@codyswann/lisa 4.34.14 → 4.34.16

package/plugins/lisa/hooks/block-no-verify.sh

@@ -33,7 +33,7 @@
 # Add a name here in the same commit that closes a vector. A hardening that
 # forgets to is invisible to refresh, and shows up as an unexplained diff at
 # review time instead of a named capability.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position, tilde-script-reach, shell-option-stdin-reach
 #
 # Shell-token matching avoids false positives from issue bodies, heredocs, and
 # commit-message prose while still catching quoted real argv values such as
@@ -265,8 +265,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,
@@ -977,7 +1007,7 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
-    text = token.strip().strip("'\"")
+    text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
         return (None, None)
@@ -999,6 +1029,48 @@ def resolve_script(token):
     return (None, "a script that does not exist or cannot be read")
 
 
+SHELL_COMMAND_STRING = object()
+SHELL_STDIN = object()
+
+
+def shell_execution_operand(args):
+    """The file a shell runs, or a sentinel for `-c` and stdin modes.
+
+    `shell_script_operand` intentionally collapses both cases to None for the
+    nested-command scanner. Reach cannot: `bash -c '...'` has already exposed
+    its text, while `bash -x`, `bash -e`, and `bash --` still await a script on
+    stdin and must remain linked to a following `< file` separator.
+    """
+    index = 0
+    opaque_option_seen = False
+    while index < len(args):
+        token = args[index]
+        if token == "--":
+            index += 1
+            break
+        if not token.startswith(("-", "+")):
+            if not opaque_option_seen:
+                break
+            index += 1
+            opaque_option_seen = False
+            continue
+        if token in SHELL_OPTIONS_SEPARATE_VALUE:
+            index += 2
+            continue
+        if token.startswith(SHELL_OPTIONS_INLINE_VALUE):
+            index += 1
+            continue
+        if token.startswith("--"):
+            if token not in SHELL_LONG_OPTIONS_NO_VALUE:
+                opaque_option_seen = True
+            index += 1
+            continue
+        if "c" in token[1:]:
+            return SHELL_COMMAND_STRING
+        index += 1
+    return args[index] if index < len(args) else SHELL_STDIN
+
+
 def executed_scripts(tokens):
     """The files a command line will RUN, and the executions it cannot follow.
 
@@ -1033,9 +1105,12 @@ def executed_scripts(tokens):
             if name in SOURCE_BUILTINS:
                 operand = arguments[0] if arguments else None
             elif name in SHELL_PROGRAMS:
-                operand = shell_script_operand(arguments)
-                if operand is None and not arguments:
+                operand = shell_execution_operand(arguments)
+                if operand is SHELL_STDIN:
                     previous_shell_awaiting_stdin = True
+                    continue
+                if operand is SHELL_COMMAND_STRING:
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/lisa/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -460,6 +460,50 @@ passed off as success.
   `blocked:unreviewed`. This fallback lives inside the gated section above —
   with `auto_merge=false` it never fires; the PR remains open awaiting a human.
 
+### The mergeability gate — never arm a PR that cannot merge
+
+The arm gate above asks *did the review context do work?* This one asks a
+different question — *is there a verdict standing in the way?* — and they are
+not the same. A `CHANGES_REQUESTED` review unambiguously **did work**, so it
+sails through the arm gate and the latch goes on over the top of it.
+
+**Read `reviewDecision` explicitly. Never infer it from a check count.**
+
+```bash
+gh pr view <pr> --json reviewDecision,reviewThreads \
+  --jq '{decision: .reviewDecision, unresolved: [.reviewThreads[]? | select(.isResolved == false)] | length}'
+```
+
+`reviewDecision` is **not part of `statusCheckRollup`**. That is the whole reason
+this stayed invisible: a failing-check count reads **zero** on a PR that can
+never merge, and the checks tab is entirely green. Any rule keyed on "no red
+checks" is satisfied by exactly the PR this gate exists to catch (#3720).
+
+**Do not arm while `reviewDecision == CHANGES_REQUESTED`.** Arming is a claim
+that this PR will merge, and that claim is false here. Clear the verdict through
+step (e) first — which discriminates a live objection from a stranded one by
+unresolved thread count, not by `reviewDecision` — and arm afterwards.
+
+**Two ruleset settings decide whether a standing verdict ever clears itself, and
+in this repository both say no.** Verify them for the repo you are in rather
+than assuming, with `gh api repos/<owner>/<repo>/rulesets`:
+
+- `dismiss_stale_reviews_on_push: false` — the review stays attached to the
+  commit it was made on, so **pushing the fix never clears it**. The intuition
+  that a new head resets the verdict is wrong here.
+- `required_approving_review_count: 0` — no approval is required to merge, so a
+  standing `CHANGES_REQUESTED` is not holding a slot for a review that would
+  otherwise arrive. Nothing is scheduled to clear it.
+
+Together those mean the block is **indefinite, not slow**. Waiting is not a
+strategy; something has to act.
+
+**Unresolved threads block independently of the verdict.** This repository sets
+`required_review_thread_resolution: true`, so a PR can have a clear
+`reviewDecision` and still be unmergeable on threads alone — a second blocker
+that is equally absent from the check rollup. Read both, and name whichever one
+is standing; reporting the wrong one sends the operator to the wrong place.
+
 ## 2. The watch loop
 
