@codyswann/lisa 2.341.3 → 2.341.4

package/plugins/src/base/hooks/block-shell-json-parsing.sh

@@ -24,6 +24,25 @@ set -euo pipefail
 
 input="$(cat)"
 
+# Probe the interpreters before the first use. Under `set -euo pipefail` an
+# absent jq does not merely skip the parse — the assignment below dies with
+# 127, and 127 is not a refusal, so the guard vanishes and the command runs.
+# Worse, that 127 used to outrank a sibling guard's 2 in
+# lisa-enforcement-fallback.sh, taking a real refusal down with it.
+#
+# Degrading to "allow" stays right: a hook that cannot parse its input cannot
+# tell a bypass from an ordinary command, and failing closed would block every
+# Bash call on a machine missing an interpreter. Doing it QUIETLY is what is
+# wrong — a guard that is silently absent reads exactly like a guard that is
+# passing. Mirrors block-no-verify.sh, which already had this.
+for required in jq python3; do
+  if ! command -v "$required" >/dev/null 2>&1; then
+    printf 'block-shell-json-parsing: %s not found; JSON-parsing protection is NOT active\n' \
+      "$required" >&2
+    exit 0
+  fi
+done
+
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
 if [ "$tool_name" != "Bash" ]; then
   exit 0
@@ -40,7 +59,7 @@ case "$command_str" in
   *) exit 0 ;;
 esac
 
-command -v python3 >/dev/null 2>&1 || exit 0
+# python3 is probed with jq at the top now, announced rather than silent.
 
 if ! BLOCK_SHELL_JSON_COMMAND="$command_str" python3 - <<'PY'
 import os

package/scripts/lisa-enforcement-fallback.sh

@@ -88,7 +88,20 @@ for guard in block-no-verify parity-safety-net block-shell-json-parsing \
   # fail-open this file exists to close.
   printf '%s' "$payload" | bash "$script"
   guard_status=$?
-  if [ "$guard_status" -gt "$status" ]; then
+  # 2 is the ONLY status Claude Code treats as a refusal. Every other non-zero
+  # is a non-blocking error: it is surfaced, and the tool call proceeds anyway.
+  # So the aggregate cannot be the numerically largest status — under `-gt`, a
+  # guard erroring with 3, or dying on a missing interpreter with 127,
+  # outranks another guard's 2 and silently downgrades a refusal into a
+  # warning. That is the precise fail-open this file exists to close,
+  # reintroduced one layer up.
+  #
+  # 2 therefore dominates and is sticky; a lesser non-zero is only carried when
+  # no guard has refused, so a genuine error is still reported when nothing
+  # blocked.
+  if [ "$guard_status" -eq 2 ]; then
+    status=2
+  elif [ "$guard_status" -ne 0 ] && [ "$status" -ne 2 ]; then
     status="$guard_status"
   fi
 done