@codyswann/lisa 4.45.7 → 4.45.8

package/plugins/lisa-phaser-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-phaser-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-phaser",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Phaser 4 game-development rules for TypeScript projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Ruby on Rails-specific skills and hooks for RuboCop and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-rails-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-rails",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Ruby on Rails-specific hooks — RuboCop linting/formatting and ast-grep scanning on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "TypeScript-specific hooks for formatting, linting, and ast-grep scanning on edit.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-typescript-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-typescript",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "TypeScript-specific hooks — Prettier formatting, ESLint linting, ast-grep scanning, and error-suppression blocking on edit",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "Distributable LLM Wiki kernel — ingest, query, lint, and maintain a git-native markdown knowledge base across Claude and Codex.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.45.7",
+  "version": "4.45.8",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/src/base/.claude-plugin/plugin.json

@@ -293,6 +293,14 @@
             "command": "command -v entire >/dev/null 2>&1 && entire hooks claude-code session-start || true"
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/worktree-binding-guard.sh"
+          }
+        ]
       }
     ],
     "SubagentStart": [

package/plugins/src/base/hooks/worktree-binding-guard.mjs

@@ -547,6 +547,63 @@ function claimedRoot(toolInput, cwd) {
   return null;
 }
 
+/**
+ * Record where the session STARTED, so its first guarded call is checked
+ * against a baseline rather than establishing one.
+ *
+ * ## Why the first call could not be checked before
+ *
+ * It established the baseline instead of testing one, which is
+ * trust-on-first-use — and TOFU is only as safe as its first use. Here the
+ * first use is assigned by the harness, unasked (CodySwannGT/lisa#3864), so the
+ * one moment the guard trusted was the moment the session had least control
+ * over. A session already sitting in a foreign worktree when it first acted
+ * bound to that tree and was never refused, and every later call was then
+ * checked faithfully against the wrong baseline — defending the session INTO
+ * the wrong worktree rather than out of it (CodySwannGT/lisa#3955).
+ *
+ * ## Why an earlier observation separates what a cleverer check cannot
+ *
+ * At the first guarded call, "I was displaced before I acted" and "I
+ * legitimately started here" present identically: one session id, one observed
+ * root, no prior state. No comparison can tell them apart, because the
+ * information is not in the hook's inputs at that instant.
+ *
+ * At session start it is. The displacement mechanism actually observed is a
+ * PEER's `EnterWorktree` moving this session (CodySwannGT/lisa#3712), which
+ * happens during the session — after it has started. A baseline taken at start
+ * is therefore recorded BEFORE the event that moves it, and the first guarded
+ * call becomes an ordinary comparison against a baseline that already exists.
+ * It reaches the same refusal a later displacement produces, because by then it
+ * is one.
+ *
+ * ## What this does NOT achieve
+ *
+ * #3955 asks for a baseline from the ASSIGNER rather than from observation.
+ * That is not what this is and Lisa cannot build it: Lisa does not own
+ * `EnterWorktree`, and nothing the harness writes names a session's assigned
+ * worktree in a form a hook can read. This is still an observation, just an
+ * earlier one. It closes the window between session start and the first guarded
+ * call; it leaves open a session LAUNCHED already displaced, where start
+ * observes the foreign tree and trust-on-first-use still applies.
+ *
+ * Returns nothing on purpose, like its sibling below: SessionStart has no call
+ * to refuse, so every path through it allows.
+ * @param sessionId - The session this baseline belongs to
+ * @param observed - The worktree root the session started in
+ */
+function recordBaseline(sessionId, observed) {
+  // Never overwrite. A resumed session, a reconnect, or anything else that
+  // fires the event twice must not be able to launder a displaced binding into
+  // a fresh baseline — which is the whole failure this exists to close.
+  if (readState(sessionId)?.boundRoot) return;
+  writeState(sessionId, {
+    boundRoot: observed,
+    claimedRoot: null,
+    updatedAt: new Date().toISOString(),
+  });
+}
+
 /**
  * Record what `EnterWorktree` just claimed, for the next tool call to check.
  *
@@ -648,6 +705,10 @@ function evaluate(payload) {
   const observed = worktreeRoot(cwd);
   if (!observed) return 0;
 
+  if (payload.hook_event_name === "SessionStart") {
+    recordBaseline(sessionId, observed);
+    return 0;
+  }
   if (payload.tool_name === "EnterWorktree") {
     recordClaim(payload, observed);
     return 0;
@@ -659,6 +720,13 @@ function evaluate(payload) {
 
   const state = readState(sessionId);
   if (!state?.boundRoot) {
+    // No baseline means SessionStart did not run for this session — an older
+    // install, a runtime that fires no such event, a harness that skips it.
+    // Absence of a baseline is absence of evidence, not evidence of
+    // displacement, so this records one exactly as it always did rather than
+    // refusing. Treating it as a refusal would turn a floor into a wall on
+    // every surface where the event does not fire, and a wall gets switched
+    // off, which costs the whole guard.
     writeState(sessionId, {
       boundRoot: observed,
       claimedRoot: null,

