@codyswann/lisa 4.10.13 → 4.10.14

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -127,6 +127,66 @@ EOF
   exit 2
 }
 
+# grep answers three ways, not two: 0 it matched, 1 it did not match, and >=2 "I
+# could not do this" — it was never exec'd, the pattern was rejected, the input
+# could not be read. Every guard in this file used to reach its verdict through
+# a bare `| grep -q` in a condition, where >=2 is indistinguishable from 1. So
+# "the scan could not run" was read as "this command is safe", and the safety
+# net stopped guarding without ever saying so.
+#
+# Measured rather than feared (CodySwannGT/lisa#3054). With a `grep` that exits
+# 2 first on PATH, this hook ALLOWED `rm -rf /`, `git push --force origin main`,
+# `dd of=/dev/disk0` and `git branch -D main` — every built-in guard, silently,
+# exit 0. And the condition that gets there is live rather than theoretical: on
+# the machine this was found on, 7,679 orphaned processes were outstanding
+# against a `kern.maxprocperuid` of 10,666, putting a fork() that returns EAGAIN
+# a few hundred spawns away.
+#
+# The reasoning is ALREADY in this file, at the bottom, for the project custom
+# rules: a malformed ERE used to silently disable a rule the project believed it
+# had, and that was fixed by reading grep's STATUS instead of its truthiness. It
+# was never extended to the built-in guards. This is that extension.
+#
+# Fails CLOSED, which is this hook's stated contract everywhere else, and NAMES
+# the environment failure — a guard that reports "safe" when it means "I could
+# not tell" is the exact shape #3054 exists to remove.
+#
+# $1 = grep flags (-Ei / -E), $2 = text to scan, $3 = pattern.
+scan() {
+  local flags="$1" text="$2" pattern="$3" status=0
+  printf '%s' "$text" | grep "$flags" -q -- "$pattern" || status=$?
+  case "$status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *) scan_failed "$status" ;;
+  esac
+}
+
+# Deny, and say what actually happened. Deliberately NOT block(): block() tells
+# the reader their command matched a destructive pattern, which is a claim about
+# the COMMAND. This is a claim about the MACHINE, and printing the first when
+# the second is true is precisely what sends an operator to re-run instead of to
+# look — the reporting failure #3054 is about.
+scan_failed() {
+  cat >&2 <<EOF
+Blocked by safety-net: a guard's pattern scan FAILED TO RUN (grep exited $1); denying fail-closed.
+
+This is an ENVIRONMENT failure, not a property of your command. The guard could
+not be evaluated at all, so the safety net denied rather than guessed — a scan
+that cannot answer must never read as "safe".
+
+The usual cause is a machine at its per-user process limit, where fork() starts
+returning EAGAIN. Compare:
+
+    ps -u \$(id -u) | wc -l
+    sysctl -n kern.maxprocperuid     # Linux: ulimit -u
+
+Re-running is reasonable. If it repeats, the machine cannot fork and no number
+of re-runs will change that.
+EOF
+  exit 2
+}
+
 # Heredoc payloads are data only for a deliberately narrow set of GitHub CLI
 # write commands. A companion parser proves that shape before removing payload
 # text from the destructive-command scans below. Unknown executable heredocs
@@ -142,8 +202,8 @@ EOF
 # this file, after the heredoc dispatch runs) so `git -C <path> commit` and
 # `git -c k=v commit` spellings are still recognized.
 block_heredoc() {
-  if printf '%s' "$command_str" \
-    | grep -Eq -- '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+  if scan -E "$command_str" \
+    '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
     block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
@@ -208,10 +268,10 @@ normalized_command_str="$(printf '%s' "$command_for_guards" \
 # not whitespace to grep -E, so the anchor failed to span the break. Defined
 # after the normalization above so the value exists when these are first called.
 matches() {
-  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+  scan -Ei "$normalized_command_str" "$1"
 }
 matches_cs() {
-  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+  scan -E "$normalized_command_str" "$1"
 }
 
