@codyswann/lisa 4.74.9 → 4.75.0

package/plugins/lisa-typescript-devin/hooks/block-suppress-directives.sh

@@ -0,0 +1,141 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+#
+# PreToolUse hook (Write|Edit): block adding error-suppression directives to
+# JS/TS source. Suppressing the type checker, linter, or formatter hides real
+# defects instead of fixing them, so it is a documented last resort (see the
+# base "ASK FIRST" governance rule). The agent should stop and get the user's
+# approval rather than slip a suppression past silently.
+#
+# Inspects only the NEW text the tool introduces, scoped to JS/TS files, and
+# matches the directive only in comment syntax (// or /*) so prose, strings,
+# and identifiers that merely mention these tokens are not flagged.
+# Exit code 2 blocks the tool call and surfaces stderr to Claude.
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+#
+# WHAT A REFUSAL HOOK OWES THAT AN ON-EDIT HOOK DOES NOT. The five PostToolUse
+# scripts may bail out when they cannot run: the write has already happened and
+# a skipped lint is a missed report. This one decides whether the write happens
+# at all, so a bail-out is a PERMIT — it lets through exactly the text it exists
+# to stop, while reporting success. Every exit below is therefore one of three
+# things and never a fourth: out of scope (nothing to judge), judged by the
+# project's declared task, or judged by the built-in. "Could not judge" refuses.
+
+JSON_INPUT=$(cat)
+
+# Project rule (host rules, .agents/rules/): never parse JSON in shell with
+# grep/sed/cut/awk — always use jq.
+#
+# FAIL CLOSED, reversed from the `exit 0` this shipped with. Without jq the
+# payload cannot be read at all: not the path, not the file type, not the new
+# text. Permitting there is the one branch that let a suppression through while
+# the hook reported success, and it could not even say which write it had waved
+# past. The refusal is deliberately unscoped for the same reason — with no
+# parse there is no file type to scope it to. This is the same shape the
+# sibling on-edit hook already ships for a missing `oxlint`: fail loudly rather
+# than silently skip.
+if ! command -v jq >/dev/null 2>&1; then
+  cat >&2 <<'MSG'
+❌ Blocked: block-suppress-directives cannot inspect this write.
+
+`jq` is not installed, so the tool payload cannot be parsed — this hook cannot
+tell whether the write adds an error-suppression directive. It refuses rather
+than permitting an edit it was unable to check.
+
+Install jq (`brew install jq`, `apt-get install jq`), or declare the
+`suppression-residue` gate at `pre-tool` in .lisa.config.json to have your own
+check decide instead.
+MSG
+  exit 2
+fi
+
+FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+[ -n "$FILE_PATH" ] || exit 0
+
+# Only guard JS/TS source. Directives in other file types (docs, configs that
+# document the rules, this script) are not suppressions.
+case "${FILE_PATH##*.}" in
+  ts | tsx | js | jsx | mjs | cjs) ;;
+  *) exit 0 ;;
+esac
+
+# Where this script lives, resolved BEFORE any `cd`. `$0` is the path the
+# harness invoked, and the façade helper ships beside it.
+LISA_HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+
+# ---------------------------------------------------------------------------
+# Gate façade. The project's declaration decides BEFORE the built-in judges
+# anything. Full contract, and why an undeclared project sees no change at all,
+# in lisa-edit-gate.sh beside this file.
+#
+# THE WORKING DIRECTORY IS PART OF THE WIRING HERE, which is why this hook was
+# left out of the change that wired the five on-edit ones. Those hooks already
+# `cd "$CLAUDE_PROJECT_DIR"` to run a tool against the tree; this one acts on
+# the payload and never establishes a directory at all. The helper resolves
+# .lisa.config.json and the gate registry RELATIVE to the current directory, so
+# without the `cd` it would read whatever directory the harness happened to
+# launch in and report "nothing declared" for a project that had declared.
+#
+# The `cd` is safe for the built-in below because the built-in reads only the
+# payload and the absolute path inside it — nothing it does depends on the
+# working directory. That is what keeps an undeclared project on exactly the
+# command, and exactly the exit status, it had before.
+#
+# ONE PROPERTY, so there is no all-or-nothing question here: this hook proves
+# `suppression-residue` and nothing else.
