@codyswann/lisa 4.35.4 → 4.36.0

package/dist/migrations/ensure-third-party-action-pins.d.ts

@@ -0,0 +1,123 @@
+import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
+/** Resolve the commit a ref points at, or null when it cannot be determined. */
+export type ShaResolver = (owner: string, repo: string, ref: string) => Promise<string | null>;
+/**
+ * Ask GitHub what a ref resolves to right now.
+ *
+ * Deliberately resolves live rather than reading a table shipped inside Lisa.
+ * A shipped table pins every consumer to whatever those refs meant on the night
+ * it was generated, which converts a mutable-ref problem into a stale-ref
+ * problem and calls it fixed. Resolving live also satisfies the harder half of
+ * the requirement: the SHA written is the one THAT repository's ref resolves to
+ * at migration time, so pinning never silently upgrades anything.
+ *
+ * Returns null rather than throwing on every failure path. The caller turns a
+ * null into a reported skip; an exception here would turn a missing network
+ * into a failed `lisa` run, which is not what an unreachable API means.
+ *
+ * Unauthenticated on purpose. Every action being resolved is public — a private
+ * one could not be `uses:`-ed by a consumer's runner either — and the endpoint's
+ * anonymous allowance is far above the handful of distinct refs one repository
+ * has. Reading a token here would mean reaching into the environment from
+ * `src/`, and buying a higher rate limit is not worth that: being rate-limited
+ * lands on the same reported-skip path as being offline, which is a correct
+ * outcome rather than a failure. A caller that wants authenticated lookups
+ * injects its own resolver.
+ * @param owner - Action owner
+ * @param repo - Action repository
+ * @param ref - The mutable ref to resolve
+ * @returns The 40-character commit SHA, or null when it cannot be resolved
+ */
+export declare const resolveViaGitHub: ShaResolver;
+/**
+ * Pin the third-party actions in an already-seeded consumer's workflows.
+ *
+ * #3585 pinned Lisa's own workflows and its `create-only` templates. Those
+ * templates are seeded once and never overwritten, so that fix reaches new
+ * adoptions and no repository that already exists. This migration is the
+ * surface that reaches the installed base — the same role, and the same
+ * reasoning, as `ensure-nightly-e2e-workflow-pins` (#3476, #3485, #3588).
+ *
+ * It rewrites matched `uses:` lines only, never the file, so a host that has
+ * edited its seeded workflow keeps every other edit.
+ */
+export declare class EnsureThirdPartyActionPinsMigration implements Migration {
+    private readonly resolve;
+    readonly name = "ensure-third-party-action-pins";
+    readonly description = "Pin third-party GitHub Actions in this project's workflows to the commit SHA their ref resolves to today";
+    /**
+     * Create the migration.
+     * @param resolve - SHA resolver, injectable so tests never touch the network
+     */
+    constructor(resolve?: ShaResolver);
+    /**
+     * Whether any workflow in this project carries a mutable third-party ref.
+     *
+     * Never touches the network: an offline machine must still get a truthful
+     * answer about whether there is anything to do.
+     * @param ctx - Migration context
+     * @returns True when at least one reference needs pinning
+     */
+    applies(ctx: MigrationContext): Promise<boolean>;
+    /**
+     * Resolve every mutable ref and rewrite the ones that resolved.
+     * @param ctx - Migration context
+     * @returns Applied, skipped, or no-op result
+     */
+    apply(ctx: MigrationContext): Promise<MigrationResult>;
+    /**
+     * Read every workflow file and collect its mutable third-party refs.
+     * @param projectDir - Destination project directory
+     * @returns One entry per workflow file that has at least one finding
+     */
+    private scan;
+    /**
+     * Resolve each distinct reference, dropping the ones that do not resolve.
+     * @param found - Every finding across the scanned files
+     * @returns The references that resolved to a commit SHA
+     */
+    private resolveAll;
+    /**
+     * Decline during a package manager's install, and say what was declined.
+     *
+     * A workflow file is not a generated artifact — it is a reviewed,
+     * checked-in declaration of what runs against this repository, and nobody
+     * types `bun install` meaning to change that. The same rule, and the same
+     * incident behind it, as `ensure-seeded-gates` (#3574).
+     *
+     * It reports rather than going quiet, because a migration that silently
+     * skipped here would be this codebase's signature defect: work that stops
+     * happening with nothing anywhere saying so.
+     * @param ctx - Migration context
+     * @param found - Every finding across the scanned files
+     * @returns A skipped result carrying the operator-readable explanation
+     */
+    private refuse;
+    /**
+     * Report that nothing could be resolved, without claiming to have applied.
+     *
+     * No network and no credentials are ordinary conditions on a developer
+     * machine, so neither is a failure. What matters is that the result says
+     * `skipped`: a migration that reported `applied` here would be recorded as
+     * done and never run again, leaving the references mutable forever.
+     * @param ctx - Migration context
+     * @param found - Every finding across the scanned files
+     * @returns A skipped result carrying the operator-readable explanation
+     */
+    private declineUnresolved;
+    /**
+     * One operator-readable line per distinct reference.
+     * @param found - Every finding across the scanned files
+     * @returns Indented description lines
+     */
+    private describe;
+    /**
+     * Summarize what was pinned, naming anything that was left alone.
+     * @param pins - References that resolved
+     * @param found - Every finding across the scanned files
+     * @param changedFiles - Files that were rewritten
+     * @returns Operator-readable summary
+     */
+    private summarize;
+}
+//# sourceMappingURL=ensure-third-party-action-pins.d.ts.map

