@codyswann/lisa 4.4.17 → 4.4.19

package/expo/create-only/.github/required-checks.json

@@ -10,9 +10,11 @@
     "`_example_required_contexts` below is a STARTING POINT FOR TYPING, never read by the guard. Verify every line against your own ruleset before promoting any of it.",
     "THE FAMILY: required-and-red is loud; required-and-vacuous is not; advisory-and-stale is invisible. All three are one gate reporting satisfied without proving anything. `required_contexts` + `skip_job_declarations` above cover the SKIPPED variant; `evidence_bearing_checks` below covers the VACUOUS one.",
     "VACUOUS, measured (CodySwannGT/lisa#2497): a required `CodeRabbit` context posted `success` with the description `Review rate limited`, having reviewed nothing, on two security-relevant PRs that then merged and shipped. `gh pr checks` prints `pass` for that exactly as it does for a real review — only the DESCRIPTION tells them apart.",
-    "Run it per PR: `npm run check:vacuous-required-checks -- --pr=1234` (or `node scripts/check-skipped-required-checks.mjs --pr=1234`). It reads `gh pr checks --json name,state,bucket,description`, which is the only route that carries the description for a legacy commit status like CodeRabbit's.",
+    "NOTHING HAS TO REMEMBER A FLAG. `.github/workflows/review-evidence.yml` runs this arm on every pull request, and `npm run check:vacuous-required-checks` resolves the pull request itself: `--pr`, else the `pull_request` payload at GITHUB_EVENT_PATH, else `refs/pull/N/merge` in GITHUB_REF, else the checked-out branch. For one specific pull request by hand: `npm run check:vacuous-required-checks -- --pr=1234`.",
+    "It reads `gh pr checks --json name,state,bucket,description`, the only route that carries the description for a legacy commit status like CodeRabbit's, and falls back to the commit-status API when the token lacks `actions: read` (`gh pr checks` resolves the rollup through `checkSuite.workflowRun`, and without that scope it exits non-zero with EMPTY STDOUT — a failure shaped like a content problem that never says the word \"permission\").",
+    "IT REFUSES RATHER THAN REPORTING AN EMPTY INSPECTION. An unresolvable pull request, a `gh` it could not read, a roster with no checks in it, or an empty `evidence_bearing_checks` all print the same \"nothing vacuous here\" that a genuinely clean run prints — so the guard fails instead and names which of the four it hit (`vacuity_pr_unresolved`, `vacuity_checks_unreadable`, `vacuity_no_checks_reported`, `vacuity_none_declared`). A refusal is NOT a finding: NOBODY LOOKED and THE REVIEW WAS FAKE are opposite facts, and a single red job would otherwise report them identically.",
     "`evidence_bearing_checks` names the checks whose GREEN is supposed to mean something reviewed the code. Use `{}` to accept the shipped description vocabulary, or add `proof` / `no_work` arrays to extend it — extensions ADD to the defaults, they do not replace them. Undeclared checks are never examined, because most CI jobs ship an empty description and flagging them all would bury the one finding that matters.",
-    "This arm REPORTS AND NEVER BLOCKS, in every enforcement mode. A review bot can go hollow because an org-wide SPENDING CAP was hit, and a gate that reddens every PR on a billing state is worse than the one it criticises. What it changes is what you may CLAIM: a PR carrying a `vacuous_required_check` finding has not been shown to be reviewed, so do not record it as reviewed."
+    "This arm REPORTS AND NEVER BLOCKS, in every enforcement mode. A review bot can go hollow because an org-wide SPENDING CAP was hit, and a gate that reddens every PR on a billing state is worse than the one it criticises. What it changes is what you may CLAIM: a PR carrying a `vacuous_required_check` finding has not been shown to be reviewed, so do not record it as reviewed. Once you have made the governance call, `--fail-on-vacuous` is the supported way to ask for an exit code — add it to the command in `review-evidence.yml`, instead of writing a wrapper that reads `--json`."
   ],
   "enforcement": "warn",
   "ruleset": {

