@codyswann/lisa 4.71.7 → 4.71.9

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.7",
+  "version": "4.71.9",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.7",
+  "version": "4.71.9",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.71.7",
+  "version": "4.71.9",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/materialized-artifacts.json

@@ -1,4 +1,5 @@
 [
+  "all/copy-overwrite/scripts/check-threshold-ratchet.mjs",
   "all/copy-overwrite/scripts/lib/bounded-spawn.mjs",
   "all/copy-overwrite/scripts/lib/invoked-as-script.mjs",
   "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh",
@@ -14,6 +15,8 @@
   "all/copy-overwrite/scripts/lisa-hooks/sonar-secrets.sh",
   "all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.mjs",
   "all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.sh",
+  "all/copy-overwrite/scripts/threshold-ratchet-compare.mjs",
+  "all/copy-overwrite/scripts/threshold-ratchet-families.mjs",
   "expo/copy-overwrite/scripts/lib/bounded-spawn.mjs",
   "expo/copy-overwrite/scripts/lib/invoked-as-script.mjs",
   "plugins/lisa/hooks/block-blind-automerge.sh",

package/plugins/src/base/hooks/threshold-ratchet-compare.mjs

@@ -296,8 +296,8 @@ function compareLighthouse(relPath, base, current) {
       current?.ci?.assert?.assertions != null) &&
     (previous == null ||
       (typeof previous === "number" && Number.isFinite(previous))) &&
-    typeof added === "number" &&
-    Number.isFinite(added)
+    (added == null || (typeof added === "number" && Number.isFinite(added))) &&
+    !(previous == null && added == null)
   ) {
     // This checker reads top-level settings even beside canonical assertions.
     // Keep its comparison separate so a new setting cannot replace a canonical
@@ -307,7 +307,7 @@ function compareLighthouse(relPath, base, current) {
       ...compareConstraints(
         relPath,
         new Map([[key, { value: previous ?? 100, direction: "max" }]]),
-        new Map([[key, { value: added, direction: "max" }]])
+        new Map([[key, { value: added ?? 100, direction: "max" }]])
       )
     );
   }

package/plugins/src/base/hooks/threshold-ratchet.mjs

@@ -517,7 +517,7 @@ function main() {
   process.stderr.write(
     "usage: threshold-ratchet.mjs --hook | --staged | --base <ref> [--head <ref>]\n"
   );
-  return 0;
+  return 2;
 }
 
 /**

package/rails/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -520,7 +520,7 @@ function main() {
   process.stderr.write(
     "usage: threshold-ratchet.mjs --hook | --staged | --base <ref> [--head <ref>]\n"
   );
-  return 0;
+  return 2;
 }
 
 /**

package/rails/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -299,8 +299,8 @@ function compareLighthouse(relPath, base, current) {
       current?.ci?.assert?.assertions != null) &&
     (previous == null ||
       (typeof previous === "number" && Number.isFinite(previous))) &&
-    typeof added === "number" &&
-    Number.isFinite(added)
+    (added == null || (typeof added === "number" && Number.isFinite(added))) &&
+    !(previous == null && added == null)
   ) {
     // This checker reads top-level settings even beside canonical assertions.
     // Keep its comparison separate so a new setting cannot replace a canonical
@@ -310,7 +310,7 @@ function compareLighthouse(relPath, base, current) {
       ...compareConstraints(
         relPath,
         new Map([[key, { value: previous ?? 100, direction: "max" }]]),
-        new Map([[key, { value: added, direction: "max" }]])
+        new Map([[key, { value: added ?? 100, direction: "max" }]])
       )
     );
   }

package/scripts/build-plugins.sh

@@ -138,11 +138,12 @@ build_plugin base lisa
 # copies here so they can never drift; a unit test asserts byte-equality.
 if [ -f "$SRC_DIR/base/hooks/threshold-ratchet.mjs" ]; then
   for ratchet_scripts_dir in \
+    "$ROOT_DIR/all/copy-overwrite/scripts" \
     "$ROOT_DIR/typescript/copy-overwrite/scripts" \
     "$ROOT_DIR/rails/copy-overwrite/scripts"; do
     mkdir -p "$ratchet_scripts_dir"
     # The entry point takes the template check-* naming; its relative imports
-    # (threshold-ratchet-*.mjs) keep their canonical names in both trees.
+    # (threshold-ratchet-*.mjs) keep their canonical names in all three trees.
     materialize "$SRC_DIR/base/hooks/threshold-ratchet.mjs" \
       "$ratchet_scripts_dir/check-threshold-ratchet.mjs"
     for ratchet_module in threshold-ratchet-families threshold-ratchet-compare; do

