@codyswann/lisa 2.290.0 → 2.292.0

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -1,17 +1,50 @@
 #!/usr/bin/env bash
 # PreToolUse hook for Bash: a safety net that blocks destructive shell commands
 # before they run. Lisa-native reimplementation of the upstream
-# `safety-net@cc-marketplace` plugin's PreToolUse Bash-guard (parity work, issue
-# #1059). It does NOT port upstream code — it re-expresses the behavior in Lisa's
-# hook conventions, modeled on block-no-verify.sh.
+# `safety-net@cc-marketplace` plugin's PreToolUse Bash-guard (parity work,
+# issues #1059 and #1960). It does NOT port upstream code — it re-expresses the
+# behavior in Lisa's hook conventions, modeled on block-no-verify.sh.
 #
 # It reads the hook stdin JSON, inspects the proposed Bash command, and EXITS
 # NON-ZERO (2) to BLOCK when a known-destructive pattern matches:
-#   - `rm -rf /` (recursive forced delete of a root / home / wildcard path)
-#   - force-pushing a protected branch (main/master/production/release)
-#   - `git reset --hard` while the working tree is dirty (would discard work)
-#   - dropping or truncating a database/schema/table
-# Otherwise it exits 0 and the command proceeds.
+#   - `rm -rf` of a root / home / wildcard path (quote-aware boundaries, so
+#     `bash -c "rm -rf /"` and interpreter one-liners are caught too; the rm
+#     guards also match path-prefixed invocations like `/bin/rm` and `./rm`)
+#   - `rm -rf` of the cwd (`.`), a `..`-traversal path, a `~/`-anchored path,
+#     an absolute path outside the project (with a /tmp, /var/tmp, $TMPDIR
+#     allowance), a `$VAR` target other than $TMPDIR, or ANY recursive forced
+#     delete while cwd is $HOME
+#   - force-pushing a protected branch (main/master/production/prod/release) —
+#     feature-branch force-push stays allowed (sanctioned rebase workflow;
+#     deliberate divergence from upstream's any-branch block). Every git guard
+#     sees through leading git GLOBAL options (`-C <path>`, `-c <k>=<v>`,
+#     `--git-dir[=…]`, `--no-pager`, …), so `git -C /path <destructive>` cannot
+#     dodge the subcommand anchor
+#   - `git reset --hard` / `--merge` while the working tree is dirty. Deliberate
+#     divergence: upstream blocks unconditionally; Lisa allows clean-tree resets.
+#     Residual risk (documented, accepted): the dirty check runs in the hook's
+#     cwd at hook time, so a `cd elsewhere && git reset --hard` evades it.
+#   - `git checkout` discards (`--`, `-f/--force`, `--pathspec-from-file`,
+#     bare `.` — the bare-`.` block exceeds upstream)
+#   - `git switch --discard-changes` / `-f/--force`
+#   - `git restore` touching the worktree (allowed only with `--staged` and
+#     without `--worktree`)
+#   - `git stash drop` / `git stash clear`
+#   - `git clean` with force and no dry-run (`-n`/`--dry-run` anywhere wins)
+#   - `git branch -D` (or `-d` + `-f` in any spelling)
+#   - `git tag -d`, `git reflog delete`, `git worktree remove --force`
+#   - `find ... -delete`, `find ... -exec rm -rf`, `xargs ... rm -rf`
+#   - disk destroyers: `dd of=/dev/...`, `mkfs ... /dev/...`, `shred`
+#   - dropping or truncating a database/schema/table (Lisa-only guard)
+# Otherwise it exits 0 and the command proceeds. Malformed hook input fails
+# CLOSED: any parse error exits 2 (a non-2 exit would be a non-blocking hook
+# error in Claude Code, silently failing open).
+#
+# Known accepted false-positive class: this is a text scan, not a shell engine,
+# so display commands quoting a destructive string (`echo "docs about rm -rf /"`)
+# can match. Upstream exempts those via an engine-only DISPLAY_COMMANDS list a
+# grep hook cannot replicate. Workaround: quote-break the string or use the
+# gh-writer heredoc form, whose payload is stripped before the guards run.
 #
 # Operators extend the built-in rules with a project-local rule file — one
 # extended-regex (ERE) per line, blank lines and `#` comments ignored — managed
@@ -20,6 +53,13 @@
 #   ${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt
 set -euo pipefail
 
