@codyswann/lisa 4.74.8 → 4.75.0

package/plugins/lisa-expo-devin/skills/ops-run-local/SKILL.md

@@ -0,0 +1,169 @@
+---
+name: ops-run-local
+description: Manage the local development environment for Expo + serverless backend projects. Supports start, stop, restart, and status for the full stack or individual services.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Run Local
+
+Manage the local development environment.
+
+**Argument**: `$ARGUMENTS` — `start`, `stop`, `restart`, `status`, `start-frontend`, `start-backend` (default: `start`)
+
+## Path Convention
+
+- **Frontend**: Current project directory (`.`)
+- **Backend**: `${BACKEND_DIR:-../backend-v2}` — set `BACKEND_DIR` in `.claude/settings.local.json` if your backend is elsewhere
+
+## Prerequisites (run before any operation)
+
+1. Verify backend directory exists:
+   ```bash
+   BACKEND_DIR="${BACKEND_DIR:-../backend-v2}"
+   test -d "$BACKEND_DIR" && echo "Backend dir OK: $BACKEND_DIR" || echo "ERROR: Backend dir not found at $BACKEND_DIR — set BACKEND_DIR"
+   ```
+2. Check port availability:
+   ```bash
+   lsof -i :8081 2>/dev/null | grep LISTEN
+   lsof -i :3000 2>/dev/null | grep LISTEN
+   ```
+3. Verify bun is installed:
+   ```bash
+   which bun && bun --version
+   ```
+
+## Discovery
+
+Read the frontend `package.json` to find available start scripts (e.g., `start:local`, `start:dev`, `start:staging`). Read the backend `package.json` to find backend start scripts (e.g., `start:local`, `start:dev`).
+
+## Operations
+
+### start (full stack)
+
+Start both backend and frontend for local development.
+
+1. **Start backend** (background):
+   ```bash
+   cd "${BACKEND_DIR:-../backend-v2}" && IS_OFFLINE=true bun run start:local
+   ```
+   Run this in the background using the Bash tool with `run_in_background: true`.
+
+2. **Wait for backend** (up to 30 seconds):
+   ```bash
+   for i in $(seq 1 30); do
+     curl -sf http://localhost:3000/graphql -X POST \
+       -H "Content-Type: application/json" \
+       -d '{"query":"{ __typename }"}' > /dev/null 2>&1 && echo "Backend ready" && break
+     sleep 1
+   done
+   ```
+
+3. **Start frontend** (background):
+   ```bash
+   bun run start:local
+   ```
+   Run this in the background using the Bash tool with `run_in_background: true`.
+
+4. **Verify frontend** (up to 60 seconds — Metro bundler can be slow):
+   ```bash
+   for i in $(seq 1 60); do
+     curl -sf http://localhost:8081 > /dev/null 2>&1 && echo "Frontend ready" && break
+     sleep 1
+   done
+   ```
+
+5. Report status table.
+
+### start-frontend (frontend only, pointing at remote backend)
+
+Use when the backend is already deployed and you only need the frontend.
+
+1. ```bash
+   bun run start:dev
+   ```
+   Run in background.
+
+2. Verify:
+   ```bash
+   for i in $(seq 1 60); do
+     curl -sf http://localhost:8081 > /dev/null 2>&1 && echo "Frontend ready" && break
+     sleep 1
+   done
+   ```
+
+### start-backend (backend only)
+
+1. Check AWS credentials (discover profile from backend `package.json` scripts or remote-routine
+   `~/.aws/config`):
+   ```bash
+   aws sts get-caller-identity --profile {aws-profile} 2>/dev/null
+   ```
+   If this is an interactive local session and credentials are expired, refresh the backend's local
+   AWS signin flow. In headless sessions, rely on the configured environment-backed AWS profile and
+   do not start an SSO browser/device flow.
+
+2. Start:
+   ```bash
+   cd "${BACKEND_DIR:-../backend-v2}" && IS_OFFLINE=true bun run start:local
+   ```
+   Run in background.
+
+3. Verify:
+   ```bash
+   for i in $(seq 1 30); do
+     curl -sf http://localhost:3000/graphql -X POST \
+       -H "Content-Type: application/json" \
+       -d '{"query":"{ __typename }"}' > /dev/null 2>&1 && echo "Backend ready" && break
+     sleep 1
+   done
+   ```
+
+### stop
+
+Kill all local services.
