@codyswann/lisa 4.41.1 → 4.42.1

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -8,8 +8,8 @@
 #
 # Every PreToolUse guard — block-no-verify, parity-safety-net,
 # block-shell-json-parsing, block-instruction-file-edits,
-# block-direct-issue-create, block-blind-automerge — is declared in the
-# Lisa plugin. A cloud session
+# block-direct-issue-create, block-blind-automerge, worktree-binding-guard —
+# is declared in the Lisa plugin. A cloud session
 # installs plugins at session start from the marketplace the repository
 # declares, and when that does not happen the container runs with
 # `installed_plugins.json` empty and no enforcement whatsoever.
@@ -316,7 +316,7 @@ plugin_tree_used=0
 
 for guard in block-no-verify parity-safety-net block-shell-json-parsing \
   block-instruction-file-edits block-direct-issue-create \
-  block-managed-file-edits block-blind-automerge; do
+  block-managed-file-edits block-blind-automerge worktree-binding-guard; do
   if [ -f "$host_tree/$guard.sh" ]; then
     guard_names+=("$guard")
     guard_scripts+=("$host_tree/$guard.sh")

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.mjs

@@ -0,0 +1,327 @@
+#!/usr/bin/env node
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/**
+ * Reconcile the worktree a session was TOLD it is in against the one it is
+ * ACTUALLY operating in, and refuse to act while the two disagree.
+ *
+ * WHAT WENT WRONG. `EnterWorktree` reported "the session is now working in the
+ * worktree" for a tree that Bash never moved to and that Edit then refused by
+ * name (CodySwannGT/lisa#3864). Three subsystems, three answers, and the one
+ * that answered affirmatively was the wrong one. A refusal teaches you
+ * something; a success message that is not true is a confirmation — it removes
+ * the reason to check and sends the agent forward confidently in the wrong
+ * place. Acting on that confirmation, one session ran an install that landed in
+ * a different agent's active worktree. The next such command is a `git commit`
+ * or a file write, and that tree held eighteen modified tracked files.
+ *
+ * The displacement is also mutual: whoever calls `EnterWorktree` last wins for
+ * every session whose own binding never took, so each agent repairing itself
+ * displaces the others. That is why "just re-enter your worktree" is not a
+ * remedy — it is the mechanism.
+ *
+ * WHAT THIS FIXES AND WHAT IT CANNOT. Lisa does not own `EnterWorktree`, so it
+ * cannot make that call itself return failure. What it can do is make the
+ * false confirmation cost nothing: the FIRST action taken on the strength of it
+ * is refused, and the refusal names the worktree the session is really bound
+ * to. The gap is stated rather than hidden — the acceptance criterion asking
+ * `EnterWorktree` to fail is met one tool call later, by the guard, not by the
+ * tool.
+ *
+ * WHY BLOCKING AND NOT A WARNING. The failure mode is that nothing feels wrong.
+ * There is no symptom to notice, so an advisory line scrolls past exactly when
+ * it matters. A refusal is the only form of this check the agent cannot read
+ * past.
+ *
+ * WHY AN EXPLICIT ACKNOWLEDGEMENT AND NOT "BLOCK ONCE". A guard that blocks the
+ * first attempt and lets the retry through is defeated by a blind retry, which
+ * is the single most likely next action. So the block stands until the session
+ * states, in the acknowledgement, the absolute path it now intends to work in.
+ * A path that does not match what the session is actually in is refused too —
+ * that is the rejection control, and it is what stops a stale acknowledgement
+ * copied from another agent's transcript from silently rebinding this one.
+ *
+ * FAILING OPEN, LOUDLY. Anything this cannot determine — no session id, no
+ * cwd, not a git repository, an unreadable state file — exits 0 with a line on
+ * stderr. A guard that cannot read its input cannot tell a displacement from a
+ * directory listing, and one that wedges every tool call is switched off within
+ * the hour. Silence is the only outcome that is never acceptable.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+
+/** Tools whose effect on the wrong worktree is not undoable by re-reading. */
