@codyswann/lisa 4.45.5 → 4.45.6

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -2030,6 +2030,77 @@ readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$
 # that could not run produced no lines, the loop body never executed, and the
 # guard was skipped with the command ALLOWED. A segmentation that cannot answer
 # must refuse, exactly like a scan that cannot answer.
+# 14b. Linked worktrees, which are the same principle one level out. `.git` is
+# protected because nothing in the working tree can rebuild it; a linked
+# worktree is protected because nothing OUTSIDE it can rebuild what it holds.
+# The asymmetry is exact and it is invisible from the prompt: `.git/refs` and
+# the object store are shared by every worktree of a repository, while
+# `.git/index` and the working files are per-worktree. So `git commit` moves
+# work somewhere a deletion cannot reach, and `git add` does not — a staged file
+# shows green in `git status`, which reads as saved, and dies with the
+# directory.
+#
+# Measured twice in one evening (issue #3863): one worktree lost a 284-line
+# staged test file, and a second lost nothing from the identical event purely
+# because a gate had forced its work into a commit first. Neither deletion
+# announced itself. That is the second reason this is a block rather than a
+# warning — a worktree deletion destroys the only evidence its own case could
+# leave, so there is no after-the-fact detection to fall back on.
+#
+# `git worktree remove` (guard 12) already refuses a dirty tree, and
+# `--force` is already blocked. This closes the spelling that walks around both:
+# `rm -rf` on the directory, which git never sees.
+#
+# Matching is by REGISTERED path — `git worktree list` names them — so an
+# ordinary directory that merely lives near one is untouched. A repository that
+# cannot be read answers "no": this guard adds protection to a shape that was
+# fully allowed a moment ago, and failing it closed would deny every recursive
+# delete on every path outside a repository.
+#
+# The comparison is on WHOLE TOKENS, which is the only spelling that gets both
+# error directions right. Substring containment would let a worktree named
+# `wt-1` claim `rm -rf wt-10`, an over-block on an unrelated directory; and
+# hand-written boundary classes leak the other way, because `rm -rf <wt>/`
+# with one trailing slash ends on a character every such class treats as
+# "inside a path". So every non-path character — quote, space, parenthesis,
+# redirection — is folded to a space first, which makes each argument a
+# space-delimited token regardless of how it was quoted, and the match is then
+# an equality test on that token. A SUBPATH (`rm -rf <wt>/node_modules`) is
+# deliberately not this guard's business: it is not a worktree deletion, and
+# blocking routine cleanup inside a worktree is how a guard gets switched off.
+names_linked_worktree() {
+  local stmt="$1" probe root listed line primary wt rel
+  root="$(git -C "${CLAUDE_PROJECT_DIR:-$PWD}" rev-parse --show-toplevel 2> /dev/null)" || return 1
+  [ -n "$root" ] || return 1
+  listed="$(git -C "$root" worktree list --porcelain 2> /dev/null)" || return 1
+  probe=" $(printf '%s' "$stmt" | tr -c 'A-Za-z0-9_./-' ' ') "
+  primary=""
+  while IFS= read -r line; do
+    case "$line" in
+      worktree\ *) wt="${line#worktree }" ;;
+      *) continue ;;
+    esac
+    # First entry is the primary checkout, which is not a linked worktree.
+    if [ -z "$primary" ]; then
+      primary="$wt"
+      continue
+    fi
+    case "$probe" in
+      *" $wt "* | *" $wt/ "*) return 0 ;;
+    esac
+    rel="${wt#"$primary"/}"
+    [ "$rel" != "$wt" ] || continue
+    # `./` is the same path spelled the way an agent in the project root types
+    # it, and a token comparison is exact, so it has to be spelled here too.
+    case "$probe" in
+      *" $rel "* | *" $rel/ "* | *" ./$rel "* | *" ./$rel/ "*) return 0 ;;
+    esac
+  done <<EOF
+$listed
+EOF
+  return 1
+}
+
 git_segments_status=0
 git_segments="$(printf '%s' "$normalized_command_str" \
   | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
@@ -2052,6 +2123,9 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead. Re-cloning is NOT a like-for-like replacement: every linked worktree stores a pointer into this .git, so discarding it discards each of them and any uncommitted work they hold — check \`git worktree list\` before treating the checkout as disposable."
   fi
+  if names_linked_worktree "$git_stmt"; then
+    block "recursive forced delete of a linked git worktree. A worktree's index and working files are private to it — only commits are shared — so this destroys any staged or unwritten-to-a-commit work another agent left there, and destroys the evidence that it did (CodySwannGT/lisa#3863). Use 'node scripts/lisa-worktree-guard.mjs remove <path>' instead: it deletes clean and already-committed trees without ceremony, names the files when they exist nowhere else, and records an explicit --force override."
+  fi
 done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even

