@codyswann/lisa 4.59.2 → 4.59.3

package/plugins/lisa-cursor/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** Resolve the Expo pilot's credential inside its GitHub Actions job. */
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
+
+import { get, readConfig } from "./resolve-secret.mjs";
+import { ENV_KEY } from "./providers.mjs";
+import {
+  BIN_DIR,
+  ensureOnPath,
+  loadPinnedInstaller,
+} from "../../lisa-setup-workstation/scripts/cli.mjs";
+import {
+  installEntry,
+  planProvider,
+  resolveProvider,
+} from "../../lisa-setup-workstation/scripts/workstation.mjs";
+
+/** Provision only the selected provider, using the existing pinned installer. */
+async function prepareProvider(name) {
+  const provider = resolveProvider(name);
+  let plan = planProvider(provider);
+  if (plan.action === "present") return;
+  ensureOnPath(BIN_DIR);
+  plan = planProvider(provider);
+  if (plan.action === "present") return;
+  if (plan.action !== "install") throw new Error("Provider needs setup");
+  const installed = installEntry({ ...provider, name: provider.binary }, plan, {
+    installPinned: await loadPinnedInstaller(),
+  });
+  if (installed.action !== "installed")
+    throw new Error("Provider setup failed");
+}
+
+/** Keep the bootstrap inside this subprocess; export only the selected value. */
+async function resolveToken() {
+  const explicit = process.env.EXPO_TOKEN;
+  const bootstrap = process.env.LISA_SECRETS_BOOTSTRAP;
+  delete process.env.LISA_SECRETS_BOOTSTRAP;
+  if (explicit) return explicit;
+
+  process.env.LISA_SECRETS_SURFACE = "github-actions";
+  const cfg = readConfig();
+  if (cfg.provider === "env") return "";
+  if (
+    bootstrap &&
+    (!ENV_KEY.test(cfg.bootstrap.key ?? "") ||
+      cfg.bootstrap.key === "EXPO_TOKEN")
+  ) {
+    throw new Error("Invalid bootstrap key");
+  }
+  await prepareProvider(cfg.provider);
+  if (bootstrap) process.env[cfg.bootstrap.key] = bootstrap;
+  return get("EXPO_TOKEN", cfg);
+}
+
+if (process.argv.includes("--help")) {
+  // Safe to inspect without preparing a provider or reading/exporting a token.
+  console.log("Environment: EXPO_TOKEN LISA_SECRETS_BOOTSTRAP GITHUB_ENV");
+  console.log(
+    "An explicit EXPO_TOKEN takes precedence; otherwise resolve through the configured provider and export only EXPO_TOKEN to GITHUB_ENV."
+  );
+} else {
+  let failureMessage = "GITHUB_ENV is required to export EXPO_TOKEN.";
+  try {
+    const destination = process.env.GITHUB_ENV;
+    if (!destination) throw new Error("GITHUB_ENV is required");
+    failureMessage =
+      "Unable to resolve EXPO_TOKEN. Check the configured provider, bootstrap input, and secrets.require; ensure the runner can install its provider CLI.";
+    const token = await resolveToken();
+    if (token) {
+      const masked = token
+        .replaceAll("%", "%25")
+        .replaceAll("\r", "%0D")
+        .replaceAll("\n", "%0A");
+      console.log(`::add-mask::${masked}`);
+      const delimiter = randomUUID();
+      failureMessage =
+        "Unable to write EXPO_TOKEN to GITHUB_ENV. Check the runner's environment file.";
+      appendFileSync(
+        destination,
+        `EXPO_TOKEN<<${delimiter}\n${token}\n${delimiter}\n`
+      );
+    }
+  } catch {
+    // Provider errors can contain captured subprocess output. Never echo it.
+    console.error(failureMessage);
+    process.exitCode = 1;
+  }
+}

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -188,6 +188,18 @@ On the GitHub Actions surface the repository secret and the exported environment
 