+# ---------------------------------------------------------------------------
+if [ -n "${CLAUDE_PROJECT_DIR:-}" ] &&
+  [ -f "$LISA_HOOK_DIR/lisa-edit-gate.sh" ] &&
+  cd "$CLAUDE_PROJECT_DIR" 2>/dev/null; then
+  # shellcheck source=/dev/null
+  . "$LISA_HOOK_DIR/lisa-edit-gate.sh"
+  if LISA_GATE_COMMANDS="$(lisa_edit_gate_tasks pre-tool suppression-residue)"; then
+    # The declared task's own exit status decides the write: non-zero refuses,
+    # exactly as the built-in's match does. `lisa_edit_gate_run` exits 2 on the
+    # first failure, which is this surface's refusal status.
+    lisa_edit_gate_run "$FILE_PATH" "$LISA_GATE_COMMANDS"
+    exit $?
+  fi
+fi
+
+# Resolve the new text per tool shape:
+#   Write     -> tool_input.content
+#   MultiEdit -> tool_input.edits[].new_string
+#   Edit      -> tool_input.new_string
+NEW_TEXT=$(printf '%s' "$JSON_INPUT" | jq -r '
+  .tool_input as $i
+  | if   ($i.content     // null) != null then $i.content
+    elif ($i.edits       // null) != null then ([$i.edits[].new_string] | join("\n"))
+    elif ($i.new_string  // null) != null then $i.new_string
+    else "" end')
+
+# Comment-syntax-only match: a // or /* opener, optional whitespace, then the
+# suppression directive. @ts-expect-error is intentionally NOT matched — it is
+# the safer alternative this hook steers toward.
+DIRECTIVE_RE='(//|/\*)[[:space:]]*(@ts-(ignore|nocheck)|eslint-disable|biome-ignore|prettier-ignore)'
+
+if printf '%s' "$NEW_TEXT" | grep -Eq "$DIRECTIVE_RE"; then
+  cat >&2 <<MSG
+❌ Blocked: error-suppression directive in $FILE_PATH
+
+You are adding a @ts-ignore / @ts-nocheck / eslint-disable / biome-ignore /
+prettier-ignore comment. These silence the type checker, linter, or formatter
+instead of fixing the underlying problem. They are a last resort, not a default.
+
+Fix it properly first:
+  - Resolve the actual type/lint error rather than suppressing it.
+  - Add the missing annotation, narrow the type, or restructure the code so the
+    rule passes legitimately.
+  - For a faulty dependency type, prefer a typed wrapper or module augmentation.
+
+If — and only if — there is genuinely no other way (e.g. a known upstream bug):
+  - STOP and get the user's approval before suppressing (base "ASK FIRST" rule).
+  - Prefer @ts-expect-error over @ts-ignore (it fails once the error is gone).
+  - Scope the disable to one line and one rule, never a whole file.
+  - Include a "-- <reason>" description (eslint-comments/require-description).
+MSG
+  exit 2
+fi
+
+exit 0

package/plugins/lisa-typescript-devin/hooks/devin-tool-name-shim.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Generated by scripts/generate-devin-plugin-artifacts.mjs — do not edit.
+#
+# Devin CLI names its tools in lowercase (exec, write, edit, read, ...) while
+# Lisa's guards test Claude's names (Bash, Write, Edit, Read, ...). The field
+# names inside tool_input already match, so translating tool_name is enough
+# for an unchanged guard to evaluate a Devin tool call (CodySwannGT/lisa#4426).
+#
+# Usage: devin-tool-name-shim.sh <hook command> [args...]
+payload=$(cat)
+normalized=$payload
+if command -v jq >/dev/null 2>&1; then
+  mapped=$(printf '%s' "$payload" | jq -c '
+    if (.tool_name | type) == "string" then
+      .tool_name |= ({
+        "exec": "Bash",
+        "write": "Write",
+        "edit": "Edit",
+        "read": "Read",
+        "notebook_edit": "NotebookEdit",
+        "grep": "Grep",
+        "glob": "Glob",
+        "webfetch": "WebFetch",
+        "run_subagent": "Task",
+        "skill": "Skill",
+        "todo_write": "TodoWrite"
+      }[.] // .)
