@codyswann/lisa 4.68.1 → 4.69.1

package/plugins/src/base/hooks/auto-update.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# SessionStart: keep the project on the latest Lisa, locally
+# (CodySwannGT/lisa#4337). `autoUpdate` in .lisa.config.json defaults to on;
+# `false` opts out.
+#
+# All the work lives in the sibling `.mjs`, which is unit-tested. This wrapper
+# only resolves the project root and hands off — the same division
+# `enforcement-vintage.sh` beside it makes.
+#
+# FAIL SOFT, ALWAYS. Every exit is 0: a session must start even when the update
+# cannot run, and the `.mjs` reports what it could not do in the context.
+set -uo pipefail
+
+cat >/dev/null 2>&1 || true
+
+ROOT="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}}"
+RUNNER="$ROOT/hooks/auto-update.mjs"
+
+[ -f "$RUNNER" ] || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+# CLAUDE_PROJECT_DIR is the harness's own declaration of the root; the git
+# toplevel is the fallback, because the manifest and node_modules this updates
+# live at the repository root, not at whatever directory the session opened in.
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
+if [ -z "${PROJECT_DIR}" ] || [ ! -d "${PROJECT_DIR}" ]; then
+  PROJECT_DIR="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+fi
+
+node "$RUNNER" --project-dir "$PROJECT_DIR" || true
+exit 0

package/plugins/src/base/hooks/enforcement-vintage-npm.mjs

@@ -259,8 +259,8 @@ export function renderNpmRows(state) {
   const guidance = state.projectBehind
     ? [
         `PROJECT BEHIND — this project installs lisa ${state.pin?.version} while lisa ${state.latest?.version} is published.`,
-        "- Do NOT upgrade Lisa inside the current task: a version bump plus its template apply belongs in its own pull request, never mixed into feature work.",
-        "- Check for an open pull request on a `lisa/update-*` branch. If none is open, the project's Lisa Update workflow (`.github/workflows/lisa-update.yml`) opens one on its schedule; say so in your report, and if that workflow is missing, recommend running `lisa apply` once so the project receives it.",
+        "- Do NOT upgrade Lisa by hand inside the current task. The session-start auto-update applies it on a clean tree as its own commit; see the lisa-auto-update block for what it did this session.",
+        '- If it did not run (autoUpdate is false, the tree was dirty, or it failed), say so in your report; the update happens at the start of the next session on a clean tree, or with "autoUpdate" left on.',
       ]
     : [];
   return { rows, guidance };

package/scripts/lib/per-agent-hook-filter.mjs

@@ -170,6 +170,19 @@ const SCRIPT_RULES = {
     agy: false,
     copilot: true,
   },
+  // Session-start local Lisa update (CodySwannGT/lisa#4337). Every harness with
+  // a session-start event gets it; OpenCode runs the same engine from its
+  // session bootstrap plugin. Documented gap: agy has no SessionStart event, so
+  // agy sessions never auto-update — the project still updates the next time a
+  // session on any other harness starts in it, and `lisa doctor` reports a
+  // stale install on every agent.
+  "auto-update.sh": {
+    claude: true,
+    codex: true,
+    cursor: true,
+    agy: false,
+    copilot: true,
+  },
   "inject-flow-context.sh": {
     claude: true,
     codex: true,

package/scripts/two-channel-couplings.json

@@ -97,7 +97,7 @@
     "workflows": 23,
     "steps": 784,
     "couplings": 33,
-    "inventory": 91
+    "inventory": 90
   },
   "counts": {
     "package-backed": 10,

