@codyswann/lisa 4.35.0 → 4.35.2

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.35.0",
+  "version": "4.35.2",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/hooks/block-direct-issue-create.sh

@@ -1426,7 +1426,11 @@ EXEC_WRAPPERS = {
     "nohup": (frozenset(), 0),
     "setsid": (frozenset(), 0),
     "stdbuf": (frozenset({"-i", "-o", "-e"}), 0),
-    "sudo": (frozenset({"-u", "--user", "-g", "--group", "-C", "--close-from"}), 0),
+    "sudo": (frozenset({
+        "-u", "--user", "-g", "--group", "-C", "--close-from",
+        "-p", "--prompt", "-h", "--host", "-r", "--role",
+        "-t", "--type", "-U", "--other-user",
+    }), 0),
     "time": (frozenset(), 0),
     "timeout": (frozenset({"-k", "--kill-after", "-s", "--signal"}), 1),
 }
@@ -1447,6 +1451,31 @@ NO_SCRIPT_OPTIONS = {
     "ruby": {"-e"},
 }
 
+# Interpreter switches whose value is a separate token, followed by the real
+# script operand. Treating the value as the script makes the guard inspect a
+# preload or option value and never reach what the interpreter executes.
+INTERPRETER_VALUE_OPTIONS = {
+    "bash": {"-o", "--option"},
+    "dash": {"-o"},
+    "deno": {"-c", "--config"},
+    "ksh": {"-o"},
+    "node": {"-r", "--require"},
+    "nodejs": {"-r", "--require"},
+    "sh": {"-o"},
+    "zsh": {"-o"},
+}
+
+# Runtime subcommands that introduce the script path rather than name it.
+INTERPRETER_SUBCOMMANDS = {
+    "bun": {"run"},
+    "deno": {"run"},
+}
+
+
+def is_assignment_word(token):
+    """Whether token is a POSIX shell assignment in command-prefix position."""
+    return re.match(r"^[A-Za-z_][A-Za-z0-9_]*\+?=", token) is not None
+
 # Programs that READ their operands and never execute them as programs.
 #
 # This is an allowlist of readers rather than the inverse, and the asymmetry is
@@ -1501,7 +1530,7 @@ def executing_command(argv):
     index = 0
     while index < len(argv):
         token = argv[index]
-        if "=" in token and not token.startswith(("=", "-")):
+        if is_assignment_word(token):
             index += 1
             continue
         program = basename(token)
@@ -1568,16 +1597,20 @@ def executed_operand(argv):
     # shebang — `./create.sh` names no interpreter and runs all the same.
     if program not in EXECUTING_INTERPRETERS and resolve_operand(token) is not None:
         return token
-    # `bash < create.sh` runs that file as surely as `bash create.sh` does, and
-    # `<` is not a segment boundary, so the pair survives in one argv.
-    for index, argument in enumerate(args):
-        if argument == "<" and index + 1 < len(args):
-            return args[index + 1]
     # Reached by a known interpreter AND by a program this parser cannot name.
     # The unknown case is followed on purpose — see READ_ONLY_PROGRAMS.
-    for argument in args:
-        if argument == "--":
+    redirected = None
+    index = 0
+    while index < len(args):
+        argument = args[index]
+        if argument == "<":
+            if index + 1 < len(args):
+                redirected = args[index + 1]
+            index += 2
             continue
+        if argument == "--":
+            index += 1
+            return args[index] if index < len(args) else redirected
         if argument.startswith("-"):
             # A command string or a module name; no script file follows.
             head = argument.split("=", 1)[0]
@@ -1588,9 +1621,15 @@ def executed_operand(argv):
                     return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
+            takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())
+            index += 2 if takes_value and "=" not in argument else 1
+            continue
+        if argument in INTERPRETER_SUBCOMMANDS.get(program, set()):
+            index += 1
             continue
         return argument
-    return None
+    # `bash < create.sh` runs stdin only when no explicit script was named.
+    return redirected
 
 
 def file_operands(argv):

package/plugins/src/base/hooks/block-managed-file-edits.sh

@@ -90,7 +90,7 @@
 # from mine", and guessing "behind" is how a fork's stronger guard gets silently
 # replaced by a weaker upstream one. Add a name here in the same commit that
 # closes a vector.
-# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, direct-script-command-reach, analyzer-failure-visible
+# lisa-guard-capabilities: managed-path-resolution, lisaignore-precedence, generated-path-rebuild, redirect-target, tee-target, sed-in-place-all-spellings, executed-script-reach, source-builtin-reach, stdin-redirect-reach, wrapper-positional-operand, direct-script-command-reach, analyzer-failure-visible, apply-patch-parse-failure-visible, apply-patch-move-target, shell-command-string-reach
 set -euo pipefail
 
