@codyswann/lisa 4.9.0 → 4.9.1

package/dist/opencode/plugin-templates/lisa-block-no-verify.ts

@@ -0,0 +1,81 @@
+/**
+ * Lisa-managed OpenCode plugin (tool.execute.before).
+ *
+ * Blocks commands that bypass git's verification hooks — `--no-verify` and any
+ * prefix abbreviation git accepts for it, the short `git commit -n` (bare or
+ * bundled into a cluster such as `-nm "msg"`), `HUSKY=0` / `HUSKY_SKIP_HOOKS=`,
+ * and every spelling of `core.hooksPath` that points hooks somewhere that
+ * disables them.
+ *
+ * ## Why a plugin rather than more deny globs
+ *
+ * OpenCode's `permission.bash` map matches SPELLINGS. Lisa's emit shipped
+ * `"*--no-verify*"` and two `git commit -n` prefixes, and that is a filter on
+ * how the bypass was typed, not on what git will do with it: `git commit
+ * --no-veri` is an unambiguous abbreviation git resolves to `--no-verify` and
+ * matched no glob at all. Adding `*--no-veri*` would close that one spelling
+ * and leave the class open, because the set of abbreviations git accepts is a
+ * property of git's own parser. It also cannot be closed by widening: a glob
+ * broad enough to catch `-n` late on a line refuses `grep -n`.
+ *
+ * The distinction the globs cannot draw is between a token that IS an option
+ * and a token that merely CONTAINS the text of one, and drawing it requires
+ * tokenizing the command. OpenCode fires `tool.execute.before` for the `bash`
+ * tool before the command runs, and a throw from it cancels the call — so the
+ * capability was there; the emit was not using it.
+ *
+ * ## Why it shells out
+ *
+ * Policy stays single-sourced in `block-no-verify.sh`, the canonical guard
+ * Claude, Codex, Cursor and Copilot already run, copied beside this module by
+ * the installer exactly as `parity-safety-net.sh` is. A second implementation
+ * of git's option grammar in TypeScript would be a second thing to harden, and
+ * the two would diverge at the first vector closed in only one of them. This
+ * adapter converts OpenCode's `bash` tool input into Lisa's canonical Claude
+ * Bash-hook envelope, runs the script, and surfaces its refusal.
+ *
+ * The `permission.bash` deny globs stay in the emit as a FLOOR, not as the
+ * guard: if this plugin fails to load, the literal spellings are still refused.
+ * A coarse guard that is present beats a precise one that is absent.
+ *
+ * NOTE: Lisa copies this template verbatim into `.opencode/plugin/`. It runs
+ * under OpenCode's Bun runtime and is excluded from this repository's tsconfig.
+ */
+export const LisaBlockNoVerify = async () => ({
+  "tool.execute.before": async (
+    input: { tool: string },
+    output: { args?: { command?: string } }
+  ) => {
+    if (input.tool !== "bash") return;
+    const command = String(output.args?.command ?? "");
+    if (!command) return;
+
+    const hookPath = `${import.meta.dir}/block-no-verify.sh`;
+    const processHandle = Bun.spawn(["/bin/bash", hookPath], {
+      env: { ...process.env, CLAUDE_PROJECT_DIR: process.cwd() },
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "pipe",
+    });
+    processHandle.stdin.write(
+      JSON.stringify({ tool_name: "Bash", tool_input: { command } })
+    );
+    processHandle.stdin.end();
+
+    const [status, reason] = await Promise.all([
+      processHandle.exited,
+      new Response(processHandle.stderr).text(),
+    ]);
+    // Exit 0 is ALLOW, including the canonical script's degraded path when jq
+    // or python3 is missing — it says so on stderr and permits the command,
+    // which is why stderr alone must never be read as a refusal. Any non-zero
+    // status is a block: 2 is the guard's own refusal, and anything else means
+    // the guard could not complete, which is not a state to run a bypass in.
+    if (status === 0) return;
+    throw new Error(
+      reason.trim() ||
+        "block-no-verify: this command bypasses git's verification hooks. " +
+          "Fix the underlying failure instead of skipping the check."
+    );
+  },
+});

package/package.json

@@ -148,7 +148,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/copy-opencode-plugin-templates.mjs

@@ -16,7 +16,11 @@ const repoRoot = path.resolve(import.meta.dirname, "..");
 const sourceDir = path.join(repoRoot, "src", "opencode", "plugin-templates");
 const destDir = path.join(repoRoot, "dist", "opencode", "plugin-templates");
 const canonicalHookDir = path.join(repoRoot, "plugins", "src", "base", "hooks");
+// Kept in step with PLUGIN_SUPPORT_FILES in src/opencode/hooks-installer.ts —
+// that list is what the installer copies into a host, this one is what makes
+// the files reachable from `dist/` for a packaged install.
 const canonicalSupportFiles = [
+  "block-no-verify.sh",
   "parity-safety-net.sh",
   "parity-safety-net-heredoc.py",
 ];

package/typescript/copy-overwrite/scripts/lisa-mutation.mjs

@@ -635,11 +635,30 @@ export const MIN_DETECTED_FOR_SHARE = 50;
 
 /**
  * The share ceiling in force.
+ *
+ * A variable that is SET BUT EMPTY reads as unset, not as zero. `Number("")` is
+ * 0, and 0 passes both `Number.isFinite` and `>= 0`, so an empty string used to
+ * be the one non-numeric spelling that did NOT fall back: `"abc"` resolved to
+ * the default and `""` resolved to a ceiling of 0, which fails the run on the
+ * first timed-out mutant. That is the strictest ceiling reachable, delivered by
+ * a value nobody chose.
+ *
+ * Empty is exactly what GitHub Actions produces when an unset workflow input is
+ * mapped into `env:` — `MUTATION_TIMEOUT_SHARE_MAX: ${{ inputs.share_max }}` on
+ * a caller that passes nothing sets the variable to "". The declaration is the
+ * caller's, the emptiness is the harness's, and reading the harness's silence
+ * as a deliberate zero is how a gate goes red for a reason no human wrote.
+ *
+ * Zero stays reachable, because zero stays typeable: `MUTATION_TIMEOUT_SHARE_MAX=0`
+ * still resolves to 0. What changes is that a ceiling that severe now has to be
+ * asked for in a character, rather than arrived at through an absent one.
  * @returns {number} The ceiling, as a percentage.
  */
 export const resolveTimeoutShareCeiling = () => {
   const raw = process.env.MUTATION_TIMEOUT_SHARE_MAX;
-  if (raw === undefined) return DEFAULT_TIMEOUT_SHARE_CEILING_PCT;
+  if (raw === undefined || raw.trim() === "") {
+    return DEFAULT_TIMEOUT_SHARE_CEILING_PCT;
+  }
   const parsed = Number(raw);
   return Number.isFinite(parsed) && parsed >= 0
     ? parsed