 Poll the live state each iteration:
@@ -1078,6 +1122,14 @@ Loop until one of:
   the one thing nobody would then do is investigate it. Usually a missing
   `issues: read` / label-read permission, which is fixable and invisible from
   the merge outcome alone.
+- **`blocked:armed-unmergeable`** — the PR is OPEN, auto-merge is ON, every check
+  is green, and it still cannot merge: `reviewDecision == CHANGES_REQUESTED`, or
+  unresolved review threads under `required_review_thread_resolution`. Report the
+  PR URL, **which** of the two is standing, and that it will not clear itself.
+  For example: *"PR #123 looks ready — every check is green and auto-merge is on
+  — but a review asked for changes and that is still on record, so it will sit
+  there forever. Someone needs to clear that review or resolve the open
+  comments."* Never report this PR as merging.
 - **`CLOSED`** → report (PR was closed without merge).
 - **Hard block needing a human**: an unresolvable conflict, a failing check that
   needs design input, or genuine unresolved human objection (not a bot gate). Stop
@@ -1087,6 +1139,44 @@ Loop until one of:
   adversarial-review substitute is posted (step d); it never extends to any
   other gate.
 
+### Before you stop: never leave a PR armed and unmergeable in silence
+
+**This applies at every exit that leaves the PR OPEN** — not only the terminal
+states above, but any point where this run concludes it is finished, hands back,
+or gives up. Re-read, from the live PR, immediately before reporting:
+
+```bash
+gh pr view <pr> --json state,autoMergeRequest,reviewDecision,reviewThreads \
+  --jq '{state, armed: (.autoMergeRequest != null), decision: .reviewDecision,
+         unresolved: [.reviewThreads[]? | select(.isResolved == false)] | length}'
+```
+
+If `state == OPEN` and `armed` and either `decision == "CHANGES_REQUESTED"` or
+`unresolved > 0`, the outcome is **`blocked:armed-unmergeable`** — never a
+success, and never silence.
+
+**Why this exists rather than trusting the loop.** While the loop runs this is
+already covered: the watch poll reads `reviewDecision` and step (e) handles it.
+The failure is a run that **stops** while the PR is armed and blocked — the
+session ends, or the agent decides the work is done because arming looked like
+completion. Measured (#3720): three PRs were left armed, green and permanently
+unmergeable, and every one was found only because a person queried
+`reviewDecision` by hand. An agent that arms auto-merge and reports "armed, will
+merge" is reporting something false and has no reason to know it.
+
+**Arming is not completion.** It is a claim about the future that this check is
+what makes honest. The claim costs nothing when true — one read, and the report
+says merging — and when false it is the only thing standing between a parked PR
+and nobody noticing for hours.
+
+**Read the two fields; do not substitute a check count.** Zero failing checks is
+the symptom, not the signal — that is precisely why this class was invisible.
+
+In `on_blocker=report` mode the same condition returns the existing
+`blocked:changes_requested` classification rather than this terminal state: that
+mode returns a blocker for the caller to act on, and does not drive. The two
+names describe the same PR seen from the two modes.
+
 At every terminal state, release the babysitter lease
 (`gh pr edit <pr> --remove-label "lisa:babysitter-on-duty"`) so the CI
 auto-fix workflow can take over as fixer of last resort if the branch goes

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1432,8 +1432,20 @@ EXEC_WRAPPERS = {
 }
 
 # Interpreter options that mean "no script file follows": a command string or a
-# module name, both of which the guard reads by other means or not at all.
-NO_SCRIPT_OPTIONS = {"-c", "-e", "-m", "--eval", "--command", "--module"}
+# module name, both of which the guard reads by other means or not at all. These
+# are interpreter-specific on purpose. `bash -e create.sh` and `sh -m create.sh`
+# still execute the following file; treating Python and Node flags as universal
+# silently stopped the scan before those shell operands.
+NO_SCRIPT_OPTIONS = {
+    "bun": {"-e", "--eval"},
+    "node": {"-e", "--eval"},
+    "nodejs": {"-e", "--eval"},
+    "perl": {"-e"},
+    "php": {"-r"},
+    "python": {"-c", "-m", "--command", "--module"},
+    "python3": {"-c", "-m", "--command", "--module"},
+    "ruby": {"-e"},
+}
 