+# Fail CLOSED on any unexpected error (malformed JSON, missing jq, …): exit 2 so
+# the tool call is denied instead of surfacing a non-blocking hook warning.
+# Deliberately NOT `set -E`: errtrace would propagate this trap into command
+# substitutions (e.g. the heredoc parser call, whose non-zero exit codes are
+# meaningful protocol) and rewrite their status to 2 before it can be read.
+trap 'printf "%s\n" "Blocked by safety-net: hook failed while parsing its input; denying fail-closed." >&2; exit 2' ERR
+
 input="$(cat)"
 
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
@@ -90,22 +130,154 @@ case "$command_str" in
     ;;
 esac
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+matches() {
+  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
+}
+
+# Normalize bash line-continuations (a trailing backslash + newline → space)
+# before segmenting the command. Without this, "git push --force origin
+# \<newline>main" splits into a segment matching --force but not `main`, letting a
+# protected force-push slip past. Uses awk (POSIX) instead of a GNU-only
+# `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
+normalized_command_str="$(printf '%s' "$command_for_guards" \
+  | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
+
+# Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
+# crossing a statement separator, so a flag in a LATER statement can never be
+# attributed to an earlier git subcommand.
+readonly GIT_TOKENS='([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+'
+# Git GLOBAL options (`-C <path>`, `-c <k>=<v>`, `--git-dir[=…]`, `--no-pager`,
+# …) legally sit between `git` and its subcommand, so every subcommand guard
+# consumes them — otherwise `git -C /path checkout -- f` dodges the anchor
+# (issue #1960 security review F1). Shape: zero or more dash-led tokens, each
+# optionally followed by ONE non-dash value token, which covers both the
+# `--git-dir=/x` and `--git-dir /x` spellings without naming every option.
+readonly GIT_GLOBAL_OPTS='(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*'
+# Anchor for every git subcommand guard: word-bounded `git`, whitespace, then
+# any run of global options. Callers append the subcommand name directly.
+readonly GIT_CMD='(^|[^[:alnum:]_-])git[[:space:]]+'"$GIT_GLOBAL_OPTS"
+# An rm invocation: bare `rm` or a path whose basename is exactly `rm`
+# (`/bin/rm`, `./rm`) — issue #1960 security review F2. The optional prefix must
+# END IN `/` immediately before `rm`, so charm/confirm/informant/rmdir never
+# match. The preceding-char class still excludes `.`, `/`, and `-` to keep
+# `--rm`-style flags and `foo.rm` names out.
+readonly RM_CMD='(^|[^[:alnum:]_./-])([[:alnum:]_./-]*/)?rm'
+# rm invoked with BOTH a recursive and a force flag — clustered (-rf/-fr, any
+# extra letters) or split, in either order. The split gate pairs ANY recursive
+# form (short cluster containing r, or --recursive) with ANY force form (short
+# cluster containing f, or --force), so mixed spellings like `rm -r --force /`
+# and `rm --recursive -f /` cannot slip between the short/short and long/long
+# alternations (PR #1976 review).
+readonly RM_RF_CLUSTER="$RM_CMD"'([[:space:]]+-[[:alnum:]-]+)*[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)'
+readonly RM_RF_SPLIT="$RM_CMD"'(([[:space:]][^;&|]*)?[[:space:]](-[[:alnum:]]*r[[:alnum:]]*|--recursive)([[:space:]][^;&|]*)?[[:space:]](-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|$)|([[:space:]][^;&|]*)?[[:space:]](-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]][^;&|]*)?[[:space:]](-[[:alnum:]]*r[[:alnum:]]*|--recursive)([[:space:]]|$))'
+
 # 1. Recursive forced delete (`rm -rf`) of a filesystem root, home, or top-level
-#    wildcard. Two gates ANDed: the command must invoke `rm` with BOTH a
+#    wildcard. Two gates ANDed: the statement must invoke `rm` with BOTH a
 #    recursive and a force flag, AND name a catastrophic target. Splitting the
 #    flag check from the target check keeps each regex legible and testable.
-if printf '%s' "$command_for_guards" \
-  | grep -Eiq '(^|[^[:alnum:]_./-])rm([[:space:]]+-[[:alnum:]-]+)*[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)' \
-  || printf '%s' "$command_for_guards" \
