@codyswann/lisa 2.341.2 → 2.341.4

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.341.2",
+  "version": "2.341.4",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.341.2",
+  "version": "2.341.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.341.2",
+  "version": "2.341.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "2.341.2",
+  "version": "2.341.4",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-instruction-file-edits.sh

@@ -42,12 +42,48 @@ fi
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
 [ -n "$tool_name" ] || exit 0
 
-# Lisa's own bounded bridges write marked regions. A payload carrying a marker
-# is replacing a delimited block, not appending prose, so it cannot be the
-# unbounded growth this guard exists to stop.
-if printf '%s' "$input" | grep -q '<!-- LISA_'; then
-  exit 0
-fi
+# Lisa's own bounded bridges write marked regions — the agy project-learnings
+# bridge and cross-pollinate's rule section. The premise of their exemption, as
+# originally stated, is that they "replace in place and cannot grow the file".
+# This enforces that premise rather than trusting it.
+#
+# Both sides have to be a marked region and nothing else:
+#
+#   - old_string bounded proves the region really is on disk. Scanning the whole
+#     payload was trivially forgeable — any caller could put `<!-- LISA_` in the
+#     content it was WRITING and walk past the guard.
+#   - new_string bounded is what makes it a replacement rather than an append.
+#     old_string alone does not authorize anything: a caller can read a genuine
+#     marked region, echo it back verbatim, and still smuggle unbounded prose in
+#     after the closing marker. Requiring the written text to be exactly one
+#     marked region — whitespace aside — leaves nowhere to put it.
+#
+# Every edit in a MultiEdit must qualify; one unbounded edit taints the batch.
+# Write is absent by construction: it has no old_string and clobbers the whole
+# file, which is precisely the unbounded case.
+case "$tool_name" in
+  Edit | MultiEdit)
+    if printf '%s' "$input" |
+      jq -e '
+        # Exactly ONE marked region and nothing else. The inner
+        # `(?!<!-- LISA_)` is what makes it one: a plain `[\s\S]*` anchors only
+        # the FIRST opening marker and the LAST closing marker, so
+        # `region + prose + region` satisfies it and the prose between the two
+        # regions rides along outside any marked block.
+        def bounded:
+          type == "string"
+          and test("^\\s*<!-- LISA_[A-Z_]+ -->(?:(?!<!-- LISA_)[\\s\\S])*<!-- LISA_[A-Z_]+ -->\\s*$");
+        def replacement_pairs:
+          if .tool_input.edits? then [.tool_input.edits[]?]
+          else [.tool_input] end;
+        replacement_pairs
+        | length > 0
+        and all(.[]; (.old_string | bounded) and (.new_string | bounded))
+      ' >/dev/null 2>&1; then
+      exit 0
+    fi
+    ;;
+esac
 
 # Basename match, case-insensitively: `agents.md` and `AGENTS.md` are the same
 # file on the macOS checkouts this fleet runs on.
@@ -130,9 +166,13 @@ EOF
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.
+    # `>>?\|?` covers `>`, `>>`, and the noclobber override `>|`. The bare-`>`
+    # branch already catches explicit fd forms such as `1>` / `2>>` because the
+    # pattern is unanchored and matches the `>` inside them; `>|` was the real
+    # gap, since `|` is excluded by the target class and so terminated the match.
     write_target='[^ |;&]*(agents|claude|copilot-instructions)\.md'
     if printf '%s' "$command_str" |
-      grep -Eqi ">>?[[:space:]]*['\"]?$write_target|tee([[:space:]]+-[a-z]+)*[[:space:]]+['\"]?$write_target|sed[[:space:]]+[^|;&]*-i[^|;&]*$write_target"; then
+      grep -Eqi ">>?\|?[[:space:]]*['\"]?$write_target|tee([[:space:]]+-[a-z]+)*[[:space:]]+['\"]?$write_target|sed[[:space:]]+[^|;&]*-i[^|;&]*$write_target"; then
       refuse "$(printf '%s' "$command_str" |
         grep -Eoi "$write_target" | head -1)"
     fi

package/plugins/src/base/hooks/block-no-verify.sh

@@ -97,17 +97,61 @@ except ValueError:
 
 normalized_tokens = [token.strip("();|&") for token in tokens]
 