 # Programs that READ their operands and never execute them as programs.
 #
@@ -1569,7 +1581,12 @@ def executed_operand(argv):
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
-            if argument in NO_SCRIPT_OPTIONS or head in NO_SCRIPT_OPTIONS:
+            if program in {"bash", "dash", "ksh", "sh", "zsh"}:
+                # Shell `-c` may be clustered (`-ec`), while `-e` and `-m` are
+                # ordinary shell options and do not consume the script path.
+                if not head.startswith("--") and "c" in head[1:]:
+                    return None
+            elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             continue
         return argument

package/plugins/lisa-agy/hooks/block-no-verify.agy.sh

@@ -28,7 +28,7 @@
 # not JSON). Malformed/empty stdin → allow (fail open, never crash the tool).
 #
 # Capability names below are the canonical guard's, kept identical on every agent.
-# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position
+# lisa-guard-capabilities: no-verify-abbrev, husky-env, hookspath-allowlist, config-env, env-split-string, git-config-key, git-config-parameters, git-config-parameters-append, git-config-parameters-expansion, heredoc-shell-word, herestring-aware, no-verify-short, nested-shell-no-verify, nested-shell-long-options, env-split-string-abbrev, command-wrapper-normalization, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, dispatcher-exec-position, tilde-script-reach, shell-option-stdin-reach
 set -uo pipefail
 
 allow() {
@@ -195,8 +195,38 @@ ENV_LONG_SEPARATE_VALUE = {"--argv0", "--chdir", "--split-string", "--unset"}
 
 # env's single-letter options, by whether the rest of a cluster is more
 # options or the option's value.
+#
+# BOTH PLATFORMS' SETS, not one. These began as GNU's, and an option that is
+# in neither set falls through to `ambiguous`, which this guard treats as
+# suspicious. That default is correct and stays — an unknown option genuinely
+# could take a value and swallow the command name. What is wrong is a
+# well-known option being unknown, and on a macOS fleet `env -P` is exactly
+# that: BSD's "search altpath for the utility", refused on every ordinary
+# command it prefixes.
+#
+# Measured, one option at a time, against the guard before this change. BSD's
+# complete short set is `0 i v u C P S`, from the synopsis in env(1):
+#
+#     allowed   -0  -i  -v  -u NAME  -C DIR     already covered
+#     BLOCKED   -P altpath                      the defect, and the ONLY one
+#     BLOCKED   -S string                       correct: split-string reparses
+#                                               an opaque payload, so what it
+#                                               runs cannot be proven here
+#     BLOCKED   -Z  -Q                          correct: unknown stays suspicious
+#
+# So the population is one letter, not a class. The two platforms' short
+# options coincide everywhere else, which is why "detect the platform and
+# choose a table" would be machinery for a single character — and would fail
+# on a machine running GNU coreutils under a BSD userland, or the reverse.
+# Recognising the union is both smaller and more robust.
+#
+# Adding a letter here is a WEAKENING, so it needs the same evidence as any
+# other: ten bypass shapes routed through `-P` — long flag, attached value,
+# short cluster, abbreviation, an assignment, `HUSKY=0`, a hooksPath disable,
+# a nested `-c` shell, an executed script, and `-P` swallowing the command
+# word — were all refused before this change and are all still refused after.
 ENV_SHORT_NO_VALUE = frozenset("i0v")
-ENV_SHORT_TAKES_VALUE = frozenset("uCaS")
+ENV_SHORT_TAKES_VALUE = frozenset("uCaSP")
 
 # Builtins and wrappers that run whatever FOLLOWS them without changing what
 # it is: `command env -S ...` runs exactly the `env` that `env -S ...` runs,
@@ -907,7 +937,7 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
-    text = token.strip().strip("'\"")
+    text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
         return (None, None)
@@ -929,6 +959,48 @@ def resolve_script(token):
     return (None, "a script that does not exist or cannot be read")
 