package/package.json

@@ -176,7 +176,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -324,7 +324,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "2dfa25a8a2115203dd400e5e1f69aefef8014933",
-  "gitHead": "2dfa25a8a2115203dd400e5e1f69aefef8014933",
-  "lisaReleaseTag": "v4.45.5"
+  "lisaReleaseCommit": "51043b81af85673a4ee2956bf05e65a8f6bda03f",
+  "gitHead": "51043b81af85673a4ee2956bf05e65a8f6bda03f",
+  "lisaReleaseTag": "v4.45.6"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/cleanup-stale-worktrees.sh

@@ -16,8 +16,15 @@
 #   * no modified or staged TRACKED files (real work is never deleted)
 #   * its HEAD commit is reachable from some remote ref (nothing unpushed)
 #   * its directory mtime is older than LISA_WORKTREE_MAX_AGE_DAYS (default 7)
+#   * lisa-worktree-guard reports no uncommitted bytes that exist in no commit
 # Untracked-only dirt does NOT block removal — that junk is exactly what
-# defeats the built-in sweep. Set LISA_WORKTREE_CLEANUP=off to disable.
+# defeats the built-in sweep. But "untracked" and "junk" are not the same word:
+# a brand-new source file an agent has written and not yet committed is
+# untracked too, and this sweep would delete it (CodySwannGT/lisa#3863). The
+# guard draws the line by CONTENT rather than by tracking state — a file whose
+# exact bytes are already in some commit is free to delete, one whose bytes
+# exist nowhere else is not, and ignored paths (node_modules, build output)
+# never reach the question. Set LISA_WORKTREE_CLEANUP=off to disable.
 
 set -u
 
@@ -37,6 +44,33 @@ esac
 wt_root="$repo_root/.claude/worktrees"
 [ -d "$wt_root" ] || exit 0
 
+# Resolve the content-reachability guard once. Three homes, in the order a host
+# project actually has them: the applied copy, the installed package, and Lisa's
+# own delivery tree (Lisa does not apply this script to itself).
+guard=""
+for candidate in \
+  "$repo_root/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/all/copy-overwrite/scripts/lisa-worktree-guard.mjs"; do
+  if [ -f "$candidate" ]; then
+    guard="$candidate"
+    break
+  fi
+done
+command -v node > /dev/null 2>&1 || guard=""
+
+# Whether a worktree's uncommitted content is safe to destroy. With the guard
+# present the question is answered by content; without it (no node, no delivered
+# script) the sweep falls back to the conservative shape — ANY non-ignored
+# untracked file keeps the tree. A missing guard must not read as consent.
+removal_allowed() {
+  if [ -n "$guard" ]; then
+    node "$guard" check "$1" > /dev/null 2>&1
+    return $?
+  fi
+  [ -z "$(git -C "$1" ls-files --others --exclude-standard 2> /dev/null | head -1)" ]
+}
+
 now=$(date +%s)
 max_age_secs=$((MAX_AGE_DAYS * 86400))
 removed=0
@@ -66,6 +100,13 @@ for wt in "$wt_root"/*/; do
     sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null) || continue
     [ -n "$(git -C "$wt" branch -r --contains "$sha" 2>/dev/null | head -1)" ] || continue
 
+    # Content gate: refuse to destroy bytes that live in no commit. The
+    # tracked-file check above answers a different question — a file an agent
+    # has written but never `git add`ed is untracked, so that check reports the
+    # tree clean while the whole deliverable sits in it. Only commits are shared
+    # between worktrees; this directory's working files and index are not.
+    removal_allowed "$wt" || continue
+
     # git worktree lock (held during live agent execution) blocks removal;
     # --force only clears untracked junk, never the gates above.
     git -C "$repo_root" worktree remove --force "$wt" 2>/dev/null && removed=$((removed + 1))

