@codyswann/lisa 4.4.1 → 4.4.3

package/scripts/check-security-floors.mjs

@@ -23,10 +23,11 @@
  * @module scripts/check-security-floors
  */
 
-import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { globSync } from "node:fs";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 /**
  * Fixed absolute git locations, tried in order rather than a bare command name
  * so a writeable directory early on `PATH` cannot decide which binary runs.
@@ -129,18 +130,28 @@ const NOT_A_MANIFEST = [
 /**
  * Every manifest git tracks, so the glob can be checked against reality.
  *
- * Returns null when the question cannot be asked — outside a checkout, or with
- * no git. A null is reported as "not reconciled", never folded into "nothing
- * missing": the whole defect being fixed here is a scan that narrowed silently.
+ * Returns null when the question cannot be asked — outside a checkout, with no
+ * git, or with the child killed at its deadline. A null is reported as "not
+ * reconciled", never folded into "nothing missing": the whole defect being
+ * fixed here is a scan that narrowed silently.
+ *
+ * The swallow is therefore KEPT for a timeout rather than kept by inheritance.
+ * A kill is one more way the question cannot be asked, and this function
+ * already routes "cannot ask" to the safe answer — so re-raising would trade a
+ * correct report for a crash and gain nothing.
  * @returns {string[]|null} Tracked manifest paths, or null when unknowable.
  */
 function trackedManifests() {
   try {
-    return execFileSync(GIT_BIN, ["ls-files", "-z", "*package.lisa.json"], {
-      encoding: "utf8",
-      maxBuffer: 8 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "ignore"],
-    })
+    return boundedExecFileSync(
+      GIT_BIN,
+      ["ls-files", "-z", "*package.lisa.json"],
+      {
+        encoding: "utf8",
+        maxBuffer: 8 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "ignore"],
+      }
+    )
       .split("\0")
       .filter(Boolean)
       .filter(

package/scripts/check-template-workflow-refs.mjs

@@ -57,12 +57,12 @@
  *
  * @module scripts/check-template-workflow-refs
  */
-import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { fileURLToPath } from "node:url";
 
+import { boundedExecFileSync, isChildTimeout } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 const REPO_ROOT = path.resolve(
@@ -124,7 +124,7 @@ export function findWorkflowRefs(content) {
 function listTrackedFiles(root) {
   let stdout;
   try {
-    stdout = execFileSync("git", ["-C", root, "ls-files", "-z"], {
+    stdout = boundedExecFileSync("git", ["-C", root, "ls-files", "-z"], {
       encoding: "utf8",
       maxBuffer: MAX_GIT_OUTPUT_BYTES,
       stdio: ["ignore", "pipe", "ignore"],
@@ -140,13 +140,19 @@ function listTrackedFiles(root) {
 /**
  * Whether `ref` names an object present in this clone.
  *
+ * A KILLED child re-raises. `false` here does not mean "unknown", it means
+ * "this reference is broken" — a verdict the caller reports. So a busy machine
+ * would manufacture a failure about a reference that is perfectly fine, and a
+ * guard that invents failures is one people learn to re-run rather than read.
+ * That is the sibling harm to failing open, and it is just as corrosive.
  * @param {string} root - the repository root.
  * @param {string} ref - a tag, branch, or SHA.
  * @returns {boolean} whether the ref resolves locally.
+ * @throws {Error} When the child was killed at its deadline
  */
 function refExists(root, ref) {
   try {
-    execFileSync(
+    boundedExecFileSync(
       "git",
       ["-C", root, "rev-parse", "--verify", `${ref}^{commit}`],
       {
@@ -154,7 +160,8 @@ function refExists(root, ref) {
       }
     );
     return true;
-  } catch {
+  } catch (error) {
+    if (isChildTimeout(error)) throw error;
     return false;
   }
 }
@@ -162,18 +169,26 @@ function refExists(root, ref) {
 /**
  * Whether `target` exists in the tree named by `ref`.
  *
+ * A KILLED child re-raises, for the reason given on `refExists` above: `false`
+ * is a verdict of "absent at that ref", not an admission of ignorance.
  * @param {string} root - the repository root.
  * @param {string} ref - a tag, branch, or SHA known to resolve.
  * @param {string} target - a repo-relative path.
  * @returns {boolean} whether the path exists at that ref.
+ * @throws {Error} When the child was killed at its deadline
  */
 function pathExistsAtRef(root, ref, target) {
   try {
-    execFileSync("git", ["-C", root, "cat-file", "-e", `${ref}:${target}`], {
-      stdio: ["ignore", "ignore", "ignore"],
-    });
+    boundedExecFileSync(
+      "git",
+      ["-C", root, "cat-file", "-e", `${ref}:${target}`],
+      {
+        stdio: ["ignore", "ignore", "ignore"],
+      }
+    );
     return true;
-  } catch {
+  } catch (error) {
+    if (isChildTimeout(error)) throw error;
     return false;
   }
 }