+
+```bash
+# Kill frontend (Metro bundler)
+lsof -ti :8081 | xargs kill -9 2>/dev/null || echo "No frontend process on :8081"
+
+# Kill backend (Serverless Offline)
+lsof -ti :3000 | xargs kill -9 2>/dev/null || echo "No backend process on :3000"
+
+# Stop Docker if running
+cd "${BACKEND_DIR:-../backend-v2}" && docker compose down 2>/dev/null || true
+```
+
+### restart
+
+1. Run **stop** (above).
+2. Wait 2 seconds: `sleep 2`
+3. Run **start** (above).
+4. Verify both services respond.
+
+### status
+
+Check what is currently running and responsive.
+
+```bash
+echo "=== Port Check ==="
+echo -n "Frontend :8081 — "; lsof -i :8081 2>/dev/null | grep LISTEN > /dev/null && echo "LISTENING" || echo "NOT LISTENING"
+echo -n "Backend  :3000 — "; lsof -i :3000 2>/dev/null | grep LISTEN > /dev/null && echo "LISTENING" || echo "NOT LISTENING"
+
+echo ""
+echo "=== Health Check ==="
+echo -n "Frontend :8081 — "; curl -sf -o /dev/null -w "%{http_code}" http://localhost:8081 2>/dev/null || echo "UNREACHABLE"
+echo -n "Backend  :3000 — "; curl -sf -o /dev/null -w "%{http_code}" http://localhost:3000/graphql -X POST -H "Content-Type: application/json" -d '{"query":"{ __typename }"}' 2>/dev/null || echo "UNREACHABLE"
+
+echo ""
+echo "=== Docker ==="
+docker compose -f "${BACKEND_DIR:-../backend-v2}/compose.yaml" ps 2>/dev/null || echo "No Docker services running"
+```
+
+Report results as a table:
+
+| Service | Port | Listening | Responsive |
+|---------|------|-----------|------------|
+| Frontend (Metro) | 8081 | YES/NO | YES/NO |
+| Backend (Serverless Offline) | 3000 | YES/NO | YES/NO |

package/plugins/lisa-expo-devin/skills/ops-verify-health/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: ops-verify-health
+description: Health check all services across environments. Checks frontend URLs, backend GraphQL endpoints, and reports response times.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Verify Health
+
+Health check all services across environments.
+
+**Argument**: `$ARGUMENTS` — environment(s) to check (default: `all`). Options: `local`, `dev`, `staging`, `production`, `all`
+
+## Discovery
+
+Read these files to build the environment URL table:
+
+1. `e2e/constants.ts` — frontend URLs per environment
+2. `.env.localhost`, `.env.development`, `.env.staging`, `.env.production` — `EXPO_PUBLIC_GRAPHQL_BASE_URL` for backend GraphQL URLs
+
+## Health Checks
+
+For each environment, run these checks:
+
+### Frontend Check
+
+```bash
+curl -sf -o /dev/null -w "HTTP %{http_code} in %{time_total}s" {frontend_url}
+```
+
+Verify the response contains Expo/React markers:
+```bash
+curl -sf {frontend_url} | head -20
+```
+
+### Backend GraphQL Check
+
+```bash
+curl -sf {graphql_url} -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __typename }"}' \
+  -w "\nHTTP %{http_code} in %{time_total}s\n"
+```
+
+### GraphQL Introspection (detailed check)
+
+```bash
+curl -sf {graphql_url} -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __schema { queryType { name } } }"}' \
+  -w "\nHTTP %{http_code} in %{time_total}s\n"
+```
+
+## Full Health Check Script
+
+Run all checks for the specified environment(s):
+
+```bash
+check_env() {
+  local ENV=$1
+  local FE_URL=$2
+  local BE_URL=$3
+
+  echo "=== $ENV ==="
+
+  # Frontend
+  FE_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" --max-time 10 "$FE_URL" 2>/dev/null || echo "000")
+  FE_TIME=$(curl -sf -o /dev/null -w "%{time_total}" --max-time 10 "$FE_URL" 2>/dev/null || echo "timeout")
+  echo "Frontend: HTTP $FE_STATUS ($FE_TIME s)"
+
+  # Backend
+  BE_RESULT=$(curl -sf --max-time 10 "$BE_URL" -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"query":"{ __typename }"}' \
+    -w "\n%{http_code} %{time_total}" 2>/dev/null || echo -e "\n000 timeout")
+  BE_STATUS=$(echo "$BE_RESULT" | tail -1 | awk '{print $1}')
+  BE_TIME=$(echo "$BE_RESULT" | tail -1 | awk '{print $2}')
+  echo "Backend:  HTTP $BE_STATUS ($BE_TIME s)"
+  echo ""
+}
+```
+
+## EAS Update Status
+
+Check the latest OTA updates deployed to each branch:
+
+```bash
+eas update:list --branch {env} --limit 3
+```
+
+## Output Format
+
+Report results as a table:
+
+| Service | Environment | Status | Response Time | Details |
+|---------|-------------|--------|---------------|---------|
+| Frontend | dev | UP (200) | 0.45s | HTML contains React root |
+| Backend | dev | UP (200) | 0.32s | GraphQL responds `__typename` |
+
+Flag any service with status != 200 or response time > 5s as a concern.

