@codyswann/lisa 4.87.5 → 4.87.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/all/copy-overwrite/scripts/check-third-party-review-evidence.mjs +568 -80
- package/dist/cli/doctor-seeded-artifacts.d.ts.map +1 -1
- package/dist/cli/doctor-seeded-artifacts.js +10 -3
- package/dist/cli/doctor-seeded-artifacts.js.map +1 -1
- package/dist/cli/doctor-third-party-evidence-seed.d.ts +32 -0
- package/dist/cli/doctor-third-party-evidence-seed.d.ts.map +1 -0
- package/dist/cli/doctor-third-party-evidence-seed.js +239 -0
- package/dist/cli/doctor-third-party-evidence-seed.js.map +1 -0
- package/dist/cli/doctor.js +2 -2
- package/dist/core/lisa-owned-hash-ledger.d.ts.map +1 -1
- package/dist/core/lisa-owned-hash-ledger.js +6 -0
- package/dist/core/lisa-owned-hash-ledger.js.map +1 -1
- package/dist/core/nightly-e2e-guard-behavior-certificate.js +2 -2
- package/dist/core/third-party-evidence-seed.d.ts +42 -0
- package/dist/core/third-party-evidence-seed.d.ts.map +1 -0
- package/dist/core/third-party-evidence-seed.js +233 -0
- package/dist/core/third-party-evidence-seed.js.map +1 -0
- package/dist/core/upstream-evidence-manifest.d.ts.map +1 -1
- package/dist/core/upstream-evidence-manifest.js +21 -4
- package/dist/core/upstream-evidence-manifest.js.map +1 -1
- package/package.json +4 -4
- package/plugins/lisa/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa/.codex-plugin/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa/.codex-plugin/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa-agy/plugin.json +1 -1
- package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa-agy/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-agy/plugin.json +1 -1
- package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cdk-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-copilot/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa-copilot/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-cursor/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa-cursor/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-devin/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/lisa-devin/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-agy/plugin.json +1 -1
- package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-expo-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-harper-fabric-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-agy/plugin.json +1 -1
- package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-nestjs-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-agy/plugin.json +1 -1
- package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-openclaw-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-agy/plugin.json +1 -1
- package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-phaser-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-agy/plugin.json +1 -1
- package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-rails-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-agy/plugin.json +1 -1
- package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-typescript-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-agy/plugin.json +1 -1
- package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-devin/.claude-plugin/plugin.json +1 -1
- package/plugins/lisa-wiki-devin/.devin-plugin/plugin.json +1 -1
- package/plugins/src/base/skills/lisa-drive-pr-to-merge/SKILL.md +59 -31
- package/plugins/src/base/skills/lisa-pull-request-review/SKILL.md +11 -5
- package/typescript/create-only/.github/workflows/third-party-review-evidence.yml +62 -30
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "lisa-openclaw",
|
|
3
|
-
"version": "4.87.
|
|
3
|
+
"version": "4.87.6",
|
|
4
4
|
"description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Cody Swann"
|
|
@@ -953,13 +953,30 @@ resolve every thread via `resolveReviewThread` so the branch-protection
|
|
|
953
953
|
thread-resolution gate clears.
|
|
954
954
|
|
|
955
955
|
**A green review check is not proof a review happened.** A third-party review
|
|
956
|
-
app
|
|
957
|
-
|
|
958
|
-
|
|
959
|
-
|
|
960
|
-
|
|
956
|
+
app reports on the PR head through a **check run** or a **commit status**, and
|
|
957
|
+
one app can move from the second to the first without notice: measured in one
|
|
958
|
+
repository, its reviewer stopped posting statuses between 2026-10-26 and
|
|
959
|
+
2026-10-27 and has reported only as a check run since. When it is throttled or
|
|
960
|
+
declines it never blocks — a status still reports `success`, and a check run
|
|
961
|
+
concludes `neutral`, which GitHub counts as passing a required check. Only the
|
|
962
|
+
reviewer's own words tell the two apart. Measured over the last 30 merged PRs in
|
|
963
|
+
one repository: 24 of 30 merges passed a required review gate that had reviewed
|
|
964
|
+
nothing. A second repository sampled `success` on 50 of 50.
|
|
965
|
+
|
|
966
|
+
**Read the words from the reviewer's own API object, never from the rollup.**
|
|
967
|
+
A check run's title is often a generic `Finished`; its result is the **first
|
|
968
|
+
line of its summary** — `Result: Success - Review completed` when a review
|
|
969
|
+
completed, `Result: Rate limited - Review rate limited` when it was throttled.