package/scripts/update-node-version.ts

@@ -15,6 +15,7 @@
  * bun scripts/update-node-version.ts
  * ```
  */
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 
@@ -35,17 +36,21 @@ interface ReplacementPattern {
 }
 
 const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
-  // node_version: '22.21.1' (workflow input defaults)
+  // Include reusable-workflow defaults and expression fallbacks as well as
+  // ordinary callers. Only Node-shaped keys are rewritten.
   {
-    pattern: /(node_version:\s*['"])[\d.]+(['"])/g,
+    pattern: /((?:node_version|node-version):\s*['"]?)\d+\.\d+\.\d+(['"]?)/g,
     replacement: VERSION_REPLACEMENT,
   },
-  // node-version: '22.21.1' (actions/setup-node)
   {
-    pattern: /(node-version:\s*['"])[\d.]+(['"])/g,
+    pattern:
+      /(node_version:\n(?: +(?:description|type|required):[^\n]*\n)* +default: *['"])\d+\.\d+\.\d+(['"])/g,
+    replacement: VERSION_REPLACEMENT,
+  },
+  {
+    pattern: /(node-version:.*?\|\|\s*['"])\d+\.\d+\.\d+(['"])/g,
     replacement: VERSION_REPLACEMENT,
   },
-  // node-version: '22.x' (major version pattern)
   {
     pattern: /(node-version:\s*['"])\d+\.x(['"])/g,
     replacement: "$1{{major}}.x$2",
@@ -53,43 +58,39 @@ const WORKFLOW_PATTERNS: readonly ReplacementPattern[] = [
 ];
 
 const PACKAGE_JSON_PATTERN: ReplacementPattern = {
-  pattern: /("node":\s*["'])[\d.]+(["'])/g,
+  pattern: /("node":\s*["'](?:>=\s*)?)\d+\.\d+\.\d+(["'])/g,
   replacement: VERSION_REPLACEMENT,
 };
 
 /**
- * Files to update (relative to project root)
+ * Current tracked runtime surfaces, rather than the removed merge/workflow
+ * paths used by the original updater. Historical plans and test fixtures are
+ * deliberately excluded. Adding a shipped stack workflow needs no list edit.
+ * @returns Existing repository-relative files governed by shared Node policy
  */
-const FILES_TO_UPDATE: readonly string[] = [
-  // This project's workflows
-  ".github/workflows/ci.yml",
-  ".github/workflows/quality.yml",
-  ".github/workflows/publish-to-npm.yml",
-
-  // TypeScript template workflows
-  "typescript/copy-overwrite/.github/workflows/quality.yml",
-  "typescript/copy-overwrite/.github/workflows/release.yml",
-  "typescript/copy-overwrite/.github/workflows/create-github-issue-on-failure.yml",
-  "typescript/copy-overwrite/.github/workflows/create-jira-issue-on-failure.yml",
-  "typescript/copy-overwrite/.github/workflows/create-sentry-issue-on-failure.yml",
-  "typescript/merge/package.json",
-
-  // Expo template workflows
-  "expo/copy-overwrite/.github/workflows/ci.yml",
-  "expo/copy-overwrite/.github/workflows/deploy.yml",
-  "expo/copy-overwrite/.github/workflows/build.yml",
-  "expo/copy-overwrite/.github/workflows/lighthouse.yml",
-
-  // NestJS template workflows
-  "nestjs/copy-overwrite/.github/workflows/ci.yml",
-  "nestjs/copy-overwrite/.github/workflows/deploy.yml",
-
-  // CDK template workflows
-  "cdk/copy-overwrite/workflows/ci.yml",
-
-  // npm-package template workflows
-  "npm-package/copy-overwrite/.github/workflows/publish-to-npm.yml",
-];
+function filesToUpdate(): readonly string[] {
+  return execFileSync("git", ["ls-files", "-z"], {
+    cwd: PROJECT_ROOT,
+    encoding: "utf8",
+  })
+    .split("\0")
+    .filter(
+      file =>
+        [
+          "package.json",
+          "package.lisa.json",
+          "typescript/copy-overwrite/.nvmrc",
+          "expo/create-only/eas.json",
+        ].includes(file) ||
+        /^(?:typescript|cdk|nestjs|npm-package|phaser|harper-fabric)\/package-lisa\/package\.lisa\.json$/.test(
