@codyswann/lisa 2.222.2 → 2.222.3

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# PreToolUse hook for Bash: a safety net that blocks destructive shell commands
+# before they run. Lisa-native reimplementation of the upstream
+# `safety-net@cc-marketplace` plugin's PreToolUse Bash-guard (parity work, issue
+# #1059). It does NOT port upstream code — it re-expresses the behavior in Lisa's
+# hook conventions, modeled on block-no-verify.sh.
+#
+# It reads the hook stdin JSON, inspects the proposed Bash command, and EXITS
+# NON-ZERO (2) to BLOCK when a known-destructive pattern matches:
+#   - `rm -rf /` (recursive forced delete of a root / home / wildcard path)
+#   - force-pushing a protected branch (main/master/production/release)
+#   - `git reset --hard` while the working tree is dirty (would discard work)
+#   - dropping or truncating a database/schema/table
+# Otherwise it exits 0 and the command proceeds.
+#
+# Operators extend the built-in rules with a project-local rule file — one
+# extended-regex (ERE) per line, blank lines and `#` comments ignored — managed
+# by the parity-safety-net-rules skill. Default location (overridable via
+# SAFETY_NET_RULES_FILE):
+#   ${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt
+set -euo pipefail
+
+input="$(cat)"
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
+if [ "$tool_name" != "Bash" ]; then
+  exit 0
+fi
+
+command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
+if [ -z "$command_str" ]; then
+  exit 0
+fi
+
+# block() prints the reason to stderr (surfaced to the model) and exits 2 so the
+# Bash tool call is denied. $1 = human-readable reason for the block.
+block() {
+  cat >&2 <<EOF
+Blocked by safety-net: $1
+
+This command matched a destructive-operation guard. If it is genuinely safe and
+intentional, ask the user to confirm, then run it manually outside the agent, or
+narrow the command so it no longer matches the guard.
+EOF
+  exit 2
+}
+
+# Heredoc payloads are data only for a deliberately narrow set of GitHub CLI
+# write commands. A companion parser proves that shape before removing payload
+# text from the destructive-command scans below. Unknown executable heredocs
+# remain visible to every built-in and custom rule. Ambiguous or malformed
+# heredocs fail closed instead of guessing which text the shell would execute.
+command_for_guards="$command_str"
+case "$command_str" in
+  *'<<'*)
+    hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    heredoc_parser="$hook_dir/parity-safety-net-heredoc.py"
+    if ! command -v python3 >/dev/null 2>&1 || [ ! -r "$heredoc_parser" ]; then
+      block "cannot safely classify heredoc command because its parser runtime is unavailable"
+    fi
+    if ! printf '%s\n' "$command_str" | /bin/bash -n >/dev/null 2>&1; then
+      block "malformed heredoc command failed shell syntax validation"
+    fi
+
+    parser_status=0
+    if parser_output="$(printf '%s' "$command_str" | python3 "$heredoc_parser" 2>/dev/null)"; then
+      parser_status=0
+    else
+      parser_status=$?
+    fi
+
+    case "$parser_status" in
+      0) command_for_guards="$parser_output" ;;
+      10) command_for_guards="$command_str" ;;
+      20) block "malformed or ambiguous heredoc command cannot be safely classified" ;;
+      *) block "heredoc parser failed; command was denied fail-closed" ;;
+    esac
+    ;;
+esac
+
+# 1. Recursive forced delete (`rm -rf`) of a filesystem root, home, or top-level
+#    wildcard. Two gates ANDed: the command must invoke `rm` with BOTH a
+#    recursive and a force flag, AND name a catastrophic target. Splitting the
+#    flag check from the target check keeps each regex legible and testable.