+const GUARDED_TOOLS = new Set(["Bash", "Write", "Edit", "MultiEdit"]);
+
+/**
+ * The literal an agent echoes to rebind this session deliberately.
+ *
+ * A shell line rather than a flag on this script, because the only surface the
+ * agent has for saying so is a Bash command, and it must be one this guard sees
+ * on its own PreToolUse pass — which is exactly where a command string arrives.
+ */
+const ACCEPT_PREFIX = "lisa-worktree-binding: accept";
+
+/**
+ * Resolve a path the way git reports one.
+ *
+ * `git rev-parse --show-toplevel` answers with symlinks resolved, and on macOS
+ * every temporary directory is a symlink — `/var/…` is `/private/var/…`. A
+ * comparison between git's answer and a path handed in by a tool would then
+ * differ by that prefix alone and read as a displacement, which is a false
+ * accusation in exactly the state the guard is supposed to be trusted in. A
+ * path that does not exist yet cannot be resolved and is returned as given.
+ * @param value - Absolute path to normalize
+ * @returns The path with symlinks resolved where possible
+ */
+function realpath(value) {
+  try {
+    return realpathSync(value);
+  } catch {
+    return value;
+  }
+}
+
+function say(message) {
+  process.stderr.write(`worktree-binding-guard: ${message}\n`);
+}
+
+/** Run git, returning trimmed stdout, or null when it exits non-zero. */
+function git(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/** The worktree root containing `cwd`, or null when `cwd` is not in a repo. */
+function worktreeRoot(cwd) {
+  const top = git(["rev-parse", "--show-toplevel"], cwd);
+  return top ? resolve(top) : null;
+}
+
+/**
+ * The MAIN checkout's root, which is where `.claude/worktrees/` lives.
+ *
+ * `--git-common-dir` is shared by every linked worktree, so its parent is the
+ * main checkout no matter which worktree asks.
+ */
+function mainCheckout(cwd) {
+  const common = git(
+    ["rev-parse", "--path-format=absolute", "--git-common-dir"],
+    cwd
+  );
+  return common ? dirname(resolve(common)) : null;
+}
+
+function stateFile(sessionId) {
+  const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
+  return join(home, "worktree-binding", `${sessionId}.json`);
+}
+
+function readState(sessionId) {
+  try {
+    return JSON.parse(readFileSync(stateFile(sessionId), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeState(sessionId, state) {
+  const file = stateFile(sessionId);
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+    return true;
+  } catch (error) {
+    say(`could not record the binding (${error.message}); NOT enforcing`);
+    return false;
+  }
+}
+
+/**
+ * The worktree `EnterWorktree` claims the session moved to.
+ *
+ * `path` is given verbatim; `name` resolves under the main checkout's
+ * `.claude/worktrees/`, which is where the tool creates one. A call carrying
+ * neither is a generated name this guard cannot predict, so it returns null and
+ * the claim is simply not recorded — an unrecorded claim degrades to the plain
+ * displacement check rather than to a false accusation.
+ */
+function claimedRoot(toolInput, cwd) {
+  const path = toolInput?.path;
+  if (typeof path === "string" && path.trim()) {
+    return realpath(resolve(isAbsolute(path) ? path : join(cwd, path)));
+  }
+  const name = toolInput?.name;
+  if (typeof name === "string" && name.trim()) {
+    const main = mainCheckout(cwd);
+    return main
+      ? realpath(join(main, ".claude", "worktrees", name.trim()))
+      : null;
+  }
+  return null;
+}
+
+/**
+ * Record what `EnterWorktree` just claimed, for the next tool call to check.
+ *
+ * Returns nothing on purpose. This runs on PostToolUse, where the tool has
+ * already happened and there is no call left to refuse, so every path through
+ * it is an allow — and a function whose only answer is "allow" should not be
+ * spelled as one that computes an exit code.
+ */
+function recordClaim(payload, observed) {
+  const claimed = claimedRoot(payload.tool_input, payload.cwd);
+  if (!claimed || claimed === observed) return;
+  const previous = readState(payload.session_id);
+  writeState(payload.session_id, {
+    boundRoot: previous?.boundRoot ?? observed,
+    claimedRoot: claimed,
