@codyswann/lisa 4.39.0 → 4.40.1

package/dist/opencode/plugin-templates/block-managed-file-edits.sh

@@ -719,6 +719,20 @@ def shell_script_operand(args):
             # not a script file.
             if not token.startswith("--") and "c" in token[1:]:
                 return None
+            # `-n` is noexec: the shell READS and parses the file, then exits
+            # without executing a line of it. `bash -n <file>` is the one shape
+            # that puts a path at a command position while provably running
+            # nothing — the exact seam between reading and running, and this
+            # walk got it wrong (CodySwannGT/lisa#3781). Here that meant a
+            # syntax check of any script mentioning a managed path was refused
+            # as though it were about to write one.
+            #
+            # `bash <file>` still executes and is still refused. Noexec is the
+            # distinction, not the program.
+            if token == "--noexec" or (
+                not token.startswith("--") and "n" in token[1:]
+            ):
+                return None
             continue
         return token
     return None

package/dist/opencode/plugin-templates/block-no-verify.sh

@@ -24,6 +24,13 @@
 #      `source`, `.`, `bash < nv.sh`, and an interpreter a `find -exec` or
 #      `xargs` puts at a command position.
 #
+# NOT vector 11: `bash -n nv.sh`. `-n` is noexec — the shell reads and parses
+# the file, then exits without running a line — so a syntax check is the one
+# shape that puts a path at a command position while executing nothing. It used
+# to be refused, which made `bash -n` unusable on this file, on every husky
+# hook, and on most of this repository (#3781). The distinction is noexec, not
+# the program: `bash nv.sh` still executes and is still refused.
+#
 # The line below is what lets `lisa apply` tell a downstream copy of this guard
 # that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
 # "differs from mine", and guessing "behind" is how a fork's stronger guard gets
@@ -1031,6 +1038,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -1061,12 +1072,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1111,6 +1135,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/npm-package/create-only/.github/workflows/publish-to-npm.yml

@@ -48,19 +48,47 @@ jobs:
   publish:
     name: Publish to npm
     runs-on: ubuntu-latest
+    # Job-level so every step below reads these from the environment instead of
+    # having them substituted into its script. A `${{ }}` expression is
+    # substituted by Actions BEFORE the shell parses the script, so an
+    # interpolated value is shell SOURCE TEXT rather than an argument - and
+    # `tag`, `version` and `package_manager` are all free-text `type: string`
+    # inputs that reach `git checkout`, `npm version` and a bare command name.
+    # Paired with the shape gates in Validate inputs below (#3717).
+    env:
+      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_VERSION: ${{ inputs.version }}
+      PACKAGE_MANAGER: ${{ inputs.package_manager }}
     steps:
       - name: Validate inputs
         run: |
-          if [ -z "${{ inputs.tag }}" ]; then
+          if [ -z "$RELEASE_TAG" ]; then
             echo "::error::Tag input is empty - cannot publish without a version tag"
             echo "This usually means the version job was skipped (e.g., promotion merge detected)"
             exit 1
           fi
-          if [ -z "${{ inputs.version }}" ]; then
+          if [ -z "$RELEASE_VERSION" ]; then
             echo "::error::Version input is empty - cannot publish without a version"
             exit 1
           fi
-          echo "✅ Inputs validated: tag=${{ inputs.tag }}, version=${{ inputs.version }}"
+          # Shape gates, so a value carrying shell metacharacters is refused
+          # before it reaches `git checkout`, `npm version`, or a command name.
+          if ! printf '%s' "$RELEASE_TAG" | grep -Eq '^v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'; then
+            echo "::error::Tag input is not a valid version tag"
+            exit 1
+          fi
+          if ! printf '%s' "$RELEASE_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'; then
+            echo "::error::Version input is not a valid semantic version"
+            exit 1
+          fi
+          case "$PACKAGE_MANAGER" in
+            npm|yarn|pnpm|bun) ;;
+            *)
+              echo "::error::Unsupported package manager: must be npm, yarn, pnpm or bun"
+              exit 1
+              ;;
+          esac
+          echo "✅ Inputs validated: tag=$RELEASE_TAG, version=$RELEASE_VERSION"
 
       - name: Checkout
         uses: actions/checkout@v6
@@ -69,12 +97,12 @@ jobs:
 
