@codyswann/lisa 4.55.9 → 4.55.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. package/dist/core/nightly-e2e-guard-behavior-certificate.js +2 -2
  2. package/dist/core/nightly-e2e-guard-behavior-certificate.js.map +1 -1
  3. package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
  4. package/dist/core/upstream-evidence-manifest.js +3 -2
  5. package/dist/core/upstream-evidence-manifest.js.map +1 -1
  6. package/package.json +4 -4
  7. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  8. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  9. package/plugins/lisa-agy/plugin.json +1 -1
  10. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  11. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  12. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  13. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  14. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  15. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  16. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  17. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  18. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  19. package/plugins/lisa-expo/.codex-plugin/skills/jira-journey/SKILL.md +7 -2
  20. package/plugins/lisa-expo/.codex-plugin/skills/jira-journey/scripts/parse-plan.py +32 -0
  21. package/plugins/lisa-expo/skills/jira-journey/SKILL.md +7 -2
  22. package/plugins/lisa-expo/skills/jira-journey/scripts/parse-plan.py +32 -0
  23. package/plugins/lisa-expo-agy/plugin.json +1 -1
  24. package/plugins/lisa-expo-agy/skills/jira-journey/SKILL.md +7 -2
  25. package/plugins/lisa-expo-agy/skills/jira-journey/scripts/parse-plan.py +32 -0
  26. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  27. package/plugins/lisa-expo-copilot/skills/jira-journey/SKILL.md +7 -2
  28. package/plugins/lisa-expo-copilot/skills/jira-journey/scripts/parse-plan.py +32 -0
  29. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  30. package/plugins/lisa-expo-cursor/skills/jira-journey/SKILL.md +7 -2
  31. package/plugins/lisa-expo-cursor/skills/jira-journey/scripts/parse-plan.py +32 -0
  32. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  33. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  34. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  35. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  36. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  37. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  38. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  39. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  40. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  41. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  42. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  43. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  44. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  45. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  46. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  47. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  48. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  49. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  50. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  51. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  52. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  53. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  54. package/plugins/lisa-rails-agy/plugin.json +1 -1
  55. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  56. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  57. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  58. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  59. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  60. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  61. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  62. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  63. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  64. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  65. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  66. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  67. package/plugins/src/expo/skills/jira-journey/SKILL.md +7 -2
  68. package/plugins/src/expo/skills/jira-journey/scripts/parse-plan.py +32 -0
package/package.json CHANGED
@@ -187,7 +187,7 @@
187
187
  "zod-validation-error": "^4.0.0"
188
188
  },
189
189
  "name": "@codyswann/lisa",
190
- "version": "4.55.9",
190
+ "version": "4.55.10",
191
191
  "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
192
192
  "main": "dist/index.js",
193
193
  "exports": {
@@ -336,7 +336,7 @@
336
336
  "test": "tests"
337
337
  },
338
338
  "types": "./dist/index.d.ts",
339
- "lisaReleaseCommit": "f05bf1444e854a2163285bac544b368b4cfb75e8",
340
- "gitHead": "f05bf1444e854a2163285bac544b368b4cfb75e8",
341
- "lisaReleaseTag": "v4.55.9"
339
+ "lisaReleaseCommit": "bbf92dbe112ba3ed753ae43cde2691f1de3c772c",
340
+ "gitHead": "bbf92dbe112ba3ed753ae43cde2691f1de3c772c",
341
+ "lisaReleaseTag": "v4.55.10"
342
342
  }
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "AWS CDK-specific Lisa plugin.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
17
17
  ## Prerequisites
18
18
 
19
19
  - `JIRA_API_TOKEN` environment variable set
20
- - `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
21
- `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
20
+ - `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
21
+ This Expo parser deliberately remains home-config-only: it does not consume
22
+ checkout configuration or a `JIRA_SERVER` environment override. Its server must
23
+ be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
24
+ ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
25
+ and a root slash are canonicalized away. Whitespace, controls, encoded or
26
+ non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
22
27
  - `gh` CLI authenticated
23
28
  - Playwright MCP server running (browser tools available)
24
29
  - Dev server running
@@ -25,6 +25,7 @@ Output (JSON):
25
25
  }
26
26
  """
27
27
 
