@codyswann/lisa 4.54.13 → 4.55.0

package/all/copy-overwrite/scripts/lisa-hooks/guard-dedupe.bash

@@ -0,0 +1,340 @@
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
+# shellcheck shell=bash
+# Evaluate a dual-channel guard once per tool call, without de-registering it.
+#
+# Sourced — never executed — by every guard that Lisa registers on BOTH of its
+# enforcement channels: the repository dispatcher
+# (`scripts/lisa-enforcement-fallback.sh`, which sweeps the guard roster in one
+# process) and the plugin manifest, which registers the same guards
+# individually. On a machine where both are live the harness runs each guard
+# twice for one tool call. The verdicts agree — the guards are idempotent — so
+# the defect is cost, not correctness (CodySwannGT/lisa#3814).
+#
+# WHY THIS IS NOT "DROP ONE REGISTRATION".
+#
+# The obvious fix is to de-register the fallback where the plugin covers the
+# same ground. That fix cannot be made safely from here, and the reason is
+# written into the dispatcher itself: plugin-hook LIVENESS is not observable
+# from disk. `installed_plugins.json` answers "was this plugin ever installed",
+# which is project-blind, enablement-blind and session-blind — hooks load at
+# session start, the record is rewritten on any install. A stand-down keyed on
+# that record switched enforcement off in sessions where the plugin hooks were
+# not loaded, and did it silently. So the dispatcher runs unconditionally and
+# always will.
+#
+# What IS observable is EXECUTION. A guard that has already run in this session
+# from a different directory is proof — not inference — that a second channel is
+# live right now. This file turns that observation into a per-call memo, so the
+# second copy of an identical guard replays a verdict the first one produced
+# instead of computing it again. Nothing is de-registered, no matcher narrows,
+# and a host with the plugin absent takes the single-channel path where the memo
+# can never hit.
+#
+# WHAT THE MEMO IS ALLOWED TO SHORT-CIRCUIT, and the three conditions that make
+# it sound. Every one of them is a REFUSAL to dedupe when it cannot be proven:
+#
+#   1. BYTE-IDENTICAL CODE. The digest covers the guard script and this library
+#      verbatim. Two channels at different vintages therefore compute different
+#      keys and both run — which is required, because the agent is meant to see
+#      the UNION of two vintages' verdicts, and a tightening on either channel
+#      must take effect at once. Deduplicating across vintages would let the
+#      older, weaker copy answer for the newer one.
+#   2. IDENTICAL PAYLOAD, SAME TOOL CALL. The digest covers the payload and a
+#      per-call discriminator — the transcript's size, which grows with every
+#      turn. Without the discriminator a command repeated later in the session
+#      would hit a memo written before the repository changed underneath it, and
+#      a guard that classifies against the working tree would be answering with
+#      a stale verdict. No discriminator available means no memo.
+#   3. ALLOW VERDICTS ONLY. A refusal is never memoised and never replayed. That
+#      is deliberate: refusals are the rare path, so deduplicating them saves
+#      nothing measurable, and it removes the whole class of hazard the ticket
+#      names — a replayed refusal whose producing channel died mid-run, or a
+#      refusal reaching the agent without the message that explains it. On a
+#      refusal every channel evaluates and speaks exactly as it does today.
+#
+# COST ON THE PATH THAT GETS NO BENEFIT. A host with one channel must not pay
+# for a mechanism it cannot use. The channel check is builtins only — one small
+# file read, no subshell, no fork — and returns before the digest is computed
