@codyswann/lisa 4.65.8 → 4.66.1

package/expo/create-only/.github/workflows/maestro-e2e.yml

@@ -112,6 +112,12 @@ jobs:
       #   MAESTRO_TEST_PHONE=0000000000
       #   MAESTRO_TEST_OTP=555555
       #
+      # MAESTRO_RUN_ID namespaces the throwaway accounts and uploads a run
+      # mints (convention: tester+<runId><ordinal>) so a sweep can delete
+      # exactly one run's state. It defaults to the run's own id; uncomment to
+      # pin a shared namespace across invocations you will sweep together.
+      # run_id: 'my-sweep-namespace'
+      #
       # Once per run, before either platform starts — resets, sweeps, seeding.
       # pre_suite_command: |
       #   node scripts/maestro/prune-e2e-fixtures.mjs

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "dd0cd9d7119aa0d6ed10d1695cfdb9da488ffd7e",
-  "gitHead": "dd0cd9d7119aa0d6ed10d1695cfdb9da488ffd7e",
-  "lisaReleaseTag": "v4.65.8"
+  "lisaReleaseCommit": "0979337762941f8b34642797540d18c946e739bf",
+  "gitHead": "0979337762941f8b34642797540d18c946e739bf",
+  "lisaReleaseTag": "v4.66.1"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/worktree-binding-guard.mjs

@@ -506,9 +506,32 @@ function reachesOut(script, foreign, bound) {
   ]);
 }
 
-function stateFile(sessionId) {
+function stateFile(bindingKey) {
   const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
-  return join(home, "worktree-binding", `${sessionId}.json`);
+  return join(home, "worktree-binding", `${bindingKey}.json`);
+}
+
+/**
+ * The identity a binding belongs to.
+ *
+ * Parallel subagents share the session's `session_id`, so keying the binding
+ * on it alone made each subagent's guarded call read the binding a sibling
+ * recorded — the sibling's worktree then read as "changed underneath it" and
+ * its writes were refused, or an acknowledgement rebound the file out from
+ * under the sibling (CodySwannGT/lisa#4277). The payload's `agent_id` is what
+ * distinguishes a subagent from the main agent, so a caller carrying one gets
+ * its own state file. The main agent carries no `agent_id` and keeps the
+ * session-scoped key it always had, which is also the fallback for runtimes
+ * that never send the field.
+ *
+ * The key lands in a filename, so the composite is folded into a set that is
+ * legal on every filesystem — `:` is not, which rules it out as a separator
+ * and as tolerated session_id content on Windows hosts.
+ */
+function bindingKey(payload) {
+  const agent = payload?.agent_id;
+  if (typeof agent !== "string" || !agent) return payload.session_id;
+  return `${payload.session_id}--${agent}`.replaceAll(/[^A-Za-z0-9._-]/g, "_");
 }
 
 function readState(sessionId) {
@@ -640,8 +663,8 @@ function recordBaseline(sessionId, observed) {
 function recordClaim(payload, observed) {
   const claimed = claimedRoot(payload.tool_input, payload.cwd);
   if (!claimed || claimed === observed) return;
-  const previous = readState(payload.session_id);
-  writeState(payload.session_id, {
+  const previous = readState(bindingKey(payload));
+  writeState(bindingKey(payload), {
     boundRoot: previous?.boundRoot ?? observed,
     claimedRoot: claimed,
     updatedAt: new Date().toISOString(),
@@ -681,7 +704,7 @@ function handleAcceptance(payload, observed) {
       acceptanceLine(observed),
     ]);
   }
-  writeState(payload.session_id, {
+  writeState(bindingKey(payload), {
     boundRoot: observed,
     claimedRoot: null,
     updatedAt: new Date().toISOString(),
@@ -883,15 +906,16 @@ function evaluate(payload) {
     say("payload carries no session id or cwd; binding is NOT enforced");
     return 0;
   }
+  const binding = bindingKey(payload);
   const observed = worktreeRoot(cwd);
   if (!observed) return 0;
 
   if (payload.hook_event_name === "SessionStart") {
-    recordBaseline(sessionId, observed);
+    recordBaseline(binding, observed);
     // After the baseline, never before: `recordBaseline` writes a fresh state
     // for a session it has not seen, and the notice's record has to go on top
     // of that write rather than under it.
-    noticeRuntimeDrift(sessionId, process.env);
+    noticeRuntimeDrift(binding, process.env);
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {
@@ -903,7 +927,7 @@ function evaluate(payload) {
   const accepted = handleAcceptance(payload, observed);
   if (accepted !== null) return accepted;
 