package/dist/migrations/ensure-third-party-action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-third-party-action-pins.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-third-party-action-pins.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAKlC,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,CACxB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAU5B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAmB9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,mCAAoC,YAAW,SAAS;IASvD,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,QAAQ,CAAC,IAAI,oCAAoC;IACjD,QAAQ,CAAC,WAAW,8GACyF;IAE7G;;;OAGG;gBAC0B,OAAO,GAAE,WAA8B;IAEpE;;;;;;;OAOG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAItD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqC5D;;;;OAIG;YACW,IAAI;IAqBlB;;;;OAIG;YACW,UAAU;IAcxB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM;IAmBd;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;CAalB"}

package/dist/migrations/ensure-third-party-action-pins.js

@@ -0,0 +1,238 @@
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import * as path from "node:path";
+import * as fse from "fs-extra";
+import { applyPins, distinctRefs, findUnpinnedRefs, } from "../core/third-party-action-pins.js";
+const WORKFLOW_DIR = path.join(".github", "workflows");
+const WORKFLOW_FILE = /\.ya?ml$/;
+/**
+ * Ask GitHub what a ref resolves to right now.
+ *
+ * Deliberately resolves live rather than reading a table shipped inside Lisa.
+ * A shipped table pins every consumer to whatever those refs meant on the night
+ * it was generated, which converts a mutable-ref problem into a stale-ref
+ * problem and calls it fixed. Resolving live also satisfies the harder half of
+ * the requirement: the SHA written is the one THAT repository's ref resolves to
+ * at migration time, so pinning never silently upgrades anything.
+ *
+ * Returns null rather than throwing on every failure path. The caller turns a
+ * null into a reported skip; an exception here would turn a missing network
+ * into a failed `lisa` run, which is not what an unreachable API means.
+ *
+ * Unauthenticated on purpose. Every action being resolved is public — a private
+ * one could not be `uses:`-ed by a consumer's runner either — and the endpoint's
+ * anonymous allowance is far above the handful of distinct refs one repository
+ * has. Reading a token here would mean reaching into the environment from
+ * `src/`, and buying a higher rate limit is not worth that: being rate-limited
+ * lands on the same reported-skip path as being offline, which is a correct
+ * outcome rather than a failure. A caller that wants authenticated lookups
+ * injects its own resolver.
+ * @param owner - Action owner
+ * @param repo - Action repository
+ * @param ref - The mutable ref to resolve
+ * @returns The 40-character commit SHA, or null when it cannot be resolved
+ */
+export const resolveViaGitHub = async (owner, repo, ref) => {
+    try {
+        const response = await fetch(`https://api.github.com/repos/${owner}/${repo}/commits/${encodeURIComponent(ref)}`, {
+            headers: {
+                Accept: "application/vnd.github.sha",
+                "User-Agent": "lisa-third-party-action-pins",
+            },
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const sha = (await response.text()).trim();
+        return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Pin the third-party actions in an already-seeded consumer's workflows.
+ *
+ * #3585 pinned Lisa's own workflows and its `create-only` templates. Those
+ * templates are seeded once and never overwritten, so that fix reaches new
+ * adoptions and no repository that already exists. This migration is the
+ * surface that reaches the installed base — the same role, and the same
+ * reasoning, as `ensure-nightly-e2e-workflow-pins` (#3476, #3485, #3588).
+ *
+ * It rewrites matched `uses:` lines only, never the file, so a host that has
+ * edited its seeded workflow keeps every other edit.
