@codyswann/lisa 4.38.7 → 4.39.0

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.38.7",
+  "version": "4.39.0",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -901,6 +901,7 @@ follow_scan() {
         redirected=""
         heredoc=0
         stdin_mode=0
+        noexec=0
         j=$((i + 1))
         while [ "$j" -lt "$n" ]; do
           follow_unwrap "${toks[j]}"
@@ -931,13 +932,35 @@ follow_scan() {
                 *) j=$((j + 1)) ;;
               esac
               ;;
+            # `-n` is NOEXEC: the shell reads and parses its operand, then exits
+            # without running a line of it. So a syntax check is the one shape
+            # that puts a path at a command position while provably executing
+            # nothing, and following it reads a file the command never runs.
+            #
+            # This guard hit that on ITSELF: its pattern list is destructive
+            # command literals living inside the guard, so `bash -n` on its own
+            # source was refused by its own patterns — and the same held for any
+            # file documenting destructive commands. See CodySwannGT/lisa#3803.
+            #
+            # `bash <file>` still executes and is still followed. Noexec is the
+            # distinction, not the program: this is not a read-only exemption.
+            --noexec) noexec=1; break ;;
             --*) j=$((j + 1)) ;;
             -*c*) inline=1; j=$((j + 1)) ;;
+            -*n*) noexec=1; break ;;
             -s | -[a-zA-Z]*s[a-zA-Z]*) stdin_mode=1; j=$((j + 1)) ;;
             -*) j=$((j + 1)) ;;
             *) break ;;
           esac
         done
+        if [ "$noexec" -eq 1 ]; then
+          # Nothing runs, so there is no script to follow and nothing to fail
+          # closed about. Checked before the heredoc and dispatcher arms: those
+          # decide WHICH text to read, and here there is no execution at all.
+          cmd_pos=0
+          i=$((j + 1))
+          continue
+        fi
         if [ "$heredoc" -eq 1 ] && [ "$inline" -eq 0 ]; then
           cmd_pos=0
           i=$((j + 1))

package/rails/deletions.json

@@ -15,5 +15,22 @@
     ".github/workflows/claude-nightly-test-coverage.yml",
     ".github/workflows/claude-nightly-test-improvement.yml",
     ".github/workflows/claude-sync-down-branches.yml"
-  ]
+  ],
+  "basis": {
+    ".overcommit.yml": "needs-review",
+    ".claude/skills/action-controller-best-practices": "needs-review",
+    ".claude/skills/action-view-best-practices": "needs-review",
+    ".claude/skills/active-record-model-best-practices": "needs-review",
+    ".claude/skills/plan-add-test-coverage": "needs-review",
+    ".claude/skills/plan-fix-linter-error": "needs-review",
+    ".claude/skills/plan-lower-code-complexity": "needs-review",
+    ".claude/skills/plan-reduce-max-lines": "needs-review",
+    ".claude/skills/plan-reduce-max-lines-per-function": "needs-review",
+    ".claude/rules/rails-conventions.md": "needs-review",
+    ".github/workflows/claude-code-review-response.yml": "needs-review",
+    ".github/workflows/claude-nightly-code-complexity.yml": "needs-review",
+    ".github/workflows/claude-nightly-test-coverage.yml": "needs-review",
+    ".github/workflows/claude-nightly-test-improvement.yml": "needs-review",
+    ".github/workflows/claude-sync-down-branches.yml": "needs-review"
+  }
 }

