@codyswann/lisa 4.55.2 → 4.55.4

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/toolchain.mjs

@@ -56,7 +56,7 @@ export function extractVersion(output) {
 /**
  * Classify one required tool against what the environment actually provides.
  * @param {object} tool Manifest entry.
- * @param {{version: string|null, present: boolean}} found Probe result.
+ * @param {{version: string|null, present: boolean, executable: boolean}} found Probe result.
  * @returns {{name: string, action: string, reason: string}} The decision.
  */
 function planRequired(tool, found) {
@@ -70,6 +70,13 @@ function planRequired(tool, found) {
         `Either add an install entry or pin a different image.`,
     };
   }
+  if (found.executable !== true) {
+    return {
+      name: tool.name,
+      action: "missing",
+      reason: `${tool.name} was found but cannot be executed. Repair its permissions or replace the binary before using it.`,
+    };
+  }
   if (
     tool.minVersion &&
     compareVersions(found.version ?? "0", tool.minVersion) < 0
@@ -97,7 +104,7 @@ function planRequired(tool, found) {
  * and maintenance the same script, and it is the cheap path when a container
  * resumes from cache rather than being built fresh.
  * @param {object} tool Manifest entry.
- * @param {{version: string|null, present: boolean}} found Probe result.
+ * @param {{version: string|null, present: boolean, executable: boolean}} found Probe result.
  * @returns {{name: string, action: string, reason: string}} The decision.
  */
 function planInstallable(tool, found, pinIsFloor = false) {
@@ -108,7 +115,11 @@ function planInstallable(tool, found, pinIsFloor = false) {
       reason: `${tool.name} has no pinned version. An unpinned install is not reproducible.`,
     };
   }
-  if (found.present && found.version === tool.version) {
+  if (
+    found.present &&
+    found.executable === true &&
+    found.version === tool.version
+  ) {
     return {
       name: tool.name,
       action: "skip",
@@ -125,6 +136,7 @@ function planInstallable(tool, found, pinIsFloor = false) {
   if (
     pinIsFloor &&
     found.present &&
+    found.executable === true &&
     found.version &&
     compareVersions(found.version, tool.version) > 0
   ) {
@@ -286,10 +298,10 @@ export function appliesToSurface(tool, surface) {
  * asking about availability rather than provisioning has the answer instead of
  * having to infer one from the other.
  * @param {{require?: object[], install?: object[]}} tools Manifest.
- * @param {(name: string) => {version: string|null, present: boolean}} probe Version probe.
+ * @param {(name: string) => {version: string|null, present: boolean, executable: boolean}} probe Version probe.
  * @param {string} [surface] Surface being provisioned.
  * @param {string} [platform] Platform key to resolve install entries against.
- * @returns {Array<{name: string, action: string, reason: string, tool?: object, found?: {version: string|null, present: boolean}, unpinnedForPlatform?: boolean}>} Ordered decisions.
+ * @returns {Array<{name: string, action: string, reason: string, tool?: object, found?: {version: string|null, present: boolean, executable: boolean}, unpinnedForPlatform?: boolean}>} Ordered decisions.
  */
 export function planToolchain(
   tools,

package/plugins/lisa/skills/lisa-track/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Skill", "Bash", "Read"]
 
 # Track Work: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 Establish the tracked-work invariant before any durable project mutation. Discussion and read-only orientation may proceed without this skill; code, configuration, documentation, research artifacts, plans, investigation findings, tests, commits, and pull requests may not.
 
 This flow must return exactly one canonical `(tracker_provider, work_item_ref)` pair or fail closed. It never returns an unvalidated textual guess.
@@ -24,7 +38,7 @@ This flow must return exactly one canonical `(tracker_provider, work_item_ref)`
 
 ### Explicit reference
 
-Invoke `lisa-tracker-read <ref>` and require a live result from the configured project. Reject nonexistent, inaccessible, closed/resolved/terminal, wrong-project, wrong-repository, or container items. Read the returned body for the hold marker: an item carrying `[lisa-human-gate]` is held and Phase 3 refuses to claim it, whatever role or labels it carries. This live read is mandatory even if caller context already includes ticket text.
+Invoke `lisa-tracker-read <ref>` and require a live result from the configured project. Reject nonexistent, inaccessible, closed/resolved/terminal, wrong-project, wrong-repository, or container items. Read the returned body, labels and all comments; Phase 3 uses the shared hold classifier so a historical `[lisa-human-gate]` marker with a matching release is not mistaken for an active hold. This live read is mandatory even if caller context already includes ticket text.
 
