@codyswann/lisa 4.66.2 → 4.66.3

package/dist/opencode/plugin-templates/lisa-block-direct-issue-create.ts

@@ -584,10 +584,12 @@ const LisaBlockDirectIssueCreate = async () => {
   /**
    * Tool names that are never a tracker creation, skipped before anything else.
    *
-   * The canonical guard's own list, transcribed rather than adapted. It is a
-   * cost gate, not a correctness gate — none of these names would survive the
-   * verb and noun tests below anyway — so keeping it identical costs nothing
-   * and removes one way for the two implementations to disagree.
+   * The canonical guard's own list, transcribed rather than adapted. It is
+   * mostly a cost gate, but not ONLY one: `TaskCreate` and friends satisfy
+   * both shape tests below, so for the `Task*` family this set is also the
+   * correctness decision — the canonical guard allows them unconditionally,
+   * and a port that skips them here rather than below is the only way to
+   * stay exactly as strict, never stricter.
    */
   const STRUCTURED_SKIP: ReadonlySet<string> = new Set([
     "Bash",
@@ -599,6 +601,19 @@ const LisaBlockDirectIssueCreate = async () => {
     "Grep",
     "Task",
     "TodoWrite",
+    // The `Task*` family is the runtime's in-session task list — LOCAL
+    // scratch, not a tracker write. `TaskCreate` satisfies both shape gates
+    // (create-verb + task noun) and carries `"type": "bug"` metadata the
+    // lisa-implement skill prescribes; absent from this set it is refused as
+    // a tracker creation here while the canonical guard allows it — making
+    // this port STRICTER, the one direction it is documented never to take
+    // (CodySwannGT/lisa#4274).
+    "TaskCreate",
+    "TaskGet",
+    "TaskList",
+    "TaskOutput",
+    "TaskStop",
+    "TaskUpdate",
   ]);
   /**
    * A creation verb in a tool name, matched on SHAPE rather than on a list of

package/expo/create-only/.github/workflows/deploy.yml

@@ -154,6 +154,16 @@ jobs:
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
       SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
       SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+      # Scanner tokens release.yml re-declares and forwards to quality.yml —
+      # without them the deploy-path quality run silently skips Sonar, Snyk,
+      # GitGuardian, FOSSA and Maestro (CodySwannGT/lisa#4287). Tracker
+      # credentials are deliberately absent: work_item_traceability is
+      # pull_request-only and never runs on the release path.
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+      MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
 
   # Step 2: Deploy to AWS (Custom deployment logic)
   check_eas_setup:

package/nestjs/create-only/.github/workflows/deploy.yml

@@ -149,6 +149,16 @@ jobs:
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
       SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
       SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+      # Scanner tokens release.yml re-declares and forwards to quality.yml —
+      # without them the deploy-path quality run silently skips Sonar, Snyk,
+      # GitGuardian, FOSSA and Maestro (CodySwannGT/lisa#4287). Tracker
+      # credentials are deliberately absent: work_item_traceability is
+      # pull_request-only and never runs on the release path.
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+      MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
 
   verify_aws_credentials:
     name: Verify AWS Credentials

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "80f2ea7d119a11d3b2dc6497e20d10fb0c49b605",
-  "gitHead": "80f2ea7d119a11d3b2dc6497e20d10fb0c49b605",
-  "lisaReleaseTag": "v4.66.2"
+  "lisaReleaseCommit": "764ae79b79c134e967e35cfb75c0b7986f997216",
+  "gitHead": "764ae79b79c134e967e35cfb75c0b7986f997216",
+  "lisaReleaseTag": "v4.66.3"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/worktree-binding-guard.mjs

@@ -511,6 +511,20 @@ function stateFile(bindingKey) {
   return join(home, "worktree-binding", `${bindingKey}.json`);
 }
 
+/**
+ * Percent-escape every byte that is not filename-safe, so the output cannot
+ * contain `-` at all and two escaped parts can be joined on `--` without the
+ * joiner ever being smuggled in from either side.
+ *
+ * `:` and friends are folded too — the key lands in a filename and `:` is
+ * illegal on Windows/NTFS (CodySwannGT/lisa#4277).
+ * @param {string} value - One component of the binding key
+ * @returns {string} A component containing only `[A-Za-z0-9._]` and `%XX`
+ */
+function keyPart(value) {
+  return encodeURIComponent(value).replaceAll("-", "%2D");
+}
+
 /**
  * The identity a binding belongs to.
  *
@@ -524,22 +538,58 @@ function stateFile(bindingKey) {
  * session-scoped key it always had, which is also the fallback for runtimes
  * that never send the field.
  *
- * The key lands in a filename, so the composite is folded into a set that is
- * legal on every filesystem — `:` is not, which rules it out as a separator
- * and as tolerated session_id content on Windows hosts.
+ * Both shapes escape every component with {@link keyPart}, so the session key
+ * `x` and the agent key `a--b` live in disjoint namespaces: an escaped
+ * component never contains `-`, a main-session key is one component, an
+ * agent key is two joined by the only `--` the string can hold. Session
+ * "s%2Da--c" cannot collide with session "s-a" + agent "c", and neither can
+ * collide across the two shapes (CodySwannGT/lisa#4294).
  */
 function bindingKey(payload) {
   const agent = payload?.agent_id;
-  if (typeof agent !== "string" || !agent) return payload.session_id;
-  return `${payload.session_id}--${agent}`.replaceAll(/[^A-Za-z0-9._-]/g, "_");
+  if (typeof agent !== "string" || !agent) return keyPart(payload.session_id);
+  return `${keyPart(payload.session_id)}--${keyPart(agent)}`;
 }
 