package/nestjs/create-only/.github/required-checks.json

@@ -10,9 +10,11 @@
     "`_example_required_contexts` below is a STARTING POINT FOR TYPING, never read by the guard. Verify every line against your own ruleset before promoting any of it.",
     "THE FAMILY: required-and-red is loud; required-and-vacuous is not; advisory-and-stale is invisible. All three are one gate reporting satisfied without proving anything. `required_contexts` + `skip_job_declarations` above cover the SKIPPED variant; `evidence_bearing_checks` below covers the VACUOUS one.",
     "VACUOUS, measured (CodySwannGT/lisa#2497): a required `CodeRabbit` context posted `success` with the description `Review rate limited`, having reviewed nothing, on two security-relevant PRs that then merged and shipped. `gh pr checks` prints `pass` for that exactly as it does for a real review — only the DESCRIPTION tells them apart.",
-    "Run it per PR: `npm run check:vacuous-required-checks -- --pr=1234` (or `node scripts/check-skipped-required-checks.mjs --pr=1234`). It reads `gh pr checks --json name,state,bucket,description`, which is the only route that carries the description for a legacy commit status like CodeRabbit's.",
+    "NOTHING HAS TO REMEMBER A FLAG. `.github/workflows/review-evidence.yml` runs this arm on every pull request, and `npm run check:vacuous-required-checks` resolves the pull request itself: `--pr`, else the `pull_request` payload at GITHUB_EVENT_PATH, else `refs/pull/N/merge` in GITHUB_REF, else the checked-out branch. For one specific pull request by hand: `npm run check:vacuous-required-checks -- --pr=1234`.",
+    "It reads `gh pr checks --json name,state,bucket,description`, the only route that carries the description for a legacy commit status like CodeRabbit's, and falls back to the commit-status API when the token lacks `actions: read` (`gh pr checks` resolves the rollup through `checkSuite.workflowRun`, and without that scope it exits non-zero with EMPTY STDOUT — a failure shaped like a content problem that never says the word \"permission\").",
+    "IT REFUSES RATHER THAN REPORTING AN EMPTY INSPECTION. An unresolvable pull request, a `gh` it could not read, a roster with no checks in it, or an empty `evidence_bearing_checks` all print the same \"nothing vacuous here\" that a genuinely clean run prints — so the guard fails instead and names which of the four it hit (`vacuity_pr_unresolved`, `vacuity_checks_unreadable`, `vacuity_no_checks_reported`, `vacuity_none_declared`). A refusal is NOT a finding: NOBODY LOOKED and THE REVIEW WAS FAKE are opposite facts, and a single red job would otherwise report them identically.",
     "`evidence_bearing_checks` names the checks whose GREEN is supposed to mean something reviewed the code. Use `{}` to accept the shipped description vocabulary, or add `proof` / `no_work` arrays to extend it — extensions ADD to the defaults, they do not replace them. Undeclared checks are never examined, because most CI jobs ship an empty description and flagging them all would bury the one finding that matters.",
-    "This arm REPORTS AND NEVER BLOCKS, in every enforcement mode. A review bot can go hollow because an org-wide SPENDING CAP was hit, and a gate that reddens every PR on a billing state is worse than the one it criticises. What it changes is what you may CLAIM: a PR carrying a `vacuous_required_check` finding has not been shown to be reviewed, so do not record it as reviewed."
+    "This arm REPORTS AND NEVER BLOCKS, in every enforcement mode. A review bot can go hollow because an org-wide SPENDING CAP was hit, and a gate that reddens every PR on a billing state is worse than the one it criticises. What it changes is what you may CLAIM: a PR carrying a `vacuous_required_check` finding has not been shown to be reviewed, so do not record it as reviewed. Once you have made the governance call, `--fail-on-vacuous` is the supported way to ask for an exit code — add it to the command in `review-evidence.yml`, instead of writing a wrapper that reads `--json`."
   ],
   "enforcement": "warn",
   "ruleset": {

package/package.json

@@ -49,6 +49,7 @@
     "check:pipeline-status-reads": "node scripts/check-pipeline-status-reads.mjs",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
+    "check:vacuous-required-checks": "node typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs --vacuity",
     "check:orphan-processes": "node scripts/check-orphan-test-processes.mjs",
     "check:template-workflow-refs": "node scripts/check-template-workflow-refs.mjs",
     "check:workflow-package-paths": "node scripts/check-workflow-package-paths.mjs",
@@ -146,7 +147,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-direct-issue-create.sh