+ */
+export class EnsureThirdPartyActionPinsMigration {
+    resolve;
+    name = "ensure-third-party-action-pins";
+    description = "Pin third-party GitHub Actions in this project's workflows to the commit SHA their ref resolves to today";
+    /**
+     * Create the migration.
+     * @param resolve - SHA resolver, injectable so tests never touch the network
+     */
+    constructor(resolve = resolveViaGitHub) {
+        this.resolve = resolve;
+    }
+    /**
+     * Whether any workflow in this project carries a mutable third-party ref.
+     *
+     * Never touches the network: an offline machine must still get a truthful
+     * answer about whether there is anything to do.
+     * @param ctx - Migration context
+     * @returns True when at least one reference needs pinning
+     */
+    async applies(ctx) {
+        return (await this.scan(ctx.projectDir)).length > 0;
+    }
+    /**
+     * Resolve every mutable ref and rewrite the ones that resolved.
+     * @param ctx - Migration context
+     * @returns Applied, skipped, or no-op result
+     */
+    async apply(ctx) {
+        const scanned = await this.scan(ctx.projectDir);
+        if (scanned.length === 0) {
+            return { name: this.name, action: "noop" };
+        }
+        const found = scanned.flatMap(file => file.refs);
+        if (ctx.postinstallSafe === true) {
+            return this.refuse(ctx, found);
+        }
+        const pins = await this.resolveAll(found);
+        if (pins.length === 0) {
+            return this.declineUnresolved(ctx, found);
+        }
+        const updates = scanned
+            .map(file => ({ file, source: applyPins(file.source, pins) }))
+            .filter(update => update.source !== update.file.source);
+        if (updates.length === 0) {
+            return { name: this.name, action: "noop" };
+        }
+        const changedFiles = updates.map(update => update.file.relative);
+        const message = this.summarize(pins, found, changedFiles);
+        if (ctx.dryRun) {
+            ctx.logger.dry(`Would pin ${pins.length} reference(s) in ${changedFiles.join(", ")}`);
+            return { name: this.name, action: "applied", changedFiles, message };
+        }
+        for (const update of updates) {
+            await writeFile(update.file.absolute, update.source);
+        }
+        ctx.logger.success(message);
+        return { name: this.name, action: "applied", changedFiles, message };
+    }
+    /**
+     * Read every workflow file and collect its mutable third-party refs.
+     * @param projectDir - Destination project directory
+     * @returns One entry per workflow file that has at least one finding
+     */
+    async scan(projectDir) {
+        const dir = path.join(projectDir, WORKFLOW_DIR);
+        if (!(await fse.pathExists(dir))) {
+            return [];
+        }
+        const names = (await readdir(dir)).filter(name => WORKFLOW_FILE.test(name));
+        const files = await Promise.all(names.map(async (name) => {
+            const absolute = path.join(dir, name);
+            const source = await readFile(absolute, "utf8");
+            return {
+                relative: path.join(WORKFLOW_DIR, name),
+                absolute,
+                source,
+                refs: findUnpinnedRefs(source),
+            };
+        }));
+        return files.filter(file => file.refs.length > 0);
+    }
+    /**
+     * Resolve each distinct reference, dropping the ones that do not resolve.
+     * @param found - Every finding across the scanned files
+     * @returns The references that resolved to a commit SHA
+     */
+    async resolveAll(found) {
+        const resolutions = await Promise.all(distinctRefs(found).map(async (ref) => ({
+            ref,
+            sha: await this.resolve(ref.owner, ref.repo, ref.ref),
+        })));
+        return resolutions.flatMap(({ ref, sha }) => sha === null ? [] : [{ action: ref.action, ref: ref.ref, sha }]);
