@codyswann/lisa 4.68.1 → 4.69.1

package/dist/opencode/plugin-templates/lisa-session-bootstrap.ts

@@ -6,8 +6,9 @@
  *   - install-pkgs.sh   → install dependencies when node_modules is missing
  *   - setup-jira-cli.sh → write jira-cli config from environment variables, only
  *     when the project's configured tracker is jira
+ *   - auto-update.sh    → update the project to the latest Lisa (autoUpdate)
  *
- * Both are fully fail-open (wrapped in try/catch) so a package-manager or
+ * All are fully fail-open (wrapped in try/catch) so a package-manager or
  * filesystem hiccup never bricks OpenCode startup, mirroring the Codex scripts.
  * install only runs on the first session of a fresh checkout (node_modules
  * absent), so the common case is a cheap no-op.
@@ -61,6 +62,45 @@ export const LisaSessionBootstrap = async ({
     // fail open — never block startup on a dependency-install error
   }
 
+  // auto-update: the same engine as the Claude/Codex/Cursor/Copilot SessionStart
+  // hook (CodySwannGT/lisa#4337), run from the project's installed Lisa package,
+  // which ships `plugins/lisa/hooks/`. It is not a guard, so it is not staged
+  // beside this plugin; running it from node_modules is safe even though it
+  // rewrites node_modules, because Node has loaded it before anything changes.
+  // It runs after install so it sees the installed version, honours
+  // `autoUpdate: false`, only touches a clean tree, and reports what it did.
+  // OpenCode has no context-injection channel here, so the report goes to the
+  // console the session shows.
+  try {
+    const engine = `${root}/node_modules/@codyswann/lisa/plugins/lisa/hooks/auto-update.mjs`;
+    if (existsSync(engine) && !Bun.which("node")) {
+      console.error(
+        "lisa-auto-update: node is not on PATH, so the session-start Lisa update could not run. Install Node.js (or add it to PATH) to enable it."
+      );
+    } else if (existsSync(engine)) {
+      const result = await $`node ${engine} --project-dir ${root}`
+        .cwd(root)
+        .quiet()
+        .nothrow();
+      const text = String(result.stdout ?? "").trim();
+      if (text) {
+        const context = JSON.parse(text)?.hookSpecificOutput?.additionalContext;
+        if (context) console.error(context);
+      }
+    } else if (
+      existsSync(`${root}/node_modules/@codyswann/lisa/package.json`)
+    ) {
+      // This plugin is only written by an apply of a Lisa that ships the
+      // engine, so an installed Lisa without it means node_modules is older
+      // than the project's own files. Say so rather than skipping silently.
+      console.error(
+        "lisa-auto-update: the installed @codyswann/lisa predates this project's Lisa files, so the session-start update could not run. Run your package install to bring node_modules up to date."
+      );
+    }
+  } catch {
+    // fail open — a session must start even when the update cannot run
+  }
+
   // setup-jira-cli: write jira-cli config from environment variables and non-secret Lisa config.
   // Gated on `tracker: "jira"` — a project on Linear or GitHub Issues has no use
   // for a jira-cli config, and writing one made a false implicit claim about the

package/expo/create-only/.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       skip_jobs: 'test:e2e,playwright_e2e'
       # Forward SE-4551 / SE-4552 inputs. `|| fromJSON('...')` falls back to
@@ -82,7 +82,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
 
   zap:
@@ -98,5 +98,5 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'

package/expo/create-only/.github/workflows/deploy.yml

@@ -114,7 +114,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).
@@ -142,7 +142,7 @@ jobs:
       approval_environment: ${{ needs.determine_environment.outputs.approval_environment }}
       require_signatures: false
       generate_sbom: true
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       override_blackout: true
       emergency_release: false
@@ -330,7 +330,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           package-manager-cache: false
-          node-version: '22.21.1'
+          node-version: '22.23.3'
       - name: 🍞 Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
@@ -424,7 +424,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).

package/expo/create-only/.github/workflows/nightly-e2e-bypass-reaper.yml

@@ -93,7 +93,7 @@ jobs:
         uses: actions/setup-node@v6
         with:
           package-manager-cache: false
-          node-version: '22'
+          node-version: '22.23.3'
 
       - name: 🔎 Locate the guard
         id: guard

package/expo/create-only/.github/workflows/playwright-e2e.yml

@@ -137,7 +137,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       # The moment this workflow's cadence corresponds to. It is what makes the
       # `.lisa.config.json` declaration above readable from here — a gate

package/expo/create-only/eas.json

@@ -5,7 +5,7 @@
   },
   "build": {
     "base": {
-      "node": "22.21.1",
+      "node": "22.23.3",
       "resourceClass": "large",
       "env": {
         "NODE_OPTIONS": "--max-old-space-size=4096",

package/harper-fabric/copy-overwrite/.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       skip_jobs: ''
     secrets:

package/harper-fabric/create-only/.github/workflows/deploy.yml

@@ -41,7 +41,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ github.ref_name }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).
@@ -64,7 +64,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22.21.1'
+          node-version: '22.23.3'
           package-manager-cache: false
 