@@ -389,13 +389,21 @@ POST_PAYLOAD_FLAGS = {
 # read as an endpoint: it is data being sent, not the address being posted to.
 PAYLOAD_VALUE_FLAGS = {"-f", "-F", "--raw-field", "--field"}
 
-GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s]+/[^/\s]+/issues/?$")
+# Matched against a token's PATH COMPONENT, never the raw argument — see
+# `endpoint_path`. The `$` anchor is load-bearing and stays: without it
+# `repos/o/r/issues/123/comments` reads as a creation, which is a different
+# operation this guard must not refuse. The segment classes exclude `?` and
+# `#` so the anchor cannot be reached past a decoration even if some future
+# caller forgets to parse first.
+GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s?#]+/[^/\s?#]+/issues/?$")
 GITHUB_ISSUES_URL = re.compile(r"api\.github\.com/repos/[^/\s]+/[^/\s]+/issues")
 # The repository a creation is ADDRESSED at, which decides whose ready role
 # answers for it. `gh` accepts the flag before or after the subcommand and in
 # either spelling, and the REST paths carry the same pair positionally.
 REPO_FLAGS = {"--repo", "-R"}
-GITHUB_ISSUES_PATH_REPO = re.compile(r"repos/([^/\s]+)/([^/\s]+)/issues/?$")
+GITHUB_ISSUES_PATH_REPO = re.compile(
+    r"repos/([^/\s?#]+)/([^/\s?#]+)/issues/?$"
+)
 GITHUB_ISSUES_URL_REPO = re.compile(
     r"api\.github\.com/repos/([^/\s]+)/([^/\s]+)/issues"
 )
@@ -663,8 +671,33 @@ def is_write_request(args):
     return False
 
 
-def endpoint_tokens(args, pattern):
-    """Tokens naming an API endpoint, excluding payload values.
+def endpoint_path(token):
+    """The path component of an endpoint-shaped argument.
+
+    An endpoint is a URL, and a URL is not its path: `?query` and `#fragment`
+    are separate components that address the SAME resource. Comparing the raw
+    argument against a path pattern therefore recognised a URL SHAPE rather
+    than an endpoint, and `repos/o/r/issues?foo=1` — the identical request —
+    was classified as a non-creation and allowed (#2939).
+
+    Trailing whitespace is stripped for the same reason: `"repos/o/r/issues "`
+    survives shlex as one token and addresses the same endpoint, but defeats an
+    end-anchored comparison just as a query string does.
+
+    Args:
+        token: One argument, possibly a decorated endpoint.
+
+    Returns:
+        The token with any fragment, query, and surrounding whitespace removed.
+    """
+    # Fragment first: it is the LAST component of a URL, so `path?q#f` yields
+    # `path?q` here and `path` after the query split, while a malformed
+    # `path#a?b` still collapses to `path` rather than keeping `a?b`.
+    return token.split("#", 1)[0].split("?", 1)[0].strip()
+
+
+def endpoint_paths(args, pattern):
+    """Endpoint path components matching a pattern, excluding payload values.
 
     Scans every token rather than a filtered positional list, because a BOOLEAN
     flag has no value to skip and filtering swallowed the endpoint behind one:
@@ -672,21 +705,28 @@ def endpoint_tokens(args, pattern):
     behind `--silent`. Payload values are excluded the other way, so
     `-f path=repos/o/r/issues` is not mistaken for the address being posted to.
 
