@codyswann/lisa 4.34.21 → 4.35.1

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -179,12 +179,14 @@ EOF
 # The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
 # filename, and it lives in this agent's own TMPDIR where no sibling can reach
 # it. Untracked files are unaffected by both refused operations, so `git diff`
-# captures everything at risk.
+# captures everything at risk. `HEAD` includes staged and unstaged changes, and
+# `--binary` keeps binary edits recoverable rather than emitting a text-only
+# placeholder that cannot be applied.
 PRESERVE_GUIDANCE="$(
   cat <<'EOF'
 Preserve the work first, per-worktree:
 
-  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+  git diff --binary HEAD [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
 
 and restore it later with `git apply <that file>`.
 
@@ -444,6 +446,7 @@ follow_refuse() {
 # so peak process count never rises. The latency was the whole problem.
 follow_unwrapped=""
 follow_operand_index=0
+follow_located=""
 
 # Strip substitution, quote and alias wrappers off one token. A sibling of
 # strip_subst_wrappers() below rather than a call to it: that one is defined
@@ -568,6 +571,7 @@ follow_add_base() {
 # this hook cannot evaluate.
 follow_locate() {
   local token="$1" home="${HOME:-}" tmp="${TMPDIR:-/tmp}" proj="${CLAUDE_PROJECT_DIR:-$PWD}" base
+  follow_located=""
   tmp="${tmp%/}"
   [ -n "$tmp" ] || tmp="/tmp"
   # The tilde arms below are LITERAL text: this is the unexpanded spelling the
@@ -589,14 +593,14 @@ follow_locate() {
     "" | *'$'* | *'*'* | *'?'* | *'`'* | *'{'* | *'['*) return 1 ;;
     /*)
       [ -f "$token" ] && [ -r "$token" ] || return 1
-      printf '%s' "$token"
+      follow_located="$token"
       return 0
       ;;
   esac
   while IFS= read -r base; do
     [ -n "$base" ] || continue
     if [ -f "$base/$token" ] && [ -r "$base/$token" ]; then
-      printf '%s' "$base/$token"
+      follow_located="$base/$token"
       return 0
     fi
   done <<<"$PWD"$'\n'"$proj$follow_bases"
@@ -641,12 +645,13 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
-  if ! path="$(follow_locate "$token")"; then
+  if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
     fi
     return 0
   fi
+  path="$follow_located"
   follow_take "$path" "$depth"
 }
 