 ### File or plain text
 
@@ -44,9 +58,23 @@ This is intentionally conservative: ambiguity creates one explicit work item ins
 
 ## Phase 3 — Claim and bind
 
-The work item is **held** when either of two independent signals is present: the caller declared a `human_gate`, or the resolved item's body contains the literal `[lisa-human-gate]` marker. Test the marker as a plain substring and never key the parse on a `reason=` value — markers are written both with and without one, and a parser that requires the key misses the keyless ones while appearing to work.
+The work item is **held** when the caller declared a `human_gate`, independently of any item history,
+or `classifyReadyCandidate({ labels, body, comments, trustedHumanActorIds, humanNeededLabel })` from the shipped
+`scripts/intake-blocker-reprobe.mjs` returns `claimable: false`. Pass the complete live comment
+history so a matching `[lisa-human-gate-release]` discharges the historical body marker. Never
+reimplement heldness as a substring test or as the negation of `planHumanGateRelease().released`:
+that planner also returns `released: false` for an item that was never held. Missing comments fail
+closed for a hold; never infer release from a missing label.
+
+A held item stops the flow here, whatever roles or labels it carries. Do not invoke
+`lisa-tracker-claim`, write the worktree binding, or begin durable project work. Return
+`claim_outcome: held-by-gate` and `binding_outcome: skipped-human-gate`, name the signal in `held_by`
+and carry its reason verbatim in `gate_reason` (null for a keyless hold), then stop.
 
-A held item stops the flow here, whatever the resolution outcome and whatever roles or labels the item carries. The marker is the authority: an item can be held while sitting in the build-ready role with no blocked or human-needed label, because a human stamping a hold on live work is the most likely way a gate is ever applied, and the vendor claim contracts reject a closed item or an active blocker but not a marked one. Do not invoke `lisa-tracker-claim`, do not write the worktree binding, and do not begin durable project work. Claiming a held leaf binds a live lane to it and makes it look already-attended, which suppresses exactly the human attention it was filed to attract. Return the structured result below with `claim_outcome: held-by-gate` and `binding_outcome: skipped-human-gate`, name which signal held it in `held_by` and carry the reason verbatim in `gate_reason` alongside the canonical reference, then stop. A marker written without a `reason=` key yields `gate_reason: null` — a missing reason narrows what the result can say, never whether the item is held.
+For a discharged item, call
+`planHumanGateRelease({ labels, body, comments, trustedHumanActorIds, humanNeededLabel, readyLabel, lifecycleLabels, alreadyNotified })`
+and apply only the returned actions before claiming. Keep the body marker as history; a release
+never overrides a new caller-declared hold or another eligibility check.
 
 Otherwise:
 
@@ -78,5 +106,5 @@ Otherwise:
 - Branch setup may call `node scripts/lisa-work-item.mjs attach-branch` after the feature branch exists.
 - Keep the binding across ordinary interruptions and blocked outcomes so resumed work remains attributable.
 - Clear it only after true terminal completion — merged, deployed/verified where required, tracker evidence/backlink complete, and the work item terminal — by running `node scripts/lisa-work-item.mjs clear` and verifying no current binding remains.
-- A held filing writes no binding at all, so there is nothing to clear. The gate is released by a human decision, but not by a human edit: the person records the decision as a comment on the leaf beginning `[lisa-human-gate-release]` and repeating the hold's `reason=` verbatim, and the next intake sweep takes the human-needed marker off and puts the leaf back in the build-ready role on its own (`planHumanGateRelease` in `scripts/intake-blocker-reprobe.mjs`). A later invocation then resolves it on the ordinary path. **Do not tell anyone to delete the marker from the description, and do not delete it here.** The only description write available is a whole-body replacement, so clearing one line means rewriting the entire record — which is why, before this, the rational move was always to leave a hold in place and answered holds only accumulated (CodySwannGT/lisa#3852). The hold stays in the body as history; the release is recorded beside it.
+- A held filing writes no binding at all, so there is nothing to clear. The gate is released by a human decision, but not by a human edit: the person records the decision as a comment on the leaf beginning `[lisa-human-gate-release]` and, for a keyed hold, repeating its `reason=` verbatim. For a keyless hold, the comment begins `[lisa-human-gate-release]` without a `reason=` field. The next intake sweep takes the human-needed marker off and puts the leaf back in the build-ready role on its own (`planHumanGateRelease` in `scripts/intake-blocker-reprobe.mjs`). A later invocation then resolves it on the ordinary path. **Do not tell anyone to delete the marker from the description, and do not delete it here.** The only description write available is a whole-body replacement, so clearing one line means rewriting the entire record — which is why, before this, the rational move was always to leave a hold in place and answered holds only accumulated (CodySwannGT/lisa#3852). The hold stays in the body as history; the release is recorded beside it.
 - A tracker outage, invalid item, failed claim, or failed binding blocks durable work. Never continue untracked and never ask a Git hook to create the item.