+    That payload exclusion is tested on the PATH, not the raw token, and the
+    order matters: a query string carries `=`, so testing the raw token skipped
+    `repos/o/r/issues?foo=1` before the pattern ever ran. Two independent
+    mechanisms — this filter and the pattern's end anchor — hid the same
+    creation, which is why fixing only the anchor would not have closed it.
+
     Args:
         args: A command's arguments.
-        pattern: The endpoint regex.
+        pattern: The endpoint regex, written against a path component.
 
     Returns:
-        Matching endpoint tokens.
+        The matching path components, decoration removed.
     """
     found = []
     for index, token in enumerate(args):
-        if "=" in token:
+        path = endpoint_path(token)
+        if "=" in path:
             continue
         if index > 0 and args[index - 1] in PAYLOAD_VALUE_FLAGS:
             continue
-        if pattern.search(token):
-            found.append(token)
+        if pattern.search(path):
+            found.append(path)
     return found
 
 
@@ -712,7 +752,7 @@ def creation_signature(name, args):
         if "api" in args:
             if GRAPHQL_CREATE.search(joined):
                 return "gh api graphql issue creation"
-            if endpoint_tokens(args, GITHUB_ISSUES_PATH) and is_write_request(args):
+            if endpoint_paths(args, GITHUB_ISSUES_PATH) and is_write_request(args):
                 return "gh api POST .../issues"
         return None
 
@@ -820,7 +860,7 @@ def target_repository(args):
     Read only from positions that actually reach the created item: a flag
     before the end-of-options marker, or the endpoint the write is posted to.
     A `-f repo=o/r` payload field is data being SENT, not the address being
-    posted to, and `endpoint_tokens` already excludes it.
+    posted to, and `endpoint_paths` already excludes it.
 
     Args:
         args: A creating command's arguments.
@@ -837,8 +877,8 @@ def target_repository(args):
             head, value = token.split("=", 1)
             if head in REPO_FLAGS:
                 return normalise_repo(value)
-    for token in endpoint_tokens(scoped, GITHUB_ISSUES_PATH):
-        match = GITHUB_ISSUES_PATH_REPO.search(token)
+    for path in endpoint_paths(scoped, GITHUB_ISSUES_PATH):
+        match = GITHUB_ISSUES_PATH_REPO.search(path)
         if match:
             return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
     for token in scoped:

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -389,13 +389,21 @@ POST_PAYLOAD_FLAGS = {
 # read as an endpoint: it is data being sent, not the address being posted to.
 PAYLOAD_VALUE_FLAGS = {"-f", "-F", "--raw-field", "--field"}
 
-GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s]+/[^/\s]+/issues/?$")
+# Matched against a token's PATH COMPONENT, never the raw argument — see
+# `endpoint_path`. The `$` anchor is load-bearing and stays: without it
+# `repos/o/r/issues/123/comments` reads as a creation, which is a different
+# operation this guard must not refuse. The segment classes exclude `?` and
+# `#` so the anchor cannot be reached past a decoration even if some future
+# caller forgets to parse first.
+GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s?#]+/[^/\s?#]+/issues/?$")
 GITHUB_ISSUES_URL = re.compile(r"api\.github\.com/repos/[^/\s]+/[^/\s]+/issues")
 # The repository a creation is ADDRESSED at, which decides whose ready role
 # answers for it. `gh` accepts the flag before or after the subcommand and in
 # either spelling, and the REST paths carry the same pair positionally.
 REPO_FLAGS = {"--repo", "-R"}
-GITHUB_ISSUES_PATH_REPO = re.compile(r"repos/([^/\s]+)/([^/\s]+)/issues/?$")
+GITHUB_ISSUES_PATH_REPO = re.compile(
+    r"repos/([^/\s?#]+)/([^/\s?#]+)/issues/?$"
+)
 GITHUB_ISSUES_URL_REPO = re.compile(
     r"api\.github\.com/repos/([^/\s]+)/([^/\s]+)/issues"
 )
@@ -663,8 +671,33 @@ def is_write_request(args):
     return False
 
