@codyswann/lisa 4.55.10 → 4.55.12

package/dist/utils/package-manager-detect.d.ts

@@ -34,7 +34,7 @@ export declare const LOCKFILE_REGEN_PLANS: Readonly<Record<PackageManager, Lockf
  * npm-only project sets `engines.bun = "please-use-npm"`). Such a manager must
  * never have its lockfile regenerated — even if a stray lockfile for it is
  * present — because doing so re-creates the stray lockfile via that manager's
- * `install`. That is the SE-5221 regression: a stray `bun.lock` in an npm-only
+ * `install`. That is the package-manager selection regression: a stray `bun.lock` in an npm-only
  * project kept alive by `bun install`, which then misroutes the pre-push hook's
  * package-manager detection to the bun branch.
  * @param projectDir - Absolute path to the project directory
@@ -52,7 +52,7 @@ export declare function enginesForbiddenManagers(projectDir: string): ReadonlySe
  *
  * Managers opted out via an `engines` sentinel (e.g. `bun = "please-use-npm"`)
  * are dropped even when their lockfile is present, so the reconciliation never
- * re-creates a stray lockfile the project deliberately disallows (SE-5221).
+ * re-creates a stray lockfile the project deliberately disallows.
  * @param projectDir - Absolute path to the project directory
  * @returns Ordered list of detected package managers (possibly empty)
  */

package/dist/utils/package-manager-detect.js

@@ -55,7 +55,7 @@ export const LOCKFILE_REGEN_PLANS = {
  * npm-only project sets `engines.bun = "please-use-npm"`). Such a manager must
  * never have its lockfile regenerated — even if a stray lockfile for it is
  * present — because doing so re-creates the stray lockfile via that manager's
- * `install`. That is the SE-5221 regression: a stray `bun.lock` in an npm-only
+ * `install`. That is the package-manager selection regression: a stray `bun.lock` in an npm-only
  * project kept alive by `bun install`, which then misroutes the pre-push hook's
  * package-manager detection to the bun branch.
  * @param projectDir - Absolute path to the project directory
@@ -87,7 +87,7 @@ export function enginesForbiddenManagers(projectDir) {
  *
  * Managers opted out via an `engines` sentinel (e.g. `bun = "please-use-npm"`)
  * are dropped even when their lockfile is present, so the reconciliation never
- * re-creates a stray lockfile the project deliberately disallows (SE-5221).
+ * re-creates a stray lockfile the project deliberately disallows.
  * @param projectDir - Absolute path to the project directory
  * @returns Ordered list of detected package managers (possibly empty)
  */

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "bbf92dbe112ba3ed753ae43cde2691f1de3c772c",
-  "gitHead": "bbf92dbe112ba3ed753ae43cde2691f1de3c772c",
-  "lisaReleaseTag": "v4.55.10"
+  "lisaReleaseCommit": "89b58b2d263fe97a8579fc54500ba188243824d3",
+  "gitHead": "89b58b2d263fe97a8579fc54500ba188243824d3",
+  "lisaReleaseTag": "v4.55.12"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa/hooks/install-pkgs.sh

@@ -53,7 +53,7 @@ fi
 # This must NOT key on lockfile presence alone. An npm-only project
 # (engines.bun = "please-use-npm", CI runs `npm ci`) that picks up a stray
 # bun.lock would otherwise get `bun install`, re-create the bun.lock, and break
-# — the SE-5221 regression. The engines/packageManager signals are
+# — the package-manager selection regression. The engines/packageManager signals are
 # authoritative; lockfiles are only a fallback and never override an opt-out.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa/rules/eager/00-rule-index.md

@@ -76,6 +76,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](../reference/documentation-source-paths.md) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](../reference/project-learnings.md) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](../reference/factory-model.md) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa/rules/eager/never-name-a-downstream-project.md

@@ -0,0 +1,9 @@
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md).

package/plugins/lisa/rules/reference/never-name-a-downstream-project.md

@@ -0,0 +1,37 @@
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/install-pkgs.sh

@@ -53,7 +53,7 @@ fi
 # This must NOT key on lockfile presence alone. An npm-only project
 # (engines.bun = "please-use-npm", CI runs `npm ci`) that picks up a stray
 # bun.lock would otherwise get `bun install`, re-create the bun.lock, and break
-# — the SE-5221 regression. The engines/packageManager signals are
+# — the package-manager selection regression. The engines/packageManager signals are
 # authoritative; lockfiles are only a fallback and never override an opt-out.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-copilot/rules/eager/00-rule-index.md

@@ -76,6 +76,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](../reference/documentation-source-paths.md) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](../reference/project-learnings.md) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](../reference/factory-model.md) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa-copilot/rules/eager/never-name-a-downstream-project.md

@@ -0,0 +1,9 @@
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md).

package/plugins/lisa-copilot/rules/reference/never-name-a-downstream-project.md

@@ -0,0 +1,37 @@
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa-copilot/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/install-pkgs.sh

@@ -53,7 +53,7 @@ fi
 # This must NOT key on lockfile presence alone. An npm-only project
 # (engines.bun = "please-use-npm", CI runs `npm ci`) that picks up a stray
 # bun.lock would otherwise get `bun install`, re-create the bun.lock, and break
-# — the SE-5221 regression. The engines/packageManager signals are
+# — the package-manager selection regression. The engines/packageManager signals are
 # authoritative; lockfiles are only a fallback and never override an opt-out.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-cursor/rules/00-rule-index.mdc

@@ -81,6 +81,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](documentation-source-paths-reference.mdc) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](project-learnings-reference.mdc) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](factory-model-reference.mdc) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](never-name-a-downstream-project-reference.mdc) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa-cursor/rules/never-name-a-downstream-project-reference.mdc

@@ -0,0 +1,42 @@
+---
+description: "Never Name a Downstream Project"
+alwaysApply: false
+---
+
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa-cursor/rules/never-name-a-downstream-project.mdc

@@ -0,0 +1,14 @@
+---
+description: "Never Name a Downstream Project"
+alwaysApply: true
+---
+
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](never-name-a-downstream-project-reference.mdc).

package/plugins/lisa-cursor/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"