+          file
+        ) ||
+        /^\.github\/workflows\/[^/]+\.ya?ml$/.test(file) ||
+        /^(?:all|typescript|cdk|expo|nestjs|npm-package|phaser|harper-fabric)\/(?:copy-overwrite|create-only)\/\.github\/workflows\/[^/]+\.ya?ml$/.test(
+          file
+        )
+    );
+}
 
 /**
  * Reads the Node.js version from .nvmrc
@@ -100,7 +101,7 @@ function readNvmrcVersion(): string {
 
   if (!/^\d+\.\d+\.\d+$/.test(content)) {
     throw new Error(
-      `Invalid version format in .nvmrc: "${content}". Expected semver (e.g., 22.21.1)`
+      `Invalid version format in .nvmrc: "${content}". Expected semver (e.g., 22.23.3)`
     );
   }
 
@@ -133,9 +134,16 @@ function updateFile(
   let content = originalContent;
   let totalChanges = 0;
 
-  const patterns = filePath.endsWith(".json")
-    ? [PACKAGE_JSON_PATTERN]
-    : WORKFLOW_PATTERNS;
+  if (filePath.endsWith(".nvmrc")) {
+    content = `${version}\n`;
+    totalChanges = Number(content !== originalContent);
+  }
+
+  const patterns = filePath.endsWith(".nvmrc")
+    ? []
+    : filePath.endsWith(".json")
+      ? [PACKAGE_JSON_PATTERN]
+      : WORKFLOW_PATTERNS;
 
   patterns.forEach(({ pattern, replacement }) => {
     const resolvedReplacement = replacement
@@ -179,7 +187,7 @@ function main(): void {
   let filesUpdated = 0;
   let totalChanges = 0;
 
-  FILES_TO_UPDATE.forEach(file => {
+  filesToUpdate().forEach(file => {
     const result = updateFile(file, version, majorVersion);
     if (result.updated) {
       filesUpdated++;
@@ -193,7 +201,7 @@ function main(): void {
 
   if (filesUpdated > 0) {
     console.log(
-      "\nRemember to commit these changes and regenerate package-lock.json if needed."
+      "\nRemember to commit these changes and refresh the repository lockfile if needed."
     );
   }
 }

package/typescript/copy-overwrite/.github/GITHUB_ACTIONS.md

@@ -68,7 +68,7 @@ Runs on every pull request to validate code quality:
 **Configuration**:
 ```yaml
 # In ci.yml, modify these inputs:
-node_version: '22.21.1'
+node_version: '22.23.3'
 package_manager: 'bun'
 skip_jobs: 'test,test:integration,test:e2e'  # Comma-separated list
 ```
@@ -610,7 +610,7 @@ release.yml and create the environment in **Settings** > **Environments** first
 ```yaml
 uses: ./.github/workflows/quality.yml
 with:
-  node_version: '22.21.1'
+  node_version: '22.23.3'
   package_manager: 'bun'  # or npm, yarn
 ```
 

package/typescript/copy-overwrite/.nvmrc

@@ -1 +1 @@
-22.21.1
+22.23.3

package/typescript/copy-overwrite/.prettierignore

@@ -92,7 +92,6 @@ scripts/lisa-postinstall.mjs
 scripts/lisa-reconcile-policy.mjs
 scripts/lisa-run-gates.mjs
 scripts/lisa-schema-validate.mjs
-scripts/lisa-self-update.mjs
 scripts/lisa-test-node.mjs
 scripts/lisa-work-item.mjs
 scripts/lisa-worktree-guard.mjs

package/typescript/copy-overwrite/audit.ignore.config.json

@@ -137,12 +137,6 @@
       "id": "GHSA-j759-j44w-7fr8",
       "package": "@xmldom/xmldom",
       "reason": "XML node injection via unvalidated comment serialization. Transitive via expo > @expo/config-plugins > @expo/plist; only serializes developer-authored plist files at build/prebuild time, no runtime code path serializes attacker-controlled XML."
-    },
-    {
-      "id": "GHSA-vfj7-8cjw-p6xm",
-      "cve": "CVE-2026-93687",
-      "package": "braces",
-      "reason": "Stack-exhaustion DoS (uncaught RangeError) via deeply nested brace patterns; no patched release exists. Keep this exclusion only if no runtime code path passes attacker-supplied glob or brace patterns to braces/micromatch (dev tooling expanding repo-owned globs is unaffected)."