 
-def endpoint_tokens(args, pattern):
-    """Tokens naming an API endpoint, excluding payload values.
+def endpoint_path(token):
+    """The path component of an endpoint-shaped argument.
+
+    An endpoint is a URL, and a URL is not its path: `?query` and `#fragment`
+    are separate components that address the SAME resource. Comparing the raw
+    argument against a path pattern therefore recognised a URL SHAPE rather
+    than an endpoint, and `repos/o/r/issues?foo=1` — the identical request —
+    was classified as a non-creation and allowed (#2939).
+
+    Trailing whitespace is stripped for the same reason: `"repos/o/r/issues "`
+    survives shlex as one token and addresses the same endpoint, but defeats an
+    end-anchored comparison just as a query string does.
+
+    Args:
+        token: One argument, possibly a decorated endpoint.
+
+    Returns:
+        The token with any fragment, query, and surrounding whitespace removed.
+    """
+    # Fragment first: it is the LAST component of a URL, so `path?q#f` yields
+    # `path?q` here and `path` after the query split, while a malformed
+    # `path#a?b` still collapses to `path` rather than keeping `a?b`.
+    return token.split("#", 1)[0].split("?", 1)[0].strip()
+
+
+def endpoint_paths(args, pattern):
+    """Endpoint path components matching a pattern, excluding payload values.
 
     Scans every token rather than a filtered positional list, because a BOOLEAN
     flag has no value to skip and filtering swallowed the endpoint behind one:
@@ -672,21 +705,28 @@ def endpoint_tokens(args, pattern):
     behind `--silent`. Payload values are excluded the other way, so
     `-f path=repos/o/r/issues` is not mistaken for the address being posted to.
 
+    That payload exclusion is tested on the PATH, not the raw token, and the
+    order matters: a query string carries `=`, so testing the raw token skipped
+    `repos/o/r/issues?foo=1` before the pattern ever ran. Two independent
+    mechanisms — this filter and the pattern's end anchor — hid the same
+    creation, which is why fixing only the anchor would not have closed it.
+
     Args:
         args: A command's arguments.
-        pattern: The endpoint regex.
+        pattern: The endpoint regex, written against a path component.
 
     Returns:
-        Matching endpoint tokens.
+        The matching path components, decoration removed.
     """
     found = []
     for index, token in enumerate(args):
-        if "=" in token:
+        path = endpoint_path(token)
+        if "=" in path:
             continue
         if index > 0 and args[index - 1] in PAYLOAD_VALUE_FLAGS:
             continue
-        if pattern.search(token):
-            found.append(token)
+        if pattern.search(path):
+            found.append(path)
     return found
 
 
@@ -712,7 +752,7 @@ def creation_signature(name, args):
         if "api" in args:
             if GRAPHQL_CREATE.search(joined):
                 return "gh api graphql issue creation"
-            if endpoint_tokens(args, GITHUB_ISSUES_PATH) and is_write_request(args):
+            if endpoint_paths(args, GITHUB_ISSUES_PATH) and is_write_request(args):
                 return "gh api POST .../issues"
         return None
 
@@ -820,7 +860,7 @@ def target_repository(args):
     Read only from positions that actually reach the created item: a flag
     before the end-of-options marker, or the endpoint the write is posted to.
     A `-f repo=o/r` payload field is data being SENT, not the address being
-    posted to, and `endpoint_tokens` already excludes it.
+    posted to, and `endpoint_paths` already excludes it.
 