-  | grep -Eiq '(^|[^[:alnum:]_./-])rm[[:space:]].*(-r\b.*[[:space:]]-f\b|-f\b.*[[:space:]]-r\b|--recursive\b.*--force\b|--force\b.*--recursive\b)'; then
-  if printf '%s' "$command_for_guards" \
-    | grep -Eq '([[:space:]]|=)(/|/\*|/\.\*?|~|~/\*?|\$HOME\b|\$\{HOME\}|\*)([[:space:]]|/?\*?$)'; then
+#    The target boundary classes include quote characters (issue #1960): without
+#    them, `bash -c "rm -rf /"` and interpreter one-liners like
+#    `python -c "… os.system('rm -rf /')"` slip through because the target is
+#    quote-adjacent instead of space-bounded.
+#    Both gates run PER STATEMENT inside the shared rm loop below (quality
+#    review S1): a harmless `/` in a LATER statement (`rm -rf build && cd /`)
+#    is never attributed to the rm in an earlier one.
+qc="'\""
+readonly RM_CATASTROPHIC_TARGET='([[:space:]='"$qc"'])(/|/\*|/\.\*?|~|~/\*?|\$HOME\b|\$\{HOME\}|\*)([[:space:]'"$qc"']|/?\*?['"$qc"']?$)'
+
+# 1b. rm target hardening (issue #1960). For every statement that invokes rm
+#     with recursive+force flags, additionally block when:
+#       - cwd is $HOME (any target is one argument away from wiping home), or
+#       - the target is the cwd itself (`.` / `./`), or
+#       - the target traverses out via `..`, or
+#       - the target is home-anchored (`~/…` — the shell expands it to $HOME at
+#         execution time, so it is always outside the project), or
+#       - the target is an absolute path outside the project — with an allowance
+#         for /tmp, /var/tmp, and $TMPDIR — or
+#       - the target is a `$VAR` expansion other than the sanctioned $TMPDIR.
+#     Globbing is disabled around the token walk so a literal `*` in the command
+#     is never expanded against the hook's own cwd.
+project_dir="${CLAUDE_PROJECT_DIR:-$PWD}"
+tmp_dir_allow="${TMPDIR:-/tmp}"
+tmp_dir_allow="${tmp_dir_allow%/}"
+[ -n "$tmp_dir_allow" ] || tmp_dir_allow="/tmp"
+while IFS= read -r rm_stmt; do
+  if ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_CLUSTER" \
+    && ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_SPLIT"; then
+    continue
+  fi
+  # Guard 1: catastrophic target named in the SAME statement as the rm -rf.
+  if printf '%s' "$rm_stmt" | grep -Eq -- "$RM_CATASTROPHIC_TARGET"; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
-fi
+  # Physical-path comparison (pwd -P): on macOS $HOME or the cwd may arrive via
+  # a symlink (/var → /private/var), and a string compare would miss the match.
+  if [ -n "${HOME:-}" ] \
+    && [ "$(pwd -P)" = "$(cd -- "$HOME" 2>/dev/null && pwd -P)" ]; then
+    block "recursive forced delete while the working directory is \$HOME (cd into a project first)"
+  fi
+  set -f
+  seen_rm=0
+  for raw_token in $rm_stmt; do
+    token="${raw_token#\"}"
+    token="${token#\'}"
+    token="${token%\"}"
+    token="${token%\'}"
+    if [ "$seen_rm" -eq 0 ]; then
+      # Path-prefixed spellings (`/bin/rm`, `./rm`) are still rm (F2).
+      case "$token" in
+        rm | */rm) seen_rm=1 ;;
+      esac
+      continue
+    fi
+    case "$token" in
+      -*) continue ;;
+      . | ./)
+        set +f
+        block "recursive forced delete of the current directory (rm -rf .)"
+        ;;
+      .. | ../* | */.. | */../*)
+        set +f
+        block "recursive forced delete of a path outside the project (.. traversal)"
+        ;;
+      '~' | '~'/*)
+        set +f
+        block "recursive forced delete of a home-anchored path (~/…) outside the project"
+        ;;
+      /*)
+        case "$token" in
+          "$project_dir" | "$project_dir"/* | /tmp | /tmp/* | /var/tmp | /var/tmp/* | "$tmp_dir_allow" | "$tmp_dir_allow"/*) : ;;
+          *)
+            set +f
+            block "recursive forced delete of an absolute path outside the project (only the project, /tmp, /var/tmp, and \$TMPDIR are allowed)"
+            ;;
+        esac
+        ;;
+      *'$'*)
+        case "$token" in
+          '$TMPDIR' | '$TMPDIR'/* | '${TMPDIR}' | '${TMPDIR}'/*) : ;;
+          *)
+            set +f
+            block "recursive forced delete of a variable-expanded target (unset or mistyped variables can point anywhere; \$TMPDIR is the only sanctioned dynamic target)"
+            ;;
+        esac
+        ;;
+    esac
+  done
+  set +f
+done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)' || true)
 