|
|
970
|
+
Filter by name — the `?check_name=<context>` filter, sent as a field so a name
|
|
971
|
+
with spaces is encoded for you — because a head commonly carries more check
|
|
972
|
+
runs than one unfiltered page returns:
|
|
961
973
|
|
|
962
|
-
|
|
974
|
+
```bash
|
|
975
|
+
gh api -X GET 'repos/<owner>/<repo>/commits/<head-sha>/check-runs' -f check_name='<context>' \
|
|
976
|
+
--jq '.check_runs[] | {id, name, head_sha, status, conclusion, app: .app.id, title: .output.title, result: ((.output.summary // "") | split("\n")[0])}'
|
|
977
|
+
```
|
|
978
|
+
|
|
979
|
+
A commit status carries its words in its description, and
|
|
963
980
|
`gh pr view --json statusCheckRollup` returns a `StatusContext` with **no
|
|
964
981
|
`description` key at all** — verified — so a hollow green is invisible there:
|
|
965
982
|
|
|
@@ -969,16 +986,22 @@ gh api repos/<owner>/<repo>/commits/<head-sha>/status \
|
|
|
969
986
|
```
|
|
970
987
|
|
|
971
988
|
For a quick human look at one context, `gh pr checks <pr> --json name,state,description,bucket`
|
|
972
|
-
prints
|
|
973
|
-
|
|
974
|
-
|
|
975
|
-
|
|
989
|
+
prints a status's description, but its description column is EMPTY for a check
|
|
990
|
+
run — it shows neither the run's title nor its summary — so it can never tell
|
|
991
|
+
you a check run reviewed anything. The prover and CI read the two APIs above
|
|
992
|
+
instead, because `gh pr checks`
|
|
993
|
+
resolves the rollup through the workflow run and exits non-zero with EMPTY
|
|
994
|
+
stdout when it lacks `actions: read`, which reads as a content problem and
|
|
995
|
+
never says "permission". Reading a check run needs `checks: read`.
|
|
976
996
|
|
|
977
997
|
**Which reviewers to read is configuration, never a vendor name.** Each gate in
|
|
978
998
|
`.lisa.config.json` that declares `evidence.reviewer: true` on its
|
|
979
|
-
`pull-request` moment names one third-party reviewer: `await` is
|
|
980
|
-
context
|
|
981
|
-
|
|
999
|
+
`pull-request` moment names one third-party reviewer: `await` is the status
|
|
1000
|
+
context or check-run name it reports under, `posted_by` (when declared) is the
|
|
1001
|
+
app whose check run counts, and `evidence.proof` is the exact **reviewed-when**
|
|
1002
|
+
phrase. The shipped prover reads both representations and returns the whole
|
|
1003
|
+
verdict. Take the verdict from it, not from your own reading of the payloads
|
|
1004
|
+
above:
|
|
982
1005
|
|
|
983
1006
|
```bash
|
|
984
1007
|
node scripts/check-third-party-review-evidence.mjs --sha <head-sha> --json
|
|
@@ -986,18 +1009,20 @@ node scripts/check-third-party-review-evidence.mjs --sha <head-sha> --json
|
|
|
986
1009
|
|
|
987
1010
|
Three cases, and each is handled differently:
|
|
988
1011
|
|
|
989
|
-
1. **`satisfied`** — every configured reviewer
|
|
990
|
-
|
|
1012
|
+
1. **`satisfied`** — every configured reviewer showed its reviewed-when
|
|
1013
|
+
evidence: a status whose description is the phrase, or a check run that
|
|
1014
|
+
completed with `success` and whose first summary line is the completed
|
|
1015
|
+
result. Nothing further; record `reviewed` and the words it observed.
|
|
991
1016
|
2. **`no-reviewer-configured`** — no gate declares one. This is a legitimate
|
|
992
1017
|
state, **not** a pass: say so explicitly in the report ("no third-party
|
|
993
1018
|
reviewer configured; nothing read this diff on that path"), and do not
|
|
994
1019
|
invent a substitute for a reviewer the project never asked for.
|
|
995
|
-
3. **anything else** — throttled, skipped, absent, empty,
|
|
996
|
-
no configured list. **Treat every one
|
|
997
|
-
allowlist is the only thing that grants
|
|
998
|
-
phrases fails open, and the vocabulary is
|
|
999
|
-
are known already, from two repositories.
|
|
1000
|
-
extra local review, never a free pass.