package/plugins/lisa/skills/lisa-tracker-build-intake/SKILL.md

@@ -6,6 +6,20 @@ allowed-tools: ["Skill", "Bash", "Read"]
 
 # Tracker Build Intake: $ARGUMENTS
 
+## Human-gate release authorization
+
+A release requires a trusted human author, not just matching comment text. Follow
+`ready-role-filing` — **Human-gate release authorization**: preserve tracker-supplied comment
+author IDs and bot metadata, resolve `trustedHumanActorIds` only from an explicit user instruction
+or existing human-authored trusted project policy, and pass it with structured `comments` to every
+hold classifier, reconciliation, normalization and release planner. Never derive trust from the
+comment body, a display name, the actor's own assertion, or an automation posting on its own behalf.
+Missing policy, missing/unreadable author identity, raw body strings, untrusted actors and known bots
+cannot discharge a hold. Keep the item held and report the missing authorization; do not silently
+replace these inputs with an empty history or an inferred allowlist. Authorized matching releases
+continue through the existing path and never override an independently declared caller hold.
+
+
 Thin dispatcher. Resolves the configured destination tracker and delegates to the matching vendor build-queue scanner.
 
 See the `config-resolution` rule for configuration and dispatch table.
@@ -63,7 +77,7 @@ blocker re-probe carries an absolute human gate: an item carrying the configured
 or a `[lisa-human-gate]` marker is never auto-selected, whatever a probe returns.
 
 That gate has an inverse, and it is forwarded identically: a hold ends when a
-`[lisa-human-gate-release]` comment naming the same `reason=` is recorded on the item. Every vendor
+`[lisa-human-gate-release]` comment naming the same `reason=` is recorded on the item by an authorized human. Every vendor
 scanner passes the item's `comments` into the gate helpers so the discharge is visible, and calls
 `planHumanGateRelease(...)` to take the marker off and put the item back in the queue. **No vendor
 scanner clears a hold by editing the description** — the only body write any of them has is a

package/plugins/lisa-agy/hooks/block-blind-automerge.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook for Bash: refuse to ARM auto-merge on a pull request that
 # GitHub already says is blocked on review.
 #
@@ -280,7 +283,8 @@ NODE_ID_PATTERN = re.compile(r"^[A-Za-z0-9_=-]+$")
 NODE_QUERY = (
     "query($id:ID!){node(id:$id){... on PullRequest"
     "{number url reviewDecision state baseRefName "
-    "commits(last:1){nodes{commit{statusCheckRollup{contexts(first:100){nodes{"
+    "commits(last:1){nodes{commit{statusCheckRollup{contexts(first:100){"
+    "pageInfo{hasNextPage} nodes{"
     "__typename ... on CheckRun{name conclusion} "
     "... on StatusContext{context state}"
     "}}}}}}}}}"
@@ -294,9 +298,13 @@ NODE_QUERY = (
 # checks, which is genuinely not failing and gets an empty list. A node without
 # the scaffolding is a probe that never asked, and it must leave the key absent
 # so the re-target path can tell the two apart instead of reading both as green.
+# A truncated page is equally unreadable: a failing check may be on the next
+# page, so a green first page cannot authorize an uncovered-base re-target.
 NODE_JQ = (
     "if .data.node == null then null else .data.node as $n "
-    "| if ($n | has(\"commits\")) then ($n | del(.commits)) "
+    "| if ($n.commits.nodes[0].commit.statusCheckRollup.contexts.pageInfo.hasNextPage == true) "
+    "then ($n | del(.commits)) "
+    "elif ($n | has(\"commits\")) then ($n | del(.commits)) "
     "+ {statusCheckRollup: "
     "((($n.commits.nodes[0].commit.statusCheckRollup.contexts.nodes)) // [])} "
     "else $n end end"
@@ -1024,9 +1032,9 @@ not read the pull request's checks.
 
 That ref has ZERO required status checks, so the one thing standing between the
 move and a permission-free gate bypass is whether the PR is currently failing —
-and the probe returned no `statusCheckRollup` at all. An absent rollup is not an
-empty one. Reporting the move as the sanctioned green-PR batching case here
-would be a verdict about a question that was never asked.
+and the probe returned no complete `statusCheckRollup`. An absent or truncated
+rollup is not an empty one. Reporting the move as the sanctioned green-PR
+batching case here would claim a result the probe did not establish.
 