package/scripts/generate-scratch-supervisor-profile.mjs

@@ -63,7 +63,7 @@ if (invokedAsScript(import.meta.url)) {
   const rendered = renderScratchProfile(
     current,
     readFileSync(
-      path.join(root, "rails/copy-overwrite/scripts/lisa-scratch-run.sh")
+      path.join(root, "all/copy-overwrite/scripts/lisa-scratch-run.sh")
     )
   );
   if (process.argv.includes("--check")) {

package/scripts/install-claude-plugins.sh

@@ -580,16 +580,20 @@ done
 
 # Retire third-party plugins Lisa no longer curates. The base lisa plugin
 # bundles the Sentry MCP server (plugins/src/base/.mcp.json) for every agent
-# runtime, so the upstream sentry plugin registered the same server twice in
-# each Claude session (issue #1955). Likewise, the Lisa-native
+# runtime. The official Claude plugin remains disabled by default to avoid
+# duplicate registration (#1955), but an explicit host choice enables its own
+# maintained skills and must survive sync (#4318). Likewise, the Lisa-native
 # parity-safety-net.sh hook screens every Bash command, so the upstream
 # safety-net plugin double-screened each command; its material guards were
-# absorbed into the Lisa hook (issue #1960). The merge settings templates flip
-# both enabledPlugins entries to false; this removes the installs themselves.
+# absorbed into the Lisa hook (issue #1960). Remove unchosen retired installs.
 # Version-gated like the other one-time heals so same-version runs don't spawn
 # the CLI.
 if [ "$FORCE_PLUGIN_SYNC" = "true" ]; then
   for retired_plugin in "sentry@claude-plugins-official" "safety-net@cc-marketplace"; do
+    if [ "$retired_plugin" = "sentry@claude-plugins-official" ] &&
+       node -e 'try { const s = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8")); process.exit(s.enabledPlugins?.["sentry@claude-plugins-official"] === true ? 0 : 1); } catch { process.exit(1); }' "$SETTINGS_FILE"; then
+      continue
+    fi
     claude plugin uninstall "$retired_plugin" --scope project </dev/null >/dev/null 2>&1 || true
   done
 fi