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
@@ -402,7 +462,7 @@ rm_scan_scope() {
         if [ "$found" -eq 0 ]; then
           case "$cur_run" in
             *[Rr][Mm]*)
-              if printf '%s' "$cur_run" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+              if scan -Ei "$cur_run" "$RM_CMD"'([[:space:]]|$)'; then
                 found=1
                 first_rm_run="$cur_run"
               fi
@@ -427,7 +487,7 @@ rm_scan_scope() {
   # An unterminated quote is text the scan cannot place: treat it as unquoted so
   # the fallback below hands back the whole statement.
   [ -z "$q" ] || outside="$outside$cur_run"
-  if printf '%s' "$outside" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+  if scan -Ei "$outside" "$RM_CMD"'([[:space:]]|$)'; then
     printf '%s' "$stmt"
     return
   fi
@@ -437,8 +497,8 @@ rm_scan_scope() {
   fi
   # `rm` first in its run (modulo whitespace and substitution/alias openers) is
   # an invocation, not prose.
-  if printf '%s' "$first_rm_run" \
-    | grep -Eiq -- '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
+  if scan -Ei "$first_rm_run" \
+    '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
     printf '%s' "$stmt"
     return
   fi
@@ -570,13 +630,29 @@ classify_rm_target() {
   esac
   return 0
 }
+# Segmented in the PARENT shell rather than in a process substitution, and the
+# `|| true` that used to sit on the feeder is gone. Both together were the same
+# three-way read as a bare `grep -q` condition (see scan() above), just wearing
+# a loop: a grep that could not run produced no lines, the body never executed,
+# and the guard was silently skipped with the command ALLOWED. `exit` inside a
+# process substitution cannot deny anything either — it ends that subshell, not
+# this hook.
+rm_segments_status=0
+rm_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)')" || rm_segments_status=$?
+case "$rm_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$rm_segments_status" ;;
+esac
 while IFS= read -r rm_stmt; do
-  if ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_CLUSTER" \
-    && ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_SPLIT"; then
+  # A here-string over empty input still yields one empty line.
+  [ -n "$rm_stmt" ] || continue
+  if ! scan -Ei "$rm_stmt" "$RM_RF_CLUSTER" \
+    && ! scan -Ei "$rm_stmt" "$RM_RF_SPLIT"; then
     continue
   fi
   # Guard 1: catastrophic target named in the SAME statement as the rm -rf.
-  if printf '%s' "$rm_stmt" | grep -Eq -- "$RM_CATASTROPHIC_TARGET"; then
+  if scan -E "$rm_stmt" "$RM_CATASTROPHIC_TARGET"; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
   # Physical-path comparison (pwd -P): on macOS $HOME or the cwd may arrive via
@@ -603,8 +679,7 @@ while IFS= read -r rm_stmt; do
     classify_rm_target "$token"
   done
   set +f
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)' || true)
+done <<<"$rm_segments"
 
 # 2. Force-pushing a protected branch. `--force-with-lease` is the safe,
 #    non-clobbering alternative and is intentionally NOT blocked. Deliberate
@@ -620,16 +695,25 @@ done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
 #    (`;`, `&&`, `||`, `|`, newlines), keep only the `git push` segments, and
 #    inspect each in isolation — a real `git push --force origin main` still
 #    matches, while a feature-branch push next to `[ -f ]`/`--base main` passes.
+# Same reason as the rm segmentation above: a feeder that swallows grep's error
+# skips the guard entirely and allows the command.
+push_segments_status=0
+push_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "${GIT_CMD}push\b")" || push_segments_status=$?
+case "$push_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$push_segments_status" ;;
+esac
 while IFS= read -r push_stmt; do
-  if printf '%s' "$push_stmt" \
-    | grep -Eiq '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
-    && ! printf '%s' "$push_stmt" | grep -Eiq -- '--force-with-lease' \
-    && printf '%s' "$push_stmt" \
-    | grep -Eiq '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
+  [ -n "$push_stmt" ] || continue
+  if scan -Ei "$push_stmt" \
+    '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
+    && ! scan -Ei "$push_stmt" '--force-with-lease' \
+    && scan -Ei "$push_stmt" \
+      '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
     block "force-pushing a protected branch (use --force-with-lease, or push a feature branch)"
   fi
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "${GIT_CMD}push\b" || true)
+done <<<"$push_segments"
 