+    }
+    /**
+     * Decline during a package manager's install, and say what was declined.
+     *
+     * A workflow file is not a generated artifact — it is a reviewed,
+     * checked-in declaration of what runs against this repository, and nobody
+     * types `bun install` meaning to change that. The same rule, and the same
+     * incident behind it, as `ensure-seeded-gates` (#3574).
+     *
+     * It reports rather than going quiet, because a migration that silently
+     * skipped here would be this codebase's signature defect: work that stops
+     * happening with nothing anywhere saying so.
+     * @param ctx - Migration context
+     * @param found - Every finding across the scanned files
+     * @returns A skipped result carrying the operator-readable explanation
+     */
+    refuse(ctx, found) {
+        const message = [
+            "Left this project's workflows unchanged: an install must not rewrite what runs against this repository.",
+            "",
+            `  ${found.length} third-party action reference(s) resolve at job start to whatever their owner has pushed:`,
+            "",
+            ...this.describe(found),
+            "",
+            "  To pin them deliberately, so the change lands in a commit somebody reviews:",
+            "",
+            "      npx @codyswann/lisa@latest .",
+        ].join("\n");
+        ctx.logger.warn(message);
+        return { name: this.name, action: "skipped", changedFiles: [], message };
+    }
+    /**
+     * Report that nothing could be resolved, without claiming to have applied.
+     *
+     * No network and no credentials are ordinary conditions on a developer
+     * machine, so neither is a failure. What matters is that the result says
+     * `skipped`: a migration that reported `applied` here would be recorded as
+     * done and never run again, leaving the references mutable forever.
+     * @param ctx - Migration context
+     * @param found - Every finding across the scanned files
+     * @returns A skipped result carrying the operator-readable explanation
+     */
+    declineUnresolved(ctx, found) {
+        const message = [
+            "Could not reach GitHub to look up what these action references point at, so nothing was changed.",
+            "",
+            `  ${found.length} third-party action reference(s) are still resolved at job start by their owner:`,
+            "",
+            ...this.describe(found),
+            "",
+            "  Nothing is broken and nothing has changed. Re-run once this machine can",
+            "  reach github.com; if the lookups were rate-limited, a few minutes is enough:",
+            "",
+            "      npx @codyswann/lisa@latest .",
+        ].join("\n");
+        ctx.logger.warn(message);
+        return { name: this.name, action: "skipped", changedFiles: [], message };
+    }
+    /**
+     * One operator-readable line per distinct reference.
+     * @param found - Every finding across the scanned files
+     * @returns Indented description lines
+     */
+    describe(found) {
+        return distinctRefs(found).map(ref => `    • ${ref.action}@${ref.ref}`);
+    }
+    /**
+     * Summarize what was pinned, naming anything that was left alone.
+     * @param pins - References that resolved
+     * @param found - Every finding across the scanned files
+     * @param changedFiles - Files that were rewritten
+     * @returns Operator-readable summary
+     */
+    summarize(pins, found, changedFiles) {
+        const distinct = distinctRefs(found).length;
+        const unresolved = distinct - pins.length;
+        const tail = unresolved > 0
+            ? ` ${unresolved} reference(s) could not be looked up and were left as they are.`
+            : "";
+        return `Pinned ${pins.length} third-party action reference(s) to commit SHAs in ${changedFiles.join(", ")}.${tail}`;
+    }
+}
+//# sourceMappingURL=ensure-third-party-action-pins.js.map