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -2030,6 +2030,77 @@ readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$
 # that could not run produced no lines, the loop body never executed, and the
 # guard was skipped with the command ALLOWED. A segmentation that cannot answer
 # must refuse, exactly like a scan that cannot answer.
+# 14b. Linked worktrees, which are the same principle one level out. `.git` is
+# protected because nothing in the working tree can rebuild it; a linked
+# worktree is protected because nothing OUTSIDE it can rebuild what it holds.
+# The asymmetry is exact and it is invisible from the prompt: `.git/refs` and
+# the object store are shared by every worktree of a repository, while
+# `.git/index` and the working files are per-worktree. So `git commit` moves
+# work somewhere a deletion cannot reach, and `git add` does not — a staged file
+# shows green in `git status`, which reads as saved, and dies with the
+# directory.
+#
+# Measured twice in one evening (issue #3863): one worktree lost a 284-line
+# staged test file, and a second lost nothing from the identical event purely
+# because a gate had forced its work into a commit first. Neither deletion
+# announced itself. That is the second reason this is a block rather than a
+# warning — a worktree deletion destroys the only evidence its own case could
+# leave, so there is no after-the-fact detection to fall back on.
+#
+# `git worktree remove` (guard 12) already refuses a dirty tree, and
+# `--force` is already blocked. This closes the spelling that walks around both:
+# `rm -rf` on the directory, which git never sees.
+#
+# Matching is by REGISTERED path — `git worktree list` names them — so an
+# ordinary directory that merely lives near one is untouched. A repository that
+# cannot be read answers "no": this guard adds protection to a shape that was
+# fully allowed a moment ago, and failing it closed would deny every recursive
+# delete on every path outside a repository.
+#
+# The comparison is on WHOLE TOKENS, which is the only spelling that gets both
+# error directions right. Substring containment would let a worktree named
+# `wt-1` claim `rm -rf wt-10`, an over-block on an unrelated directory; and
+# hand-written boundary classes leak the other way, because `rm -rf <wt>/`
+# with one trailing slash ends on a character every such class treats as
+# "inside a path". So every non-path character — quote, space, parenthesis,
+# redirection — is folded to a space first, which makes each argument a
+# space-delimited token regardless of how it was quoted, and the match is then
+# an equality test on that token. A SUBPATH (`rm -rf <wt>/node_modules`) is
+# deliberately not this guard's business: it is not a worktree deletion, and
+# blocking routine cleanup inside a worktree is how a guard gets switched off.
+names_linked_worktree() {
+  local stmt="$1" probe root listed line primary wt rel
+  root="$(git -C "${CLAUDE_PROJECT_DIR:-$PWD}" rev-parse --show-toplevel 2> /dev/null)" || return 1
+  [ -n "$root" ] || return 1
+  listed="$(git -C "$root" worktree list --porcelain 2> /dev/null)" || return 1
+  probe=" $(printf '%s' "$stmt" | tr -c 'A-Za-z0-9_./-' ' ') "
+  primary=""
+  while IFS= read -r line; do
+    case "$line" in
+      worktree\ *) wt="${line#worktree }" ;;
+      *) continue ;;
+    esac
+    # First entry is the primary checkout, which is not a linked worktree.
+    if [ -z "$primary" ]; then
+      primary="$wt"
+      continue
+    fi
+    case "$probe" in
+      *" $wt "* | *" $wt/ "*) return 0 ;;
+    esac
+    rel="${wt#"$primary"/}"
+    [ "$rel" != "$wt" ] || continue
+    # `./` is the same path spelled the way an agent in the project root types
+    # it, and a token comparison is exact, so it has to be spelled here too.
+    case "$probe" in
+      *" $rel "* | *" $rel/ "* | *" ./$rel "* | *" ./$rel/ "*) return 0 ;;
+    esac
+  done <<EOF
+$listed
+EOF
+  return 1
+}
+
 git_segments_status=0
 git_segments="$(printf '%s' "$normalized_command_str" \
   | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
@@ -2052,6 +2123,9 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead. Re-cloning is NOT a like-for-like replacement: every linked worktree stores a pointer into this .git, so discarding it discards each of them and any uncommitted work they hold — check \`git worktree list\` before treating the checkout as disposable."
   fi
+  if names_linked_worktree "$git_stmt"; then
+    block "recursive forced delete of a linked git worktree. A worktree's index and working files are private to it — only commits are shared — so this destroys any staged or unwritten-to-a-commit work another agent left there, and destroys the evidence that it did (CodySwannGT/lisa#3863). Use 'node scripts/lisa-worktree-guard.mjs remove <path>' instead: it deletes clean and already-committed trees without ceremony, names the files when they exist nowhere else, and records an explicit --force override."
+  fi