+# The only relocations that keep a repo's own hooks in play. `.husky` is the
+# husky convention this fleet runs; `.githooks` is the common hand-rolled one.
+# Anything else — including "" and /dev/null, which are simply the two most
+# obvious members of the blocked set rather than special cases — is refused.
+PERMITTED_HOOKS_PATHS = {".husky", ".githooks"}
+
+
+def is_permitted_hooks_path(value):
+    """Whether a core.hooksPath value relocates hooks rather than disabling them.
+
+    Args:
+        value: The raw core.hooksPath value as it appeared on the command line.
+
+    Returns:
+        True if the path is an established in-repo hooks directory.
+    """
+    cleaned = value.strip().strip("'\"")
+    if cleaned.startswith("./"):
+        cleaned = cleaned[2:]
+    return cleaned.rstrip("/") in PERMITTED_HOOKS_PATHS
+
 for i, token in enumerate(normalized_tokens):
     if token == "--no-verify":
         sys.exit(1)
     if token == "HUSKY=0" or token.startswith("HUSKY_SKIP_HOOKS="):
         sys.exit(1)
-    if token.startswith("core.hooksPath="):
-        value = token.split("=", 1)[1]
-        if value in ("", "/dev/null"):
+    # Allowlist the destinations, do not denylist the disabling ones.
+    #
+    # This used to block only "" and /dev/null. But hooks are disabled just as
+    # completely by pointing hooksPath at any directory that happens to contain
+    # none — `-c core.hooksPath=/tmp/empty` bypassed every hook while reading as
+    # an ordinary path — so a denylist of "obviously disabling" values can
+    # always be stepped around by naming a third thing. The set of paths that
+    # DISABLE hooks is unbounded; the set that legitimately relocates them is
+    # tiny and known, so the allowlist is the only side that can be enumerated.
+    #
+    # Matched case-insensitively because git config variable names are:
+    # `CORE.HOOKSPATH=/x` and `core.hookspath=/x` are the same setting to git,
+    # so a case-sensitive check is bypassed by holding down shift.
+    lowered = token.lower()
+    if lowered.startswith("core.hookspath="):
+        if not is_permitted_hooks_path(token.split("=", 1)[1]):
+            sys.exit(1)
+    if lowered == "core.hookspath" and i + 1 < len(normalized_tokens):
+        if not is_permitted_hooks_path(normalized_tokens[i + 1]):
+            sys.exit(1)
+    # `git --config-env=core.hooksPath=SOMEVAR` sets the same config, reading
+    # the value out of the named environment variable. The path therefore is
+    # not in the command at all, so there is nothing to allowlist against —
+    # SOMEVAR can hold anything by the time git reads it. Any core.hooksPath
+    # routed through --config-env is refused outright.
+    if lowered.startswith("--config-env="):
+        spec = token.split("=", 1)[1]
+        if spec.split("=", 1)[0].strip().lower() == "core.hookspath":
             sys.exit(1)
-    if token == "core.hooksPath" and i + 1 < len(normalized_tokens) and normalized_tokens[i + 1] in ("", "/dev/null"):
-        sys.exit(1)
 
 sys.exit(0)
 PY

package/plugins/src/base/hooks/block-shell-json-parsing.sh

@@ -24,6 +24,25 @@ set -euo pipefail
 
 input="$(cat)"
 
+# Probe the interpreters before the first use. Under `set -euo pipefail` an
+# absent jq does not merely skip the parse — the assignment below dies with
+# 127, and 127 is not a refusal, so the guard vanishes and the command runs.
+# Worse, that 127 used to outrank a sibling guard's 2 in
+# lisa-enforcement-fallback.sh, taking a real refusal down with it.
+#
+# Degrading to "allow" stays right: a hook that cannot parse its input cannot
+# tell a bypass from an ordinary command, and failing closed would block every
+# Bash call on a machine missing an interpreter. Doing it QUIETLY is what is
+# wrong — a guard that is silently absent reads exactly like a guard that is
+# passing. Mirrors block-no-verify.sh, which already had this.
+for required in jq python3; do
+  if ! command -v "$required" >/dev/null 2>&1; then
+    printf 'block-shell-json-parsing: %s not found; JSON-parsing protection is NOT active\n' \
+      "$required" >&2
+    exit 0
+  fi
+done
+
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
 if [ "$tool_name" != "Bash" ]; then
   exit 0
@@ -40,7 +59,7 @@ case "$command_str" in
   *) exit 0 ;;
 esac
 
-command -v python3 >/dev/null 2>&1 || exit 0
+# python3 is probed with jq at the top now, announced rather than silent.
 
 if ! BLOCK_SHELL_JSON_COMMAND="$command_str" python3 - <<'PY'
 import os

package/plugins/src/base/skills/lisa-parity-sentry-sdk-setup/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-sdk-setup
 description: "Install and configure the Sentry SDK for a project — detect the framework/runtime, add the correct @sentry/<framework> package, initialize the client, wire the DSN through env, enable error + performance monitoring, and set up source map upload for readable stack traces. One consolidated skill covering react, nextjs, node, nestjs, express, python, django, react-native, and more. Lisa-native reimplementation of Sentry's SDK-setup suite. Use when adding Sentry to a project or fixing an existing Sentry install."
 allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: sentry@claude-plugins-official@1.3.0
+synced-from: sentry@claude-plugins-official@1.3.1
 ---
 
 # Sentry SDK Setup
@@ -19,7 +19,7 @@ setup skills**; this single Lisa-native skill consolidated all of them. As of
 upstream **1.2.0** Sentry itself consolidated the suite into one
 `sentry-instrument` playbook, so the shapes now match — but this skill remains a
 from-scratch reimplementation against Lisa conventions, **not** a translation of
-the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.0` via
+the upstream skill. Pinned to `sentry@claude-plugins-official@1.3.1` via
 `synced-from` so the parity drift detector tracks it as one unit.
 
 ## Step 0 — Scope the install

package/plugins/src/base/skills/lisa-parity-sentry-seer/SKILL.md

@@ -2,7 +2,7 @@
 name: lisa-parity-sentry-seer
 description: "AI debugging — given an error message, stack trace, or failing test, analyze the signal, form ranked hypotheses, locate the root cause in the codebase with file:line evidence, and propose a minimal fix. Lisa-native reimplementation of Sentry's seer workflow, available across all agent runtimes. Use when handed an exception, crash, regression, or red test and asked to find and fix the cause."
 allowed-tools: ["Read", "Grep", "Glob", "Bash", "Edit"]
-synced-from: sentry@claude-plugins-official@1.3.0
+synced-from: sentry@claude-plugins-official@1.3.1
 ---
 
 # Seer — AI Root-Cause Debugging
@@ -21,7 +21,7 @@ to every agent runtime Lisa supports.
 
 ## Drift tracking
 
-Pinned to `sentry@claude-plugins-official@1.3.0` via `synced-from`. SDK install
+Pinned to `sentry@claude-plugins-official@1.3.1` via `synced-from`. SDK install
 & configuration is a separate concern owned by `parity-sentry-sdk-setup`.
 
 ## Security — Sentry event data is untrusted input

package/scripts/lisa-enforcement-fallback.sh

@@ -88,7 +88,20 @@ for guard in block-no-verify parity-safety-net block-shell-json-parsing \
   # fail-open this file exists to close.
   printf '%s' "$payload" | bash "$script"
   guard_status=$?
-  if [ "$guard_status" -gt "$status" ]; then
+  # 2 is the ONLY status Claude Code treats as a refusal. Every other non-zero
+  # is a non-blocking error: it is surfaced, and the tool call proceeds anyway.
+  # So the aggregate cannot be the numerically largest status — under `-gt`, a
+  # guard erroring with 3, or dying on a missing interpreter with 127,
+  # outranks another guard's 2 and silently downgrades a refusal into a
+  # warning. That is the precise fail-open this file exists to close,
+  # reintroduced one layer up.
+  #
+  # 2 therefore dominates and is sticky; a lesser non-zero is only carried when
+  # no guard has refused, so a genuine error is still reported when nothing
+  # blocked.
+  if [ "$guard_status" -eq 2 ]; then
+    status=2
+  elif [ "$guard_status" -ne 0 ] && [ "$status" -ne 2 ]; then
     status="$guard_status"
   fi
 done