package/dist/migrations/ensure-third-party-action-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-third-party-action-pins.js","sourceRoot":"","sources":["../../src/migrations/ensure-third-party-action-pins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EACL,SAAS,EACT,YAAY,EACZ,gBAAgB,GAGjB,MAAM,oCAAoC,CAAC;AAO5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,UAAU,CAAC;AAiBjC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,gCAAgC,KAAK,IAAI,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAClF;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,4BAA4B;gBACpC,YAAY,EAAE,8BAA8B;aAC7C;SACF,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,mCAAmC;IASjB;IARpB,IAAI,GAAG,gCAAgC,CAAC;IACxC,WAAW,GAClB,0GAA0G,CAAC;IAE7G;;;OAGG;IACH,YAA6B,UAAuB,gBAAgB;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAExE;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,OAAO,GAAG,OAAO;aACpB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;aAC7D,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CACZ,aAAa,IAAI,CAAC,MAAM,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,UAAkB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;gBACvC,QAAQ;gBACR,MAAM;gBACN,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;aAC/B,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;QACF,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CACtB,KAA6B;QAE7B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,CAAC;YACpC,GAAG;YACH,GAAG,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC,CACJ,CAAC;QACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAC1C,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,MAAM,CACZ,GAAqB,EACrB,KAA6B;QAE7B,MAAM,OAAO,GAAG;YACd,yGAAyG;YACzG,EAAE;YACF,KAAK,KAAK,CAAC,MAAM,2FAA2F;YAC5G,EAAE;YACF,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,EAAE;YACF,+EAA+E;YAC/E,EAAE;YACF,oCAAoC;SACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;OAUG;IACK,iBAAiB,CACvB,GAAqB,EACrB,KAA6B;QAE7B,MAAM,OAAO,GAAG;YACd,kGAAkG;YAClG,EAAE;YACF,KAAK,KAAK,CAAC,MAAM,kFAAkF;YACnG,EAAE;YACF,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,EAAE;YACF,2EAA2E;YAC3E,gFAAgF;YAChF,EAAE;YACF,oCAAoC;SACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,KAA6B;QAC5C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACK,SAAS,CACf,IAA4B,EAC5B,KAA6B,EAC7B,YAA+B;QAE/B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC5C,MAAM,UAAU,GAAG,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,GACR,UAAU,GAAG,CAAC;YACZ,CAAC,CAAC,IAAI,UAAU,iEAAiE;YACjF,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,UAAU,IAAI,CAAC,MAAM,sDAAsD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IACtH,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -13,6 +13,7 @@ export { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
+export { EnsureThirdPartyActionPinsMigration } from "./ensure-third-party-action-pins.js";
 export { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 export { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";
 export { EnsureTsconfigLocalIncludesMigration } from "./ensure-tsconfig-local-includes.js";