 done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -2030,6 +2030,77 @@ readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$
 # that could not run produced no lines, the loop body never executed, and the
 # guard was skipped with the command ALLOWED. A segmentation that cannot answer
 # must refuse, exactly like a scan that cannot answer.
+# 14b. Linked worktrees, which are the same principle one level out. `.git` is
+# protected because nothing in the working tree can rebuild it; a linked
+# worktree is protected because nothing OUTSIDE it can rebuild what it holds.
+# The asymmetry is exact and it is invisible from the prompt: `.git/refs` and
+# the object store are shared by every worktree of a repository, while
+# `.git/index` and the working files are per-worktree. So `git commit` moves
+# work somewhere a deletion cannot reach, and `git add` does not — a staged file
+# shows green in `git status`, which reads as saved, and dies with the
+# directory.
+#
+# Measured twice in one evening (issue #3863): one worktree lost a 284-line
+# staged test file, and a second lost nothing from the identical event purely
+# because a gate had forced its work into a commit first. Neither deletion
+# announced itself. That is the second reason this is a block rather than a
+# warning — a worktree deletion destroys the only evidence its own case could
+# leave, so there is no after-the-fact detection to fall back on.
+#
+# `git worktree remove` (guard 12) already refuses a dirty tree, and
+# `--force` is already blocked. This closes the spelling that walks around both:
+# `rm -rf` on the directory, which git never sees.
+#
+# Matching is by REGISTERED path — `git worktree list` names them — so an
+# ordinary directory that merely lives near one is untouched. A repository that
+# cannot be read answers "no": this guard adds protection to a shape that was
+# fully allowed a moment ago, and failing it closed would deny every recursive
+# delete on every path outside a repository.
+#
+# The comparison is on WHOLE TOKENS, which is the only spelling that gets both
+# error directions right. Substring containment would let a worktree named
+# `wt-1` claim `rm -rf wt-10`, an over-block on an unrelated directory; and
+# hand-written boundary classes leak the other way, because `rm -rf <wt>/`
+# with one trailing slash ends on a character every such class treats as
+# "inside a path". So every non-path character — quote, space, parenthesis,
+# redirection — is folded to a space first, which makes each argument a
+# space-delimited token regardless of how it was quoted, and the match is then
+# an equality test on that token. A SUBPATH (`rm -rf <wt>/node_modules`) is
+# deliberately not this guard's business: it is not a worktree deletion, and
+# blocking routine cleanup inside a worktree is how a guard gets switched off.
+names_linked_worktree() {
+  local stmt="$1" probe root listed line primary wt rel
+  root="$(git -C "${CLAUDE_PROJECT_DIR:-$PWD}" rev-parse --show-toplevel 2> /dev/null)" || return 1
+  [ -n "$root" ] || return 1
+  listed="$(git -C "$root" worktree list --porcelain 2> /dev/null)" || return 1
+  probe=" $(printf '%s' "$stmt" | tr -c 'A-Za-z0-9_./-' ' ') "
+  primary=""
+  while IFS= read -r line; do
+    case "$line" in
+      worktree\ *) wt="${line#worktree }" ;;
+      *) continue ;;
+    esac
+    # First entry is the primary checkout, which is not a linked worktree.
+    if [ -z "$primary" ]; then
+      primary="$wt"
+      continue
+    fi
+    case "$probe" in
+      *" $wt "* | *" $wt/ "*) return 0 ;;
+    esac
+    rel="${wt#"$primary"/}"
+    [ "$rel" != "$wt" ] || continue
+    # `./` is the same path spelled the way an agent in the project root types
+    # it, and a token comparison is exact, so it has to be spelled here too.
+    case "$probe" in
+      *" $rel "* | *" $rel/ "* | *" ./$rel "* | *" ./$rel/ "*) return 0 ;;
+    esac
+  done <<EOF
+$listed
+EOF
+  return 1
+}
+
 git_segments_status=0
 git_segments="$(printf '%s' "$normalized_command_str" \
   | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
@@ -2052,6 +2123,9 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead. Re-cloning is NOT a like-for-like replacement: every linked worktree stores a pointer into this .git, so discarding it discards each of them and any uncommitted work they hold — check \`git worktree list\` before treating the checkout as disposable."
   fi
+  if names_linked_worktree "$git_stmt"; then
+    block "recursive forced delete of a linked git worktree. A worktree's index and working files are private to it — only commits are shared — so this destroys any staged or unwritten-to-a-commit work another agent left there, and destroys the evidence that it did (CodySwannGT/lisa#3863). Use 'node scripts/lisa-worktree-guard.mjs remove <path>' instead: it deletes clean and already-committed trees without ceremony, names the files when they exist nowhere else, and records an explicit --force override."
+  fi
 done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/cleanup-stale-worktrees.sh

