@codyswann/lisa 2.222.2 → 2.222.3

package/plugins/src/base/hooks/parity-safety-net-heredoc.py

@@ -0,0 +1,417 @@
+#!/usr/bin/env python3
+"""Classify the only heredoc forms whose payload is non-executable text."""
+
+from __future__ import annotations
+
+import re
+import shlex
+import sys
+from dataclasses import dataclass
+
+SAFE = 0
+UNSUPPORTED = 10
+MALFORMED = 20
+
+DELIMITER = r"(?P<delimiter>[A-Za-z_][A-Za-z0-9_]*)"
+BODY_CAT_MARKER = re.compile(
+    r"(?P<prefix>.*(?:^|\s)--body\s+)\"\$\(cat\s+<<'"
+    + DELIMITER
+    + r"'\s*$"
+)
+ALLOWED_GROUPS = {"issue", "pr"}
+ALLOWED_ACTIONS = {"create", "edit", "comment"}
+
+
+@dataclass(frozen=True)
+class Marker:
+    start: int
+    end: int
+    delimiter: str
+    strip_tabs: bool
+
+
+def shell_tokens(prefix: str) -> list[str] | None:
+    """Return literal simple-command tokens, rejecting executable shell syntax."""
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(prefix):
+        char = prefix[index]
+        if escaped:
+            escaped = False
+        elif state == "single":
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+            elif char == "`" or (
+                char == "$"
+                and index + 1 < len(prefix)
+                and prefix[index + 1] in "([{"):
+                return None
+        elif char == "'":
+            state = "single"
+        elif char == '"':
+            state = "double"
+        elif char == "\\":
+            escaped = True
+        elif char == "#" and (index == 0 or prefix[index - 1].isspace()):
+            return None
+        elif char in ";|&()<>`\n\r":
+            return None
+        elif char == "$" and index + 1 < len(prefix) and prefix[index + 1] in "([{":
+            return None
+        index += 1
+
+    if state != "plain" or escaped:
+        return None
+    try:
+        return shlex.split(prefix, comments=False, posix=True)
+    except ValueError:
+        return None
+
+
+def is_allowed_gh(tokens: list[str]) -> bool:
+    return (
+        len(tokens) >= 3
+        and tokens[0] == "gh"
+        and tokens[1] in ALLOWED_GROUPS
+        and tokens[2] in ALLOWED_ACTIONS
+    )
+
+
+def line_has_allowed_writer(line: str) -> bool:
+    """Find a writer after shell quote-concatenation and control operators."""
+    try:
+        lexer = shlex.shlex(line, posix=True, punctuation_chars=";&|()")
+        lexer.whitespace_split = True
+        lexer.commenters = "#"
+        tokens = list(lexer)
+    except ValueError:
+        return False
+    return any(
+        is_allowed_gh(tokens[index : index + 3])
+        for index in range(max(0, len(tokens) - 2))
+    )
+
+
+def has_body_file_stdin(tokens: list[str]) -> bool:
+    return "--body-file=-" in tokens or any(
+        tokens[index : index + 2] == ["--body-file", "-"]
+        for index in range(len(tokens) - 1)
+    )
+
+
+def exact_terminator(lines: list[str], delimiter: str, start: int) -> int | None:
+    for index in range(start, len(lines)):
+        if lines[index] == delimiter:
+            return index
+    return None
+
+
+def only_whitespace(lines: list[str], start: int) -> bool:
+    return all(not line.strip() for line in lines[start:])
+
+
+def classify_safe(command: str) -> str | None:
+    lines = command.splitlines()
+    if len(lines) < 2 or "\x00" in command or "\r" in command:
+        return None
+
+    header = lines[0]
+    body_cat = BODY_CAT_MARKER.search(header)
+    if body_cat is not None:
+        tokens = shell_tokens(body_cat.group("prefix"))
+        if tokens is None or not is_allowed_gh(tokens):
+            return None
+        terminator = exact_terminator(lines, body_cat.group("delimiter"), 1)
+        if terminator is None:
+            raise ValueError("unclosed body cat heredoc")
+        if terminator + 1 >= len(lines) or lines[terminator + 1].strip() != ')"':
+            raise ValueError("body cat substitution is not closed exactly")
+        if not only_whitespace(lines, terminator + 2):
+            raise ValueError("command follows body cat heredoc")
+        return body_cat.group("prefix") + '"<heredoc-text>"'
+
+    header_markers = top_level_markers(header)
+    if len(header_markers) != 1:
+        return None
+    direct = header_markers[0]
+    raw_marker = header[direct.start : direct.end]
+    if raw_marker != f"<<'{direct.delimiter}'" or header[direct.end :].strip():
+        return None
+    prefix = header[: direct.start]
+    tokens = shell_tokens(prefix)
+    if tokens is None or not is_allowed_gh(tokens) or not has_body_file_stdin(tokens):
+        return None
+    terminator = exact_terminator(lines, direct.delimiter, 1)
+    if terminator is None:
+        raise ValueError("unclosed direct heredoc")
+    if not only_whitespace(lines, terminator + 1):
+        raise ValueError("command follows direct heredoc")
+    return prefix.rstrip()
+
+
+def top_level_markers(command: str) -> list[Marker]:
+    """Find conservative top-level markers for malformed/duplicate detection."""
+    markers: list[Marker] = []
+    lines = command.splitlines()
+    offset = 0
+    for line in lines:
+        state = "plain"
+        escaped = False
+        index = 0
+        while index < len(line):