-  const state = readState(sessionId);
+  const state = readState(binding);
   if (!state?.boundRoot) {
     // No baseline means SessionStart did not run for this session — an older
     // install, a runtime that fires no such event, a harness that skips it.
@@ -912,7 +936,7 @@ function evaluate(payload) {
     // refusing. Treating it as a refusal would turn a floor into a wall on
     // every surface where the event does not fire, and a wall gets switched
     // off, which costs the whole guard.
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),
@@ -923,7 +947,7 @@ function evaluate(payload) {
     return unconfirmedSwitch(state.claimedRoot, observed);
   }
   if (state.claimedRoot === observed) {
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/worktree-binding-guard.mjs

@@ -506,9 +506,32 @@ function reachesOut(script, foreign, bound) {
   ]);
 }
 
-function stateFile(sessionId) {
+function stateFile(bindingKey) {
   const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
-  return join(home, "worktree-binding", `${sessionId}.json`);
+  return join(home, "worktree-binding", `${bindingKey}.json`);
+}
+
+/**
+ * The identity a binding belongs to.
+ *
+ * Parallel subagents share the session's `session_id`, so keying the binding
+ * on it alone made each subagent's guarded call read the binding a sibling
+ * recorded — the sibling's worktree then read as "changed underneath it" and
+ * its writes were refused, or an acknowledgement rebound the file out from
+ * under the sibling (CodySwannGT/lisa#4277). The payload's `agent_id` is what
+ * distinguishes a subagent from the main agent, so a caller carrying one gets
+ * its own state file. The main agent carries no `agent_id` and keeps the
+ * session-scoped key it always had, which is also the fallback for runtimes
+ * that never send the field.
+ *
+ * The key lands in a filename, so the composite is folded into a set that is
+ * legal on every filesystem — `:` is not, which rules it out as a separator
+ * and as tolerated session_id content on Windows hosts.
+ */
+function bindingKey(payload) {
+  const agent = payload?.agent_id;
+  if (typeof agent !== "string" || !agent) return payload.session_id;
+  return `${payload.session_id}--${agent}`.replaceAll(/[^A-Za-z0-9._-]/g, "_");
 }
 
 function readState(sessionId) {
@@ -640,8 +663,8 @@ function recordBaseline(sessionId, observed) {
 function recordClaim(payload, observed) {
   const claimed = claimedRoot(payload.tool_input, payload.cwd);
   if (!claimed || claimed === observed) return;
-  const previous = readState(payload.session_id);
-  writeState(payload.session_id, {
+  const previous = readState(bindingKey(payload));
+  writeState(bindingKey(payload), {
     boundRoot: previous?.boundRoot ?? observed,
     claimedRoot: claimed,
     updatedAt: new Date().toISOString(),
@@ -681,7 +704,7 @@ function handleAcceptance(payload, observed) {
       acceptanceLine(observed),
     ]);
   }
-  writeState(payload.session_id, {
+  writeState(bindingKey(payload), {
     boundRoot: observed,
     claimedRoot: null,
     updatedAt: new Date().toISOString(),
@@ -883,15 +906,16 @@ function evaluate(payload) {
     say("payload carries no session id or cwd; binding is NOT enforced");
     return 0;
   }
+  const binding = bindingKey(payload);
   const observed = worktreeRoot(cwd);
   if (!observed) return 0;
 
   if (payload.hook_event_name === "SessionStart") {
-    recordBaseline(sessionId, observed);
+    recordBaseline(binding, observed);
     // After the baseline, never before: `recordBaseline` writes a fresh state
     // for a session it has not seen, and the notice's record has to go on top
     // of that write rather than under it.
-    noticeRuntimeDrift(sessionId, process.env);
+    noticeRuntimeDrift(binding, process.env);
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {
@@ -903,7 +927,7 @@ function evaluate(payload) {
   const accepted = handleAcceptance(payload, observed);
   if (accepted !== null) return accepted;
 
-  const state = readState(sessionId);
+  const state = readState(binding);
   if (!state?.boundRoot) {
     // No baseline means SessionStart did not run for this session — an older
     // install, a runtime that fires no such event, a harness that skips it.
@@ -912,7 +936,7 @@ function evaluate(payload) {
     // refusing. Treating it as a refusal would turn a floor into a wall on
     // every surface where the event does not fire, and a wall gets switched
     // off, which costs the whole guard.
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),
@@ -923,7 +947,7 @@ function evaluate(payload) {
     return unconfirmedSwitch(state.claimedRoot, observed);
   }
   if (state.claimedRoot === observed) {
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/worktree-binding-guard.mjs