+    updatedAt: new Date().toISOString(),
+  });
+}
+
+function refuse(lines) {
+  process.stderr.write(`${lines.join("\n")}\n`);
+  return 2;
+}
+
+function acceptanceLine(observed) {
+  return `  echo '${ACCEPT_PREFIX} ${observed}'`;
+}
+
+/**
+ * Handle an acknowledgement line, or return null when the command is not one.
+ *
+ * The path is compared against what the session is measurably in, not against
+ * what it says it wants. An acknowledgement naming somewhere else is the case
+ * this is for: it means the operator is reasoning about a tree they are not in.
+ */
+function handleAcceptance(payload, observed) {
+  const command = payload.tool_input?.command;
+  if (typeof command !== "string" || !command.includes(ACCEPT_PREFIX))
+    return null;
+  const stated = command.slice(
+    command.indexOf(ACCEPT_PREFIX) + ACCEPT_PREFIX.length
+  );
+  const match = /([^\s'"]+)/.exec(stated);
+  const path = match ? realpath(resolve(match[1])) : null;
+  if (path !== observed) {
+    return refuse([
+      `worktree-binding-guard: this acknowledgement names ${path ?? "no path"},`,
+      `but this session is operating in ${observed}. Not rebinding.`,
+      `If ${observed} is where you mean to work, acknowledge that path:`,
+      acceptanceLine(observed),
+    ]);
+  }
+  writeState(payload.session_id, {
+    boundRoot: observed,
+    claimedRoot: null,
+    updatedAt: new Date().toISOString(),
+  });
+  say(`bound to ${observed}`);
+  return 0;
+}
+
+/** Refusal text for a switch that reported success without taking effect. */
+function unconfirmedSwitch(claimed, observed) {
+  return refuse([
+    `worktree-binding-guard: EnterWorktree reported success for`,
+    `  ${claimed}`,
+    `but this session is still operating in`,
+    `  ${observed}`,
+    "The switch did not take effect. Anything run now lands in the second",
+    "path, not the first — including installs, commits, and file writes, and",
+    "that tree may hold another agent's uncommitted work.",
+    "",
+    "Use absolute paths under the tree you actually want, or acknowledge that",
+    "you intend to keep working where you are:",
+    acceptanceLine(observed),
+  ]);
+}
+
+/** Refusal text for a binding that moved without this session asking. */
+function displaced(bound, observed) {
+  return refuse([
+    "worktree-binding-guard: this session's worktree changed underneath it.",
+    `  bound to:  ${bound}`,
+    `  now in:    ${observed}`,
+    "Concurrent sessions share one worktree binding, so another agent's",
+    "EnterWorktree can move this one. Commands run now land in the second",
+    "path. If you moved deliberately, say so:",
+    acceptanceLine(observed),
+  ]);
+}
+
+function evaluate(payload) {
+  const sessionId = payload.session_id;
+  const cwd = payload.cwd;
+  if (typeof sessionId !== "string" || !sessionId || typeof cwd !== "string") {
+    say("payload carries no session id or cwd; binding is NOT enforced");
+    return 0;
+  }
+  const observed = worktreeRoot(cwd);
+  if (!observed) return 0;
+
+  if (payload.tool_name === "EnterWorktree") {
+    recordClaim(payload, observed);
+    return 0;
+  }
+  if (!GUARDED_TOOLS.has(payload.tool_name)) return 0;
+
+  const accepted = handleAcceptance(payload, observed);
+  if (accepted !== null) return accepted;
+
+  const state = readState(sessionId);
+  if (!state?.boundRoot) {
+    writeState(sessionId, {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    });
+    return 0;
+  }
+  if (state.claimedRoot && state.claimedRoot !== observed) {
+    return unconfirmedSwitch(state.claimedRoot, observed);
+  }
+  if (state.claimedRoot === observed) {
+    writeState(sessionId, {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    });
+    return 0;
+  }
+  if (state.boundRoot !== observed) return displaced(state.boundRoot, observed);
+  return 0;
+}
+
+function main() {
+  let raw = "";
+  try {
+    raw = readFileSync(0, "utf8");
+  } catch {
+    say("could not read the hook payload; binding is NOT enforced");
+    return 0;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    say("hook payload was not JSON; binding is NOT enforced");
+    return 0;
+  }
+  return evaluate(payload);
+}
+
+process.exit(main());