package/plugins/lisa-expo-devin/skills/owasp-zap/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: owasp-zap
+description: This skill should be used when running or interpreting an OWASP ZAP baseline DAST scan of the Expo web export — after changes to HTTP headers, authentication, or security middleware, before deploying to staging or production, or when triaging ZAP findings from CI or pull request checks. Covers running scripts/zap-baseline.sh locally, risk-level triage, common findings and fixes, and .zap/baseline.conf rule configuration.
+---
+
+# OWASP ZAP Baseline Scanning
+
+OWASP ZAP (Zed Attack Proxy) performs DAST (Dynamic Application Security Testing) by scanning a running application for common security vulnerabilities from the OWASP Top 10.
+
+## When to Use
+
+- After making changes to HTTP headers, authentication, or security middleware
+- Before deploying to staging or production
+- When reviewing security scan results from CI
+- When triaging ZAP findings from pull request checks
+
+## Running Locally
+
+```bash
+# Requires Docker to be installed and running
+bash scripts/zap-baseline.sh
+```
+
+The scan builds the Expo web export, serves it locally, and runs ZAP against it. Reports are saved to `zap-report.html`, `zap-report.json`, and `zap-report.md`.
+
+## Interpreting Results
+
+ZAP findings are categorized by risk level:
+
+| Risk | Action |
+|------|--------|
+| **High** | Fix immediately — indicates exploitable vulnerability |
+| **Medium** | Fix before deployment — security best practice violation |
+| **Low** | Fix when convenient — minor security improvement |
+| **Informational** | Review — may be false positive or acceptable risk |
+
+## Common Findings and Fixes
+
+### Infrastructure-Level (fix at CDN/hosting, not in code)
+
+- **CSP Header Not Set**: Configure Content-Security-Policy at CDN or hosting platform. Expo web exports need `script-src 'self' 'unsafe-inline'` for hydration.
+- **HSTS Not Set**: Configure Strict-Transport-Security at CDN/load balancer.
+- **X-Frame-Options**: Use `frame-ancestors` in CSP at CDN level.
+
+### Application-Level (fix in code)
+
+- **Cookie flags missing**: Ensure all cookies set `HttpOnly`, `Secure`, and `SameSite` attributes.
+- **Debug error messages**: Ensure error boundaries don't leak stack traces in production.
+- **Server version disclosure**: Remove or mask the `Server` response header.
+
+## Configuration
+
+ZAP scan rules are configured in `.zap/baseline.conf`. Each line controls how ZAP treats a specific rule:
+
+- `IGNORE`: Skip the rule entirely
+- `WARN`: Report finding but don't fail the build
+- `FAIL`: Fail the build if this finding is detected
+
+## CI Integration
+
+ZAP runs automatically in CI via the `zap-baseline.yml` workflow. Results are uploaded as artifacts and the build fails on medium+ severity findings.

package/plugins/lisa-expo-devin/skills/play-store-access/SKILL.md

@@ -0,0 +1,226 @@
+---
+name: play-store-access
+description: "Read-only Google Play Console access layer for Expo projects. Use when an operator or agent needs to set up Play Developer API credentials, resolve the Android package name, or check the production track release state without using the Play Console UI. Reads the androidpublisher v3 API only; track promotion, rollout changes, and submissions are out of scope."