       - name: Setup Bun
@@ -132,7 +132,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: post-deploy:${{ github.ref_name }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).

package/harper-fabric/create-only/.github/workflows/zap-baseline.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22.21.1'
+          node-version: '22.23.3'
           package-manager-cache: false
 
       - name: Setup Bun

package/harper-fabric/package-lisa/package.lisa.json

@@ -38,7 +38,7 @@
       "@eslint/eslintrc": "^3.2.0",
       "@eslint/js": "^9.39.0",
       "@types/node": "^22.0.0",
-      "@vitest/coverage-v8": "^4.1.0",
+      "@vitest/coverage-v8": "^4.1.11",
       "eslint": "^9.39.0",
       "eslint-config-prettier": "^10.0.0",
       "eslint-import-resolver-typescript": "^4.4.4",
@@ -58,14 +58,14 @@
       "tsx": "^4.20.6",
       "typescript": "^6.0.3",
       "uuid": "^13.0.0",
-      "vitest": "^4.1.0"
+      "vitest": "^4.1.11"
     },
     "engines": {
       "npm": "please-use-bun",
       "yarn": "please-use-bun",
       "pnpm": "please-use-bun",
       "bun": ">= 1.3.11",
-      "node": ">= 22.21.1"
+      "node": ">= 22.23.3"
     },
     "packageManager": "bun@1.3.11",
     "private": true

package/nestjs/create-only/.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       skip_jobs: 'test:e2e,playwright_e2e'
     secrets:
@@ -56,5 +56,5 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'

package/nestjs/create-only/.github/workflows/deploy.yml

@@ -110,7 +110,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: pre-deploy:${{ needs.determine_environment.outputs.environment }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).
@@ -139,7 +139,7 @@ jobs:
       require_approval: ${{ needs.determine_environment.outputs.require_approval == 'true' }}
       approval_environment: ${{ needs.determine_environment.outputs.approval_environment }}
       require_signatures: false
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     secrets:
       DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
@@ -306,10 +306,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
-      - name: Use Node.js 22.21.1
+      - name: Use Node.js 22.23.3
         uses: actions/setup-node@v6
         with:
-          node-version: 22.21.1
+          node-version: 22.23.3
           package-manager-cache: false
       - uses: noliran/branch-based-secrets@ef9182f16f118c7c3d05c36973546ebc990b8c69 # v1 (2020-10-09, no semver tag)
         with:
@@ -462,7 +462,7 @@ jobs:
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
       moment: post-deploy:${{ needs.determine_environment.outputs.environment }}
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
     # No `secrets:` key: gates.yml declares none in its `workflow_call`, so
     # passing any grants everything to a callee that reads nothing (#3065).

package/nestjs/package-lisa/package.lisa.json

@@ -97,9 +97,9 @@
       "serverless": "^4.30.0",
       "serverless-esbuild": "^1.57.0",
       "serverless-offline": "^14.4.0",
-      "vite": "^8.0.16",
-      "vitest": "^4.1.0",
-      "@vitest/coverage-v8": "^4.1.0",
+      "vite": "^8.3.2",
+      "vitest": "^4.1.11",
+      "@vitest/coverage-v8": "^4.1.11",
       "eslint-plugin-oxlint": "^1.62.0",
       "oxlint": "^1.62.0",
       "oxlint-tsgolint": "^0.24.0",

package/npm-package/package-lisa/package.lisa.json

@@ -14,9 +14,9 @@
       "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest"
     },
     "devDependencies": {
-      "vite": "^8.0.16",
-      "vitest": "^4.1.0",
-      "@vitest/coverage-v8": "^4.1.0"
+      "vite": "^8.3.2",
+      "vitest": "^4.1.11",
+      "@vitest/coverage-v8": "^4.1.11"
     },
     "overrides": {
       "vite": "$vite"