@@ -506,9 +506,32 @@ function reachesOut(script, foreign, bound) {
   ]);
 }
 
-function stateFile(sessionId) {
+function stateFile(bindingKey) {
   const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
-  return join(home, "worktree-binding", `${sessionId}.json`);
+  return join(home, "worktree-binding", `${bindingKey}.json`);
+}
+
+/**
+ * The identity a binding belongs to.
+ *
+ * Parallel subagents share the session's `session_id`, so keying the binding
+ * on it alone made each subagent's guarded call read the binding a sibling
+ * recorded — the sibling's worktree then read as "changed underneath it" and
+ * its writes were refused, or an acknowledgement rebound the file out from
+ * under the sibling (CodySwannGT/lisa#4277). The payload's `agent_id` is what
+ * distinguishes a subagent from the main agent, so a caller carrying one gets
+ * its own state file. The main agent carries no `agent_id` and keeps the
+ * session-scoped key it always had, which is also the fallback for runtimes
+ * that never send the field.
+ *
+ * The key lands in a filename, so the composite is folded into a set that is
+ * legal on every filesystem — `:` is not, which rules it out as a separator
+ * and as tolerated session_id content on Windows hosts.
+ */
+function bindingKey(payload) {
+  const agent = payload?.agent_id;
+  if (typeof agent !== "string" || !agent) return payload.session_id;
+  return `${payload.session_id}--${agent}`.replaceAll(/[^A-Za-z0-9._-]/g, "_");
 }
 
 function readState(sessionId) {
@@ -640,8 +663,8 @@ function recordBaseline(sessionId, observed) {
 function recordClaim(payload, observed) {
   const claimed = claimedRoot(payload.tool_input, payload.cwd);
   if (!claimed || claimed === observed) return;
-  const previous = readState(payload.session_id);
-  writeState(payload.session_id, {
+  const previous = readState(bindingKey(payload));
+  writeState(bindingKey(payload), {
     boundRoot: previous?.boundRoot ?? observed,
     claimedRoot: claimed,
     updatedAt: new Date().toISOString(),
@@ -681,7 +704,7 @@ function handleAcceptance(payload, observed) {
       acceptanceLine(observed),
     ]);
   }
-  writeState(payload.session_id, {
+  writeState(bindingKey(payload), {
     boundRoot: observed,
     claimedRoot: null,
     updatedAt: new Date().toISOString(),
@@ -883,15 +906,16 @@ function evaluate(payload) {
     say("payload carries no session id or cwd; binding is NOT enforced");
     return 0;
   }
+  const binding = bindingKey(payload);
   const observed = worktreeRoot(cwd);
   if (!observed) return 0;
 
   if (payload.hook_event_name === "SessionStart") {
-    recordBaseline(sessionId, observed);
+    recordBaseline(binding, observed);
     // After the baseline, never before: `recordBaseline` writes a fresh state
     // for a session it has not seen, and the notice's record has to go on top
     // of that write rather than under it.
-    noticeRuntimeDrift(sessionId, process.env);
+    noticeRuntimeDrift(binding, process.env);
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {
@@ -903,7 +927,7 @@ function evaluate(payload) {
   const accepted = handleAcceptance(payload, observed);
   if (accepted !== null) return accepted;
 
-  const state = readState(sessionId);
+  const state = readState(binding);
   if (!state?.boundRoot) {
     // No baseline means SessionStart did not run for this session — an older
     // install, a runtime that fires no such event, a harness that skips it.
@@ -912,7 +936,7 @@ function evaluate(payload) {
     // refusing. Treating it as a refusal would turn a floor into a wall on
     // every surface where the event does not fire, and a wall gets switched
     // off, which costs the whole guard.
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),
@@ -923,7 +947,7 @@ function evaluate(payload) {
     return unconfirmedSwitch(state.claimedRoot, observed);
   }
   if (state.claimedRoot === observed) {
-    writeState(sessionId, {
+    writeState(binding, {
       boundRoot: observed,
       claimedRoot: null,
       updatedAt: new Date().toISOString(),

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.65.8",
+  "version": "4.66.1",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/skills/expo-router-best-practices/SKILL.md

