@codyswann/lisa 4.34.4 → 4.34.6

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.34.4",
+  "version": "4.34.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-managed-file-edits.sh

@@ -53,8 +53,30 @@
 # Blocked signatures:
 #   1. Write / Edit / MultiEdit / NotebookEdit whose target resolves to a
 #      copy-overwrite template in the installed Lisa package;
-#   2. Bash output redirection (`>`, `>>`, `>|`), `tee`, or `sed -i` aimed at
-#      one. Reads never fire.
+#   2. Bash output redirection (`>`, `>>`, `>|`), `tee`, or an in-place `sed`
+#      aimed at one — `-i`, `-i ''`, `-i.bak`, a cluster such as `-ni`, and the
+#      long `--in-place[=SUFFIX]`. Reads never fire;
+#   3. any of those inside a script the command EXECUTES — `bash edit.sh`,
+#      `sh`, `source`, `.`, `bash < edit.sh`, and behind wrappers that carry an
+#      operand of their own (`nice -n 5`, `timeout 5`, `sudo`).
+#
+# ## What signature 3 deliberately does NOT do
+#
+# A path is followed ONLY when the command EXECUTES it. `grep -n x edit.sh`,
+# `wc -l edit.sh`, `git diff edit.sh` and a test run over it name a file as
+# DATA, and following those is the known-wrong fix this guard family has already
+# made once: it refuses ordinary reads and attributes a file's capability to a
+# command that merely mentions it. Command POSITION decides. Taint does not
+# propagate any further either — a path a followed script merely NAMES is data
+# one file further out, not a third hop.
+#
+# ## Parity gap, recorded rather than silently dropped
+#
+# This guard has no Antigravity, Codex or OpenCode port — only the Claude
+# reference and the copies generated from it. Its siblings do. That predates
+# this change and is not closed by it: opening three ports is its own work, and
+# doing it here would triple the surface under review. Recorded so it reads as a
+# known gap rather than an oversight.
 #
 # Exemptions (allowed):
 #   - `LISA_ALLOW_MANAGED_FILE_WRITE` set — the operator's explicit override,
@@ -62,6 +84,13 @@
 #   - paths under `node_modules/` or `dist/` — vendored copies, not the host's;
 #   - the Lisa source repository itself, where these files are the originals and
 #     editing them is the entire point.
+#
+# The line below lets `lisa apply` tell a downstream copy of this guard that is
+# BEHIND from one that is AHEAD. Byte comparison cannot: both look like "differs
+# from mine", and guessing "behind" is how a fork's stronger guard gets silently
+# replaced by a weaker upstream one. Add a name here in the same commit that
+# closes a vector.
+# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand
 set -euo pipefail
 
 input="$(cat)"
@@ -363,19 +392,417 @@ EOF
   Bash)
     command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
     [ -n "$command_str" ] || exit 0
-    # Write signatures only. A bare mention is a read and stays allowed — the
-    # path has to be the target of a redirection, a tee, or an in-place sed.
-    # `>>?\|?` covers `>`, `>>`, and the noclobber override `>|`.
+    # A missing interpreter must be announced rather than swallowed. This guard
+    # degrades to "allow" — a hook that cannot parse its input cannot tell a
+    # write from a read — but a guard that is silently absent reads exactly like
+    # a guard that is passing.
+    if ! command -v python3 >/dev/null 2>&1; then
+      printf 'block-managed-file-edits: python3 not found; Bash write protection is NOT active\n' >&2
+      exit 0
+    fi
+    # Why a tokenizer replaced the two-stage regex.
+    #
+    # The old extraction was `grep -Eo` for a redirect / tee / in-place sed,
+    # followed by a `sed -E` strip of the matched prefix. MEASURED against it:
+    # `tee <path>` and `tee -a <path>` extracted correctly, and EVERY `sed -i`
+    # spelling extracted NOTHING — `-i`, `-i ''` and `-i.bak` alike. The
+    # `grep` matched; the strip pattern `sed[[:space:]]+[^|;&]*-i[^|;&]*` is
+    # greedy, so it consumed the path along with the flags and left an empty
+    # token. The arm was DEAD, not merely missing macOS's two-token spelling.
+    #
+    # A regex cannot answer the question this guard actually asks — is this path
+    # WRITTEN or merely NAMED — because that depends on token position, which is
+    # what a tokenizer is for.
+    #
+    # The analyzer is read into a variable by `read -d ''` rather than run
+    # inside a `$(python3 - <<'PY' … PY)`. Bash has to find the closing paren of
+    # a command substitution by re-scanning its text, and a heredoc body nested
+    # there is scanned too: the lone backtick in `re.compile(r"[$`]")` below
+    # reads as an unterminated backtick substitution and the whole script fails
+    # to parse. Keeping the heredoc out of the substitution is the fix.