package/scripts/check-workflow-package-paths.mjs

@@ -77,7 +77,6 @@
  *
  * @module scripts/check-workflow-package-paths
  */
-import { execFileSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
@@ -89,6 +88,7 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import { invokedAsScript } from "./lib/invoked-as-script.mjs";
 
 /** The package whose released layout a workflow may make claims about. */
@@ -179,7 +179,7 @@ function parseArgs(argv) {
  * @returns {readonly string[]} Repo-relative workflow paths
  */
 function trackedWorkflows(root) {
-  const output = execFileSync(
+  const output = boundedExecFileSync(
     "git",
     ["-C", root, "ls-files", ".github/workflows"],
     { encoding: "utf8" }
@@ -285,7 +285,7 @@ export function collectClaims(root) {
  */
 function publishedVersions() {
   const versions = JSON.parse(
-    execFileSync("npm", ["view", PACKAGE_NAME, "versions", "--json"], {
+    boundedExecFileSync("npm", ["view", PACKAGE_NAME, "versions", "--json"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       maxBuffer: 16 * 1024 * 1024,
@@ -357,7 +357,7 @@ function fetchReleaseListings(chosen, cacheDir) {
       continue;
     }
     const staging = mkdtempSync(path.join(tmpdir(), "lisa-release-"));
-    execFileSync(
+    boundedExecFileSync(
       "npm",
       ["pack", `${PACKAGE_NAME}@${version}`, "--pack-destination", staging],
       { stdio: ["ignore", "pipe", "pipe"] }
@@ -366,10 +366,14 @@ function fetchReleaseListings(chosen, cacheDir) {
     if (tarball === undefined) {
       throw new Error(`npm pack produced no tarball for ${version}`);
     }
-    const entries = execFileSync("tar", ["-tzf", path.join(staging, tarball)], {
-      encoding: "utf8",
-      maxBuffer: 64 * 1024 * 1024,
-    })
+    const entries = boundedExecFileSync(
+      "tar",
+      ["-tzf", path.join(staging, tarball)],
+      {
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+      }
+    )
       .split("\n")
       .filter(Boolean);
     listings[version] = entries;

package/scripts/generate-lisa-owned-hash-ledger.mjs

@@ -19,11 +19,12 @@
  *   legitimately stale file as host-modified and stop refreshing it — failing
  *   safe, but permanently.
  */
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
+import { boundedExecFileSync, isChildTimeout } from "./lib/bounded-spawn.mjs";
+
 const repoRoot = path.resolve(import.meta.dirname, "..");
 const outputPath = path.join(repoRoot, "src/core/lisa-owned-hash-ledger.ts");
 const COPY_OVERWRITE = "copy-overwrite";
@@ -35,18 +36,25 @@ const ENFORCEMENT_TREE = "scripts/";
  *
  * Blobs are read as `binary` so arbitrary bytes survive the round trip into the
  * Buffer that gets hashed; decoding as UTF-8 would corrupt any non-text file.
+ * A KILLED child re-raises. Every caller reads this as content, and an empty
+ * string is a perfectly well-formed answer meaning "no files" — so a timeout
+ * on the `ls-files` call would build a ledger that vouches for NOTHING and
+ * report it as a complete one. A ledger's whole job is to vouch for bytes; one
+ * assembled from silence is worse than none, because it looks authoritative.
  * @param {readonly string[]} args - Arguments passed to git
- * @returns {string} Command stdout, or an empty string when git fails
+ * @returns {string} Command stdout, or an empty string when git said nothing
+ * @throws {Error} When the child was killed at its deadline
  */
 function git(args) {
   try {
-    return execFileSync("git", args, {
+    return boundedExecFileSync("git", args, {
       cwd: repoRoot,
       encoding: "buffer",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
     }).toString("binary");
-  } catch {
+  } catch (error) {
+    if (isChildTimeout(error)) throw error;
     return "";
   }
 }