+    else . end' 2>/dev/null) && [ -n "$mapped" ] && normalized=$mapped
+fi
+printf '%s' "$normalized" | "$@"

package/plugins/lisa-typescript-devin/hooks/format-on-edit.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+
+# Hook script to format files with Prettier after Claude edits them
+# This script receives JSON input via stdin with tool information
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+
+# Read the JSON input from stdin
+JSON_INPUT=$(cat)
+
+# Extract the file path from the tool_input. Use jq for robust JSON parsing
+# (never grep/sed/cut — a JSON shape change silently skips formatting). Fail
+# open without jq so we never hard-block an edit.
+command -v jq >/dev/null 2>&1 || exit 0
+FILE_PATH=$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Check if we successfully extracted a file path
+if [ -z "$FILE_PATH" ]; then
+    echo "⚠ Skipping Prettier: Could not extract file path from Edit tool input" >&2
+    exit 0  # Exit gracefully to not interrupt Claude's workflow
+fi
+
+# Check if the file exists
+if [ ! -f "$FILE_PATH" ]; then
+    echo "⚠ Skipping Prettier: File does not exist: $FILE_PATH" >&2
+    exit 0  # Exit gracefully
+fi
+
+# Get the file extension
+FILE_EXT="${FILE_PATH##*.}"
+
+# Check if this is a TypeScript or JavaScript file that should be formatted
+# Based on package.json format command: "prettier --write \"src/**/*.ts\" \"test/**/*.ts\""
+case "$FILE_EXT" in
+    ts|tsx|js|jsx|json)
+        # File type is supported for formatting
+        ;;
+    *)
+        echo "ℹ Skipping Prettier: File type .$FILE_EXT is not configured for auto-formatting"
+        exit 0
+        ;;
+esac
+
+# Change to the project directory to ensure package manager commands work
+# Where this script lives, resolved BEFORE any `cd`. `$0` is the path the
+# harness invoked, and the façade helper ships beside it.
+LISA_HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# ---------------------------------------------------------------------------
+# Gate façade. The project's declaration decides BEFORE any tool is resolved.
+# Full contract, and why an undeclared project sees no change at all, in
+# lisa-edit-gate.sh beside this file.
+#
+# All-or-nothing across the properties this script proves: a single invocation
+# that proves more than one stands down only when EVERY one is declared, or it
+# would silently stop proving the others.
+# ---------------------------------------------------------------------------
+if [ -f "$LISA_HOOK_DIR/lisa-edit-gate.sh" ]; then
+    # shellcheck source=/dev/null
+    . "$LISA_HOOK_DIR/lisa-edit-gate.sh"
+    if LISA_GATE_COMMANDS="$(lisa_edit_gate_tasks post-tool format-conformance)"; then
+        lisa_edit_gate_run "$FILE_PATH" "$LISA_GATE_COMMANDS"
+        exit $?
+    fi
+fi
+
+
+# Resolve Prettier binary — prefer local node_modules/.bin, then package-manager exec
+if [ -x "./node_modules/.bin/prettier" ]; then
+    PRETTIER_CMD="./node_modules/.bin/prettier"
+    PKG_MANAGER="npm"
+elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    PRETTIER_CMD="bunx prettier"
+    PKG_MANAGER="bun"
+elif [ -f "pnpm-lock.yaml" ]; then
+    PRETTIER_CMD="pnpm exec prettier"
+    PKG_MANAGER="pnpm"
+elif [ -f "yarn.lock" ]; then
+    PRETTIER_CMD="yarn exec prettier"
+    PKG_MANAGER="yarn"
+else
+    PRETTIER_CMD="npx prettier"
+    PKG_MANAGER="npm"
+fi
+
+# Run Prettier on the specific file
+echo "🎨 Running Prettier on: $FILE_PATH"
+$PRETTIER_CMD --write "$FILE_PATH" 2>&1 | grep -v "run v" | grep -v "Done in"
+
+# Check the exit status
+if [ ${PIPESTATUS[0]} -eq 0 ]; then
+    echo "✓ Successfully formatted: $(basename "$FILE_PATH")"
+else
+    echo "⚠ Prettier formatting failed for: $FILE_PATH" >&2
+    echo "  You may need to run '$PKG_MANAGER run format' manually to fix formatting issues." >&2
+fi
+
+# Always exit successfully to not interrupt Claude's workflow
+exit 0

package/plugins/lisa-typescript-devin/hooks/lint-on-edit.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# Lint-on-Edit Hook (PostToolUse - Write|Edit)
+# =============================================================================
+# Runs oxlint on each edited TypeScript file. Full ESLint remains enforced at
+# the commit/CI chokepoint via the project lint scripts.