 # 2. Force-pushing a protected branch. `--force-with-lease` is the safe,
-#    non-clobbering alternative and is intentionally NOT blocked.
+#    non-clobbering alternative and is intentionally NOT blocked. Deliberate
+#    divergence from upstream (which blocks force-push on ANY branch):
+#    feature-branch force-push is a sanctioned rebase-and-push agent workflow.
 #
 #    The force flag AND the protected-branch name must appear in the SAME
 #    `git push` statement. Checking them independently over the whole command is
@@ -116,14 +288,6 @@ fi
 #    (`;`, `&&`, `||`, `|`, newlines), keep only the `git push` segments, and
 #    inspect each in isolation — a real `git push --force origin main` still
 #    matches, while a feature-branch push next to `[ -f ]`/`--base main` passes.
-# Normalize bash line-continuations (a trailing backslash + newline → space)
-# before segmenting the command. Without this, "git push --force origin
-# \<newline>main" splits into a segment matching --force but not `main`, letting a
-# protected force-push slip past. Uses awk (POSIX) instead of a GNU-only
-# `sed ':a;N;$!ba;…'`, which errors on BSD sed (macOS) and there silently no-ops.
-normalized_command_str="$(printf '%s' "$command_for_guards" \
-  | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
-
 while IFS= read -r push_stmt; do
   if printf '%s' "$push_stmt" \
     | grep -Eiq '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
@@ -133,25 +297,125 @@ while IFS= read -r push_stmt; do
     block "force-pushing a protected branch (use --force-with-lease, or push a feature branch)"
   fi
 done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei '(^|[^[:alnum:]_-])git[[:space:]]+push\b')
+  | grep -Ei -- "${GIT_CMD}push\b" || true)
 
-# 3. `git reset --hard` while the working tree has uncommitted changes — this
-#    silently discards them. Only blocks when the tree is actually dirty, so a
-#    clean-tree reset (a legitimate workflow) still passes.
-if printf '%s' "$command_for_guards" | grep -Eiq '(^|[^[:alnum:]_-])git[[:space:]]+reset\b.*--hard\b'; then
+# 3. `git reset --hard` / `git reset --merge` while the working tree has
+#    uncommitted changes — both silently discard them. Only blocks when the tree
+#    is actually dirty, so a clean-tree reset (a legitimate workflow) passes.
+#    Deliberate divergence from upstream's unconditional block; the accepted
+#    residual risk (dirty check runs at hook time in the hook's cwd) is
+#    documented in the header.
+if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+  fi
+fi
+
+# 4. `git checkout` worktree discards: the `--` pathspec form (with or without a
+#    ref), `-f/--force`, `--pathspec-from-file`, and bare `git checkout .`.
+#    Blocking bare `.` exceeds upstream (which allows any single positional) —
+#    issue #1960 names it explicitly: it discards the entire tree. Branch
+#    switches and creation (`-b`/`-B`) stay allowed.
+readonly GIT_CHECKOUT="${GIT_CMD}checkout"
+if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
+  || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
+  || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
+  || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+fi
+
+# 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.
+if matches "${GIT_CMD}switch${GIT_TOKENS}"'(--discard-changes|--force|-f)([[:space:]]|=|$)'; then
+  block "git switch discarding local changes (--discard-changes/-f/--force)"
+fi
+
+# 6. `git restore` defaults to overwriting the WORKTREE — a silent discard. Only
+#    the pure staging-area form is safe: `--staged` present and `--worktree`
+#    absent. Two conditions, because an ERE has no lookahead: `--staged
+#    --worktree` still discards, so `--worktree` blocks regardless of `--staged`.
+if matches "${GIT_CMD}"'restore([[:space:]]|$)'; then
+  if matches "${GIT_CMD}"'restore[^;&|]*--worktree' \
+    || ! matches "${GIT_CMD}"'restore[^;&|]*--staged'; then
+    block "git restore overwriting worktree files (only 'git restore --staged <path>' without --worktree is allowed)"
   fi
 fi
 