|
|
1020
|
+
3. **anything else** — throttled, skipped, absent, empty, unreadable, a check
|
|
1021
|
+
run that did not succeed, or words in no configured list. **Treat every one
|
|
1022
|
+
of these as NOT REVIEWED.** The allowlist is the only thing that grants
|
|
1023
|
+
credit; a denylist of known-bad phrases fails open, and the vocabulary is
|
|
1024
|
+
open-ended — four distinct strings are known already, from two repositories.
|
|
1025
|
+
An unrecognised string costs an extra local review, never a free pass.
|
|
1001
1026
|
|
|
1002
1027
|
**In case 3, substitute — do not block, and do not wait.** Before merging, run
|
|
1003
1028
|
the local adversarial review over the PR diff and **post it on the PR**, so the
|
|
@@ -1007,13 +1032,15 @@ code that merges has been read by something. The comment must:
|
|
|
1007
1032
|
as its first line, so CI can find it for this reviewer at this head;
|
|
1008
1033
|
- state plainly that it is a **self-review substitute**, not a third-party
|
|
1009
1034
|
review;
|
|
1010
|
-
- **record the actual
|
|
1011
|
-
|
|
1035
|
+
- **record the actual words observed, verbatim** — the prover's `observed`: a
|
|
1036
|
+
status's description, or a check run's title or first summary line — so the
|
|
1037
|
+
trail says *why* it was substituted rather than only that it was;
|
|
1012
1038
|
- **name the observed condition, not a guessed cause.** The prover returns a
|
|
1013
1039
|
`reading` per reviewer and a sentence for it; copy that sentence in. In
|
|
1014
1040
|
particular `absent` must read as *no third-party status was present at this
|
|
1015
1041
|
head at all* — an operator seeing an empty pair of quotes cannot tell that
|
|
1016
|
-
apart from a status whose description was blank
|
|
1042
|
+
apart from a status whose description was blank — and `unreadable` must read
|
|
1043
|
+
as a read that failed, never as an absence.
|
|
1017
1044
|
|
|
1018
1045
|
**Several different causes produce the same reading, and you cannot tell them
|
|
1019
1046
|
apart from here.** A quota throttle, a per-repository decline, and **auto-review
|
|
@@ -1069,8 +1096,8 @@ directions and must agree: the prover says whether the context did work, and the
|
|
|
1069
1096
|
configured reviewed-when phrase says what "did work" looks like for this
|
|
1070
1097
|
project.
|
|
1071
1098
|
|
|
1072
|
-
Prove the signal from the commit
|
|
1073
|
-
check is not proof of anything and must keep polling. **A settled vacuity, the
|
|
1099
|
+
Prove the signal from the check-run or commit-status API as above; a
|
|
1100
|
+
merely pending or queued check is not proof of anything and must keep polling. **A settled vacuity, the
|
|
1074
1101
|
rate limit included, arrives here immediately.** There is no wait to spend first
|
|
1075
1102
|
and no re-request to try: a rate limit's window is of unknown length, and
|
|
1076
1103
|
waiting it out stalls the pull request without reading a line of the diff. The
|
|
@@ -1101,11 +1128,12 @@ from memory:
|
|
|
1101
1128
|
- `mergeable == MERGEABLE` and `mergeStateStatus` is not `BEHIND`/`DIRTY`;
|
|
1102
1129
|
- no pending auto-fix PR into this branch (step f).
|
|
1103
1130
|
|
|
1104
|
-
**A review OBJECT is not a status CONTEXT.** Everything above is about
|
|
1105
|
-
|
|
1106
|
-
is never hollow — do not let empty-description
|
|
1107
|
-
objects. A `CHANGES_REQUESTED` is a blocking
|
|
1108
|
-
because its content commonly lives entirely in
|
|
1131
|
+
**A review OBJECT is not a status CONTEXT.** Everything above is about the
|
|
1132
|
+
words a status or check run reports. An **empty-bodied `APPROVED` review is an
|
|
1133
|
+
ordinary approval** and is never hollow — do not let empty-description
|
|
1134
|
+
reasoning leak onto review objects. A `CHANGES_REQUESTED` is a blocking
|
|
1135
|
+
objection **whatever its body**, because its content commonly lives entirely in
|
|
1136
|
+
inline threads.
|
|
1109
1137
|
|
|
1110
1138
|
**Filter review objects on `commit_id == head`, in BOTH directions.** Writing the
|
|
1111
1139
|
filter for one direction only is the easy bug, and each direction fails a
|