@codyswann/lisa 4.4.6 → 4.4.8

package/plugins/lisa-cursor/skills/lisa-setup-remote-env/scripts/verify-remote-env.mjs

@@ -21,7 +21,6 @@
  * @module verify-remote-env
  */
 
-import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { existsSync, readFileSync, statSync, realpathSync } from "node:fs";
 import { join } from "node:path";
@@ -29,6 +28,8 @@ import { join } from "node:path";
 import { probe, readRemoteEnvConfig } from "./setup-remote-env.mjs";
 import { planToolchain } from "./toolchain.mjs";
 
+import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
+
 /** Collected results, so every check runs before anything reports failure. */
 const results = [];
 
@@ -73,12 +74,15 @@ function checkMode(path, mode, label) {
  */
 function node(args) {
   try {
-    const out = execFileSync("node", args, {
+    const out = boundedChildOutput("node", args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
     });
     return { ok: true, out: out.trim() };
   } catch (err) {
+    // KEPT: `ok: false` fails the check either way, and a killed child's
+    // `err.message` already reads "... ETIMEDOUT", so the timeout names
+    // itself. This is the shape the others are being moved toward.
     return { ok: false, out: String(err.stderr ?? err.message).trim() };
   }
 }
@@ -149,7 +153,7 @@ export function verifyNotProxied(required, env, report) {
  */
 function verifyCleanCheckout() {
   try {
-    const out = execFileSync("git", ["status", "--porcelain"], {
+    const out = boundedChildOutput("git", ["status", "--porcelain"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
     });

package/plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/bounded-child.mjs

