@codyswann/lisa 4.41.1 → 4.42.1

package/package.json

@@ -171,7 +171,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -319,7 +319,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "f53413636a353ff14e517508836882aa5f36429a",
-  "gitHead": "f53413636a353ff14e517508836882aa5f36429a",
-  "lisaReleaseTag": "v4.41.1"
+  "lisaReleaseCommit": "76a0d0db994047aee8067e20e77620f84fc6faba",
+  "gitHead": "76a0d0db994047aee8067e20e77620f84fc6faba",
+  "lisaReleaseTag": "v4.42.1"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"
@@ -107,6 +107,15 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/withdrawn-rulings.sh --hook"
           }
         ]
+      },
+      {
+        "matcher": "EnterWorktree",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
+          }
+        ]
       }
     ],
     "PreToolUse": [
@@ -149,6 +158,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },
@@ -162,6 +175,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },

package/plugins/lisa/.codex-plugin/hooks.json

@@ -56,6 +56,15 @@
             "command": "${PLUGIN_ROOT}/hooks/withdrawn-rulings.sh --hook"
           }
         ]
+      },
+      {
+        "matcher": "EnterWorktree",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
+          }
+        ]
       }
     ],
     "PreToolUse": [
@@ -89,6 +98,10 @@
           {
             "type": "command",
             "command": "${PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },
@@ -102,6 +115,10 @@
           {
             "type": "command",
             "command": "${PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/worktree-binding-guard.mjs

@@ -0,0 +1,324 @@
+#!/usr/bin/env node
+/**
+ * Reconcile the worktree a session was TOLD it is in against the one it is
+ * ACTUALLY operating in, and refuse to act while the two disagree.
+ *
+ * WHAT WENT WRONG. `EnterWorktree` reported "the session is now working in the
+ * worktree" for a tree that Bash never moved to and that Edit then refused by
+ * name (CodySwannGT/lisa#3864). Three subsystems, three answers, and the one
+ * that answered affirmatively was the wrong one. A refusal teaches you
+ * something; a success message that is not true is a confirmation — it removes
+ * the reason to check and sends the agent forward confidently in the wrong
+ * place. Acting on that confirmation, one session ran an install that landed in
+ * a different agent's active worktree. The next such command is a `git commit`
+ * or a file write, and that tree held eighteen modified tracked files.
+ *
+ * The displacement is also mutual: whoever calls `EnterWorktree` last wins for
+ * every session whose own binding never took, so each agent repairing itself
+ * displaces the others. That is why "just re-enter your worktree" is not a
+ * remedy — it is the mechanism.
+ *
+ * WHAT THIS FIXES AND WHAT IT CANNOT. Lisa does not own `EnterWorktree`, so it
+ * cannot make that call itself return failure. What it can do is make the
+ * false confirmation cost nothing: the FIRST action taken on the strength of it
+ * is refused, and the refusal names the worktree the session is really bound
+ * to. The gap is stated rather than hidden — the acceptance criterion asking
+ * `EnterWorktree` to fail is met one tool call later, by the guard, not by the
+ * tool.
+ *
+ * WHY BLOCKING AND NOT A WARNING. The failure mode is that nothing feels wrong.
+ * There is no symptom to notice, so an advisory line scrolls past exactly when
+ * it matters. A refusal is the only form of this check the agent cannot read
+ * past.
+ *
+ * WHY AN EXPLICIT ACKNOWLEDGEMENT AND NOT "BLOCK ONCE". A guard that blocks the
+ * first attempt and lets the retry through is defeated by a blind retry, which
+ * is the single most likely next action. So the block stands until the session
+ * states, in the acknowledgement, the absolute path it now intends to work in.
+ * A path that does not match what the session is actually in is refused too —
+ * that is the rejection control, and it is what stops a stale acknowledgement
+ * copied from another agent's transcript from silently rebinding this one.