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
+# PreToolUse guard for Bash/Write/Edit/MultiEdit, and PostToolUse recorder for
+# EnterWorktree: refuse to act while the worktree the session was told it is in
+# disagrees with the one it is measurably in (CodySwannGT/lisa#3864).
+#
+# The reconciliation lives in worktree-binding-guard.mjs beside this file. It
+# needs per-session state, path resolution and git plumbing, and a bash
+# reimplementation of any of that would be a second copy of the thing the guard
+# exists to keep honest.
+#
+# This wrapper does three things and nothing else: probe its interpreter, pass
+# the hook envelope through untouched, and return the classifier's exit code so
+# a refusal is a refusal.
+#
+# FAILING OPEN, LOUDLY
+#
+# Claude Code treats exit 2 as a refusal and every OTHER non-zero exit as a
+# non-blocking hook error, so a missing interpreter under `set -e` would exit
+# 127 and permit exactly what this exists to stop. Degrading to "allow" is
+# correct — a hook that cannot read its input cannot tell a displacement from a
+# directory listing — but it must SAY so, because a guard that is silently
+# absent reads exactly like a guard that is passing. Same reasoning as
+# block-host-name-leak.sh.
+#
+# AGENT PARITY, AND WHY IT STOPS WHERE IT DOES
+#
+# `EnterWorktree` is a Claude Code tool, and the process-global session binding
+# it rewrites is a Claude Code structure. Codex, Antigravity and OpenCode manage
+# their own worktrees and have neither, so there is nothing on those harnesses
+# for the reconciler to reconcile — no `.agy.sh` adapter is shipped for this
+# guard, and its absence is a statement rather than an omission. The Codex
+# variant carries the PreToolUse half because the displacement check is
+# harness-agnostic: it only asks whether the directory a session is measurably
+# in has changed since it last acted.
+set -uo pipefail
+
+input="$(cat)"
+
+if ! command -v node >/dev/null 2>&1; then
+  printf 'worktree-binding-guard: node not found; worktree-binding enforcement is NOT active\n' >&2
+  exit 0
+fi
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+classifier="$hook_dir/worktree-binding-guard.mjs"
+if [ ! -r "$classifier" ]; then
+  printf 'worktree-binding-guard: classifier missing at %s; worktree-binding enforcement is NOT active\n' \
+    "$classifier" >&2
+  exit 0
+fi
+
+status=0
+printf '%s' "$input" | node "$classifier" || status=$?
+exit "$status"

package/all/copy-overwrite/scripts/lisa-work-item.mjs

@@ -2207,11 +2207,10 @@ function assertStateAmong(refs, contract) {
  *   branch encodes none.
  */
 function branchWorkItem(contract) {
-  // A GitHub reference is `owner/repo#123`; no branch-naming convention
-  // encodes one, so there is nothing here to read.
-  if (contract.provider === "github") return undefined;
   const branch = activeBranch();
   if (!branch) return undefined;
+  if (contract.provider === "github")
+    return githubBranchIssue(branch, contract);
   const key =
     contract.provider === "jira" ? contract.project : contract.teamKey;
   if (!key) return undefined;
@@ -2225,6 +2224,53 @@ function branchWorkItem(contract) {
   return match ? `${key}-${match[1]}` : undefined;
 }
 
+/**
+ * The GitHub issue a branch name encodes, canonicalized, or undefined.
+ *
+ * This used to be `branchWorkItem`'s first statement, returning `undefined`
+ * unconditionally on the premise that "a GitHub reference is `owner/repo#123`;
+ * no branch-naming convention encodes one". True of the canonical SPELLING and
+ * false of the convention in use — `fix/3537-…`, `stack/3463`, `qd/3554-…`.
+ * The number is right there; it simply is not written as a full reference. So
+ * the fallback built to close the unbound-worktree gap never applied to the
+ * provider this repository configures, and the trailer went on being compared
+ * against nothing, while the hook printed `WORK_ITEM_TRACKING_OK` either way
+ * (CodySwannGT/lisa#3861).
+ *
+ * WHY THE WHOLE FIRST SEGMENT AFTER THE FIRST SLASH, and nothing looser. A
+ * bare number is ambiguous in a way a `KEY-123` shape is not, so position has
+ * to carry the meaning the key would otherwise carry. Measured against the 246
+ * branches this repository has: the rule reads 149 of them, and every one of
+ * the 97 it declines genuinely encodes no issue number. A "first number
+ * anywhere" rule would instead read `chore/upgrade-lisa-4.33.1` as issue 4,
+ * `stack/queue-drain-20260903` as issue 20260903, and
+ * `fix/se-7728-e2e-coverage-wildcard` as issue 7728 — a version, a date and
+ * another tracker's key, each refusing a commit that is perfectly correct.
+ *
+ * `issue-<n>` shapes (`codex/issue-1264`) are knowingly NOT read. They are
+ * unambiguous but rare here, and every additional pattern is another place to
+ * be wrong; declining them fails open, which is the safe direction.
+ *
+ * EXPORTED SO IT CAN BE TESTED IN PROCESS, and that is not a formality. The
+ * CLI-level cases around this reach it only by SPAWNING the script, and a
+ * subprocess loads the file from disk rather than the instrumented module, so
+ * the mutation gate cannot see through it: measured, 12 of 12 mutants in this
+ * function survived every CLI case while an untouched range of the same file
+ * scored 85.71% off the in-process importers. Taking `branch` as an argument
+ * rather than calling `activeBranch()` is what makes that possible — the
+ * function is pure, so a table of names can pin each boundary directly. Several
+ * neighbours here are exported for the same reason.
+ * @param {string} branch Active branch name.
+ * @param {object} contract Resolved tracker contract.
+ * @returns {string|undefined} Canonical `owner/repo#123`, or undefined.
+ */
+export function githubBranchIssue(branch, contract) {
+  // Bounded on both sides: the number must fill the segment, so `4.33.1` and
+  // `se-7728` do not match, and `3463` is not read out of `34631`.
+  const match = /^[^/]+\/([1-9]\d*)(?:-|$)/.exec(branch);
+  return match ? `${contract.repository}#${match[1]}` : undefined;
+}
+
 /**
  * Refuse a trailer that names a different work item than the branch is for.
  *

package/all/merge/.claude/settings.json

@@ -37,6 +37,17 @@
   },
   "plansDirectory": "./plans",
   "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "EnterWorktree",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$CLAUDE_PROJECT_DIR\"/scripts/lisa-hooks/worktree-binding-guard.sh"
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
       {
         "matcher": "Bash",

package/dist/core/lisa-owned-hash-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAghCjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAm7BjC,CAAC"}
+{"version":3,"file":"lisa-owned-hash-ledger.d.ts","sourceRoot":"","sources":["../../src/core/lisa-owned-hash-ledger.ts"],"names":[],"mappings":"AACA,6EAA6E;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAC3C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA2hCjC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CACpD,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA87BjC,CAAC"}