 input="$(cat)"
@@ -399,6 +399,7 @@ case "$tool_name" in
     #   *** Add File: <path>
     #   *** Update File: <path>
     #   *** Delete File: <path>
+    #   *** Move to: <path>
     #
     # So every header is walked and each target classified; one managed
     # target anywhere in a multi-file patch refuses the whole call, because
@@ -415,14 +416,25 @@ case "$tool_name" in
     # legitimately cannot be one file. What is NOT restated is the
     # classification: `managed_source` and `refuse` are the single copy here,
     # exactly as for every other arm.
-    patch_text="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+    if ! patch_text="$(printf '%s' "$input" | jq -er '
+      if ((.tool_input.command? // "") | type) == "string"
+      then (.tool_input.command? // "")
+      else error("tool_input.command must be a string")
+      end')"; then
+      printf 'block-managed-file-edits: could not parse the apply_patch command; managed-file protection refused the edit\n' >&2
+      exit 2
+    fi
     [ -n "$patch_text" ] || exit 0
     while IFS= read -r patch_line; do
       case "$patch_line" in
-        "*** Add File: "* | "*** Update File: "* | "*** Delete File: "*) ;;
+        "*** Add File: "* | "*** Update File: "* | "*** Delete File: "*)
+          candidate="${patch_line#*File: }"
+          ;;
+        "*** Move to: "*)
+          candidate="${patch_line#*** Move to: }"
+          ;;
         *) continue ;;
       esac
-      candidate="${patch_line#*File: }"
       [ -n "$candidate" ] || continue
       if source_path="$(managed_source "$candidate")"; then
         refuse "$candidate" "$source_path" "$(relative_path "$candidate")"
@@ -712,6 +724,29 @@ def shell_script_operand(args):
     return None
 
 
+def shell_command_string(statement):
+    """The inline command a shell executes with `-c`, or None.
+
+    Args:
+        statement: One statement's tokens.
+
+    Returns:
+        The command string operand, or None when this is not a shell `-c` call.
+    """
+    _token, program, args = command_word(statement)
+    if program not in SHELL_PROGRAMS:
+        return None
+    for index, token in enumerate(args):
+        if token == "--":
+            return None
+        if token.startswith("-") and not token.startswith("--") and "c" in token[1:]:
+            command_index = index + 1
+            if command_index < len(args) and args[command_index] == "--":
+                command_index += 1
+            return args[command_index] if command_index < len(args) else None
+    return None
+
+
 def write_targets(statement):
     """Paths this statement WRITES.
 
@@ -834,6 +869,9 @@ def collect(text, depth, seen, out):
         if not statement:
             continue
         out.extend(write_targets(statement))
+        nested = shell_command_string(statement)
+        if nested is not None and depth < FOLLOW_MAX_DEPTH:
+            collect(nested, depth + 1, seen, out)
         operand = executed_script(statement)
         if operand is None:
             continue

package/plugins/src/base/hooks/parity-safety-net.sh

@@ -179,12 +179,14 @@ EOF
 # The patch file is per-worktree: `mktemp` names it, so nothing has to invent a
 # filename, and it lives in this agent's own TMPDIR where no sibling can reach
 # it. Untracked files are unaffected by both refused operations, so `git diff`
-# captures everything at risk.
+# captures everything at risk. `HEAD` includes staged and unstaged changes, and
+# `--binary` keeps binary edits recoverable rather than emitting a text-only
+# placeholder that cannot be applied.
 PRESERVE_GUIDANCE="$(
   cat <<'EOF'
 Preserve the work first, per-worktree:
 
-  git diff [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
+  git diff --binary HEAD [-- <path>] > "$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX.patch")"
 
 and restore it later with `git apply <that file>`.
 
@@ -444,6 +446,7 @@ follow_refuse() {
 # so peak process count never rises. The latency was the whole problem.
 follow_unwrapped=""
 follow_operand_index=0
+follow_located=""
 
 # Strip substitution, quote and alias wrappers off one token. A sibling of
 # strip_subst_wrappers() below rather than a call to it: that one is defined
@@ -568,6 +571,7 @@ follow_add_base() {
 # this hook cannot evaluate.
 follow_locate() {
   local token="$1" home="${HOME:-}" tmp="${TMPDIR:-/tmp}" proj="${CLAUDE_PROJECT_DIR:-$PWD}" base
+  follow_located=""
   tmp="${tmp%/}"
   [ -n "$tmp" ] || tmp="/tmp"
   # The tilde arms below are LITERAL text: this is the unexpanded spelling the
@@ -589,14 +593,14 @@ follow_locate() {
     "" | *'$'* | *'*'* | *'?'* | *'`'* | *'{'* | *'['*) return 1 ;;
     /*)
       [ -f "$token" ] && [ -r "$token" ] || return 1
-      printf '%s' "$token"
+      follow_located="$token"
       return 0
       ;;
   esac
   while IFS= read -r base; do
     [ -n "$base" ] || continue
     if [ -f "$base/$token" ] && [ -r "$base/$token" ]; then
-      printf '%s' "$base/$token"
+      follow_located="$base/$token"
       return 0
     fi
   done <<<"$PWD"$'\n'"$proj$follow_bases"
@@ -641,12 +645,13 @@ follow_take() {
 follow_target() {
   local token="$1" depth="$2" path=""
   [ -n "$token" ] || return 0
-  if ! path="$(follow_locate "$token")"; then
+  if ! follow_locate "$token"; then
     if [ "$depth" -eq 0 ]; then
       follow_refuse "$token" "no readable file could be resolved for it"
     fi
     return 0
   fi
+  path="$follow_located"
   follow_take "$path" "$depth"
 }
 