+ *
+ * FAILING OPEN, LOUDLY. Anything this cannot determine — no session id, no
+ * cwd, not a git repository, an unreadable state file — exits 0 with a line on
+ * stderr. A guard that cannot read its input cannot tell a displacement from a
+ * directory listing, and one that wedges every tool call is switched off within
+ * the hour. Silence is the only outcome that is never acceptable.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+
+/** Tools whose effect on the wrong worktree is not undoable by re-reading. */
+const GUARDED_TOOLS = new Set(["Bash", "Write", "Edit", "MultiEdit"]);
+
+/**
+ * The literal an agent echoes to rebind this session deliberately.
+ *
+ * A shell line rather than a flag on this script, because the only surface the
+ * agent has for saying so is a Bash command, and it must be one this guard sees
+ * on its own PreToolUse pass — which is exactly where a command string arrives.
+ */
+const ACCEPT_PREFIX = "lisa-worktree-binding: accept";
+
+/**
+ * Resolve a path the way git reports one.
+ *
+ * `git rev-parse --show-toplevel` answers with symlinks resolved, and on macOS
+ * every temporary directory is a symlink — `/var/…` is `/private/var/…`. A
+ * comparison between git's answer and a path handed in by a tool would then
+ * differ by that prefix alone and read as a displacement, which is a false
+ * accusation in exactly the state the guard is supposed to be trusted in. A
+ * path that does not exist yet cannot be resolved and is returned as given.
+ * @param value - Absolute path to normalize
+ * @returns The path with symlinks resolved where possible
+ */
+function realpath(value) {
+  try {
+    return realpathSync(value);
+  } catch {
+    return value;
+  }
+}
+
+function say(message) {
+  process.stderr.write(`worktree-binding-guard: ${message}\n`);
+}
+
+/** Run git, returning trimmed stdout, or null when it exits non-zero. */
+function git(args, cwd) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/** The worktree root containing `cwd`, or null when `cwd` is not in a repo. */
+function worktreeRoot(cwd) {
+  const top = git(["rev-parse", "--show-toplevel"], cwd);
+  return top ? resolve(top) : null;
+}
+
+/**
+ * The MAIN checkout's root, which is where `.claude/worktrees/` lives.
+ *
+ * `--git-common-dir` is shared by every linked worktree, so its parent is the
+ * main checkout no matter which worktree asks.
+ */
+function mainCheckout(cwd) {
+  const common = git(
+    ["rev-parse", "--path-format=absolute", "--git-common-dir"],
+    cwd
+  );
+  return common ? dirname(resolve(common)) : null;
+}
+
+function stateFile(sessionId) {
+  const home = process.env.LISA_STATE_HOME || join(homedir(), ".lisa");
+  return join(home, "worktree-binding", `${sessionId}.json`);
+}
+
+function readState(sessionId) {
+  try {
+    return JSON.parse(readFileSync(stateFile(sessionId), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeState(sessionId, state) {
+  const file = stateFile(sessionId);
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+    return true;
+  } catch (error) {
+    say(`could not record the binding (${error.message}); NOT enforcing`);
+    return false;
+  }
+}
+
+/**
+ * The worktree `EnterWorktree` claims the session moved to.
+ *
+ * `path` is given verbatim; `name` resolves under the main checkout's
+ * `.claude/worktrees/`, which is where the tool creates one. A call carrying
+ * neither is a generated name this guard cannot predict, so it returns null and
+ * the claim is simply not recorded — an unrecorded claim degrades to the plain
+ * displacement check rather than to a false accusation.
+ */
+function claimedRoot(toolInput, cwd) {
+  const path = toolInput?.path;
+  if (typeof path === "string" && path.trim()) {
+    return realpath(resolve(isAbsolute(path) ? path : join(cwd, path)));
+  }
+  const name = toolInput?.name;
+  if (typeof name === "string" && name.trim()) {
+    const main = mainCheckout(cwd);
+    return main
+      ? realpath(join(main, ".claude", "worktrees", name.trim()))
+      : null;
+  }
+  return null;
+}
+
+/**
+ * Record what `EnterWorktree` just claimed, for the next tool call to check.