-function readState(sessionId) {
-  try {
-    return JSON.parse(readFileSync(stateFile(sessionId), "utf8"));
-  } catch {
-    return null;
+/**
+ * The keys earlier versions wrote for this payload, newest first.
+ *
+ * The v1 key was the raw `session_id` (single shared file per session). v2
+ * joined raw session and agent on `--`. Both are readable on upgrade so a
+ * mid-session deploy does not silently re-baseline an established binding —
+ * the ambiguity in a legacy `a--b` key is resolved toward the interpretation
+ * the lookup is making, and the next write lands on the current key while the
+ * legacy file is left to age out.
+ * @param {object} payload - The hook payload
+ * @returns {string[]} Zero or more legacy keys this payload may have written
+ */
+function legacyKeys(payload) {
+  const agent = payload?.agent_id;
+  const session = payload.session_id;
+  if (typeof agent === "string" && agent) {
+    // v2 wrote the sanitised composite. v1 never wrote a per-agent file — an
+    // agent falling back to the shared session file is the #4277 bug again,
+    // so the list stops there.
+    const san = value => value.replaceAll(/[^A-Za-z0-9._-]/g, "_");
+    return [`${san(session)}--${san(agent)}`];
   }
+  // v1 and v2 both keyed the main agent on the raw session id — but only when
+  // that id contains no `--`. One that does spells exactly the composite
+  // shape agent bindings now write, so reading it could hand this session a
+  // stranger's binding. Losing the v1 binding for such an id re-baselines
+  // once; the alternative is reading a file whose owner cannot be proven.
+  return session.includes("--") ? [] : [session];
+}
+
+function readState(bindingKeyValue, payload) {
+  for (const key of [bindingKeyValue, ...legacyKeys(payload)]) {
+    try {
+      return JSON.parse(readFileSync(stateFile(key), "utf8"));
+    } catch {
+      // Not written under this key — try the next older one.
+    }
+  }
+  return null;
 }
 
 /**
@@ -552,17 +602,23 @@ function readState(sessionId) {
  * {@link noticeRuntimeDrift} and read by nobody else, and a clobbering write
  * would turn its "reported once" into "reported again after the next
  * acknowledgement", which is the noise the notice is designed not to be.
- * @param sessionId - The session whose state file this is
+ * @param bindingKeyValue - The key whose state file this is
  * @param state - Fields to write over the recorded state
+ * @param payload - The hook payload, for legacy-key reads while a binding is
+ *   migrating to the current key format
  * @returns Whether the write succeeded
  */
-function writeState(sessionId, state) {
-  const file = stateFile(sessionId);
+function writeState(bindingKeyValue, state, payload) {
+  const file = stateFile(bindingKeyValue);
   try {
     mkdirSync(dirname(file), { recursive: true });
     writeFileSync(
       file,
-      `${JSON.stringify({ ...readState(sessionId), ...state }, null, 2)}\n`
+      `${JSON.stringify(
+        { ...readState(bindingKeyValue, payload), ...state },
+        null,
+        2
+      )}\n`
     );
     return true;
   } catch (error) {
@@ -637,19 +693,24 @@ function claimedRoot(toolInput, cwd) {
  *
  * Returns nothing on purpose, like its sibling below: SessionStart has no call
  * to refuse, so every path through it allows.
- * @param sessionId - The session this baseline belongs to
+ * @param bindingKeyValue - The key this baseline belongs to
  * @param observed - The worktree root the session started in
+ * @param payload - The hook payload, for legacy-key reads
  */
-function recordBaseline(sessionId, observed) {
+function recordBaseline(bindingKeyValue, observed, payload) {
   // Never overwrite. A resumed session, a reconnect, or anything else that
   // fires the event twice must not be able to launder a displaced binding into
   // a fresh baseline — which is the whole failure this exists to close.
-  if (readState(sessionId)?.boundRoot) return;
-  writeState(sessionId, {
-    boundRoot: observed,
-    claimedRoot: null,
-    updatedAt: new Date().toISOString(),
-  });
+  if (readState(bindingKeyValue, payload)?.boundRoot) return;
+  writeState(
+    bindingKeyValue,
+    {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    },
+    payload
+  );
 }
 