 # 3. `git reset --hard` / `git reset --merge` while the working tree has
 #    uncommitted changes — both silently discard them. Only blocks when the tree

package/plugins/lisa-copilot/rules/eager/falsifiable-checks.md

@@ -34,6 +34,7 @@ Each has been observed in real runs; each reported success while asserting nothi
   This form is preferred over the alternatives because it is the only one that both survives `sh` and keeps the full output, which is what you need the moment the status says the gate failed. `set -o pipefail` is correct where it exists but is **not POSIX `sh`** — dash has no such option, and this repository runs hooks under `sh`. `${PIPESTATUS[0]}` is **bash-only** (zsh spells it `$pipestatus[1]`, 1-indexed) and is overwritten by the very next command, so it must be read immediately. Never report a gate as green from a status read through `| tail`, `| head`, or `| tee`.
 - **Falsify before reporting.** No clean result is reportable until the check has been shown to fail on a deliberate break. **"Mentally reverting" does not count** — reasoning that the assertion *would* fail is precisely the step that lets a non-functional guard ship, because the author already believes it is load-bearing. Run the break.
 - **Mutation-prove the guard, then read the cardinality.** Neuter the protection **in production code**, run the **whole suite**, count the failures and **read their names**, then revert. **Zero** ⇒ the guard is inert (one pinning a single field shipped with all 50 tests green while the regression walked through). **Many, unrelated** ⇒ over-broad; its next failure will not name the cause. **Exactly one, or several all named for the same regression** ⇒ load-bearing and correctly scoped. A **zero is robust to contention** — load only ever adds failures — so only the non-zero counts need a quiet machine.
+- **The automated mutation gate is language-scoped; the manual probe above is not.** Stryker instruments the JS/TS family and nothing else — there is **no shell parser**, so a guard whose logic lives in `.sh` yields no mutants under **any** `mutate` list. Adding one does not measure it: it aborts the whole run (`No parser registered for .sh!` — measured, not inferred) and takes every other guard's score with it. So a mutation gate that stays grey or green on a shell-guard change **measured nothing about that guard**, and reading it as coverage is the fifth failure mode above wearing a config file. Shell guards are covered by **driving tests only**: execute the script against a payload table and assert the blocked/allowed verdict, with a control on **both** sides — a refusal case *and* an allowed case. A shell guard nothing executes has no bite evidence at all, whatever the gate printed.
 - **Never scope the probe by filename, and never infer absent coverage from a grep.** Suites split at the line cap, so a protection's tests often sit in a sibling file: a filename-scoped probe reported cardinality 0 on a live security fix that a whole-suite run showed failing 4 tests, every one named for it.
 - **Assert that no copy is wrong, not that some copy is right.** An existential assertion over duplicated content is satisfied by the correct copy and cannot see the broken one — rewriting one suite's assertions to universal negatives took the same mutation from **0 to 18** failures. Enumerate the property (*every* marker uses an em-dash), never the one known-bad spelling.
 - **Reconstruct a red state; never narrate one you did not run.** Evidence describing a failing or dirty state must come from a run you actually observed — an evidence file once claimed "working tree clean" while listing two untracked scripts in the same file. To observe a state that no longer exists, check that commit out in a **throwaway detached-HEAD worktree** and run it there. Writing down what the output would have said is fabrication, however confident the reasoning.

package/plugins/lisa-copilot/rules/reference/falsifiable-checks.md

@@ -166,6 +166,20 @@ The obvious objection to any cardinality measured on a shared machine — *"your
 
 Practical consequence: an inert-guard finding is safe to report from a busy machine, while the "exactly one, or several all named alike" reading is only trustworthy once you have separated your mutation's failures from the load-flake population — which is what reading the *names* is for.
 