-# 4. Dropping or truncating a database / schema / table.
-if printf '%s' "$command_for_guards" \
-  | grep -Eiq '\b(drop[[:space:]]+(database|schema|table)|truncate[[:space:]]+(table[[:space:]]+)?[[:alnum:]_."`]+)\b'; then
+# 7. `git stash drop` / `git stash clear` destroy stashed work. push/pop/list/
+#    apply — the safe alternatives the reset guard recommends — stay allowed.
+if matches "${GIT_CMD}"'stash[[:space:]]+(drop|clear)([[:space:]]|$)'; then
+  block "git stash drop/clear destroys stashed work"
+fi
+
+# 8. `git clean` with a force flag wipes untracked files. A dry-run flag
+#    (`-n`/`--dry-run`) ANYWHERE wins — git itself performs no deletion under
+#    dry-run, so `git clean -fdn` is a safe preview.
+readonly GIT_CLEAN="${GIT_CMD}clean"
+if matches "${GIT_CLEAN}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
+  && ! matches "${GIT_CLEAN}${GIT_TOKENS}"'(-[[:alnum:]]*n[[:alnum:]]*|--dry-run)([[:space:]]|=|$)'; then
+  block "git clean --force deletes untracked files (preview with git clean -n first)"
+fi
+
+# 9. `git branch` force-delete loses unmerged commits: `-D`, `-d` combined with
+#    `-f` (clustered or split), or `--delete` + `--force`. Case-SENSITIVE so the
+#    safe `-d` (which refuses unmerged work) and rename `-m` stay allowed.
+readonly GIT_BRANCH="${GIT_CMD}branch"
+if matches_cs "${GIT_BRANCH}${GIT_TOKENS}"'-[[:alnum:]]*D[[:alnum:]]*([[:space:]]|$)' \
+  || { matches_cs "${GIT_BRANCH}${GIT_TOKENS}"'-[[:alnum:]]*d[[:alnum:]]*([[:space:]]|$)' \
+    && matches_cs "${GIT_BRANCH}${GIT_TOKENS}"'-[[:alnum:]]*f[[:alnum:]]*([[:space:]]|$)'; } \
+  || { matches "${GIT_BRANCH}"'[^;&|]*--delete' && matches "${GIT_BRANCH}"'[^;&|]*--force'; }; then
+  block "git branch force-delete (-D) loses unmerged commits (use -d, which refuses unmerged work)"
+fi
+
+# 10. Cheap destructive-ref guards: `git tag -d` (tags are shared refs),
+#     `git reflog delete` (erases recovery history), and
+#     `git worktree remove --force` (discards a dirty worktree). Tag deletion is
+#     case-SENSITIVE so annotated-tag `-a` and message `-m` flags never match.
+if matches_cs "${GIT_CMD}tag${GIT_TOKENS}"'(-[[:alnum:]]*d[[:alnum:]]*([[:space:]]|$)|--delete([[:space:]]|=|$))'; then
+  block "git tag -d deletes a shared ref"
+fi
+if matches "${GIT_CMD}"'reflog[[:space:]]+delete([[:space:]]|$)'; then
+  block "git reflog delete erases recovery history"
+fi
+if matches "${GIT_CMD}"'worktree[[:space:]]+remove[^;&|]*(--force([[:space:]]|=|$)|[[:space:]]-[[:alnum:]]*f[[:alnum:]]*([[:space:]]|$))'; then
+  block "git worktree remove --force discards a dirty worktree (remove without --force, which refuses dirty trees)"
+fi
+
+# 11. Deletion through find/xargs, where the target never appears as a literal
+#     argument: `find … -delete`, `find … -exec rm -rf`, and `xargs … rm -rf`
+#     (targets arrive from dynamic stdin — unauditable). Plain `rm` (no
+#     recursive+force) on find/xargs output stays allowed for normal cleanups.
+if matches '(^|[^[:alnum:]_./-])find[[:space:]][^;&|]*[[:space:]]-delete([[:space:]]|$)'; then
+  block "find -delete removes files tree-wide (use -print to preview, or an explicit rm on reviewed paths)"
+fi
+if matches '(^|[^[:alnum:]_./-])find[[:space:]][^;&|]*-exec[[:space:]]+rm[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)'; then
+  block "find -exec rm -rf performs a recursive forced delete on unreviewed paths"
+fi
+if matches '(^|[^[:alnum:]_./-])xargs[[:space:]]([^;&|]*[[:space:]])?rm[[:space:]]+(-[[:alnum:]]*r[[:alnum:]]*f|-[[:alnum:]]*f[[:alnum:]]*r)([[:space:]]|$)'; then
+  block "xargs rm -rf performs a recursive forced delete on dynamic stdin input"
+fi
+
+# 12. Disk destroyers, always on (exceeds upstream, which only scans these
+#     inside interpreter one-liners): writing to a raw /dev node via dd,
+#     formatting a device with mkfs, and shred's unrecoverable overwrite.
+#     dd/mkfs against regular files (imaging) stays allowed.
+if matches '(^|[^[:alnum:]_./-])dd[[:space:]]+([^;&|]*[[:space:]])?of=/dev/'; then
+  block "dd writing to a raw device (of=/dev/…) destroys it"
+fi
+if matches '(^|[^[:alnum:]_./-])mkfs(\.[[:alnum:]]+)?[[:space:]][^;&|]*/dev/'; then
+  block "mkfs formatting a device erases it"
+fi
+if matches '(^|[^[:alnum:]_./-])shred([[:space:]]|$)'; then
+  block "shred overwrites files unrecoverably"
+fi
+
+# 13. Dropping or truncating a database / schema / table (Lisa-only guard —
+#     upstream has no SQL protection; keep).
+if matches '\b(drop[[:space:]]+(database|schema|table)|truncate[[:space:]]+(table[[:space:]]+)?[[:alnum:]_."`]+)\b'; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
 
