@codyswann/lisa 4.26.1 → 4.26.3

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-copilot/skills/lisa-jira-journey/SKILL.md

@@ -37,8 +37,30 @@ python3 .claude/skills/jira-journey/scripts/parse-plan.py <TICKET_ID>
 
 The parser resolves Jira configuration from the checkout first: it searches
 `$CLAUDE_PROJECT_DIR/.lisa/jira-cli/.config.yml`, then the current directory and
-its parents, and only then falls back to `~/.config/.jira/.config.yml`. Do not
-copy project settings into the home-level file just to make this step work.
+its parents, and uses `~/.config/.jira/.config.yml` when no checkout config
+exists. Do not copy project settings into the home-level file just to make this
+step work.
+
+A checkout config is not automatically trusted. The first checkout candidate
+that exists is decisive — that is `$CLAUDE_PROJECT_DIR` when it is set, which
+outranks a config nearer the current directory, and only otherwise the nearest
+one walking up from the current directory. Its server must match the operator's
+trust root — `JIRA_SERVER` when set, otherwise the home config — and a mismatch
+fails naming that file rather than quietly using the home config instead, so the
+error points at the file that is actually wrong.
+
+`server` must be a bare HTTPS origin: `https://host`, optionally with a port and
+a single trailing slash. An explicit `:443` is accepted and canonicalized away,
+so `https://host:443` and `https://host` are the same origin and either may be
+configured. Userinfo (`https://user:token@…`), a query, a fragment, and any
+other path are refused rather than trimmed away. So are a hostname this parser
+cannot describe unambiguously — surrounding whitespace, control characters,
+percent-encoded or non-ASCII hostnames, a trailing dot, and port 0.
+The reason is that this value is both the trust key and the base every request
+is built from; normalizing a richer URL down to its origin would approve one
+value and then send the API token to a different one. Self-hosted context paths
+and internationalized hostnames are out of scope and would need their own
+base-path contract.
 
 The script outputs JSON with: `ticket`, `prerequisites`, `steps`, `viewports`, `assertions`.
 

package/plugins/lisa-copilot/skills/lisa-jira-journey/scripts/parse-plan.py

@@ -25,6 +25,7 @@ Output (JSON):
     }
 """
 
+import ipaddress
 import json
 import os
 import re
@@ -41,6 +42,24 @@ from urllib.parse import urlsplit
 # a capture obligation.
 LOCAL_EVIDENCE_PATTERN = re.compile(r'\[(SCREENSHOT|EVIDENCE):\s*([^\]]+)\]')
 
+# One ASCII DNS name: dot-separated labels of letters, digits and inner hyphens.
+# IPv4 literals are a subset of this form. Anything else -- percent-encoding, a
+# trailing dot, an empty label, a leading or trailing hyphen -- is refused,
+# because a hostname this pattern cannot describe is one whose meaning depends
+# on who resolves it.
+DNS_NAME_PATTERN = re.compile(
+    r'^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$'
+)
+
+# The only two path spellings that mean "no path".
+ROOT_PATHS = ("", "/")
+
+DEFAULT_HTTPS_PORT = 443
+
+
+class JiraConfigError(Exception):
+    """A configured Jira server could not be established as trusted."""
+
 
 def jira_config_candidates():
     """Return project-first jira-cli config candidates without duplicates."""
@@ -80,63 +99,158 @@ def read_jira_config(config_path):
     return server, login
 