+ *
+ * Returns nothing on purpose. This runs on PostToolUse, where the tool has
+ * already happened and there is no call left to refuse, so every path through
+ * it is an allow — and a function whose only answer is "allow" should not be
+ * spelled as one that computes an exit code.
+ */
+function recordClaim(payload, observed) {
+  const claimed = claimedRoot(payload.tool_input, payload.cwd);
+  if (!claimed || claimed === observed) return;
+  const previous = readState(payload.session_id);
+  writeState(payload.session_id, {
+    boundRoot: previous?.boundRoot ?? observed,
+    claimedRoot: claimed,
+    updatedAt: new Date().toISOString(),
+  });
+}
+
+function refuse(lines) {
+  process.stderr.write(`${lines.join("\n")}\n`);
+  return 2;
+}
+
+function acceptanceLine(observed) {
+  return `  echo '${ACCEPT_PREFIX} ${observed}'`;
+}
+
+/**
+ * Handle an acknowledgement line, or return null when the command is not one.
+ *
+ * The path is compared against what the session is measurably in, not against
+ * what it says it wants. An acknowledgement naming somewhere else is the case
+ * this is for: it means the operator is reasoning about a tree they are not in.
+ */
+function handleAcceptance(payload, observed) {
+  const command = payload.tool_input?.command;
+  if (typeof command !== "string" || !command.includes(ACCEPT_PREFIX))
+    return null;
+  const stated = command.slice(
+    command.indexOf(ACCEPT_PREFIX) + ACCEPT_PREFIX.length
+  );
+  const match = /([^\s'"]+)/.exec(stated);
+  const path = match ? realpath(resolve(match[1])) : null;
+  if (path !== observed) {
+    return refuse([
+      `worktree-binding-guard: this acknowledgement names ${path ?? "no path"},`,
+      `but this session is operating in ${observed}. Not rebinding.`,
+      `If ${observed} is where you mean to work, acknowledge that path:`,
+      acceptanceLine(observed),
+    ]);
+  }
+  writeState(payload.session_id, {
+    boundRoot: observed,
+    claimedRoot: null,
+    updatedAt: new Date().toISOString(),
+  });
+  say(`bound to ${observed}`);
+  return 0;
+}
+
+/** Refusal text for a switch that reported success without taking effect. */
+function unconfirmedSwitch(claimed, observed) {
+  return refuse([
+    `worktree-binding-guard: EnterWorktree reported success for`,
+    `  ${claimed}`,
+    `but this session is still operating in`,
+    `  ${observed}`,
+    "The switch did not take effect. Anything run now lands in the second",
+    "path, not the first — including installs, commits, and file writes, and",
+    "that tree may hold another agent's uncommitted work.",
+    "",
+    "Use absolute paths under the tree you actually want, or acknowledge that",
+    "you intend to keep working where you are:",
+    acceptanceLine(observed),
+  ]);
+}
+
+/** Refusal text for a binding that moved without this session asking. */
+function displaced(bound, observed) {
+  return refuse([
+    "worktree-binding-guard: this session's worktree changed underneath it.",
+    `  bound to:  ${bound}`,
+    `  now in:    ${observed}`,
+    "Concurrent sessions share one worktree binding, so another agent's",
+    "EnterWorktree can move this one. Commands run now land in the second",
+    "path. If you moved deliberately, say so:",
+    acceptanceLine(observed),
+  ]);
+}
+
+function evaluate(payload) {
+  const sessionId = payload.session_id;
+  const cwd = payload.cwd;
+  if (typeof sessionId !== "string" || !sessionId || typeof cwd !== "string") {
+    say("payload carries no session id or cwd; binding is NOT enforced");
+    return 0;
+  }
+  const observed = worktreeRoot(cwd);
+  if (!observed) return 0;
+
+  if (payload.tool_name === "EnterWorktree") {
+    recordClaim(payload, observed);
+    return 0;
+  }
+  if (!GUARDED_TOOLS.has(payload.tool_name)) return 0;
+
+  const accepted = handleAcceptance(payload, observed);
+  if (accepted !== null) return accepted;
+
+  const state = readState(sessionId);
+  if (!state?.boundRoot) {
+    writeState(sessionId, {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    });