@@ -16,8 +16,15 @@
 #   * no modified or staged TRACKED files (real work is never deleted)
 #   * its HEAD commit is reachable from some remote ref (nothing unpushed)
 #   * its directory mtime is older than LISA_WORKTREE_MAX_AGE_DAYS (default 7)
+#   * lisa-worktree-guard reports no uncommitted bytes that exist in no commit
 # Untracked-only dirt does NOT block removal — that junk is exactly what
-# defeats the built-in sweep. Set LISA_WORKTREE_CLEANUP=off to disable.
+# defeats the built-in sweep. But "untracked" and "junk" are not the same word:
+# a brand-new source file an agent has written and not yet committed is
+# untracked too, and this sweep would delete it (CodySwannGT/lisa#3863). The
+# guard draws the line by CONTENT rather than by tracking state — a file whose
+# exact bytes are already in some commit is free to delete, one whose bytes
+# exist nowhere else is not, and ignored paths (node_modules, build output)
+# never reach the question. Set LISA_WORKTREE_CLEANUP=off to disable.
 
 set -u
 
@@ -37,6 +44,33 @@ esac
 wt_root="$repo_root/.claude/worktrees"
 [ -d "$wt_root" ] || exit 0
 
+# Resolve the content-reachability guard once. Three homes, in the order a host
+# project actually has them: the applied copy, the installed package, and Lisa's
+# own delivery tree (Lisa does not apply this script to itself).
+guard=""
+for candidate in \
+  "$repo_root/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/all/copy-overwrite/scripts/lisa-worktree-guard.mjs"; do
+  if [ -f "$candidate" ]; then
+    guard="$candidate"
+    break
+  fi
+done
+command -v node > /dev/null 2>&1 || guard=""
+
+# Whether a worktree's uncommitted content is safe to destroy. With the guard
+# present the question is answered by content; without it (no node, no delivered
+# script) the sweep falls back to the conservative shape — ANY non-ignored
+# untracked file keeps the tree. A missing guard must not read as consent.
+removal_allowed() {
+  if [ -n "$guard" ]; then
+    node "$guard" check "$1" > /dev/null 2>&1
+    return $?
+  fi
+  [ -z "$(git -C "$1" ls-files --others --exclude-standard 2> /dev/null | head -1)" ]
+}
+
 now=$(date +%s)
 max_age_secs=$((MAX_AGE_DAYS * 86400))
 removed=0
@@ -66,6 +100,13 @@ for wt in "$wt_root"/*/; do
     sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null) || continue
     [ -n "$(git -C "$wt" branch -r --contains "$sha" 2>/dev/null | head -1)" ] || continue
 
+    # Content gate: refuse to destroy bytes that live in no commit. The
+    # tracked-file check above answers a different question — a file an agent
+    # has written but never `git add`ed is untracked, so that check reports the
+    # tree clean while the whole deliverable sits in it. Only commits are shared
+    # between worktrees; this directory's working files and index are not.
+    removal_allowed "$wt" || continue
+
     # git worktree lock (held during live agent execution) blocks removal;
     # --force only clears untracked junk, never the gates above.
     git -C "$repo_root" worktree remove --force "$wt" 2>/dev/null && removed=$((removed + 1))