28
+ import ipaddress
28
29
  import json
29
30
  import os
30
31
  import re
@@ -33,6 +34,31 @@ import sys
33
34
  import urllib.request
34
35
  from base64 import b64encode
35
36
  from pathlib import Path
37
+ from urllib.parse import urlsplit
38
+
39
+
40
+ def server_origin(server):
41
+ """Validate the base parser's bare HTTPS grammar before accessing a token."""
42
+ if not server or any(char <= " " or char >= "\x7f" for char in server):
43
+ return ""
44
+ try:
45
+ parsed = urlsplit(server)
46
+ if (parsed.scheme != "https" or "@" in parsed.netloc
47
+ or "?" in server or "#" in server
48
+ or parsed.path not in ("", "/") or not parsed.hostname):
49
+ return ""
50
+ host = parsed.hostname
51
+ if parsed.netloc.startswith("["):
52
+ host = f"[{ipaddress.IPv6Address(host).compressed}]"
53
+ elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
54
+ return ""
55
+ port = parsed.port
56
+ if port == 0:
57
+ return ""
58
+ suffix = f":{port}" if port is not None and port != 443 else ""
59
+ return f"https://{host}{suffix}"
60
+ except ValueError:
61
+ return ""
36
62
 
37
63
 
38
64
  def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
51
77
  elif line.startswith("login:"):
52
78
  login = line.split(":", 1)[1].strip()
53
79
 
80
+ # Home configuration remains the operator-owned source; never trust checkout input here.
81
+ server = server_origin(server)
82
+ if not server:
83
+ print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
84
+ sys.exit(1)
85
+
54
86
  token = os.environ.get("JIRA_API_TOKEN", "")
55
87
  if not token:
56
88
  print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
17
17
  ## Prerequisites
18
18
 
19
19
  - `JIRA_API_TOKEN` environment variable set
20
- - `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
21
- `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
20
+ - `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
21
+ This Expo parser deliberately remains home-config-only: it does not consume
22
+ checkout configuration or a `JIRA_SERVER` environment override. Its server must
23
+ be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
24
+ ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
25
+ and a root slash are canonicalized away. Whitespace, controls, encoded or
26
+ non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
22
27
  - `gh` CLI authenticated
23
28
  - Playwright MCP server running (browser tools available)
24
29
  - Dev server running
@@ -25,6 +25,7 @@ Output (JSON):
25
25
  }
26
26
  """
27
27
 
28
+ import ipaddress
28
29
  import json
29
30
  import os
30
31
  import re
@@ -33,6 +34,31 @@ import sys
33
34
  import urllib.request
34
35
  from base64 import b64encode
35
36
  from pathlib import Path
37
+ from urllib.parse import urlsplit
38
+
39
+
40
+ def server_origin(server):
41
+ """Validate the base parser's bare HTTPS grammar before accessing a token."""
42
+ if not server or any(char <= " " or char >= "\x7f" for char in server):
43
+ return ""
44
+ try:
45
+ parsed = urlsplit(server)
46
+ if (parsed.scheme != "https" or "@" in parsed.netloc
47
+ or "?" in server or "#" in server
48
+ or parsed.path not in ("", "/") or not parsed.hostname):
49
+ return ""
50
+ host = parsed.hostname
51
+ if parsed.netloc.startswith("["):
52
+ host = f"[{ipaddress.IPv6Address(host).compressed}]"
53
+ elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
54
+ return ""
55
+ port = parsed.port
56
+ if port == 0:
57
+ return ""
58
+ suffix = f":{port}" if port is not None and port != 443 else ""
59
+ return f"https://{host}{suffix}"
60
+ except ValueError:
61
+ return ""
36
62
 