package/scripts/check-deletion-basis.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * Refuse a `deletions.json` that declares a path without saying why it may go.
+ *
+ * This is the AUTHORING gate. `Lisa.processDeletionsFile` has its own runtime
+ * fail-safe that keeps an unclassified path in a consumer's repository; the two
+ * are deliberately separate mechanisms. The runtime rule protects a consumer
+ * whatever manifest they happen to have, including one authored before either
+ * existed. This one stops an unclassified path being written here in the first
+ * place, so the manifest cannot silently regrow the problem the moment somebody
+ * adds entry 256.
+ *
+ * Without this, the whole change is a one-time sweep. With it, it is a standing
+ * property.
+ *
+ * Also reports the outstanding `needs-review` count, because that number is the
+ * debt this change deliberately took on and it should be visible on every run
+ * rather than discovered later.
+ *
+ * Usage: node scripts/check-deletion-basis.mjs
+ * @module scripts/check-deletion-basis
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO_ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  ".."
+);
+
+const MANIFESTS = [
+  "all",
+  "typescript",
+  "expo",
+  "rails",
+  "nestjs",
+  "cdk",
+  "phaser",
+  "harper-fabric",
+];
+
+const NEEDS_REVIEW = "needs-review";
+const OWNED = "owned";
+const LEGACY_PREFIX = "legacy:";
+
+/**
+ * Whether one declared path carries a usable basis.
+ *
+ * Mirrors `resolveDeletionBasis` in `src/core/deletion-basis.ts`. Kept as plain
+ * ESM so this check runs with no build step — a gate that needs `dist/` cannot
+ * run in a pre-commit hook on a tree that does not compile.
+ * @param {object} manifest - Parsed deletions.json.
+ * @param {string} declaredPath - The declared path.
+ * @returns {boolean} True when the manifest says why the path may be removed.
+ */
+function isClassified(manifest, declaredPath) {
+  const forced = manifest.force?.[declaredPath];
+  if (typeof forced === "string" && forced.trim() !== "") return true;
+  const declared = manifest.basis?.[declaredPath];
+  if (typeof declared !== "string") return false;
+  const value = declared.trim();
+  if (value === NEEDS_REVIEW || value === OWNED) return true;
+  // A `legacy` basis with no prose is unclassified in substance: the point of
+  // the kind is that somebody wrote down WHY.
+  if (value.startsWith(LEGACY_PREFIX))
+    return value.slice(LEGACY_PREFIX.length).trim() !== "";
+  return false;
+}
+
+let unclassified = 0;
+let needsReview = 0;
+let classified = 0;
+
+for (const stack of MANIFESTS) {
+  const file = path.join(REPO_ROOT, stack, "deletions.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") continue;
+    console.error(
+      `${stack}/deletions.json could not be read: ${error.message}`
+    );
+    process.exitCode = 1;
+    continue;
+  }
+  const keep = new Set(manifest.keep ?? []);
+  for (const declaredPath of manifest.paths ?? []) {
+    if (keep.has(declaredPath)) continue;
+    if (!isClassified(manifest, declaredPath)) {
+      if (unclassified === 0)
+        console.error(
+          "Declared for deletion with no basis — say why each may be removed:\n"
+        );
+      console.error(`  ${stack}/deletions.json  ${declaredPath}`);
+      unclassified++;
+      continue;
+    }
+    classified++;
+    if (manifest.basis?.[declaredPath]?.trim() === NEEDS_REVIEW) needsReview++;
+  }
+}
+
+if (unclassified > 0) {
+  console.error(
+    `\n${unclassified} declared path(s) carry no basis.\n\n` +
+      "Add one to that manifest's `basis` map:\n" +
+      '  "owned"                    Lisa installs this path today\n' +
+      '  "legacy: <reason>"         Lisa shipped it once and no longer does\n' +
+      '  "needs-review"             declared before the basis field; debt, but countable\n' +
+      "or a `force` entry when the removal is a ruling that must reach an edited copy.\n\n" +
+      "An unclassified path is KEPT at apply time rather than deleted, so leaving\n" +
+      "it unclassified does not merely fail this check — it stops the removal\n" +
+      "reaching consumers at all."
+  );
+  process.exitCode = 1;
+} else {
+  console.log(
+    `deletion basis: ${classified} declared path(s) classified, of which ${needsReview} still carry \`${NEEDS_REVIEW}\`.`
+  );
+  if (needsReview > 0)
+    console.log(
+      `  ${needsReview} reason(s) remain unwritten. Each one replaced by \`legacy: <reason>\` is a path whose removal somebody has justified in writing.`
+    );
+}

