@codyswann/lisa 4.38.3 → 4.38.5

package/dist/opencode/plugin-templates/lisa-block-managed-file-edits.ts

@@ -0,0 +1,83 @@
+/**
+ * Lisa-managed OpenCode plugin (tool.execute.before).
+ *
+ * Refuses agent writes to files Lisa overwrites on every apply. Lisa ships
+ * templates in three modes and only `copy-overwrite` is unsafe to edit:
+ * `copy-contents` appends, so host content survives, and `create-only` is
+ * skipped when the file exists, so the host owns it outright.
+ *
+ * The harm is not deletion, which is what makes it invisible. Measured by
+ * mutating four files in a scratch project and running a real `lisa apply`:
+ * every edit SURVIVED, and apply reported `Overwritten: 0 files` /
+ * `Out of date: 3 files`. So the file silently FORKS — it keeps looking current
+ * while every upstream fix stops reaching it, and the only trace is a warning
+ * line the next person learns to scroll past.
+ *
+ * ## Why it shells out
+ *
+ * Policy stays single-sourced in `block-managed-file-edits.sh`, the canonical
+ * guard Claude, Codex, Cursor and Copilot already run, copied beside this module
+ * by the installer exactly as `block-no-verify.sh` is. That guard resolves a
+ * candidate path against the installed package's `copy-overwrite` trees, the
+ * generated-paths module, and the Lisa-owned hash ledger, and it follows a
+ * command into the contents of any script it executes. Reimplementing that in
+ * TypeScript would be a second thing to harden, and the two would diverge at the
+ * first vector closed in only one of them. This adapter converts OpenCode's
+ * `bash` tool input into Lisa's canonical Claude Bash-hook envelope, runs the
+ * script, and surfaces its refusal.
+ *
+ * Bash arm only, and deliberately so: OpenCode exposes the shell as the `bash`
+ * tool, which is the surface this intercepts. That is the same scope the agy
+ * adapter has.
+ *
+ * NOTE: Lisa copies this template verbatim into `.opencode/plugin/`. It runs
+ * under OpenCode's Bun runtime and is excluded from this repository's tsconfig.
+ */
+export const LisaBlockManagedFileEdits = async () => ({
+  "tool.execute.before": async (
+    input: { tool: string },
+    output: { args?: { command?: string } }
+  ) => {
+    if (input.tool !== "bash") return;
+    const command = String(output.args?.command ?? "");
+    if (!command) return;
+
+    const hookPath = `${import.meta.dir}/block-managed-file-edits.sh`;
+    const processHandle = Bun.spawn(["/bin/bash", hookPath], {
+      env: { ...process.env, CLAUDE_PROJECT_DIR: process.cwd() },
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "pipe",
+      timeout: 2_000,
+      killSignal: "SIGKILL",
+    });
+    processHandle.stdin.write(
+      JSON.stringify({ tool_name: "Bash", tool_input: { command } })
+    );
+    processHandle.stdin.end();
+
+    const [status, reason] = await Promise.all([
+      processHandle.exited,
+      new Response(processHandle.stderr).text(),
+    ]);
+    // Exit 0 is ALLOW, including the canonical script's degraded path when jq
+    // or python3 is missing — it says so on stderr and permits the command,
+    // which is why stderr alone must never be read as a refusal. Any non-zero
+    // status fails closed. Exit 2 is the guard's own policy refusal; any other
+    // non-zero status is an adapter/environment failure and must say so rather
+    // than falsely accusing the requested command of editing a managed file.
+    if (status === 0) return;
+    if (status !== 2) {
+      throw new Error(
+        `block-managed-file-edits: guard environment failure (status ${status}) at ${hookPath}` +
+          (reason.trim() ? `: ${reason.trim()}` : "")
+      );
+    }
+    throw new Error(
+      reason.trim() ||
+        "block-managed-file-edits: this file is Lisa-managed and is replaced by " +
+          "`lisa apply`. Edit the template upstream in Lisa, or use the local " +
+          "escape hatch beside the file."
+    );
+  },
+});

package/package.json

@@ -170,7 +170,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.38.3",
+  "version": "4.38.5",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -318,7 +318,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "45d3791eee9301486af483eab0f615ac478c5fbc",
-  "gitHead": "45d3791eee9301486af483eab0f615ac478c5fbc",
-  "lisaReleaseTag": "v4.38.3"
+  "lisaReleaseCommit": "8df909afd30135ff230a81ccdd3e0d76e6dba8fa",
+  "gitHead": "8df909afd30135ff230a81ccdd3e0d76e6dba8fa",
+  "lisaReleaseTag": "v4.38.5"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.38.3",
+  "version": "4.38.5",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"
@@ -145,6 +145,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-host-name-leak.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
           }
         ]
       },
@@ -154,6 +158,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-instruction-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
           }
         ]
       },

package/plugins/lisa/.codex-plugin/hooks.json

@@ -85,6 +85,10 @@
           {
             "type": "command",
             "command": "${PLUGIN_ROOT}/hooks/block-host-name-leak.sh"
+          },
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
           }
         ]
       },
@@ -94,6 +98,10 @@
           {
             "type": "command",
             "command": "${PLUGIN_ROOT}/hooks/block-instruction-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
           }
         ]
       },

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.38.3",
+  "version": "4.38.5",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-managed-file-edits.agy.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Antigravity (agy) PreToolUse adapter for Lisa's managed-file guard.
+#
+# agy sends `{toolCall:{name:"run_command",args:{CommandLine:"..."}}}` and
+# expects an allow/deny JSON object on stdout. The canonical hook consumes the
+# Claude Bash-hook envelope and communicates denial with exit status 2. This
+# adapter only translates protocols; all classification stays in the canonical
+# block-managed-file-edits.sh beside it (same delegation pattern as
+# block-instruction-file-edits.agy.sh).
+#
+# Scope note: agy plugin hooks match `run_command`, so only the Bash arm of the
+# guard reaches agy — an agy file-edit tool call writing a copy-overwrite
+# template cannot be intercepted. That gap is accepted and recorded here, and in
+# the pull request that added this adapter, rather than papered over. The
+# redirection / append / tee signatures the canonical guard follows into
+# executed scripts still hold on agy, which is the majority of the surface.
+#
+# Fail-open on missing runtimes, matching every sibling adapter. A missed
+# refusal here costs a silently forked template — recoverable, and `lisa apply`
+# reports it as out of date on every subsequent run — where failing closed would
+# block every command on a machine without jq.
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"decision":"allow"}'
+  exit 0
+}
+
+deny() {
+  local reason="$1"
+  if command -v jq >/dev/null 2>&1; then
+    jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
+  else
+    printf '%s\n' '{"decision":"allow"}'
+  fi
+  exit 0
+}
+
+input="$(cat 2>/dev/null || true)"
+[ -z "$input" ] && allow
+command -v jq >/dev/null 2>&1 || allow
+
+tool_name="$(printf '%s' "$input" | jq -r '.toolCall.name // empty' 2>/dev/null || true)"
+[ "$tool_name" != "run_command" ] && allow
+command_str="$(printf '%s' "$input" | jq -r '.toolCall.args.CommandLine // empty' 2>/dev/null || true)"
+[ -z "$command_str" ] && allow
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+canonical_hook="$hook_dir/block-managed-file-edits.sh"
+[ -r "$canonical_hook" ] || allow
+
+canonical_input="$(jq -cn --arg command "$command_str" '{tool_name:"Bash",tool_input:{command:$command}}')"
+canonical_output=""
+canonical_status=0
+if canonical_output="$(printf '%s' "$canonical_input" | /bin/bash "$canonical_hook" 2>&1)"; then
+  canonical_status=0
+else
+  canonical_status=$?
+fi
+
+[ "$canonical_status" -eq 0 ] && allow
+[ -n "$canonical_output" ] || canonical_output="Blocked: this file is Lisa-managed and is replaced by \`lisa apply\`. Edit the template upstream in Lisa, or use the local escape hatch beside the file."
+deny "$canonical_output"

package/plugins/lisa-agy/hooks/block-managed-file-edits.agy.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Antigravity (agy) PreToolUse adapter for Lisa's managed-file guard.
+#
+# agy sends `{toolCall:{name:"run_command",args:{CommandLine:"..."}}}` and
+# expects an allow/deny JSON object on stdout. The canonical hook consumes the
+# Claude Bash-hook envelope and communicates denial with exit status 2. This
+# adapter only translates protocols; all classification stays in the canonical
+# block-managed-file-edits.sh beside it (same delegation pattern as
+# block-instruction-file-edits.agy.sh).
+#
+# Scope note: agy plugin hooks match `run_command`, so only the Bash arm of the
+# guard reaches agy — an agy file-edit tool call writing a copy-overwrite
+# template cannot be intercepted. That gap is accepted and recorded here, and in
+# the pull request that added this adapter, rather than papered over. The
+# redirection / append / tee signatures the canonical guard follows into
+# executed scripts still hold on agy, which is the majority of the surface.
+#
+# Fail-open on missing runtimes, matching every sibling adapter. A missed
+# refusal here costs a silently forked template — recoverable, and `lisa apply`
+# reports it as out of date on every subsequent run — where failing closed would
+# block every command on a machine without jq.
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"decision":"allow"}'
+  exit 0
+}
+
+deny() {
+  local reason="$1"
+  if command -v jq >/dev/null 2>&1; then
+    jq -cn --arg reason "$reason" '{decision:"deny",reason:$reason}'
+  else
+    printf '%s\n' '{"decision":"allow"}'
+  fi
+  exit 0
+}
+
+input="$(cat 2>/dev/null || true)"
+[ -z "$input" ] && allow
+command -v jq >/dev/null 2>&1 || allow
+
+tool_name="$(printf '%s' "$input" | jq -r '.toolCall.name // empty' 2>/dev/null || true)"
+[ "$tool_name" != "run_command" ] && allow
+command_str="$(printf '%s' "$input" | jq -r '.toolCall.args.CommandLine // empty' 2>/dev/null || true)"
+[ -z "$command_str" ] && allow
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+canonical_hook="$hook_dir/block-managed-file-edits.sh"
+[ -r "$canonical_hook" ] || allow
+
+canonical_input="$(jq -cn --arg command "$command_str" '{tool_name:"Bash",tool_input:{command:$command}}')"
+canonical_output=""
+canonical_status=0
+if canonical_output="$(printf '%s' "$canonical_input" | /bin/bash "$canonical_hook" 2>&1)"; then
+  canonical_status=0
+else
+  canonical_status=$?
+fi
+
+[ "$canonical_status" -eq 0 ] && allow
+[ -n "$canonical_output" ] || canonical_output="Blocked: this file is Lisa-managed and is replaced by \`lisa apply\`. Edit the template upstream in Lisa, or use the local escape hatch beside the file."
+deny "$canonical_output"