@codyswann/lisa 4.34.14 → 4.34.15

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.34.14",
+  "version": "4.34.15",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-no-verify.agy.sh

@@ -195,8 +195,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,

package/plugins/src/base/hooks/block-no-verify.sh

@@ -265,8 +265,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,

package/scripts/check-npm-publish-landed.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/**
+ * Lisa's own entry point for the shipped npm-publish verification.
+ *
+ * `publish-to-npm.yml` runs `node scripts/check-npm-publish-landed.mjs`, and
+ * that path is the CALLER's tree: in a host project `lisa apply` writes it from
+ * `all/copy-overwrite/scripts/`, and in this repository it is this file. So the
+ * step needs the path to exist here too, or Lisa's own release is the one
+ * release the check never runs on.
+ *
+ * A re-export rather than a second copy. The sibling in the same workflow,
+ * `check-release-package-identity.mjs`, is duplicated byte-for-byte across both
+ * channels, and duplicated checks are exactly what drifts unnoticed — the whole
+ * `hook-copy-parity` subsystem exists because two copies of one check cannot be
+ * kept in step by intention. There is one implementation, and both paths reach
+ * it.
+ * @module scripts/check-npm-publish-landed
+ */
+import process from "node:process";
+
+import { main } from "../all/copy-overwrite/scripts/check-npm-publish-landed.mjs";
+
+main(process.argv.slice(2))
+  .then(code => {
+    process.exitCode = code;
+  })
+  .catch(error => {
+    process.stderr.write(`❌ ${error.message}\n`);
+    process.exitCode = 1;
+  });

package/scripts/two-channel-couplings.json

@@ -5,13 +5,13 @@
   },
   "inspected": {
     "workflows": 22,
-    "steps": 715,
-    "couplings": 33,
-    "inventory": 70
+    "steps": 716,
+    "couplings": 34,
+    "inventory": 71
   },
   "counts": {
     "package-backed": 10,
-    "apply-lagged": 21,
+    "apply-lagged": 22,
     "never-delivered": 0,
     "undelivered": 2
   },
@@ -133,6 +133,19 @@
       ],
       "detail": "`nightly-e2e-tracking.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/reconcile-nightly-e2e-tracking.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
     },
+    {
+      "key": "publish-to-npm.yml::scripts/check-npm-publish-landed.mjs",
+      "workflow": "publish-to-npm.yml",
+      "path": "scripts/check-npm-publish-landed.mjs",
+      "channel": "apply",
+      "verdict": "apply-lagged",
+      "remedy": "run-lisa-apply",
+      "guarded": false,
+      "lanes": [
+        "all/copy-overwrite"
+      ],
+      "detail": "`publish-to-npm.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-npm-publish-landed.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read is unguarded, so an absent path fails the job loudly. Visible, which makes it the better of the two failures."
+    },
     {
       "key": "publish-to-npm.yml::scripts/check-release-package-identity.mjs",
       "workflow": "publish-to-npm.yml",

package/typescript/copy-overwrite/.prettierignore

@@ -69,6 +69,7 @@ scripts/check-orphaned-branches.mjs
 scripts/check-e2e-coverage.mjs
 scripts/check-lighthouse-details.mjs
 scripts/check-nightly-e2e-health.mjs
+scripts/check-npm-publish-landed.mjs
 scripts/check-release-package-identity.mjs
 scripts/check-skipped-required-checks.mjs
 scripts/check-state-classification.mjs