@codyswann/lisa 4.38.1 → 4.38.3

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.1",
+  "version": "4.38.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/.claude-plugin/plugin.json

@@ -138,10 +138,6 @@
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-instruction-file-edits.sh"
           },
-          {
-            "type": "command",
-            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-direct-issue-create.sh"
-          },
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-blind-automerge.sh"
@@ -178,6 +174,15 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/enforce-verification-gate.sh"
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-direct-issue-create.sh"
+          }
+        ]
       }
     ],
     "Stop": [

package/plugins/src/base/hooks/block-direct-issue-create.agy.sh

@@ -8,9 +8,19 @@
 # block-direct-issue-create.sh beside it (same delegation pattern as
 # block-instruction-file-edits.agy.sh).
 #
-# No scope gap here, unlike the instruction-file adapter: the canonical guard is
-# Bash-only by construction, and `run_command` is exactly the surface it needs.
-# agy therefore receives the whole guard, not an arm of it.
+# SCOPE GAP, recorded rather than silently dropped (AGENTS.md). This used to
+# read "no scope gap here: the canonical guard is Bash-only by construction, and
+# `run_command` is exactly the surface it needs." That stopped being true in
+# CodySwannGT/lisa#3753: the canonical guard now covers a SECOND substrate —
+# structured tool payloads, where a creation arrives as named fields rather than
+# as a command line — because the filing contract was enforced on the shell and
+# unenforced on every tool call beside it.
+#
+# This adapter forwards `run_command` and nothing else, so on agy that second
+# substrate is still uncovered. Closing it needs agy's own tool-call envelope
+# (which tool names its creation surface, and where the arguments land), and
+# that is a different piece of work from translating one protocol. The shell
+# surface agy does expose receives the whole guard, exactly as before.
 #
 # Fail-open on missing runtimes: a missed refusal costs one under-declared
 # ticket, and `lisa-repair-intake` already sweeps for exactly that. Failing

package/plugins/src/base/hooks/block-direct-issue-create.sh

@@ -79,6 +79,36 @@
 # settings env block, CI config). An escape the governed agent reaches by
 # typing one more token in front of the command it was just refused is not an
 # escape hatch — it is the prose problem with extra steps.
+#
+# ## What this hook costs, and the number that would change the decision
+#
+# Registered `matcher: ""` since CodySwannGT/lisa#3753 — it runs on EVERY tool
+# call, not only Bash. Measured on a developer machine at load ~8-26, 50
+# invocations per row:
+#
+#     16.7 ms   enforce-team-first.sh          already `matcher: ""` today
+#     17.5 ms   enforce-verification-gate.sh   already `matcher: ""` today
+#     11.5 ms   this guard, non-Bash payload   what the broad matcher adds
+#    112.3 ms   this guard, Bash payload       what Bash calls already paid
+#
+# So the broad registration was not novel — two hooks were already there, this
+# one is cheaper than either, and it raises an existing ~34 ms per-call baseline
+# by about a third.
+#
+# THIS IS A THRESHOLD, NOT A PRECEDENT. The argument is about the TOTAL cost of
+# the broad set, so it does not transfer to the next guard: four more hooks
+# moved to `matcher: ""` would put ~90 ms on every tool call and the answer
+# flips. **Before widening any other hook's matcher, re-run the measurement and
+# reconsider if the broad set totals more than ~100 ms per tool call, or if any
+# single broad hook exceeds ~50 ms.** Do not cite these numbers for a fifth
+# hook; measure again, because the number that matters is the sum.
+#
+# The cost is also irreducible rather than sloppy. A 9-line script containing
+# only this file's preamble measured 11.7 ms, and padding it to this file's
+# length changed nothing (11.5 ms) — it is process spawn plus one `jq`, not
+# parsing. Moving the early exit further up the file buys nothing; the exit is
+# already ahead of config resolution, which is what keeps the figure at 11.5
+# rather than at the 112 ms the Bash path pays.
 set -euo pipefail
 