 Re-target through `gh pr edit --base` instead, which reads the checks, or fix
 the probe. Do not report the PR as batched until something has actually looked.

package/plugins/lisa-agy/hooks/block-direct-issue-create.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook for Bash: refuse a direct tracker-creation command that
 # declares no readiness.
 #
@@ -2106,6 +2109,10 @@ def unparseable_reads_only(text):
     Returns:
         True when every segment's command word is a known reader.
     """
+    # Unlexable operands cannot be certified as data when shell substitutions
+    # may execute inside them. Preserve the plain apostrophe reader exemption.
+    if any(operator in text for operator in ("$(", "`", "<(", ">(")):
+        return False
     words = raw_command_words(text)
     return bool(words) and all(word in READ_ONLY_PROGRAMS for word in words)
 

package/plugins/lisa-agy/hooks/block-instruction-file-edits.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook: refuse agent writes to the session-instruction files.
 #
 # `AGENTS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` are the files

package/plugins/lisa-agy/hooks/block-managed-file-edits.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook: refuse agent writes to files Lisa overwrites on every apply.
 #
 # Lisa ships templates in three modes, and only one of them is unsafe to edit:
@@ -566,6 +569,7 @@ EOF
 import os
 import re
 import shlex
+import sys
 
 command = os.environ.get("MANAGED_EDIT_COMMAND", "")
 project = os.environ.get("MANAGED_EDIT_PROJECT", "") or os.getcwd()
@@ -576,6 +580,7 @@ project = os.environ.get("MANAGED_EDIT_PROJECT", "") or os.getcwd()
 FOLLOW_MAX_BYTES = 262144
 FOLLOW_MAX_FILES = 8
 FOLLOW_MAX_DEPTH = 3
+ENV_SPLIT_UNRESOLVED = 42
 
 # Spelled with chr() rather than backslash escapes on purpose. This source is
 # embedded in a shell heredoc and copied verbatim through several generators
@@ -607,7 +612,7 @@ FOLLOW_WRAPPERS = {
     # positional count: the walk below re-enters its assignment skip on the
     # next iteration and steps over as many as are present.
     "env": (
-        frozenset({"-C", "--chdir", "-P", "-S", "--split-string", "-u", "--unset"}),
+        frozenset({"-C", "--chdir", "-P", "-u", "--unset"}),
         0,
     ),
     "exec": (frozenset({"-a"}), 0),
@@ -741,6 +746,31 @@ def statements(tokens):
     return grouped
 
 
+class UnresolvedEnvSplit(ValueError):
+    """Split-string syntax whose executed arguments cannot be proven here."""
+
+
+def parse_env_split(split_string):
+    """Parse only the env -S subset shared with ordinary quoted arguments.
+
+    GNU env has its own escapes, comments and environment interpolation. Do
+    not pretend shlex implements those, or invent environment values in a
+    pre-execution guard. The operator can spell the resulting command directly.
+
+    Args:
+        split_string: The literal argument supplied to env's split option.
+
+    Returns:
+        Arguments for the supported subset; otherwise raises UnresolvedEnvSplit.
+    """
+    if any(marker in split_string for marker in (BACKSLASH, "#", "$", chr(96), chr(11), chr(12))):
+        raise UnresolvedEnvSplit("escapes, comments, shell substitution, variable expansion or control whitespace")
+    try:
+        return shlex.split(split_string, comments=False, posix=True)
+    except ValueError as error:
+        raise UnresolvedEnvSplit("unbalanced quoting") from error
+
+
 def command_word(statement):
     """The program a statement runs, and the tokens after it.
 