+            char = line[index]
+            if escaped:
+                escaped = False
+            elif state == "single":
+                if char == "'":
+                    state = "plain"
+            elif state == "double":
+                if char == '"':
+                    state = "plain"
+                elif char == "\\":
+                    escaped = True
+            elif char == "'":
+                state = "single"
+            elif char == '"':
+                state = "double"
+            elif char == "\\":
+                escaped = True
+            elif char == "#" and (index == 0 or line[index - 1].isspace()):
+                break
+            elif line.startswith("<<", index) and not line.startswith("<<<", index):
+                marker = parse_marker(line, index, offset)
+                if marker is not None:
+                    markers.append(marker)
+                    index = marker.end - offset - 1
+            index += 1
+        offset += len(line) + 1
+    return markers
+
+
+def unquoted_code_and_comment(line: str) -> tuple[str, str]:
+    """Return executable text and any shell comment, hiding quoted prose."""
+    code: list[str] = []
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(line):
+        char = line[index]
+        if escaped:
+            code.append(" ")
+            escaped = False
+        elif state == "single":
+            code.append(" ")
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            code.append(" ")
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+        elif char == "'":
+            code.append(" ")
+            state = "single"
+        elif char == '"':
+            code.append(" ")
+            state = "double"
+        elif char == "\\":
+            code.append(" ")
+            escaped = True
+        elif char == "#" and (index == 0 or line[index - 1].isspace()):
+            return "".join(code), line[index + 1 :]
+        else:
+            code.append(char)
+        index += 1
+    return "".join(code), ""
+
+
+def collapse_line_continuations(command: str) -> str:
+    """Remove Bash backslash-newline pairs outside single-quoted text."""
+    result: list[str] = []
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(command):
+        char = command[index]
+        if escaped:
+            result.append(char)
+            escaped = False
+        elif state == "single":
+            result.append(char)
+            if char == "'":
+                state = "plain"
+        elif char == "\\" and command.startswith("\n", index + 1):
+            index += 2
+            continue
+        elif char == "\\":
+            result.append(char)
+            escaped = True
+        elif char == "'" and state == "plain":
+            result.append(char)
+            state = "single"
+        elif char == '"':
+            result.append(char)
+            state = "plain" if state == "double" else "double"
+        else:
+            result.append(char)
+        index += 1
+    return "".join(result)
+
+
+def writer_owns_real_marker(command: str, markers: list[Marker]) -> bool:
+    """Detect a supported writer on a line containing a real heredoc marker."""
+    logical_command = collapse_line_continuations(command)
+    logical_markers = (
+        markers if logical_command == command else top_level_markers(logical_command)
+    )
+    lines = logical_command.splitlines()
+    for marker in logical_markers:
+        line_index = logical_command.count("\n", 0, marker.start)
+        if line_has_allowed_writer(lines[line_index]):
+            return True
+    return False
+
+
+def writer_has_commented_marker_and_following_code(command: str) -> bool:
+    """Reject fake writer markers whose following lines would execute."""
+    lines = command.splitlines()
+    for index, line in enumerate(lines):
+        _code, comment = unquoted_code_and_comment(line)
+        if (
+            line_has_allowed_writer(line)
+            and "<<" in comment
+            and any(candidate.strip() for candidate in lines[index + 1 :])
+        ):
+            return True
+    return False
+
+
+def has_active_command_substitution(command: str) -> bool:
+    """Detect substitutions outside single-quoted text and shell comments."""
+    state = "plain"
+    escaped = False
+    index = 0
+    while index < len(command):
+        char = command[index]
+        if escaped:
+            escaped = False
+        elif state == "single":
+            if char == "'":
+                state = "plain"
+        elif state == "double":
+            if char == '"':
+                state = "plain"
+            elif char == "\\":
+                escaped = True
+            elif char == "`" or command.startswith("$(", index):
+                return True
+        elif char == "'":
+            state = "single"
+        elif char == '"':
+            state = "double"
+        elif char == "\\":
+            escaped = True
+        elif char == "#" and (
+            index == 0 or command[index - 1].isspace()
+        ):
+            newline = command.find("\n", index)
+            if newline < 0:
+                return False
+            index = newline
+        elif char == "`" or command.startswith("$(", index):