+### The automated gate stops at the language boundary
+
+Everything above is a *manual* probe, and it is language-agnostic: neuter a shell guard, run the suite, read the names, and the yardstick works exactly as it does for TypeScript.
+
+The **automated** mutation gate is not language-agnostic, and the difference is easy to miss because both end in a green result. Stryker's instrumenter is per-language — the JS/TS family, plus HTML and Svelte, which delegate to it. There is **no shell parser**. So:
+
+- A guard whose logic lives in `.sh` produces **no mutants under any `mutate` list**. It is outside the gate by construction, not by a selection decision, and widening the patterns cannot bring it in.
+- Adding a `.sh` path to `mutate` does not measure it and does not quietly no-op. Stryker throws out of instrumentation — `Unable to parse …. No parser registered for .sh!` — and the run aborts before a single mutant is tried, so **one such entry destroys the score of every other guard in the list.** Measured, not inferred.
+- Therefore a mutation gate that reports nothing-to-mutate, or reports green, on a change whose only guard edits were shell **measured nothing about those guards**. The absence of red is a property of the toolchain, not of the tests.
+
+What does measure a shell guard is a **driving test**: execute the script as a subprocess against a payload table and assert the verdict — blocked or allowed — with a control on **both** sides. A refusal-only suite cannot see a guard that refuses everything; an allow-only suite cannot see one that refuses nothing. Tests that merely `bash -n` the script, grep its source, or assert it exists are *source-shape* checks and are not evidence of bite.
+
+A shell guard with no test that executes it has **no bite evidence at all**, whatever any gate printed.
+
 ### Two reasons a real protection reports zero
 
 A cardinality of zero has two distinct innocent causes, and they need different fixes. Rule out both before concluding a guard is inert:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -127,6 +127,66 @@ EOF
   exit 2
 }
 