       - name: Wait for tag to be available
         run: |
-          echo "Waiting for tag ${{ inputs.tag }} to be available..."
+          echo "Waiting for tag $RELEASE_TAG to be available..."
           for i in {1..30}; do
             git fetch --tags
-            if git tag --list | grep -q "^${{ inputs.tag }}$"; then
-              echo "Tag ${{ inputs.tag }} is now available"
-              git checkout ${{ inputs.tag }}
+            if git tag --list | grep -qx "$RELEASE_TAG"; then
+              echo "Tag $RELEASE_TAG is now available"
+              git checkout "$RELEASE_TAG"
               break
             fi
             echo "Attempt $i/30: Tag not found yet, waiting 10 seconds..."
@@ -82,8 +110,8 @@ jobs:
           done
 
           # Final check
-          if [ "$(git describe --exact-match --tags 2>/dev/null)" != "${{ inputs.tag }}" ]; then
-            echo "Error: Tag ${{ inputs.tag }} is still not available after 5 minutes"
+          if [ "$(git describe --exact-match --tags 2>/dev/null)" != "$RELEASE_TAG" ]; then
+            echo "Error: Tag $RELEASE_TAG is still not available after 5 minutes"
             exit 1
           fi
 
@@ -107,24 +135,25 @@ jobs:
 
       - name: Install dependencies
         run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
+          if [ "$PACKAGE_MANAGER" = "npm" ]; then
             npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
+          elif [ "$PACKAGE_MANAGER" = "yarn" ]; then
             yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
+          elif [ "$PACKAGE_MANAGER" = "bun" ]; then
             bun install --frozen-lockfile
           fi
 
       - name: Build package
-        run: ${{ inputs.package_manager }} run build
+        run: |
+          "$PACKAGE_MANAGER" run build
 
       - name: Update package version
         run: |
           # Update package.json to match the release version
-          VERSION="${{ inputs.version }}"
+          VERSION="$RELEASE_VERSION"
           if [ -n "$VERSION" ]; then
             echo "Updating package.json to version $VERSION"
-            npm version $VERSION --no-git-tag-version --allow-same-version
+            npm version "$VERSION" --no-git-tag-version --allow-same-version
           fi
 
       - name: Publish to npm with OIDC
@@ -136,22 +165,22 @@ jobs:
         if: ${{ hashFiles('eslint-plugin-code-organization/package.json') != '' }}
         run: |
           cd eslint-plugin-code-organization
-          npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+          npm version "$RELEASE_VERSION" --no-git-tag-version --allow-same-version
           npm publish --access public --provenance
 
       - name: Publish @codyswann/eslint-plugin-component-structure
         if: ${{ hashFiles('eslint-plugin-component-structure/package.json') != '' }}
         run: |
           cd eslint-plugin-component-structure
-          npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+          npm version "$RELEASE_VERSION" --no-git-tag-version --allow-same-version
           npm publish --access public --provenance
 
       - name: Publish @codyswann/eslint-plugin-ui-standards
         if: ${{ hashFiles('eslint-plugin-ui-standards/package.json') != '' }}
         run: |
           cd eslint-plugin-ui-standards
-          npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+          npm version "$RELEASE_VERSION" --no-git-tag-version --allow-same-version
           npm publish --access public --provenance
 
       - name: Notify on success
-        run: echo "Successfully published version ${{ inputs.version }} to npm with provenance"
+        run: echo "Successfully published version $RELEASE_VERSION to npm with provenance"

package/package.json

@@ -171,7 +171,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -319,7 +319,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "e7d63c1fa3c6f7f706b013daa00901b4701ef8d9",
-  "gitHead": "e7d63c1fa3c6f7f706b013daa00901b4701ef8d9",
-  "lisaReleaseTag": "v4.39.0"
+  "lisaReleaseCommit": "ec7fc892e6ac49b4162920b7aecc37157877d4eb",
+  "gitHead": "ec7fc892e6ac49b4162920b7aecc37157877d4eb",
+  "lisaReleaseTag": "v4.40.1"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -1708,6 +1708,23 @@ def executed_operand(argv):
                 # ordinary shell options and do not consume the script path.
                 if not head.startswith("--") and "c" in head[1:]:
                     return None
+                # `-n` is noexec: the shell READS and parses the file and then
+                # exits without running a line of it. `bash -n <file>` is the
+                # one shape that puts a path at a command position while
+                # provably executing nothing, so it is the exact seam between
+                # reading and running — and this walk got it wrong in BOTH
+                # directions (CodySwannGT/lisa#3781). A creation-shaped file
+                # earned a false refusal; a file carrying a human-gate marker
+                # earned a false ALLOW, adjudicating as "declared" a command
+                # that filed nothing. The silent direction is the worse one.
+                #
+                # Not a read-only-command exemption: `bash <file>` still runs
+                # the file and is still refused. The distinction is noexec, not
+                # the program.
+                if head == "--noexec" or (
+                    not head.startswith("--") and "n" in head[1:]
+                ):
+                    return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())

