@codyswann/lisa 4.49.0 → 4.50.1

package/all/copy-overwrite/scripts/check-conflict-markers.mjs

@@ -446,8 +446,11 @@ export function parseArgs(argv) {
     if (arg === "--json") {
       json = true;
     } else if (arg === "--root") {
+      if (i + 1 >= argv.length) {
+        throw new UsageError("--root requires a value");
+      }
       const next = argv[i + 1];
-      if (next === undefined || next.startsWith("--")) {
+      if (next.startsWith("--")) {
         throw new UsageError("--root requires a value");
       }
       root = next;

package/all/copy-overwrite/scripts/lib/gate-failure-diagnosis.mjs

@@ -358,6 +358,169 @@ function noTestsVerdict(output) {
   };
 }
 
+/**
+ * What a tool prints when it exited SUCCESSFULLY having done nothing.
+ *
+ * `states` is the tool's own positive statement of emptiness; `contradicted`
+ * is the line that same tool prints whenever it DID reach a verdict. Both are
+ * required. The second is what stops a parent transcript that merely quotes a
+ * child's empty lane from being read as empty itself — the same guard, and the
+ * same known limit, as the failure path's use of {@link SUMMARY_PATTERN}.
+ *
+ * A table rather than two conditionals, because the defect is not vitest's. It
+ * is "exit 0 attests to work that never happened", and the extension point is
+ * one row per tool that can say so. A tool which prints NO count at all —
+ * `tsc`, whose silent exit 0 says nothing about how much it compiled — cannot
+ * be given a row until it is first made to state what it compiled.
+ * CodySwannGT/lisa#3811 is the work that makes it state one.
+ *
+ * **A row there does NOT close #3811**, and reading it that way would be a
+ * costly mistake. That gate compiles 1,210 files, none of them under `tests/`:
+ * a WRONG NON-ZERO, not an emptiness. No row keyed on a positive statement can
+ * reach it, and the only row that could is one keyed on "I saw no test path in
+ * the file list" — the absence-inference this table refuses on principle, since
+ * it cannot tell "nothing was compiled" from "I did not look". The row and that
+ * ticket's config fix are complementary, not sequential.
+ *
+ * Both rows are measured, not recalled: vitest 4.1.9 and jest, each run with
+ * `--passWithNoTests` against a directory holding no tests.
+ */
+const ZERO_WORK_SIGNATURES = Object.freeze([
+  Object.freeze({
+    contradicted: SUMMARY_PATTERN,
+    // The same pattern the failure path reads, deliberately, so a wording
+    // change in the tool breaks BOTH readings visibly instead of silently
+    // retiring this one. A tighter pattern keyed on the `, exiting with code
+    // 0` suffix would be more precise and would go quietly inert the day that
+    // suffix moves — which is the defect class this whole file is about.
+    states: NO_TESTS_PATTERN,
+    tool: "vitest",
+  }),
+  Object.freeze({
+    /** jest's tally line: `Tests:       3 passed, 3 total`. */
+    contradicted: /^[ \t]*Tests:[ \t]/m,
+    /** jest's own line: `No tests found, exiting with code 0`. */
+    states: /^[ \t]*No tests found/m,
+    tool: "jest",
+  }),
+]);
+
+/**
+ * The root a runner names for itself: ` RUN  v4.1.9 /path/to/root`.
+ *
+ * The capture takes the rest of the line rather than the next run of non-space,
+ * because a checkout path may contain spaces and the truncated answer is worse
+ * than no answer: `/repo/consumer project` reported as `/repo/consumer` names a
+ * tree that exists, so the operator checks the wrong one and the line that was
+ * added to end that guessing causes it instead.
+ *
+ * The capture is one greedy negated class and the trailing whitespace comes off
+ * in `rootLine` rather than in the pattern. A lazy `(.+?)` followed by `[ \t]*$`
+ * expresses the same intent and is a super-linear backtracking hazard, which
+ * the shipped ruleset rejects outright (`sonarjs/slow-regex`) — this module
+ * reads gate transcripts, which are exactly the untrusted, arbitrarily long
+ * input that makes that rule worth obeying.
+ */
+const RUN_ROOT_PATTERN = /^[ \t]*RUN[ \t]+v\S+[ \t]+([^\r\n]+)/m;
+
+/**
+ * Where this run happened — always answered, never omitted.
+ *
+ * The question an operator asks first of an empty run is WHICH TREE it ran in,
+ * and several agents lost time inferring it from an absent file count
+ * (CodySwannGT/lisa#3715, direction 3).
+ *
+ * Two sources, and the line says which one it used. The tool's own header is
+ * preferred because it is the tool's account of itself; the gate's working
+ * directory is the fallback because it is a fact the runner always has. An
+ * earlier version quoted ONLY the header and fell silent when it was absent —