+# unless a second channel has actually been seen. The digest, and the one `stat`
+# that feeds it the per-call discriminator, are reached only where a second
+# channel is live, which is exactly where they are repaid.
+
+# Key this guard would memoise under, once computed. Empty means "record
+# nothing on exit".
+lisa_guard_memo_key=""
+
+# File that memo is written to.
+lisa_guard_memo_file=""
+
+# Base directory for memo state, resolved at most once per process.
+lisa_guard_memo_base=""
+
+# Whether a key was computed and a memo may be recorded on exit.
+lisa_guard_memo_ready=0
+
+# Digest tool for the memo key, resolved once. Empty disables the memo.
+lisa_guard_memo_digest_tool=""
+
+# Whether a directory is a real directory this user owns, and not a symlink —
+# builtins only, so this costs no process.
+#
+# `-O` is the load-bearing test: a memo planted by another user would suppress a
+# refusal, so a directory this user does not own is never used. The dispatcher
+# validates the whole parent chain before exporting `LISA_GUARD_MEMO_DIR`; this
+# re-checks the leaf rather than trusting the environment variable, because an
+# exported path is an input like any other.
+#
+# $1 - candidate directory
+lisa_guard_memo_dir_usable() {
+  [ -n "${1:-}" ] || return 1
+  [ -d "$1" ] || return 1
+  [ ! -L "$1" ] || return 1
+  [ -O "$1" ] || return 1
+}
+
+# Establish the memo base directory.
+#
+# Preferred source is `LISA_GUARD_MEMO_DIR`, exported by the dispatcher, which
+# has already resolved `TMPDIR` physically and walked every parent for ownership
+# and mode. Guards it spawns therefore pay nothing for that walk. A guard
+# reached by the plugin channel has no such parent, so it creates the directory
+# itself under `TMPDIR` — private by umask, and used only when this user owns
+# it. If neither works the memo is unavailable and every guard evaluates, which
+# is today's behaviour.
+lisa_guard_memo_resolve_base() {
+  [ -z "$lisa_guard_memo_base" ] || return 0
+
+  local candidate="${LISA_GUARD_MEMO_DIR:-}"
+  if lisa_guard_memo_dir_usable "$candidate"; then
+    lisa_guard_memo_base="$candidate"
+    return 0
+  fi
+
+  local uid="${LISA_GUARD_MEMO_UID:-}"
+  if [ -z "$uid" ]; then
+    uid="$(id -u 2>/dev/null || printf 'unknown')"
+  fi
+  candidate="${TMPDIR:-/tmp}"
+  candidate="${candidate%/}/lisa-guard-memo-$uid"
+  if [ ! -e "$candidate" ] && [ ! -L "$candidate" ]; then
+    (umask 077 && mkdir -p "$candidate") 2>/dev/null || true
+  fi
+  if lisa_guard_memo_dir_usable "$candidate"; then
+    lisa_guard_memo_base="$candidate"
+    return 0
+  fi
+  return 1
+}
+
+# Resolve a SHA-256 tool, or report that there is none.
+#
+# Two spellings because the guards run on macOS, on Linux CI images, and in
+# containers that carry neither. A missing digest tool disables dedupe rather
+# than degrading it to something weaker: a cheap checksum could collide, and a
+# collision here means a DIFFERENT payload reads as already-allowed, which is
+# lost enforcement rather than a slow guard.
+lisa_guard_memo_resolve_digest() {
+  [ -z "$lisa_guard_memo_digest_tool" ] || return 0
+  if command -v shasum >/dev/null 2>&1; then
+    lisa_guard_memo_digest_tool="shasum"
+  elif command -v sha256sum >/dev/null 2>&1; then
+    lisa_guard_memo_digest_tool="sha256sum"
+  else
+    return 1
+  fi
+  return 0
+}
+
+# Remove memo state older than a day.
+#
+# Files first, then the emptied session directories, both with `find -delete`.
+# Never a recursive forced delete: this runs unattended inside every guard, and
+# the blast radius of a mis-resolved base directory has to stay bounded to
+# entries this scheme itself created.
+lisa_guard_memo_sweep() {
+  find "$lisa_guard_memo_base" -mindepth 2 -maxdepth 2 -type f -mmin +1440 \