@@ -0,0 +1,159 @@
+/**
+ * bounded-child — the plugin payload's child-start deadline.
+ *
+ * @remarks
+ * ## Why this exists separately from `scripts/lib/bounded-spawn.mjs`
+ *
+ * Same property, different reach. A plugin payload cannot import from
+ * `scripts/lib/`: the built plugin is a self-contained copy of
+ * `plugins/src/<name>/`, and nothing outside that tree exists at runtime. So the
+ * rule is written out here rather than pointed at — the accommodation
+ * `threshold-ratchet.mjs` and `preflight-secrets.mjs` already make for their
+ * entry guards.
+ *
+ * It is a MODULE rather than 28 inline copies because the fanout preserves
+ * relative imports. Measured in the built output, not assumed:
+ * `plugins/lisa/skills/lisa-setup-workstation/scripts/catalogue.mjs` exists and
+ * is imported as `../../lisa-setup-workstation/scripts/catalogue.mjs` from a
+ * sibling skill. The build copies the plugin tree wholesale, so a path that
+ * resolves in `plugins/src/base/` resolves in all five copies.
+ *
+ * That distinction matters because the accommodation above is narrower than its
+ * wording suggests. `threshold-ratchet.mjs` cannot import a sibling because it
+ * is **materialized into other lanes** — `typescript/`, `rails/` — where the
+ * sibling does not exist at the destination. A file that lives only in this
+ * plugin has no such problem.
+ *
+ * ## The one thing a deadline alone does not fix
+ *
+ * `spawnSync` does not throw when it kills a child. It returns:
+ *
+ * | outcome | `.code` | `.status` | `.signal` | streams |
+ * | --- | --- | --- | --- | --- |
+ * | killed at deadline | `"ETIMEDOUT"` | `null` | `"SIGKILL"` | **empty** |
+ * | ran, exited non-zero | *(absent)* | `3` | `null` | real |
+ * | binary not found | `"ENOENT"` | `null` | `null` | empty |
+ *
+ * So the shape that appears all over this tree —
+ *
+ * ```js
+ * return result.status === 0 ? result.stdout : null;
+ * ```
+ *
+ * — takes the benign branch for a killed child exactly as it does for a program
+ * that ran and said no. **Adding `timeout:` gives such a call site a deadline
+ * and changes nothing about its verdict.** There is no `catch` to fix, because
+ * the fail-open is in the conditional.
+ *
+ * That is why `boundedChild` THROWS rather than returning a flag: a caller that
+ * does nothing inherits fail-closed behaviour, and only one that deliberately
+ * catches can proceed.
+ * ## Why it lives in THIS skill's directory
+ *
+ * It is not about workstation setup, and it is here anyway, for a measured
+ * reason. The built Codex artifact — `plugins/lisa/.codex-plugin/` — copies
+ * `skills/` and nothing else: no `scripts/`, `agents/`, `commands/` or
+ * `rules/`. So a skill script importing `../../../scripts/lib/…` resolves to a
+ * path that does not exist in that copy, while `../../<skill>/scripts/…`
+ * resolves everywhere, which is exactly why `catalogue.mjs` beside this file is
+ * already imported that way from a sibling skill.
+ *
+ * A directory of its own under `skills/` was the tidier home and was rejected
+ * on evidence: every `skills/` subdirectory in this tree is a real skill with a
+ * `SKILL.md`, the generators parse that file to build their artifacts, and a
+ * directory without one is a shape nothing here has ever produced. Choosing an
+ * unproven layout is what put the import in the wrong place to begin with.
+ *
+ * **Do not delete this as unused from its host skill.** Its importers are in
+ * other skills and in `../../../scripts/`; `lisa-setup-workstation` hosts it,
+ * it does not own it.
+ * @module bounded-child
+ */
+
+import { execFileSync, spawnSync } from "node:child_process";
+
+/**
+ * Deadline a child gets when the caller states none, in milliseconds.
+ *
+ * A hang detector, not a performance budget. `git` resolved through `PATH` on
+ * macOS goes via Apple's `xcrun` shim, measured at over 20 seconds under load
+ * against 11ms for a real binary (CodySwannGT/lisa#2887) — so a tighter
+ * deadline would make this module's own timeout the dominant failure mode, and
+ * the tool would start manufacturing the failures it exists to detect.
+ */
+export const CHILD_BUDGET_MS = 30_000;
+
+/**
+ * Whether this value is a child that was killed at its deadline.
+ *
+ * Reads `code` rather than an error class, because `ETIMEDOUT` is set by Node
+ * itself on all three call forms — it is a platform fact, not a convention this
+ * module invented, so the same test is correct anywhere including inline.
+ *
+ * Defensive about the shape: a `catch` binding is `unknown` and a thrown
+ * non-object is legal JavaScript, so this must answer `false` rather than crash
+ * the guard that was being careful.
+ * @param {unknown} error A caught value, or `result.error` from `spawnSync`.
+ * @returns {boolean} True when the child was killed at its deadline.
+ */
+export function isChildTimeout(error) {
+  return (
+    typeof error === "object" &&
+    error !== null &&
+    /** @type {{ code?: unknown }} */ (error).code === "ETIMEDOUT"
+  );
+}
+
+/**
+ * Re-raise a caught value when it is a killed child, otherwise do nothing.
+ *
+ * The correct spelling is `throw error` — not wrapping — because a wrapped
+ * error loses the `code` the next frame up needs to make the same decision.
+ * @param {unknown} error The caught value.
+ * @returns {void}
+ * @throws {unknown} The original value, when it is a killed child.
+ */
+export function rethrowIfChildTimeout(error) {
+  if (isChildTimeout(error)) throw error;
+}
+
+/**
+ * `spawnSync` with a deadline, refusing to return a killed child's result.
+ * @param {string} command The executable.
+ * @param {readonly string[]} args Arguments.
+ * @param {object} [options] `spawnSync` options; `timeout` overrides the default.
+ * @returns {import("node:child_process").SpawnSyncReturns<string>} The result.
+ * @throws {Error} When the child was killed at its deadline.
+ */
+export function boundedChild(command, args = [], options = {}) {
+  const result = spawnSync(command, [...args], {
+    ...options,
+    // `SIGKILL` rather than the default `SIGTERM`: the hang this exists for is
+    // a process not servicing signals, and a `SIGTERM` a child ignores turns
+    // the deadline into a suggestion.
+    killSignal: "SIGKILL",
+    timeout: options.timeout ?? CHILD_BUDGET_MS,
+  });
+  if (isChildTimeout(result.error)) throw result.error;
+  return result;
+}
+
+/**
+ * `execFileSync` with a deadline.
+ *
+ * `execFileSync` already throws on a timeout, so this changes the FAILURE MODE
+ * rather than adding one: without a `timeout` there is no deadline to reach and
+ * the call blocks for as long as the child lives.
+ * @param {string} command The executable.
+ * @param {readonly string[]} args Arguments.
+ * @param {object} [options] `execFileSync` options; `timeout` overrides the default.
+ * @returns {string|Buffer} Whatever the child wrote to stdout.
+ * @throws {Error} When the child was killed, or exited non-zero.
+ */
+export function boundedChildOutput(command, args = [], options = {}) {
+  return execFileSync(command, [...args], {
+    ...options,
+    killSignal: "SIGKILL",
+    timeout: options.timeout ?? CHILD_BUDGET_MS,
+  });
+}

package/plugins/lisa-cursor/skills/lisa-setup-workstation/scripts/workstation.mjs