 
+def canonical_authority(netloc, hostname):
+    """Return the canonical authority for one host, or "" when it is not one."""
+    if netloc.startswith("["):
+        try:
+            return f"[{ipaddress.IPv6Address(hostname).compressed}]"
+        except ValueError:
+            return ""
+    return hostname if DNS_NAME_PATTERN.match(hostname) else ""
+
+
+def is_bare_origin(server, parsed):
+    """Report whether the raw value names an origin and nothing besides.
+
+    The query and fragment are checked against the raw string rather than the
+    parse, because ``https://host?`` and ``https://host`` parse to the same
+    empty query. A delimiter carrying nothing is still a component the operator
+    wrote and the trust key would discard.
+    """
+    if "?" in server or "#" in server:
+        return False
+    if parsed.scheme != "https" or "@" in parsed.netloc:
+        return False
+    return parsed.path in ROOT_PATHS
+
+
 def server_origin(server):
-    """Return the normalized HTTPS origin used as the credential trust key."""
+    """Return the canonical HTTPS origin, or "" when the value is not one.
+
+    This value is both the credential trust key and the base every request is
+    built from, so the two have to be the same string. A normalizer that reduced
+    an arbitrary URL to its origin would approve one value and send another:
+    userinfo, a query, a fragment, or a path would ride along into the request
+    while the trust check saw only the host, which is how an API token reaches a
+    URL that validation never approved. So the accepted grammar is a bare
+    origin -- ``https://host`` or ``https://host/`` with an optional non-default
+    port -- and every richer form is refused rather than trimmed down to fit.
+
+    Self-hosted context paths and internationalized hostnames are deliberately
+    out of scope: either needs its own base-path contract, and inventing one
+    here would re-open the gap between what is checked and what is sent.
+    """
+    if not server or any(char <= " " or char >= "\x7f" for char in server):
+        return ""
     try:
         parsed = urlsplit(server)
         port = parsed.port
     except ValueError:
         return ""
-    if parsed.scheme.lower() != "https" or not parsed.hostname:
+    if not parsed.hostname or port == 0:
+        return ""
+    if not is_bare_origin(server, parsed):
         return ""
-    if port == 0:
+    authority = canonical_authority(parsed.netloc, parsed.hostname)
+    if not authority:
         return ""
-    hostname = parsed.hostname.lower()
-    authority = f"[{hostname}]" if ":" in hostname else hostname
-    if port is not None and port != 443:
+    if port is not None and port != DEFAULT_HTTPS_PORT:
         authority = f"{authority}:{port}"
     return f"https://{authority}"
 
 
-def resolve_jira_config_path():
-    """Resolve a project config only when its host matches a user trust root."""
+def resolve_trusted_origin():
+    """Return the operator-owned origin a checkout config must match, or "".
+
+    An explicit JIRA_SERVER wins over the home config. A JIRA_SERVER that is not
+    a canonical origin raises rather than resolving to "": degrading a malformed
+    trust root into "no trust root" would silently widen what a checkout config
+    is allowed to claim, which is the opposite of what setting it asked for.
+    """
+    configured = os.environ.get("JIRA_SERVER", "")
+    if configured.strip():
+        origin = server_origin(configured)
+        if not origin:
+            raise JiraConfigError(
+                "JIRA_SERVER must be a valid HTTPS URL naming one origin, with "
+                "no userinfo, path, query or fragment"
+            )
+        return origin
+
+    home_config = (Path.home() / ".config" / ".jira" / ".config.yml").resolve()
+    if not home_config.exists():
+        return ""
+    return server_origin(read_jira_config(home_config)[0])
+
+
+def resolve_jira_config_path(trusted_origin=None):
+    """Select the jira-cli config that governs this checkout.
+
+    The nearest checkout-owned config is decisive. When one exists it must match
+    the operator's trust root, and a mismatch fails naming that file. Falling
+    through to the home config instead would report a missing or unusable home
+    config for a project config that was found and refused -- an error about the
+    wrong file, pointing whoever has to fix it away from the one that is wrong.
+
+    Args:
+        trusted_origin: The operator's trust root, resolved when not supplied.
+    """
     candidates = jira_config_candidates()
     home_config = candidates[-1]
-    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
-    if not trusted_server and home_config.exists():
-        trusted_server, _ = read_jira_config(home_config)
-    trusted_origin = server_origin(trusted_server)
+    if trusted_origin is None:
+        trusted_origin = resolve_trusted_origin()
 
     for candidate in candidates[:-1]:
         if not candidate.exists():
             continue
-        candidate_server, _ = read_jira_config(candidate)
-        if trusted_origin and server_origin(candidate_server) == trusted_origin:
-            return candidate
+        if not trusted_origin:
+            raise JiraConfigError(
+                f"jira-cli config {candidate} cannot be trusted: neither "
+                "JIRA_SERVER nor a home config establishes a trust root"
+            )
+        if server_origin(read_jira_config(candidate)[0]) != trusted_origin:
+            raise JiraConfigError(
+                f"jira-cli config {candidate} server does not match the "
+                "trusted JIRA server origin"
+            )
+        return candidate
     return home_config
 