package/dist/core/lisa-owned-hash-ledger.js

@@ -434,6 +434,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "b456ad79aae18ea3af4ae462327653a88ab865ec31c84aa233c3ded512acff32",
         "b4cc14d5dc02c790ea3e51b0134b9c3d5e4a0e8ef08a652817f7485a0badde17",
         "c64765cb502797daa163dbb6cad723b633a7c527dffeb6bd99cca4989a63fcf4",
+        "c9604929b1f5d3fee39ef7c3619f89002accf27712dbd38f25b6a7a0ceb0025a",
         "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
@@ -759,6 +760,13 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "e0b0073fe44f6e78b74f05cb232d30a3121acc3600bdbd5bc4299c1c710d56a2",
         "f21cdcb54b353714a92c2d1e25fd6b76318e8e8d7cb90cdb016f174923c532ef",
     ]),
+    "scripts/lisa-hooks/worktree-binding-guard.mjs": Object.freeze([
+        "822e4f9d2c3ad8fb184ff7fc880f6811004852fb731c7878b5a8a1a9532bceb8",
+        "bc1118b05eaea3fc7b3409c96979d64e3dee0907118f3e84d735163f473f632a",
+    ]),
+    "scripts/lisa-hooks/worktree-binding-guard.sh": Object.freeze([
+        "662652c09e5eb70f14db61136ea1206e9b337fce49dcabc774a45a07a0fd718f",
+    ]),
     "scripts/lisa-lint-staged-preflight.mjs": Object.freeze([
         "ce4bc224a102e3ac2bc29d8f2038eefd619129d4639c25954c93f05011f7f977",
     ]),
@@ -892,6 +900,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "04f78df45465d01601c8b5711b74749b2a2c2b70b9c916d6790bd69e1c11865d",
         "08ec9a37d66fb35443a5aac72e09d7ab5478cbd516f72e248d01b3befabddfe5",
         "0b6eff0a306ccd8396d6e3d71ac9c54d3a1c8c29449a9146e0c2e5726b74feb9",
+        "1365fd1272eac2d046bbc54d50b0ebdce5b1d9863c832d93c9d4671c3fa13e3c",
         "14bc7270452a95321e6bbe4a81afcd86fabc7b7cd595b2c59b1a467d0d58b262",
         "1d206070e5a0230aac5598ed320ab26ef9eb6db18afbd860a69bf483a303dd5f",
         "1fd9e91eeb37007e4ae273c4af2a34d7b4d9a143eb5edfb19f733bd6215b4a95",
@@ -900,6 +909,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "2b7e81f0e23628da9c3a124f3d5b0593e3a8c564cd595329b9f37510540a5581",
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
+        "38489b50b0305256ef29037551bf12781b7caebf72c5609667c9c4e2d621f0ff",
         "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
         "3f8c59e0f4ad43211f6964b4889f3fc673bee0496ec3613bdbdc4544424340f6",
         "41b967f736d7fcf9d8928ad7c8cc767c5beb9544e2fbfa3317c65734aa02fcfd",
@@ -912,6 +922,7 @@ export const LISA_OWNED_HASH_LEDGER = Object.freeze({
         "5bc1466a79c18e565e62305d4adeca0c7de94a1e5a22b2c2a75c84f634fcec86",
         "5e937e22bac62f66e91b288e9076e717147e4b382a431cdc8bbfc56681ebde8e",
         "5eb31c284e820a51312d4484f0669128007326af55ee515923fec33700d003a1",
+        "60bc3a715e02b5bf57f324f78e6da46dbb6dbb7769177c42139f7b7a2806eea6",
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "637741a9e5d2904aed24d48efd6bec1326c5573f718a13152807aa0e4b42f0a1",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
@@ -1467,6 +1478,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "b456ad79aae18ea3af4ae462327653a88ab865ec31c84aa233c3ded512acff32",