+            return True
+        index += 1
+    return False
+
+
+def parse_marker(line: str, start: int, offset: int) -> Marker | None:
+    index = start + 2
+    strip_tabs = False
+    if index < len(line) and line[index] == "-":
+        strip_tabs = True
+        index += 1
+    while index < len(line) and line[index] in " \t":
+        index += 1
+    if index >= len(line):
+        return None
+    quote = line[index] if line[index] in "'\"" else None
+    if quote:
+        index += 1
+        end = line.find(quote, index)
+        if end < 0:
+            return None
+        delimiter = line[index:end]
+        final = end + 1
+    else:
+        match = re.match(r"[A-Za-z_][A-Za-z0-9_]*", line[index:])
+        if match is None:
+            return None
+        delimiter = match.group(0)
+        final = index + len(delimiter)
+    if not delimiter:
+        return None
+    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+
+
+def marker_is_closed(command: str, marker: Marker) -> bool:
+    marker_line = command.count("\n", 0, marker.start)
+    lines = command.splitlines()
+    for line in lines[marker_line + 1 :]:
+        candidate = line.lstrip("\t") if marker.strip_tabs else line
+        if candidate == marker.delimiter:
+            return True
+    return False
+
+
+def main() -> int:
+    command = sys.stdin.read()
+    if "<<" not in command:
+        print(command, end="")
+        return SAFE
+    try:
+        sanitized = classify_safe(command)
+    except ValueError:
+        return MALFORMED
+    if sanitized is not None:
+        print(sanitized, end="")
+        return SAFE
+
+    logical_command = collapse_line_continuations(command)
+    markers = top_level_markers(logical_command)
+    if writer_has_commented_marker_and_following_code(logical_command):
+        return MALFORMED
+    if writer_owns_real_marker(logical_command, markers):
+        return MALFORMED
+    # Textual operators inside quotes or comments are not heredocs. Leave the
+    # raw command unchanged so ordinary guard matching proceeds normally.
+    if not markers and not has_active_command_substitution(logical_command):
+        return UNSUPPORTED
+
+    # A supported writer that failed the exact safe grammar is ambiguous: do
+    # not let chaining, alternate redirects, or an expanding delimiter turn a
+    # would-be payload exemption into a bypass.
+    if logical_command.splitlines() and line_has_allowed_writer(
+        logical_command.splitlines()[0]
+    ):
+        return MALFORMED
+
+    # Nested substitution plus a heredoc is executable shell syntax unless it
+    # matched the one exact quoted `--body "$(cat ...)"` form above.
+    if has_active_command_substitution(logical_command):
+        return MALFORMED
+    if len(markers) > 1:
+        return MALFORMED
+    if markers and not marker_is_closed(logical_command, markers[0]):
+        return MALFORMED
+    return UNSUPPORTED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugins/src/base/hooks/parity-safety-net.agy.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Antigravity (agy) PreToolUse adapter for Lisa's canonical parity safety net.
+#
+# agy sends `{toolCall:{name:"run_command",args:{CommandLine:"..."}}}` and
+# expects an allow/deny JSON object on stdout. The canonical hook consumes the
+# Claude Bash-hook envelope and communicates denial with exit status 2. This
+# adapter only translates protocols; all classification stays in the canonical
+# parity-safety-net.sh and parity-safety-net-heredoc.py files beside it.
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"decision":"allow"}'
+  exit 0
+}
+
+deny() {
+  local reason="$1"
+  if command -v jq >/dev/null 2>&1; then
+    jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
+  else
+    printf '%s\n' '{"decision":"deny","reason":"Blocked by safety-net: the required JSON runtime is unavailable, so this command could not be classified safely."}'
+  fi
+  exit 0
+}
+
+input="$(cat 2>/dev/null || true)"
+[ -z "$input" ] && allow
+command -v jq >/dev/null 2>&1 || deny "Blocked by safety-net: the required JSON runtime is unavailable, so this command could not be classified safely."
+
+tool_name="$(printf '%s' "$input" | jq -r '.toolCall.name // empty' 2>/dev/null || true)"
+[ "$tool_name" != "run_command" ] && allow
+command_str="$(printf '%s' "$input" | jq -r '.toolCall.args.CommandLine // empty' 2>/dev/null || true)"
+[ -z "$command_str" ] && allow
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+canonical_hook="$hook_dir/parity-safety-net.sh"
+[ -r "$canonical_hook" ] || deny "Blocked by safety-net: the canonical safety policy is unavailable, so this command could not be classified safely."
+
+canonical_input="$(jq -cn --arg command "$command_str" '{tool_name:"Bash",tool_input:{command:$command}}')"
+canonical_output=""
+canonical_status=0
+if canonical_output="$(printf '%s' "$canonical_input" | /bin/bash "$canonical_hook" 2>&1)"; then
+  canonical_status=0
+else
+  canonical_status=$?
+fi
+
+[ "$canonical_status" -eq 0 ] && allow
+[ -n "$canonical_output" ] || canonical_output="Blocked by safety-net: the canonical safety policy failed closed."
+deny "$canonical_output"

