@codyswann/lisa 4.55.10 → 4.55.12

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.55.10",
+  "version": "4.55.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/install-pkgs.sh

@@ -53,7 +53,7 @@ fi
 # This must NOT key on lockfile presence alone. An npm-only project
 # (engines.bun = "please-use-npm", CI runs `npm ci`) that picks up a stray
 # bun.lock would otherwise get `bun install`, re-create the bun.lock, and break
-# — the SE-5221 regression. The engines/packageManager signals are
+# — the package-manager selection regression. The engines/packageManager signals are
 # authoritative; lockfiles are only a fallback and never override an opt-out.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/plugins/src/base/rules/eager/00-rule-index.md

@@ -76,6 +76,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](../reference/documentation-source-paths.md) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](../reference/project-learnings.md) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](../reference/factory-model.md) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/src/base/rules/eager/never-name-a-downstream-project.md

@@ -0,0 +1,9 @@
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md).

package/plugins/src/base/rules/reference/never-name-a-downstream-project.md

@@ -0,0 +1,37 @@
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/src/base/skills/lisa-generate-claude-remote-build-script/SKILL.md

@@ -169,7 +169,7 @@ require() { need "$1" || { echo "FATAL: required tool '$1' missing and install f
 # Resolve the PM from packageManager/engines/lockfiles — emit the manager the
 # `packageManager` inventory field reported, NEVER a hardcoded bun. An npm-only
 # project (engines.bun = "please-use-npm") must install with npm; emitting
-# `bun install` would create a stray bun.lock and break it (the SE-5221
+# `bun install` would create a stray bun.lock and break it (the package-manager selection
 # regression). Only install/PATH-export the manager actually selected below.
 detect_package_manager() {
   _field="" _forced="" _forbidden=""

package/scripts/claude-remote-setup.sh

@@ -92,7 +92,7 @@ require gitleaks
 # Resolve the package manager from packageManager/engines/lockfiles rather than
 # hardcoding bun: an npm-only project (engines.bun = "please-use-npm", CI runs
 # `npm ci`) must install with npm, never `bun install` — which would create a
-# stray bun.lock and break the project (the SE-5221 regression). jq is required
+# stray bun.lock and break the project (the package-manager selection regression). jq is required
 # above, so the package.json signals are always available here.
 # bun has known proxy package-fetch issues in cloud sessions; retry transient failures.
 detect_package_manager() {

package/typescript/copy-contents/.husky/pre-push

@@ -774,7 +774,7 @@ else
     # npm branch (`npm audit --production`) and the yarn branch
     # (`yarn audit --groups dependencies`). Without it, bun audits
     # devDependencies too and the gate fails on dev-only CVEs that never ship —
-    # the SE-5221 false positive. bun honours `--production` even though
+    # the package-manager selection false positive. bun honours `--production` even though
     # `bun audit --help` omits it from the flag list.
     # Normalize bun's transport before parsing, or this gate FAILS OPEN.
     #