package/plugins/lisa/hooks/block-managed-file-edits.sh

@@ -719,6 +719,20 @@ def shell_script_operand(args):
             # not a script file.
             if not token.startswith("--") and "c" in token[1:]:
                 return None
+            # `-n` is noexec: the shell READS and parses the file, then exits
+            # without executing a line of it. `bash -n <file>` is the one shape
+            # that puts a path at a command position while provably running
+            # nothing — the exact seam between reading and running, and this
+            # walk got it wrong (CodySwannGT/lisa#3781). Here that meant a
+            # syntax check of any script mentioning a managed path was refused
+            # as though it were about to write one.
+            #
+            # `bash <file>` still executes and is still refused. Noexec is the
+            # distinction, not the program.
+            if token == "--noexec" or (
+                not token.startswith("--") and "n" in token[1:]
+            ):
+                return None
             continue
         return token
     return None

package/plugins/lisa/hooks/block-no-verify.agy.sh

@@ -961,6 +961,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -991,12 +995,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1041,6 +1058,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/lisa/hooks/block-no-verify.sh

@@ -24,6 +24,13 @@
 #      `source`, `.`, `bash < nv.sh`, and an interpreter a `find -exec` or
 #      `xargs` puts at a command position.
 #
+# NOT vector 11: `bash -n nv.sh`. `-n` is noexec — the shell reads and parses
+# the file, then exits without running a line — so a syntax check is the one
+# shape that puts a path at a command position while executing nothing. It used
+# to be refused, which made `bash -n` unusable on this file, on every husky
+# hook, and on most of this repository (#3781). The distinction is noexec, not
+# the program: `bash nv.sh` still executes and is still refused.
+#
 # The line below is what lets `lisa apply` tell a downstream copy of this guard
 # that is BEHIND from one that is AHEAD. Byte comparison cannot: both look like
 # "differs from mine", and guessing "behind" is how a fork's stronger guard gets
@@ -1031,6 +1038,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -1061,12 +1072,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1111,6 +1135,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1708,6 +1708,23 @@ def executed_operand(argv):
                 # ordinary shell options and do not consume the script path.
                 if not head.startswith("--") and "c" in head[1:]:
                     return None
+                # `-n` is noexec: the shell READS and parses the file and then
+                # exits without running a line of it. `bash -n <file>` is the
+                # one shape that puts a path at a command position while
+                # provably executing nothing, so it is the exact seam between
+                # reading and running — and this walk got it wrong in BOTH
+                # directions (CodySwannGT/lisa#3781). A creation-shaped file
+                # earned a false refusal; a file carrying a human-gate marker
+                # earned a false ALLOW, adjudicating as "declared" a command
+                # that filed nothing. The silent direction is the worse one.
+                #
+                # Not a read-only-command exemption: `bash <file>` still runs
+                # the file and is still refused. The distinction is noexec, not
+                # the program.
+                if head == "--noexec" or (
+                    not head.startswith("--") and "n" in head[1:]
+                ):
+                    return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())

package/plugins/lisa-agy/hooks/block-managed-file-edits.sh

@@ -719,6 +719,20 @@ def shell_script_operand(args):
             # not a script file.
             if not token.startswith("--") and "c" in token[1:]:
                 return None
+            # `-n` is noexec: the shell READS and parses the file, then exits
+            # without executing a line of it. `bash -n <file>` is the one shape
+            # that puts a path at a command position while provably running
+            # nothing — the exact seam between reading and running, and this
+            # walk got it wrong (CodySwannGT/lisa#3781). Here that meant a
+            # syntax check of any script mentioning a managed path was refused
+            # as though it were about to write one.
+            #
+            # `bash <file>` still executes and is still refused. Noexec is the
+            # distinction, not the program.
+            if token == "--noexec" or (
+                not token.startswith("--") and "n" in token[1:]
+            ):
+                return None
             continue
         return token
     return None

package/plugins/lisa-agy/hooks/block-no-verify.agy.sh

@@ -961,6 +961,10 @@ def resolve_script(token):
 
