@codyswann/lisa 4.55.9 → 4.55.11

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "f05bf1444e854a2163285bac544b368b4cfb75e8",
-  "gitHead": "f05bf1444e854a2163285bac544b368b4cfb75e8",
-  "lisaReleaseTag": "v4.55.9"
+  "lisaReleaseCommit": "4936a1c0995d3406d00b906b4390ffe2e7f03c59",
+  "gitHead": "4936a1c0995d3406d00b906b4390ffe2e7f03c59",
+  "lisaReleaseTag": "v4.55.11"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/rules/eager/00-rule-index.md

@@ -76,6 +76,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](../reference/documentation-source-paths.md) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](../reference/project-learnings.md) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](../reference/factory-model.md) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa/rules/eager/never-name-a-downstream-project.md

@@ -0,0 +1,9 @@
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md).

package/plugins/lisa/rules/reference/never-name-a-downstream-project.md

@@ -0,0 +1,37 @@
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/rules/eager/00-rule-index.md

@@ -76,6 +76,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](../reference/documentation-source-paths.md) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](../reference/project-learnings.md) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](../reference/factory-model.md) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa-copilot/rules/eager/never-name-a-downstream-project.md

@@ -0,0 +1,9 @@
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](../reference/never-name-a-downstream-project.md).

package/plugins/lisa-copilot/rules/reference/never-name-a-downstream-project.md

@@ -0,0 +1,37 @@
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/rules/00-rule-index.mdc

@@ -81,6 +81,7 @@ Paths are relative to this file.
 | `documentation-source-paths` | moving, absorbing, or deleting a docs-like directory | [../reference/documentation-source-paths.md](documentation-source-paths-reference.mdc) |
 | `project-learnings` | you need the learnings ledger's entry schema and field semantics | [../reference/project-learnings.md](project-learnings-reference.mdc) |
 | `factory-model` | you need the shape of the factory model, not its obligations | [../reference/factory-model.md](factory-model-reference.mdc) |
+| `never-name-a-downstream-project` | you are about to refer to a downstream project in writing | [../reference/never-name-a-downstream-project.md](never-name-a-downstream-project-reference.mdc) |
 
 The obligations that follow from `factory-model` are in `base-rules`, which is
 eager. This entry is the exposition behind them.

package/plugins/lisa-cursor/rules/never-name-a-downstream-project-reference.mdc

@@ -0,0 +1,42 @@
+---
+description: "Never Name a Downstream Project"
+alwaysApply: false
+---
+
+# Never Name a Downstream Project
+
+## The rule
+
+A downstream project's identity — its organization, product, or repository name — does not belong in anything that outlives the session it was written in: tracker items (titles, descriptions, comments), pull request titles and bodies, commit messages, wiki and ingested sources, and the text of rules and skills.
+
+## Why the identity is never the point
+
+An observation earns its place by being reproducible, not by its provenance. "A caller repo pinned all 64 of its call sites" and the same sentence with a name carry exactly the same engineering weight — the second just adds an obligation for whoever reads it later.
+
+Where an argument appears to need the name, that is a signal the argument is under-specified. The fix is to state the condition that made it true — the version, the config, the shape of the tree — not to identify the place it was observed.
+
+## How to write it instead
+
+| situation | write |
+|---|---|
+| one project | "a caller repo", "a downstream project", "the reference repository" |
+| two contrasted | "repo A" / "repo B" |
+| several that must stay distinct in one sentence | `<project-1>`, `<project-2>` |
+| a real identifier | `<ticket>` |
+
+Rewrite the prose rather than substituting tokens wherever a placeholder reads badly: "follow `<name>`'s serverless pattern" becomes "follow the reference serverless pattern", not "follow `<project-1>`'s serverless pattern".
+
+## Enforcement is partial, and must not be relied on
+
+`block-host-name-leak` compares against a **curated denylist** and inspects **Bash tool calls only**. If the detector cannot be loaded, the hook warns and permits the write without inspecting the text. These limits follow:
+
+- a name nobody has added to the list is invisible to it;
+- a write issued by a script that reads its own body — rather than by a CLI given a `--body-file` — never reaches it at all.
+
+When the detector is available, a clean run means "no listed name appeared", never "this text is safe". When it is unavailable, no inspection occurred. This rule is default-deny and holds independently of whether the guard fires.
+
+Note also that the denylist cannot be the primary control: this repository is public and `dist/` ships to npm, so the entries most worth catching are the ones least safe to enumerate there.
+
+## Prior reference is not licence
+
+An existing ticket, brief, or ingested source that already carries a name does not authorise repeating it, and inherited text is the most common way such names spread — ingestion carries them forward, and each new document that quotes the last one multiplies them. When you meet one, replace it in what you are writing; do not propagate it because it was already there.