37
63
 
38
64
  def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
51
77
  elif line.startswith("login:"):
52
78
  login = line.split(":", 1)[1].strip()
53
79
 
80
+ # Home configuration remains the operator-owned source; never trust checkout input here.
81
+ server = server_origin(server)
82
+ if not server:
83
+ print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
84
+ sys.exit(1)
85
+
54
86
  token = os.environ.get("JIRA_API_TOKEN", "")
55
87
  if not token:
56
88
  print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
17
17
  ## Prerequisites
18
18
 
19
19
  - `JIRA_API_TOKEN` environment variable set
20
- - `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
21
- `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
20
+ - `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
21
+ This Expo parser deliberately remains home-config-only: it does not consume
22
+ checkout configuration or a `JIRA_SERVER` environment override. Its server must
23
+ be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
24
+ ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
25
+ and a root slash are canonicalized away. Whitespace, controls, encoded or
26
+ non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
22
27
  - `gh` CLI authenticated
23
28
  - Playwright MCP server running (browser tools available)
24
29
  - Dev server running
@@ -25,6 +25,7 @@ Output (JSON):
25
25
  }
26
26
  """
27
27
 
28
+ import ipaddress
28
29
  import json
29
30
  import os
30
31
  import re
@@ -33,6 +34,31 @@ import sys
33
34
  import urllib.request
34
35
  from base64 import b64encode
35
36
  from pathlib import Path
37
+ from urllib.parse import urlsplit
38
+
39
+
40
+ def server_origin(server):
41
+ """Validate the base parser's bare HTTPS grammar before accessing a token."""
42
+ if not server or any(char <= " " or char >= "\x7f" for char in server):
43
+ return ""
44
+ try:
45
+ parsed = urlsplit(server)
46
+ if (parsed.scheme != "https" or "@" in parsed.netloc
47
+ or "?" in server or "#" in server
48
+ or parsed.path not in ("", "/") or not parsed.hostname):
49
+ return ""
50
+ host = parsed.hostname
51
+ if parsed.netloc.startswith("["):
52
+ host = f"[{ipaddress.IPv6Address(host).compressed}]"
53
+ elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
54
+ return ""
55
+ port = parsed.port
56
+ if port == 0:
57
+ return ""
58
+ suffix = f":{port}" if port is not None and port != 443 else ""
59
+ return f"https://{host}{suffix}"
60
+ except ValueError:
61
+ return ""
36
62
 
37
63
 
38
64
  def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
51
77
  elif line.startswith("login:"):
52
78
  login = line.split(":", 1)[1].strip()
53
79
 
80
+ # Home configuration remains the operator-owned source; never trust checkout input here.
81
+ server = server_origin(server)
82
+ if not server:
83
+ print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
84
+ sys.exit(1)
85
+
54
86
  token = os.environ.get("JIRA_API_TOKEN", "")
55
87
  if not token:
56
88
  print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
17
17
  ## Prerequisites
18
18
 
19
19
  - `JIRA_API_TOKEN` environment variable set
20
- - `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
21
- `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
20
+ - `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
21
+ This Expo parser deliberately remains home-config-only: it does not consume
22
+ checkout configuration or a `JIRA_SERVER` environment override. Its server must
23
+ be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
24
+ ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
25
+ and a root slash are canonicalized away. Whitespace, controls, encoded or
26
+ non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
22
27
  - `gh` CLI authenticated
23
28
  - Playwright MCP server running (browser tools available)
24
29
  - Dev server running
@@ -25,6 +25,7 @@ Output (JSON):
25
25
  }
26
26
  """
27
27
 