package/scripts/generate-upstream-evidence-manifest.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 /** Generate the exact hash-pinned allowlist for public upstream evidence. */
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
 import {
   describeStaleManifest,
   diagnoseStaleManifest,
@@ -86,7 +86,7 @@ function repositoryPath(url) {
 // comparison is by path: `url.<base>.insteadOf` rewrites what `git remote
 // get-url` returns, so it answers "how do I reach this" rather than "what is
 // this". Falls back to the resolved URL only if no value is configured.
-const originUrl = execFileSync(
+const originUrl = boundedExecFileSync(
   "git",
   ["config", "--get", "remote.origin.url"],
   { cwd: repoRoot, encoding: "utf8" }
@@ -100,7 +100,7 @@ if (repositoryPath(originUrl) !== canonicalRepository.toLowerCase()) {
   );
 }
 
-const tracked = execFileSync("git", ["ls-files", "-z"], {
+const tracked = boundedExecFileSync("git", ["ls-files", "-z"], {
   cwd: repoRoot,
   encoding: "utf8",
 })
@@ -135,7 +135,7 @@ const existingPublicCommits = [
   .filter(Boolean);
 const refreshPublicCommits = process.argv.includes("--refresh-public-commits");
 const discoveredPublicCommits = refreshPublicCommits
-  ? execFileSync("git", ["rev-list", "--remotes=origin"], {
+  ? boundedExecFileSync("git", ["rev-list", "--remotes=origin"], {
       cwd: repoRoot,
       encoding: "utf8",
     })

package/scripts/verify-health-agentic-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped optional agentic Health composition API. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   lstat,
@@ -17,6 +16,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const TEMPLATES_MANAGED = "templates.managed";
@@ -62,14 +63,14 @@ const root = process.cwd();
 const workspace = await mkdtemp(path.join(tmpdir(), "lisa-health-agentic-"));
 const project = path.join(workspace, "host");
 const isolatedBin = path.join(workspace, "bin");
-const gitExecutable = execFileSync("which", ["git"], {
+const gitExecutable = boundedExecFileSync("which", ["git"], {
   encoding: "utf8",
 }).trim();
 const healthFile = path.join(project, ".lisa", "health", "latest.json");
 const startedAt = Date.now();
 
 const run = (executable, argv, options = {}) =>
-  execFileSync(executable, argv, {
+  boundedExecFileSync(executable, argv, {
     cwd: project,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],

package/scripts/verify-health-consumer-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Built-package proof for the real two-phase Health CLI consumer. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import {
   lstat,
   mkdir,
@@ -14,6 +13,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const LATEST_JSON = "latest.json";
@@ -53,7 +54,7 @@ async function createProject(name) {
 
 /** Run the compiled CLI and capture its exact standard-output bytes. */
 function runCli(project, argv, input) {
-  return execFileSync(
+  return boundedExecFileSync(
     process.execPath,
     [cli, "--no-update-check", "health", ...argv, project],
     {

package/scripts/verify-health-contract-built.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped Health v1 contract and real built CLI. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 let assertions = 0;
 const check = (condition, message) => {
   assertions += 1;
@@ -23,7 +24,7 @@ try {
     path.join(project, ".lisa.config.json"),
     `${JSON.stringify({ tracker: "github", github: { org: "acme", repo: "app" } }, null, 2)}\n`
   );
-  execFileSync(
+  boundedExecFileSync(
     process.execPath,
     [path.join(root, "dist/index.js"), "sync", project, "--json"],
     {

package/scripts/verify-health-deterministic-built.mjs

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
 /** Empirical proof for the shipped deterministic Health fast path. */
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   chmod,
@@ -18,6 +17,8 @@ import {
 import { tmpdir } from "node:os";
 import path from "node:path";
 