@@ -426,6 +426,7 @@ const { width } = useWindowDimensions();
 For detailed documentation on specific topics, refer to:
 
 - `references/official-docs.md` - Condensed official Expo Router documentation
+- `references/static-export-verification.md` - Asserting enumerated routes, per-route titles, and initial HTML after `expo export`
 - `scripts/generate-route.py` - Route scaffolding script
 
 Official Documentation: https://docs.expo.dev/router/introduction/

package/plugins/lisa-expo/.codex-plugin/skills/expo-router-best-practices/references/static-export-verification.md

@@ -0,0 +1,54 @@
+# Static Export Verification
+
+When `expo export` runs with static output (`output: "static"` in app.json),
+every route must produce an HTML file with the right title and the expected
+initial markup. `expo export` succeeding only proves the bundle built — a
+missing route, a wrong title, or an empty shell all ship green unless the
+exported output itself is checked.
+
+## Enumerate the dynamic routes
+
+Static export prerenders each route it can enumerate. Dynamic segments need
+`generateStaticParams` — an unenumerated `[id]` route produces no page at all.
+After export, enumerate the routes the app *declares* and assert each one has
+a file under `dist/`:
+
+```typescript
+import { existsSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+const DIST = path.resolve("dist");
+
+// The routes the app owns — keep this in sync with app/, or derive it from
+// the route manifest expo-router emits.
+const EXPECTED_ROUTES = ["index", "settings", "players/[id]"];
+
+for (const route of EXPECTED_ROUTES) {
+  const html = path.join(DIST, `${route}.html`);
+  expect(existsSync(html)).toBe(true);
+}
+```
+
+## Per-route titles
+
+`<Stack.Screen options={{ title: "..." }}>` sets the native header title; the
+web `<title>` comes from `Head` (`expo-router/head`). Assert the title the
+exported HTML actually carries:
+
+```typescript
+const html = readFileSync(path.join(DIST, "settings.html"), "utf8");
+expect(html).toMatch(/<title>[^<]*Settings[^<]*<\/title>/);
+```
+
+## Expected initial content
+
+The exported page should ship its prerendered content, not a bare shell —
+that is what makes static export worth shipping at all. Assert a stable marker
+of the route's expected first paint:
+
+```typescript
+expect(html).toContain("Sign in to continue");
+```
+
+Keep the marker to content that exists in the static HTML, never something
+hydration adds later.

package/plugins/lisa-expo/.codex-plugin/skills/expo-tailwind-setup/SKILL.md

@@ -478,3 +478,10 @@ Add className to component props:
 ```tsx
 type Props = React.ComponentProps<typeof RNView> & { className?: string };
 ```
+
+The same rule applies at every styling API boundary — `useCssElement`,
+`cssInterop`, or `styled()`: type the wrapped component's props explicitly
+(`React.ComponentProps<typeof X> & { className?: string }`) and pass props
+through, rather than casting to a wider type. A cast compiles over a
+prop-shape drift that an explicit type would refuse — the boundary is where
+the drift is cheapest to catch.

package/plugins/lisa-expo/.codex-plugin/skills/playwright-selectors/SKILL.md

@@ -394,6 +394,31 @@ Components from third-party libraries (e.g., `react-native-bouncy-checkbox`, `re
 
 ---
 
+## Reveal-on-Focus Assertions
+
+`toBeVisible()` proves the element exists and is not hidden — it does NOT
+prove the element crossed onto the screen. A focused element scrolled off-view
+still reports visible. For any "focus reveals the element" behavior (skip
+links, focus-trapped modals, scroll-into-view containers), assert on layout,
+not just visibility:
+
+```typescript
+// Rejects when the element has no box at all (display: none, detached).
+const box = await page.getByTestId("dialog:panel").boundingBox();
+expect(box).not.toBeNull();
+
+// Then prove it is actually inside the viewport — the part toBeVisible()
+// cannot say.
+await expect(page.getByTestId("dialog:panel")).toBeInViewport();
+```
+
+Pair them: `boundingBox()` answers "is there a box" (null means never laid
+out), `toBeInViewport()` answers "did it cross onto the screen". An assertion
+that skips the null check reads a missing layout as a viewport miss, which is
+a different bug.
+
+---
+
 ## Implementation Checklist
 
 When adding E2E test coverage to a component:

package/plugins/lisa-expo/.codex-plugin/skills/testing-library/references/mocking-patterns.md

