@codyswann/lisa 4.34.19 → 4.34.21

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -162,6 +162,37 @@ describes yours:
 EOF
 )"
 
+# How to preserve uncommitted work before an operation that would discard it.
+#
+# This is appended to the reasons that refuse a discarding operation, and its
+# whole point is what it does NOT say (issue #3722). The obvious advice is
+# "stash it first", and on a single-checkout repository that is fine. Here it
+# is the most dangerous thing an agent can be told: the stash is ONE STACK PER
+# CLONE, shared by every worktree, so with concurrent agents a sibling's push
+# can shift your entry and a sibling's pop can consume it. `lint-staged` pushes
+# one on every commit too, so agent and tooling entries interleave.
+#
+# A remedy fires at the exact moment an agent is holding the work most worth
+# protecting, and a guard's own output reads as authoritative — so pointing it
+# at shared mutable state there is worse than the refusal it accompanies.
+#
+# The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
+# filename, and it lives in this agent's own TMPDIR where no sibling can reach
+# it. Untracked files are unaffected by both refused operations, so `git diff`
+# captures everything at risk.
+PRESERVE_GUIDANCE="$(
+  cat <<'EOF'
+Preserve the work first, per-worktree:
+
+  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+
+and restore it later with `git apply <that file>`.
+
+Do NOT reach for `git stash`. One stash stack is shared by every worktree of a
+clone, so a concurrently running agent can consume the entry you just pushed.
+EOF
+)"
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 #
@@ -1574,7 +1605,9 @@ done <<<"$push_segments"
 if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
@@ -1624,7 +1657,9 @@ if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
   || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
   || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
   || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
-  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
 fi
 
 # 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.

package/dist/strategies/package-lisa.js

@@ -723,8 +723,8 @@ function locateLisaPin(packageJson) {
  * applied version and the INSTALLED version are two halves of one thing. When
  * they drift, a config file calls an export the installed package does not have
  * and every run of the tool that loads it dies at config load — while the apply
- * itself reports success, and `postinstall`'s `[ -d dist/configs ] || tsc ||
- * true` swallows the only local signal. The failure then surfaces at the next
+ * itself reports success, and `postinstall`'s `tsc || true` swallows the only
+ * local signal. The failure then surfaces at the next
  * lint run, detached from the apply that caused it (#2953).
  *
  * A range is rewritten as readily as an exact pin, and deliberately so: a caret

package/package.json

@@ -3,16 +3,16 @@
     "build": "bun run build:dist && bun run build:plugins",
     "build:dist": "node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
     "build:dist:in-place": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
-    "lisa-test-run": "([ -d dist/configs ] || bun run build) && node dist/cli/lisa-test-run.js --profile lisa",
+    "lisa-test-run": "bun run build && node dist/cli/lisa-test-run.js --profile lisa",
     "test:integration": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration",
     "test:integration:push": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",
-    "postinstall": "bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ -d dist/configs ] || tsc || true",
-    "pretest": "[ -d dist/configs ] || bun run build",
+    "postinstall": "bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; tsc || true",
+    "pretest": "bun run build",
     "test": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run",
     "test:unit": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
     "test:cov": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage",
     "test:cov:unit": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-    "pretest:mutation": "[ -d dist/configs ] || bun run build",
+    "pretest:mutation": "bun run build",
     "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs",
     "test:mutation:full": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs --all",
     "lint": "oxlint --disable-nested-config && eslint . --quiet",
@@ -59,7 +59,7 @@
     "check:rules-pairing": "bash scripts/check-rules-pairing.sh",
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:whole-output-guards": "node scripts/check-whole-output-guards.mjs",
-    "check:shell-guard-refusals": "([ -d dist/configs ] || bun run build) && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
+    "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
     "check:vacuous-required-checks": "node typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs --vacuity",
@@ -166,7 +166,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -314,7 +314,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "cfd0ef6086a16d015552bd0403a2d98dc13d7bc1",
-  "gitHead": "cfd0ef6086a16d015552bd0403a2d98dc13d7bc1",
-  "lisaReleaseTag": "v4.34.19"
+  "lisaReleaseCommit": "f65b16b98f562acb7a06c20b6e01a2cc6c37e200",
+  "gitHead": "f65b16b98f562acb7a06c20b6e01a2cc6c37e200",
+  "lisaReleaseTag": "v4.34.21"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -1685,7 +1685,28 @@ def scan(text, depth, from_file=False):
         # waved through: an unbalanced quote inside a script is the identical
         # two-character trick moved one file away, and skipping it would hand
         # the bypass straight back.
-        if from_file and text_declares_readiness(text):
+        #
+        # The declaration check is NOT gated on `from_file`, and that is the
+        # #3727 fix. Tokenisation is what feeds every argv-based check below,
+        # so when it throws, a TYPED command was previously judged with no
+        # declaration consulted at all — not its `--body-file`, not even a
+        # plain `--label <ready role>` sitting in argv. A correctly declared
+        # filing was refused for the unrelated reason that its command happened
+        # not to lex, and told "this filing declares no readiness", which was
+        # false. Reading the text here is the only check available once `shlex`
+        # has failed.
+        #
+        # It cannot reopen the bypass the paragraph above defends. That bypass
+        # is an UNDECLARED create hiding behind a quote, and an undeclared
+        # create has no marker and no `--label <ready role>` for
+        # `text_declares_readiness` to match — which is asserted, not assumed,
+        # by the rejection controls covering a bare create, the role mentioned
+        # in prose, and the role appearing inside a URL.
+        #
+        # A marker in a SEPARATE `--body-file` stays refused, because finding
+        # that operand needs the tokenisation that just failed. That case is
+        # reachable by declaring inline instead, which this change makes work.
+        if text_declares_readiness(text):
             return None
         if UNPARSEABLE_CREATION.search(text):
             return (