+import { boundedExecFileSync } from "./lib/bounded-spawn.mjs";
+
 // Literals named once — each was repeated enough times that a typo in one
 // copy would diverge silently.
 const PACKAGE_JSON = "package.json";
@@ -40,14 +41,14 @@ const root = process.cwd();
 const workspace = await mkdtemp(path.join(tmpdir(), "lisa-health-fast-path-"));
 const project = path.join(workspace, "host");
 const isolatedBin = path.join(workspace, "bin");
-const gitExecutable = execFileSync("which", ["git"], {
+const gitExecutable = boundedExecFileSync("which", ["git"], {
   encoding: "utf8",
 }).trim();
 const healthFile = path.join(project, ".lisa", "health", "latest.json");
 const startedAt = Date.now();
 
 const run = (executable, argv, options = {}) =>
-  execFileSync(executable, argv, {
+  boundedExecFileSync(executable, argv, {
     cwd: project,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
@@ -466,7 +467,7 @@ try {
       path.join(unsafeProject, LISA_CONFIG_JSON),
       '{"tracker":"github","harness":"codex"}\n'
     );
-    execFileSync("mkfifo", [path.join(unsafeProject, PACKAGE_JSON)]);
+    boundedExecFileSync("mkfifo", [path.join(unsafeProject, PACKAGE_JSON)]);
     const unsafeStarted = Date.now();
     const unsafe = await health.runDeterministicHealth(unsafeProject, {
       lisaRoot: root,