 input="$(cat)"
@@ -99,13 +129,72 @@ for required in jq python3; do
 done
 
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+
+# ── The two substrates ────────────────────────────────────────────────────
+#
+# A creation reaches a tracker two ways, and until CodySwannGT/lisa#3753 this
+# guard saw only one of them. It was registered `matcher: "Bash"` AND gated
+# here on `tool_name != "Bash"`, so an MCP tool call was refused entry twice
+# over. MEASURED before the change, driving the guard with synthetic payloads:
+#
+#   ALLOW   mcp__linear-server__create_issue, undeclared      <- the defect
+#   ALLOW   mcp__github__create_issue, undeclared             <- the defect
+#   REFUSE  the same creation as `gh issue create` shell text <- control
+#   ALLOW   an ordinary Read tool call                        <- control
+#
+# The two controls are what make those ALLOWs mean anything: the refusal proves
+# the guard is live, the Read proves it is not simply refusing everything.
+#
+# **Widening the matcher alone would have changed nothing** — the call would
+# arrive and this gate would still exit 0. Anyone who "fixed" #3753 by editing
+# `plugin.json` would have seen no test fail and shipped a guard that still
+# allows every MCP filing. The registration and this gate had to move together.
+#
+# The SHELL path below is untouched. A structured payload has no command line
+# to tokenise, so it gets its own small classifier rather than being forced
+# through a parser built for shell text.
+structured_call=""
 if [ "$tool_name" != "Bash" ]; then
-  exit 0
+  # The cheap shape gate, deliberately BEFORE config resolution.
+  #
+  # This hook now runs on EVERY tool call, so the cost of the path that does
+  # nothing is the cost of the whole change. Config resolution spawns two jq
+  # processes per lookup and is what makes the Bash path ~112 ms; putting it
+  # ahead of this gate would charge that to every Read and Grep. So the
+  # not-a-creation exit happens here, on a shell `case` with no subprocess.
+  #
+  # Matched on SHAPE, not on an enumerated list of server tool names. Server
+  # names are supplied by whoever wrote the server and change when one is
+  # added or renamed, so a list would pass every row anyone thought of and
+  # miss the first one nobody did — the failure mode this repository's guard
+  # suites are written to defeat.
+  #
+  # RESIDUAL, stated rather than hidden: a server whose creation tool is named
+  # without a create-verb or without a tracker noun (`mcp__x__file_work`) is
+  # not recognised and is allowed. That is a fail-open, and it is the honest
+  # cost of refusing to enumerate. Add shapes here as they are measured.
+  case "$tool_name" in
+    Bash | Read | Write | Edit | MultiEdit | Glob | Grep | Task | TodoWrite)
+      exit 0
+      ;;
+  esac
+  case "$tool_name" in
+    *[Cc]reate* | *[Nn]ew* | *[Aa]dd* | *[Ff]ile*) ;;
+    *) exit 0 ;;
+  esac
+  case "$tool_name" in
+    *[Ii]ssue* | *[Tt]icket* | *[Tt]ask* | *[Ss]tory* | *[Bb]ug* | *[Ee]pic* | *[Ww]ork*) ;;
+    *) exit 0 ;;
+  esac
+  structured_call="1"
 fi
 
-command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-if [ -z "$command_str" ]; then
-  exit 0
+command_str=""
+if [ -z "$structured_call" ]; then
+  command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+  if [ -z "$command_str" ]; then
+    exit 0
+  fi
 fi
 
 project_dir="${CLAUDE_PROJECT_DIR:-}"
@@ -1859,6 +1948,53 @@ print("ALLOW")
 PY
 
 set +e
+# ── The structured substrate ──────────────────────────────────────────────
+#
+# An MCP call carries named fields, not a command line, so `scan()` — which
+# tokenises shell text — has nothing to parse. The declaration is read from the
+# payload instead, and the recogniser is deliberately small: this path decides
+# ONE question (is a build-ready role or a human-gate marker present anywhere
+# in the submitted fields), where the shell path has to answer "which of these
+# tokens is a client, an endpoint, a flag value, or a file it executes".
+#
+# Every string in the payload is searched, at any depth, because a role lands
+# in a different field on every tracker — `labels[]` on GitHub, `stateId` or a
+# workflow state name on Linear, a transition `id` on JIRA — and enumerating
+# field names per vendor is the same brittleness as enumerating tool names.
+# Over-collecting is safe here: the values are compared against ONE configured
+# role string, so an unrelated field cannot accidentally satisfy it.
+if [ -n "$structured_call" ]; then
+  # The operator's ambient escape works on both substrates. There is no inline
+  # form to disqualify it here — a structured call has no shell in which to
+  # assign one — so the override is simply honoured.
+  if [ -n "$ambient_override" ]; then
+    exit 0
+  fi
+
+  structured_declaration="$(
+    printf '%s' "$input" |
+      jq -r --arg role "$ready_role" '
+        [(.tool_input // {}) | .. | strings] as $values
+        | if ($values | index($role)) then "role"
+          elif ($values | map(select(contains("[lisa-human-gate]"))) | length) > 0 then "gate"
+          else "" end
+      ' 2>/dev/null || printf 'UNREADABLE'
+  )"
+
+  # Fail closed on a creation-shaped call whose payload cannot be read. Silence
+  # about a filing the guard could not inspect is the defect this whole ticket
+  # is about, one substrate over.
+  if [ "$structured_declaration" = "UNREADABLE" ]; then
+    refuse "an unreadable $tool_name payload that reads as a tracker creation" \
+      "$ready_role" ""
+  fi
+
+  if [ -z "$structured_declaration" ]; then
+    refuse "a tracker creation through $tool_name" "$ready_role" ""
+  fi
+  exit 0
+fi
+
 verdict="$(
   printf '%s' "$classifier" |
     LISA_GUARD_COMMAND="$command_str" \

