@codyswann/lisa 2.295.2 → 2.295.3

package/dist/core/upstream-evidence-manifest.js

@@ -292,9 +292,9 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
     "plugins/src/base/hooks/inject-flow-context.sh": "f4ab07065762d592c0fc36be2e4918e767b293aaa4094b9d85d69010576c6dbf",
     "plugins/src/base/hooks/inject-rules.sh": "89a3780250e21aefa0eb83235523835ec0f83b25807b1ccc21f7a397a0459842",
     "plugins/src/base/hooks/install-pkgs.sh": "e9a13faba849a277410dde911ab102ee6f88ef915b33571bb1d4eef904172db5",
-    "plugins/src/base/hooks/parity-safety-net-heredoc.py": "c5301958ed8ca29b0de7b8521d299cdbc8c1c402df8d8fada6b5f173b6cf5dbe",
+    "plugins/src/base/hooks/parity-safety-net-heredoc.py": "5acc70d65304d8ef01bf3837cbf0fdc77aae6d6e47c0fec824692fe7091da20b",
     "plugins/src/base/hooks/parity-safety-net.agy.sh": "ce9bd2b4566ad9147e4ace56434cffbbe87edb4ccbb57549ab3fd9f4c671ced4",
-    "plugins/src/base/hooks/parity-safety-net.sh": "b83c5043a0f29b2d8851258acfe6906aab7922cd80f486e25220e55f26a8c0a5",
+    "plugins/src/base/hooks/parity-safety-net.sh": "f740f600b255742a50f28e5c9d09427c5783c4084e84052dca46bc1f0c94a187",
     "plugins/src/base/hooks/setup-jira-cli.sh": "a675f6b17ce7f0d6b9fb7daeba6d2bc59bcb48ef79b034076ea73b2b1e72ee09",
     "plugins/src/base/hooks/shell-write-nudge.sh": "69839af423f8792b1e52c71097316c3264425553031627c0a2f9409a9d5becd0",
     "plugins/src/base/hooks/threshold-ratchet-compare.mjs": "8bc4b379d7057b2fecf9cb35820c39efad0a65df7df49073786f996cc2a74810",

package/dist/opencode/plugin-templates/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/package.json

@@ -113,7 +113,7 @@
     "brace-expansion": ">=5.0.6"
   },
   "name": "@codyswann/lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-agy/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "NestJS-specific skills and migration write-protection hooks.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-nestjs",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-openclaw",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.295.2",
+  "version": "2.295.3",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/parity-safety-net-heredoc.py

@@ -28,6 +28,7 @@ class Marker:
     end: int
     delimiter: str
     strip_tabs: bool
+    quoted: bool
 
 
 def shell_tokens(prefix: str) -> list[str] | None:
@@ -357,7 +358,7 @@ def parse_marker(line: str, start: int, offset: int) -> Marker | None:
         final = index + len(delimiter)
     if not delimiter:
         return None
-    return Marker(offset + start, offset + final, delimiter, strip_tabs)
+    return Marker(offset + start, offset + final, delimiter, strip_tabs, quote is not None)
 
 
 def marker_is_closed(command: str, marker: Marker) -> bool:
@@ -370,6 +371,19 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
     return False
 
 
+def single_closed_quoted_nonwriter_heredoc(command: str, marker: Marker) -> bool:
+    """Allow guard scanning for inert quoted heredoc payloads outside gh writers."""
+    if not marker.quoted or not marker_is_closed(command, marker):
+        return False
+    line_end = command.find("\n", marker.start)
+    if line_end < 0:
+        line_end = len(command)
+    header = command[:line_end]
+    if has_active_command_substitution(header):
+        return False
+    return True
+
+
 def main() -> int:
     command = sys.stdin.read()
     if "<<" not in command:
@@ -402,6 +416,11 @@ def main() -> int:
     ):
         return MALFORMED
 
+    if len(markers) == 1 and single_closed_quoted_nonwriter_heredoc(
+        logical_command, markers[0]
+    ):
+        return UNSUPPORTED
+
     # Nested substitution plus a heredoc is executable shell syntax unless it
     # matched the one exact quoted `--body "$(cat ...)"` form above.
     if has_active_command_substitution(logical_command):

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -96,15 +96,21 @@ EOF
 # remain visible to every built-in and custom rule. Ambiguous or malformed
 # heredocs fail closed instead of guessing which text the shell would execute.
 #
-# block_heredoc() teaches the remediation the moment the wall is hit: heredoc
-# denials overwhelmingly come from `git commit -m "$(cat <<EOF …)"` attempts,
-# and a bare denial strands the agent with no path forward (gardener #1789).
+# block_heredoc() teaches the remediation the moment the wall is hit. Commit
+# heredocs need commit-message-file guidance; other heredocs should point agents
+# at script/payload files instead of implying every denial was a commit attempt.
 block_heredoc() {
-  block "$1
+  if printf '%s' "$command_str" | grep -Eq '(^|[^[:alnum:]_-])git[[:space:]]+([^;&|[:space:]]+[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+    block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
 Every commit must also carry a Co-authored-by trailer for a supported agent
 (Claude/Codex/OpenCode) — the commit-msg hook enforces this."
+  fi
+  block "$1
+Heredoc command invocations are blocked when Lisa cannot prove the payload is
+non-executable text.
+Fix: write the payload to a file and execute or pass that file explicitly."
 }
 
 command_for_guards="$command_str"