package/dist/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAwB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAElD;;;OAGG;gBACS,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE;IAyB7C;;;OAGG;IACH,MAAM,IAAI,SAAS,SAAS,EAAE;IAI9B;;;;OAIG;IACG,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D;;;;OAIG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;CAazE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}

package/dist/migrations/index.js

@@ -11,6 +11,7 @@ import { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 import { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 import { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 import { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
+import { EnsureThirdPartyActionPinsMigration } from "./ensure-third-party-action-pins.js";
 import { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 import { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";
 import { EnsureTsconfigLocalIncludesMigration } from "./ensure-tsconfig-local-includes.js";
@@ -30,6 +31,7 @@ export { EnsurePushDefaultSafeMigration } from "./ensure-push-default-safe.js";
 export { EnsureQualityCallerScopesMigration } from "./ensure-quality-caller-scopes.js";
 export { EnsureSeededGatesMigration } from "./ensure-seeded-gates.js";
 export { EnsureSonarExcludesLisaHarnessMigration } from "./ensure-sonar-excludes-lisa-harness.js";
+export { EnsureThirdPartyActionPinsMigration } from "./ensure-third-party-action-pins.js";
 export { EnsureTsconfigLocalFilesFallbackMigration } from "./ensure-tsconfig-local-files-fallback.js";
 export { EnsureWikiSourceDeclaredMigration } from "./ensure-wiki-source-declared.js";
 export { EnsureTsconfigLocalIncludesMigration } from "./ensure-tsconfig-local-includes.js";
@@ -62,6 +64,7 @@ export class MigrationRegistry {
             new EnsureQualityCallerScopesMigration(),
             new EnsureSeededGatesMigration(),
             new EnsureSonarExcludesLisaHarnessMigration(),
+            new EnsureThirdPartyActionPinsMigration(),
             new EnsureWikiSourceDeclaredMigration(),
             new PruneRetiredClaudeDenyRulesMigration(),
             new ReconcileClaudeStackPluginsMigration(),

package/dist/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,8BAA8B,EAAE;YACpC,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAalF,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,6CAA6C,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,EAAE,qCAAqC,EAAE,MAAM,qCAAqC,CAAC;AAC5F,OAAO,EAAE,mCAAmC,EAAE,MAAM,oCAAoC,CAAC;AACzF,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,wCAAwC,EAAE,MAAM,yCAAyC,CAAC;AACnG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AAClG,OAAO,EAAE,mCAAmC,EAAE,MAAM,qCAAqC,CAAC;AAC1F,OAAO,EAAE,yCAAyC,EAAE,MAAM,2CAA2C,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,oCAAoC,EAAE,MAAM,sCAAsC,CAAC;AAC5F,OAAO,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAElF;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACX,UAAU,CAAuB;IAElD;;;OAGG;IACH,YAAY,UAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI;YAC9B,IAAI,oCAAoC,EAAE;YAC1C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,yCAAyC,EAAE;YAC/C,IAAI,6CAA6C,EAAE;YACnD,IAAI,qCAAqC,EAAE;YAC3C,IAAI,mCAAmC,EAAE;YACzC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,qCAAqC,EAAE;YAC3C,IAAI,8BAA8B,EAAE;YACpC,IAAI,gCAAgC,EAAE;YACtC,IAAI,wCAAwC,EAAE;YAC9C,IAAI,8BAA8B,EAAE;YACpC,IAAI,kCAAkC,EAAE;YACxC,IAAI,0BAA0B,EAAE;YAChC,IAAI,uCAAuC,EAAE;YAC7C,IAAI,mCAAmC,EAAE;YACzC,IAAI,iCAAiC,EAAE;YACvC,IAAI,oCAAoC,EAAE;YAC1C,IAAI,oCAAoC,EAAE;YAC1C,IAAI,gCAAgC,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAqB;QAC7C,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;gBAC/B,MAAM,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC"}

package/package.json

@@ -166,7 +166,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.35.4",
+  "version": "4.36.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -314,7 +314,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "cdfd50ffb82cb4a61189aa88ac5079f7191d5af3",
-  "gitHead": "cdfd50ffb82cb4a61189aa88ac5079f7191d5af3",
-  "lisaReleaseTag": "v4.35.4"
+  "lisaReleaseCommit": "e680357faafbc7d19a410bc517bd6fb48e3c5929",
+  "gitHead": "e680357faafbc7d19a410bc517bd6fb48e3c5929",
+  "lisaReleaseTag": "v4.36.0"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.35.4",
+  "version": "4.36.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.35.4",
+  "version": "4.36.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-jsdoc-best-practices/SKILL.md