     }
   ]
 }

package/typescript/create-only/.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       skip_jobs: ''
     secrets:

package/typescript/create-only/.github/workflows/review-evidence.yml

@@ -190,7 +190,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           package-manager-cache: false
-          node-version: '22.21.1'
+          node-version: '22.23.3'
 
       - name: 🕵️ Refuse a required check that reviewed nothing
         id: review_evidence

package/typescript/create-only/.github/workflows/third-party-review-evidence.yml

@@ -90,7 +90,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           package-manager-cache: false
-          node-version: ${{ vars.NODE_VERSION || '22.21.1' }}
+          node-version: ${{ vars.NODE_VERSION || '22.23.3' }}
 
       - name: 🕵️ Prove review evidence, or a posted substitute, at this head
         env:

package/typescript/package-lisa/package.lisa.json

@@ -40,26 +40,26 @@
     },
     "resolutions": {
       "@isaacs/brace-expansion": "^5.0.1",
-      "axios": ">=1.18.0",
+      "axios": ">=1.20.0",
       "esbuild": ">=0.28.1",
       "handlebars": ">=4.7.9",
       "lodash": ">=4.18.1",
       "multer": ">=2.3.0",
-      "undici": "^6.28.0",
-      "vite": ">=8.0.16",
+      "undici": "^6.28.1",
+      "vite": "^8.3.2",
       "ws": ">=8.21.0",
       "form-data": ">=4.0.6",
       "systeminformation": ">=5.31.7"
     },
     "overrides": {
       "@isaacs/brace-expansion": "^5.0.1",
-      "axios": ">=1.18.0",
+      "axios": ">=1.20.0",
       "esbuild": ">=0.28.1",
       "handlebars": ">=4.7.9",
       "lodash": ">=4.18.1",
       "multer": ">=2.3.0",
-      "undici": "^6.28.0",
-      "vite": "^8.0.16",
+      "undici": "^6.28.1",
+      "vite": "^8.3.2",
       "ws": ">=8.21.0",
       "form-data": ">=4.0.6",
       "systeminformation": ">=5.31.7"
@@ -68,12 +68,12 @@
   "defaults": {
     "devDependencies": {
       "@ast-grep/cli": "^0.40.4",
-      "@vitest/coverage-v8": "^4.1.0",
+      "@vitest/coverage-v8": "^4.1.11",
       "eslint": "^9.39.0",
       "husky": "^8.0.0",
       "prettier": "^3.3.3",
       "typescript": "^6.0.3",
-      "vitest": "^4.1.0"
+      "vitest": "^4.1.11"
     },
     "scripts": {
       "build": "node scripts/lib/worktree-dependencies.mjs && tsc",
@@ -97,7 +97,7 @@
       "yarn": "please-use-bun",
       "pnpm": "please-use-bun",
       "bun": "1.3.8",
-      "node": "22.21.1"
+      "node": "22.23.3"
     }
   },
   "merge": {

package/ui/index.html

@@ -7525,7 +7525,7 @@
                 more: [
                   "Enforced configs: eslint.config.ts, tsconfig.json, vitest.config.ts, knip.json, commitlint, Prettier, ast-grep",
                   "Seeded once: ci.yml, claude*.yml, nightly improvement workflows, eslint.config.local.ts, thresholds files",
-                  "package.json governance: lint/test/typecheck scripts forced, security overrides forced, engines bun 1.3.8 / node 22.21.1 defaulted",
+                  "package.json governance: lint/test/typecheck scripts forced, security overrides forced, engines bun 1.3.8 / node 22.23.3 defaulted",
                 ],
               },
               {
@@ -9662,7 +9662,7 @@
                 key: "node_version",
                 label: "Node version",
                 desc: "",
-                control: txt("22.21.1", { mono: true }),
+                control: txt("22.23.3", { mono: true }),
               },
               {
                 key: "verify_enforced",