 
+SHELL_COMMAND_STRING = object()
+SHELL_STDIN = object()
+
+
+def shell_execution_operand(args):
+    """The file a shell runs, or a sentinel for `-c` and stdin modes.
+
+    `shell_script_operand` intentionally collapses both cases to None for the
+    nested-command scanner. Reach cannot: `bash -c '...'` has already exposed
+    its text, while `bash -x`, `bash -e`, and `bash --` still await a script on
+    stdin and must remain linked to a following `< file` separator.
+    """
+    index = 0
+    opaque_option_seen = False
+    while index < len(args):
+        token = args[index]
+        if token == "--":
+            index += 1
+            break
+        if not token.startswith(("-", "+")):
+            if not opaque_option_seen:
+                break
+            index += 1
+            opaque_option_seen = False
+            continue
+        if token in SHELL_OPTIONS_SEPARATE_VALUE:
+            index += 2
+            continue
+        if token.startswith(SHELL_OPTIONS_INLINE_VALUE):
+            index += 1
+            continue
+        if token.startswith("--"):
+            if token not in SHELL_LONG_OPTIONS_NO_VALUE:
+                opaque_option_seen = True
+            index += 1
+            continue
+        if "c" in token[1:]:
+            return SHELL_COMMAND_STRING
+        index += 1
+    return args[index] if index < len(args) else SHELL_STDIN
+
+
 def executed_scripts(tokens):
     """The files a command line will RUN, and the executions it cannot follow.
 
@@ -963,9 +1035,12 @@ def executed_scripts(tokens):
             if name in SOURCE_BUILTINS:
                 operand = arguments[0] if arguments else None
             elif name in SHELL_PROGRAMS:
-                operand = shell_script_operand(arguments)
-                if operand is None and not arguments:
+                operand = shell_execution_operand(arguments)
+                if operand is SHELL_STDIN:
                     previous_shell_awaiting_stdin = True
+                    continue
+                if operand is SHELL_COMMAND_STRING:
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-drive-pr-to-merge/SKILL.md

@@ -460,6 +460,50 @@ passed off as success.
   `blocked:unreviewed`. This fallback lives inside the gated section above —
   with `auto_merge=false` it never fires; the PR remains open awaiting a human.
 
+### The mergeability gate — never arm a PR that cannot merge
+
+The arm gate above asks *did the review context do work?* This one asks a
+different question — *is there a verdict standing in the way?* — and they are
+not the same. A `CHANGES_REQUESTED` review unambiguously **did work**, so it
+sails through the arm gate and the latch goes on over the top of it.
+
+**Read `reviewDecision` explicitly. Never infer it from a check count.**
+
+```bash
+gh pr view <pr> --json reviewDecision,reviewThreads \
+  --jq '{decision: .reviewDecision, unresolved: [.reviewThreads[]? | select(.isResolved == false)] | length}'
+```
+
+`reviewDecision` is **not part of `statusCheckRollup`**. That is the whole reason
+this stayed invisible: a failing-check count reads **zero** on a PR that can
+never merge, and the checks tab is entirely green. Any rule keyed on "no red
+checks" is satisfied by exactly the PR this gate exists to catch (#3720).
+
+**Do not arm while `reviewDecision == CHANGES_REQUESTED`.** Arming is a claim
+that this PR will merge, and that claim is false here. Clear the verdict through
+step (e) first — which discriminates a live objection from a stranded one by
+unresolved thread count, not by `reviewDecision` — and arm afterwards.
+
+**Two ruleset settings decide whether a standing verdict ever clears itself, and
+in this repository both say no.** Verify them for the repo you are in rather
+than assuming, with `gh api repos/<owner>/<repo>/rulesets`:
+
+- `dismiss_stale_reviews_on_push: false` — the review stays attached to the
+  commit it was made on, so **pushing the fix never clears it**. The intuition
+  that a new head resets the verdict is wrong here.
+- `required_approving_review_count: 0` — no approval is required to merge, so a
+  standing `CHANGES_REQUESTED` is not holding a slot for a review that would
+  otherwise arrive. Nothing is scheduled to clear it.
+
+Together those mean the block is **indefinite, not slow**. Waiting is not a
+strategy; something has to act.
+
+**Unresolved threads block independently of the verdict.** This repository sets
+`required_review_thread_resolution: true`, so a PR can have a clear
+`reviewDecision` and still be unmergeable on threads alone — a second blocker
+that is equally absent from the check rollup. Read both, and name whichever one
+is standing; reporting the wrong one sends the operator to the wrong place.
+
 ## 2. The watch loop
 