     Args:
         args: A creating command's arguments.
@@ -837,8 +877,8 @@ def target_repository(args):
             head, value = token.split("=", 1)
             if head in REPO_FLAGS:
                 return normalise_repo(value)
-    for token in endpoint_tokens(scoped, GITHUB_ISSUES_PATH):
-        match = GITHUB_ISSUES_PATH_REPO.search(token)
+    for path in endpoint_paths(scoped, GITHUB_ISSUES_PATH):
+        match = GITHUB_ISSUES_PATH_REPO.search(path)
         if match:
             return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
     for token in scoped:

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-direct-issue-create.sh

@@ -389,13 +389,21 @@ POST_PAYLOAD_FLAGS = {
 # read as an endpoint: it is data being sent, not the address being posted to.
 PAYLOAD_VALUE_FLAGS = {"-f", "-F", "--raw-field", "--field"}
 
-GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s]+/[^/\s]+/issues/?$")
+# Matched against a token's PATH COMPONENT, never the raw argument — see
+# `endpoint_path`. The `$` anchor is load-bearing and stays: without it
+# `repos/o/r/issues/123/comments` reads as a creation, which is a different
+# operation this guard must not refuse. The segment classes exclude `?` and
+# `#` so the anchor cannot be reached past a decoration even if some future
+# caller forgets to parse first.
+GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s?#]+/[^/\s?#]+/issues/?$")
 GITHUB_ISSUES_URL = re.compile(r"api\.github\.com/repos/[^/\s]+/[^/\s]+/issues")
 # The repository a creation is ADDRESSED at, which decides whose ready role
 # answers for it. `gh` accepts the flag before or after the subcommand and in
 # either spelling, and the REST paths carry the same pair positionally.
 REPO_FLAGS = {"--repo", "-R"}
-GITHUB_ISSUES_PATH_REPO = re.compile(r"repos/([^/\s]+)/([^/\s]+)/issues/?$")
+GITHUB_ISSUES_PATH_REPO = re.compile(
+    r"repos/([^/\s?#]+)/([^/\s?#]+)/issues/?$"
+)
 GITHUB_ISSUES_URL_REPO = re.compile(
     r"api\.github\.com/repos/([^/\s]+)/([^/\s]+)/issues"
 )
@@ -663,8 +671,33 @@ def is_write_request(args):
     return False
 
 
-def endpoint_tokens(args, pattern):
-    """Tokens naming an API endpoint, excluding payload values.
+def endpoint_path(token):
+    """The path component of an endpoint-shaped argument.
+
+    An endpoint is a URL, and a URL is not its path: `?query` and `#fragment`
+    are separate components that address the SAME resource. Comparing the raw
+    argument against a path pattern therefore recognised a URL SHAPE rather
+    than an endpoint, and `repos/o/r/issues?foo=1` — the identical request —
+    was classified as a non-creation and allowed (#2939).
+
+    Trailing whitespace is stripped for the same reason: `"repos/o/r/issues "`
+    survives shlex as one token and addresses the same endpoint, but defeats an
+    end-anchored comparison just as a query string does.
+
+    Args:
+        token: One argument, possibly a decorated endpoint.
+
+    Returns:
+        The token with any fragment, query, and surrounding whitespace removed.
+    """
+    # Fragment first: it is the LAST component of a URL, so `path?q#f` yields
+    # `path?q` here and `path` after the query split, while a malformed
+    # `path#a?b` still collapses to `path` rather than keeping `a?b`.
+    return token.split("#", 1)[0].split("?", 1)[0].strip()
+
+
+def endpoint_paths(args, pattern):
+    """Endpoint path components matching a pattern, excluding payload values.
 
     Scans every token rather than a filtered positional list, because a BOOLEAN
     flag has no value to skip and filtering swallowed the endpoint behind one:
@@ -672,21 +705,28 @@ def endpoint_tokens(args, pattern):
     behind `--silent`. Payload values are excluded the other way, so
     `-f path=repos/o/r/issues` is not mistaken for the address being posted to.
 
+    That payload exclusion is tested on the PATH, not the raw token, and the
+    order matters: a query string carries `=`, so testing the raw token skipped
+    `repos/o/r/issues?foo=1` before the pattern ever ran. Two independent
+    mechanisms — this filter and the pattern's end anchor — hid the same
+    creation, which is why fixing only the anchor would not have closed it.
+
     Args:
         args: A command's arguments.
-        pattern: The endpoint regex.
+        pattern: The endpoint regex, written against a path component.
 