+    analyzer=''
+    IFS= read -r -d '' analyzer <<'PY' || true
+import os
+import re
+import shlex
+
+command = os.environ.get("MANAGED_EDIT_COMMAND", "")
+project = os.environ.get("MANAGED_EDIT_PROJECT", "") or os.getcwd()
+
+# Following a script costs a read on every intercepted command, so the walk is
+# bounded three ways, and a file past the cap is skipped rather than half-read:
+# a truncated scan reports a confident ALLOW about text it never saw.
+FOLLOW_MAX_BYTES = 262144
+FOLLOW_MAX_FILES = 8
+FOLLOW_MAX_DEPTH = 3
+
+# Spelled with chr() rather than backslash escapes on purpose. This source is
+# embedded in a shell heredoc and copied verbatim through several generators
+# into every shipped plugin; a backslash literal is the one thing in it most
+# likely to be mangled in transit, and the mangling would be silent.
+BACKSLASH = chr(92)
+NEWLINE = chr(10)
+
+STATEMENT_SEPARATORS = {";", "|", "||", "&", "&&", "(", ")", "&|"}
+# `>`, `>>`, and the noclobber override `>|`.
+REDIRECT_OUT = {">", ">>", ">|"}
+REDIRECT_IN = "<"
+
+SHELL_PROGRAMS = {"bash", "dash", "ksh", "sh", "zsh"}
+SOURCE_BUILTINS = {"source", "."}
+
+# Wrappers that run what FOLLOWS them without changing what it is, mapped to
+# (options whose value is a SEPARATE token, positional operands consumed).
+# The positional count is why this is a table rather than a set: `timeout 5
+# bash x` puts an operand between the wrapper and the interpreter, so a walk
+# that steps over `-flags` only stops at `5` and never reaches `bash`.
+FOLLOW_WRAPPERS = {
+    "builtin": (frozenset(), 0),
+    "command": (frozenset(), 0),
+    "exec": (frozenset({"-a"}), 0),
+    "nice": (frozenset({"-n", "--adjustment"}), 0),
+    "nohup": (frozenset(), 0),
+    "setsid": (frozenset(), 0),
+    "stdbuf": (frozenset({"-i", "-o", "-e"}), 0),
+    "sudo": (
+        frozenset(
+            {
+                "-C", "--close-from", "-g", "--group", "-h", "--host",
+                "-p", "--prompt", "-r", "--role", "-t", "--type",
+                "-U", "--other-user", "-u", "--user",
+            }
+        ),
+        0,
+    ),
+    "time": (frozenset(), 0),
+    "timeout": (frozenset({"-k", "--kill-after", "-s", "--signal"}), 1),
+}
+
+# `-i`, `-i.bak`, a cluster such as `-ni`, and the long `--in-place[=SUFFIX]`.
+IN_PLACE = re.compile(r"^(--in-place(=.*)?|-[a-zA-Z]*i.*)$")
+# A value the SHELL computes; this hook runs before expansion and cannot know
+# which file it will name.
+COMPUTED_VALUE = re.compile(r"[$`]")
+
+
+def normalise_lines(text):
+    """Spell line breaks as statement separators.
+
+    A newline ends a command exactly as `;` does, but shlex treats it as plain
+    whitespace — so two consecutive lines of a followed script would read as
+    one invocation and only the first program would be classified. A
+    backslash-newline is joined first, because there the newline is NOT a
+    boundary.
+
+    Args:
+        text: A command line or a script's contents.
+
+    Returns:
+        The same text with line breaks spelled as separators.
+    """
+    joined = text.replace(BACKSLASH + NEWLINE, " ")
+    return joined.replace(NEWLINE, " ; ")
+
+
+def tokenize(text):
+    """Tokenize with shell operators kept as their own tokens.
+
+    Args:
+        text: A command line or a script's contents.
+
+    Returns:
+        The token list, or None when the text does not lex.
+    """
+    lexer = shlex.shlex(normalise_lines(text), posix=True, punctuation_chars=True)
+    lexer.whitespace_split = True
+    # `#` is not a comment introducer on a typed command line, and letting shlex
+    # treat it as one silently truncates the rest of the line.
+    lexer.commenters = ""
+    try:
+        return list(lexer)
+    except ValueError:
+        return None
+
+
+def strip_comments(text):
+    """Drop `#` comments from a FOLLOWED SCRIPT, quote-aware.
+
+    Applied to file contents and never to a typed command. A comment cannot
+    execute, and Lisa's own managed templates discuss redirection and `sed -i`
+    against managed paths in their headers — classifying a followed file
+    without dropping its comments reads documentation as an edit.
+
+    Args:
+        text: A script's contents.
+
+    Returns:
+        The same text with unquoted comments removed.
+    """
+    output = []
+    for line in text.split(NEWLINE):
+        quote = ""
+        escaped = False
+        cut = None
+        for position, character in enumerate(line):
+            if escaped:
+                escaped = False
+                continue
+            if character == BACKSLASH and quote != "'":
+                escaped = True
+                continue
+            if quote:
+                if character == quote:
+                    quote = ""
+                continue
+            if character in "'\"":
+                quote = character
+                continue
+            # A `#` opens a comment only at the start of a word, so `x#y` and
+            # `${x#y}` keep their hashes.
+            if character == "#" and (position == 0 or line[position - 1].isspace()):
+                cut = position
+                break
+        output.append(line if cut is None else line[:cut])
+    return NEWLINE.join(output)
+
+
+def statements(tokens):
+    """Split a token list at statement separators, keeping redirects inline.
+
+    Redirect operators are deliberately NOT separators here: `>` and its target
+    have to stay in the same group, because the pair is the write signature.
+
+    Args:
+        tokens: The operator-aware token list.
+
+    Returns:
+        A list of statements.
+    """
+    grouped = []
+    current = []
+    for token in tokens:
+        if token in STATEMENT_SEPARATORS:
+            grouped.append(current)
+            current = []
+            continue
+        current.append(token)
+    grouped.append(current)
+    return grouped
+
+
+def command_word(statement):
+    """The program a statement runs, and the tokens after it.
+
+    Steps over leading variable assignments and over wrappers that do not
+    change what runs. Reading a wrapper as the command is how a payload hides
+    from a guard that inspects only a statement's first word.
+
+    Args:
+        statement: One statement's tokens.
+
+    Returns:
+        A pair (program, args); (None, []) when no program is named.
+    """
+    index = 0
+    while index < len(statement):
+        token = statement[index]
+        if "=" in token and not token.startswith(("=", "-")):
+            index += 1
+            continue
+        program = token.rsplit("/", 1)[-1]
+        if program not in FOLLOW_WRAPPERS:
+            return (program, statement[index + 1 :])
+        separate, positional = FOLLOW_WRAPPERS[program]
+        index += 1
+        while index < len(statement) and statement[index].startswith("-"):
+            option = statement[index]
+            if option == "--":
+                index += 1
+                break
+            index += 2 if option in separate else 1
+        index += positional
+    return (None, [])
+
+
+def shell_script_operand(args):
+    """The file a shell invocation runs, or None when it runs no script file.
+
+    Args:
+        args: The tokens following the shell's own name.
+
+    Returns:
+        The operand token, or None for an interactive shell or a `-c` string.
+    """
+    for token in args:
+        if token == "--":
+            continue
+        if token.startswith(("-", "+")):
+            # A single-dash cluster containing `c` carries a command string,
+            # not a script file.
+            if not token.startswith("--") and "c" in token[1:]:
+                return None
+            continue
+        return token
+    return None
+
+
+def write_targets(statement):
+    """Paths this statement WRITES.
+
+    Reads never fire. A path has to be the target of an output redirection, or
+    an operand of `tee` or of an in-place `sed`. That is the whole distinction
+    this guard turns on: `grep -n x <managed>` names the same path and stays
+    allowed, and following a merely-named path is the known-wrong fix that
+    refuses ordinary reads elsewhere in this family.
+
+    Extraction is deliberately GENEROUS for `tee` and `sed`: every non-flag
+    operand is offered. It costs nothing, because the caller classifies each
+    candidate by resolving it against the installed package, and a `sed` script
+    expression such as `s/a/b/` resolves to no template. Being narrow here is
+    precisely what left the old `sed -i` arm dead in every spelling.
+
+    Args:
+        statement: One statement's tokens.
+
+    Returns:
+        Candidate paths this statement writes.
+    """
+    found = []
+    program, args = command_word(statement)
+    for index, token in enumerate(statement):
+        if token in REDIRECT_OUT and index + 1 < len(statement):
+            found.append(statement[index + 1])
+    if program == "tee":
+        found.extend(token for token in args if not token.startswith("-"))
+    elif program == "sed" and any(IN_PLACE.match(token) for token in args):
+        found.extend(token for token in args if not token.startswith("-"))
+    return found
+
+
+def executed_script(statement):
+    """The path this statement EXECUTES, or None.