@@ -667,11 +672,18 @@ follow_target() {
 # Accepted residual: a shebang script whose relative path resolves only from a
 # working directory this hook does not share is not followed.
 follow_direct() {
-  local token="$1" depth="$2" path="" first=""
-  if ! path="$(follow_locate "$token")"; then
+  local token="$1" depth="$2" path="" first="" raw="" char="" k=0
+  local LC_ALL=C
+  if ! follow_locate "$token"; then
     return 0
   fi
-  first="$(LC_ALL=C head -c 256 -- "$path" 2>/dev/null | LC_ALL=C head -n 1 2>/dev/null | LC_ALL=C tr -dc '[:print:]' 2>/dev/null)" || first=""
+  path="$follow_located"
+  IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
+  while [ "$k" -lt "${#raw}" ]; do
+    char="${raw:k:1}"
+    case "$char" in [[:print:]]) first="$first$char" ;; esac
+    k=$((k + 1))
+  done
   case "$first" in
     '#!'*[/[:space:]]bash* | '#!'*[/[:space:]]sh* | '#!'*[/[:space:]]zsh* \
       | '#!'*[/[:space:]]ksh* | '#!'*[/[:space:]]dash* | '#!'*[/[:space:]]ash*) ;;
@@ -701,7 +713,7 @@ follow_next_operand() {
 follow_scan() {
   local text="$1" depth="$2"
   local split_out line sep stmt t tj i j n cmd_pos eval_mode inline arg_exec
-  local heredoc redirected pipe_cat prev_cat pending_operand
+  local heredoc redirected pipe_cat prev_cat pending_operand stdin_mode
   local find_mode dispatch_pending
   local -a toks=()
   split_out="$(follow_split "$text")"
@@ -888,6 +900,7 @@ follow_scan() {
         inline=0
         redirected=""
         heredoc=0
+        stdin_mode=0
         j=$((i + 1))
         while [ "$j" -lt "$n" ]; do
           follow_unwrap "${toks[j]}"
@@ -920,6 +933,7 @@ follow_scan() {
               ;;
             --*) j=$((j + 1)) ;;
             -*c*) inline=1; j=$((j + 1)) ;;
+            -s | -[a-zA-Z]*s[a-zA-Z]*) stdin_mode=1; j=$((j + 1)) ;;
             -*) j=$((j + 1)) ;;
             *) break ;;
           esac
@@ -944,6 +958,14 @@ follow_scan() {
           i="$j"
           continue
         fi
+        if [ "$stdin_mode" -eq 1 ]; then
+          # `sh -s -- -y` reads its program from stdin; tokens after `--` are
+          # positional arguments to that program, never a script path.
+          [ -z "$pipe_cat" ] || follow_target "$pipe_cat" "$depth"
+          cmd_pos=0
+          i="$n"
+          continue
+        fi
         if [ "$j" -ge "$n" ]; then
           # A dispatcher supplies the script from ANOTHER command's output, so
           # the operand exists but is unreadable here. That is the fail-closed
@@ -1806,15 +1828,14 @@ readonly SQL_TRUNCATE_EVIDENCE='\btruncate[[:space:]]+(table[[:space:]]+[[:alnum
 # the same command must also invoke a command-line database client. Prose in a
 # tracker filing or a commit message invokes none, which is exactly the
 # difference the text scan could not see on its own.
-readonly SQL_CLIENT='(^|[^[:alnum:]_./-])([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]|$)'
-readonly SQL_TRUNCATE_BARE='\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
+readonly SQL_CLIENT_TRUNCATE='(^|[;&|()][[:space:]]*)([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]+[^;&|()]*)?[[:space:]]+(-e|-c|--command|--eval)(=|[[:space:]]+)[^;&|()]*\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
 # Residual, accepted and stated: a bare `TRUNCATE <name>` with no terminator,
 # no qualification and no recognized client in the same command goes unmatched
 # — the same trade the `drop` arm has always made for `drop the ball`. No DROP
 # shape is weakened, and the guard still fails in the safe direction.
 if matches "$SQL_DROP" \
   || matches "$SQL_TRUNCATE_EVIDENCE" \
-  || { matches "$SQL_CLIENT" && matches "$SQL_TRUNCATE_BARE"; }; then
+  || matches "$SQL_CLIENT_TRUNCATE"; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
 

package/plugins/lisa/rules/eager/measurement-integrity.md

@@ -0,0 +1,18 @@
+# Measurement Integrity (load-bearing)
+
+**Before you report a count, a population, or "N items affected", run the checks — because every way this goes wrong produces output that looks exactly like an answer.** No exception, no warning, no partial flag: the wrong number is indistinguishable from the right one by reading it.
+
+That is why "be careful about scope" is not a remedy. **Every check below is performed or not performed**, never noticed:
+
+1. **State the population boundary** before enumerating — what is in, and what is adjacent and out.
+2. **Prove the enumeration complete** — paginate, and *assert* the end-of-pages signal rather than trusting it. A silent cap looks exactly like a population.
+3. **Validate the detector against known-true items.** If it cannot find the examples you already have, its total means nothing.
+4. **Treat search results as candidates, never members** — read each one directly and confirm the literal.
+5. **Control the instrument in both directions** — it must report a real absence, and must not invent one.
+6. **Report pattern-derived totals as floors**, and **state the unit** beside any count whose argument rests on how many *independent* observations you have.
+
+No single check covers the others: validating against known items is blind to truncation, and reading every candidate can only ever see what enumeration handed it.
+
+**And one that fires while reading rather than measuring:** a filter built from the failure shapes you already expect cannot show you a shape you did not. Read gate and tool output **unfiltered** on a refusal — the diagnosis is usually already in it.
+
+Full method (six modes in two families, the membership test for adding a seventh, and which check is blind to what): [reference/measurement-integrity.md](../reference/measurement-integrity.md).