package/package.json

@@ -109,7 +109,7 @@
     "yarn": "please-use-bun",
     "pnpm": "please-use-bun",
     "bun": "1.3.8",
-    "node": "22.21.1"
+    "node": "22.23.3"
   },
   "workspaces": [
     "eslint-plugin-code-organization",
@@ -146,7 +146,7 @@
   ],
   "resolutions": {
     "@isaacs/brace-expansion": "^5.0.1",
-    "axios": ">=1.15.2",
+    "axios": ">=1.20.0",
     "browserslist": ">=4.28.8",
     "deepmerge-ts": "^8.0.1",
     "esbuild": ">=0.28.1",
@@ -158,7 +158,7 @@
     "multer": ">=2.3.0",
     "nanoid": "^3.3.18",
     "postcss": ">=8.5.18",
-    "undici": "^6.28.0",
+    "undici": "^6.28.1",
     "vite": "$vite",
     "ws": ">=8.21.0",
     "zod-validation-error": "^4.0.0"
@@ -169,7 +169,7 @@
     "@istanbuljs/load-nyc-config": {
       "js-yaml": "^3.15.1"
     },
-    "axios": ">=1.15.2",
+    "axios": ">=1.20.0",
     "browserslist": ">=4.28.8",
     "deepmerge-ts": "^8.0.1",
     "esbuild": ">=0.28.1",
@@ -181,13 +181,13 @@
     "multer": ">=2.3.0",
     "nanoid": "^3.3.18",
     "postcss": ">=8.5.18",
-    "undici": "^6.28.0",
+    "undici": "^6.28.1",
     "vite": "$vite",
     "ws": ">=8.21.0",
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.68.1",
+  "version": "4.69.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -271,7 +271,7 @@
     "@types/jest": "^30.0.0",
     "@types/lodash.merge": "^4.6.0",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.11",
     "commander": "^12.0.0",
     "esbuild-register": "^3.6.0",
     "eslint": "^9.39.0",
@@ -311,7 +311,7 @@
     "tsx": "^4.0.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.0.0",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.11"
   },
   "devDependencies": {
     "@actions/expressions": "0.3.61",
@@ -328,7 +328,7 @@
     "fast-check": "^4.9.0",
     "oxlint": "^1.62.0",
     "oxlint-tsgolint": "^0.24.0",
-    "vite": "^8.0.16"
+    "vite": "^8.3.2"
   },
   "type": "module",
   "directories": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "d58ad3182285c14e174f430045b385a678a07bcd",
-  "gitHead": "d58ad3182285c14e174f430045b385a678a07bcd",
-  "lisaReleaseTag": "v4.68.1"
+  "lisaReleaseCommit": "995f533b00d9b8a60256096bf6d28940164cd893",
+  "gitHead": "995f533b00d9b8a60256096bf6d28940164cd893",
+  "lisaReleaseTag": "v4.69.1"
 }

package/phaser/copy-overwrite/.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
       # declared a break, and says NOT DETERMINED if this line goes missing
       # (CodySwannGT/lisa#3698).
       expected_workflow_contract_major: '1'
-      node_version: '22.21.1'
+      node_version: '22.23.3'
       package_manager: 'bun'
       skip_jobs: ''
       # Verification IS UAT: a feat/fix must ship a tests/e2e verification spec

package/phaser/package-lisa/package.lisa.json

@@ -31,7 +31,7 @@
       "@eslint/eslintrc": "^3.2.0",
       "@eslint/js": "^9.39.0",
       "@types/node": "^22.0.0",
-      "@vitest/coverage-v8": "^4.1.0",
+      "@vitest/coverage-v8": "^4.1.11",
       "eslint": "^9.39.0",
       "eslint-config-prettier": "^10.0.0",
       "eslint-import-resolver-typescript": "^4.4.4",
@@ -50,14 +50,14 @@
       "prettier": "^3.3.3",
       "tsx": "^4.20.6",
       "typescript": "^6.0.3",
-      "vitest": "^4.1.0"
+      "vitest": "^4.1.11"
     },
     "engines": {
       "npm": "please-use-bun",
       "yarn": "please-use-bun",
       "pnpm": "please-use-bun",
       "bun": ">= 1.3.11",
-      "node": ">= 22.21.1"
+      "node": ">= 22.23.3"
     },
     "packageManager": "bun@1.3.11",
     "private": true,
@@ -102,7 +102,7 @@
       "phaser": "^4.2.0"
     },
     "devDependencies": {
-      "vite": "^8.0.16",
+      "vite": "^8.3.2",
       "vite-plugin-pwa": "^1.3.0",
       "@playwright/test": "^1.56.1",
       "free-tex-packer-core": "^0.3.8",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.68.1",
+  "version": "4.69.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"
@@ -294,6 +294,16 @@
           }
         ]
       },
+      {
+        "matcher": "startup",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/auto-update.sh",
+            "timeout": 600
+          }
+        ]
+      },
       {
         "matcher": "",
         "hooks": [

package/plugins/lisa/.codex-plugin/hooks.json

@@ -216,6 +216,16 @@
           }
         ]
       },
+      {
+        "matcher": "startup",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/auto-update.sh",
+            "timeout": 600
+          }
+        ]
+      },
       {
         "matcher": "",
         "hooks": [

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.68.1",
+  "version": "4.69.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"