-# 5. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
+# 14. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
   while IFS= read -r rule || [ -n "$rule" ]; do

package/dist/sync/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AASD,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC;IACjD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;CAC5D,CAkCA,CAAC;AA6BF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EA0JjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AASD,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC;IACjD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;CAC5D,CAkCA,CAAC;AAyBF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EA0JjD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EA0C/C,CAAC"}

package/dist/sync/registry.js

@@ -10,6 +10,7 @@
  * completely missing.
  * @module sync/registry
  */
+import { ENV_DONE_LABEL_DEFAULTS, JIRA_DONE_STATUS_DEFAULTS, } from "../core/deploy-status-sync.js";
 import { DEFAULT_PROJECT_RULES_FILE } from "../core/project-config.js";
 import { validateHealthSchedule } from "../health/contract.js";
 const WHEN_TRACKER_JIRA = "tracker=jira";
@@ -65,11 +66,7 @@ const BUILD_LABEL_DEFAULTS = {
     claimed: "status:in-progress",
     blocked: "status:blocked",
     human_needed: "human-needed",
-    done: {
-        dev: "status:on-dev",
-        staging: "status:on-stg",
-        production: "status:done",
-    },
+    done: ENV_DONE_LABEL_DEFAULTS,
 };
 const PRD_LABEL_DEFAULTS = {
     draft: "prd-draft",
@@ -187,7 +184,7 @@ export const SYNC_REGISTRY = [
             claimed: "In Progress",
             review: "Code Review",
             blocked: "Blocked",
-            done: { dev: "On Dev", staging: "On Stg", production: "Done" },
+            done: JIRA_DONE_STATUS_DEFAULTS,
         },
         relevantWhen: ["jira", WHEN_TRACKER_JIRA],
         description: "JIRA workflow status names per lifecycle role",