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -162,6 +162,37 @@ describes yours:
 EOF
 )"
 
+# How to preserve uncommitted work before an operation that would discard it.
+#
+# This is appended to the reasons that refuse a discarding operation, and its
+# whole point is what it does NOT say (issue #3722). The obvious advice is
+# "stash it first", and on a single-checkout repository that is fine. Here it
+# is the most dangerous thing an agent can be told: the stash is ONE STACK PER
+# CLONE, shared by every worktree, so with concurrent agents a sibling's push
+# can shift your entry and a sibling's pop can consume it. `lint-staged` pushes
+# one on every commit too, so agent and tooling entries interleave.
+#
+# A remedy fires at the exact moment an agent is holding the work most worth
+# protecting, and a guard's own output reads as authoritative — so pointing it
+# at shared mutable state there is worse than the refusal it accompanies.
+#
+# The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
+# filename, and it lives in this agent's own TMPDIR where no sibling can reach
+# it. Untracked files are unaffected by both refused operations, so `git diff`
+# captures everything at risk.
+PRESERVE_GUIDANCE="$(
+  cat <<'EOF'
+Preserve the work first, per-worktree:
+
+  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+
+and restore it later with `git apply <that file>`.
+
+Do NOT reach for `git stash`. One stash stack is shared by every worktree of a
+clone, so a concurrently running agent can consume the entry you just pushed.
+EOF
+)"
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 #
@@ -1574,7 +1605,9 @@ done <<<"$push_segments"
 if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
@@ -1624,7 +1657,9 @@ if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
   || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
   || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
   || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
-  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
 fi
 
 # 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1685,7 +1685,28 @@ def scan(text, depth, from_file=False):
         # waved through: an unbalanced quote inside a script is the identical
         # two-character trick moved one file away, and skipping it would hand
         # the bypass straight back.
-        if from_file and text_declares_readiness(text):
+        #
+        # The declaration check is NOT gated on `from_file`, and that is the
+        # #3727 fix. Tokenisation is what feeds every argv-based check below,
+        # so when it throws, a TYPED command was previously judged with no
+        # declaration consulted at all — not its `--body-file`, not even a
+        # plain `--label <ready role>` sitting in argv. A correctly declared
+        # filing was refused for the unrelated reason that its command happened
+        # not to lex, and told "this filing declares no readiness", which was
+        # false. Reading the text here is the only check available once `shlex`
+        # has failed.
+        #
+        # It cannot reopen the bypass the paragraph above defends. That bypass
+        # is an UNDECLARED create hiding behind a quote, and an undeclared
+        # create has no marker and no `--label <ready role>` for
+        # `text_declares_readiness` to match — which is asserted, not assumed,
+        # by the rejection controls covering a bare create, the role mentioned
+        # in prose, and the role appearing inside a URL.
+        #
+        # A marker in a SEPARATE `--body-file` stays refused, because finding
+        # that operand needs the tokenisation that just failed. That case is
+        # reachable by declaring inline instead, which this change makes work.
+        if text_declares_readiness(text):
             return None
         if UNPARSEABLE_CREATION.search(text):
             return (

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -162,6 +162,37 @@ describes yours:
 EOF
 )"
 