+ * measured on CI, where the header did not appear in the captured transcript
+ * and jest never prints one at all. A direction that reads "make the run state
+ * its root" is not satisfied by a line that appears when the tool feels like
+ * it; that is the same defect one field over.
+ * @param {string} output The command's combined output.
+ * @param {string} cwd The directory the gate command ran in.
+ * @returns {string} An evidence line naming the root and its source.
+ */
+function rootLine(output, cwd) {
+  const match = RUN_ROOT_PATTERN.exec(output);
+  return match
+    ? `the run's root was ${match[1].trimEnd()}, as the tool reported it`
+    : `the run's root was ${cwd}, the directory the gate ran in — the tool printed none`;
+}
+
+/**
+ * What an operator does about a gate that collected nothing.
+ *
+ * Two remedies and no third, because there are exactly two true situations: the
+ * suite exists and the invocation missed it, or the suite does not exist and
+ * the gate should not have been declared. `--passWithNoTests` is named outright
+ * because it is the flag that converts the second into a green report, and it
+ * ships in the integration script of several stack templates for a real reason
+ * — a project may genuinely have no integration tests yet. That reason is an
+ * argument for declaring the gate `off`, never for a gate reporting PASSED.
+ */
+const ZERO_WORK_REMEDY =
+  "declaring this gate means declaring that work exists — either point the " +
+  "command at the suite it was meant to run, or declare the gate `off` for " +
+  "this moment; `--passWithNoTests` on a gate command turns a missing suite " +
+  "into a green report";
+
+/**
+ * The verdict for a command that exited 0 while stating it did no work.
+ *
+ * The success branch is where this defect lives, and it is the one branch the
+ * zero-collection diagnosis could not reach: `execute()` returned PASSED on
+ * `code === 0` without ever reading the output, so every pattern in this file
+ * — including {@link noTestsVerdict}, written for exactly this event — was
+ * unreachable on the path that needed it (CodySwannGT/lisa#3715).
+ *
+ * A separate entry point from {@link diagnoseFailure} rather than a widening of
+ * it, because the two are asked different questions. `diagnoseFailure` is asked
+ * "what went wrong", and always has an answer. This is asked "did anything
+ * happen at all", and its ordinary answer is null: silence means the command
+ * said nothing about a count, which stays PASSED and keeps the blast radius off
+ * every non-test gate.
+ * @param {string|null|undefined} output The command's combined output, or null
+ *   when the runner could not capture it. An uncaptured success stays a
+ *   success — capture is on by default, and its loss is not evidence.
+ * @param {string} [cwd] The directory the gate command ran in, quoted when the
+ *   tool printed no root of its own. Defaults to this process's; injected by
+ *   tests so a fixture needs no directory on disk.
+ * @returns {Diagnosis|null} The verdict, or null when the output carries no
+ *   positive statement that nothing ran.
+ */
+export function diagnoseHollowSuccess(output, cwd = process.cwd()) {
+  // A type-contract check at the module boundary, and deliberately the only
+  // guard here: an EMPTY transcript states nothing, so the search below
+  // already answers null for it and a second check on its length would be a
+  // branch no test could ever kill — a poor thing to ship in the file whose
+  // subject is controls that cannot fire. This one is kept anyway, and is
+  // itself an equivalent mutant under the caller's contract: `normaliseExec`
+  // hands over `string | null`, and a null would fall through the search too,
+  // by way of `RegExp.test` coercing it to the characters "null". Relying on
+  // that coincidence is worse than stating the type.
+  if (typeof output !== "string") return null;
+  const empty = ZERO_WORK_SIGNATURES.find(
+    signature =>
+      signature.states.test(output) && !signature.contradicted.test(output)
+  );
+  if (!empty) return null;
+  const stated = output
+    .split("\n")
+    .map(line => line.trim())
+    .filter(line => empty.states.test(line));
+  return {
+    evidence: capped([...stated, rootLine(output, cwd), ZERO_WORK_REMEDY]),
+    kind: DIAGNOSIS.NO_TESTS_RAN,
+    proves: ATTRIBUTION[DIAGNOSIS.NO_TESTS_RAN] ?? null,
+    summary:
+      `the command exited 0 and ${empty.tool} said it collected ZERO test ` +
+      "files, so this gate is attesting to work that never happened — exit 0 " +
+      "here reports that nothing ran, NOT that anything passed",
+  };
+}
+
 /**
  * Which gate's property each kind of failure actually belongs to.
  *