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -2030,6 +2030,77 @@ readonly GIT_CONTROL_PLANE='(^|[[:space:]='"$qc"'./])\.git([/[:space:]'"$qc"']|$
 # that could not run produced no lines, the loop body never executed, and the
 # guard was skipped with the command ALLOWED. A segmentation that cannot answer
 # must refuse, exactly like a scan that cannot answer.
+# 14b. Linked worktrees, which are the same principle one level out. `.git` is
+# protected because nothing in the working tree can rebuild it; a linked
+# worktree is protected because nothing OUTSIDE it can rebuild what it holds.
+# The asymmetry is exact and it is invisible from the prompt: `.git/refs` and
+# the object store are shared by every worktree of a repository, while
+# `.git/index` and the working files are per-worktree. So `git commit` moves
+# work somewhere a deletion cannot reach, and `git add` does not — a staged file
+# shows green in `git status`, which reads as saved, and dies with the
+# directory.
+#
+# Measured twice in one evening (issue #3863): one worktree lost a 284-line
+# staged test file, and a second lost nothing from the identical event purely
+# because a gate had forced its work into a commit first. Neither deletion
+# announced itself. That is the second reason this is a block rather than a
+# warning — a worktree deletion destroys the only evidence its own case could
+# leave, so there is no after-the-fact detection to fall back on.
+#
+# `git worktree remove` (guard 12) already refuses a dirty tree, and
+# `--force` is already blocked. This closes the spelling that walks around both:
+# `rm -rf` on the directory, which git never sees.
+#
+# Matching is by REGISTERED path — `git worktree list` names them — so an
+# ordinary directory that merely lives near one is untouched. A repository that
+# cannot be read answers "no": this guard adds protection to a shape that was
+# fully allowed a moment ago, and failing it closed would deny every recursive
+# delete on every path outside a repository.
+#
+# The comparison is on WHOLE TOKENS, which is the only spelling that gets both
+# error directions right. Substring containment would let a worktree named
+# `wt-1` claim `rm -rf wt-10`, an over-block on an unrelated directory; and
+# hand-written boundary classes leak the other way, because `rm -rf <wt>/`
+# with one trailing slash ends on a character every such class treats as
+# "inside a path". So every non-path character — quote, space, parenthesis,
+# redirection — is folded to a space first, which makes each argument a
+# space-delimited token regardless of how it was quoted, and the match is then
+# an equality test on that token. A SUBPATH (`rm -rf <wt>/node_modules`) is
+# deliberately not this guard's business: it is not a worktree deletion, and
+# blocking routine cleanup inside a worktree is how a guard gets switched off.
+names_linked_worktree() {
+  local stmt="$1" probe root listed line primary wt rel
+  root="$(git -C "${CLAUDE_PROJECT_DIR:-$PWD}" rev-parse --show-toplevel 2> /dev/null)" || return 1
+  [ -n "$root" ] || return 1
+  listed="$(git -C "$root" worktree list --porcelain 2> /dev/null)" || return 1
+  probe=" $(printf '%s' "$stmt" | tr -c 'A-Za-z0-9_./-' ' ') "
+  primary=""
+  while IFS= read -r line; do
+    case "$line" in
+      worktree\ *) wt="${line#worktree }" ;;
+      *) continue ;;
+    esac
+    # First entry is the primary checkout, which is not a linked worktree.
+    if [ -z "$primary" ]; then
+      primary="$wt"
+      continue
+    fi
+    case "$probe" in
+      *" $wt "* | *" $wt/ "*) return 0 ;;
+    esac
+    rel="${wt#"$primary"/}"
+    [ "$rel" != "$wt" ] || continue
+    # `./` is the same path spelled the way an agent in the project root types
+    # it, and a token comparison is exact, so it has to be spelled here too.
+    case "$probe" in
+      *" $rel "* | *" $rel/ "* | *" ./$rel "* | *" ./$rel/ "*) return 0 ;;
+    esac
+  done <<EOF
+$listed
+EOF
+  return 1
+}
+
 git_segments_status=0
 git_segments="$(printf '%s' "$normalized_command_str" \
   | awk '{ if (/\|[ \t]*$/) printf "%s ", $0; else print }' \
@@ -2052,6 +2123,9 @@ while IFS= read -r git_stmt; do
   if scan -E "$git_stmt" "$GIT_CONTROL_PLANE"; then
     block "recursive forced delete of the git control plane (.git holds every commit, branch and stash not already pushed; nothing in the working tree can rebuild it). Delete a specific ignored artifact instead. Re-cloning is NOT a like-for-like replacement: every linked worktree stores a pointer into this .git, so discarding it discards each of them and any uncommitted work they hold — check \`git worktree list\` before treating the checkout as disposable."
   fi
+  if names_linked_worktree "$git_stmt"; then
+    block "recursive forced delete of a linked git worktree. A worktree's index and working files are private to it — only commits are shared — so this destroys any staged or unwritten-to-a-commit work another agent left there, and destroys the evidence that it did (CodySwannGT/lisa#3863). Use 'node scripts/lisa-worktree-guard.mjs remove <path>' instead: it deletes clean and already-committed trees without ceremony, names the files when they exist nowhere else, and records an explicit --force override."
+  fi
 done <<<"$git_segments"
 
 # 15. Credential stores. Reading one into an agent transcript is disclosure even

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.45.5",
+  "version": "4.45.6",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"