package/plugins/lisa/.codex-plugin/skills/lisa-parity-safety-net-rules/SKILL.md

@@ -1,263 +0,0 @@
----
-name: lisa-parity-safety-net-rules
-description: "View, set, and verify the…"
-allowed-tools: ["Read", "Edit", "Write", "Bash"]
-synced-from: safety-net@cc-marketplace@1.0.6
----
-
-# Parity Safety-Net Rules
-
-Manage the **custom guard rules** that Lisa's safety-net hook enforces on every
-Bash command. The hook (`hooks/parity-safety-net.sh`, registered as a
-`PreToolUse` matcher on `Bash`) ships with built-in guards against catastrophic
-commands; this skill lets a project **view**, **set**, and **verify** *additional*
-project-specific rules on top of those built-ins.
-
-> **Lisa-native reimplementation.** Upstream 0.9.0 shipped two rule-management
-> skills (`set-custom-rules` + `verify-custom-rules`), which this skill
-> consolidates. Upstream 1.0.6 consolidated them too (into `cc-safety-net`) and
-> moved custom rules to a JSON rulebook system driven by the
-> `npx cc-safety-net rule` CLI. Lisa **deliberately keeps** its simpler
-> ERE-lines-file design: the Lisa hook must run identically on Codex, agy,
-> Copilot, Cursor, and Claude without an npx dependency, and a flat regex file
-> is auditable in any of those runtimes. It is reimplemented from scratch
-> against Lisa conventions — it does **not** port or invoke upstream plugin
-> code.
->
-> **Drift tracking.** Pinned to `safety-net@cc-marketplace@1.0.6`.
-> `scripts/plugin-parity-drift.mjs` compares this pin against the upstream
-> version in the plugin cache and flags staleness. **Do not port or copy upstream
-> plugin code.**
->
-> **2.0.3 review.** Upstream 2.0.2–2.0.3 added Kimi Code and Amp installation
-> support and release tooling. Those changes do not alter the upstream
-> rule-management skill or Lisa's project-local ERE rule contract, and Lisa does
-> not currently ship hooks for those runtimes, so no behavior is absorbed here.
->
-> **2.0.4 review.** Method, so the next person can re-run it rather than trust
-> it: hash the sorted (relative path, content) manifest of every rule-bearing
-> directory in the plugin cache under both versions, then diff the trees
-> excluding `dist/`, `.git/`, and `node_modules/`. Result — `src/` (230 files),
-> `skills/` (1), and `hooks/` (1) are byte-identical across 2.0.3 and 2.0.4
-> (`src` digest `7e346e205fbd1aa7` both sides). The only non-generated
-> differences are the `version` string in `package.json`, `kimi.plugin.json`,
-> and `.claude-plugin/plugin.json`, plus a test-harness fix in
-> `tests/cli/cli-statusline.test.ts` that tolerates EPIPE when an oversized
-> payload is flushed at the bounded reader's cap. Everything else is rebuilt
-> `dist/` output. No rule, guard family, or skill surface moved, so nothing is
-> absorbed here — and, critically, **2.0.4 does not close the gap recorded
-> below**, which therefore carries forward unchanged rather than being dropped
-> at the new pin.
->
-> **Known gap at the 2.0.4 pin.** Upstream 2.0.0 rebuilt its engine and added two
-> guard families this hook does **not** mirror: `secret.*` (blocks reading or
-> copying SSH keys, `.env` files, cloud credentials, and coding-CLI credential
-> stores) and `rm.git-metadata` (blocks deleting the `.git` control plane). Both
-> were measured against this hook rather than assumed — see the probe table in
-> `parity/plugin-routing/safety-net@cc-marketplace.md`. Absorbing `secret.*` also
-> needs a matcher change, because this hook is registered on `Bash` only while
-> upstream also screens file tools. That work is tracked separately in
-> `parity/FOLLOWUPS.md` §5; **do not treat this skill's built-in guard list as
-> covering secret access.**
-
-## How the rules work
-
-- The hook always enforces its **built-in guards** (see below). These cannot be
-  disabled from the rules file — they are the floor.
-- **Custom rules** live in a project-local file, one **POSIX extended regular
-  expression (ERE)** per line. Blank lines and lines beginning with `#` are
-  ignored. Matching is case-insensitive (`grep -Ei`).
-- If *any* built-in guard or custom rule matches the proposed command, the hook
-  exits non-zero and the Bash call is **blocked**, with the reason shown to the
-  agent.
-
-### Rules file location
-
-Resolved in this order:
-
-1. `$SAFETY_NET_RULES_FILE` (explicit override), else
-2. `${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt`
-
-```bash
-RULES_FILE="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
-```
-