+#
+# oxlint is Rust-native and covers the fast-feedback rule tier in milliseconds;
+# ESLint stays out of the edit-time path.
+#
+# Behavior:
+#   - Exit 0: lint passes
+#   - Exit 2: oxlint errors remain - blocks Claude so it fixes them immediately
+#
+# @see .claude/rules/verfication.md "Self-Correction Loop" section
+# =============================================================================
+
+# Extract file path from JSON input. Use jq for robust JSON parsing (never
+# grep/sed/cut — a shape change would silently skip the blocking lint gate).
+# Fail open without jq so we never hard-block an edit.
+command -v jq >/dev/null 2>&1 || exit 0
+FILE_PATH=$(cat | jq -r '.tool_input.file_path // empty')
+
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if file type is supported (TypeScript only)
+case "${FILE_PATH##*.}" in
+    ts|tsx) ;;
+    *) exit 0 ;;
+esac
+
+# Validate project directory
+if [ -z "${CLAUDE_PROJECT_DIR:-}" ]; then
+    exit 0
+fi
+
+# Check if file is in a source directory
+RELATIVE_PATH="${FILE_PATH#$CLAUDE_PROJECT_DIR/}"
+case "$RELATIVE_PATH" in
+    src/*|apps/*|libs/*|test/*|tests/*|features/*|components/*|hooks/*|screens/*|app/*|constants/*|utils/*|providers/*|stores/*) ;;
+    *) exit 0 ;;
+esac
+
+# Where this script lives, resolved BEFORE any `cd`. `$0` is the path the
+# harness invoked, and the façade helper ships beside it.
+LISA_HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# ---------------------------------------------------------------------------
+# Gate façade. The project's declaration decides BEFORE any tool is resolved.
+# Full contract, and why an undeclared project sees no change at all, in
+# lisa-edit-gate.sh beside this file.
+#
+# All-or-nothing across the properties this script proves: a single invocation
+# that proves more than one stands down only when EVERY one is declared, or it
+# would silently stop proving the others.
+# ---------------------------------------------------------------------------
+if [ -f "$LISA_HOOK_DIR/lisa-edit-gate.sh" ]; then
+    # shellcheck source=/dev/null
+    . "$LISA_HOOK_DIR/lisa-edit-gate.sh"
+    if LISA_GATE_COMMANDS="$(lisa_edit_gate_tasks post-tool code-style)"; then
+        lisa_edit_gate_run "$FILE_PATH" "$LISA_GATE_COMMANDS"
+        exit $?
+    fi
+fi
+
+
+# Resolve oxlint binary - prefer local node_modules/.bin
+if [ -x "./node_modules/.bin/oxlint" ]; then
+    OXLINT_CMD="./node_modules/.bin/oxlint"
+elif [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    OXLINT_CMD="bunx oxlint"
+elif [ -f "pnpm-lock.yaml" ]; then
+    OXLINT_CMD="pnpm exec oxlint"
+elif [ -f "yarn.lock" ]; then
+    OXLINT_CMD="yarn exec oxlint"
+else
+    OXLINT_CMD="npx oxlint"
+fi
+
+# oxlint (REQUIRED in the Phase 2 hybrid pipeline)
+# If oxlint is missing the project is out of sync with the current Lisa
+# governance — fail loudly rather than silently skipping. ESLint alone is
+# no longer a complete lint pass.