package/typescript/deletions.json

@@ -59,5 +59,53 @@
     ".github/workflows/reusable-auto-update-pr-branches.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
     ".github/workflows/reusable-auto-update-pr-branches-dispatch.yml": "Removed fleet-wide (CodySwannGT/lisa#3590): it force-updated PR branches with the workflow's own github.token, and GitHub will not start runs from such a push, so required checks went ABSENT at head and pull requests silently stopped becoming mergeable. An edited copy does the same damage, so this removal overrides workflow ownership.",
     ".github/workflows/required-checks-drift.yml": "Removed fleet-wide (CodySwannGT/lisa#3599): it read the live ruleset over the GitHub API, which needs administration:read and therefore a personal access token held in a permanent repository secret. An edited copy still asks for that token, so this removal overrides workflow ownership."
+  },
+  "basis": {
+    "jest.config.js": "needs-review",
+    ".claude/hooks/install_pkgs.sh": "needs-review",
+    ".claude/hooks/format-on-edit.sh": "needs-review",
+    ".claude/hooks/install-pkgs.sh": "needs-review",
+    ".claude/hooks/lint-on-edit.sh": "needs-review",
+    ".claude/hooks/sg-scan-on-edit.sh": "needs-review",
+    ".claude/skills/jira-add-journey": "needs-review",
+    ".claude/skills/jira-create": "needs-review",
+    ".claude/skills/jira-evidence": "needs-review",
+    ".claude/skills/jira-journey": "needs-review",
+    ".claude/skills/jira-verify": "needs-review",
+    ".claude/skills/jsdoc-best-practices": "needs-review",
+    "eslint-plugin-code-organization": "needs-review",
+    "eslint.base.ts": "needs-review",
+    "eslint.typescript.ts": "needs-review",
+    "jest.base.ts": "needs-review",
+    "jest.typescript.ts": "needs-review",
+    "tsconfig.base.json": "needs-review",
+    "tsconfig.typescript.json": "needs-review",
+    ".github/workflows/quality.yml": "needs-review",
+    ".github/workflows/release.yml": "needs-review",
+    ".github/workflows/create-issue-on-failure.yml": "needs-review",
+    ".github/workflows/create-github-issue-on-failure.yml": "needs-review",
+    ".github/workflows/create-jira-issue-on-failure.yml": "needs-review",
+    ".github/workflows/create-sentry-issue-on-failure.yml": "needs-review",
+    ".github/workflows/reusable-claude.yml": "needs-review",
+    ".github/workflows/reusable-claude-ci-auto-fix.yml": "needs-review",
+    ".github/workflows/reusable-claude-code-review-response.yml": "needs-review",
+    ".github/workflows/reusable-claude-deploy-auto-fix.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-code-complexity.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-test-coverage.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-test-improvement.yml": "needs-review",
+    ".github/workflows/load-test.yml": "needs-review",
+    ".github/workflows/claude-ci-auto-fix.yml": "needs-review",
+    ".github/workflows/claude-code-review-response.yml": "needs-review",
+    ".github/workflows/claude-deploy-auto-fix.yml": "needs-review",
+    ".github/workflows/claude-nightly-code-complexity.yml": "needs-review",
+    ".github/workflows/claude-nightly-test-coverage.yml": "needs-review",
+    ".github/workflows/claude-nightly-test-improvement.yml": "needs-review",
+    ".github/workflows/claude-sync-down-branches.yml": "needs-review",
+    ".github/workflows/claude.yml": "needs-review",
+    ".github/workflows/reusable-claude-sync-down-branches.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-code-complexity-rails.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-jira-triage.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-test-coverage-rails.yml": "needs-review",
+    ".github/workflows/reusable-claude-nightly-test-improvement-rails.yml": "needs-review"
   }
 }