package/plugins/src/base/hooks/threshold-ratchet-families.mjs

@@ -77,6 +77,14 @@ export const FAMILIES = [
     match: /(^|\/)\.lisa\.config\.json$/,
     kind: "allow-list",
   },
+  {
+    // The #3811 quarantine. `allow-list` is exactly right here: the list may
+    // shrink freely, and ADDING a file — re-authorising type debt that the
+    // gate would otherwise refuse — is the change that needs a human to see it.
+    id: "typecheck-quarantine",
+    match: /(^|\/)typecheck-quarantine\.json$/,
+    kind: "allow-list",
+  },
   {
     id: "lighthouse",
     match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,

package/rails/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -80,6 +80,14 @@ export const FAMILIES = [
     match: /(^|\/)\.lisa\.config\.json$/,
     kind: "allow-list",
   },
+  {
+    // The #3811 quarantine. `allow-list` is exactly right here: the list may
+    // shrink freely, and ADDING a file — re-authorising type debt that the
+    // gate would otherwise refuse — is the change that needs a human to see it.
+    id: "typecheck-quarantine",
+    match: /(^|\/)typecheck-quarantine\.json$/,
+    kind: "allow-list",
+  },
   {
     id: "lighthouse",
     match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,

package/scripts/check-typecheck-tests.mjs

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * Type-check `tests/` and hold the result to a quarantine that can only shrink.
+ *
+ * WHY THIS EXISTS. The required `type-correctness` gate compiles `tsconfig.json`,
+ * whose `include` is `src/**\/*`, so it compiled 0 of 1385 test files and reported
+ * success — a required gate permitting exactly what it forbids
+ * (CodySwannGT/lisa#3811). Test files here are not incidental: they hold fixture
+ * builders, shape assertions and harnesses other suites import.
+ *
+ * WHY A FILE-LEVEL QUARANTINE RATHER THAN A STAGED ROLLOUT. Turning the program
+ * on surfaces a backlog that predates this gate, so something has to hold it.
+ * The tempting option is to widen the program one directory at a time. That is
+ * the defect surviving in miniature: with a directory scope, a brand-new file
+ * under an unreached directory is unchecked on the day it is written. A
+ * file-level quarantine inverts it — **every new or renamed file is checked
+ * immediately**, and only the files that were already failing are exempt.
+ *
+ * IT RATCHETS IN BOTH DIRECTIONS, which is what stops it becoming permanent:
+ *
+ *   - an error in a file NOT in the quarantine fails the gate: that is new debt;
+ *   - a quarantined file with NO errors fails the gate too, asking to be
+ *     removed from the list. Without that rule the list would record files that
+ *     were fixed years ago and quietly re-authorise them if they regressed.
+ *
+ * `typecheck-quarantine.json` is additionally watched by the existing
+ * threshold-ratchet as an `allow-list` family, so *adding* an entry is flagged
+ * by a gate somebody already reads.
+ *
+ * WHAT IS DELIBERATELY NOT DONE HERE: the declared `lib` is not widened. tsc
+ * emits "Try changing the 'lib' compiler option to 'es2023' or later" on the
+ * ES2023 array APIs, and taking that suggestion would have erased the
+ * measurement proving this gap cost something — `toSorted` appeared 0 times in
+ * the type-checked `src/` and 52 times in the unchecked `tests/`. Those call
+ * sites were rewritten to ES2022 equivalents instead.
+ * @module scripts/check-typecheck-tests
+ */
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const QUARANTINE = path.join(ROOT, "typecheck-quarantine.json");
+const PROJECT = path.join(ROOT, "tsconfig.tests.json");
+
+/** Matches `path/to/file.ts(12,34): error TS1234: message`. */