+if printf '%s' "$command_for_guards" \
+  | grep -Eiq '(^|[^[:alnum:]_./-])rm([[:space:]]+-[[:alnum:]-]+)*[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)' \
+  || printf '%s' "$command_for_guards" \
+  | grep -Eiq '(^|[^[:alnum:]_./-])rm[[:space:]].*(-r\b.*[[:space:]]-f\b|-f\b.*[[:space:]]-r\b|--recursive\b.*--force\b|--force\b.*--recursive\b)'; then
+  if printf '%s' "$command_for_guards" \
+    | grep -Eq '([[:space:]]|=)(/|/\*|/\.\*?|~|~/\*?|\$HOME\b|\$\{HOME\}|\*)([[:space:]]|/?\*?$)'; then
+    block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
+  fi
+fi
+
+# 2. Force-pushing a protected branch. `--force-with-lease` is the safe,
+#    non-clobbering alternative and is intentionally NOT blocked.
+#
+#    The force flag AND the protected-branch name must appear in the SAME
+#    `git push` statement. Checking them independently over the whole command is
+#    a false-positive magnet: an unrelated `-f` (a `[ -f file ]` test, `rm -f`,
+#    `grep -f`, `tail -f`) plus an unrelated protected name (`--base main`,
+#    `origin/main`, `git fetch origin main`) alongside any feature-branch
+#    `git push` would wrongly block. So split the command into statements
+#    (`;`, `&&`, `||`, `|`, newlines), keep only the `git push` segments, and
+#    inspect each in isolation — a real `git push --force origin main` still
+#    matches, while a feature-branch push next to `[ -f ]`/`--base main` passes.
+# Normalize bash line-continuations (a trailing backslash + newline → space)
+# before segmenting the command. Without this, "git push --force origin
+# \<newline>main" splits into a segment matching --force but not `main`, letting a
+# protected force-push slip past. Uses awk (POSIX) instead of a GNU-only
+# `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
+normalized_command_str="$(printf '%s' "$command_for_guards" \
+  | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
+
+while IFS= read -r push_stmt; do
+  if printf '%s' "$push_stmt" \
+    | grep -Eiq '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
+    && ! printf '%s' "$push_stmt" | grep -Eiq -- '--force-with-lease' \
+    && printf '%s' "$push_stmt" \
+    | grep -Eiq '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
+    block "force-pushing a protected branch (use --force-with-lease, or push a feature branch)"
+  fi
+done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei '(^|[^[:alnum:]_-])git[[:space:]]+push\b')
+
+# 3. `git reset --hard` while the working tree has uncommitted changes — this
+#    silently discards them. Only blocks when the tree is actually dirty, so a
+#    clean-tree reset (a legitimate workflow) still passes.
+if printf '%s' "$command_for_guards" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
+  if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
+    && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+    block "git reset --hard on a dirty working tree would discard uncommitted changes (stash or commit first)"
+  fi
+fi
+
+# 4. Dropping or truncating a database / schema / table.
+if printf '%s' "$command_for_guards" \
+  | grep -Eiq '\b(drop[[:space:]]+(database|schema|table)|truncate[[:space:]]+(table[[:space:]]+)?[[:alnum:]_."`]+)\b'; then
+  block "destructive SQL (DROP/TRUNCATE) detected"
+fi
+
+# 5. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
+rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
+if [ -f "$rules_file" ]; then
+  while IFS= read -r rule || [ -n "$rule" ]; do
+    case "$rule" in
+      '' | '#'*) continue ;;
+    esac
+    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
+      block "matched a project custom safety rule (${rules_file##*/}): $rule"
+    fi
+  done <"$rules_file"
+fi
+
+exit 0

package/plugins/lisa-agy/hooks.json

@@ -11,5 +11,18 @@
         ]
       }
     ]
+  },
+  "lisa-parity-safety-net": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$HOME/.gemini/config/plugins/lisa/hooks/parity-safety-net.agy.sh\""
+          }
+        ]
+      }
+    ]
   }
 }

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.222.2",
+  "version": "2.222.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net-heredoc.py

@@ -0,0 +1,417 @@
+#!/usr/bin/env python3
+"""Classify the only heredoc forms whose payload is non-executable text."""