package/plugins/lisa/rules/reference/measurement-integrity.md

@@ -0,0 +1,109 @@
+# Measurement Integrity
+
+How an audit, sweep, or population count arrives at a confident wrong number, and the mechanical steps that catch each way.
+
+## The unifying property
+
+**Every failure here produces output that looks exactly like an answer.** None throws, none warns, none reports partial. The wrong number is indistinguishable from the right one by inspecting the result, which is why it survives review and gets cited.
+
+That has a direct consequence for remedies: **a step that requires the auditor to notice something has already failed.** Every recommendation below is shaped as an action that is either performed or not — validate the detector against known-true items, assert the end-of-pages signal, pair a negative with a positive control. "Be careful about scope" is not one of these.
+
+## The membership test
+
+This is a method, not a bestiary. A failure belongs here when **all three** hold:
+
+1. **The output is well formed.** No exception, no warning, no truncation marker, no partial flag.
+2. **The error is invisible from the artifact alone.** Reading the result — the number, the list, the report — cannot distinguish it from a correct one.
+3. **A mechanical step would have caught it.** Something performed-or-not, not a judgement. If no such step exists, it is a hazard worth documenting but it is not a mode here, because the entry earns its place by supplying the check.
+
+**The list is open.** It is currently six modes in two families plus one adjacent family. An earlier four-item version of a related list felt complete at four and was not; a taxonomy is the artifact most likely to be believed finished, and its own characteristic failure is a reader who stops looking once their case appears covered. Condition 3 is what lets you add to it rather than merely consult it.
+
+## Family A — the instrument mis-measures
+
+Six modes fall out of two axes: **direction** (does it under- or over-report?) and **stage** (does it fail while *enumerating* candidates, or while *matching* them?). All four cells are occupied, which is a reason to believe the family is close to complete and not a reason to stop looking.
+
+| | under-reports | over-reports |
+|---|---|---|
+| **enumeration** | class exclusion · truncation | scope inflation |
+| **matching** | pattern blindness | tokenization · alternation order |
+
+### A1. Class exclusion — under, enumeration
+
+An entire corpus sits outside the query's scope and nothing says so. `gh search issues` does not return pull requests; run alone against a mostly-PR population it reported **10 items where the answer was 45**, and omitted the two items already known to be members. A list that misses the examples you started from still reads as authoritative.
+
+**Catch it:** validate the detector against known-true items before believing any count.
+
+### A2. Truncation — under, enumeration
+
+Real members past the first page are dropped with no truncation signal. `gh issue list` and `gh pr list` default to 30 and cap silently at whatever `--limit` is passed: one audit reported **37 items where the answer was 513**, a 14× undercount. A paging API returning **249 of 845 rows with `hasNextPage: false`** is the same mode on another substrate.
+
+**Catch it:** paginate to exhaustion and assert the end-of-pages signal rather than trusting it.
+
+### A3. Pattern blindness — under, matching
+
+Members the pattern cannot express are never matched. A prose form of an organisation's name appeared in three bodies and was matched by no pattern in the audit that was looking for exactly that; it was caught only because a person added the spelling by hand.
+
+**Catch it:** nothing automatic. Report every pattern-derived total as a **floor**, never a total — saying so is the honest form, and it is a step that is either performed or not.
+
+### A4. Scope inflation — over, enumeration
+
+Candidates are enumerated from a root that reaches beyond the population. A tree walk asserting a repository ships exactly one copy of a script found **21 additional copies**, one per agent worktree nested inside the checkout, and failed. The walk was correct; its root was wrong.
+
+Note the trap this mode sets for A1's remedy: **path reachability is not membership.** "The search reached it" and "it belongs to the population" are different claims, and conflating them is how an over-report is defended as thoroughness.
+
+**Catch it:** state the population boundary before enumerating, and assert that a known non-member is excluded — the positive control's mirror.
