@codyswann/lisa 4.26.0 → 4.26.2

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/expo/create-only/.github/workflows/nightly-e2e-report.yml

@@ -15,12 +15,27 @@ name: 🌙 Nightly E2E Report
 #
 # ## This is NOT a gate — never make it a required check
 #
-# Its status answers "did reporting work", not "is the suite green". A red
-# nightly reported correctly is a successful report. Requiring this context would
-# hand an issues-API outage the power to block every pull request, which is
-# exactly the coupling the two-workflow split exists to prevent: the gate
-# workflow does not request `issues:` scope at all, so it cannot file, and this
-# one is not required, so it cannot block.
+# Requiring this context would hand an issues-API outage the power to block every
+# pull request, which is exactly the coupling the two-workflow split exists to
+# prevent: the gate workflow does not request `issues:` scope at all, so it
+# cannot file, and this one is not required, so it cannot block.
+#
+# ## Publishing is BEST EFFORT — this job's result tracks the SUITE
+#
+# The verdict goes to `$GITHUB_STEP_SUMMARY` first, then the tracking issue is
+# attempted, then whatever publishing did becomes a `::warning::`. So:
+#
+#   * A tracking issue that could not be written — Issues disabled on the
+#     repository, an API outage, a revoked scope — is a WARNING, and the verdict
+#     is still on the run's summary. The report channel does not die because its
+#     optional publishing destination is unavailable.
+#   * A genuinely RED suite fails this job.
+#   * A verdict that could not be resolved at all fails this job.
+#
+# Do NOT reach for `continue-on-error:` on the job below to quieten a failing
+# publish. It greens every run, including the ones that genuinely failed to
+# report — which is the failure this design exists to avoid. If publishing is
+# failing, the warning names the cause; fix that.
 #
 # ## Wiring this up
 #

package/package.json

@@ -161,7 +161,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -305,6 +305,6 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "6989b95675f7de9626bc472122de552fb3df3217",
-  "gitHead": "6989b95675f7de9626bc472122de552fb3df3217"
+  "lisaReleaseCommit": "671183a45139c27c367599e7c7adb963750dfb19",
+  "gitHead": "671183a45139c27c367599e7c7adb963750dfb19"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Harper/Fabric-specific Lisa rules for TypeScript component apps.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.26.0",
+  "version": "4.26.2",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"