     Returns:
-        Matching endpoint tokens.
+        The matching path components, decoration removed.
     """
     found = []
     for index, token in enumerate(args):
-        if "=" in token:
+        path = endpoint_path(token)
+        if "=" in path:
             continue
         if index > 0 and args[index - 1] in PAYLOAD_VALUE_FLAGS:
             continue
-        if pattern.search(token):
-            found.append(token)
+        if pattern.search(path):
+            found.append(path)
     return found
 
 
@@ -712,7 +752,7 @@ def creation_signature(name, args):
         if "api" in args:
             if GRAPHQL_CREATE.search(joined):
                 return "gh api graphql issue creation"
-            if endpoint_tokens(args, GITHUB_ISSUES_PATH) and is_write_request(args):
+            if endpoint_paths(args, GITHUB_ISSUES_PATH) and is_write_request(args):
                 return "gh api POST .../issues"
         return None
 
@@ -820,7 +860,7 @@ def target_repository(args):
     Read only from positions that actually reach the created item: a flag
     before the end-of-options marker, or the endpoint the write is posted to.
     A `-f repo=o/r` payload field is data being SENT, not the address being
-    posted to, and `endpoint_tokens` already excludes it.
+    posted to, and `endpoint_paths` already excludes it.
 
     Args:
         args: A creating command's arguments.
@@ -837,8 +877,8 @@ def target_repository(args):
             head, value = token.split("=", 1)
             if head in REPO_FLAGS:
                 return normalise_repo(value)
-    for token in endpoint_tokens(scoped, GITHUB_ISSUES_PATH):
-        match = GITHUB_ISSUES_PATH_REPO.search(token)
+    for path in endpoint_paths(scoped, GITHUB_ISSUES_PATH):
+        match = GITHUB_ISSUES_PATH_REPO.search(path)
         if match:
             return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
     for token in scoped:

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-direct-issue-create.sh

@@ -389,13 +389,21 @@ POST_PAYLOAD_FLAGS = {
 # read as an endpoint: it is data being sent, not the address being posted to.
 PAYLOAD_VALUE_FLAGS = {"-f", "-F", "--raw-field", "--field"}
 
-GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s]+/[^/\s]+/issues/?$")
+# Matched against a token's PATH COMPONENT, never the raw argument — see
+# `endpoint_path`. The `$` anchor is load-bearing and stays: without it
+# `repos/o/r/issues/123/comments` reads as a creation, which is a different
+# operation this guard must not refuse. The segment classes exclude `?` and
+# `#` so the anchor cannot be reached past a decoration even if some future
+# caller forgets to parse first.
+GITHUB_ISSUES_PATH = re.compile(r"repos/[^/\s?#]+/[^/\s?#]+/issues/?$")
 GITHUB_ISSUES_URL = re.compile(r"api\.github\.com/repos/[^/\s]+/[^/\s]+/issues")
 # The repository a creation is ADDRESSED at, which decides whose ready role
 # answers for it. `gh` accepts the flag before or after the subcommand and in
 # either spelling, and the REST paths carry the same pair positionally.
 REPO_FLAGS = {"--repo", "-R"}
-GITHUB_ISSUES_PATH_REPO = re.compile(r"repos/([^/\s]+)/([^/\s]+)/issues/?$")
+GITHUB_ISSUES_PATH_REPO = re.compile(
+    r"repos/([^/\s?#]+)/([^/\s?#]+)/issues/?$"
+)
 GITHUB_ISSUES_URL_REPO = re.compile(
     r"api\.github\.com/repos/([^/\s]+)/([^/\s]+)/issues"
 )
@@ -663,8 +671,33 @@ def is_write_request(args):
     return False
 