28
+ import ipaddress
28
29
  import json
29
30
  import os
30
31
  import re
@@ -33,6 +34,31 @@ import sys
33
34
  import urllib.request
34
35
  from base64 import b64encode
35
36
  from pathlib import Path
37
+ from urllib.parse import urlsplit
38
+
39
+
40
+ def server_origin(server):
41
+ """Validate the base parser's bare HTTPS grammar before accessing a token."""
42
+ if not server or any(char <= " " or char >= "\x7f" for char in server):
43
+ return ""
44
+ try:
45
+ parsed = urlsplit(server)
46
+ if (parsed.scheme != "https" or "@" in parsed.netloc
47
+ or "?" in server or "#" in server
48
+ or parsed.path not in ("", "/") or not parsed.hostname):
49
+ return ""
50
+ host = parsed.hostname
51
+ if parsed.netloc.startswith("["):
52
+ host = f"[{ipaddress.IPv6Address(host).compressed}]"
53
+ elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
54
+ return ""
55
+ port = parsed.port
56
+ if port == 0:
57
+ return ""
58
+ suffix = f":{port}" if port is not None and port != 443 else ""
59
+ return f"https://{host}{suffix}"
60
+ except ValueError:
61
+ return ""
36
62
 
37
63
 
38
64
  def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
51
77
  elif line.startswith("login:"):
52
78
  login = line.split(":", 1)[1].strip()
53
79
 
80
+ # Home configuration remains the operator-owned source; never trust checkout input here.
81
+ server = server_origin(server)
82
+ if not server:
83
+ print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
84
+ sys.exit(1)
85
+
54
86
  token = os.environ.get("JIRA_API_TOKEN", "")
55
87
  if not token:
56
88
  print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
17
17
  ## Prerequisites
18
18
 
19
19
  - `JIRA_API_TOKEN` environment variable set
20
- - `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
21
- `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
20
+ - `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
21
+ This Expo parser deliberately remains home-config-only: it does not consume
22
+ checkout configuration or a `JIRA_SERVER` environment override. Its server must
23
+ be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
24
+ ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
25
+ and a root slash are canonicalized away. Whitespace, controls, encoded or
26
+ non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
22
27
  - `gh` CLI authenticated
23
28
  - Playwright MCP server running (browser tools available)
24
29
  - Dev server running
@@ -25,6 +25,7 @@ Output (JSON):
25
25
  }
26
26
  """
27
27
 
28
+ import ipaddress
28
29
  import json
29
30
  import os
30
31
  import re
@@ -33,6 +34,31 @@ import sys
33
34
  import urllib.request
34
35
  from base64 import b64encode
35
36
  from pathlib import Path
37
+ from urllib.parse import urlsplit
38
+
39
+
40
+ def server_origin(server):
41
+ """Validate the base parser's bare HTTPS grammar before accessing a token."""
42
+ if not server or any(char <= " " or char >= "\x7f" for char in server):
43
+ return ""
44
+ try:
45
+ parsed = urlsplit(server)
46
+ if (parsed.scheme != "https" or "@" in parsed.netloc
47
+ or "?" in server or "#" in server
48
+ or parsed.path not in ("", "/") or not parsed.hostname):
49
+ return ""
50
+ host = parsed.hostname
51
+ if parsed.netloc.startswith("["):
52
+ host = f"[{ipaddress.IPv6Address(host).compressed}]"
53
+ elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
54
+ return ""
55
+ port = parsed.port
56
+ if port == 0:
57
+ return ""
58
+ suffix = f":{port}" if port is not None and port != 443 else ""
59
+ return f"https://{host}{suffix}"
60
+ except ValueError:
61
+ return ""
36
62
 
37
63
 
38
64
  def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
51
77
  elif line.startswith("login:"):
52
78
  login = line.split(":", 1)[1].strip()
53
79
 
80
+ # Home configuration remains the operator-owned source; never trust checkout input here.
81
+ server = server_origin(server)
82
+ if not server:
83
+ print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
84
+ sys.exit(1)
85
+
54
86
  token = os.environ.get("JIRA_API_TOKEN", "")
55
87
  if not token:
56
88
  print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "4.55.9",
3
+ "version": "4.55.10",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"