+    return 0;
+  }
+  if (state.claimedRoot && state.claimedRoot !== observed) {
+    return unconfirmedSwitch(state.claimedRoot, observed);
+  }
+  if (state.claimedRoot === observed) {
+    writeState(sessionId, {
+      boundRoot: observed,
+      claimedRoot: null,
+      updatedAt: new Date().toISOString(),
+    });
+    return 0;
+  }
+  if (state.boundRoot !== observed) return displaced(state.boundRoot, observed);
+  return 0;
+}
+
+function main() {
+  let raw = "";
+  try {
+    raw = readFileSync(0, "utf8");
+  } catch {
+    say("could not read the hook payload; binding is NOT enforced");
+    return 0;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(raw);
+  } catch {
+    say("hook payload was not JSON; binding is NOT enforced");
+    return 0;
+  }
+  return evaluate(payload);
+}
+
+process.exit(main());

package/plugins/lisa/hooks/worktree-binding-guard.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# PreToolUse guard for Bash/Write/Edit/MultiEdit, and PostToolUse recorder for
+# EnterWorktree: refuse to act while the worktree the session was told it is in
+# disagrees with the one it is measurably in (CodySwannGT/lisa#3864).
+#
+# The reconciliation lives in worktree-binding-guard.mjs beside this file. It
+# needs per-session state, path resolution and git plumbing, and a bash
+# reimplementation of any of that would be a second copy of the thing the guard
+# exists to keep honest.
+#
+# This wrapper does three things and nothing else: probe its interpreter, pass
+# the hook envelope through untouched, and return the classifier's exit code so
+# a refusal is a refusal.
+#
+# FAILING OPEN, LOUDLY
+#
+# Claude Code treats exit 2 as a refusal and every OTHER non-zero exit as a
+# non-blocking hook error, so a missing interpreter under `set -e` would exit
+# 127 and permit exactly what this exists to stop. Degrading to "allow" is
+# correct — a hook that cannot read its input cannot tell a displacement from a
+# directory listing — but it must SAY so, because a guard that is silently
+# absent reads exactly like a guard that is passing. Same reasoning as
+# block-host-name-leak.sh.
+#
+# AGENT PARITY, AND WHY IT STOPS WHERE IT DOES
+#
+# `EnterWorktree` is a Claude Code tool, and the process-global session binding
+# it rewrites is a Claude Code structure. Codex, Antigravity and OpenCode manage
+# their own worktrees and have neither, so there is nothing on those harnesses
+# for the reconciler to reconcile — no `.agy.sh` adapter is shipped for this
+# guard, and its absence is a statement rather than an omission. The Codex
+# variant carries the PreToolUse half because the displacement check is
+# harness-agnostic: it only asks whether the directory a session is measurably
+# in has changed since it last acted.
+set -uo pipefail
+
+input="$(cat)"
+
+if ! command -v node >/dev/null 2>&1; then
+  printf 'worktree-binding-guard: node not found; worktree-binding enforcement is NOT active\n' >&2
+  exit 0
+fi
+
+hook_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+classifier="$hook_dir/worktree-binding-guard.mjs"
+if [ ! -r "$classifier" ]; then
+  printf 'worktree-binding-guard: classifier missing at %s; worktree-binding enforcement is NOT active\n' \
+    "$classifier" >&2
+  exit 0
+fi
+
+status=0
+printf '%s' "$input" | node "$classifier" || status=$?
+exit "$status"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"
@@ -62,6 +62,15 @@
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/withdrawn-rulings.sh --hook"
           }
         ]
+      },
+      {
+        "matcher": "EnterWorktree",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
+          }
+        ]
       }
     ],
     "preToolUse": [
@@ -95,6 +104,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },
@@ -108,6 +121,10 @@
           {
             "type": "command",
             "command": "${CLAUDE_PLUGIN_ROOT}/hooks/block-managed-file-edits.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
           }
         ]
       },