@@ -348,7 +348,66 @@ In `@example` blocks, use fenced code blocks and escape `@` as `\@`:
  */
 ```
 
-### Quick Reference for Escaping
+### Path Examples Must Not Contain the Block Terminator
+
+A path written as an example inside a doc comment **ends the comment** if it
+contains `*/` — a glob such as `sandbox-*/`, or any real directory whose
+name ends in an asterisk. Everything below that point is then parsed as source:
+path segments become identifiers, and the separator between them becomes
+division.
+
+**Write the wildcard as a placeholder, not a glob:**
+
+```typescript
+// WRONG — the comment ends inside the path, mid-line
+/**
+ * Debris lands at `.stryker-tmp/bite-guard-intact/sandbox-*/rails/scripts/foo.sh`
+ * and this line is no longer a comment.
+ */
+
+// RIGHT — a placeholder cannot terminate the block
+/**
+ * Debris lands at `.stryker-tmp/bite-guard-intact/sandbox-<id>/rails/scripts/foo.sh`
+ * and this line is still a comment.
+ */
+```
+
+`<id>`, `<name>`, `<n>` — the same placeholder convention used everywhere else
+in Lisa's docs. Escaping (`*\/`) also works but produces an example nobody can
+copy and paste, which defeats the point of writing one.
+
+### What it looks like when you get it wrong
+
+The build goes red immediately — `bun run typecheck`, `bun run lint` and the
+test run all fail — but **none of them mentions a comment**, and every line
+they report sits *below* the real cause. Measured, with the true cause on
+line 89:
+
+```text
+src/configs/repo-scan.ts(90,9):  error TS1005: ';' expected.
+src/configs/repo-scan.ts(90,20): error TS1443: Module declaration names may only use ' or " quoted strings.
+src/configs/repo-scan.ts(94,1):  error TS1160: Unterminated template literal.
+```
+
+Errors naming identifiers you never wrote — `Cannot find name 'mutation'`,
+`Cannot find name 'src'` — are the giveaway: those are backtick contents from
+inside the comment, now being read as code. **Look upward for a doc comment
+before looking for a missing import.**
+
+Lisa's gate runner says this for you. When a gate fails, it scans the files the
+failure named and reports the closed comment by name:
+
+```text
+a doc comment in src/configs/repo-scan.ts ends early, on line 89 — every error
+reported below that line is downstream of it, not a fault of its own
+  ↳ src/configs/repo-scan.ts:89 — the block opened on line 87 ends at the
+    terminator INSIDE this line, not on line 92
+```
+
+It is a text scan rather than a lint rule on purpose: the file does not parse,
+so ESLint reports `Parsing error` and runs zero rules on it.
+
+## Quick Reference for Escaping
 
 | Context | Approach | Example |
 |---------|----------|---------|

package/plugins/lisa/rules/reference/measurement-integrity.md

@@ -33,6 +33,16 @@ An entire corpus sits outside the query's scope and nothing says so. `gh search
 
 **Catch it:** validate the detector against known-true items before believing any count.
 
+#### A second domain, which is what makes this a category rather than a quirk
+
+The same mode, on a filesystem rather than a tracker. A survey of agent worktrees enumerating `.claude/worktrees/` and `.worktrees/` returns a well-formed list — and omits every worktree created outside the repository tree, under the per-user temporary directory. Four such worktrees existed, three of them with uncommitted changes; none appeared.
+
+Run it through the membership test and it qualifies on all three counts: the list is **well formed** (no error, no warning, no partial marker); the omission is **invisible from the list itself**, which looks exactly like a complete survey of a machine with fewer worktrees on it; and **a mechanical step would have caught it** — the same one A1 already prescribes, validating the enumeration against a worktree you know exists.
+
+This example is here rather than folded into the paragraph above because **a second domain tests whether the category is real or just a description of one tool's behaviour.** A mode observed only through `gh search` could be a fact about GitHub's search semantics; the same shape in a `find` over directories says the failure belongs to *enumeration with an unstated boundary*, whichever substrate is enumerating. When extending this document, a new domain for an existing mode is worth as much as a new mode.
+
+**The consequence in that instance was not academic.** Uncommitted work outside the repository tree is invisible to every query anyone would run before deciding what to clean up, and looks identical to abandoned scratch — so a survey feeding a deletion decision under-reports precisely the thing that must not be deleted. See the worktree-and-binding hazards for the separate question of a mitigation whose cost is invisibility; the measurement half is this mode.
+
 ### A2. Truncation — under, enumeration
 
 Real members past the first page are dropped with no truncation signal. `gh issue list` and `gh pr list` default to 30 and cap silently at whatever `--limit` is passed: one audit reported **37 items where the answer was 513**, a 14× undercount. A paging API returning **249 of 845 rows with `hasNextPage: false`** is the same mode on another substrate.

package/plugins/lisa/skills/lisa-jsdoc-best-practices/SKILL.md

@@ -348,7 +348,66 @@ In `@example` blocks, use fenced code blocks and escape `@` as `\@`:
  */
 ```
 