+    -delete 2>/dev/null || true
+  find "$lisa_guard_memo_base" -mindepth 1 -maxdepth 1 -type d -empty \
+    -mmin +1440 -delete 2>/dev/null || true
+}
+
+# Decide whether this guard has already been evaluated for this tool call, and
+# exit 0 in place of re-evaluating it when it has.
+#
+# Returns 0 for "carry on and evaluate". Never returns non-zero, so a caller
+# running under `set -e` is unaffected by it.
+#
+# $1 - guard name, used only to name the memo file
+# $2 - the raw tool payload this guard was handed on stdin
+lisa_guard_dedupe() {
+  local guard_name="${1:-}"
+  local payload="${2:-}"
+  [ -n "$guard_name" ] || return 0
+  [ -n "$payload" ] || return 0
+  [ -z "${LISA_GUARD_DEDUPE_DISABLE:-}" ] || return 0
+
+  # The session scopes every piece of state below. No session id means the
+  # payload came from a surface this cannot reason about — an adapter's
+  # synthesised envelope, a test harness — and the answer there is to evaluate.
+  local session_id=""
+  local session_pattern="\"session_id\"[[:space:]]*:[[:space:]]*\"([^\"]+)\""
+  if [[ "$payload" =~ $session_pattern ]]; then
+    session_id="${BASH_REMATCH[1]}"
+  fi
+  [ -n "$session_id" ] || return 0
+  # It is used as a path component, so anything that could escape the state
+  # directory disqualifies it outright.
+  case "$session_id" in *[!A-Za-z0-9._-]* | .*) return 0 ;; esac
+
+  lisa_guard_memo_resolve_base || return 0
+
+  local session_dir="$lisa_guard_memo_base/$session_id"
+  local fresh_session=0
+  if [ ! -d "$session_dir" ]; then
+    if (umask 077 && mkdir "$session_dir") 2>/dev/null; then
+      fresh_session=1
+    fi
+  fi
+  [ -d "$session_dir" ] || return 0
+  [ ! -L "$session_dir" ] || return 0
+
+  # Swept once, by the process that created the session directory, so a
+  # long-lived machine does not accumulate memo state. Off the hot path by
+  # construction: every later call in the session finds the directory present.
+  if [ "$fresh_session" -eq 1 ]; then
+    lisa_guard_memo_sweep
+  fi
+
+  # The directory this copy of the guard was served from. Two registrations of
+  # one guard are always two different directories — a repository tree or an
+  # applied `scripts/lisa-hooks/` on one side, a plugin cache on the other — so
+  # the set of directories seen this session IS the set of live channels.
+  local self_script="${BASH_SOURCE[1]:-$0}"
+  local self_dir="."
+  case "$self_script" in */*) self_dir="${self_script%/*}" ;; esac
+
+  local channels_file="$session_dir/channels"
+  local seen_self=0
+  local other_channel=0
+  local line=""
+  if [ -f "$channels_file" ]; then
+    while IFS= read -r line || [ -n "$line" ]; do
+      [ -n "$line" ] || continue
+      if [ "$line" = "$self_dir" ]; then
+        seen_self=1
+      else
+        other_channel=1
+      fi
+    done <"$channels_file"
+  fi
+  if [ "$seen_self" -eq 0 ]; then
+    printf '%s\n' "$self_dir" >>"$channels_file" 2>/dev/null || true
+  fi
+
+  # Single channel: the memo can never hit, so nothing below is worth its cost.
+  # This is the branch a host with no plugin takes on every call, and it is the
+  # reason the fork lives below this line rather than above it.
+  [ "$other_channel" -eq 1 ] || return 0
+
+  # The per-call discriminator. The transcript grows with every turn, so its
+  # size separates two identical commands issued at different points in one
+  # session — which matters because a guard classifies against a working tree
+  # that may have changed between them. Both channels read the same transcript
+  # within one tool call, and anything appended between them costs a memo miss,
+  # never a stale hit.
+  local transcript=""
+  local transcript_pattern="\"transcript_path\"[[:space:]]*:[[:space:]]*\"([^\"]+)\""