-### Built-in guards (always on)
-
-1. `rm -rf` of a filesystem root, `$HOME`/`~`, or a top-level wildcard — with
-   quote-aware boundaries, so wrapper/interpreter forms like
-   `bash -c "rm -rf /"` and `python -c "… os.system('rm -rf /')"` match too.
-   Path-prefixed spellings (`/bin/rm`, `./rm`) count as `rm` for every rm
-   guard.
-2. `rm -rf` target hardening: the cwd itself (`.`/`./`), `..`-traversal paths,
-   home-anchored `~/…` paths, absolute paths outside the project (`/tmp`,
-   `/var/tmp`, and `$TMPDIR` are allowed), `$VAR` targets other than `$TMPDIR`,
-   and **any** recursive forced delete while the working directory is `$HOME`.
-3. Force-pushing a protected branch
-   (`main`/`master`/`production`/`prod`/`release`). `--force-with-lease` is
-   intentionally allowed, and so is force-pushing a feature branch (sanctioned
-   rebase workflow). Acceptable parity divergence: a refspec force-push
-   (`git push origin +main`) is not blocked — upstream 1.0.6 allows it too.
-4. `git reset --hard` / `git reset --merge` while the working tree is **dirty**
-   (would discard work). Clean-tree resets are intentionally allowed.
-5. `git rebase --abort` / `git rebase --quit` while the in-progress rebase
-   holds human-made conflict resolutions (they would be discarded). A clean or
-   untouched rebase state stays abortable — an agent-recoverable wedge; the
-   apply backend and a missing `AUTO_MERGE` ref fail closed. Deliberate
-   divergence: upstream blocks `rebase --abort` unconditionally.
-6. `git checkout` discards: the `--` pathspec form (with or without a ref),
-   `-f`/`--force`, `--pathspec-from-file`, and bare `git checkout .`.
-   Branch switching and `-b`/`-B` creation stay allowed.
-7. `git switch --discard-changes` / `-f`/`--force`.
-8. `git restore` touching the worktree — only `git restore --staged <path>`
-   without `--worktree` is allowed (unstaging is safe).
-9. `git stash drop` / `git stash clear` (push/pop/list/apply stay allowed).
-10. `git clean` with a force flag and no dry-run — `-n`/`--dry-run` anywhere
-    makes it a safe preview.
-11. `git branch -D` (or `-d` combined with `-f`, clustered or split);
-    safe `-d` and rename `-m` stay allowed.
-12. `git tag -d`, `git reflog delete`, `git worktree remove --force`.
-13. Deletion via `find … -delete`, `find … -exec rm -rf`, and `xargs … rm -rf`
-    (plain non-recursive `rm` on find/xargs output stays allowed).
-14. Disk destroyers: `dd of=/dev/…`, `mkfs … /dev/…`, `shred`.
-15. Destructive SQL — `DROP DATABASE/SCHEMA/TABLE`, `TRUNCATE TABLE`.
-
-Every git guard sees through leading git **global options** (`-C <path>`,
-`-c <k>=<v>`, `--git-dir[=…]`, `--no-pager`, …), so `git -C /path <destructive>`
-is screened the same as `git <destructive>`.
-
-Malformed hook input fails **closed** (exit 2 denies the command). A text-scan
-hook cannot exempt display commands, so prose like
-`echo "docs about rm -rf /"` can false-positive — quote-break the string or use
-the gh-writer heredoc form (payload is stripped before the guards run). For the
-same reason the rm guard treats substitution-wrapping as verdict-neutral (issue
-#1982): an executable `echo "$(rm -rf /)"` is blocked, and so are inert twins the
-shell would never expand — a single-quoted `echo '$(rm -rf /)'` or an escaped
-`echo "\$(rm -rf /)"` — since the scan has no quote-context awareness. The same
-quote-break or heredoc workaround applies. Spell that heredoc workaround with a
-**quote-pair** delimiter (`gh issue create --body-file - <<'EOF'`) — only that
-spelling reaches the payload-strip path. `<<"EOF"` and `<<\EOF` do not, and a
-`gh … <<\EOF` writer now fails closed instead.
-
-## What this does and does not defend against
-
-Read this before treating the safety net as a wall.
-
-**What it is for:** stopping *accidental* catastrophic commands — an agent (or a
-human) that reaches for `rm -rf /`, force-pushes `main`, drops a table, or writes
-to a raw device by mistake. Within that job the guards above are the floor and
-they are always on.
-
-**What it is not:** a security boundary against a deliberate adversary. Two
-structural reasons, both accepted rather than open bugs:
-
-- **It is a text scan, not a shell engine.** It has no quote-context awareness,
-  which produces the false positives described above and means an operation
-  spelled in a way the patterns do not anticipate is not matched.
-- **The here-doc classifier re-implements bash's lexer in Python** to decide