@@ -588,3 +588,25 @@ afterAll(() => {
   console.error = originalError;
 });
 ```
+
+## Migrating jest.mock Usage
+
+When moving a test file onto the managed setup, scope the migration to the
+file under your hand — a suite-wide mock sweep is where subtle behavior
+changes hide.
+
+- **Prefer renderer-compatible mocks.** A mock that works in the Node
+  environment but reads `window`, native modules, or ESM-only entry points
+  fails under the jsdom/renderer the Expo preset provides. Mock the seam your
+  component actually imports (`jest.mock("nativewind", ...)`,
+  `jest.mock("@/lib/env", ...)`) — never reach around it to mock a transitive
+  dependency.
+- **Keep factories stable and hoisted.** Jest hoists `jest.mock` calls above
+  imports, so a factory cannot close over outer variables. Everything the
+  factory needs must come from `jest.requireActual`, `jest.requireMock`, or a
+  `mock`-prefixed name. A factory that silently returns a different shape per
+  run is the migration failure that surfaces as unrelated flakes.
+- **Check version compatibility, not history.** A pinned workaround for an
+  old jest-expo/Expo SDK issue is not a permanent blocker — verify whether the
+  current versions still need it before carrying it forward. Historical Expo
+  issues expire; copy them forward only when they reproduce.

package/plugins/lisa-expo/skills/expo-router-best-practices/SKILL.md

@@ -426,6 +426,7 @@ const { width } = useWindowDimensions();
 For detailed documentation on specific topics, refer to:
 
 - `references/official-docs.md` - Condensed official Expo Router documentation
+- `references/static-export-verification.md` - Asserting enumerated routes, per-route titles, and initial HTML after `expo export`
 - `scripts/generate-route.py` - Route scaffolding script
 
 Official Documentation: https://docs.expo.dev/router/introduction/

package/plugins/lisa-expo/skills/expo-router-best-practices/references/static-export-verification.md

@@ -0,0 +1,54 @@
+# Static Export Verification
+
+When `expo export` runs with static output (`output: "static"` in app.json),
+every route must produce an HTML file with the right title and the expected
+initial markup. `expo export` succeeding only proves the bundle built — a
+missing route, a wrong title, or an empty shell all ship green unless the
+exported output itself is checked.
+
+## Enumerate the dynamic routes
+
+Static export prerenders each route it can enumerate. Dynamic segments need
+`generateStaticParams` — an unenumerated `[id]` route produces no page at all.
+After export, enumerate the routes the app *declares* and assert each one has
+a file under `dist/`:
+
+```typescript
+import { existsSync, readdirSync } from "node:fs";
+import path from "node:path";
+
+const DIST = path.resolve("dist");
+
+// The routes the app owns — keep this in sync with app/, or derive it from
+// the route manifest expo-router emits.
+const EXPECTED_ROUTES = ["index", "settings", "players/[id]"];
+
+for (const route of EXPECTED_ROUTES) {
+  const html = path.join(DIST, `${route}.html`);
+  expect(existsSync(html)).toBe(true);
+}
+```
+
+## Per-route titles
+
+`<Stack.Screen options={{ title: "..." }}>` sets the native header title; the
+web `<title>` comes from `Head` (`expo-router/head`). Assert the title the
+exported HTML actually carries:
+
+```typescript
+const html = readFileSync(path.join(DIST, "settings.html"), "utf8");
+expect(html).toMatch(/<title>[^<]*Settings[^<]*<\/title>/);
+```
+
+## Expected initial content
+
+The exported page should ship its prerendered content, not a bare shell —
+that is what makes static export worth shipping at all. Assert a stable marker
+of the route's expected first paint:
+
+```typescript
+expect(html).toContain("Sign in to continue");
+```
+
+Keep the marker to content that exists in the static HTML, never something
+hydration adds later.

package/plugins/lisa-expo/skills/expo-tailwind-setup/SKILL.md

@@ -478,3 +478,10 @@ Add className to component props:
 ```tsx
 type Props = React.ComponentProps<typeof RNView> & { className?: string };
 ```
+
+The same rule applies at every styling API boundary — `useCssElement`,
+`cssInterop`, or `styled()`: type the wrapped component's props explicitly
+(`React.ComponentProps<typeof X> & { className?: string }`) and pass props
+through, rather than casting to a wider type. A cast compiles over a
+prop-shape drift that an explicit type would refuse — the boundary is where
+the drift is cheapest to catch.