package/all/copy-overwrite/scripts/lisa-enforcement-fallback.sh

@@ -276,6 +276,178 @@ resolve_vintages() {
     plugin_tree_version="$json_version"
   fi
   note_version "$plugin_tree_version" "$plugin_tree"
+
+  # The channel this dispatcher races. Deliberately NOT folded into
+  # `note_version`: the newest-on-disk maximum answers "is this copy behind
+  # something local", and the plugin channel's age is a separate question
+  # about a copy that runs in parallel rather than instead.
+  resolve_plugin_channel || true
+}
+
+# ---------------------------------------------------------------------------
+# The other channel
+#
+# YOU CANNOT RETIRE A REFUSAL BY SHIPPING A FIX.
+#
+# These guards reach an agent by two independent channels: this dispatcher,
+# registered in `.claude/settings.json`, and the plugin manifest, which
+# registers the same guards individually. An agent sees the UNION of the two
+# verdicts, so a TIGHTENING on either channel takes effect at once while a
+# RELAXATION is inert until the slower channel catches up — the stale copy goes
+# on refusing, and its refusal wins. What the operator sees is a guard blocking
+# something `main` already permits, which reads as the guard being WRONG rather
+# than OLD, and the move that reading suggests is to route around it.
+#
+# The two channels are two different files refreshed by two different
+# mechanisms: `scripts/lisa-hooks/` when `lisa apply` runs, the plugin's own
+# `hooks/` when the plugin updates. They drift. Measured on one machine on one
+# day, two checkouts of the SAME repository resolved plugin 4.32.2 and 4.47.0.
+#
+# `plugin_tree` above cannot see any of that: it is repo-relative, so it exists
+# only inside the Lisa monorepo, and in a host project the plugin actually in
+# force is somewhere else entirely. The vintage machinery written for #3205
+# was therefore blind to the channel it races. This resolves it properly, from
+# the record the runtime itself keeps.
+#
+# WHAT THIS RECORD CAN AND CANNOT ANSWER. The header above explains why a
+# previous stand-down keyed on `installed_plugins.json` was removed: the record
+# is project-blind as it was read then, enablement-blind (`enabledPlugins` can
+# switch a plugin off without removing its entry), and session-blind (hooks load
+# at session start; the record is rewritten on any install). Those defeat a
+# LIVENESS question — "are the plugin's guards running in this session?" — and
+# nothing on disk answers that one.
+#
+# This asks a different question: "what VINTAGE is the plugin installed for this
+# project?" The record answers that directly, and the project-blindness is
+# resolved by keying the lookup on this repo root rather than on the plugin name.
+# The remaining two blindnesses bound the claim rather than break it: a skew
+# reported here is a real difference between two copies on disk, but a disabled
+# or not-yet-loaded plugin may mean those copies are not both firing right now.
+# So the wording below reports what is INSTALLED and what the union WOULD mean,
+# and never asserts that both channels are live. Reporting is also why this may
+# use the record at all where a stand-down may not: an over-reported skew costs
+# a line of notice, while an over-confident stand-down costs enforcement.
+plugin_channel_version=""
+plugin_channel_path=""
+
+# Resolve the vintage of the guard channel the PLUGIN MANIFEST runs.
+#
+# `plugins/installed_plugins.json` records installs PER PROJECT DIRECTORY —
+# which is exactly why one checkout sits versions behind another on the same
+# disk — so the lookup is keyed on this repo root, not on the machine.
+#
+# A record is claimed only when its `installPath` sits under a `lisa/lisa/`
+# marketplace cache. A locally-installed plugin does not match and is left
+# UNRESOLVED on purpose: reporting "agree" about a copy that was never read is
+# the failure this whole section exists to end, and an honest "I could not
+# tell" is the safe direction.
+#
+# `grep` does the scanning because the record runs to tens of thousands of
+# lines; the bash loop then sees a handful. Called only from resolve_vintages,
+# so it inherits that latch and never runs on the silent allow path.
+resolve_plugin_channel() {
+  local config_dir="${CLAUDE_CONFIG_DIR-}"
+  [ -n "$config_dir" ] || config_dir="${HOME-}/.claude"
+  local record="$config_dir/plugins/installed_plugins.json"