         "b4cc14d5dc02c790ea3e51b0134b9c3d5e4a0e8ef08a652817f7485a0badde17",
         "c64765cb502797daa163dbb6cad723b633a7c527dffeb6bd99cca4989a63fcf4",
+        "c9604929b1f5d3fee39ef7c3619f89002accf27712dbd38f25b6a7a0ceb0025a",
         "d7d88e44763694bed5eae998cd3663922c957e49f9f9621d9201f0417a4128ad",
         "d922508529c0ffd6b8411d7fc618b3d14ceb70901746adfbcf49e46eb685d6b9",
         "e0f4f2b11bea5497af12bae0d52902eb3d02b4ec3a7ae8e07236fb09b59cf560",
@@ -1746,6 +1758,13 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "e0b0073fe44f6e78b74f05cb232d30a3121acc3600bdbd5bc4299c1c710d56a2",
         "f21cdcb54b353714a92c2d1e25fd6b76318e8e8d7cb90cdb016f174923c532ef",
     ]),
+    "scripts/lisa-hooks/worktree-binding-guard.mjs": Object.freeze([
+        "822e4f9d2c3ad8fb184ff7fc880f6811004852fb731c7878b5a8a1a9532bceb8",
+        "bc1118b05eaea3fc7b3409c96979d64e3dee0907118f3e84d735163f473f632a",
+    ]),
+    "scripts/lisa-hooks/worktree-binding-guard.sh": Object.freeze([
+        "662652c09e5eb70f14db61136ea1206e9b337fce49dcabc774a45a07a0fd718f",
+    ]),
     "scripts/lisa-lint-staged-preflight.mjs": Object.freeze([
         "ce4bc224a102e3ac2bc29d8f2038eefd619129d4639c25954c93f05011f7f977",
     ]),
@@ -1858,6 +1877,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "04401ae05bf9464e6929180ffdfff80afc528a1df20733b032a0342252ca1d4a",
         "08ec9a37d66fb35443a5aac72e09d7ab5478cbd516f72e248d01b3befabddfe5",
         "0b6eff0a306ccd8396d6e3d71ac9c54d3a1c8c29449a9146e0c2e5726b74feb9",
+        "1365fd1272eac2d046bbc54d50b0ebdce5b1d9863c832d93c9d4671c3fa13e3c",
         "14bc7270452a95321e6bbe4a81afcd86fabc7b7cd595b2c59b1a467d0d58b262",
         "1d206070e5a0230aac5598ed320ab26ef9eb6db18afbd860a69bf483a303dd5f",
         "1fd9e91eeb37007e4ae273c4af2a34d7b4d9a143eb5edfb19f733bd6215b4a95",
@@ -1866,6 +1886,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "2b7e81f0e23628da9c3a124f3d5b0593e3a8c564cd595329b9f37510540a5581",
         "2c678c75d6de9b029f27fa6eec45b8421217a4fb5ef3412ad39883e10b213987",
         "2d9ca0841db9e75ddfd95e3a4d485fd01aa639a512ef648996f565b7991d8e2b",
+        "38489b50b0305256ef29037551bf12781b7caebf72c5609667c9c4e2d621f0ff",
         "3a9ec1ff863693a0fa0fef0ade6fa5534485d0249fb78302d37cdac3781348f1",
         "3f8c59e0f4ad43211f6964b4889f3fc673bee0496ec3613bdbdc4544424340f6",
         "41b967f736d7fcf9d8928ad7c8cc767c5beb9544e2fbfa3317c65734aa02fcfd",
@@ -1878,6 +1899,7 @@ export const LISA_OWNED_HASH_HISTORY_DERIVED = Object.freeze({
         "5bc1466a79c18e565e62305d4adeca0c7de94a1e5a22b2c2a75c84f634fcec86",
         "5e937e22bac62f66e91b288e9076e717147e4b382a431cdc8bbfc56681ebde8e",
         "5eb31c284e820a51312d4484f0669128007326af55ee515923fec33700d003a1",
+        "60bc3a715e02b5bf57f324f78e6da46dbb6dbb7769177c42139f7b7a2806eea6",
         "62f53156d425198609564e996f3844f52ab110e63f99f22e8338fcf7a83f316d",
         "653252b0bbfd19bdffa046a2173c053e566ac6bf605c8d9060f9cf71ad7386de",
         "6a8be8577242588f14ab52b25b2a22b6def53aefa9513b4d3d7c49f4d8027079",