+
+### A5. Tokenization — over, matching
+
+The query is split into terms, so unrelated items match. Searching for a URL-shaped needle matched issues containing only its bare final word in ordinary prose — one read *"There is no account, token, or session."* Two of 47 candidates were phantoms.
+
+**Catch it:** treat search results as **candidates, never members**; read each one directly and confirm the literal.
+
+### A6. Alternation order — over, matching, and it fabricates
+
+A regex alternative matches early and produces a value with no referent. Extracting paths with `\.(mjs|js|sh|json)` matched `js` inside `package.json` before reaching `json`, producing a phantom `package.js` and reporting a live exposure that did not exist.
+
+This is the most expensive mode. A4 and A5 return a *real item for a wrong reason* and die on a direct read; this returns an **artifact that does not exist**, so a direct read cannot disconfirm it — there is nothing to read — and it sends someone chasing a break that was never there.
+
+**Catch it:** order alternations longest-first, or anchor the match end. Control it with an input crafted to trip the partial match; asserting the regex matches what it should is satisfied by the broken version.
+
+## Family B — the instrument is right and the report is wrong
+
+### B1. Unit error
+
+The measurement is correct and the **reported unit** is not. "Three separate branches" versus *three events across two branches* is not a count error — the count was three either way. It inflates the **independence** of the sample, which is the property the argument rested on: repeated observations on one branch are weaker evidence of a general flake than the same number spread across branches.
+
+No amount of instrument validation catches this. The detector was never involved.
+
+**Catch it:** state the unit next to the number, and ask whether the claim rests on *how many* or on *how many independent*. Where it rests on independence, report both.
+
+## Family C — adjacent, and deliberately not a mode here
+
+### C1. Filter blindness
+
+**A filter built from the failure shapes you already expect cannot show you a shape you did not.** An agent grep-filtered push output for failure markers and discarded the gate's own line naming the cause; the gate had diagnosed itself perfectly and the filter threw the diagnosis away.
+
+This is listed and **excluded from the taxonomy on purpose.** It fails condition 2 in a different place: the artifact was complete and correct, and the loss happened while *reading* it. Forcing it into Family A would dilute the membership test, which is the part of this document that does work. It is here because it is the same shape one layer out, and because the remedy is one line: **read gate and tool output unfiltered on a refusal.**
+
+## Composition: no single check catches all of them
+
+This is the payload. Each check is blind to modes the others catch.
+
+| check | catches | blind to |
+|---|---|---|
+| validate the detector against known-true items | A1, A3 | A2 when the knowns sit on page one · A4 · A5 · A6 · B1 |
+| read every candidate directly | A5, A6 | A1 · A2 · A3 — it only ever sees what enumeration handed it |
+| paginate and assert end-of-pages | A2 | everything else |
+| assert a known non-member is excluded | A4 | A1 · A2 · A3 |
+| state the unit beside the number | B1 | all of Family A |
+
+**Validating against known-true items** loses to truncation, because your known examples are usually recent and therefore on the first page. **Reading every candidate** kills both over-reports and cannot see what was never enumerated. They are complements, not alternatives.
+
+## The procedure
+
+1. **State the population boundary** before enumerating — what is in, what is adjacent and out.
+2. **Enumerate candidates and prove the enumeration complete** — paginate, assert the end-of-pages signal, and check the query's scope covers every corpus (issues *and* pull requests, open *and* closed, bodies *and* comments).
+3. **Validate the detector against known-true items.** If it cannot find the examples you already have, its total means nothing.
+4. **Read every candidate directly** and confirm the literal. Search results are candidates, never members.
+5. **Control the instrument in both directions** — it must report a real absence, and must not invent one.
+6. **Report pattern-derived totals as floors**, and **state the unit** beside any count whose argument rests on independence.