+
+from __future__ import annotations
+
+import re
+import shlex
+import sys
+from dataclasses import dataclass
+
+SAFE = 0
+UNSUPPORTED = 10
+MALFORMED = 20
+
+DELIMITER = r"(?P<delimiter>[A-Za-z_][A-Za-z0-9_]*)"
+BODY_CAT_MARKER = re.compile(
+    r"(?P<prefix>.*(?:^|\s)--body\s+)\"\$\(cat\s+<<'"
+    + DELIMITER
+    + r"'\s*$"
+)
+ALLOWED_GROUPS = {"issue", "pr"}
+ALLOWED_ACTIONS = {"create", "edit", "comment"}
+
+
+@dataclass(frozen=True)
+class Marker:
+    start: int
+    end: int
+    delimiter: str
+    strip_tabs: bool
+
+
+def shell_tokens(prefix: str) -> list[str] | None:
+    """Return literal simple-command tokens, rejecting executable shell syntax."""
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(prefix):
+        char = prefix[index]
+        if escaped:
+            escaped = False
+        elif state == "single":
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+            elif char == "`" or (
+                char == "$"
+                and index + 1 < len(prefix)
+                and prefix[index + 1] in "([{"):
+                return None
+        elif char == "'":
+            state = "single"
+        elif char == '"':
+            state = "double"
+        elif char == "\\":
+            escaped = True
+        elif char == "#" and (index == 0 or prefix[index - 1].isspace()):
+            return None
+        elif char in ";|&()<>`\n\r":
+            return None
+        elif char == "$" and index + 1 < len(prefix) and prefix[index + 1] in "([{":
+            return None
+        index += 1
+
+    if state != "plain" or escaped:
+        return None
+    try:
+        return shlex.split(prefix, comments=False, posix=True)
+    except ValueError:
+        return None
+
+
+def is_allowed_gh(tokens: list[str]) -> bool:
+    return (
+        len(tokens) >= 3
+        and tokens[0] == "gh"
+        and tokens[1] in ALLOWED_GROUPS
+        and tokens[2] in ALLOWED_ACTIONS
+    )
+
+
+def line_has_allowed_writer(line: str) -> bool:
+    """Find a writer after shell quote-concatenation and control operators."""
+    try:
+        lexer = shlex.shlex(line, posix=True, punctuation_chars=";&|()")
+        lexer.whitespace_split = True
+        lexer.commenters = "#"
+        tokens = list(lexer)
+    except ValueError:
+        return False
+    return any(
+        is_allowed_gh(tokens[index : index + 3])
+        for index in range(max(0, len(tokens) - 2))
+    )
+
+
+def has_body_file_stdin(tokens: list[str]) -> bool:
+    return "--body-file=-" in tokens or any(
+        tokens[index : index + 2] == ["--body-file", "-"]
+        for index in range(len(tokens) - 1)
+    )
+
+
+def exact_terminator(lines: list[str], delimiter: str, start: int) -> int | None:
+    for index in range(start, len(lines)):
+        if lines[index] == delimiter:
+            return index
+    return None
+
+
+def only_whitespace(lines: list[str], start: int) -> bool:
+    return all(not line.strip() for line in lines[start:])
+
+
+def classify_safe(command: str) -> str | None:
+    lines = command.splitlines()
+    if len(lines) < 2 or "\x00" in command or "\r" in command:
+        return None
+
+    header = lines[0]
+    body_cat = BODY_CAT_MARKER.search(header)
+    if body_cat is not None:
+        tokens = shell_tokens(body_cat.group("prefix"))
+        if tokens is None or not is_allowed_gh(tokens):
+            return None
+        terminator = exact_terminator(lines, body_cat.group("delimiter"), 1)
+        if terminator is None:
+            raise ValueError("unclosed body cat heredoc")
+        if terminator + 1 >= len(lines) or lines[terminator + 1].strip() != ')"':
+            raise ValueError("body cat substitution is not closed exactly")
+        if not only_whitespace(lines, terminator + 2):
+            raise ValueError("command follows body cat heredoc")
+        return body_cat.group("prefix") + '"<heredoc-text>"'
+
+    header_markers = top_level_markers(header)
+    if len(header_markers) != 1:
+        return None
+    direct = header_markers[0]
+    raw_marker = header[direct.start : direct.end]
+    if raw_marker != f"<<'{direct.delimiter}'" or header[direct.end :].strip():
+        return None
+    prefix = header[: direct.start]
+    tokens = shell_tokens(prefix)
+    if tokens is None or not is_allowed_gh(tokens) or not has_body_file_stdin(tokens):
+        return None
+    terminator = exact_terminator(lines, direct.delimiter, 1)
+    if terminator is None:
+        raise ValueError("unclosed direct heredoc")
+    if not only_whitespace(lines, terminator + 1):
+        raise ValueError("command follows direct heredoc")
+    return prefix.rstrip()
+
+
+def top_level_markers(command: str) -> list[Marker]:
+    """Find conservative top-level markers for malformed/duplicate detection."""