@@ -33,10 +33,11 @@
  * @module workstation
  */
 
-import { execFileSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 
+import { boundedChildOutput } from "./bounded-child.mjs";
+
 import {
   AGENTS,
   CHECKSUMMED,
@@ -56,7 +57,7 @@ import {
  * @param {Function} [exec] Runner, injectable for tests.
  * @returns {string|null} Absolute path, or null when absent.
  */
-export function locate(name, exec = execFileSync) {
+export function locate(name, exec = boundedChildOutput) {
   try {
     return String(
       exec("command", ["-v", name], { encoding: "utf8", shell: true })
@@ -76,7 +77,7 @@ export function locate(name, exec = execFileSync) {
  * @param {Function} [exec] Runner, injectable for tests.
  * @returns {string|null} A dotted version, or null.
  */
-export function version(name, exec = execFileSync) {
+export function version(name, exec = boundedChildOutput) {
   const read = out => {
     const match = /(\d+(?:\.\d+)+)/.exec(String(out ?? ""));
     return match ? match[1] : null;
@@ -381,7 +382,7 @@ export function installEntry(entry, row, deps = {}) {
   const run =
     deps.run ??
     ((cmd, args, opts) =>
-      execFileSync(cmd, args, { stdio: "inherit", ...opts }));
+      boundedChildOutput(cmd, args, { stdio: "inherit", ...opts }));
   const find = deps.locate ?? locate;
 
   try {

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/hooks/enforce-config-extensions.mjs

@@ -59,6 +59,44 @@ const gitEnv = () =>
     Object.entries(process.env).filter(([key]) => !key.startsWith("GIT_"))
   );
 
+/**
+ * Milliseconds before the baseline read is presumed hung.
+ *
+ * A hang detector, not a budget. `git` reached through PATH on macOS goes via
+ * Apple's `xcrun` shim, measured over 20 seconds under load against 11ms for a
+ * real binary (CodySwannGT/lisa#2887), so a tighter deadline would make this
+ * hook's own timeout the ordinary outcome on a busy machine.
+ */
+const GIT_BUDGET_MS = 30_000;
+
+/** The baseline could not be read at all, as distinct from "there is none". */
+const UNREADABLE = Symbol("unreadable");
+
+/**
+ * The config as HEAD holds it: its text, `null` when HEAD has no such file, or
+ * `UNREADABLE` when git could not be asked.
+ *
+ * THE THREE ANSWERS ARE DELIBERATELY THREE. This used to be
+ * `result.status === 0 ? result.stdout : null`, and `status === 0` is false for
+ * a file that does not exist at HEAD **and** for a child killed at its
+ * deadline — so both became `null`, and the caller reads `null` as "no baseline
+ * to compare against, allow the edit". A busy machine therefore let through
+ * exactly the extension removal this hook exists to block, and nothing anywhere
+ * said the word "time".
+ *
+ * A deadline alone does not fix that. `spawnSync` does not throw when it kills
+ * a child; it returns `{ status: null, stdout: "" }`, which takes the same
+ * branch it always did. The discrimination has to be written, not scheduled —
+ * which is why this call site needed more than the `timeout:` its siblings did.
+ *
+ * `ETIMEDOUT` is set by Node itself, so this is a platform fact rather than a
+ * convention invented here; the shared `bounded-child.mjs` reads the same field,
+ * and this hook writes it out inline because a plugin payload materialized as a
+ * hook has no module to import from.
+ * @param {string} repoRoot Repository root.
+ * @returns {string|null|symbol} The text, `null` when absent, `UNREADABLE` when
+ *   the child was killed.
+ */
 const readGitBlob = repoRoot => {
   const result = spawnSync(
     "git",
@@ -66,8 +104,11 @@ const readGitBlob = repoRoot => {
     {
       encoding: "utf8",
       env: gitEnv(),
+      killSignal: "SIGKILL",
+      timeout: GIT_BUDGET_MS,
     }
   );
+  if (result.error?.code === "ETIMEDOUT") return UNREADABLE;
   return result.status === 0 ? result.stdout : null;
 };
 
@@ -104,6 +145,20 @@ const main = () => {
   }
 
   const previousText = readGitBlob(repoRoot);
+  // FAIL CLOSED on "could not ask", ALLOW on "there is nothing to compare".
+  // Those are different findings and only the second is safe to permit: a
+  // config with no baseline at HEAD is a new file, while a baseline nobody
+  // could read is an unanswered question, and a guard that permits an edit
+  // because it was too busy to check has not checked.
+  if (previousText === UNREADABLE) {
+    process.stderr.write(
+      `Blocked: could not read HEAD:${CONFIG_PATH} — git was killed after ` +
+        `${String(GIT_BUDGET_MS)}ms without finishing, so the previous ` +
+        `extensions are unknown. This is a timeout, not a finding: nothing ` +
+        `about the edit was measured. Re-run when the machine is quieter.\n`
+    );
+    return BLOCKED;
+  }
   if (previousText === null) return ALLOWED;
 
   const previousExtensions = topLevelExtensionKeys(previousText);

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"