package/scripts/check-shell-guard-refusal-coverage.mjs

@@ -28,9 +28,13 @@
  *
  * CLI:
  *   node scripts/check-shell-guard-refusal-coverage.mjs [--json] [--trace FILE]
+ *                                                       [--trace-out FILE]
  *
  *   --trace FILE   judge an existing trace instead of producing one. Use it in
  *                  CI when the full suite already ran with the tracer imported.
+ *   --trace-out FILE
+ *                  also write the judged trace to FILE, so a later step in the
+ *                  same job can read what this run observed. Never commit it.
  *
  * Exit codes (mirroring the sibling check-* scripts):
  *   0 — every guard the run drove was observed refusing and allowing.
@@ -41,7 +45,7 @@
  * @module scripts/check-shell-guard-refusal-coverage
  */
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import process from "node:process";
@@ -56,6 +60,9 @@ import {
   tracerIndex,
 } from "./lib/shell-guard-refusal-coverage.mjs";
 
+/** The flag naming a file the produced trace should also be written to. */
+const TRACE_OUT_FLAG = "--trace-out";
+
 /** Wall-clock ceiling for the traced vitest run. */
 const RUN_TIMEOUT_MS = 45 * 60_000;
 
@@ -185,16 +192,54 @@ function produceTrace(root, population) {
   };
 }
 
+/**
+ * Persist the trace this run produced, when the caller asked for it.
+ *
+ * The trace is the only artefact that can tell a LATER step — the mutation
+ * gate's uninstrumentable branch, which until CodySwannGT/lisa#3931 asserted a
+ * search it never ran — which shell guards this run actually drove. Written
+ * only on request, and never committed: a checked-in trace would report a guard
+ * as evidenced long after its driving test was deleted, which is the same false
+ * claim with a longer half-life.
+ *
+ * A write that fails is announced and otherwise ignored. This check's verdict
+ * does not depend on the copy, and refusing the run because a convenience file
+ * could not be written would trade a real signal for a bookkeeping one.
+ * @param {string} root - Repository root.
+ * @param {readonly string[]} args - CLI arguments.
+ * @param {string} trace - The raw JSONL this run produced.
+ * @returns {void}
+ */
+function keepTrace(root, args, trace) {
+  const at = args.indexOf(TRACE_OUT_FLAG);
+  const target = at === -1 ? undefined : args[at + 1];
+  if (target === undefined) return;
+  const resolved = path.isAbsolute(target) ? target : path.join(root, target);
+  try {
+    mkdirSync(path.dirname(resolved), { recursive: true });
+    writeFileSync(resolved, trace);
+  } catch (error) {
+    console.error(
+      `check:shell-guard-refusal-coverage: could not write ${target}: ${
+        error instanceof Error ? error.message : String(error)
+      }`
+    );
+  }
+}
+
 /**
  * CLI entry point.
  * @returns {void}
  */
 export function main() {
   const args = process.argv.slice(2);
-  const known = new Set(["--json", "--trace"]);
+  const known = new Set(["--json", "--trace", TRACE_OUT_FLAG]);
+  const valueFlags = new Set(["--trace", TRACE_OUT_FLAG]);
   const unknown = args.find(
     (arg, at) =>
-      arg.startsWith("--") && !known.has(arg) && args[at - 1] !== "--trace"
+      arg.startsWith("--") &&
+      !known.has(arg) &&
+      !valueFlags.has(args[at - 1] ?? "")
   );
   if (unknown) {
     console.error(
@@ -216,6 +261,7 @@ export function main() {
     process.exitCode = 2;
     return;
   }
+  keepTrace(root, args, produced.trace);
   const report = judge({ population, observed: parseTrace(produced.trace) });
   console.log(
     args.includes("--json")