 
 def get_jira_config():
-    """Read JIRA server and login from the project-first jira-cli config."""
-    config_path = resolve_jira_config_path()
+    """Read JIRA server and login from the project-first jira-cli config.
+
+    Every exit below happens before the token is read, so a configured URL that
+    fails validation cannot reach a request. The returned server is the
+    canonical origin, never the configured string, which is what keeps the value
+    that was checked and the value that is sent identical.
+    """
+    try:
+        trusted_origin = resolve_trusted_origin()
+        config_path = resolve_jira_config_path(trusted_origin)
+    except JiraConfigError as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        sys.exit(1)
+
     if not config_path.exists():
         print(f"ERROR: jira-cli config not found at {config_path}", file=sys.stderr)
         sys.exit(1)
 
     server, login = read_jira_config(config_path)
-
-    trusted_server = os.environ.get("JIRA_SERVER", "").strip()
-    trusted_origin = server_origin(trusted_server)
-    if trusted_server and not trusted_origin:
-        print("ERROR: JIRA_SERVER must be a valid HTTPS URL", file=sys.stderr)
+    origin = server_origin(server)
+    if not origin:
+        print(
+            f"ERROR: JIRA server in {config_path} must be an HTTPS URL naming "
+            "one origin, with no userinfo, path, query or fragment",
+            file=sys.stderr,
+        )
         sys.exit(1)
-    if trusted_origin:
-        if server_origin(server) != trusted_origin:
-            print("ERROR: jira-cli config server does not match trusted JIRA_SERVER", file=sys.stderr)
-            sys.exit(1)
-        server = trusted_server.rstrip("/")
-    if not server_origin(server):
-        print("ERROR: JIRA server must be an HTTPS URL from a trusted config", file=sys.stderr)
+    if trusted_origin and origin != trusted_origin:
+        print(
+            f"ERROR: jira-cli config {config_path} server does not match the "
+            "trusted JIRA server origin",
+            file=sys.stderr,
+        )
         sys.exit(1)
 
     token = os.environ.get("JIRA_API_TOKEN", "")
@@ -144,7 +258,7 @@ def get_jira_config():
         print("ERROR: JIRA_API_TOKEN env var not set", file=sys.stderr)
         sys.exit(1)
 
-    return server, login, token
+    return origin, login, token
 
 
 def fetch_ticket(server, login, token, ticket_id):