+
+    Only a COMMAND POSITION can execute something. A path anywhere else is an
+    argument, and an argument is data.
+
+    Args:
+        statement: One statement's tokens.
+
+    Returns:
+        The operand token naming a script that will run, or None.
+    """
+    program, args = command_word(statement)
+    if program is None:
+        return None
+    if program in SHELL_PROGRAMS:
+        for index, token in enumerate(statement):
+            # `bash < script.sh` runs that file as surely as `bash script.sh`.
+            if token == REDIRECT_IN and index + 1 < len(statement):
+                return statement[index + 1]
+        return shell_script_operand(args)
+    if program in SOURCE_BUILTINS:
+        return args[0] if args else None
+    return None
+
+
+def resolve(token):
+    """An existing readable script a token names, or None.
+
+    A computed target (`bash "$SCRIPT"`) is NOT followed and NOT refused. This
+    guard's harm is a template that silently forks — recoverable, and reported
+    by `lisa doctor` on every run — so failing closed on every `bash "$SCRIPT"`
+    in every host project would cost far more than it buys. Its sibling
+    `block-no-verify` DOES fail closed on the identical shape, because an
+    unverified commit is not recoverable. The divergence is deliberate, and it
+    is recorded here so the next reader does not read it as an oversight.
+
+    Args:
+        token: The operand naming a script.
+
+    Returns:
+        A path, or None.
+    """
+    if COMPUTED_VALUE.search(token):
+        return None
+    text = token.strip().strip("'\"")
+    if not text or text == "-":
+        return None
+    if os.path.isabs(text):
+        candidates = [text]
+    else:
+        candidates = [os.path.join(project, text), os.path.join(os.getcwd(), text)]
+    for candidate in candidates:
+        try:
+            if not os.path.isfile(candidate):
+                continue
+            if os.path.getsize(candidate) > FOLLOW_MAX_BYTES:
+                continue
+        except OSError:
+            continue
+        return candidate
+    return None
+
+
+def collect(text, depth, seen, out):
+    """Accumulate every write target in this text and in the scripts it runs.
+
+    Args:
+        text: A command line, or a followed script's contents.
+        depth: Number of scripts already followed.
+        seen: Real paths already inspected, so a cycle terminates.
+        out: Accumulator for candidate paths.
+
+    Returns:
+        Nothing; `out` is extended in place.
+    """
+    tokens = tokenize(text)
+    if tokens is None:
+        return
+    for statement in statements(tokens):
+        if not statement:
+            continue
+        out.extend(write_targets(statement))
+        operand = executed_script(statement)
+        if operand is None:
+            continue
+        if depth >= FOLLOW_MAX_DEPTH or len(seen) >= FOLLOW_MAX_FILES:
+            continue
+        path = resolve(operand)
+        if path is None:
+            continue
+        try:
+            key = os.path.realpath(path)
+        except OSError:
+            key = path
+        if key in seen:
+            continue
+        seen.add(key)
+        try:
+            with open(path, encoding="utf-8", errors="replace") as handle:
+                body = handle.read(FOLLOW_MAX_BYTES)
+        except OSError:
+            continue
+        collect(strip_comments(body), depth + 1, seen, out)
+
+
+targets = []
+collect(command, 0, set(), targets)
+for target in targets:
+    cleaned = target.strip().strip("'\"")
+    if cleaned:
+        print(cleaned)
+PY
+    write_targets="$(printf '%s' "$analyzer" |
+      MANAGED_EDIT_COMMAND="$command_str" \
+        MANAGED_EDIT_PROJECT="$project_root" \
+        python3 - 2>/dev/null || true)"
     while IFS= read -r token; do
       [ -n "$token" ] || continue
       if source_path="$(managed_source "$token")"; then
         refuse "$token" "$source_path" "$(relative_path "$token")"
       fi
     done <<EOF
-$(printf '%s' "$command_str" |
-  grep -Eo ">>?\|?[[:space:]]*['\"]?[^ |;&'\"]+|tee([[:space:]]+-[a-zA-Z]+)*[[:space:]]+['\"]?[^ |;&'\"]+|sed[[:space:]]+[^|;&]*-i[^|;&]*[[:space:]]['\"]?[^ |;&'\"]+" 2>/dev/null |
-  sed -E "s/^(>>?\|?|tee([[:space:]]+-[a-zA-Z]+)*|sed[[:space:]]+[^|;&]*-i[^|;&]*)[[:space:]]*//" |
-  tr -d "\"'" || true)
+$write_targets
 EOF
     ;;
 esac