+# How to preserve uncommitted work before an operation that would discard it.
+#
+# This is appended to the reasons that refuse a discarding operation, and its
+# whole point is what it does NOT say (issue #3722). The obvious advice is
+# "stash it first", and on a single-checkout repository that is fine. Here it
+# is the most dangerous thing an agent can be told: the stash is ONE STACK PER
+# CLONE, shared by every worktree, so with concurrent agents a sibling's push
+# can shift your entry and a sibling's pop can consume it. `lint-staged` pushes
+# one on every commit too, so agent and tooling entries interleave.
+#
+# A remedy fires at the exact moment an agent is holding the work most worth
+# protecting, and a guard's own output reads as authoritative — so pointing it
+# at shared mutable state there is worse than the refusal it accompanies.
+#
+# The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
+# filename, and it lives in this agent's own TMPDIR where no sibling can reach
+# it. Untracked files are unaffected by both refused operations, so `git diff`
+# captures everything at risk.
+PRESERVE_GUIDANCE="$(
+  cat <<'EOF'
+Preserve the work first, per-worktree:
+
+  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+
+and restore it later with `git apply <that file>`.
+
+Do NOT reach for `git stash`. One stash stack is shared by every worktree of a
+clone, so a concurrently running agent can consume the entry you just pushed.
+EOF
+)"
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 #
@@ -1574,7 +1605,9 @@ done <<<"$push_segments"
 if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
@@ -1624,7 +1657,9 @@ if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
   || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
   || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
   || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
-  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
 fi
 
 # 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -1685,7 +1685,28 @@ def scan(text, depth, from_file=False):
         # waved through: an unbalanced quote inside a script is the identical
         # two-character trick moved one file away, and skipping it would hand
         # the bypass straight back.
-        if from_file and text_declares_readiness(text):
+        #
+        # The declaration check is NOT gated on `from_file`, and that is the
+        # #3727 fix. Tokenisation is what feeds every argv-based check below,
+        # so when it throws, a TYPED command was previously judged with no
+        # declaration consulted at all — not its `--body-file`, not even a
+        # plain `--label <ready role>` sitting in argv. A correctly declared
+        # filing was refused for the unrelated reason that its command happened
+        # not to lex, and told "this filing declares no readiness", which was
+        # false. Reading the text here is the only check available once `shlex`
+        # has failed.
+        #
+        # It cannot reopen the bypass the paragraph above defends. That bypass
+        # is an UNDECLARED create hiding behind a quote, and an undeclared
+        # create has no marker and no `--label <ready role>` for
+        # `text_declares_readiness` to match — which is asserted, not assumed,
+        # by the rejection controls covering a bare create, the role mentioned
+        # in prose, and the role appearing inside a URL.
+        #
+        # A marker in a SEPARATE `--body-file` stays refused, because finding
+        # that operand needs the tokenisation that just failed. That case is
+        # reachable by declaring inline instead, which this change makes work.
+        if text_declares_readiness(text):
             return None
         if UNPARSEABLE_CREATION.search(text):
             return (

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -162,6 +162,37 @@ describes yours:
 EOF
 )"
 
+# How to preserve uncommitted work before an operation that would discard it.
+#
+# This is appended to the reasons that refuse a discarding operation, and its
+# whole point is what it does NOT say (issue #3722). The obvious advice is
+# "stash it first", and on a single-checkout repository that is fine. Here it
+# is the most dangerous thing an agent can be told: the stash is ONE STACK PER
+# CLONE, shared by every worktree, so with concurrent agents a sibling's push
+# can shift your entry and a sibling's pop can consume it. `lint-staged` pushes
+# one on every commit too, so agent and tooling entries interleave.
+#
+# A remedy fires at the exact moment an agent is holding the work most worth
+# protecting, and a guard's own output reads as authoritative — so pointing it
+# at shared mutable state there is worse than the refusal it accompanies.
+#
+# The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
+# filename, and it lives in this agent's own TMPDIR where no sibling can reach
+# it. Untracked files are unaffected by both refused operations, so `git diff`
+# captures everything at risk.
+PRESERVE_GUIDANCE="$(
+  cat <<'EOF'
+Preserve the work first, per-worktree:
+
+  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+
+and restore it later with `git apply <that file>`.
+
+Do NOT reach for `git stash`. One stash stack is shared by every worktree of a
+clone, so a concurrently running agent can consume the entry you just pushed.
+EOF
+)"
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 #
@@ -1574,7 +1605,9 @@ done <<<"$push_segments"
 if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
@@ -1624,7 +1657,9 @@ if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
   || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
   || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
   || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
-  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
 fi
 