+version: 1.0.0
+license: MIT
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Play Store Access: $ARGUMENTS
+
+Read-only access layer for Google Play release state in Expo projects. Use it to
+answer whether the Android app is live, halted, draft, or in staged rollout on a
+Play track after EAS submission.
+
+This skill MUST NOT promote tracks, change rollout percentages, create releases,
+or submit builds. EAS remains the submission path.
+
+## Invocation Contract
+
+```text
+operation: setup
+operation: production-status [track:production] [package:<android.package>]
+operation: track-status track:<track> [package:<android.package>]
+operation: resolve-package
+```
+
+Return a concise result with the package name, track, release `name` /
+`versionCodes`, `status`, `userFraction` when present, and any `countryTargeting`
+or in-app update priority fields present in the API response.
+
+## Configuration
+
+Project-safe config can live in `.lisa.config.json`:
+
+```json
+{
+  "playStore": {
+    "packageName": "com.example.app",
+    "track": "production"
+  }
+}
+```
+
+Local credential config belongs in `.lisa.config.local.json`, which must stay
+gitignored:
+
+```json
+{
+  "playStore": {
+    "serviceAccountKeyPath": "./google-play-service-account.json"
+  }
+}
+```
+
+Supported credential locations, in resolution order:
+
+1. `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` containing the raw service-account JSON.
+2. `GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64` containing base64 JSON.
+3. `.lisa.config.local.json` `playStore.serviceAccountKeyPath`.
+4. Darwin keychain item `lisa-google-play` account `<packageName>`.
+
+Fail closed if no credential is available. Never prompt indefinitely and never
+fall back to Play Console UI scraping.
+
+## One-Time Setup Flow
+
+For `operation: setup`:
+
+1. Confirm the project is an Expo app by checking for `app.json`,
+   `app.config.json`, `app.config.js`, or `app.config.ts`.
+2. Resolve or ask the operator to provide the Android package name. Prefer
+   `.lisa.config.json` `playStore.packageName`, then `expo.android.package` from
+   app config.
+3. In Google Cloud Console, create a service account dedicated to read-only Play
+   release visibility and create a JSON key for it.
+4. In Play Console, open **Setup -> API access**, link the Google Cloud project if
+   needed, then grant the service-account email app access with read-level
+   release visibility. Do not grant release-management write permissions for v1.
+5. Store the key locally using one of the credential locations above. If using a
+   path, add the path to `.gitignore` and record only the path in
+   `.lisa.config.local.json`.
+6. Record non-secret defaults in `.lisa.config.json`:
+
+   ```bash
+   jq '.playStore.packageName = "com.example.app" | .playStore.track = "production"' \
+     .lisa.config.json > /tmp/lisa-config.json && mv /tmp/lisa-config.json .lisa.config.json
+   ```
+
+The key material itself must never be committed.
+
+## Resolve Package Name
+
+Resolution order:
+
+1. Explicit `package:<value>` argument.
+2. `.lisa.config.json` `playStore.packageName`.
+3. `app.json` / `app.config.json` `expo.android.package`.
+4. `app.config.ts` / `app.config.js` by running Expo config export:
+
+   ```bash
+   npx expo config --json | jq -r '.android.package // empty'
+   ```
+
+If the package still cannot be resolved, fail with:
+
+```text
+Error: Google Play package name is not configured. Set playStore.packageName in .lisa.config.json or pass package:<name>.
+```
+
+## Read Track State
+
+The androidpublisher API requires an edit even for track reads. Create the edit,
+list the track, then delete the edit. Do not commit the edit.