+if [ ! -x "./node_modules/.bin/oxlint" ] && ! command -v "${OXLINT_CMD%% *}" >/dev/null 2>&1; then
+    echo "oxlint is required but not installed in this project." >&2
+    echo "Add 'oxlint' as a devDependency (Lisa governance pins it via package.lisa.json) and run install." >&2
+    exit 2
+fi
+
+if [ ! -f ".oxlintrc.json" ] && [ ! -f ".oxlintrc.jsonc" ] && [ ! -f "oxlint.config.ts" ]; then
+    echo "oxlint is installed but no .oxlintrc.json found. Run 'lisa update' to install the stack template." >&2
+    exit 2
+fi
+
+echo "Running oxlint on: $FILE_PATH"
+OX_OUTPUT=$($OXLINT_CMD --quiet "$FILE_PATH" 2>&1)
+OX_EXIT=$?
+if [ $OX_EXIT -ne 0 ]; then
+    case "$OX_OUTPUT" in
+        *"No files found to lint"* | *" on 0 files"* | *" on 0 file"*)
+            echo "oxlint: Ignored by lint config: $FILE_PATH"
+            exit 0
+            ;;
+    esac
+    echo "oxlint found errors in: $FILE_PATH" >&2
+    echo "$OX_OUTPUT" >&2
+    exit 2
+fi
+
+echo "oxlint: No errors in $(basename "$FILE_PATH")"
+exit 0

package/plugins/lisa-typescript-devin/hooks/lisa-edit-gate.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+# =============================================================================
+# Edit-time gate façade
+# =============================================================================
+# Sourced by every on-edit hook. Answers one question before the hook runs
+# anything: has the project declared what proves this property at this moment,
+# and if so what should run instead of Lisa's written-in tool?
+#
+# WHY THIS EXISTS. Edit time is the highest-frequency enforcement surface Lisa
+# owns and was the one surface with no configurability at all. The scripts
+# resolved a RUNNER (`./node_modules/.bin/oxlint`, else `bunx`/`npx`) and
+# hardcoded the TOOL, which is the inversion the gate registry exists to fix.
+# Worse, they exit 2 — refusing the edit — when the written-in binary or config
+# filename is absent, so a project that lints correctly with something else had
+# every agent write refused until it installed Lisa's choice.
+#
+# THE CONTRACT, and the two halves that matter equally:
+#
+#   declared   -> the project's task runs and the hook's written-in tool is
+#                 never consulted, so a missing binary cannot refuse the edit.
+#   undeclared -> NOTHING changes. The resolver is not even invoked when no
+#                 registry is installed, and the hook falls through to exactly
+#                 the command it ran before. That is the overwhelming majority
+#                 of projects, and it is the case a façade silently breaks.
+#
+# ALL OR NOTHING FOR A MULTI-PROPERTY SCRIPT. `lisa_edit_gate_tasks` takes every
+# property its caller proves and resolves only when EVERY one is declared. The
+# Rails hook runs `rubocop -a` and then a second pass for unfixable errors — its
+# own header calls it both formatter and linter — so standing down on `code-style`
+# alone would silently stop proving `format-conformance`. Same shape as
+# `lisa_gate_covers test-correctness coverage-adequacy` in the pre-push hook.
+#
+# HOW THE DECLARED TASK LEARNS WHICH FILE WAS EDITED. It does not take an
+# argument: `<runner> <task>` with no arguments is the invocation every other
+# Lisa façade uses, and adding a positional here would make the declaration
+# mean something different at this moment than at every other one. The path is
+# exported as LISA_EDITED_FILE instead, so a project that wants a per-file run
+# can scope its own task and one that does not gets a whole-project run.
+# =============================================================================
+
+# Where the gate registry may be installed, in resolution order.
+lisa_edit_gate_registry() {
+    for _lisa_candidate in \
+        "node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-gates.mjs" \
+        "scripts/lisa-gates.mjs" \
+        "all/copy-overwrite/scripts/lisa-gates.mjs"
+    do
+        if [ -f "$_lisa_candidate" ]; then
+            printf '%s' "$_lisa_candidate"
+            unset _lisa_candidate
+            return 0
+        fi
+    done
+    unset _lisa_candidate
+    return 1
+}
+
+# lisa_edit_gate_tasks <moment> <gate-id>...
+#
+# Prints one `<runner> <task>` line per DISTINCT declared task and returns 0,
+# but only when every named gate resolves to a runnable task at <moment>.