+  [ -f "$record" ] || return 1
+
+  local install_pattern="^[[:space:]]*\"installPath\"[[:space:]]*:[[:space:]]*\"(.*/lisa/lisa/[^\"]+)\""
+  local version_pattern="^[[:space:]]*\"version\"[[:space:]]*:[[:space:]]*\"([^\"]+)\""
+  local line
+  local candidate=""
+  while IFS= read -r line || [ -n "$line" ]; do
+    # `grep -A` separates non-adjacent groups with `--`. A candidate must not
+    # survive across that boundary or one plugin's installPath answers for
+    # another plugin's version.
+    if [ "$line" = "--" ]; then
+      candidate=""
+      continue
+    fi
+    if [[ "$line" =~ $install_pattern ]]; then
+      candidate="${BASH_REMATCH[1]}"
+      continue
+    fi
+    if [ -n "$candidate" ] && [[ "$line" =~ $version_pattern ]]; then
+      plugin_channel_path="$candidate"
+      plugin_channel_version="${BASH_REMATCH[1]}"
+      return 0
+    fi
+  done < <(grep -F -A4 "\"projectPath\": \"$repo_root\"," "$record" 2>/dev/null)
+  return 1
+}
+
+# Verdict of the last classify_channel_skew call: agree | skew | undetermined.
+#
+# Three answers, never two. "The channels agree" and "I could not read one of
+# them" are DIFFERENT facts, and collapsing them is how a probe reports success
+# while measuring nothing.
+#
+# THIS PROBE REPORTS. IT NEVER BLOCKS. A permitted command stays permitted
+# whatever the verdict, and the finding goes into the once-per-session notice.
+# That is a decision, not an oversight, so here is the reasoning for whoever
+# comes to change it:
+#
+#   - The two error directions have asymmetric costs. An over-reported skew
+#     costs a line of notice; an over-confident stand-down costs enforcement.
+#     When the costs are that lopsided the direction is settled without needing
+#     to argue about likelihood.
+#   - Failing closed on `undetermined` would refuse work on every host with no
+#     `installed_plugins.json` — containers, fresh clones, non-Claude runtimes.
+#     That is a large population with nothing wrong with it, and refusing them
+#     is a bigger fault than the one being detected.
+#   - What is detected is two copies at different AGES, not a compromised
+#     guard. Blocking on it turns a diagnostic into an outage.
+#   - And the practical argument, which beats the principled one: skew is the
+#     common case on a developer machine right now, so as a blocker this would
+#     be a permanent stop-work and the first response would be to switch it
+#     off. A blocker everyone turns off protects nothing.
+#
+# Pinned by the test named "lets a permitted command through whatever the
+# verdict is", which asserts exit 0 on both the skew and undetermined arms.
+channel_skew_verdict="undetermined"
+channel_skew_line=""
+
+# Compare the vintage of the channel this dispatcher runs against the vintage
+# of the channel the plugin manifest runs.
+classify_channel_skew() {
+  local mine=""
+  if [ "$host_tree_used" -eq 1 ]; then
+    mine="$host_tree_version"
+  elif [ "$plugin_tree_used" -eq 1 ]; then
+    mine="$plugin_tree_version"
+  fi
+
+  if [ -z "$mine" ] || [ -z "$plugin_channel_version" ]; then
+    channel_skew_verdict="undetermined"
+    channel_skew_line="  cross-channel vintage UNDETERMINED — this dispatcher's guards could not be
+    compared with the plugin manifest's copies. Not agreement: an unread copy
+    can be any age, and a relaxation shipped to one channel stays inert until
+    the other catches up.
+"
+    return 0
+  fi
+
+  if [ "$mine" = "$plugin_channel_version" ]; then
+    channel_skew_verdict="agree"
+    channel_skew_line=""
+    return 0
+  fi
+
+  channel_skew_verdict="skew"
+  # The sentence is kept whole on one line on purpose: it is the finding, and
+  # an operator greps for it.
+  channel_skew_line="  cross-channel vintage SKEW — this dispatcher runs lisa $mine; the plugin
+    installed for this project is lisa $plugin_channel_version at $plugin_channel_path.
+    When both fire on one tool call the agent sees the UNION of their verdicts,
+    which means:
+      YOU CANNOT RETIRE A REFUSAL BY SHIPPING A FIX.
+    A relaxation on the newer channel does nothing until the older one is
+    refreshed, so a block you cannot explain from \`main\` is the older copy
+    still enforcing.
+      repair: refresh both — \`npx @codyswann/lisa apply\` for this checkout's
+      guards, and update the installed plugin for the manifest's copies.
+"
+  return 0
 }
 