+  if [[ "$payload" =~ $transcript_pattern ]]; then
+    transcript="${BASH_REMATCH[1]}"
+  fi
+  [ -n "$transcript" ] || return 0
+  [ -f "$transcript" ] || return 0
+
+  lisa_guard_memo_resolve_digest || return 0
+
+  # The transcript's size, captured and VALIDATED before it can reach the
+  # digest, because a `stat` that rejects the other platform's spelling can
+  # still write to stdout on its way out. GNU `stat -f '%z' FILE` reads `-f` as
+  # `--file-system` and the format string as a FILE that does not exist: it
+  # exits non-zero AND prints a filesystem status block for the real operand,
+  # whose `Free` and `Available` counts move under any disk activity. Appended
+  # straight into the digest, that made the two channels of ONE tool call
+  # compute different keys, so the memo could only ever miss — the whole
+  # mechanism switched off on every Linux host, while the three "must not
+  # dedupe" controls stayed green because they assert a miss.
+  #
+  # Only an all-digits answer is accepted, and no size means NO MEMO rather
+  # than a memo with nothing separating one call from the next: that is
+  # condition 2 above, which the `A || B` spelling had left unenforced on a
+  # host carrying neither `stat`.
+  local transcript_size=""
+  transcript_size="$(stat -c '%s' "$transcript" 2>/dev/null)" ||
+    transcript_size=""
+  case "$transcript_size" in
+    "" | *[!0-9]*)
+      transcript_size="$(stat -f '%z' "$transcript" 2>/dev/null)" ||
+        transcript_size=""
+      ;;
+  esac
+  case "$transcript_size" in "" | *[!0-9]*) return 0 ;; esac
+
+  # One command substitution, covering everything the verdict depends on: the
+  # guard's own bytes, this library's bytes, the payload, and which call it is.
+  local key=""
+  key="$(
+    {
+      cat "$self_script" "${BASH_SOURCE[0]}" 2>/dev/null
+      printf '\n%s\n' "$payload"
+      printf '%s\n' "$transcript_size"
+    } | if [ "$lisa_guard_memo_digest_tool" = "shasum" ]; then
+      shasum -a 256 2>/dev/null
+    else
+      sha256sum 2>/dev/null
+    fi
+  )" || key=""
+  key="${key%% *}"
+  case "$key" in "" | *[!0-9a-f]*) return 0 ;; esac
+
+  # One memo file per guard per session, rewritten as the call moves on, so the
+  # state directory stays a fixed size however long a session runs. A saturated
+  # temp directory is its own outage on this fleet, and a memo scheme that grew
+  # a file per tool call would be one.
+  local memo_file="$session_dir/$guard_name.allow"
+  local recorded=""
+  if [ -f "$memo_file" ] && [ ! -L "$memo_file" ]; then
+    IFS= read -r recorded <"$memo_file" 2>/dev/null || recorded=""
+    if [ "$recorded" = "$key" ]; then
+      # A byte-identical copy of this guard already allowed this exact payload
+      # on this exact tool call. The evaluation being skipped could only have
+      # produced the verdict that was already delivered.
+      exit 0
+    fi
+  fi
+
+  lisa_guard_memo_key="$key"
+  lisa_guard_memo_file="$memo_file"
+  lisa_guard_memo_ready=1
+  return 0
+}
+
+# Record an ALLOW verdict for the other channel to replay. Installed as the
+# guard's EXIT trap, so it covers every path the guard can leave by.
+#
+# Any status other than 0 writes nothing and, when a memo from an earlier call
+# is still sitting there, removes it: a guard that refused must never leave
+# behind something that reads as permission.
+#
+# $1 - the exiting status
+lisa_guard_dedupe_record() {
+  [ "${lisa_guard_memo_ready:-0}" -eq 1 ] || return 0
+  [ -n "$lisa_guard_memo_file" ] || return 0
+  if [ "${1:-1}" -eq 0 ]; then
+    printf '%s\n' "$lisa_guard_memo_key" >"$lisa_guard_memo_file" 2>/dev/null ||
+      true
+  else
+    rm -f "$lisa_guard_memo_file" 2>/dev/null || true
+  fi
+  return 0
+}