+# grep answers three ways, not two: 0 it matched, 1 it did not match, and >=2 "I
+# could not do this" — it was never exec'd, the pattern was rejected, the input
+# could not be read. Every guard in this file used to reach its verdict through
+# a bare `| grep -q` in a condition, where >=2 is indistinguishable from 1. So
+# "the scan could not run" was read as "this command is safe", and the safety
+# net stopped guarding without ever saying so.
+#
+# Measured rather than feared (CodySwannGT/lisa#3054). With a `grep` that exits
+# 2 first on PATH, this hook ALLOWED `rm -rf /`, `git push --force origin main`,
+# `dd of=/dev/disk0` and `git branch -D main` — every built-in guard, silently,
+# exit 0. And the condition that gets there is live rather than theoretical: on
+# the machine this was found on, 7,679 orphaned processes were outstanding
+# against a `kern.maxprocperuid` of 10,666, putting a fork() that returns EAGAIN
+# a few hundred spawns away.
+#
+# The reasoning is ALREADY in this file, at the bottom, for the project custom
+# rules: a malformed ERE used to silently disable a rule the project believed it
+# had, and that was fixed by reading grep's STATUS instead of its truthiness. It
+# was never extended to the built-in guards. This is that extension.
+#
+# Fails CLOSED, which is this hook's stated contract everywhere else, and NAMES
+# the environment failure — a guard that reports "safe" when it means "I could
+# not tell" is the exact shape #3054 exists to remove.
+#
+# $1 = grep flags (-Ei / -E), $2 = text to scan, $3 = pattern.
+scan() {
+  local flags="$1" text="$2" pattern="$3" status=0
+  printf '%s' "$text" | grep "$flags" -q -- "$pattern" || status=$?
+  case "$status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *) scan_failed "$status" ;;
+  esac
+}
+
+# Deny, and say what actually happened. Deliberately NOT block(): block() tells
+# the reader their command matched a destructive pattern, which is a claim about
+# the COMMAND. This is a claim about the MACHINE, and printing the first when
+# the second is true is precisely what sends an operator to re-run instead of to
+# look — the reporting failure #3054 is about.
+scan_failed() {
+  cat >&2 <<EOF
+Blocked by safety-net: a guard's pattern scan FAILED TO RUN (grep exited $1); denying fail-closed.
+
+This is an ENVIRONMENT failure, not a property of your command. The guard could
+not be evaluated at all, so the safety net denied rather than guessed — a scan
+that cannot answer must never read as "safe".
+
+The usual cause is a machine at its per-user process limit, where fork() starts
+returning EAGAIN. Compare:
+
+    ps -u \$(id -u) | wc -l
+    sysctl -n kern.maxprocperuid     # Linux: ulimit -u
+
+Re-running is reasonable. If it repeats, the machine cannot fork and no number
+of re-runs will change that.
+EOF
+  exit 2
+}
+
 # Heredoc payloads are data only for a deliberately narrow set of GitHub CLI
 # write commands. A companion parser proves that shape before removing payload
 # text from the destructive-command scans below. Unknown executable heredocs
@@ -142,8 +202,8 @@ EOF
 # this file, after the heredoc dispatch runs) so `git -C <path> commit` and
 # `git -c k=v commit` spellings are still recognized.
 block_heredoc() {
-  if printf '%s' "$command_str" \
-    | grep -Eq -- '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+  if scan -E "$command_str" \
+    '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
     block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
@@ -208,10 +268,10 @@ normalized_command_str="$(printf '%s' "$command_for_guards" \
 # not whitespace to grep -E, so the anchor failed to span the break. Defined
 # after the normalization above so the value exists when these are first called.
 matches() {
-  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+  scan -Ei "$normalized_command_str" "$1"
 }
 matches_cs() {
-  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+  scan -E "$normalized_command_str" "$1"
 }
 
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
@@ -402,7 +462,7 @@ rm_scan_scope() {
         if [ "$found" -eq 0 ]; then
           case "$cur_run" in
             *[Rr][Mm]*)
-              if printf '%s' "$cur_run" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+              if scan -Ei "$cur_run" "$RM_CMD"'([[:space:]]|$)'; then
                 found=1
                 first_rm_run="$cur_run"
               fi
@@ -427,7 +487,7 @@ rm_scan_scope() {
   # An unterminated quote is text the scan cannot place: treat it as unquoted so
   # the fallback below hands back the whole statement.
   [ -z "$q" ] || outside="$outside$cur_run"
-  if printf '%s' "$outside" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+  if scan -Ei "$outside" "$RM_CMD"'([[:space:]]|$)'; then
     printf '%s' "$stmt"
     return
   fi
@@ -437,8 +497,8 @@ rm_scan_scope() {
   fi
   # `rm` first in its run (modulo whitespace and substitution/alias openers) is
   # an invocation, not prose.
-  if printf '%s' "$first_rm_run" \
-    | grep -Eiq -- '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
+  if scan -Ei "$first_rm_run" \
+    '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
     printf '%s' "$stmt"
     return
   fi
@@ -570,13 +630,29 @@ classify_rm_target() {
   esac
   return 0
 }
+# Segmented in the PARENT shell rather than in a process substitution, and the
+# `|| true` that used to sit on the feeder is gone. Both together were the same
+# three-way read as a bare `grep -q` condition (see scan() above), just wearing
+# a loop: a grep that could not run produced no lines, the body never executed,
+# and the guard was silently skipped with the command ALLOWED. `exit` inside a
+# process substitution cannot deny anything either — it ends that subshell, not
+# this hook.
+rm_segments_status=0
+rm_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)')" || rm_segments_status=$?
+case "$rm_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$rm_segments_status" ;;
+esac
 while IFS= read -r rm_stmt; do
-  if ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_CLUSTER" \
-    && ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_SPLIT"; then
+  # A here-string over empty input still yields one empty line.
+  [ -n "$rm_stmt" ] || continue
+  if ! scan -Ei "$rm_stmt" "$RM_RF_CLUSTER" \
+    && ! scan -Ei "$rm_stmt" "$RM_RF_SPLIT"; then
     continue
   fi
   # Guard 1: catastrophic target named in the SAME statement as the rm -rf.
-  if printf '%s' "$rm_stmt" | grep -Eq -- "$RM_CATASTROPHIC_TARGET"; then
+  if scan -E "$rm_stmt" "$RM_CATASTROPHIC_TARGET"; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
   # Physical-path comparison (pwd -P): on macOS $HOME or the cwd may arrive via
@@ -603,8 +679,7 @@ while IFS= read -r rm_stmt; do
     classify_rm_target "$token"
   done
   set +f
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)' || true)
+done <<<"$rm_segments"
 