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.26.1",
+  "version": "4.26.3",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -1035,6 +1035,69 @@ fi
 # purpose, and blocking those would be the collision that gets a guard switched
 # off. The trailing `([/[:space:]'"$qc"']|$)` is what draws that line.
 readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$)'
+# This guard is the one segment walk that pairs TWO facts found in different
+# places: the protected target (`.git`) and the destructive verb (a recursive
+# forced delete). That makes its segmentation load-bearing in a way the rm and
+# push walks' is not — those two read a verb and its own operands, which are
+# always in one pipeline stage, so splitting on `|` costs them nothing.
+#
+# Here it cost everything. The old feeder was `tr '&|;' '\n'`, which cut a
+# PIPELINE into pieces before the pairing question was asked, and a pipeline is
+# exactly how a delete reaches a target named upstream of it:
+# `find .git -type f -print0 | xargs -0 rm -rf` became `find .git -type f
+# -print0` (a target, no verb) and `xargs -0 rm -rf` (a verb, no target), and
+# neither half could answer. Measured before this fix, with the blanket
+# `xargs rm -rf` rule masking the reported shape: `find .git -type d | parallel
+# rm -rf`, `… | /usr/bin/xargs rm -rf`, `… | xargs -0 -- rm --recursive
+# --force`, `… 2>&1 | parallel rm -rf`, `… |& parallel rm -rf` and
+# `cat .git/config | grep url | rm -rf refs` were ALL allowed (CodySwannGT/lisa#3320).
+#
+# So segment on STATEMENT boundaries and nothing else. A pipe joins stages of
+# one statement; `;`, `&`, `&&` and `||` end one. Three spellings have to be
+# normalized first or a naive split gets them wrong in both directions:
+#
+#   `|&`    bash's pipe-with-stderr. Splitting its `&` would halve a pipeline —
+#           the same fail-open, wearing a different operator. Becomes `|`.
+#   `2>&1`  a redirection, not a boundary (also `>&2`, `<&3`, `&>file`). These
+#           are where `&` appears WITHOUT ending a statement, and they are
+#           common enough that ignoring them would reopen the hole on any
+#           pipeline that redirects stderr. The `&` is folded away.
+#   `||`    a real boundary that happens to be built from pipe characters, so it
+#           must be recognized BEFORE a single `|` is spared. Becomes `;`.
+#
+# Every one of those rewrites only ever REMOVES a boundary or leaves it intact,
+# so each can merge two segments but never split one — the fail-closed
+# direction. `&` and `;` still separate, so unrelated commands are not joined.
+#
+# The leading awk is the same idea one level up. A line ending in `|` is bash's
+# OTHER implicit continuation — the pipeline resumes on the next line — and the
+# per-line read below would otherwise part the stages exactly as `tr` did, so
+# `find .git -type d |`↵`  parallel rm -rf` fails open through the newline
+# instead of through the pipe. This mirrors the backslash-continuation join that
+# `normalized_command_str` already performs for the same reason. It is done here
+# rather than in that shared normalization deliberately: this guard is the one
+# that pairs facts across stages, so it is the one that needs the stages kept
+# together, and widening the shared normalization would change every other
+# guard's segmentation for no defect anyone has measured.
+#
+# The status check is the second half of the fix and closes a quieter hole. This
+# feeder had none, while the rm and push walks above both have one: a segmenter
+# that could not run produced no lines, the loop body never executed, and the
+# guard was skipped with the command ALLOWED. A segmentation that cannot answer
+# must refuse, exactly like a scan that cannot answer.
+git_segments_status=0
+git_segments="$(printf '%s' "$normalized_command_str" \
+  | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
+  | sed -e 's/|&/|/g' \
+    -e 's/&>/>/g' \
+    -e 's/[0-9]*>&[0-9-]*/>/g' \
+    -e 's/[0-9]*<&[0-9-]*/</g' \
+    -e 's/||/;/g' \
+  | tr '&;' '\n')" || git_segments_status=$?
+case "$git_segments_status" in
+  0) ;;
+  *) scan_failed "$git_segments_status" ;;
+esac
 while IFS= read -r git_stmt; do
   [ -n "$git_stmt" ] || continue
   if ! scan -E "$git_stmt" "$RM_RF_CLUSTER" \
@@ -1044,7 +1107,7 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead, or re-clone if the checkout is genuinely to be discarded."
   fi
-done <<< "$(printf '%s' "$normalized_command_str" | tr '&|;' '\n')"
+done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even
 # when nothing is copied anywhere: the value lands in a log, a context window,

package/plugins/lisa-cursor/skills/lisa-jira-journey/SKILL.md

@@ -37,8 +37,30 @@ python3 .claude/skills/jira-journey/scripts/parse-plan.py <TICKET_ID>
 
 The parser resolves Jira configuration from the checkout first: it searches
 `$CLAUDE_PROJECT_DIR/.lisa/jira-cli/.config.yml`, then the current directory and
-its parents, and only then falls back to `~/.config/.jira/.config.yml`. Do not
-copy project settings into the home-level file just to make this step work.
+its parents, and uses `~/.config/.jira/.config.yml` when no checkout config
+exists. Do not copy project settings into the home-level file just to make this
+step work.
+
+A checkout config is not automatically trusted. The first checkout candidate
+that exists is decisive — that is `$CLAUDE_PROJECT_DIR` when it is set, which
+outranks a config nearer the current directory, and only otherwise the nearest
+one walking up from the current directory. Its server must match the operator's
+trust root — `JIRA_SERVER` when set, otherwise the home config — and a mismatch
+fails naming that file rather than quietly using the home config instead, so the
+error points at the file that is actually wrong.
+
+`server` must be a bare HTTPS origin: `https://host`, optionally with a port and
+a single trailing slash. An explicit `:443` is accepted and canonicalized away,
+so `https://host:443` and `https://host` are the same origin and either may be
+configured. Userinfo (`https://user:token@…`), a query, a fragment, and any
+other path are refused rather than trimmed away. So are a hostname this parser
+cannot describe unambiguously — surrounding whitespace, control characters,
+percent-encoded or non-ASCII hostnames, a trailing dot, and port 0.
+The reason is that this value is both the trust key and the base every request
+is built from; normalizing a richer URL down to its origin would approve one
+value and then send the API token to a different one. Self-hosted context paths
+and internationalized hostnames are out of scope and would need their own
+base-path contract.
 
 The script outputs JSON with: `ticket`, `prerequisites`, `steps`, `viewports`, `assertions`.