package/all/copy-overwrite/scripts/lisa-hooks/parity-safety-net.sh

@@ -121,6 +121,27 @@ trap 'printf "%s\n" "Blocked by safety-net: hook failed while parsing its input;
 
 input="$(cat)"
 
+# Evaluate once per tool call when this guard is registered on both channels.
+#
+# Lisa reaches an agent through the repository dispatcher AND the plugin
+# manifest, and where both are live the harness runs this guard twice for one
+# tool call. `guard-dedupe.bash` short-circuits the second run ONLY when a
+# byte-identical copy already ALLOWED this exact payload on this exact tool
+# call; a differing vintage, a refusal, and a host with one channel all
+# evaluate exactly as before. Nothing is de-registered by it
+# (CodySwannGT/lisa#3814).
+#
+# Absent library means no dedupe, which is the pre-existing behaviour, so an
+# older channel copy that predates it is unaffected.
+lisa_guard_hook_dir="${BASH_SOURCE[0]%/*}"
+lisa_guard_dedupe_lib="$lisa_guard_hook_dir/guard-dedupe.bash"
+if [ -r "$lisa_guard_dedupe_lib" ]; then
+  # shellcheck source=guard-dedupe.bash
+  . "$lisa_guard_dedupe_lib"
+  trap 'lisa_guard_dedupe_record $?' EXIT
+  lisa_guard_dedupe parity-safety-net "$input"
+fi
+
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
 if [ "$tool_name" != "Bash" ]; then
   exit 0
@@ -247,12 +268,19 @@ later with `git apply "$patch"`.
 
 If the work is NOT yours -- a concurrent agent dirtied this worktree and your
 judgement is "none of this is mine" -- that same capture is how you return the
-tree to HEAD:
+tree to HEAD. This block is self-contained; paste it as it stands:
 
+  patch="$(mktemp "${TMPDIR:-/tmp}/lisa-preserve-XXXXXX")"
   git reset
   git diff --binary HEAD > "$patch"
   git apply -R "$patch"
 
+It names the file itself rather than inheriting one from the block above,
+because the two blocks are alternatives and only one of them gets run. A remedy
+printed at the moment an agent is blocked is followed literally; one that
+depends on a variable the reader never set fails on its first line, and the
+guard that printed it stops being believed.
+
 `git reset` clears staged and unmerged entries first, so the capture sees the
 whole tree as one diff; reversing it leaves the tree at HEAD with "$patch" as
 the record of what you discarded. Untracked files survive, exactly as they

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.mjs

@@ -405,6 +405,11 @@ function applyCd(current, target) {
  * disagreeing. The scripted form is the one neither covers, and it is the only
  * cell this arm fills.
  *
+ * That reason is a dependency on a runtime Lisa does not ship, and it can
+ * expire without anything here failing. It is pinned at
+ * {@link VERIFIED_RUNTIME_VERSION} and reported when the runtime moves off it
+ * — read that constant before widening this arm.
+ *
  * ## A relative script path is resolved against the cwd the command will have
  *
  * A leading `cd` establishes the directory this guard resolves relative tokens
@@ -514,11 +519,28 @@ function readState(sessionId) {
   }
 }
 
+/**
+ * Write the session's binding state, MERGING over whatever is already there.
+ *
+ * Every caller below hands in all three lifecycle fields explicitly, so the
+ * merge changes nothing for them — `claimedRoot: null` still clears a claim.
+ * What it buys is that a field one writer owns is not silently dropped by
+ * another writer that had no opinion about it: `runtimeNoticed` is written by
+ * {@link noticeRuntimeDrift} and read by nobody else, and a clobbering write
+ * would turn its "reported once" into "reported again after the next
+ * acknowledgement", which is the noise the notice is designed not to be.
+ * @param sessionId - The session whose state file this is
+ * @param state - Fields to write over the recorded state
+ * @returns Whether the write succeeded
+ */
 function writeState(sessionId, state) {
   const file = stateFile(sessionId);
   try {
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, `${JSON.stringify(state, null, 2)}\n`);
+    writeFileSync(
+      file,
+      `${JSON.stringify({ ...readState(sessionId), ...state }, null, 2)}\n`
+    );
     return true;
   } catch (error) {
     say(`could not record the binding (${error.message}); NOT enforcing`);
@@ -698,6 +720,162 @@ function displaced(bound, observed) {
   ]);
 }
 
+/**
+ * The runtime version the inline-redirect gap was last verified at.
+ *
+ * ## What this constant is a pin ON
+ *
+ * This guard deliberately does NOT refuse an INLINE redirect into another
+ * worktree — `cd <other> && git …`, `git -C <other> …`. The reason is good and
+ * is written out at {@link scriptReachingForeignTree}: the runtime's own
+ * worktree isolation already refuses them, and duplicating a control is how two
+ * controls drift into disagreeing about the same command.
+ *
+ * That reason is a DEPENDENCY on behaviour Lisa does not ship. It was verified
+ * refusing at this version, with the refusal wording "this command names git in
+ * a form too complex to verify that it stays inside the worktree" and
+ * "redirects git to the shared checkout via -C".
+ *
+ * ## Why a pin rather than a test
+ *
+ * The runtime's isolation is not reachable from a unit test: it adjudicates
+ * inside a live worktree-isolated session, and there is no entry point that
+ * takes one hook envelope and returns a verdict the way this guard does. So the
+ * dependency cannot be turned red by writing a test, and a claim that cannot go
+ * red goes stale silently instead (CodySwannGT/lisa#3944).
+ *
+ * What CAN be measured is whether the runtime is still the one the claim was
+ * checked against. That does not prove the behaviour changed — only that nobody
+ * has checked since, which is the honest thing to report and the whole of what
+ * this pin does.
+ *
+ * ## Moving it
+ *
+ * Re-run both inline forms in a worktree-isolated session. Still refused: move
+ * this pin, and say where. Permitted: those two cells are UNCOVERED, and #3944
+ * owns the decision about which of them Lisa takes on.
+ */
+const VERIFIED_RUNTIME_VERSION = "2.1.261";
+
+/** The ticket that owns the inline-redirect dependency and its expiry. */
+const RUNTIME_ASSUMPTION_TICKET = "CodySwannGT/lisa#3944";
+
+/**
+ * This session's runtime version, or null when this is not that runtime.
+ *
+ * Three answers, and the difference between the last two is the point:
+ * - `null` — not Claude Code. Codex, Cursor and Copilot ship this guard too,
+ *   and the assumption above is about a control none of them has. A notice that
+ *   fires on every session of every harness is noise, and noise gets switched
+ *   off.
+ * - `""` — Claude Code, which will not say which version. Read as a DIVERGENCE
+ *   rather than as a match: the assumption is unconfirmed either way, and
+ *   treating an unreadable version as "still 2.1.261" is exactly the silent
+ *   expiry #3944 was filed about.
+ * - a version — take it at its word.
+ *
+ * Both env vars are read because either can be the one a future release keeps.
+ * `AI_AGENT` carries `claude-code_2-1-261_agent`; `CLAUDE_CODE_EXECPATH` ends
+ * in the version directory the running build was launched from.
+ * @param env - Environment to read
+ * @returns The version, `""` when unreadable, or null for another runtime
+ */
+const isDigit = ch => ch >= "0" && ch <= "9";
+