package/scripts/lib/shell-guard-trace.mjs

@@ -55,6 +55,14 @@
  * It NEVER throws and never changes a return value: a tracer that can break the
  * suite it observes would be turned off, and then this whole control is prose.
  *
+ * Each record carries the `sha256` that matched, not only the guard path. A
+ * consumer reading a trace some other step produced cannot otherwise tell an
+ * observation of THIS guard from an observation of the version it replaced, and
+ * a guard that inherits its predecessor's coverage is the stale-evidence shape
+ * this repository keeps closing (CodySwannGT/lisa#3931). The judge in
+ * `shell-guard-refusal-coverage.mjs` does not need it — it hashes the tree
+ * itself in the same process — so the field is additive and ignored there.
+ *
  * @module scripts/lib/shell-guard-trace
  */
 import { appendFileSync, readFileSync, statSync } from "node:fs";
@@ -98,12 +106,15 @@ function install(trace, index) {
    * @param {string} origin - Test frame that started it.
    * @returns {void}
    */
-  const record = (script, status, origin) => {
+  const record = (script, status, origin, sha256) => {
     const key = `${script}:${String(status)}`;
     if (seen.has(key)) return;
     seen.add(key);
     try {
-      appendFileSync(trace, `${JSON.stringify({ script, status, origin })}\n`);
+      appendFileSync(
+        trace,
+        `${JSON.stringify({ script, status, origin, sha256 })}\n`
+      );
     } catch {
       /* A trace that cannot be written must not fail the suite. */
     }
@@ -138,7 +149,7 @@ function install(trace, index) {
    * @param {unknown} command - First argument of the child start.
    * @param {unknown} args - Second argument: an argv array, or the options.
    * @param {unknown} third - Third argument, when the second was an argv array.
-   * @returns {string[]} Repository-relative guard paths.
+   * @returns {{guard: string, sha256: string}[]} Guards, each with the digest that matched.
    */
   const matched = (command, args, third) => {
     if (typeof command !== "string") return [];
@@ -157,7 +168,8 @@ function install(trace, index) {
       typeof (/** @type {{cwd?: unknown}} */ (options).cwd) === "string"
         ? /** @type {{cwd: string}} */ (options).cwd
         : process.cwd();
-    const hits = new Set();
+    /** @type {Map<string, string>} */
+    const hits = new Map();
     for (const token of tokens) {
       if (!token || token.length > MAX_PATH_LENGTH) continue;
       const absolute = path.isAbsolute(token)
@@ -179,12 +191,14 @@ function install(trace, index) {
         const digest = createHash("sha256")
           .update(readFileSync(absolute))
           .digest("hex");
-        for (const guard of inventory.byHash[digest] ?? []) hits.add(guard);
+        for (const guard of inventory.byHash[digest] ?? []) {
+          hits.set(guard, digest);
+        }
       } catch {
         continue;
       }
     }
-    return [...hits];
+    return [...hits].map(([guard, sha256]) => ({ guard, sha256 }));
   };
 
   /**
@@ -213,7 +227,9 @@ function install(trace, index) {
       const guards = matched(command, args, options);
       if (guards.length > 0) {
         const where = origin();
-        for (const guard of guards) record(guard, result.status, where);
+        for (const hit of guards) {
+          record(hit.guard, result.status, where, hit.sha256);
+        }
       }
     } catch {
       /* Never let observation change the observed. */
@@ -234,7 +250,9 @@ function install(trace, index) {
           const guards = matched(command, args, options);
           if (guards.length === 0) return;
           const where = origin();
-          for (const guard of guards) record(guard, status, where);
+          for (const hit of guards) {
+            record(hit.guard, status, where, hit.sha256);
+          }
         } catch {
           /* Never let observation change the observed. */
         }

package/scripts/lisa-enforcement-fallback.sh

@@ -480,6 +480,25 @@ notice_marker=""
 # non-sticky shared TMPDIR: another user could replace that parent between the
 # checks below. Root- or caller-owned parents are acceptable; any parent that
 # grants group or other write access must also carry the sticky bit.
+#
+# The two `stat` spellings must be asked for the SAME twelve bits, and getting
+# that wrong is invisible because each platform only ever runs its own branch.
+# BSD `%Lp` renders the low NINE bits and drops setuid/setgid/sticky entirely:
+#
+#   stat -f '%Lp' <a 1777 dir>  ->  777    <- sticky gone
+#   stat -f '%p'  <a 1777 dir>  ->  41777  <- sticky present, plus file type
+#   stat -c '%a'  <a 1777 dir>  ->  1777   <- sticky present (GNU includes it)
+#
+# So under `%Lp` the sticky test below is `777 & 1000`, which is zero for every
+# directory on the machine — the exemption was unreachable on macOS and the
+# whole `&& [ ... 8#1000 ] -eq 0` clause was dead code there. The same logical
+# root was therefore trusted on Linux and rejected on macOS, and since CI is
+# Linux the stricter platform was the one nobody specified and nobody tests on
+# (CodySwannGT/lisa#3691).
+#
+# `%p` restores the bit and adds the file type above it, so the mask normalizes
+# both spellings to one value and the arithmetic below has a single meaning:
+# `41777 & 7777` and `1777 & 7777` are both 1777.
 notice_directory_trusted() {
   local directory="$1"
   local directory_stat=""
@@ -487,7 +506,7 @@ notice_directory_trusted() {
   local directory_mode=""
   local directory_mode_value=0
 
-  directory_stat="$(stat -f '%u %Lp' "$directory" 2>/dev/null)" || \
+  directory_stat="$(stat -f '%u %p' "$directory" 2>/dev/null)" || \
     directory_stat="$(stat -c '%u %a' "$directory" 2>/dev/null)" || return 1
   directory_owner="${directory_stat%% *}"
   directory_mode="${directory_stat#* }"
@@ -495,7 +514,7 @@ notice_directory_trusted() {
     *[!0-9:]* | :* | *: ) return 1 ;;
   esac
   [ "$directory_owner" = "0" ] || [ "$directory_owner" = "$notice_uid" ] || return 1
-  directory_mode_value=$((8#$directory_mode))
+  directory_mode_value=$((8#$directory_mode & 8#7777))
   if [ $((directory_mode_value & 8#0022)) -ne 0 ] && \
     [ $((directory_mode_value & 8#1000)) -eq 0 ]; then
     return 1