 
-def endpoint_tokens(args, pattern):
-    """Tokens naming an API endpoint, excluding payload values.
+def endpoint_path(token):
+    """The path component of an endpoint-shaped argument.
+
+    An endpoint is a URL, and a URL is not its path: `?query` and `#fragment`
+    are separate components that address the SAME resource. Comparing the raw
+    argument against a path pattern therefore recognised a URL SHAPE rather
+    than an endpoint, and `repos/o/r/issues?foo=1` — the identical request —
+    was classified as a non-creation and allowed (#2939).
+
+    Trailing whitespace is stripped for the same reason: `"repos/o/r/issues "`
+    survives shlex as one token and addresses the same endpoint, but defeats an
+    end-anchored comparison just as a query string does.
+
+    Args:
+        token: One argument, possibly a decorated endpoint.
+
+    Returns:
+        The token with any fragment, query, and surrounding whitespace removed.
+    """
+    # Fragment first: it is the LAST component of a URL, so `path?q#f` yields
+    # `path?q` here and `path` after the query split, while a malformed
+    # `path#a?b` still collapses to `path` rather than keeping `a?b`.
+    return token.split("#", 1)[0].split("?", 1)[0].strip()
+
+
+def endpoint_paths(args, pattern):
+    """Endpoint path components matching a pattern, excluding payload values.
 
     Scans every token rather than a filtered positional list, because a BOOLEAN
     flag has no value to skip and filtering swallowed the endpoint behind one:
@@ -672,21 +705,28 @@ def endpoint_tokens(args, pattern):
     behind `--silent`. Payload values are excluded the other way, so
     `-f path=repos/o/r/issues` is not mistaken for the address being posted to.
 
+    That payload exclusion is tested on the PATH, not the raw token, and the
+    order matters: a query string carries `=`, so testing the raw token skipped
+    `repos/o/r/issues?foo=1` before the pattern ever ran. Two independent
+    mechanisms — this filter and the pattern's end anchor — hid the same
+    creation, which is why fixing only the anchor would not have closed it.
+
     Args:
         args: A command's arguments.
-        pattern: The endpoint regex.
+        pattern: The endpoint regex, written against a path component.
 
     Returns:
-        Matching endpoint tokens.
+        The matching path components, decoration removed.
     """
     found = []
     for index, token in enumerate(args):
-        if "=" in token:
+        path = endpoint_path(token)
+        if "=" in path:
             continue
         if index > 0 and args[index - 1] in PAYLOAD_VALUE_FLAGS:
             continue
-        if pattern.search(token):
-            found.append(token)
+        if pattern.search(path):
+            found.append(path)
     return found
 
 
@@ -712,7 +752,7 @@ def creation_signature(name, args):
         if "api" in args:
             if GRAPHQL_CREATE.search(joined):
                 return "gh api graphql issue creation"
-            if endpoint_tokens(args, GITHUB_ISSUES_PATH) and is_write_request(args):
+            if endpoint_paths(args, GITHUB_ISSUES_PATH) and is_write_request(args):
                 return "gh api POST .../issues"
         return None
 
@@ -820,7 +860,7 @@ def target_repository(args):
     Read only from positions that actually reach the created item: a flag
     before the end-of-options marker, or the endpoint the write is posted to.
     A `-f repo=o/r` payload field is data being SENT, not the address being
-    posted to, and `endpoint_tokens` already excludes it.
+    posted to, and `endpoint_paths` already excludes it.
 
     Args:
         args: A creating command's arguments.
@@ -837,8 +877,8 @@ def target_repository(args):
             head, value = token.split("=", 1)
             if head in REPO_FLAGS:
                 return normalise_repo(value)
-    for token in endpoint_tokens(scoped, GITHUB_ISSUES_PATH):
-        match = GITHUB_ISSUES_PATH_REPO.search(token)
+    for path in endpoint_paths(scoped, GITHUB_ISSUES_PATH):
+        match = GITHUB_ISSUES_PATH_REPO.search(path)
         if match:
             return normalise_repo("%s/%s" % (match.group(1), match.group(2)))
     for token in scoped: