@codyswann/lisa 2.342.0 → 2.342.2

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi
 

package/package.json

@@ -120,7 +120,7 @@
     }
   },
   "name": "@codyswann/lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi
 

package/plugins/lisa/hooks/threshold-ratchet.mjs

@@ -56,6 +56,15 @@ const GIT = GIT_LOCATIONS.find(candidate => fs.existsSync(candidate)) ?? "git";
 
 /** Git flag shared by every changed-file listing. */
 const NAME_ONLY = "--name-only";
+/**
+ * Suppress rename detection when discovering changed files.
+ *
+ * With it on, `git diff --name-only` reports a rename as the destination path
+ * only. Moving a watched threshold file to an unwatched path therefore lists
+ * one name the ratchet does not watch, and the loosening at the old path is
+ * never compared. Both sides have to be visible for the gate to mean anything.
+ */
+const NO_RENAMES = "--no-renames";
 
 /**
  * Run git, returning stdout or null on any failure.
@@ -87,7 +96,7 @@ function git(args, cwd) {
  */
 function resolvePlan(mode, root, baseRef, onlyFiles) {
   if (mode === "staged") {
-    const diff = git(["diff", "--cached", NAME_ONLY], root);
+    const diff = git(["diff", "--cached", NAME_ONLY, NO_RENAMES], root);
     if (diff === null) return null;
     return {
       files: diff.split("\n").filter(Boolean),
@@ -99,7 +108,7 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
     if (!baseRef) return null;
     const mergeBase = git(["merge-base", baseRef, "HEAD"], root)?.trim();
     if (!mergeBase) return null;
-    const diff = git(["diff", NAME_ONLY, mergeBase, "HEAD"], root);
+    const diff = git(["diff", NAME_ONLY, NO_RENAMES, mergeBase, "HEAD"], root);
     if (diff === null) return null;
     return {
       files: diff.split("\n").filter(Boolean),
@@ -107,7 +116,7 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
       readCurrent: f => git(["show", `HEAD:${f}`], root),
     };
   }
-  const diff = git(["diff", NAME_ONLY, "HEAD"], root);
+  const diff = git(["diff", NAME_ONLY, NO_RENAMES, "HEAD"], root);
   if (diff === null) return null;
   return {
     files: onlyFiles ?? diff.split("\n").filter(Boolean),
@@ -122,6 +131,31 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
   };
 }
 
+/**
+ * Decide the exit code when the ratchet cannot determine what changed.
+ *
+ * `staged` and `base` are enforcement gates — pre-commit and CI. A gate that
+ * cannot see the change set has not found the change set clean, and returning 0
+ * reports exactly that. It fails closed, loudly.
+ *
+ * `hook` is advisory feedback to an agent mid-edit, fires on every tool call,
+ * and blocks nothing downstream. Failing it closed on a transient git hiccup
+ * would turn a hint into an outage, so it stays permissive — but still says so.
+ * @param {"hook"|"staged"|"base"} mode Comparison mode
+ * @param {string} reason What could not be determined
+ * @returns {number} Process exit code
+ */
+function undeterminable(mode, reason) {
+  process.stderr.write(
+    `threshold-ratchet: ${reason}; the ratchet could not run in ${mode} mode\n`
+  );
+  if (mode === "hook") return 0;
+  process.stderr.write(
+    "threshold-ratchet: failing closed — an enforcement gate that cannot read the change set has not verified it\n"
+  );
+  return 1;
+}
+
 /**
  * Run the ratchet for a mode, print the report, and return the exit code.
  * @param {"hook"|"staged"|"base"} mode Comparison mode
@@ -131,9 +165,9 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
  */
 function run(mode, baseRef, onlyFiles) {
   const root = git(["rev-parse", "--show-toplevel"])?.trim();
-  if (!root) return 0;
+  if (!root) return undeterminable(mode, "not a git repository");
   const plan = resolvePlan(mode, root, baseRef, onlyFiles);
-  if (!plan) return 0;
+  if (!plan) return undeterminable(mode, "could not resolve the changed files");
 
   const watched = plan.files.filter(f => familyFor(f));
   if (watched.length === 0) return 0;

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi
 

package/plugins/lisa-copilot/hooks/threshold-ratchet.mjs

@@ -56,6 +56,15 @@ const GIT = GIT_LOCATIONS.find(candidate => fs.existsSync(candidate)) ?? "git";
 
 /** Git flag shared by every changed-file listing. */
 const NAME_ONLY = "--name-only";
+/**
+ * Suppress rename detection when discovering changed files.
+ *
+ * With it on, `git diff --name-only` reports a rename as the destination path
+ * only. Moving a watched threshold file to an unwatched path therefore lists
+ * one name the ratchet does not watch, and the loosening at the old path is
+ * never compared. Both sides have to be visible for the gate to mean anything.
+ */
+const NO_RENAMES = "--no-renames";
 
 /**
  * Run git, returning stdout or null on any failure.
@@ -87,7 +96,7 @@ function git(args, cwd) {
  */
 function resolvePlan(mode, root, baseRef, onlyFiles) {
   if (mode === "staged") {
-    const diff = git(["diff", "--cached", NAME_ONLY], root);
+    const diff = git(["diff", "--cached", NAME_ONLY, NO_RENAMES], root);
     if (diff === null) return null;
     return {
       files: diff.split("\n").filter(Boolean),
@@ -99,7 +108,7 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
     if (!baseRef) return null;
     const mergeBase = git(["merge-base", baseRef, "HEAD"], root)?.trim();
     if (!mergeBase) return null;
-    const diff = git(["diff", NAME_ONLY, mergeBase, "HEAD"], root);
+    const diff = git(["diff", NAME_ONLY, NO_RENAMES, mergeBase, "HEAD"], root);
     if (diff === null) return null;
     return {
       files: diff.split("\n").filter(Boolean),
@@ -107,7 +116,7 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
       readCurrent: f => git(["show", `HEAD:${f}`], root),
     };
   }
-  const diff = git(["diff", NAME_ONLY, "HEAD"], root);
+  const diff = git(["diff", NAME_ONLY, NO_RENAMES, "HEAD"], root);
   if (diff === null) return null;
   return {
     files: onlyFiles ?? diff.split("\n").filter(Boolean),
@@ -122,6 +131,31 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
   };
 }
 