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -32,57 +32,6 @@ if [ -z "$command_str" ]; then
   exit 0
 fi
 
-command_for_guards="$command_str"
-if command -v python3 >/dev/null 2>&1; then
-  command_for_guards="$(SAFETY_NET_COMMAND="$command_str" python3 - <<'PY'
-import os
-import re
-
-command = os.environ.get("SAFETY_NET_COMMAND", "")
-
-
-def strip_heredocs(text: str) -> str:
-    lines = text.splitlines()
-    output = []
-    pending = []
-    # Quoted strings are matched (and thereby skipped over) as plain,
-    # non-capturing alternatives BEFORE the heredoc-marker alternative gets a
-    # chance to run, so a "<<MARKER"-looking sequence inside a string literal
-    # (e.g. `echo "hello <<MARKER"`) is never mistaken for a real heredoc
-    # start. Only the heredoc-marker alternative captures a group.
-    marker_pattern = re.compile(
-        r'"(?:\\.|[^"])*"|\'[^\']*\''
-        r"|<<-?\s*(?:'([^']+)'|\"([^\"]+)\"|([A-Za-z_][A-Za-z0-9_]*))"
-    )
-    index = 0
-    while index < len(lines):
-        line = lines[index]
-        output.append(line)
-        pending.extend(
-            next(group for group in match.groups() if group)
-            for match in marker_pattern.finditer(line)
-            if any(match.groups())
-        )
-        index += 1
-        # Consume every pending heredoc body in order (chained same-line
-        # heredocs, e.g. `cat <<A <<B`, push more than one marker at once).
-        # Do NOT stop after the first terminator — dropping the `break` lets
-        # this loop keep dropping body lines until each pending marker is
-        # matched, instead of leaking the second body back into `output`
-        # where the destructive-pattern guards would see it.
-        while pending and index < len(lines):
-            if lines[index].strip() == pending[0]:
-                output.append(lines[index])
-                pending.pop(0)
-            index += 1
-    return "\n".join(output)
-
-
-print(strip_heredocs(command), end="")
-PY
-)"
-fi
-
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 block() {
@@ -96,6 +45,39 @@ EOF
   exit 2
 }
 
+# Heredoc payloads are data only for a deliberately narrow set of GitHub CLI
+# write commands. A companion parser proves that shape before removing payload
+# text from the destructive-command scans below. Unknown executable heredocs
+# remain visible to every built-in and custom rule. Ambiguous or malformed
+# heredocs fail closed instead of guessing which text the shell would execute.
+command_for_guards="$command_str"
+case "$command_str" in
+  *'<<'*)
+    hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    heredoc_parser="$hook_dir/parity-safety-net-heredoc.py"
+    if ! command -v python3 >/dev/null 2>&1 || [ ! -r "$heredoc_parser" ]; then
+      block "cannot safely classify heredoc command because its parser runtime is unavailable"
+    fi
+    if ! printf '%s\n' "$command_str" | /bin/bash -n >/dev/null 2>&1; then
+      block "malformed heredoc command failed shell syntax validation"
+    fi
+
+    parser_status=0
+    if parser_output="$(printf '%s' "$command_str" | python3 "$heredoc_parser" 2>/dev/null)"; then
+      parser_status=0
+    else
+      parser_status=$?
+    fi
+
+    case "$parser_status" in
+      0) command_for_guards="$parser_output" ;;
+      10) command_for_guards="$command_str" ;;
+      20) block "malformed or ambiguous heredoc command cannot be safely classified" ;;
+      *) block "heredoc parser failed; command was denied fail-closed" ;;
+    esac
+    ;;
+esac
+
 # 1. Recursive forced delete (`rm -rf`) of a filesystem root, home, or top-level
 #    wildcard. Two gates ANDed: the command must invoke `rm` with BOTH a
 #    recursive and a force flag, AND name a catastrophic target. Splitting the