package/scripts/two-channel-couplings.json

@@ -105,7 +105,7 @@
     "workflows": 25,
     "steps": 798,
     "couplings": 35,
-    "inventory": 164
+    "inventory": 166
   },
   "counts": {
     "package-backed": 10,
@@ -400,10 +400,11 @@
       "decision": "warranted",
       "reason": "Verdict-bearing required gate: it compares committed thresholds against measured coverage and posts a red check. A copy predating a threshold-semantics change enforces the old comparison and its red is believed — the precise harm CodySwannGT/lisa#3477 measured on the work-item gate. The artifact exports no contract version yet, so closing this needs the artifact half authored first; recorded as an open obligation rather than exempted.",
       "lanes": [
+        "all/copy-overwrite",
         "rails/copy-overwrite",
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite, rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-mutation.sh",
@@ -425,9 +426,9 @@
       "decision": "not-needed",
       "reason": "A runner, not a judge. The gate's verdict is mutant's exit code, and what it runs is read from the project's own `mutation.gate.yml` and `.mutant.yml`; this script's own logic decides whether the gate is enabled and what ref to diff against, both of which come from configuration it does not own. A superseded copy runs the wrong subjects loudly rather than returning a wrong verdict quietly.",
       "lanes": [
-        "rails/copy-contents"
+        "all/copy-contents"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-mutation.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-contents). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-mutation.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-contents). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-scratch-run.sh",
@@ -449,9 +450,9 @@
       "decision": "not-needed",
       "reason": "A supervisor that hosts a verdict rather than computing one: it owns run-scoped scratch and cleanup around whatever it wraps. Nothing it does can turn a passing suite red or a failing one green — a superseded copy misplaces or fails to reap a scratch directory, which surfaces as its own visible failure rather than as a believed verdict.",
       "lanes": [
-        "rails/copy-overwrite"
+        "all/copy-overwrite"
       ],
-      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-scratch-run.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
+      "detail": "`quality-rails.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/lisa-scratch-run.sh` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. The read sits behind an existence test, which is ALL this scan examined of the step's control flow: it did not read the test's other branch, any fallback, any explicit `exit`, or any verification of the step's output. Whether an absent path skips quietly, falls back, or fails loudly is therefore NOT MEASURED — read the step before concluding it proves nothing. The shape worth ruling out is the silent one, where a skip posts no context and an absent required context is not a red one. The step's text does carry `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `existence-only`. An existence test and no version probe: this coupling can see that the artifact is MISSING and cannot see that it is OLD. A present copy of any vintage runs, and its verdict is believed. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality-rails.yml::scripts/lisa-work-item.mjs",
@@ -576,10 +577,11 @@
       "decision": "warranted",
       "reason": "Verdict-bearing required gate, the same artifact and the same exposure as the `quality-rails.yml` entry: a copy predating a threshold-semantics change enforces the old comparison and its red is believed. Closing it once closes both couplings, since they read the same script down two stack lanes. The artifact exports no contract version yet; recorded as an open obligation rather than exempted.",
       "lanes": [
+        "all/copy-overwrite",
         "rails/copy-overwrite",
         "typescript/copy-overwrite"
       ],
-      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
+      "detail": "`quality.yml` is delivered at `@main`, so this step is live in every consumer on their next run. It reads `scripts/check-threshold-ratchet.mjs` from the CALLER's tree with no package-relative candidate, and Lisa delivers that path on the `lisa apply` channel (all/copy-overwrite, rails/copy-overwrite, typescript/copy-overwrite). The two halves land in the wrong order: this step is live everywhere immediately, the file it needs is live only where somebody applied. No existence test guards the read, which is ALL this scan examined of the step's control flow: it did not read anything that could absorb the failure. An absent path most likely fails the job loudly — the better of the two failures, because it is visible — but that is inferred from the missing guard, NOT MEASURED. The step's text does carry `else-branch`, `exit-zero`, `exit-nonzero`, `error-annotation` — located in the step, deliberately NOT related to this read, and enough to make \"it skips silently\" a claim to check rather than assume. STALENESS (a separate dimension from the delivery verdict above): `no-probe`. Neither an existence test nor a version probe bears on this read, so nothing here distinguishes a current artifact from an absent or a superseded one. Tokens found: `workflow-requests-version`. `workflow-requests-version` is workflow-scoped — it does not say THIS step asks."
     },
     {
       "key": "quality.yml::scripts/check-verification-coverage.mjs",

package/typescript/copy-overwrite/scripts/check-threshold-ratchet.mjs

@@ -520,7 +520,7 @@ function main() {
   process.stderr.write(
     "usage: threshold-ratchet.mjs --hook | --staged | --base <ref> [--head <ref>]\n"
   );
-  return 0;
+  return 2;
 }
 
 /**

package/typescript/copy-overwrite/scripts/threshold-ratchet-compare.mjs

@@ -299,8 +299,8 @@ function compareLighthouse(relPath, base, current) {
       current?.ci?.assert?.assertions != null) &&
     (previous == null ||
       (typeof previous === "number" && Number.isFinite(previous))) &&
-    typeof added === "number" &&
-    Number.isFinite(added)
+    (added == null || (typeof added === "number" && Number.isFinite(added))) &&
+    !(previous == null && added == null)
   ) {
     // This checker reads top-level settings even beside canonical assertions.
     // Keep its comparison separate so a new setting cannot replace a canonical
@@ -310,7 +310,7 @@ function compareLighthouse(relPath, base, current) {
       ...compareConstraints(
         relPath,
         new Map([[key, { value: previous ?? 100, direction: "max" }]]),
-        new Map([[key, { value: added, direction: "max" }]])
+        new Map([[key, { value: added ?? 100, direction: "max" }]])
       )
     );
   }