@codyswann/lisa 2.295.1 → 2.295.3

package/dist/core/upstream-evidence-manifest.js

@@ -92,7 +92,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "expo/github-rulesets/playwright.json": "b57ccd12f768a1466a9681528858e59764bd0efedcbcb3a96c2fb40719bbd579",
     "expo/merge/.claude/settings.json": "e97b33d7ad86b71abba94ab957d725e34c3cafca455e92fba0b29ebabc3b73d1",
     "expo/merge/.oxlintrc.json": "2a0ea2191abd5b377aed4b525a4a97d3eefb1d9e41c845c02ee0daac75df6b1f",
-    "expo/package-lisa/package.lisa.json": "bd2a5220b83c55f777c24fccf07f58bb277b526edc31a472232a8f34a8cfedd2",
+    "expo/package-lisa/package.lisa.json": "c0b971d10d40215ea0c0fa1bf1635322ed20ede330306e47e028bae8af03444d",
     "harper-fabric/copy-contents/.prettierignore": "478c782f4c5611187e21584dfd5522e37fc636c5eb03394fea3db45321c6712c",
     "harper-fabric/copy-contents/gitignore": "d091c40fd0ea3068491f1be0d6510090ae872ca95d0d058ef4595d6492d13897",
     "harper-fabric/copy-overwrite/.github/dependabot.yml": "e28fde0d906478b3fb7d6b7fc16f7fc5a4a0a20d8160f547f2b4be97c90578b7",
@@ -292,9 +292,9 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/inject-flow-context.sh": "f4ab07065762d592c0fc36be2e4918e767b293aaa4094b9d85d69010576c6dbf",
     "plugins/src/base/hooks/inject-rules.sh": "89a3780250e21aefa0eb83235523835ec0f83b25807b1ccc21f7a397a0459842",
     "plugins/src/base/hooks/install-pkgs.sh": "e9a13faba849a277410dde911ab102ee6f88ef915b33571bb1d4eef904172db5",
-    "plugins/src/base/hooks/parity-safety-net-heredoc.py": "c5301958ed8ca29b0de7b8521d299cdbc8c1c402df8d8fada6b5f173b6cf5dbe",
+    "plugins/src/base/hooks/parity-safety-net-heredoc.py": "5acc70d65304d8ef01bf3837cbf0fdc77aae6d6e47c0fec824692fe7091da20b",
     "plugins/src/base/hooks/parity-safety-net.agy.sh": "ce9bd2b4566ad9147e4ace56434cffbbe87edb4ccbb57549ab3fd9f4c671ced4",
-    "plugins/src/base/hooks/parity-safety-net.sh": "b83c5043a0f29b2d8851258acfe6906aab7922cd80f486e25220e55f26a8c0a5",
+    "plugins/src/base/hooks/parity-safety-net.sh": "f740f600b255742a50f28e5c9d09427c5783c4084e84052dca46bc1f0c94a187",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",
@@ -1035,7 +1035,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "typescript/github-rulesets/quality-checks.json": "89b9e09267cdb65865728d0e873de9c1225b8ca796e67f06fa8b72ccf6d4515e",
     "typescript/merge/.claude/settings.json": "834e6456cae81f45073bbbb08bf731fef043efb30cae2658cb4a59f17e66d165",
     "typescript/merge/.oxlintrc.json": "4debc093acfd263eb81ae15894073ebf098513204f45f40b83fb8fa5353fa1f8",
-    "typescript/package-lisa/package.lisa.json": "7e99286c549c79b1c02c07a4313dcfe5b41b4ebb80a6fbbb8741dd74dc5f454d",
+    "typescript/package-lisa/package.lisa.json": "e661329de6f19550953e3522c0dfbc643397ca9a27e975f23437b64bd50b475c",
     "ui/README.md": "deeb35e767ea5dd2883268835ea3ad21cbad9fa63ec8d8ff5e200f0e2a7d2751",
     "ui/index.html": "a66598558cb95873aa674055d3bc3335654f7c615013bae0fa8effa35f64c351",
 });

package/dist/opencode/plugin-templates/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/expo/package-lisa/package.lisa.json

@@ -98,6 +98,7 @@
     },
     "resolutions": {
       "@isaacs/brace-expansion": "^5.0.1",
+      "brace-expansion": ">=5.0.7",
       "eslint-plugin-react-hooks": "^7.0.0",
       "fast-xml-parser": "^5.10.1",
       "tar": ">=7.5.11",
@@ -105,6 +106,7 @@
     },
     "overrides": {
       "@isaacs/brace-expansion": "^5.0.1",
+      "brace-expansion": ">=5.0.7",
       "eslint-plugin-react-hooks": "^7.0.0",
       "fast-xml-parser": "^5.10.1",
       "zod-validation-error": "^4.0.0",

package/package.json

@@ -113,7 +113,7 @@
     "brace-expansion": ">=5.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-agy/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.1",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/typescript/package-lisa/package.lisa.json

@@ -27,6 +27,7 @@
     },
     "resolutions": {
       "@isaacs/brace-expansion": "^5.0.1",
+      "brace-expansion": ">=5.0.7",
       "axios": ">=1.15.2",
       "esbuild": ">=0.28.1",
       "handlebars": ">=4.7.9",
@@ -40,6 +41,7 @@
     },
     "overrides": {
       "@isaacs/brace-expansion": "^5.0.1",
+      "brace-expansion": ">=5.0.7",
       "axios": ">=1.15.2",
       "esbuild": ">=0.28.1",
       "handlebars": ">=4.7.9",