 # 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-direct-issue-create.sh

@@ -1685,7 +1685,28 @@ def scan(text, depth, from_file=False):
         # waved through: an unbalanced quote inside a script is the identical
         # two-character trick moved one file away, and skipping it would hand
         # the bypass straight back.
-        if from_file and text_declares_readiness(text):
+        #
+        # The declaration check is NOT gated on `from_file`, and that is the
+        # #3727 fix. Tokenisation is what feeds every argv-based check below,
+        # so when it throws, a TYPED command was previously judged with no
+        # declaration consulted at all — not its `--body-file`, not even a
+        # plain `--label <ready role>` sitting in argv. A correctly declared
+        # filing was refused for the unrelated reason that its command happened
+        # not to lex, and told "this filing declares no readiness", which was
+        # false. Reading the text here is the only check available once `shlex`
+        # has failed.
+        #
+        # It cannot reopen the bypass the paragraph above defends. That bypass
+        # is an UNDECLARED create hiding behind a quote, and an undeclared
+        # create has no marker and no `--label <ready role>` for
+        # `text_declares_readiness` to match — which is asserted, not assumed,
+        # by the rejection controls covering a bare create, the role mentioned
+        # in prose, and the role appearing inside a URL.
+        #
+        # A marker in a SEPARATE `--body-file` stays refused, because finding
+        # that operand needs the tokenisation that just failed. That case is
+        # reachable by declaring inline instead, which this change makes work.
+        if text_declares_readiness(text):
             return None
         if UNPARSEABLE_CREATION.search(text):
             return (

package/plugins/lisa-cursor/hooks/parity-safety-net.sh

@@ -162,6 +162,37 @@ describes yours:
 EOF
 )"
 
+# How to preserve uncommitted work before an operation that would discard it.
+#
+# This is appended to the reasons that refuse a discarding operation, and its
+# whole point is what it does NOT say (issue #3722). The obvious advice is
+# "stash it first", and on a single-checkout repository that is fine. Here it
+# is the most dangerous thing an agent can be told: the stash is ONE STACK PER
+# CLONE, shared by every worktree, so with concurrent agents a sibling's push
+# can shift your entry and a sibling's pop can consume it. `lint-staged` pushes
+# one on every commit too, so agent and tooling entries interleave.
+#
+# A remedy fires at the exact moment an agent is holding the work most worth
+# protecting, and a guard's own output reads as authoritative — so pointing it
+# at shared mutable state there is worse than the refusal it accompanies.
+#
+# The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
+# filename, and it lives in this agent's own TMPDIR where no sibling can reach
+# it. Untracked files are unaffected by both refused operations, so `git diff`
+# captures everything at risk.
+PRESERVE_GUIDANCE="$(
+  cat <<'EOF'
+Preserve the work first, per-worktree:
+
+  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+
+and restore it later with `git apply <that file>`.
+
+Do NOT reach for `git stash`. One stash stack is shared by every worktree of a
+clone, so a concurrently running agent can consume the entry you just pushed.
+EOF
+)"
+
 # block() prints the reason to stderr (surfaced to the model) and exits 2 so the
 # Bash tool call is denied. $1 = human-readable reason for the block.
 #
@@ -1574,7 +1605,9 @@ done <<<"$push_segments"
 if matches "${GIT_CMD}"'reset\b.*--(hard|merge)\b'; then
   if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
     && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
-    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (stash or commit first)"
+    block "git reset --hard/--merge on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
@@ -1624,7 +1657,9 @@ if matches "${GIT_CHECKOUT}${GIT_TOKENS}"'--([[:space:]]|$)' \
   || matches "${GIT_CHECKOUT}${GIT_TOKENS}"'(-[[:alnum:]]*f[[:alnum:]]*|--force)([[:space:]]|=|$)' \
   || matches "${GIT_CHECKOUT}"'[[:space:]][^;&|]*--pathspec-from-file' \
   || matches "${GIT_CHECKOUT}"'[[:space:]]+\.(/)?([[:space:]]|$)'; then
-  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .) — use git stash to preserve work first"
+  block "git checkout discarding local changes (--, -f/--force, --pathspec-from-file, or bare .)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
 fi
 
 # 5. `git switch` discards: `--discard-changes` and its `-f/--force` aliases.

package/plugins/lisa-expo/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Expo and React Native-specific skills, agents, rules, and MCP servers.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-expo-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-expo",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Expo/React Native-specific skills, agents, rules, and MCP servers",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-harper-fabric/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-harper-fabric",
-  "version": "4.34.19",
+  "version": "4.34.21",
   "description": "Harper/Fabric-specific rules for TypeScript component apps",
   "author": {
     "name": "Cody Swann"