 SHELL_COMMAND_STRING = object()
 SHELL_STDIN = object()
+# `-n` / `--noexec`: the shell READS and parses its operand, then exits without
+# executing a line of it. Distinct from the two above because nothing runs at
+# all — there is no payload to scan and no stdin script to wait for.
+SHELL_NOEXEC = object()
 
 
 def shell_execution_operand(args):
@@ -991,12 +995,25 @@ def shell_execution_operand(args):
             index += 1
             continue
         if token.startswith("--"):
+            if token == "--noexec":
+                return SHELL_NOEXEC
             if token not in SHELL_LONG_OPTIONS_NO_VALUE:
                 opaque_option_seen = True
             index += 1
             continue
         if "c" in token[1:]:
             return SHELL_COMMAND_STRING
+        # `-n` is noexec. `bash -n <file>` is the one shape that puts a path at
+        # a command position while provably executing nothing, so it is the
+        # exact seam between reading and running — and reach got it wrong in
+        # BOTH directions (CodySwannGT/lisa#3781). Here it meant a syntax check
+        # of any file merely DISCUSSING the bypass was refused, which is most of
+        # this repository's own guards and every husky hook.
+        #
+        # `bash <file>` still executes and is still refused. Noexec is the
+        # distinction, not the program: this is not a read-only exemption.
+        if "n" in token[1:]:
+            return SHELL_NOEXEC
         index += 1
     return args[index] if index < len(args) else SHELL_STDIN
 
@@ -1041,6 +1058,10 @@ def executed_scripts(tokens):
                     continue
                 if operand is SHELL_COMMAND_STRING:
                     continue
+                if operand is SHELL_NOEXEC:
+                    # Nothing runs, so there is nothing to follow and nothing
+                    # to fail closed about.
+                    continue
             else:
                 continue
             if operand is None:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.39.0",
+  "version": "4.40.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -1708,6 +1708,23 @@ def executed_operand(argv):
                 # ordinary shell options and do not consume the script path.
                 if not head.startswith("--") and "c" in head[1:]:
                     return None
+                # `-n` is noexec: the shell READS and parses the file and then
+                # exits without running a line of it. `bash -n <file>` is the
+                # one shape that puts a path at a command position while
+                # provably executing nothing, so it is the exact seam between
+                # reading and running — and this walk got it wrong in BOTH
+                # directions (CodySwannGT/lisa#3781). A creation-shaped file
+                # earned a false refusal; a file carrying a human-gate marker
+                # earned a false ALLOW, adjudicating as "declared" a command
+                # that filed nothing. The silent direction is the worse one.
+                #
+                # Not a read-only-command exemption: `bash <file>` still runs
+                # the file and is still refused. The distinction is noexec, not
+                # the program.
+                if head == "--noexec" or (
+                    not head.startswith("--") and "n" in head[1:]
+                ):
+                    return None
             elif head in NO_SCRIPT_OPTIONS.get(program, set()):
                 return None
             takes_value = head in INTERPRETER_VALUE_OPTIONS.get(program, set())

package/plugins/lisa-copilot/hooks/block-managed-file-edits.sh

@@ -719,6 +719,20 @@ def shell_script_operand(args):
             # not a script file.
             if not token.startswith("--") and "c" in token[1:]:
                 return None
+            # `-n` is noexec: the shell READS and parses the file, then exits
+            # without executing a line of it. `bash -n <file>` is the one shape
+            # that puts a path at a command position while provably running
+            # nothing — the exact seam between reading and running, and this
+            # walk got it wrong (CodySwannGT/lisa#3781). Here that meant a
+            # syntax check of any script mentioning a managed path was refused
+            # as though it were about to write one.
+            #
+            # `bash <file>` still executes and is still refused. Noexec is the
+            # distinction, not the program.
+            if token == "--noexec" or (
+                not token.startswith("--") and "n" in token[1:]
+            ):
+                return None
             continue
         return token
     return None