 Poll the live state each iteration:
@@ -1078,6 +1122,14 @@ Loop until one of:
   the one thing nobody would then do is investigate it. Usually a missing
   `issues: read` / label-read permission, which is fixable and invisible from
   the merge outcome alone.
+- **`blocked:armed-unmergeable`** — the PR is OPEN, auto-merge is ON, every check
+  is green, and it still cannot merge: `reviewDecision == CHANGES_REQUESTED`, or
+  unresolved review threads under `required_review_thread_resolution`. Report the
+  PR URL, **which** of the two is standing, and that it will not clear itself.
+  For example: *"PR #123 looks ready — every check is green and auto-merge is on
+  — but a review asked for changes and that is still on record, so it will sit
+  there forever. Someone needs to clear that review or resolve the open
+  comments."* Never report this PR as merging.
 - **`CLOSED`** → report (PR was closed without merge).
 - **Hard block needing a human**: an unresolvable conflict, a failing check that
   needs design input, or genuine unresolved human objection (not a bot gate). Stop
@@ -1087,6 +1139,44 @@ Loop until one of:
   adversarial-review substitute is posted (step d); it never extends to any
   other gate.
 
+### Before you stop: never leave a PR armed and unmergeable in silence
+
+**This applies at every exit that leaves the PR OPEN** — not only the terminal
+states above, but any point where this run concludes it is finished, hands back,
+or gives up. Re-read, from the live PR, immediately before reporting:
+
+```bash
+gh pr view <pr> --json state,autoMergeRequest,reviewDecision,reviewThreads \
+  --jq '{state, armed: (.autoMergeRequest != null), decision: .reviewDecision,
+         unresolved: [.reviewThreads[]? | select(.isResolved == false)] | length}'
+```
+
+If `state == OPEN` and `armed` and either `decision == "CHANGES_REQUESTED"` or
+`unresolved > 0`, the outcome is **`blocked:armed-unmergeable`** — never a
+success, and never silence.
+
+**Why this exists rather than trusting the loop.** While the loop runs this is
+already covered: the watch poll reads `reviewDecision` and step (e) handles it.
+The failure is a run that **stops** while the PR is armed and blocked — the
+session ends, or the agent decides the work is done because arming looked like
+completion. Measured (#3720): three PRs were left armed, green and permanently
+unmergeable, and every one was found only because a person queried
+`reviewDecision` by hand. An agent that arms auto-merge and reports "armed, will
+merge" is reporting something false and has no reason to know it.
+
+**Arming is not completion.** It is a claim about the future that this check is
+what makes honest. The claim costs nothing when true — one read, and the report
+says merging — and when false it is the only thing standing between a parked PR
+and nobody noticing for hours.
+
+**Read the two fields; do not substitute a check count.** Zero failing checks is
+the symptom, not the signal — that is precisely why this class was invisible.
+
+In `on_blocker=report` mode the same condition returns the existing
+`blocked:changes_requested` classification rather than this terminal state: that
+mode returns a blocker for the caller to act on, and does not drive. The two
+names describe the same PR seen from the two modes.
+
 At every terminal state, release the babysitter lease
 (`gh pr edit <pr> --remove-label "lisa:babysitter-on-duty"`) so the CI
 auto-fix workflow can take over as fixer of last resort if the branch goes

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.14",
+  "version": "4.34.16",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -1432,8 +1432,20 @@ EXEC_WRAPPERS = {
 }
 
 # Interpreter options that mean "no script file follows": a command string or a
-# module name, both of which the guard reads by other means or not at all.
-NO_SCRIPT_OPTIONS = {"-c", "-e", "-m", "--eval", "--command", "--module"}
+# module name, both of which the guard reads by other means or not at all. These
+# are interpreter-specific on purpose. `bash -e create.sh` and `sh -m create.sh`
+# still execute the following file; treating Python and Node flags as universal
+# silently stopped the scan before those shell operands.
+NO_SCRIPT_OPTIONS = {
+    "bun": {"-e", "--eval"},
+    "node": {"-e", "--eval"},
+    "nodejs": {"-e", "--eval"},
+    "perl": {"-e"},
+    "php": {"-r"},
+    "python": {"-c", "-m", "--command", "--module"},
+    "python3": {"-c", "-m", "--command", "--module"},
+    "ruby": {"-e"},
+}
 
 # Programs that READ their operands and never execute them as programs.
 #
@@ -1569,7 +1581,12 @@ def executed_operand(argv):
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
-            if argument in NO_SCRIPT_OPTIONS or head in NO_SCRIPT_OPTIONS:
+            if program in {"bash", "dash", "ksh", "sh", "zsh"}:
+                # Shell `-c` may be clustered (`-ec`), while `-e` and `-m` are
+                # ordinary shell options and do not consume the script path.
+                if not head.startswith("--") and "c" in head[1:]:
+                    return None
+            elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             continue
         return argument