package/dist/sync/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAmD/D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAS3C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGnC;IACH,OAAO,EAAE;QACP,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;YACpC,SAAS,EAAE,oBAAoB;SAChC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;YAC5C,SAAS,EAAE,kBAAkB;SAC9B;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;YAC7C,SAAS,EAAE,oBAAoB;SAChC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;YACpC,SAAS,EAAE,oBAAoB;SAChC;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;YACrD,SAAS,EAAE,oBAAoB;SAChC;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,kBAAkB,CAAC;YAC3B,SAAS,EAAE,oBAAoB;SAChC;QACD,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,mBAAmB,CAAC;YAC5B,KAAK,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;YACzD,SAAS,EAAE,wBAAwB;SACpC;KACF;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE;QACJ,GAAG,EAAE,eAAe;QACpB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,aAAa;KAC1B;CACO,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;SAC/D;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAE;QACxD,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,SAAS;KAC/D;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAE;QACxD,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QACzD,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,SAAS;KAChE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QACzD,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,SAAS;KAChE;CACF,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sync/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAmD/D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAS3C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAGnC;IACH,OAAO,EAAE;QACP,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;YACpC,SAAS,EAAE,oBAAoB;SAChC;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC;YAC5C,SAAS,EAAE,kBAAkB;SAC9B;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;YAC7C,SAAS,EAAE,oBAAoB;SAChC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;YACpC,SAAS,EAAE,oBAAoB;SAChC;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;YACrD,SAAS,EAAE,oBAAoB;SAChC;QACD,MAAM,EAAE;YACN,KAAK,EAAE,CAAC,kBAAkB,CAAC;YAC3B,SAAS,EAAE,oBAAoB;SAChC;QACD,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,mBAAmB,CAAC;YAC5B,KAAK,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;YACzD,SAAS,EAAE,wBAAwB;SACpC;KACF;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAc;IACnC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;CACnE,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,KAAK,EAAE,cAAc;IACrB,OAAO,EAAE,oBAAoB;IAC7B,OAAO,EAAE,gBAAgB;IACzB,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,uBAAuB;CACrB,CAAC;AAEX,MAAM,kBAAkB,GAAc;IACpC,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,qBAAqB;CAChC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAA6B;IACrD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,YAAY,EAAE,0BAA0B;QACxC,WAAW,EAAE,8DAA8D;KAC5E;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,YAAY,EAAE,iBAAiB;QAC/B,SAAS,EAAE;YACT,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAE;SAC9C;QACD,WAAW,EAAE,4DAA4D;KAC1E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACrE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzD,WAAW,EACT,2EAA2E;KAC9E;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,YAAY,EAAE;YACZ,mBAAmB,EAAE,EAAE;YACvB,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,EAAE;SACxB;QACD,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,WAAW,EAAE,kCAAkC;KAChD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE;QAC/C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxD,WAAW,EAAE,iCAAiC;KAC/C;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9C,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACjE,WAAW,EAAE,mCAAmC;KACjD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;QACxD,WAAW,EAAE,8CAA8C;KAC5D;IACD;QACE,qEAAqE;QACrE,mEAAmE;QACnE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7B,WAAW,EACT,wEAAwE;KAC3E;IACD;QACE,GAAG,EAAE,SAAS;QACd,YAAY,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,QAAQ,EAAE,MAAM;YAChB,YAAY,EAAE,EAAE;YAChB,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,EAAE;gBACV,YAAY,EAAE,CAAC;gBACf,wBAAwB,EAAE,CAAC;gBAC3B,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,CAAC;aAChB;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,+BAA+B;aAC5C;YACD;gBACE,WAAW,EAAE,yBAAyB;gBACtC,UAAU,EAAE,6BAA6B;aAC1C;SACF;QACD,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,yBAAyB;SAChC;QACD,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,aAAa;QAClB,YAAY,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAC9C,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACzC,WAAW,EAAE,oBAAoB;KAClC;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACtE,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,GAAG,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE;YAChE,GAAG,EAAE,kBAAkB;SACxB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;QACjE,WAAW,EAAE,uCAAuC;KACrD;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,wDAAwD;KACtE;IACD;QACE,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,UAAU;SACrB;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC5C,WAAW,EAAE,+CAA+C;KAC7D;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,GAAG;QACjB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,gCAAgC;KAC9C;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAA2B;IACnD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,oCAAoC,EAAE;IACnE;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAE;QACxD,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,SAAS;KAC/D;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAE;QACxD,YAAY,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACtD,SAAS,EAAE,uBAAuB;KACnC;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;QACvD,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QAC1D,YAAY,EAAE,CAAC,mBAAmB,CAAC;QACnC,SAAS,EAAE,2BAA2B,CAAC,OAAO,CAAC,MAAO,CAAC,SAAS;KACjE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QACzD,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,SAAS;KAChE;IACD;QACE,GAAG,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAE;QACzD,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,SAAS,EAAE,2BAA2B,CAAC,MAAM,CAAC,MAAO,CAAC,SAAS;KAChE;CACF,CAAC"}

package/expo/merge/.claude/settings.json

@@ -5,7 +5,7 @@
   },
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "playwright@claude-plugins-official": true,

package/harper-fabric/merge/.claude/settings.json

@@ -6,7 +6,7 @@
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true,
     "playwright@claude-plugins-official": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "coderabbit@claude-plugins-official": true,

package/nestjs/merge/.claude/settings.json

@@ -5,7 +5,7 @@
   },
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "coderabbit@claude-plugins-official": true,

package/package.json

@@ -113,7 +113,7 @@
     "brace-expansion": ">=5.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.290.0",
+  "version": "2.292.0",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/phaser/merge/.claude/settings.json