+    markers: list[Marker] = []
+    lines = command.splitlines()
+    offset = 0
+    for line in lines:
+        state = "plain"
+        escaped = False
+        index = 0
+        while index < len(line):
+            char = line[index]
+            if escaped:
+                escaped = False
+            elif state == "single":
+                if char == "'":
+                    state = "plain"
+            elif state == "double":
+                if char == '"':
+                    state = "plain"
+                elif char == "\\":
+                    escaped = True
+            elif char == "'":
+                state = "single"
+            elif char == '"':
+                state = "double"
+            elif char == "\\":
+                escaped = True
+            elif char == "#" and (index == 0 or line[index - 1].isspace()):
+                break
+            elif line.startswith("<<", index) and not line.startswith("<<<", index):
+                marker = parse_marker(line, index, offset)
+                if marker is not None:
+                    markers.append(marker)
+                    index = marker.end - offset - 1
+            index += 1
+        offset += len(line) + 1
+    return markers
+
+
+def unquoted_code_and_comment(line: str) -> tuple[str, str]:
+    """Return executable text and any shell comment, hiding quoted prose."""
+    code: list[str] = []
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(line):
+        char = line[index]
+        if escaped:
+            code.append(" ")
+            escaped = False
+        elif state == "single":
+            code.append(" ")
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            code.append(" ")
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+        elif char == "'":
+            code.append(" ")
+            state = "single"
+        elif char == '"':
+            code.append(" ")
+            state = "double"
+        elif char == "\\":
+            code.append(" ")
+            escaped = True
+        elif char == "#" and (index == 0 or line[index - 1].isspace()):
+            return "".join(code), line[index + 1 :]
+        else:
+            code.append(char)
+        index += 1
+    return "".join(code), ""
+
+
+def collapse_line_continuations(command: str) -> str:
+    """Remove Bash backslash-newline pairs outside single-quoted text."""
+    result: list[str] = []
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(command):
+        char = command[index]
+        if escaped:
+            result.append(char)
+            escaped = False
+        elif state == "single":
+            result.append(char)
+            if char == "'":
+                state = "plain"
+        elif char == "\\" and command.startswith("\n", index + 1):
+            index += 2
+            continue
+        elif char == "\\":
+            result.append(char)
+            escaped = True
+        elif char == "'" and state == "plain":
+            result.append(char)
+            state = "single"
+        elif char == '"':
+            result.append(char)
+            state = "plain" if state == "double" else "double"
+        else:
+            result.append(char)
+        index += 1
+    return "".join(result)
+
+
+def writer_owns_real_marker(command: str, markers: list[Marker]) -> bool:
+    """Detect a supported writer on a line containing a real heredoc marker."""
+    logical_command = collapse_line_continuations(command)
+    logical_markers = (
+        markers if logical_command == command else top_level_markers(logical_command)
+    )
+    lines = logical_command.splitlines()
+    for marker in logical_markers:
+        line_index = logical_command.count("\n", 0, marker.start)
+        if line_has_allowed_writer(lines[line_index]):
+            return True
+    return False
+
+
+def writer_has_commented_marker_and_following_code(command: str) -> bool:
+    """Reject fake writer markers whose following lines would execute."""