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1426,7 +1426,11 @@ EXEC_WRAPPERS = {
     "nohup": (frozenset(), 0),
     "setsid": (frozenset(), 0),
     "stdbuf": (frozenset({"-i", "-o", "-e"}), 0),
-    "sudo": (frozenset({"-u", "--user", "-g", "--group", "-C", "--close-from"}), 0),
+    "sudo": (frozenset({
+        "-u", "--user", "-g", "--group", "-C", "--close-from",
+        "-p", "--prompt", "-h", "--host", "-r", "--role",
+        "-t", "--type", "-U", "--other-user",
+    }), 0),
     "time": (frozenset(), 0),
     "timeout": (frozenset({"-k", "--kill-after", "-s", "--signal"}), 1),
 }
@@ -1447,6 +1451,31 @@ NO_SCRIPT_OPTIONS = {
     "ruby": {"-e"},
 }
 
+# Interpreter switches whose value is a separate token, followed by the real
+# script operand. Treating the value as the script makes the guard inspect a
+# preload or option value and never reach what the interpreter executes.
+INTERPRETER_VALUE_OPTIONS = {
+    "bash": {"-o", "--option"},
+    "dash": {"-o"},
+    "deno": {"-c", "--config"},
+    "ksh": {"-o"},
+    "node": {"-r", "--require"},
+    "nodejs": {"-r", "--require"},
+    "sh": {"-o"},
+    "zsh": {"-o"},
+}
+
+# Runtime subcommands that introduce the script path rather than name it.
+INTERPRETER_SUBCOMMANDS = {
+    "bun": {"run"},
+    "deno": {"run"},
+}
+
+
+def is_assignment_word(token):
+    """Whether token is a POSIX shell assignment in command-prefix position."""
+    return re.match(r"^[A-Za-z_][A-Za-z0-9_]*\+?=", token) is not None
+
 # Programs that READ their operands and never execute them as programs.
 #
 # This is an allowlist of readers rather than the inverse, and the asymmetry is
@@ -1501,7 +1530,7 @@ def executing_command(argv):
     index = 0
     while index < len(argv):
         token = argv[index]
-        if "=" in token and not token.startswith(("=", "-")):
+        if is_assignment_word(token):
             index += 1
             continue
         program = basename(token)
@@ -1568,16 +1597,20 @@ def executed_operand(argv):
     # shebang — `./create.sh` names no interpreter and runs all the same.
     if program not in EXECUTING_INTERPRETERS and resolve_operand(token) is not None:
         return token
-    # `bash < create.sh` runs that file as surely as `bash create.sh` does, and
-    # `<` is not a segment boundary, so the pair survives in one argv.
-    for index, argument in enumerate(args):
-        if argument == "<" and index + 1 < len(args):
-            return args[index + 1]
     # Reached by a known interpreter AND by a program this parser cannot name.
     # The unknown case is followed on purpose — see READ_ONLY_PROGRAMS.
-    for argument in args:
-        if argument == "--":
+    redirected = None
+    index = 0
+    while index < len(args):
+        argument = args[index]
+        if argument == "<":
+            if index + 1 < len(args):
+                redirected = args[index + 1]
+            index += 2
             continue
+        if argument == "--":
+            index += 1
+            return args[index] if index < len(args) else redirected
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
@@ -1588,9 +1621,15 @@ def executed_operand(argv):
                     return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
+            takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())
+            index += 2 if takes_value and "=" not in argument else 1
+            continue
+        if argument in INTERPRETER_SUBCOMMANDS.get(program, set()):
+            index += 1
             continue
         return argument
-    return None
+    # `bash < create.sh` runs stdin only when no explicit script was named.
+    return redirected
 
 
 def file_operands(argv):

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -179,12 +179,14 @@ EOF
 # The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
 # filename, and it lives in this agent's own TMPDIR where no sibling can reach
 # it. Untracked files are unaffected by both refused operations, so `git diff`
-# captures everything at risk.
+# captures everything at risk. `HEAD` includes staged and unstaged changes, and
+# `--binary` keeps binary edits recoverable rather than emitting a text-only
+# placeholder that cannot be applied.
 PRESERVE_GUIDANCE="$(
   cat <<'EOF'
 Preserve the work first, per-worktree:
 
-  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+  git diff --binary HEAD [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
 
 and restore it later with `git apply <that file>`.
 
@@ -444,6 +446,7 @@ follow_refuse() {
 # so peak process count never rises. The latency was the whole problem.
 follow_unwrapped=""
 follow_operand_index=0
+follow_located=""
 
 # Strip substitution, quote and alias wrappers off one token. A sibling of
 # strip_subst_wrappers() below rather than a call to it: that one is defined
@@ -568,6 +571,7 @@ follow_add_base() {
 # this hook cannot evaluate.
 follow_locate() {
   local token="$1" home="${HOME:-}" tmp="${TMPDIR:-/tmp}" proj="${CLAUDE_PROJECT_DIR:-$PWD}" base
+  follow_located=""
   tmp="${tmp%/}"
   [ -n "$tmp" ] || tmp="/tmp"
   # The tilde arms below are LITERAL text: this is the unexpanded spelling the
@@ -589,14 +593,14 @@ follow_locate() {
     "" | *'$'* | *'*'* | *'?'* | *'`'* | *'{'* | *'['*) return 1 ;;
     /*)
       [ -f "$token" ] && [ -r "$token" ] || return 1
-      printf '%s' "$token"
+      follow_located="$token"
       return 0
       ;;
   esac
   while IFS= read -r base; do
     [ -n "$base" ] || continue
     if [ -f "$base/$token" ] && [ -r "$base/$token" ]; then
-      printf '%s' "$base/$token"
+      follow_located="$base/$token"
       return 0
     fi
   done <<<"$PWD"$'\n'"$proj$follow_bases"
@@ -641,12 +645,13 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
-  if ! path="$(follow_locate "$token")"; then
+  if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
     fi
     return 0
   fi
+  path="$follow_located"
   follow_take "$path" "$depth"
 }
 