 # 2. Force-pushing a protected branch. `--force-with-lease` is the safe,
 #    non-clobbering alternative and is intentionally NOT blocked. Deliberate
@@ -620,16 +695,25 @@ done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
 #    (`;`, `&&`, `||`, `|`, newlines), keep only the `git push` segments, and
 #    inspect each in isolation — a real `git push --force origin main` still
 #    matches, while a feature-branch push next to `[ -f ]`/`--base main` passes.
+# Same reason as the rm segmentation above: a feeder that swallows grep's error
+# skips the guard entirely and allows the command.
+push_segments_status=0
+push_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "${GIT_CMD}push\b")" || push_segments_status=$?
+case "$push_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$push_segments_status" ;;
+esac
 while IFS= read -r push_stmt; do
-  if printf '%s' "$push_stmt" \
-    | grep -Eiq '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
-    && ! printf '%s' "$push_stmt" | grep -Eiq -- '--force-with-lease' \
-    && printf '%s' "$push_stmt" \
-    | grep -Eiq '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
+  [ -n "$push_stmt" ] || continue
+  if scan -Ei "$push_stmt" \
+    '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
+    && ! scan -Ei "$push_stmt" '--force-with-lease' \
+    && scan -Ei "$push_stmt" \
+      '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
     block "force-pushing a protected branch (use --force-with-lease, or push a feature branch)"
   fi
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "${GIT_CMD}push\b" || true)
+done <<<"$push_segments"
 
 # 3. `git reset --hard` / `git reset --merge` while the working tree has
 #    uncommitted changes — both silently discard them. Only blocks when the tree

package/plugins/lisa-cursor/rules/falsifiable-checks-reference.mdc

@@ -171,6 +171,20 @@ The obvious objection to any cardinality measured on a shared machine — *"your
 
 Practical consequence: an inert-guard finding is safe to report from a busy machine, while the "exactly one, or several all named alike" reading is only trustworthy once you have separated your mutation's failures from the load-flake population — which is what reading the *names* is for.
 
+### The automated gate stops at the language boundary
+
+Everything above is a *manual* probe, and it is language-agnostic: neuter a shell guard, run the suite, read the names, and the yardstick works exactly as it does for TypeScript.
+
+The **automated** mutation gate is not language-agnostic, and the difference is easy to miss because both end in a green result. Stryker's instrumenter is per-language — the JS/TS family, plus HTML and Svelte, which delegate to it. There is **no shell parser**. So:
+
+- A guard whose logic lives in `.sh` produces **no mutants under any `mutate` list**. It is outside the gate by construction, not by a selection decision, and widening the patterns cannot bring it in.
+- Adding a `.sh` path to `mutate` does not measure it and does not quietly no-op. Stryker throws out of instrumentation — `Unable to parse …. No parser registered for .sh!` — and the run aborts before a single mutant is tried, so **one such entry destroys the score of every other guard in the list.** Measured, not inferred.
+- Therefore a mutation gate that reports nothing-to-mutate, or reports green, on a change whose only guard edits were shell **measured nothing about those guards**. The absence of red is a property of the toolchain, not of the tests.
+
+What does measure a shell guard is a **driving test**: execute the script as a subprocess against a payload table and assert the verdict — blocked or allowed — with a control on **both** sides. A refusal-only suite cannot see a guard that refuses everything; an allow-only suite cannot see one that refuses nothing. Tests that merely `bash -n` the script, grep its source, or assert it exists are *source-shape* checks and are not evidence of bite.
+
+A shell guard with no test that executes it has **no bite evidence at all**, whatever any gate printed.
+
 ### Two reasons a real protection reports zero
 