+
+```bash
+PACKAGE_NAME="${PACKAGE_NAME:-$(jq -r '.playStore.packageName // empty' .lisa.config.json)}"
+TRACK="${TRACK:-$(jq -r '.playStore.track // "production"' .lisa.config.json)}"
+KEY_PATH="$(jq -r '.playStore.serviceAccountKeyPath // empty' .lisa.config.local.json 2>/dev/null)"
+
+read_service_account_json() {
+  if [ -n "${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON:-}" ]; then
+    printf '%s' "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON"
+    return
+  fi
+  if [ -n "${GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64:-}" ]; then
+    printf '%s' "$GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64" | base64 --decode 2>/dev/null ||
+      printf '%s' "$GOOGLE_PLAY_SERVICE_ACCOUNT_KEY_BASE64" | base64 -D
+    return
+  fi
+  if [ -n "$KEY_PATH" ] && [ -f "$KEY_PATH" ]; then
+    cat "$KEY_PATH"
+    return
+  fi
+  if [ "$(uname -s)" = "Darwin" ] && [ -n "$PACKAGE_NAME" ]; then
+    security find-generic-password -s lisa-google-play -a "$PACKAGE_NAME" -w 2>/dev/null
+    return
+  fi
+}
+
+SERVICE_ACCOUNT_JSON="$(read_service_account_json)"
+[ -n "$SERVICE_ACCOUNT_JSON" ] || {
+  echo "Error: no Google Play service-account key found. Run play-store-access operation: setup." >&2
+  exit 1
+}
+[ -n "$PACKAGE_NAME" ] || {
+  echo "Error: Google Play package name is not configured. Set playStore.packageName or pass package:<name>." >&2
+  exit 1
+}
+
+ACCESS_TOKEN="$(
+  SERVICE_ACCOUNT_JSON="$SERVICE_ACCOUNT_JSON" node <<'NODE'
+const crypto = require("crypto");
+
+const account = JSON.parse(process.env.SERVICE_ACCOUNT_JSON);
+const now = Math.floor(Date.now() / 1000);
+const encode = (value) =>
+  Buffer.from(JSON.stringify(value)).toString("base64url");
+const unsigned = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({
+  iss: account.client_email,
+  scope: "https://www.googleapis.com/auth/androidpublisher",
+  aud: "https://oauth2.googleapis.com/token",
+  iat: now,
+  exp: now + 3600,
+})}`;
+const signature = crypto
+  .createSign("RSA-SHA256")
+  .update(unsigned)
+  .sign(account.private_key, "base64url");
+
+fetch("https://oauth2.googleapis.com/token", {
+  method: "POST",
+  headers: { "Content-Type": "application/x-www-form-urlencoded" },
+  body: new URLSearchParams({
+    grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+    assertion: `${unsigned}.${signature}`,
+  }),
+})
+  .then(async (response) => {
+    const body = await response.json();
+    if (!response.ok) {
+      throw new Error(JSON.stringify(body));
+    }
+    process.stdout.write(body.access_token);
+  })
+  .catch((error) => {
+    console.error(`Error: failed to obtain Google Play access token: ${error.message}`);
+    process.exit(1);
+  });
+NODE
+)"
+
+BASE="https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${PACKAGE_NAME}"
+EDIT_ID="$(curl -fsS -X POST "${BASE}/edits" -H "Authorization: Bearer ${ACCESS_TOKEN}" | jq -r '.id')"
+trap 'curl -fsS -X DELETE "${BASE}/edits/${EDIT_ID}" -H "Authorization: Bearer ${ACCESS_TOKEN}" >/dev/null 2>&1 || true' EXIT
+
+curl -fsS "${BASE}/edits/${EDIT_ID}/tracks/${TRACK}" \
+  -H "Authorization: Bearer ${ACCESS_TOKEN}" |
+  jq --arg packageName "$PACKAGE_NAME" \
+    '{packageName: $packageName, track: .track, releases: (.releases // [])}'
+```
+
+Interpretation:
+
+- `status: completed` means the release is live on that track.
+- `status: inProgress` means staged rollout; inspect `userFraction`.
+- `status: halted` means rollout was stopped.
+- `status: draft` means it is not live.
+- Absence of a production release means the app has no watchable production-track
+  release through the API.
+
+Known limitation: androidpublisher exposes track/release state well, but
+pre-publication review state is coarse. The reliable watchable signal is whether
+the target version is live on the production track.
+
+## Error Handling
+
+- `401` / token exchange failure: service-account key is invalid or expired.
+- `403`: service account is not invited to the Play Console app or lacks read
+  access to releases.
+- `404`: package name is wrong, the app is not created in Play Console, or the
+  service account has no access to that app.
+
+In all cases, report the package name and credential source used, but never print
+private key material or the access token.