+# Returns 1 and prints nothing otherwise — including when no registry is
+# installed, when node is unavailable, and when the resolver itself fails.
+#
+# Fail-safe in the direction that keeps proving things: any doubt returns 1 and
+# the caller runs its built-in. A resolver that could not answer must never read
+# as "the project has this covered".
+lisa_edit_gate_tasks() {
+    _lisa_moment="$1"
+    shift
+    [ -n "$_lisa_moment" ] || { unset _lisa_moment; return 1; }
+    [ "$#" -gt 0 ] || { unset _lisa_moment; return 1; }
+    # NO SETTINGS FILE, NO SPAWN. Checked before anything else because this is
+    # the path essentially every project is on, and it runs on EVERY agent
+    # edit: asking the resolver would cost a node process per keystroke-sized
+    # write to answer "nothing is declared", which the absent file already
+    # answers. The equivalence control compares which COMMAND runs and would
+    # not have caught the cost.
+    [ -f .lisa.config.json ] || { unset _lisa_moment; return 1; }
+    command -v node >/dev/null 2>&1 || { unset _lisa_moment; return 1; }
+
+    _lisa_registry="$(lisa_edit_gate_registry)" || {
+        unset _lisa_moment _lisa_registry
+        return 1
+    }
+
+    # EXPORTED, not prefixed. An assignment prefix reaches only the FIRST
+    # command of a pipeline, and the filter that reads it is the second — so
+    # the prefixed form resolved an empty want-list and every script fell
+    # silently back to its built-in, which is a façade that looks wired and is
+    # not.
+    LISA_GATE_IDS="$*"
+    export LISA_GATE_IDS
+    _lisa_out="$(
+        node "$_lisa_registry" list \
+            --moment="$_lisa_moment" --json 2>/dev/null | node -e '
+let raw = "";
+process.stdin.on("data", chunk => { raw += chunk }).on("end", () => {
+  let resolved;
+  try { resolved = JSON.parse(raw || "[]"); } catch { process.exit(1); }
+  const wanted = (process.env.LISA_GATE_IDS || "").split(" ").filter(Boolean);
+  const commands = [];
+  for (const id of wanted) {
+    const hit = resolved.find(gate => gate.id === id);
+    // `run` mode with a task is the only shape that PROVES anything here. An
+    // awaited gate proves nothing at edit time and an intercepted one is
+    // Lisa running it elsewhere; both must leave the built-in in charge.
+    if (!hit || hit.mode !== "run" || !hit.command) process.exit(1);
+    if (!commands.includes(hit.command)) commands.push(hit.command);
+  }
+  if (commands.length === 0) process.exit(1);
+  process.stdout.write(commands.join("\n"));
+});
+'
+    )" || {
+        unset _lisa_moment _lisa_registry _lisa_out
+        return 1
+    }
+
+    [ -n "$_lisa_out" ] || {
+        unset _lisa_moment _lisa_registry _lisa_out
+        return 1
+    }
+    printf '%s' "$_lisa_out"
+    unset _lisa_moment _lisa_registry _lisa_out
+    return 0
+}
+
+# lisa_edit_gate_run <edited-file> <commands>
+#
+# Runs each resolved command with LISA_EDITED_FILE exported. Exits 2 on the
+# first failure, which is the same refusal the built-in path uses, so a
+# declared task that finds a real problem still stops the agent.
+lisa_edit_gate_run() {
+    _lisa_file="$1"
+    shift
+    LISA_EDITED_FILE="$_lisa_file"
+    export LISA_EDITED_FILE
+    printf '%s\n' "$*" | while IFS= read -r _lisa_command; do
+        [ -n "$_lisa_command" ] || continue
+        echo "Running declared gate task: $_lisa_command"
+        # Deliberate word split: the resolver validated both halves as plain
+        # words, so no shell metacharacter reaches argv.
+        # shellcheck disable=SC2086
+        $_lisa_command || exit 2
+    done
+    _lisa_status=$?