@@ -667,11 +672,18 @@ follow_target() {
 # Accepted residual: a shebang script whose relative path resolves only from a
 # working directory this hook does not share is not followed.
 follow_direct() {
-  local token="$1" depth="$2" path="" first=""
-  if ! path="$(follow_locate "$token")"; then
+  local token="$1" depth="$2" path="" first="" raw="" char="" k=0
+  local LC_ALL=C
+  if ! follow_locate "$token"; then
     return 0
   fi
-  first="$(LC_ALL=C head -c 256 -- "$path" 2>/dev/null | LC_ALL=C head -n 1 2>/dev/null | LC_ALL=C tr -dc '[:print:]' 2>/dev/null)" || first=""
+  path="$follow_located"
+  IFS= read -r -n 256 raw <"$path" 2>/dev/null || true
+  while [ "$k" -lt "${#raw}" ]; do
+    char="${raw:k:1}"
+    case "$char" in [[:print:]]) first="$first$char" ;; esac
+    k=$((k + 1))
+  done
   case "$first" in
     '#!'*[/[:space:]]bash* | '#!'*[/[:space:]]sh* | '#!'*[/[:space:]]zsh* \
       | '#!'*[/[:space:]]ksh* | '#!'*[/[:space:]]dash* | '#!'*[/[:space:]]ash*) ;;
@@ -701,7 +713,7 @@ follow_next_operand() {
 follow_scan() {
   local text="$1" depth="$2"
   local split_out line sep stmt t tj i j n cmd_pos eval_mode inline arg_exec
-  local heredoc redirected pipe_cat prev_cat pending_operand
+  local heredoc redirected pipe_cat prev_cat pending_operand stdin_mode
   local find_mode dispatch_pending
   local -a toks=()
   split_out="$(follow_split "$text")"
@@ -888,6 +900,7 @@ follow_scan() {
         inline=0
         redirected=""
         heredoc=0
+        stdin_mode=0
         j=$((i + 1))
         while [ "$j" -lt "$n" ]; do
           follow_unwrap "${toks[j]}"
@@ -920,6 +933,7 @@ follow_scan() {
               ;;
             --*) j=$((j + 1)) ;;
             -*c*) inline=1; j=$((j + 1)) ;;
+            -s | -[a-zA-Z]*s[a-zA-Z]*) stdin_mode=1; j=$((j + 1)) ;;
             -*) j=$((j + 1)) ;;
             *) break ;;
           esac
@@ -944,6 +958,14 @@ follow_scan() {
           i="$j"
           continue
         fi
+        if [ "$stdin_mode" -eq 1 ]; then
+          # `sh -s -- -y` reads its program from stdin; tokens after `--` are
+          # positional arguments to that program, never a script path.
+          [ -z "$pipe_cat" ] || follow_target "$pipe_cat" "$depth"
+          cmd_pos=0
+          i="$n"
+          continue
+        fi
         if [ "$j" -ge "$n" ]; then
           # A dispatcher supplies the script from ANOTHER command's output, so
           # the operand exists but is unreadable here. That is the fail-closed
@@ -1806,15 +1828,14 @@ readonly SQL_TRUNCATE_EVIDENCE='\btruncate[[:space:]]+(table[[:space:]]+[[:alnum
 # the same command must also invoke a command-line database client. Prose in a
 # tracker filing or a commit message invokes none, which is exactly the
 # difference the text scan could not see on its own.
-readonly SQL_CLIENT='(^|[^[:alnum:]_./-])([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]|$)'
-readonly SQL_TRUNCATE_BARE='\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
+readonly SQL_CLIENT_TRUNCATE='(^|[;&|()][[:space:]]*)([[:alnum:]_./-]*/)?(psql|pgcli|mysql|mysqladmin|mysqlsh|mariadb|mycli|sqlite3|sqlcmd|cqlsh|clickhouse-client|cockroach|mongosh|duckdb|usql)([[:space:]]+[^;&|()]*)?[[:space:]]+(-e|-c|--command|--eval)(=|[[:space:]]+)[^;&|()]*\btruncate[[:space:]]+(only[[:space:]]+)?[[:alnum:]_."`]'
 # Residual, accepted and stated: a bare `TRUNCATE <name>` with no terminator,
 # no qualification and no recognized client in the same command goes unmatched
 # — the same trade the `drop` arm has always made for `drop the ball`. No DROP
 # shape is weakened, and the guard still fails in the safe direction.
 if matches "$SQL_DROP" \
   || matches "$SQL_TRUNCATE_EVIDENCE" \
-  || { matches "$SQL_CLIENT" && matches "$SQL_TRUNCATE_BARE"; }; then
+  || matches "$SQL_CLIENT_TRUNCATE"; then
   block "destructive SQL (DROP/TRUNCATE) detected"
 fi