 There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
 
+### Expo workflow pilot
+
+The reusable Expo build workflow and the Expo deploy template can resolve `EXPO_TOKEN` from the project's configured provider. An explicit `EXPO_TOKEN` repository secret still takes precedence. Projects without a provider bootstrap keep their existing behavior.
+
+For provider-backed Expo authentication, install a Lisa package containing `resolve-expo-token.mjs`, declare the provider and bootstrap in `.lisa.config.json`, and include `EXPO_TOKEN` if `secrets.require` is present. The workflow prepares only that provider's CLI through Lisa's existing installer, which uses checksum-pinned downloads for Bitwarden. Providers requiring manual setup must already be installed on the runner. The resolver respects the provider grant and `secrets.narrow`, masks the selected token, and writes only `EXPO_TOKEN` to the current job's environment. The bootstrap stays inside the resolver subprocess; the vault is not materialized into the job environment.
+
+The build workflow's optional `LISA_SECRETS_BOOTSTRAP` secret input accepts the existing repository bootstrap secret. This input is an alias, not another stored credential: the resolver maps it to `bootstrap.key` inside its process. The Expo caller template forwards `secrets.BWS_ACCESS_TOKEN` by default. If your stored bootstrap has a different name, update its three references: the eligibility check, the reusable build call, and the deploy job's resolution step.
+
+The eligibility check only establishes that an explicit token or a configured provider plus bootstrap is available. Each build or deploy job resolves its own token and must authenticate with Expo. A provider-backed caller using an older Lisa package fails with an upgrade instruction before invoking Expo.
+
+The deploy caller is a **create-only** template. Existing projects must deliberately apply these caller changes after upgrading Lisa; a normal sync does not overwrite their workflow. This pilot does not convert other workflow credentials. `DEPLOY_KEY` remains available before dependency installation for checkout. Do not remove an existing Expo repository secret until a provider-only run has authenticated successfully.
+
 ## The exposure boundary
 
 **The provider's own scoping is the default allowlist.** The machine account's project grants *are* the permitted set; restating that as a list in config would duplicate a boundary the provider already enforces.

package/plugins/src/base/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** Resolve the Expo pilot's credential inside its GitHub Actions job. */
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
+
+import { get, readConfig } from "./resolve-secret.mjs";
+import { ENV_KEY } from "./providers.mjs";
+import {
+  BIN_DIR,
+  ensureOnPath,
+  loadPinnedInstaller,
+} from "../../lisa-setup-workstation/scripts/cli.mjs";
+import {
+  installEntry,
+  planProvider,
+  resolveProvider,
+} from "../../lisa-setup-workstation/scripts/workstation.mjs";
+
+/** Provision only the selected provider, using the existing pinned installer. */
+async function prepareProvider(name) {
+  const provider = resolveProvider(name);
+  let plan = planProvider(provider);
+  if (plan.action === "present") return;
+  ensureOnPath(BIN_DIR);
+  plan = planProvider(provider);
+  if (plan.action === "present") return;
+  if (plan.action !== "install") throw new Error("Provider needs setup");
+  const installed = installEntry({ ...provider, name: provider.binary }, plan, {
+    installPinned: await loadPinnedInstaller(),
+  });
+  if (installed.action !== "installed")
+    throw new Error("Provider setup failed");
+}
+
+/** Keep the bootstrap inside this subprocess; export only the selected value. */
+async function resolveToken() {
+  const explicit = process.env.EXPO_TOKEN;
+  const bootstrap = process.env.LISA_SECRETS_BOOTSTRAP;
+  delete process.env.LISA_SECRETS_BOOTSTRAP;
+  if (explicit) return explicit;
+
+  process.env.LISA_SECRETS_SURFACE = "github-actions";
+  const cfg = readConfig();
+  if (cfg.provider === "env") return "";
+  if (
+    bootstrap &&
+    (!ENV_KEY.test(cfg.bootstrap.key ?? "") ||
+      cfg.bootstrap.key === "EXPO_TOKEN")
+  ) {
+    throw new Error("Invalid bootstrap key");
+  }
+  await prepareProvider(cfg.provider);
+  if (bootstrap) process.env[cfg.bootstrap.key] = bootstrap;
+  return get("EXPO_TOKEN", cfg);
+}
+
+if (process.argv.includes("--help")) {
+  // Safe to inspect without preparing a provider or reading/exporting a token.
+  console.log("Environment: EXPO_TOKEN LISA_SECRETS_BOOTSTRAP GITHUB_ENV");
+  console.log(
+    "An explicit EXPO_TOKEN takes precedence; otherwise resolve through the configured provider and export only EXPO_TOKEN to GITHUB_ENV."
+  );
+} else {
+  let failureMessage = "GITHUB_ENV is required to export EXPO_TOKEN.";
+  try {
+    const destination = process.env.GITHUB_ENV;
+    if (!destination) throw new Error("GITHUB_ENV is required");
+    failureMessage =
+      "Unable to resolve EXPO_TOKEN. Check the configured provider, bootstrap input, and secrets.require; ensure the runner can install its provider CLI.";
+    const token = await resolveToken();
+    if (token) {
+      const masked = token
+        .replaceAll("%", "%25")
+        .replaceAll("\r", "%0D")
+        .replaceAll("\n", "%0A");
+      console.log(`::add-mask::${masked}`);
+      const delimiter = randomUUID();
+      failureMessage =
+        "Unable to write EXPO_TOKEN to GITHUB_ENV. Check the runner's environment file.";
+      appendFileSync(
+        destination,
+        `EXPO_TOKEN<<${delimiter}\n${token}\n${delimiter}\n`
+      );
+    }
+  } catch {
+    // Provider errors can contain captured subprocess output. Never echo it.
+    console.error(failureMessage);
+    process.exitCode = 1;
+  }
+}