@@ -6,7 +6,7 @@
   "enabledPlugins": {
     "typescript-lsp@claude-plugins-official": true,
     "playwright@claude-plugins-official": true,
-    "safety-net@cc-marketplace": true,
+    "safety-net@cc-marketplace": false,
     "code-simplifier@claude-plugins-official": true,
     "code-review@claude-plugins-official": true,
     "coderabbit@claude-plugins-official": true,

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.290.0",
+  "version": "2.292.0",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.290.0",
+  "version": "2.292.0",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-parity-safety-net-rules/SKILL.md

@@ -53,11 +53,47 @@ RULES_FILE="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-
 
 ### Built-in guards (always on)
 
-1. `rm -rf` of a filesystem root, `$HOME`/`~`, or a top-level wildcard.
-2. Force-pushing a protected branch (`main`/`master`/`production`/`release`).
-   `--force-with-lease` is intentionally allowed.
-3. `git reset --hard` while the working tree is **dirty** (would discard work).
-4. Destructive SQL — `DROP DATABASE/SCHEMA/TABLE`, `TRUNCATE TABLE`.
+1. `rm -rf` of a filesystem root, `$HOME`/`~`, or a top-level wildcard — with
+   quote-aware boundaries, so wrapper/interpreter forms like
+   `bash -c "rm -rf /"` and `python -c "… os.system('rm -rf /')"` match too.
+   Path-prefixed spellings (`/bin/rm`, `./rm`) count as `rm` for every rm
+   guard.
+2. `rm -rf` target hardening: the cwd itself (`.`/`./`), `..`-traversal paths,
+   home-anchored `~/…` paths, absolute paths outside the project (`/tmp`,
+   `/var/tmp`, and `$TMPDIR` are allowed), `$VAR` targets other than `$TMPDIR`,
+   and **any** recursive forced delete while the working directory is `$HOME`.
+3. Force-pushing a protected branch
+   (`main`/`master`/`production`/`prod`/`release`). `--force-with-lease` is
+   intentionally allowed, and so is force-pushing a feature branch (sanctioned
+   rebase workflow). Acceptable parity divergence: a refspec force-push
+   (`git push origin +main`) is not blocked — upstream 1.0.6 allows it too.
+4. `git reset --hard` / `git reset --merge` while the working tree is **dirty**
+   (would discard work). Clean-tree resets are intentionally allowed.
+5. `git checkout` discards: the `--` pathspec form (with or without a ref),
+   `-f`/`--force`, `--pathspec-from-file`, and bare `git checkout .`.
+   Branch switching and `-b`/`-B` creation stay allowed.
+6. `git switch --discard-changes` / `-f`/`--force`.
+7. `git restore` touching the worktree — only `git restore --staged <path>`
+   without `--worktree` is allowed (unstaging is safe).
+8. `git stash drop` / `git stash clear` (push/pop/list/apply stay allowed).
+9. `git clean` with a force flag and no dry-run — `-n`/`--dry-run` anywhere
+   makes it a safe preview.
+10. `git branch -D` (or `-d` combined with `-f`, clustered or split);
+    safe `-d` and rename `-m` stay allowed.
+11. `git tag -d`, `git reflog delete`, `git worktree remove --force`.
+12. Deletion via `find … -delete`, `find … -exec rm -rf`, and `xargs … rm -rf`
+    (plain non-recursive `rm` on find/xargs output stays allowed).
+13. Disk destroyers: `dd of=/dev/…`, `mkfs … /dev/…`, `shred`.
+14. Destructive SQL — `DROP DATABASE/SCHEMA/TABLE`, `TRUNCATE TABLE`.
+
+Every git guard sees through leading git **global options** (`-C <path>`,
+`-c <k>=<v>`, `--git-dir[=…]`, `--no-pager`, …), so `git -C /path <destructive>`
+is screened the same as `git <destructive>`.
+
+Malformed hook input fails **closed** (exit 2 denies the command). A text-scan
+hook cannot exempt display commands, so prose like
+`echo "docs about rm -rf /"` can false-positive — quote-break the string or use
+the gh-writer heredoc form (payload is stripped before the guards run).
 
 ## View the current rules