package/plugins/lisa-cursor/rules/never-name-a-downstream-project.mdc

@@ -0,0 +1,14 @@
+---
+description: "Never Name a Downstream Project"
+alwaysApply: true
+---
+
+# Never Name a Downstream Project
+
+Refer to a downstream project by its **role in the argument** — never by organization, product, or repository name — in tracker items, pull requests, commits, rules, skills, anything that outlives the session.
+
+Write the evidence, not the identity: "a caller repo", "repo A" / "repo B" when two are contrasted.
+
+Default-deny: it covers names nobody listed. `block-host-name-leak` catches some of them and is a rate reduction, never a proof.
+
+Full prose: [reference/never-name-a-downstream-project.md](never-name-a-downstream-project-reference.mdc).

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/skills/jira-journey/SKILL.md

@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
-  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
+- `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
+  This Expo parser deliberately remains home-config-only: it does not consume
+  checkout configuration or a `JIRA_SERVER` environment override. Its server must
+  be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
+  ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
+  and a root slash are canonicalized away. Whitespace, controls, encoded or
+  non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
 - `gh` CLI authenticated
 - Playwright MCP server running (browser tools available)
 - Dev server running

package/plugins/lisa-expo/.codex-plugin/skills/jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -33,6 +34,31 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def server_origin(server):
+    """Validate the base parser's bare HTTPS grammar before accessing a token."""
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
+    try:
+        parsed = urlsplit(server)
+        if (parsed.scheme != "https" or "@" in parsed.netloc
+                or "?" in server or "#" in server
+                or parsed.path not in ("", "/") or not parsed.hostname):
+            return ""
+        host = parsed.hostname
+        if parsed.netloc.startswith("["):
+            host = f"[{ipaddress.IPv6Address(host).compressed}]"
+        elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+            return ""
+        port = parsed.port
+        if port == 0:
+            return ""
+        suffix = f":{port}" if port is not None and port != 443 else ""
+        return f"https://{host}{suffix}"
+    except ValueError:
+        return ""
 
 
 def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
             elif line.startswith("login:"):
                 login = line.split(":", 1)[1].strip()
 
+    # Home configuration remains the operator-owned source; never trust checkout input here.
+    server = server_origin(server)
+    if not server:
+        print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
+        sys.exit(1)
+
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)

package/plugins/lisa-expo/skills/jira-journey/SKILL.md

@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
-  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
+- `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
+  This Expo parser deliberately remains home-config-only: it does not consume
+  checkout configuration or a `JIRA_SERVER` environment override. Its server must
+  be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
+  ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
+  and a root slash are canonicalized away. Whitespace, controls, encoded or
+  non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
 - `gh` CLI authenticated
 - Playwright MCP server running (browser tools available)
 - Dev server running

package/plugins/lisa-expo/skills/jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -33,6 +34,31 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def server_origin(server):
+    """Validate the base parser's bare HTTPS grammar before accessing a token."""
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
+    try:
+        parsed = urlsplit(server)
+        if (parsed.scheme != "https" or "@" in parsed.netloc
+                or "?" in server or "#" in server
+                or parsed.path not in ("", "/") or not parsed.hostname):
+            return ""
+        host = parsed.hostname
+        if parsed.netloc.startswith("["):
+            host = f"[{ipaddress.IPv6Address(host).compressed}]"
+        elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+            return ""
+        port = parsed.port
+        if port == 0:
+            return ""
+        suffix = f":{port}" if port is not None and port != 443 else ""
+        return f"https://{host}{suffix}"
+    except ValueError:
+        return ""
 
 
 def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
             elif line.startswith("login:"):
                 login = line.split(":", 1)[1].strip()
 