 # Description of the last describe_vintage call.
@@ -613,8 +785,10 @@ if [ "$notice_due" -eq 1 ]; then
   if [ "$plugin_tree_used" -eq 1 ]; then
     note_tree_staleness "$plugin_tree" "$plugin_tree_version" "$PLUGIN_REPAIR"
   fi
+  classify_channel_skew
 
-  if [ -n "$stale_notice" ] || [ -n "$shadowed" ] || [ -n "$missing" ]; then
+  if [ -n "$stale_notice" ] || [ -n "$shadowed" ] || [ -n "$missing" ] || \
+    [ -n "$channel_skew_line" ]; then
     # Claim the session BEFORE printing. A failed `mkdir` suppresses this copy
     # only when another process left the expected real directory behind. Every
     # other failure leaves the claim unproven and prints, so an unwritable state
@@ -650,6 +824,9 @@ if [ "$notice_due" -eq 1 ]; then
         if [ -n "$missing" ]; then
           printf '  unresolved guards: %s (no copy was dispatched)\n' "$missing"
         fi
+        if [ -n "$channel_skew_line" ]; then
+          printf '%s' "$channel_skew_line"
+        fi
       } >&2
     fi
   fi

package/all/copy-overwrite/scripts/lisa-hooks/block-direct-issue-create.sh

@@ -497,6 +497,82 @@ project_dir = os.environ.get("LISA_GUARD_PROJECT_DIR", "")
 OVERRIDE_NAME = "LISA_ALLOW_DIRECT_ISSUE_CREATE"
 HUMAN_GATE_MARKER = "[lisa-human-gate]"
 
+# Decoration a hold declaration may sit behind, and nothing more: whitespace,
+# blockquote arrows, list bullets or numbers, emphasis, an opening HTML
+# comment. One character class plus two optional groups, deliberately not a
+# nested quantifier — this runs over untrusted issue bodies.
+HUMAN_GATE_DECORATION = re.compile(r"^[ \t>*_+#-]*(?:\d+[.)][ \t]*)?(?:<!--[ \t]*)?[ \t]*")
+HUMAN_GATE_FENCE = re.compile(r"```.*?```", re.DOTALL)
+HUMAN_GATE_CODE_SPAN = re.compile(r"`[^`\n]*`")
+
+
+def declares_human_gate(text):
+    """Whether a text DECLARES a hold rather than mentioning one.
+
+    The comment this replaces said the marker is matched anywhere because it
+    "has no other meaning, so its presence in the title or body IS the
+    declaration". That was true when written and is false now: the marker
+    acquired a second meaning -- being discussed -- the moment the feature
+    became something people file tickets about, and a ticket about the marker
+    then declares a hold on itself (CodySwannGT/lisa#3815).
+
+    A declaration is POSITIONAL: the marker leads its line, behind at most the
+    decoration above, with fenced blocks and inline code spans removed first
+    because that is how the marker is written ABOUT. The same rule the intake
+    matcher applies, so the two surfaces cannot disagree about one body.
+
+    NOTE the direction here differs from the intake matcher's. There a match
+    HOLDS an item, so a false positive parks work. Here a match ADMITS a
+    filing, so a false positive is a hole -- which makes this the tightening
+    direction on both sides at once.
+
+    Args:
+        text: Any candidate text -- one argv value, a body file, a payload.
+
+    Returns:
+        True when some line of the text declares a hold.
+    """
+    if not text:
+        return False
+    body = HUMAN_GATE_CODE_SPAN.sub("", HUMAN_GATE_FENCE.sub("", str(text)))
+    for line in body.split("\n"):
+        if HUMAN_GATE_DECORATION.sub("", line, count=1).startswith(
+            HUMAN_GATE_MARKER
+        ):
+            return True
+        if _comment_carries_marker(line):
+            return True
+    return False
+
+
+def _comment_carries_marker(line):
+    """Whether an HTML comment on this line carries the marker.
+
+    The second accepted form, and the one this guard needs most: its inputs
+    are not markdown documents. A `--body` value is a single line, and a shell
+    script writes its declaration as `# <!-- ... -->`, so a purely
+    line-leading rule would refuse two declarations people have already
+    written -- both of which are in this repository's own test corpus.
+
+    It is not a loosening. An HTML comment is invisible when rendered, so
+    nobody wraps one around the marker in order to TALK about it; a quotation
+    has to be visible to be a quotation. Measured over this repository's 42
+    matching issue bodies, adding this branch changes not one verdict.
+
+    Args:
+        line: One line of text.
+
+    Returns:
+        True when some comment on the line contains the marker.
+    """
+    segments = line.split("<!--")
+    for segment in segments[1:]:
+        close = segment.find("-->")
+        inside = segment if close == -1 else segment[:close]
+        if HUMAN_GATE_MARKER in inside:
+            return True
+    return False
+
 # ---------------------------------------------------------------------------
 # WHY THIS IS A TOKEN SCAN AND NOT A PROGRAM RESOLVER
 #
@@ -583,7 +659,7 @@ LABEL_FLAGS = {"--label", "--labels", "--add-label", "--status", "--state"}
 #   None — container: state rolls up from children
 #
 # It is a marker with no other meaning, so it is matched wherever the payload
-# reaches — exactly the asymmetry `HUMAN_GATE_MARKER` gets, and for the same
+# reaches — the asymmetry `HUMAN_GATE_MARKER` gets, and for the related
 # reason. Reading the declaration the writer already emits is also what keeps
 # the guard and the skill from drifting apart a second time: there is one
 # string, defined in one rule, and both read it.
@@ -1226,7 +1302,7 @@ def text_declares_readiness(text):
     Returns:
         True when the text declares build-ready or a human gate.
     """
-    if HUMAN_GATE_MARKER in text:
+    if declares_human_gate(text):
         return True
     for role in (ready_role, upstream_ready_role, default_ready_role):
         if not role:
@@ -1270,7 +1346,7 @@ def scope_declaration(text, state_role_ok):
     Returns:
         True when the text carries a whole-scope declaration.
     """
-    if HUMAN_GATE_MARKER in text:
+    if declares_human_gate(text):
         return True
     return bool(state_role_ok and LIFECYCLE_ROLE_READY.search(text))
 
@@ -1500,20 +1576,23 @@ def declares_readiness(raw_args, roles, extra="", state_role_ok=False):
             candidates = [part.strip().strip("'\"") for part in raw.split(",")]
             if role in candidates:
                 return True
-    # The human-gate marker is matched anywhere, and that asymmetry is
-    # deliberate: it is a marker with no other meaning, so its presence in the
-    # title or body IS the declaration. The build-ready role is an ordinary
-    # string that appears in prose about the queue all the time.
-    if HUMAN_GATE_MARKER in " ".join(args):
+    # Checked per ARGV VALUE rather than against `" ".join(args)`, and that is
+    # what makes the positional rule mean anything here. Joining first destroys
+    # position: after a join, no value's line start survives except the first
+    # argument's, so "the marker leads its line" would be decided by argument
+    # order. A `--title` value is its own single line, which is exactly the
+    # unit the rule is about -- and titles must keep being read, since this
+    # guard reads them and the intake matcher does not.
+    if any(declares_human_gate(value) for value in args):
         return True
     for path in body_file_paths(args):
         try:
             with open(path, encoding="utf-8", errors="replace") as handle:
-                if HUMAN_GATE_MARKER in handle.read():
+                if declares_human_gate(handle.read()):
                     return True
         except OSError:
             continue
-    if extra and HUMAN_GATE_MARKER in extra:
+    if declares_human_gate(extra):
         return True
     # The state-based path. Scoped by `state_role_ok` rather than checked
     # unconditionally, so this adds a compliant command where none existed and