+    lines = command.splitlines()
+    for index, line in enumerate(lines):
+        _code, comment = unquoted_code_and_comment(line)
+        if (
+            line_has_allowed_writer(line)
+            and "<<" in comment
+            and any(candidate.strip() for candidate in lines[index + 1 :])
+        ):
+            return True
+    return False
+
+
+def has_active_command_substitution(command: str) -> bool:
+    """Detect substitutions outside single-quoted text and shell comments."""
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(command):
+        char = command[index]
+        if escaped:
+            escaped = False
+        elif state == "single":
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+            elif char == "`" or command.startswith("$(", index):
+                return True
+        elif char == "'":
+            state = "single"
+        elif char == '"':
+            state = "double"
+        elif char == "\\":
+            escaped = True
+        elif char == "#" and (
+            index == 0 or command[index - 1].isspace()
+        ):
+            newline = command.find("\n", index)
+            if newline < 0:
+                return False
+            index = newline
+        elif char == "`" or command.startswith("$(", index):
+            return True
+        index += 1
+    return False
+
+
+def parse_marker(line: str, start: int, offset: int) -> Marker | None:
+    index = start + 2
+    strip_tabs = False
+    if index < len(line) and line[index] == "-":
+        strip_tabs = True
+        index += 1
+    while index < len(line) and line[index] in " \t":
+        index += 1
+    if index >= len(line):
+        return None
+    quote = line[index] if line[index] in "'\"" else None
+    if quote:
+        index += 1
+        end = line.find(quote, index)
+        if end < 0:
+            return None
+        delimiter = line[index:end]
+        final = end + 1
+    else:
+        match = re.match(r"[A-Za-z_][A-Za-z0-9_]*", line[index:])
+        if match is None:
+            return None
+        delimiter = match.group(0)
+        final = index + len(delimiter)
+    if not delimiter:
+        return None
+    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+
+
+def marker_is_closed(command: str, marker: Marker) -> bool:
+    marker_line = command.count("\n", 0, marker.start)
+    lines = command.splitlines()
+    for line in lines[marker_line + 1 :]:
+        candidate = line.lstrip("\t") if marker.strip_tabs else line
+        if candidate == marker.delimiter:
+            return True
+    return False
+
+
+def main() -> int:
+    command = sys.stdin.read()
+    if "<<" not in command:
+        print(command, end="")
+        return SAFE
+    try:
+        sanitized = classify_safe(command)
+    except ValueError:
+        return MALFORMED
+    if sanitized is not None:
+        print(sanitized, end="")
+        return SAFE
+
+    logical_command = collapse_line_continuations(command)
+    markers = top_level_markers(logical_command)
+    if writer_has_commented_marker_and_following_code(logical_command):
+        return MALFORMED
+    if writer_owns_real_marker(logical_command, markers):
+        return MALFORMED
+    # Textual operators inside quotes or comments are not heredocs. Leave the
+    # raw command unchanged so ordinary guard matching proceeds normally.
+    if not markers and not has_active_command_substitution(logical_command):
+        return UNSUPPORTED
+
+    # A supported writer that failed the exact safe grammar is ambiguous: do
+    # not let chaining, alternate redirects, or an expanding delimiter turn a
+    # would-be payload exemption into a bypass.
+    if logical_command.splitlines() and line_has_allowed_writer(
+        logical_command.splitlines()[0]
+    ):
+        return MALFORMED
+
+    # Nested substitution plus a heredoc is executable shell syntax unless it
+    # matched the one exact quoted `--body "$(cat ...)"` form above.
+    if has_active_command_substitution(logical_command):
+        return MALFORMED
+    if len(markers) > 1:
+        return MALFORMED
+    if markers and not marker_is_closed(logical_command, markers[0]):
+        return MALFORMED
+    return UNSUPPORTED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())