+    # Home configuration remains the operator-owned source; never trust checkout input here.
+    server = server_origin(server)
+    if not server:
+        print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
+        sys.exit(1)
+
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/skills/jira-journey/SKILL.md

@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
-  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
+- `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
+  This Expo parser deliberately remains home-config-only: it does not consume
+  checkout configuration or a `JIRA_SERVER` environment override. Its server must
+  be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
+  ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
+  and a root slash are canonicalized away. Whitespace, controls, encoded or
+  non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
 - `gh` CLI authenticated
 - Playwright MCP server running (browser tools available)
 - Dev server running

package/plugins/lisa-expo-agy/skills/jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -33,6 +34,31 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def server_origin(server):
+    """Validate the base parser's bare HTTPS grammar before accessing a token."""
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
+    try:
+        parsed = urlsplit(server)
+        if (parsed.scheme != "https" or "@" in parsed.netloc
+                or "?" in server or "#" in server
+                or parsed.path not in ("", "/") or not parsed.hostname):
+            return ""
+        host = parsed.hostname
+        if parsed.netloc.startswith("["):
+            host = f"[{ipaddress.IPv6Address(host).compressed}]"
+        elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+            return ""
+        port = parsed.port
+        if port == 0:
+            return ""
+        suffix = f":{port}" if port is not None and port != 443 else ""
+        return f"https://{host}{suffix}"
+    except ValueError:
+        return ""
 
 
 def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
             elif line.startswith("login:"):
                 login = line.split(":", 1)[1].strip()
 
+    # Home configuration remains the operator-owned source; never trust checkout input here.
+    server = server_origin(server)
+    if not server:
+        print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
+        sys.exit(1)
+
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/skills/jira-journey/SKILL.md

@@ -17,8 +17,13 @@ Read a JIRA ticket's Validation Journey, execute it via Playwright MCP browser t
 ## Prerequisites
 
 - `JIRA_API_TOKEN` environment variable set
-- `jira-cli` configured — `.lisa/jira-cli/.config.yml` (written by the
-  `setup-jira-cli` SessionStart hook) or `~/.config/.jira/.config.yml`
+- `jira-cli` configured in the operator's `~/.config/.jira/.config.yml`.
+  This Expo parser deliberately remains home-config-only: it does not consume
+  checkout configuration or a `JIRA_SERVER` environment override. Its server must
+  be a bare HTTPS origin with no userinfo, query, fragment, or path prefix.
+  ASCII DNS names, IPv4, and bracketed IPv6 are supported; default port `443`
+  and a root slash are canonicalized away. Whitespace, controls, encoded or
+  non-ASCII hosts, trailing dots, and port zero are rejected before the token is read.
 - `gh` CLI authenticated
 - Playwright MCP server running (browser tools available)
 - Dev server running

package/plugins/lisa-expo-copilot/skills/jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -33,6 +34,31 @@ import sys
 import urllib.request
 from base64 import b64encode
 from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def server_origin(server):
+    """Validate the base parser's bare HTTPS grammar before accessing a token."""
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
+    try:
+        parsed = urlsplit(server)
+        if (parsed.scheme != "https" or "@" in parsed.netloc
+                or "?" in server or "#" in server
+                or parsed.path not in ("", "/") or not parsed.hostname):
+            return ""
+        host = parsed.hostname
+        if parsed.netloc.startswith("["):
+            host = f"[{ipaddress.IPv6Address(host).compressed}]"
+        elif not re.fullmatch(r"[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*", host):
+            return ""
+        port = parsed.port
+        if port == 0:
+            return ""
+        suffix = f":{port}" if port is not None and port != 443 else ""
+        return f"https://{host}{suffix}"
+    except ValueError:
+        return ""
 
 
 def get_jira_config():
@@ -51,6 +77,12 @@ def get_jira_config():
             elif line.startswith("login:"):
                 login = line.split(":", 1)[1].strip()
 
+    # Home configuration remains the operator-owned source; never trust checkout input here.
+    server = server_origin(server)
+    if not server:
+        print("ERROR: Jira server must be a bare HTTPS origin without userinfo, path, query or fragment.", file=sys.stderr)
+        sys.exit(1)
+
     token = os.environ.get("JIRA_API_TOKEN", "")
     if not token:
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.55.9",
+  "version": "4.55.11",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"