 A cardinality of zero has two distinct innocent causes, and they need different fixes. Rule out both before concluding a guard is inert:

package/plugins/lisa-cursor/rules/falsifiable-checks.mdc

@@ -39,6 +39,7 @@ Each has been observed in real runs; each reported success while asserting nothi
   This form is preferred over the alternatives because it is the only one that both survives `sh` and keeps the full output, which is what you need the moment the status says the gate failed. `set -o pipefail` is correct where it exists but is **not POSIX `sh`** — dash has no such option, and this repository runs hooks under `sh`. `${PIPESTATUS[0]}` is **bash-only** (zsh spells it `$pipestatus[1]`, 1-indexed) and is overwritten by the very next command, so it must be read immediately. Never report a gate as green from a status read through `| tail`, `| head`, or `| tee`.
 - **Falsify before reporting.** No clean result is reportable until the check has been shown to fail on a deliberate break. **"Mentally reverting" does not count** — reasoning that the assertion *would* fail is precisely the step that lets a non-functional guard ship, because the author already believes it is load-bearing. Run the break.
 - **Mutation-prove the guard, then read the cardinality.** Neuter the protection **in production code**, run the **whole suite**, count the failures and **read their names**, then revert. **Zero** ⇒ the guard is inert (one pinning a single field shipped with all 50 tests green while the regression walked through). **Many, unrelated** ⇒ over-broad; its next failure will not name the cause. **Exactly one, or several all named for the same regression** ⇒ load-bearing and correctly scoped. A **zero is robust to contention** — load only ever adds failures — so only the non-zero counts need a quiet machine.
+- **The automated mutation gate is language-scoped; the manual probe above is not.** Stryker instruments the JS/TS family and nothing else — there is **no shell parser**, so a guard whose logic lives in `.sh` yields no mutants under **any** `mutate` list. Adding one does not measure it: it aborts the whole run (`No parser registered for .sh!` — measured, not inferred) and takes every other guard's score with it. So a mutation gate that stays grey or green on a shell-guard change **measured nothing about that guard**, and reading it as coverage is the fifth failure mode above wearing a config file. Shell guards are covered by **driving tests only**: execute the script against a payload table and assert the blocked/allowed verdict, with a control on **both** sides — a refusal case *and* an allowed case. A shell guard nothing executes has no bite evidence at all, whatever the gate printed.
 - **Never scope the probe by filename, and never infer absent coverage from a grep.** Suites split at the line cap, so a protection's tests often sit in a sibling file: a filename-scoped probe reported cardinality 0 on a live security fix that a whole-suite run showed failing 4 tests, every one named for it.
 - **Assert that no copy is wrong, not that some copy is right.** An existential assertion over duplicated content is satisfied by the correct copy and cannot see the broken one — rewriting one suite's assertions to universal negatives took the same mutation from **0 to 18** failures. Enumerate the property (*every* marker uses an em-dash), never the one known-bad spelling.
 - **Reconstruct a red state; never narrate one you did not run.** Evidence describing a failing or dirty state must come from a run you actually observed — an evidence file once claimed "working tree clean" while listing two untracked scripts in the same file. To observe a state that no longer exists, check that commit out in a **throwaway detached-HEAD worktree** and run it there. Writing down what the output would have said is fabrication, however confident the reasoning.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.10.13",
+  "version": "4.10.14",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"