+/** @param value - Segment to test @returns Whether it is all digits */
+const allDigits = value => value.length > 0 && [...value].every(isDigit);
+
+/** @param value - Segment to read @returns Its trailing digit run, else `""` */
+const trailingDigits = value => {
+  let start = value.length;
+  while (start > 0 && isDigit(value[start - 1])) start -= 1;
+  return value.slice(start);
+};
+
+function runtimeVersion(env) {
+  if (!env.CLAUDECODE) return null;
+  const tagged = /claude-code[_-](\d+)[-.](\d+)[-.](\d+)/u.exec(
+    env.AI_AGENT ?? ""
+  );
+  if (tagged) return `${tagged[1]}.${tagged[2]}.${tagged[3]}`;
+  // Read the version off the final path segment by scanning characters rather
+  // than by regex: an unanchored `\d+\.\d+\.\d+` before `$` backtracks
+  // super-linearly on a long execpath, and the version Claude Code launches
+  // from is always the trailing directory name.
+  const segments = (env.CLAUDE_CODE_EXECPATH ?? "").split("/").filter(Boolean);
+  const trailing = segments.length ? segments[segments.length - 1] : "";
+  const parts = trailing.split(".");
+  if (parts.length < 3) return "";
+  const [major, minor, patch] = parts.slice(-3);
+  const majorDigits = trailingDigits(major);
+  if (!majorDigits || !allDigits(minor) || !allDigits(patch)) return "";
+  return `${majorDigits}.${minor}.${patch}`;
+}
+
+/**
+ * The notice text for a runtime the inline-redirect claim was not checked at.
+ * @param version - The observed runtime version, `""` when unreadable
+ * @returns The lines to report
+ */
+function driftNotice(version) {
+  return [
+    "worktree-binding-guard: the inline-redirect gap is UNVERIFIED here.",
+    "",
+    "This guard does not refuse `cd <other-worktree> && git …` or",
+    "`git -C <other-worktree> …`. Those two cells are covered by the runtime's",
+    `own worktree isolation, verified refusing at Claude Code ${VERIFIED_RUNTIME_VERSION}.`,
+    version
+      ? `This session is running ${version}, so that check does not cover it.`
+      : "This session's runtime version could not be read, so nothing covers it.",
+    "",
+    "This does NOT say the runtime stopped refusing them — only that nobody has",
+    "checked since. Run both forms in a worktree-isolated session: still",
+    "refused, move VERIFIED_RUNTIME_VERSION in worktree-binding-guard.mjs;",
+    `permitted, the two cells are uncovered and ${RUNTIME_ASSUMPTION_TICKET}`,
+    "owns what Lisa does about it.",
+  ];
+}
+
+/**
+ * Report, once per session, that the runtime moved off the verified version.
+ *
+ * ## Why SessionStart and not the guarded call
+ *
+ * SessionStart is the guard's first evaluation of a session, it fires exactly
+ * once per start, and its `additionalContext` is the one channel here that the
+ * agent actually reads — the `say()` lines elsewhere in this file are for a
+ * human reading a transcript. A notice attached to a guarded tool call would
+ * either repeat on every Bash command or need a suppression rule of its own.
+ *
+ * ## Why it is recorded rather than counted
+ *
+ * A resume fires SessionStart again for the same session id. The recorded
+ * version is what makes the second one silent, and recording the VERSION rather
+ * than a flag means a runtime that moves twice inside one resumed session is
+ * still reported the second time.
+ *
+ * Never refuses. The dependency is a reporting gap, not a live displacement,
+ * and blocking a session over a version number would be a wall where an
+ * observation belongs.
+ * @param sessionId - The session being started
+ * @param env - Environment to read the runtime version from
+ * @returns Nothing; every path through this allows
+ */
+function noticeRuntimeDrift(sessionId, env) {
+  const version = runtimeVersion(env);
+  if (version === null || version === VERIFIED_RUNTIME_VERSION) return;
+  if (readState(sessionId)?.runtimeNoticed === version) return;
+  writeState(sessionId, { runtimeNoticed: version });
+  process.stdout.write(
+    `${JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "SessionStart",
+        additionalContext: driftNotice(version).join("\n"),
+      },
+    })}\n`
+  );
+}
+
 function evaluate(payload) {
   const sessionId = payload.session_id;
   const cwd = payload.cwd;
@@ -710,6 +888,10 @@ function evaluate(payload) {
 
