# which is 0700. Its explicit Lisa prefix makes an interrupted resolver
+# attributable to the owning scratch lifecycle instead of anonymous `tmp.*`.
 resolve_secret() {
   local resolver="$1" name="$2" value="" child="" dir="" fifo=""
-  dir="$(mktemp -d)" || return 0
+  dir="$(mktemp -d "${TMPDIR:-/tmp}/lisa-sonar-resolver.XXXXXXXX")" || return 0
   fifo="$dir/resolver"
   if ! mkfifo -m 600 "$fifo" 2>/dev/null; then
     rm -rf "$dir"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.28.5",
+  "version": "4.29.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"