@@ -667,11 +672,18 @@ follow_target() {
 # Accepted residual: a shebang script whose relative path resolves only from a
 # working directory this hook does not share is not followed.
 follow_direct() {
-  local token="$1" depth="$2" path="" first=""
-  if ! path="$(follow_locate "$token")"; then
+  local token="$1" depth="$2" path="" first="" raw="" char="" k=0
+  local LC_ALL=C
+  if ! follow_locate "$token"; then
     return 0
   fi
-  first="$(LC_ALL=C head -c 256 -- "$path" 2>/dev/null | LC_ALL=C head -n 1 2>/dev/null | LC_ALL=C tr -dc '[:print:]' 2>/dev/null)" || first=""
+  path="$follow_located"
+  IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
+  while [ "$k" -lt "${#raw}" ]; do
+    char="${raw:k:1}"
+    case "$char" in [[:print:]]) first="$first$char" ;; esac
+    k=$((k + 1))
+  done
   case "$first" in
     '#!'*[/[:space:]]bash* | '#!'*[/[:space:]]sh* | '#!'*[/[:space:]]zsh* \
       | '#!'*[/[:space:]]ksh* | '#!'*[/[:space:]]dash* | '#!'*[/[:space:]]ash*) ;;
@@ -701,7 +713,7 @@ follow_next_operand() {
 follow_scan() {
   local text="$1" depth="$2"
   local split_out line sep stmt t tj i j n cmd_pos eval_mode inline arg_exec
-  local heredoc redirected pipe_cat prev_cat pending_operand
+  local heredoc redirected pipe_cat prev_cat pending_operand stdin_mode
   local find_mode dispatch_pending
   local -a toks=()
   split_out="$(follow_split "$text")"
@@ -888,6 +900,7 @@ follow_scan() {
         inline=0
         redirected=""
         heredoc=0
+        stdin_mode=0
         j=$((i + 1))
         while [ "$j" -lt "$n" ]; do
           follow_unwrap "${toks[j]}"
@@ -920,6 +933,7 @@ follow_scan() {
               ;;
             --*) j=$((j + 1)) ;;
             -*c*) inline=1; j=$((j + 1)) ;;
+            -s | -[a-zA-Z]*s[a-zA-Z]*) stdin_mode=1; j=$((j + 1)) ;;
             -*) j=$((j + 1)) ;;
             *) break ;;
           esac
@@ -944,6 +958,14 @@ follow_scan() {
           i="$j"
           continue
         fi
+        if [ "$stdin_mode" -eq 1 ]; then
+          # `sh -s -- -y` reads its program from stdin; tokens after `--` are
+          # positional arguments to that program, never a script path.
+          [ -z "$pipe_cat" ] || follow_target "$pipe_cat" "$depth"
+          cmd_pos=0
+          i="$n"
+          continue
+        fi
         if [ "$j" -ge "$n" ]; then
           # A dispatcher supplies the script from ANOTHER command's output, so
           # the operand exists but is unreadable here. That is the fail-closed
@@ -1806,15 +1828,14 @@ readonly SQL_TRUNCATE_EVIDENCE='\btruncate[[:space:]]+(table[[:space:]]+[[:alnum
 # the same command must also invoke a command-line database client. Prose in a
 # tracker filing or a commit message invokes none, which is exactly the
 # difference the text scan could not see on its own.
-readonly SQL_CLIENT='(^|[^[:alnum:]_./-])([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]|$)'
-readonly SQL_TRUNCATE_BARE='\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
+readonly SQL_CLIENT_TRUNCATE='(^|[;&|()][[:space:]]*)([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]+[^;&|()]*)?[[:space:]]+(-e|-c|--command|--eval)(=|[[:space:]]+)[^;&|()]*\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
 # Residual, accepted and stated: a bare `TRUNCATE <name>` with no terminator,
 # no qualification and no recognized client in the same command goes unmatched
 # — the same trade the `drop` arm has always made for `drop the ball`. No DROP
 # shape is weakened, and the guard still fails in the safe direction.
 if matches "$SQL_DROP" \
   || matches "$SQL_TRUNCATE_EVIDENCE" \
-  || { matches "$SQL_CLIENT" && matches "$SQL_TRUNCATE_BARE"; }; then
+  || matches "$SQL_CLIENT_TRUNCATE"; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi
 

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.21",
+  "version": "4.35.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"