+/**
+ * Decide the exit code when the ratchet cannot determine what changed.
+ *
+ * `staged` and `base` are enforcement gates — pre-commit and CI. A gate that
+ * cannot see the change set has not found the change set clean, and returning 0
+ * reports exactly that. It fails closed, loudly.
+ *
+ * `hook` is advisory feedback to an agent mid-edit, fires on every tool call,
+ * and blocks nothing downstream. Failing it closed on a transient git hiccup
+ * would turn a hint into an outage, so it stays permissive — but still says so.
+ * @param {"hook"|"staged"|"base"} mode Comparison mode
+ * @param {string} reason What could not be determined
+ * @returns {number} Process exit code
+ */
+function undeterminable(mode, reason) {
+  process.stderr.write(
+    `threshold-ratchet: ${reason}; the ratchet could not run in ${mode} mode\n`
+  );
+  if (mode === "hook") return 0;
+  process.stderr.write(
+    "threshold-ratchet: failing closed — an enforcement gate that cannot read the change set has not verified it\n"
+  );
+  return 1;
+}
+
 /**
  * Run the ratchet for a mode, print the report, and return the exit code.
  * @param {"hook"|"staged"|"base"} mode Comparison mode
@@ -131,9 +165,9 @@ function resolvePlan(mode, root, baseRef, onlyFiles) {
  */
 function run(mode, baseRef, onlyFiles) {
   const root = git(["rev-parse", "--show-toplevel"])?.trim();
-  if (!root) return 0;
+  if (!root) return undeterminable(mode, "not a git repository");
   const plan = resolvePlan(mode, root, baseRef, onlyFiles);
-  if (!plan) return 0;
+  if (!plan) return undeterminable(mode, "could not resolve the changed files");
 
   const watched = plan.files.filter(f => familyFor(f));
   if (watched.length === 0) return 0;

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.342.0",
+  "version": "2.342.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -172,16 +172,6 @@ case "$command_str" in
     ;;
 esac
 
-# matches / matches_cs run an ERE against the guarded command text. matches is
-# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
-# for guards where flag case is meaningful (`git branch -d` vs `-D`).
-matches() {
-  printf '%s' "$command_for_guards" | grep -Eiq -- "$1"
-}
-matches_cs() {
-  printf '%s' "$command_for_guards" | grep -Eq -- "$1"
-}
-
 # Normalize bash line-continuations (a trailing backslash + newline → space)
 # before segmenting the command. Without this, "git push --force origin
 # \<newline>main" splits into a segment matching --force but not `main`, letting a
@@ -190,6 +180,28 @@ matches_cs() {
 normalized_command_str="$(printf '%s' "$command_for_guards" \
   | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
 
+# matches / matches_cs run an ERE against the guarded command text. matches is
+# case-insensitive (the default for these guards); matches_cs is case-SENSITIVE
+# for guards where flag case is meaningful (`git branch -d` vs `-D`).
+#
+# Both read the NORMALIZED text. They used to read $command_for_guards, so only
+# the two segment-walking guards (rm, git push) were protected against line
+# continuations and every guard expressed through these helpers could be evaded
+# by breaking the command across lines:
+#
+#     git reset --hard \
+#       origin/main
+#
+# The patterns match on intermediate whitespace, and an embedded "\<newline>" is
+# not whitespace to grep -E, so the anchor failed to span the break. Defined
+# after the normalization above so the value exists when these are first called.
+matches() {
+  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+}
+matches_cs() {
+  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+}
+
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
 # crossing a statement separator, so a flag in a LATER statement can never be
 # attributed to an earlier git subcommand.
@@ -553,9 +565,28 @@ if [ -f "$rules_file" ]; then
     case "$rule" in
       '' | '#'*) continue ;;
     esac
-    if printf '%s' "$command_for_guards" | grep -Eiq -- "$rule"; then
-      block "matched a project custom safety rule (${rules_file##*/}): $rule"
-    fi
+    # Normalized text, for the same reason every built-in guard uses it: a
+    # project rule must not be evadable by breaking the command across lines.
+    #
+    # `|| rule_status=$?` rather than a bare pipeline: this script runs under
+    # `set -e`, and a no-match grep exits 1, which would end the hook right
+    # here — before the remaining rules ran, and with an exit status that is
+    # not a refusal. The `||` puts the pipeline in a condition context, where
+    # a non-zero status is expected rather than fatal.
+    rule_status=0
+    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    case "$rule_status" in
+      0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
+      1) ;; # no match
+      # grep exits 2 on a malformed ERE. Treated as no-match before, so a typo
+      # in a project's rules file silently disabled that rule — a guard the
+      # project believed it had. Say so instead; still non-fatal, because one
+      # bad line must not take the other rules down with it.
+      *)
+        printf 'parity-safety-net: invalid regex in %s, rule NOT enforced: %s\n' \
+          "$rules_file" "$rule" >&2
+        ;;
+    esac
   done <"$rules_file"
 fi