-### Quick Reference for Escaping
+### Path Examples Must Not Contain the Block Terminator
+
+A path written as an example inside a doc comment **ends the comment** if it
+contains `*/` — a glob such as `sandbox-*/`, or any real directory whose
+name ends in an asterisk. Everything below that point is then parsed as source:
+path segments become identifiers, and the separator between them becomes
+division.
+
+**Write the wildcard as a placeholder, not a glob:**
+
+```typescript
+// WRONG — the comment ends inside the path, mid-line
+/**
+ * Debris lands at `.stryker-tmp/bite-guard-intact/sandbox-*/rails/scripts/foo.sh`
+ * and this line is no longer a comment.
+ */
+
+// RIGHT — a placeholder cannot terminate the block
+/**
+ * Debris lands at `.stryker-tmp/bite-guard-intact/sandbox-<id>/rails/scripts/foo.sh`
+ * and this line is still a comment.
+ */
+```
+
+`<id>`, `<name>`, `<n>` — the same placeholder convention used everywhere else
+in Lisa's docs. Escaping (`*\/`) also works but produces an example nobody can
+copy and paste, which defeats the point of writing one.
+
+### What it looks like when you get it wrong
+
+The build goes red immediately — `bun run typecheck`, `bun run lint` and the
+test run all fail — but **none of them mentions a comment**, and every line
+they report sits *below* the real cause. Measured, with the true cause on
+line 89:
+
+```text
+src/configs/repo-scan.ts(90,9):  error TS1005: ';' expected.
+src/configs/repo-scan.ts(90,20): error TS1443: Module declaration names may only use ' or " quoted strings.
+src/configs/repo-scan.ts(94,1):  error TS1160: Unterminated template literal.
+```
+
+Errors naming identifiers you never wrote — `Cannot find name 'mutation'`,
+`Cannot find name 'src'` — are the giveaway: those are backtick contents from
+inside the comment, now being read as code. **Look upward for a doc comment
+before looking for a missing import.**
+
+Lisa's gate runner says this for you. When a gate fails, it scans the files the
+failure named and reports the closed comment by name:
+
+```text
+a doc comment in src/configs/repo-scan.ts ends early, on line 89 — every error
+reported below that line is downstream of it, not a fault of its own
+  ↳ src/configs/repo-scan.ts:89 — the block opened on line 87 ends at the
+    terminator INSIDE this line, not on line 92
+```
+
+It is a text scan rather than a lint rule on purpose: the file does not parse,
+so ESLint reports `Parsing error` and runs zero rules on it.
+
+## Quick Reference for Escaping
 
 | Context | Approach | Example |
 |---------|----------|---------|

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.35.4",
+  "version": "4.36.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"