+    unset _lisa_file _lisa_command
+    return $_lisa_status
+}

package/plugins/lisa-typescript-devin/hooks/sg-scan-on-edit.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+
+# Hook script to run ast-grep scan after Claude edits files
+# This script receives JSON input via stdin with tool information
+# Reference: https://docs.claude.com/en/docs/claude-code/hooks
+# Note: This hook is BLOCKING - it returns non-zero exit codes so Claude must fix issues
+
+# Extract file path from JSON input. Use jq for robust JSON parsing (never
+# grep/sed/cut — a shape change would turn this blocking scan into a silent
+# no-op). Fail open without jq so we never hard-block an edit.
+command -v jq >/dev/null 2>&1 || exit 0
+FILE_PATH=$(cat | jq -r '.tool_input.file_path // empty')
+
+if [ -z "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if file type is supported (TypeScript, JavaScript)
+case "${FILE_PATH##*.}" in
+    ts|tsx|js|jsx|mjs|cjs) ;;
+    *) exit 0 ;;
+esac
+
+# Validate project directory
+if [ -z "${CLAUDE_PROJECT_DIR:-}" ]; then
+    exit 0
+fi
+
+# Check if file is in a source directory
+RELATIVE_PATH="${FILE_PATH#$CLAUDE_PROJECT_DIR/}"
+case "$RELATIVE_PATH" in
+    src/*|apps/*|libs/*|test/*|tests/*|features/*|components/*|hooks/*|screens/*|app/*|constants/*|utils/*|providers/*|stores/*) ;;
+    *) exit 0 ;;
+esac
+
+# Where this script lives, resolved BEFORE any `cd`. `$0` is the path the
+# harness invoked, and the façade helper ships beside it.
+LISA_HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+# ---------------------------------------------------------------------------
+# Gate façade. The project's declaration decides BEFORE any tool is resolved.
+# Full contract, and why an undeclared project sees no change at all, in
+# lisa-edit-gate.sh beside this file.
+#
+# All-or-nothing across the properties this script proves: a single invocation
+# that proves more than one stands down only when EVERY one is declared, or it
+# would silently stop proving the others.
+# ---------------------------------------------------------------------------
+if [ -f "$LISA_HOOK_DIR/lisa-edit-gate.sh" ]; then
+    # shellcheck source=/dev/null
+    . "$LISA_HOOK_DIR/lisa-edit-gate.sh"
+    if LISA_GATE_COMMANDS="$(lisa_edit_gate_tasks post-tool structural-rules)"; then
+        lisa_edit_gate_run "$FILE_PATH" "$LISA_GATE_COMMANDS"
+        exit $?
+    fi
+fi
+
+
+# Verify ast-grep configuration exists
+if [ ! -f "sgconfig.yml" ]; then
+    exit 0
+fi
+
+# Verify rules are defined
+RULE_COUNT=$(find ast-grep/rules -name "*.yml" -o -name "*.yaml" 2>/dev/null | grep -v ".gitkeep" | wc -l | tr -d ' ')
+if [ "$RULE_COUNT" -eq 0 ]; then
+    exit 0
+fi
+
+# Detect package manager
+if [ -f "bun.lockb" ] || [ -f "bun.lock" ]; then
+    PKG_MANAGER="bun"
+elif [ -f "pnpm-lock.yaml" ]; then
+    PKG_MANAGER="pnpm"
+elif [ -f "yarn.lock" ]; then
+    PKG_MANAGER="yarn"
+else
+    PKG_MANAGER="npm"
+fi
+
+# Run ast-grep scan
+echo "Running ast-grep scan on: $FILE_PATH"
+if OUTPUT=$($PKG_MANAGER run sg:scan "$FILE_PATH" 2>&1); then
+    echo "ast-grep: No issues found in $(basename "$FILE_PATH")"
+    exit 0
+else
+    echo "ast-grep found issues in: $FILE_PATH" >&2
+    echo "$OUTPUT" >&2
+    exit 2
+fi

package/plugins/lisa-typescript-devin/hooks.json

@@ -0,0 +1,34 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "^(write|apply_patch|edit)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/block-suppress-directives.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "^(write|apply_patch|edit)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/format-on-edit.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/sg-scan-on-edit.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/devin-tool-name-shim.sh ${CLAUDE_PLUGIN_ROOT}/hooks/lint-on-edit.sh"
+          }
+        ]
+      }
+    ]
+  }
+}