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -29,6 +29,11 @@
 #     divergence: upstream blocks unconditionally; Lisa allows clean-tree resets.
 #     Residual risk (documented, accepted): the dirty check runs in the hook's
 #     cwd at hook time, so a `cd elsewhere && git reset --hard` evades it.
+#   - `git read-tree` with an update flag AND `--reset` while the working tree
+#     is dirty (issue #3978): the plumbing spelling of the same discard, on the
+#     same condition, printing the same remedy. Index-only `read-tree`, and
+#     `read-tree -m -u` without `--reset` (which git itself refuses rather than
+#     clobber a modified file), stay allowed. Lisa-only guard.
 #   - `git rebase --abort`/`--quit` while the in-progress rebase holds
 #     human-made conflict resolutions (AUTO_MERGE discriminator; issue #1956).
 #     Clean or untouched rebase state stays abortable; the apply backend and a
@@ -1822,6 +1827,45 @@ $DESTRUCTIVE_GUIDANCE"
   fi
 fi
 
+# 3a. `git read-tree` with BOTH an update flag and `--reset`, on the same dirty
+#     tree — the plumbing spelling of guard 3 (issue #3978). It resets the index
+#     and writes the result into the working tree, discarding tracked
+#     modifications: the identical destruction, reached through a command that
+#     carries no `--hard` and no `reset` subcommand, so every pattern in
+#     guard 3 misses it. A guard an agent can walk around is a guard that stops
+#     the honest caller and not the one looking for a way through, and this
+#     spelling is strictly worse than the blocked one — it discards WITHOUT
+#     preserving, which is exactly the property guard 3's remedy supplies. Both
+#     refusals therefore print the same $PRESERVE_GUIDANCE, so what they teach
+#     cannot drift apart.
+#
+#     `--reset` is the discriminator, not `-u`, and the pairing is deliberate:
+#
+#     - `read-tree` with no update flag touches the INDEX only and destroys
+#       nothing in the working tree, so a blanket `read-tree` block would be
+#       over-broad.
+#     - `read-tree -m -u` (a merge without `--reset`) is safe by git's own
+#       construction: it REFUSES rather than overwrite a locally modified file
+#       ("entry would be overwritten by merge"). `--reset` is precisely the flag
+#       that switches that refusal off.
+#
+#     So the destructive combination is an update flag AND `--reset` together,
+#     in either order. The update flag is matched in the checkout guard's idiom
+#     so a bundled short option (`-iu`) cannot dodge the anchor, with leading
+#     whitespace required so a `--index-output=/tmp/out-u` style value cannot
+#     read as the flag. Same conditional dirty-tree shape and same accepted
+#     residual risk as guard 3: the probe runs in the hook's cwd at hook time.
+readonly GIT_READ_TREE="${GIT_CMD}read-tree"
+if matches "${GIT_READ_TREE}"'[^;&|]*[[:space:]]--reset([[:space:]]|$)' \
+  && matches "${GIT_READ_TREE}"'[^;&|]*[[:space:]](-[[:alnum:]]*u[[:alnum:]]*|--update)([[:space:]]|=|$)'; then
+  if git rev-parse --is-inside-work-tree >/dev/null 2>&1 \
+    && [ -n "$(git status --porcelain 2>/dev/null)" ]; then
+    block "git read-tree -u --reset on a dirty working tree would discard uncommitted changes (commit first, or preserve as below)" "$PRESERVE_GUIDANCE
+
+$DESTRUCTIVE_GUIDANCE"
+  fi
+fi
+
 # 3b. `git rebase --abort` / `--quit` ONLY while human/agent conflict
 #     resolutions exist (issue #1956). `--abort` restores the pre-rebase branch
 #     and discards every resolution; `--quit` deletes the rebase bookkeeping

package/all/copy-overwrite/scripts/lisa-lint-staged-preflight.mjs

@@ -376,7 +376,7 @@ export const run = async (argv, cwd) => {
  * @returns {boolean} Whether the CLI body should run.
  */
 export const invokedAsScript = (moduleUrl, argv1 = process.argv[1]) => {
-  if (argv1 === undefined || argv1 === "") return false;
+  if (typeof argv1 !== "string" || argv1.length === 0) return false;
   try {
     return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
   } catch {