@codyswann/lisa 4.10.10 → 4.10.12

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.10.10",
+  "version": "4.10.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-no-verify.agy.sh

@@ -60,15 +60,24 @@ def strip_heredocs(text: str) -> str:
     output = []
     pending = []
     marker_pattern = re.compile(
-        r"(?<!<)<<-?(?!<)\s*(?:'([^']+)'|\"([^\"]+)\"|([A-Za-z_][A-Za-z0-9_]*))"
+        r'''(?<!<)<<-?(?!<)\s*((?:'[^']*'|"(?:[^"\\]|\\.)*"|\\.|[^\s;&|<>()])+)'''
     )
+
+    def marker_word(raw: str):
+        try:
+            words = shlex.split(raw, posix=True)
+        except ValueError:
+            return None
+        return words[0] if len(words) == 1 and words[0] else None
+
     index = 0
     while index < len(lines):
         line = lines[index]
         output.append(line)
         pending.extend(
-            next(group for group in match.groups() if group)
+            marker
             for match in marker_pattern.finditer(line)
+            if (marker := marker_word(match.group(1))) is not None
         )
         index += 1
         while pending and index < len(lines):
@@ -358,6 +367,8 @@ for i, token in enumerate(normalized_tokens):
         sys.exit(1)
     if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
+        if "$" in parameters or "`" in parameters:
+            sys.exit(1)
         try:
             configured = shlex.split(parameters, posix=True)
         except ValueError:

package/plugins/src/base/hooks/block-no-verify.sh

@@ -23,7 +23,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, herestring-aware, no-verify-short
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -101,15 +101,24 @@ def strip_heredocs(text: str) -> str:
     output = []
     pending = []
     marker_pattern = re.compile(
-        r"(?<!<)<<-?(?!<)\s*(?:'([^']+)'|\"([^\"]+)\"|([A-Za-z_][A-Za-z0-9_]*))"
+        r'''(?<!<)<<-?(?!<)\s*((?:'[^']*'|"(?:[^"\\]|\\.)*"|\\.|[^\s;&|<>()])+)'''
     )
+
+    def marker_word(raw: str):
+        try:
+            words = shlex.split(raw, posix=True)
+        except ValueError:
+            return None
+        return words[0] if len(words) == 1 and words[0] else None
+
     index = 0
     while index < len(lines):
         line = lines[index]
         output.append(line)
         pending.extend(
-            next(group for group in match.groups() if group)
+            marker
             for match in marker_pattern.finditer(line)
+            if (marker := marker_word(match.group(1))) is not None
         )
         index += 1
         while pending and index < len(lines):
@@ -451,6 +460,12 @@ for i, token in enumerate(normalized_tokens):
     # key from an unrelated value that merely contains the same text.
     if re.match(r"git_config_parameters\+?=", lowered):
         parameters = token.split("=", 1)[1]
+        # The guard sees the command before the shell expands assignments. A
+        # variable or command substitution can therefore hide hooksPath from
+        # this parser and reveal it only to Git. Refuse unresolved values; the
+        # guard cannot safely prove what configuration they will become.
+        if "$" in parameters or "`" in parameters:
+            sys.exit(1)
         try:
             configured = shlex.split(parameters, posix=True)
         except ValueError: