@codyswann/lisa 4.10.13 → 4.10.15

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -127,6 +127,66 @@ EOF
   exit 2
 }
 
+# grep answers three ways, not two: 0 it matched, 1 it did not match, and >=2 "I
+# could not do this" — it was never exec'd, the pattern was rejected, the input
+# could not be read. Every guard in this file used to reach its verdict through
+# a bare `| grep -q` in a condition, where >=2 is indistinguishable from 1. So
+# "the scan could not run" was read as "this command is safe", and the safety
+# net stopped guarding without ever saying so.
+#
+# Measured rather than feared (CodySwannGT/lisa#3054). With a `grep` that exits
+# 2 first on PATH, this hook ALLOWED `rm -rf /`, `git push --force origin main`,
+# `dd of=/dev/disk0` and `git branch -D main` — every built-in guard, silently,
+# exit 0. And the condition that gets there is live rather than theoretical: on
+# the machine this was found on, 7,679 orphaned processes were outstanding
+# against a `kern.maxprocperuid` of 10,666, putting a fork() that returns EAGAIN
+# a few hundred spawns away.
+#
+# The reasoning is ALREADY in this file, at the bottom, for the project custom
+# rules: a malformed ERE used to silently disable a rule the project believed it
+# had, and that was fixed by reading grep's STATUS instead of its truthiness. It
+# was never extended to the built-in guards. This is that extension.
+#
+# Fails CLOSED, which is this hook's stated contract everywhere else, and NAMES
+# the environment failure — a guard that reports "safe" when it means "I could
+# not tell" is the exact shape #3054 exists to remove.
+#
+# $1 = grep flags (-Ei / -E), $2 = text to scan, $3 = pattern.
+scan() {
+  local flags="$1" text="$2" pattern="$3" status=0
+  printf '%s' "$text" | grep "$flags" -q -- "$pattern" || status=$?
+  case "$status" in
+    0) return 0 ;;
+    1) return 1 ;;
+    *) scan_failed "$status" ;;
+  esac
+}
+
+# Deny, and say what actually happened. Deliberately NOT block(): block() tells
+# the reader their command matched a destructive pattern, which is a claim about
+# the COMMAND. This is a claim about the MACHINE, and printing the first when
+# the second is true is precisely what sends an operator to re-run instead of to
+# look — the reporting failure #3054 is about.
+scan_failed() {
+  cat >&2 <<EOF
+Blocked by safety-net: a guard's pattern scan FAILED TO RUN (grep exited $1); denying fail-closed.
+
+This is an ENVIRONMENT failure, not a property of your command. The guard could
+not be evaluated at all, so the safety net denied rather than guessed — a scan
+that cannot answer must never read as "safe".
+
+The usual cause is a machine at its per-user process limit, where fork() starts
+returning EAGAIN. Compare:
+
+    ps -u \$(id -u) | wc -l
+    sysctl -n kern.maxprocperuid     # Linux: ulimit -u
+
+Re-running is reasonable. If it repeats, the machine cannot fork and no number
+of re-runs will change that.
+EOF
+  exit 2
+}
+
 # Heredoc payloads are data only for a deliberately narrow set of GitHub CLI
 # write commands. A companion parser proves that shape before removing payload
 # text from the destructive-command scans below. Unknown executable heredocs
@@ -142,8 +202,8 @@ EOF
 # this file, after the heredoc dispatch runs) so `git -C <path> commit` and
 # `git -c k=v commit` spellings are still recognized.
 block_heredoc() {
-  if printf '%s' "$command_str" \
-    | grep -Eq -- '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
+  if scan -E "$command_str" \
+    '(^|[^[:alnum:]_-])git[[:space:]]+(-[^;&|[:space:]]+([[:space:]]+[^-;&|[:space:]][^;&|[:space:]]*)?[[:space:]]+)*commit([^[:alnum:]_-]|$)'; then
     block "$1
 Heredoc commit invocations are blocked (the payload is executable shell).
 Fix: write the commit message to a file and run \`git commit -F <file>\`.
@@ -208,10 +268,10 @@ normalized_command_str="$(printf '%s' "$command_for_guards" \
 # not whitespace to grep -E, so the anchor failed to span the break. Defined
 # after the normalization above so the value exists when these are first called.
 matches() {
-  printf '%s' "$normalized_command_str" | grep -Eiq -- "$1"
+  scan -Ei "$normalized_command_str" "$1"
 }
 matches_cs() {
-  printf '%s' "$normalized_command_str" | grep -Eq -- "$1"
+  scan -E "$normalized_command_str" "$1"
 }
 
 # Shared ERE fragments. GIT_TOKENS walks over intermediate argv tokens without
@@ -384,7 +444,8 @@ rm_scan_scope() {
     printf '%s' "$stmt"
     return
   fi
-  local i=0 ch q="" esc=0 outside="" cur_run="" first_rm_run="" found=0
+  local i=0 ch q="" esc=0 outside="" cur_run="" rm_runs="" found=0
+  local run_leading=0
   while [ "$i" -lt "$n" ]; do
     ch="${stmt:i:1}"
     i=$((i + 1))
@@ -399,16 +460,19 @@ rm_scan_scope() {
     fi
     if [ -n "$q" ]; then
       if [ "$ch" = "$q" ]; then
-        if [ "$found" -eq 0 ]; then
-          case "$cur_run" in
-            *[Rr][Mm]*)
-              if printf '%s' "$cur_run" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
-                found=1
-                first_rm_run="$cur_run"
+        case "$cur_run" in
+          *[Rr][Mm]*)
+            if scan -Ei "$cur_run" "$RM_CMD"'([[:space:]]|$)'; then
+              found=$((found + 1))
+              if [ -n "$rm_runs" ]; then rm_runs="$rm_runs"$'\n'; fi
+              rm_runs="$rm_runs$cur_run"
+              if scan -Ei "$cur_run" \
+                '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
+                run_leading=1
               fi
-              ;;
-          esac
-        fi
+            fi
+            ;;
+        esac
         q=""
         cur_run=""
       else
@@ -427,7 +491,7 @@ rm_scan_scope() {
   # An unterminated quote is text the scan cannot place: treat it as unquoted so
   # the fallback below hands back the whole statement.
   [ -z "$q" ] || outside="$outside$cur_run"
-  if printf '%s' "$outside" | grep -Eiq -- "$RM_CMD"'([[:space:]]|$)'; then
+  if scan -Ei "$outside" "$RM_CMD"'([[:space:]]|$)'; then
     printf '%s' "$stmt"
     return
   fi
@@ -435,36 +499,118 @@ rm_scan_scope() {
     printf '%s' "$stmt"
     return
   fi
-  # `rm` first in its run (modulo whitespace and substitution/alias openers) is
-  # an invocation, not prose.
-  if printf '%s' "$first_rm_run" \
-    | grep -Eiq -- '^[[:space:]]*(\\|\$\(|`|\(|<\(|>\()*[[:space:]]*([[:alnum:]_./-]*/)?rm([[:space:]]|$)'; then
+  # `rm` first in ANY run (modulo whitespace and substitution/alias openers) is
+  # an invocation, not prose. Inspect every run before deciding: returning on
+  # the first prose run used to hide a real delete in a later quoted run.
+  if [ "$run_leading" -eq 1 ]; then
     printf '%s' "$stmt"
     return
   fi
-  printf '%s' "$first_rm_run"
+  printf '%s' "$rm_runs"
 }
 # Look up the ONE unambiguous assignment of NAME inside the command being
 # classified — issue #3106 arm B, the variable half.
 #
-# Prints the recorded right-hand side, or fails when the name is never assigned
-# here or is assigned more than one distinct value. Ambiguity must fail: the
-# last write wins at run time and a text scan cannot order writes against the
-# delete, so `V=/etc; rm -rf "$V"; V=/tmp/x` must not resolve to the harmless
-# one. Only assignments literally present in this command are ever trusted;
-# nothing is expanded from the hook's own environment.
+# Prints the recorded right-hand side, or fails when the name is not assigned
+# before the first rm token or is assigned more than one distinct value there.
+# A later write cannot affect an earlier delete, and a quoted assignment-like
+# argument can be prose, so neither is considered. Only assignments literally
+# present in this command are ever trusted; nothing is expanded from the hook's
+# own environment.
+rm_assignment_stmt=""
 rm_assignment_value() {
-  local name="$1" hits="" count=""
+  local name="$1"
   case "$name" in
     "" | *[!A-Za-z0-9_]*) return 1 ;;
   esac
-  hits="$(printf '%s\n' "$normalized_command_str" | tr ';&|' '\n' \
-    | grep -oE "(^|[[:space:]])${name}=[^[:space:]]*" \
-    | sed -E "s/^.*${name}=//")"
-  [ -n "$hits" ] || return 1
-  count="$(printf '%s\n' "$hits" | sort -u | grep -c '' | tr -d '[:space:]')"
-  [ "$count" = "1" ] || return 1
-  printf '%s' "$(printf '%s\n' "$hits" | head -n 1)"
+  # Only assignments that occur before this statement's rm token can influence
+  # its delete safely. A later assignment is too late at runtime, and an
+  # assignment whose NAME begins inside a quoted argument can be prose. The
+  # small lexer below preserves quoted right-hand sides such as V="/tmp/x"
+  # while excluding an argument such as echo "V=/tmp/x". Any ambiguity fails
+  # closed.
+  RM_ASSIGNMENT_NAME="$name" RM_ASSIGNMENT_COMMAND="$normalized_command_str" \
+    RM_ASSIGNMENT_STATEMENT="$rm_assignment_stmt" \
+    python3 - <<'PY'
+import os
+import re
+import sys
+
+name = os.environ.get("RM_ASSIGNMENT_NAME", "")
+command = os.environ.get("RM_ASSIGNMENT_COMMAND", "")
+statement = os.environ.get("RM_ASSIGNMENT_STATEMENT", "")
+if not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", name):
+    sys.exit(1)
+
+rm_pattern = re.compile(
+    r"(?i)(?<![A-Za-z0-9_./-])(?:[A-Za-z0-9_./-]*/)?rm(?=$|[\s;&|()'\"`])",
+)
+rm_token = rm_pattern.search(statement)
+if rm_token is None or not statement or command.count(statement) != 1:
+    sys.exit(1)
+statement_start = command.find(statement)
+if statement_start < 0:
+    sys.exit(1)
+prefix = command[: statement_start + rm_token.start()]
+
+tokens = []
+buffer = []
+quote = None
+escaped = False
+started = False
+started_unquoted = False
+
+def flush():
+    global buffer, started, started_unquoted
+    if started:
+        tokens.append(("".join(buffer), started_unquoted))
+    buffer = []
+    started = False
+    started_unquoted = False
+
+for char in prefix:
+    if escaped:
+        buffer.append(char)
+        escaped = False
+        continue
+    if quote is not None:
+        if char == quote:
+            quote = None
+        elif char == "\\" and quote == '"':
+            escaped = True
+        else:
+            buffer.append(char)
+        continue
+    if char in "'\"":
+        if not started:
+            started = True
+            started_unquoted = False
+        quote = char
+    elif char == "\\":
+        if not started:
+            started = True
+            started_unquoted = True
+        escaped = True
+    elif char.isspace() or char in ";&|()":
+        flush()
+    else:
+        if not started:
+            started = True
+            started_unquoted = True
+        buffer.append(char)
+flush()
+
+needle = f"{name}="
+hits = [token[len(needle):] for token, outside in tokens
+        if outside and token.startswith(needle)]
+distinct = set(hits)
+if len(distinct) != 1:
+    sys.exit(1)
+value = hits[0]
+if not value:
+    sys.exit(1)
+sys.stdout.write(value)
+PY
 }
 # Rewrite a leading `$NAME` / `${NAME}` in a deletion target to the value the
 # command itself assigns it, so the target is classified as if the agent had
@@ -570,13 +716,29 @@ classify_rm_target() {
   esac
   return 0
 }
+# Segmented in the PARENT shell rather than in a process substitution, and the
+# `|| true` that used to sit on the feeder is gone. Both together were the same
+# three-way read as a bare `grep -q` condition (see scan() above), just wearing
+# a loop: a grep that could not run produced no lines, the body never executed,
+# and the guard was silently skipped with the command ALLOWED. `exit` inside a
+# process substitution cannot deny anything either — it ends that subshell, not
+# this hook.
+rm_segments_status=0
+rm_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)')" || rm_segments_status=$?
+case "$rm_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$rm_segments_status" ;;
+esac
 while IFS= read -r rm_stmt; do
-  if ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_CLUSTER" \
-    && ! printf '%s' "$rm_stmt" | grep -Eiq -- "$RM_RF_SPLIT"; then
+  # A here-string over empty input still yields one empty line.
+  [ -n "$rm_stmt" ] || continue
+  if ! scan -Ei "$rm_stmt" "$RM_RF_CLUSTER" \
+    && ! scan -Ei "$rm_stmt" "$RM_RF_SPLIT"; then
     continue
   fi
   # Guard 1: catastrophic target named in the SAME statement as the rm -rf.
-  if printf '%s' "$rm_stmt" | grep -Eq -- "$RM_CATASTROPHIC_TARGET"; then
+  if scan -E "$rm_stmt" "$RM_CATASTROPHIC_TARGET"; then
     block "recursive forced delete of a root, home, or wildcard path (rm -rf)"
   fi
   # Physical-path comparison (pwd -P): on macOS $HOME or the cwd may arrive via
@@ -588,23 +750,25 @@ while IFS= read -r rm_stmt; do
   # Scope the walk to the quoting region that actually contains the rm (#3106
   # arm A). Unquoted and run-leading invocations get the whole statement back,
   # so this is a no-op for every real delete.
+  rm_assignment_stmt="$rm_stmt"
   rm_walk_text="$(rm_scan_scope "$rm_stmt")"
-  set -f
-  seen_rm=0
-  for raw_token in $rm_walk_text; do
-    token="$(strip_subst_wrappers "$raw_token")"
-    if [ "$seen_rm" -eq 0 ]; then
-      # Path-prefixed spellings (`/bin/rm`, `./rm`) are still rm (F2).
-      case "$token" in
-        rm | */rm) seen_rm=1 ;;
-      esac
-      continue
-    fi
-    classify_rm_target "$token"
-  done
-  set +f
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "$RM_CMD"'([[:space:]]|$)' || true)
+  while IFS= read -r rm_scope; do
+    set -f
+    seen_rm=0
+    for raw_token in $rm_scope; do
+      token="$(strip_subst_wrappers "$raw_token")"
+      if [ "$seen_rm" -eq 0 ]; then
+        # Path-prefixed spellings (`/bin/rm`, `./rm`) are still rm (F2).
+        case "$token" in
+          rm | */rm) seen_rm=1 ;;
+        esac
+        continue
+      fi
+      classify_rm_target "$token"
+    done
+    set +f
+  done <<< "$rm_walk_text"
+done <<<"$rm_segments"
 
 # 2. Force-pushing a protected branch. `--force-with-lease` is the safe,
 #    non-clobbering alternative and is intentionally NOT blocked. Deliberate
@@ -620,16 +784,25 @@ done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
 #    (`;`, `&&`, `||`, `|`, newlines), keep only the `git push` segments, and
 #    inspect each in isolation — a real `git push --force origin main` still
 #    matches, while a feature-branch push next to `[ -f ]`/`--base main` passes.
+# Same reason as the rm segmentation above: a feeder that swallows grep's error
+# skips the guard entirely and allows the command.
+push_segments_status=0
+push_segments="$(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
+  | grep -Ei -- "${GIT_CMD}push\b")" || push_segments_status=$?
+case "$push_segments_status" in
+  0 | 1) ;;
+  *) scan_failed "$push_segments_status" ;;
+esac
 while IFS= read -r push_stmt; do
-  if printf '%s' "$push_stmt" \
-    | grep -Eiq '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
-    && ! printf '%s' "$push_stmt" | grep -Eiq -- '--force-with-lease' \
-    && printf '%s' "$push_stmt" \
-    | grep -Eiq '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
+  [ -n "$push_stmt" ] || continue
+  if scan -Ei "$push_stmt" \
+    '(--force([[:space:]]|=|$)|[[:space:]]-f([[:space:]]|$))' \
+    && ! scan -Ei "$push_stmt" '--force-with-lease' \
+    && scan -Ei "$push_stmt" \
+      '(^|[^[:alnum:]_/-])(main|master|production|prod|release)([^[:alnum:]_/-]|$)'; then
     block "force-pushing a protected branch (use --force-with-lease, or push a feature branch)"
   fi
-done < <(printf '%s' "$normalized_command_str" | tr '&|;' '\n' \
-  | grep -Ei -- "${GIT_CMD}push\b" || true)
+done <<<"$push_segments"
 
 # 3. `git reset --hard` / `git reset --merge` while the working tree has
 #    uncommitted changes — both silently discard them. Only blocks when the tree

package/plugins/lisa-copilot/rules/eager/falsifiable-checks.md

@@ -34,6 +34,7 @@ Each has been observed in real runs; each reported success while asserting nothi
   This form is preferred over the alternatives because it is the only one that both survives `sh` and keeps the full output, which is what you need the moment the status says the gate failed. `set -o pipefail` is correct where it exists but is **not POSIX `sh`** — dash has no such option, and this repository runs hooks under `sh`. `${PIPESTATUS[0]}` is **bash-only** (zsh spells it `$pipestatus[1]`, 1-indexed) and is overwritten by the very next command, so it must be read immediately. Never report a gate as green from a status read through `| tail`, `| head`, or `| tee`.
 - **Falsify before reporting.** No clean result is reportable until the check has been shown to fail on a deliberate break. **"Mentally reverting" does not count** — reasoning that the assertion *would* fail is precisely the step that lets a non-functional guard ship, because the author already believes it is load-bearing. Run the break.
 - **Mutation-prove the guard, then read the cardinality.** Neuter the protection **in production code**, run the **whole suite**, count the failures and **read their names**, then revert. **Zero** ⇒ the guard is inert (one pinning a single field shipped with all 50 tests green while the regression walked through). **Many, unrelated** ⇒ over-broad; its next failure will not name the cause. **Exactly one, or several all named for the same regression** ⇒ load-bearing and correctly scoped. A **zero is robust to contention** — load only ever adds failures — so only the non-zero counts need a quiet machine.
+- **The automated mutation gate is language-scoped; the manual probe above is not.** Stryker instruments the JS/TS family and nothing else — there is **no shell parser**, so a guard whose logic lives in `.sh` yields no mutants under **any** `mutate` list. Adding one does not measure it: it aborts the whole run (`No parser registered for .sh!` — measured, not inferred) and takes every other guard's score with it. So a mutation gate that stays grey or green on a shell-guard change **measured nothing about that guard**, and reading it as coverage is the fifth failure mode above wearing a config file. Shell guards are covered by **driving tests only**: execute the script against a payload table and assert the blocked/allowed verdict, with a control on **both** sides — a refusal case *and* an allowed case. A shell guard nothing executes has no bite evidence at all, whatever the gate printed.
 - **Never scope the probe by filename, and never infer absent coverage from a grep.** Suites split at the line cap, so a protection's tests often sit in a sibling file: a filename-scoped probe reported cardinality 0 on a live security fix that a whole-suite run showed failing 4 tests, every one named for it.
 - **Assert that no copy is wrong, not that some copy is right.** An existential assertion over duplicated content is satisfied by the correct copy and cannot see the broken one — rewriting one suite's assertions to universal negatives took the same mutation from **0 to 18** failures. Enumerate the property (*every* marker uses an em-dash), never the one known-bad spelling.
 - **Reconstruct a red state; never narrate one you did not run.** Evidence describing a failing or dirty state must come from a run you actually observed — an evidence file once claimed "working tree clean" while listing two untracked scripts in the same file. To observe a state that no longer exists, check that commit out in a **throwaway detached-HEAD worktree** and run it there. Writing down what the output would have said is fabrication, however confident the reasoning.

package/plugins/lisa-copilot/rules/reference/base-rules.md

@@ -70,7 +70,7 @@ Testing Discipline:
 JIRA Discipline:
 - If working on a JIRA issue, make sure the branch you're working on references and is added to the JIRA issue.
 - If working on a JIRA issue, update the issue as you work through it. For example, if working on a Bug Triage, update the issue with your questions/feedback/suggestions.
-- When reading a JIRA issue, always read ALL comments on the ticket — not just the description. Comments contain critical context: stakeholder decisions, scope changes, blockers, triage findings from other repos, and implementation notes. Use the Atlassian MCP or `jira --config .lisa/jira-cli/.config.yml issue view <TICKET_ID> --comments 100` to fetch them (the `--config` pins jira-cli to the config the `setup-jira-cli` hook wrote; drop it to use the machine's own `~/.config/.jira/.config.yml`).
+- When reading a JIRA issue, always read ALL comments on the ticket — not just the description. Comments contain critical context: stakeholder decisions, scope changes, blockers, triage findings from other repos, and implementation notes. Use the Atlassian MCP or first resolve the project root from `$CLAUDE_PROJECT_DIR` or `git rev-parse --show-toplevel`, then run `jira --config "$PROJECT_ROOT/.lisa/jira-cli/.config.yml" issue view <TICKET_ID> --comments 100`. If that project config is absent, omit `--config` to use the machine's own `~/.config/.jira/.config.yml`.
 - When requesting clarification on a JIRA issue, post the question as a comment using ADF (Atlassian Document Format) and @mention the Reporter so they receive a notification.
 - When creating JIRA tickets, establish issue link relationships (e.g. "is blocked by", "blocks", "relates to", "is duplicated by") between tickets that have dependencies or logical connections. Do not leave related tickets unlinked. Relationship discovery is mandatory on every create and update — search BOTH the local git history (`git log --all --grep=<keyword>`, `git log -- <path>`) AND Jira (JQL by component, keyword, label, epic siblings) before declaring "no related work." Record the searches you ran and their outcomes in the description (or a comment) so a reviewer can see the search was real.
 - Ticket scope by type: Bug, Task, and Sub-task tickets MUST be single-repo (one work unit, one repo). Epic, Spike, and Story tickets MAY span multiple repos. If a Bug/Task/Sub-task crosses repos, split it per the `repo-scope-split` rule — at PRD-decomposition time via `task-decomposition` step 1.5 (parent Story + per-repo children); at work-time (an existing ticket an agent is about to implement) via the work-time split procedure (narrow the original to one repo, spin off a sibling per additional repo cloning its metadata, link the producer→consumer dependency, then proceed). A cross-repo work unit is a decomposition error the agent fixes by splitting, not a reason to bounce the ticket to the reporter.

package/plugins/lisa-copilot/rules/reference/falsifiable-checks.md

@@ -166,6 +166,20 @@ The obvious objection to any cardinality measured on a shared machine — *"your
 
 Practical consequence: an inert-guard finding is safe to report from a busy machine, while the "exactly one, or several all named alike" reading is only trustworthy once you have separated your mutation's failures from the load-flake population — which is what reading the *names* is for.
 
+### The automated gate stops at the language boundary
+
+Everything above is a *manual* probe, and it is language-agnostic: neuter a shell guard, run the suite, read the names, and the yardstick works exactly as it does for TypeScript.
+
+The **automated** mutation gate is not language-agnostic, and the difference is easy to miss because both end in a green result. Stryker's instrumenter is per-language — the JS/TS family, plus HTML and Svelte, which delegate to it. There is **no shell parser**. So:
+
+- A guard whose logic lives in `.sh` produces **no mutants under any `mutate` list**. It is outside the gate by construction, not by a selection decision, and widening the patterns cannot bring it in.
+- Adding a `.sh` path to `mutate` does not measure it and does not quietly no-op. Stryker throws out of instrumentation — `Unable to parse …. No parser registered for .sh!` — and the run aborts before a single mutant is tried, so **one such entry destroys the score of every other guard in the list.** Measured, not inferred.
+- Therefore a mutation gate that reports nothing-to-mutate, or reports green, on a change whose only guard edits were shell **measured nothing about those guards**. The absence of red is a property of the toolchain, not of the tests.
+
+What does measure a shell guard is a **driving test**: execute the script as a subprocess against a payload table and assert the verdict — blocked or allowed — with a control on **both** sides. A refusal-only suite cannot see a guard that refuses everything; an allow-only suite cannot see one that refuses nothing. Tests that merely `bash -n` the script, grep its source, or assert it exists are *source-shape* checks and are not evidence of bite.
+
+A shell guard with no test that executes it has **no bite evidence at all**, whatever any gate printed.
+
 ### Two reasons a real protection reports zero
 
 A cardinality of zero has two distinct innocent causes, and they need different fixes. Rule out both before concluding a guard is inert:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.10.13",
+  "version": "4.10.15",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-no-verify.sh

@@ -109,7 +109,10 @@ def strip_heredocs(text: str) -> str:
             words = shlex.split(raw, posix=True)
         except ValueError:
             return None
-        return words[0] if len(words) == 1 and words[0] else None
+        # An explicitly quoted empty word is a valid heredoc delimiter. Bash
+        # terminates that heredoc on the next empty line, so preserve "" as a
+        # marker instead of treating it as a parse failure.
+        return words[0] if len(words) == 1 else None
 
     index = 0
     while index < len(lines):