-  which payload text is inert data. Every divergence from real bash is a shape it
-  mis-classifies. Eight distinct divergences were found and fixed across issues
-  #1958 and #1993; the class is open-ended, so it is now closed as an accepted
-  limitation rather than chased indefinitely.
-
-**Why that is tolerable:** a here-doc mis-classification degrades to the content
-guards rather than bypassing them. Only the narrow `gh issue|pr` writer form ever
-strips payload text; every other path passes the **raw** command to the guards,
-and since issue #1982 those guards see through substitution wrappers. So a
-mis-read here-doc costs no guard coverage for any destructive class listed above.
-
-**The honest bottom line:** an agent that is actively trying to run something
-destructive has many paths that never involve a here-doc at all — the safety net
-does not claim to close them. Do not rely on it as the only control over what an
-agent may execute; treat it as the last line of defence against mistakes, and
-keep the real boundary (credentials, permissions, environment isolation) outside
-the agent.
-
-## View the current rules
-
-```bash
-RULES_FILE="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
-if [ -f "$RULES_FILE" ]; then
-  echo "Custom safety-net rules ($RULES_FILE):"
-  grep -vE '^[[:space:]]*(#|$)' "$RULES_FILE" || echo "(no active rules)"
-else
-  echo "No custom rules file yet ($RULES_FILE). Only built-in guards are active."
-fi
-```
-
-`Read` the file to show comments and structure as well.
-
-## Set (add or edit) a rule
-
-A rule is an ERE matched against the full command string. Keep rules **specific**
-to avoid blocking legitimate work — anchor on the dangerous verb and its target.
-
-1. Ensure the file exists, then **append** a commented rule (use `Edit`/`Write`,
-   or append from the shell):
-
-   ```bash
-   RULES_FILE="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
-   mkdir -p "$(dirname "$RULES_FILE")"
-   {
-     echo "# Block deleting a Kubernetes namespace"
-     echo 'kubectl[[:space:]]+delete[[:space:]]+namespace'
-   } >> "$RULES_FILE"
-   ```
-
-2. **Always verify** the new rule (next section) before considering it set —
-   confirm it blocks what it should and allows what it shouldn't.
-
-Editing/removing: open the file with `Edit` and change or delete the line.
-Removing a rule never affects the built-in guards.
-
-## Verify the rules
-
-Two checks — both should pass before you trust a rule.
-
-### 1. The ERE is valid
-
-An invalid regex would make the hook error on every command. Validate it:
-
-```bash
-printf '%s' "$RULE" | grep -Eq -- "$RULE" 2>/dev/null && echo "valid ERE" \
-  || echo "INVALID ERE — fix before saving"
-```
-
-### 2. The rule behaves as intended
-
-Drive the **actual hook** with a fake `PreToolUse` payload and assert the exit
-code (non-zero = blocked, 0 = allowed). Build the JSON with `jq` so the test
-command line itself never contains the dangerous literal:
-
-```bash
-HOOK="${CLAUDE_PLUGIN_ROOT}/hooks/parity-safety-net.sh"
-
-check() { # check <expect: block|allow> <command>
-  jq -nc --arg c "$2" '{tool_name:"Bash",tool_input:{command:$c}}' \
-    | bash "$HOOK" >/dev/null 2>&1
-  local code=$?
-  local got=allow; [ "$code" -ne 0 ] && got=block
-  printf '%-5s want=%-5s got=%-5s  %s\n' \
-    "$([ "$got" = "$1" ] && echo OK || echo FAIL)" "$1" "$got" "$2"
-}
-
-# Should block (matches the new rule):
-check block "kubectl delete namespace prod"
-# Should allow (must not over-match):
-check allow "kubectl get pods"
-```
-
-Report a table of cases with want/got/verdict. If any case disagrees, tighten the
-ERE and re-verify.
-
-## Rules
-
-- **Built-in guards are the floor** — custom rules only *add* blocks; they cannot
-  weaken the built-ins.
-- **Prefer specific over broad** — a rule that blocks too much trains users to
-  bypass the safety net. Anchor on verb + target.
-- **Verify every rule against the real hook** before saving — never ship an
-  unverified or syntactically invalid ERE.
-- **Never weaken the net to unblock yourself.** If a built-in guard fires on a
-  command that is genuinely safe, run it manually outside the agent after the
-  user confirms — do not edit the hook to remove the guard.

package/plugins/lisa/.codex-plugin/skills/lisa-parity-safety-net-rules/agents/openai.yaml

@@ -1,4 +0,0 @@
-display_name: "Parity Safety Net Rules"
-short_description: "View, set, and verify the…"
-default_prompt:
-  - "Use $lisa-parity-safety-net-rules: View, set, and verify the…."