   if (payload.hook_event_name === "SessionStart") {
     recordBaseline(sessionId, observed);
+    // After the baseline, never before: `recordBaseline` writes a fresh state
+    // for a session it has not seen, and the notice's record has to go on top
+    // of that write rather than under it.
+    noticeRuntimeDrift(sessionId, process.env);
     return 0;
   }
   if (payload.tool_name === "EnterWorktree") {

package/all/copy-overwrite/scripts/lisa-hooks/worktree-binding-guard.sh

@@ -39,6 +39,27 @@ set -uo pipefail
 
 input="$(cat)"
 
+# Evaluate once per tool call when this guard is registered on both channels.
+#
+# Lisa reaches an agent through the repository dispatcher AND the plugin
+# manifest, and where both are live the harness runs this guard twice for one
+# tool call. `guard-dedupe.bash` short-circuits the second run ONLY when a
+# byte-identical copy already ALLOWED this exact payload on this exact tool
+# call; a differing vintage, a refusal, and a host with one channel all
+# evaluate exactly as before. Nothing is de-registered by it
+# (CodySwannGT/lisa#3814).
+#
+# Absent library means no dedupe, which is the pre-existing behaviour, so an
+# older channel copy that predates it is unaffected.
+lisa_guard_hook_dir="${BASH_SOURCE[0]%/*}"
+lisa_guard_dedupe_lib="$lisa_guard_hook_dir/guard-dedupe.bash"
+if [ -r "$lisa_guard_dedupe_lib" ]; then
+  # shellcheck source=guard-dedupe.bash
+  . "$lisa_guard_dedupe_lib"
+  trap 'lisa_guard_dedupe_record $?' EXIT
+  lisa_guard_dedupe worktree-binding-guard "$input"
+fi
+
 if ! command -v node >/dev/null 2>&1; then
   printf 'worktree-binding-guard: node not found; worktree-binding enforcement is NOT active\n' >&2
   exit 0

package/all/copy-overwrite/scripts/lisa-postinstall.mjs

@@ -173,7 +173,27 @@ export function runPostinstall(cwd = process.cwd(), env = process.env) {
     // package manager finish. Unknown throws still escape because converting a
     // broken postinstall module into an apparent apply failure would hide the
     // defect that needs fixing.
-    if (!isChildTimeout(error)) throw error;
+    //
+    // The MARKER is written for an unknown throw too, before it escapes, and
+    // that is not the same decision as the exit code. The invocation this
+    // module is chained into ends in `|| true`, deliberately — a non-zero
+    // postinstall aborts `bun install` outright and strands the project with
+    // no way to install the fix. So the escaping throw reaches nothing that
+    // records it: the stack trace scrolls past once and every later instrument
+    // reads a project whose templates simply were not applied. `lisa doctor`
+    // asks the marker, and the marker was the only durable half. Writing it
+    // here keeps the loud-and-durable contract this module's header states,
+    // without trading it for an install that cannot complete.
+    if (!isChildTimeout(error)) {
+      recordFailure(cwd, {
+        status: null,
+        output:
+          error instanceof Error
+            ? (error.stack ?? error.message)
+            : String(error),
+      });
+      throw error;
+    }
     child = {
       error: Object.assign(
         new Error(