+const ERROR_LINE = /^(?<file>[^(]+)\((?<line>\d+),\d+\): error (?<code>TS\d+):/;
+
+/**
+ * Read the quarantined paths.
+ * @returns {{files: string[], reason: string}} The parsed quarantine.
+ */
+function readQuarantine() {
+  try {
+    const parsed = JSON.parse(readFileSync(QUARANTINE, "utf-8"));
+    return { files: parsed.files ?? [], reason: parsed.reason ?? "" };
+  } catch (error) {
+    console.error(
+      `check-typecheck-tests: cannot read ${path.relative(ROOT, QUARANTINE)} — ${error.message}`
+    );
+    console.error(
+      "That file is what makes this gate green, so an unreadable one is a refusal, not a pass."
+    );
+    process.exit(1);
+  }
+}
+
+const { files: quarantined } = readQuarantine();
+const exempt = new Set(quarantined);
+
+const tsc = spawnSync(
+  process.execPath,
+  [
+    path.join(ROOT, "node_modules", "typescript", "bin", "tsc"),
+    "--noEmit",
+    "-p",
+    PROJECT,
+  ],
+  { cwd: ROOT, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }
+);
+
+if (tsc.error) {
+  console.error(
+    `check-typecheck-tests: could not run tsc — ${tsc.error.message}`
+  );
+  process.exit(1);
+}
+
+const lines = `${tsc.stdout ?? ""}\n${tsc.stderr ?? ""}`.split("\n");
+/** @type {Map<string, number>} */
+const errorsByFile = new Map();
+for (const line of lines) {
+  const match = ERROR_LINE.exec(line.trim());
+  if (!match?.groups) continue;
+  const file = match.groups.file.replace(/\\/g, "/");
+  errorsByFile.set(file, (errorsByFile.get(file) ?? 0) + 1);
+}
+
+const offenders = [...errorsByFile.keys()]
+  .filter(file => !exempt.has(file))
+  .sort();
+const cleared = quarantined.filter(file => !errorsByFile.has(file)).sort();
+
+const totalErrors = [...errorsByFile.values()].reduce((sum, n) => sum + n, 0);
+console.log(
+  `type-correctness (tests): ${errorsByFile.size} file(s) with ${totalErrors} error(s); ` +
+    `${quarantined.length} quarantined.`
+);
+
+if (offenders.length > 0) {
+  console.error("");
+  console.error(
+    `❌ ${offenders.length} file(s) outside the quarantine have type errors:`
+  );
+  for (const file of offenders) {
+    console.error(`   ${file} (${errorsByFile.get(file)})`);
+  }
+  console.error("");
+  console.error(
+    "Fix them. Do NOT add them to typecheck-quarantine.json — that list"
+  );
+  console.error(
+    "only shrinks, and the threshold-ratchet flags additions to it."
+  );
+}
+
+if (cleared.length > 0) {
+  console.error("");
+  console.error(
+    `❌ ${cleared.length} quarantined file(s) now type-check and must leave the list:`
+  );
+  for (const file of cleared) console.error(`   ${file}`);
+  console.error("");
+  console.error(
+    "Remove them from typecheck-quarantine.json. A list that keeps entries"
+  );
+  console.error(
+    "after they are fixed would re-authorise them if they ever regressed."
+  );
+}
+
+if (offenders.length > 0 || cleared.length > 0) process.exit(1);
+
+console.log(
+  "✅ No type errors outside the quarantine, and no stale quarantine entries."
+);

package/typescript/copy-overwrite/scripts/threshold-ratchet-families.mjs

@@ -80,6 +80,14 @@ export const FAMILIES = [
     match: /(^|\/)\.lisa\.config\.json$/,
     kind: "allow-list",
   },
+  {
+    // The #3811 quarantine. `allow-list` is exactly right here: the list may
+    // shrink freely, and ADDING a file — re-authorising type debt that the
+    // gate would otherwise refuse — is the change that needs a human to see it.
+    id: "typecheck-quarantine",
+    match: /(^|\/)typecheck-quarantine\.json$/,
+    kind: "allow-list",
+  },
   {
     id: "lighthouse",
     match: /(^|\/)(?:lighthouserc-config|lighthouserc|\.lighthouserc)\.json$/,