package/scripts/copy-opencode-plugin-templates.mjs

@@ -15,6 +15,11 @@ import path from "node:path";
 const repoRoot = path.resolve(import.meta.dirname, "..");
 const sourceDir = path.join(repoRoot, "src", "opencode", "plugin-templates");
 const destDir = path.join(repoRoot, "dist", "opencode", "plugin-templates");
+const canonicalHookDir = path.join(repoRoot, "plugins", "src", "base", "hooks");
+const canonicalSupportFiles = [
+  "parity-safety-net.sh",
+  "parity-safety-net-heredoc.py",
+];
 
 fs.rmSync(destDir, { recursive: true, force: true });
 fs.mkdirSync(destDir, { recursive: true });
@@ -27,3 +32,10 @@ for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
   const destPath = path.join(destDir, entry.name);
   fs.copyFileSync(sourcePath, destPath);
 }
+
+for (const filename of canonicalSupportFiles) {
+  fs.copyFileSync(
+    path.join(canonicalHookDir, filename),
+    path.join(destDir, filename)
+  );
+}

package/scripts/generate-agy-plugin-artifacts.mjs

@@ -18,8 +18,8 @@
  * hooks.json must be at root; the command points at the absolute installed path
  * via `$HOME`). Only events agy supports map: PreToolUse / PostToolUse /
  * PreInvocation / PostInvocation / Stop. SessionStart is NOT supported, so
- * install-pkgs / setup-jira-cli CANNOT ship as agy hooks — only block-no-verify
- * (PreToolUse) maps. Only the BASE plugin manifest carries the universal hooks,
+ * install-pkgs / setup-jira-cli CANNOT ship as agy hooks. Portable PreToolUse
+ * guards map through thin agy-protocol adapters. Only the BASE plugin manifest carries the universal hooks,
  * so only `lisa-agy` gets a hooks.json; stack variants emit none.
  *
  * MCP (user-global, NOT plugin-bundled): agy ignores plugin-bundled MCP and only
@@ -216,6 +216,15 @@ const AGY_PLUGIN_HOOKS = [
     event: "PreToolUse",
     matcher: "run_command",
     agyScript: "block-no-verify.agy.sh",
+    supportScripts: [],
+  },
+  {
+    sourceScript: "parity-safety-net.sh",
+    hookName: "lisa-parity-safety-net",
+    event: "PreToolUse",
+    matcher: "run_command",
+    agyScript: "parity-safety-net.agy.sh",
+    supportScripts: ["parity-safety-net.sh", "parity-safety-net-heredoc.py"],
   },
 ];
 
@@ -257,11 +266,13 @@ function sourceReferencesScript(sourceHooks, scriptName) {
 function emitAgyPluginHooks(srcDir, outDir, sourceHooks, installDirName) {
   const applicable = AGY_PLUGIN_HOOKS.filter(h => {
     if (!sourceReferencesScript(sourceHooks, h.sourceScript)) return false;
-    const scriptSource = path.join(srcDir, "hooks", h.agyScript);
-    if (!fs.existsSync(scriptSource)) {
-      throw new Error(
-        `Missing agy hook script for ${h.sourceScript}: ${scriptSource}`
-      );
+    for (const script of [h.agyScript, ...(h.supportScripts ?? [])]) {
+      const scriptSource = path.join(srcDir, "hooks", script);
+      if (!fs.existsSync(scriptSource)) {
+        throw new Error(
+          `Missing agy hook script for ${h.sourceScript}: ${scriptSource}`
+        );
+      }
     }
     return true;
   });
@@ -293,9 +304,12 @@ function emitAgyPluginHooks(srcDir, outDir, sourceHooks, installDirName) {
   // Copy the agy-protocol scripts into the variant's hooks/ subdir.
   const hooksDir = path.join(outDir, "hooks");
   fs.mkdirSync(hooksDir, { recursive: true });
-  for (const h of applicable) {
-    const scriptSource = path.join(srcDir, "hooks", h.agyScript);
-    const scriptDest = path.join(hooksDir, h.agyScript);
+  const scripts = new Set(
+    applicable.flatMap(h => [h.agyScript, ...(h.supportScripts ?? [])])
+  );
+  for (const script of scripts) {
+    const scriptSource = path.join(srcDir, "hooks", script);
+    const scriptDest = path.join(hooksDir, script);
     fs.copyFileSync(scriptSource, scriptDest);
     fs.chmodSync(scriptDest, 0o755);
   }