 /**
@@ -663,12 +724,16 @@ function recordBaseline(sessionId, observed) {
 function recordClaim(payload, observed) {
   const claimed = claimedRoot(payload.tool_input, payload.cwd);
   if (!claimed || claimed === observed) return;
-  const previous = readState(bindingKey(payload));
-  writeState(bindingKey(payload), {
-    boundRoot: previous?.boundRoot ?? observed,
-    claimedRoot: claimed,
-    updatedAt: new Date().toISOString(),
-  });
+  const previous = readState(bindingKey(payload), payload);
+  writeState(
+    bindingKey(payload),
+    {
+      boundRoot: previous?.boundRoot ?? observed,
+      claimedRoot: claimed,
+      updatedAt: new Date().toISOString(),
+    },
+    payload
+  );
 }
 
 function refuse(lines) {
@@ -704,11 +769,15 @@ function handleAcceptance(payload, observed) {
       acceptanceLine(observed),
     ]);
   }
-  writeState(bindingKey(payload), {
-    boundRoot: observed,
-    claimedRoot: null,
-    updatedAt: new Date().toISOString(),
-  });
+  writeState(
+    bindingKey(payload),
+    {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    },
+    payload
+  );
   say(`bound to ${observed}`);
   return 0;
 }
@@ -880,15 +949,16 @@ function driftNotice(version) {
  * Never refuses. The dependency is a reporting gap, not a live displacement,
  * and blocking a session over a version number would be a wall where an
  * observation belongs.
- * @param sessionId - The session being started
+ * @param bindingKeyValue - The key being started
  * @param env - Environment to read the runtime version from
+ * @param payload - The hook payload, for legacy-key reads
  * @returns Nothing; every path through this allows
  */
-function noticeRuntimeDrift(sessionId, env) {
+function noticeRuntimeDrift(bindingKeyValue, env, payload) {
   const version = runtimeVersion(env);
   if (version === null || version === VERIFIED_RUNTIME_VERSION) return;
-  if (readState(sessionId)?.runtimeNoticed === version) return;
-  writeState(sessionId, { runtimeNoticed: version });
+  if (readState(bindingKeyValue, payload)?.runtimeNoticed === version) return;
+  writeState(bindingKeyValue, { runtimeNoticed: version }, payload);
   process.stdout.write(
     `${JSON.stringify({
       hookSpecificOutput: {
@@ -911,11 +981,11 @@ function evaluate(payload) {
   if (!observed) return 0;
 
   if (payload.hook_event_name === "SessionStart") {
-    recordBaseline(binding, observed);
+    recordBaseline(binding, observed, payload);
     // After the baseline, never before: `recordBaseline` writes a fresh state
     // for a session it has not seen, and the notice's record has to go on top
     // of that write rather than under it.
-    noticeRuntimeDrift(binding, process.env);
+    noticeRuntimeDrift(binding, process.env, payload);
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {
@@ -927,7 +997,7 @@ function evaluate(payload) {
   const accepted = handleAcceptance(payload, observed);
   if (accepted !== null) return accepted;
 
-  const state = readState(binding);
+  const state = readState(binding, payload);
   if (!state?.boundRoot) {
     // No baseline means SessionStart did not run for this session — an older
     // install, a runtime that fires no such event, a harness that skips it.
@@ -936,22 +1006,30 @@ function evaluate(payload) {
     // refusing. Treating it as a refusal would turn a floor into a wall on
     // every surface where the event does not fire, and a wall gets switched
     // off, which costs the whole guard.
-    writeState(binding, {
-      boundRoot: observed,
-      claimedRoot: null,
-      updatedAt: new Date().toISOString(),
-    });
+    writeState(
+      binding,
+      {
+        boundRoot: observed,
+        claimedRoot: null,
+        updatedAt: new Date().toISOString(),
+      },
+      payload
+    );
     return 0;
   }
   if (state.claimedRoot && state.claimedRoot !== observed) {
     return unconfirmedSwitch(state.claimedRoot, observed);
   }
   if (state.claimedRoot === observed) {
-    writeState(binding, {
-      boundRoot: observed,
-      claimedRoot: null,
-      updatedAt: new Date().toISOString(),
-    });
+    writeState(
+      binding,
+      {
+        boundRoot: observed,
+        claimedRoot: null,
+        updatedAt: new Date().toISOString(),
+      },
+      payload
+    );
     return 0;
   }
   if (state.boundRoot !== observed) return displaced(state.boundRoot, observed);

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.66.2",
+  "version": "4.66.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"