@@ -757,6 +787,7 @@ def command_word(statement):
         its command word is itself the executed script.
     """
     index = 0
+    split_expansions = 0
     while index < len(statement):
         token = statement[index]
         if "=" in token and not token.startswith(("=", "-")):
@@ -772,6 +803,36 @@ def command_word(statement):
             if option == "--":
                 index += 1
                 break
+            # env -S inserts the split string back into env's argument list;
+            # it is executable input, not an option value to discard. Keep
+            # shell -c's quoted operand intact while expanding the env layer.
+            # The known no-operand flags can be combined before S (-vS/-ivS).
+            # Stop at S: the rest belongs to its argument, not more flags.
+            short_split = re.match(r"^-[iv0]*S(.*)$", option)
+            if program == "env" and (
+                option == "--split-string"
+                or option.startswith("--split-string=")
+                or short_split is not None
+            ):
+                consumed = 1
+                if option == "--split-string" or (
+                    short_split is not None and not short_split.group(1)
+                ):
+                    if index + 1 >= len(statement):
+                        raise UnresolvedEnvSplit("missing split-string operand")
+                    split_string = statement[index + 1]
+                    consumed = 2
+                elif option.startswith("--split-string="):
+                    split_string = option.split("=", 1)[1]
+                else:
+                    split_string = short_split.group(1)
+                if split_expansions >= 64:
+                    raise UnresolvedEnvSplit("nested split-string limit")
+                expanded = parse_env_split(split_string)
+                statement = [token] + expanded + statement[index + consumed :]
+                split_expansions += 1
+                index = 0
+                break
             index += 2 if option in separate else 1
         index += positional
     return (None, None, [])
@@ -985,7 +1046,11 @@ def collect(text, depth, seen, out):
 
 
 targets = []
-collect(command, 0, set(), targets)
+try:
+    collect(command, 0, set(), targets)
+except UnresolvedEnvSplit as error:
+    sys.stderr.write(str(error) + NEWLINE)
+    sys.exit(ENV_SPLIT_UNRESOLVED)
 for target in targets:
     cleaned = target.strip().strip("'\"")
     if cleaned:
@@ -1003,6 +1068,15 @@ PY
     else
       analyzer_status=$?
     fi
+    if [ "$analyzer_status" -eq 42 ]; then
+      printf 'Blocked: cannot resolve env --split-string for managed-file protection.\n' >&2
+      printf 'Use an explicit command without split-string escapes, comments or variable expansion.\n' >&2
+      while IFS= read -r analyzer_line; do
+        [ -n "$analyzer_line" ] && printf '  %s\n' "$analyzer_line" >&2
+      done <"$analyzer_stderr"
+      rm -f "$analyzer_stderr"
+      exit 2
+    fi
     if [ "$analyzer_status" -ne 0 ]; then
       printf 'block-managed-file-edits: Bash analyzer failed (exit %s); Bash write protection is NOT active\n' "$analyzer_status" >&2
       while IFS= read -r analyzer_line; do

package/plugins/lisa-agy/hooks/block-shell-json-parsing.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook for Bash: blocks structural JSON parsing with text tools.
 # Text tools (grep/sed/cut/awk) break on valid JSON — multiline values, escaped
 # quotes, reordered keys, nested objects — producing silently wrong output

package/plugins/lisa-agy/hooks/guard-dedupe.bash

@@ -1,3 +1,6 @@
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # shellcheck shell=bash
 # Evaluate a dual-channel guard once per tool call, without de-registering it.
 #
@@ -51,12 +54,9 @@
 #      refusal reaching the agent without the message that explains it. On a
 #      refusal every channel evaluates and speaks exactly as it does today.
 #
-# COST ON THE PATH THAT GETS NO BENEFIT. A host with one channel must not pay
-# for a mechanism it cannot use. The channel check is builtins only — one small
-# file read, no subshell, no fork — and returns before the digest is computed
-# unless a second channel has actually been seen. The digest, and the one `stat`
-# that feeds it the per-call discriminator, are reached only where a second
-# channel is live, which is exactly where they are repaid.
+# State ownership, modes and ancestry are verified before channel discovery.
+# After that validation the channel check uses only builtins, and returns
+# before digesting code or sizing the transcript unless another channel is live.
 
 # Key this guard would memoise under, once computed. Empty means "record
 # nothing on exit".
@@ -74,14 +74,25 @@ lisa_guard_memo_ready=0
 # Digest tool for the memo key, resolved once. Empty disables the memo.
 lisa_guard_memo_digest_tool=""
 
-# Whether a directory is a real directory this user owns, and not a symlink —
-# builtins only, so this costs no process.
-#
-# `-O` is the load-bearing test: a memo planted by another user would suppress a
-# refusal, so a directory this user does not own is never used. The dispatcher
-# validates the whole parent chain before exporting `LISA_GUARD_MEMO_DIR`; this
-# re-checks the leaf rather than trusting the environment variable, because an
-# exported path is an input like any other.
+# Read ownership and all permission bits without accepting output from a
+# failed platform-specific stat invocation.
+# $1 - directory; sets lisa_guard_memo_owner and lisa_guard_memo_mode
+lisa_guard_memo_stat() {
+  local facts=""
+  facts="$(stat -c '%u %a' "$1" 2>/dev/null)" ||
+    facts="$(stat -f '%u %p' "$1" 2>/dev/null)" || return 1
+  lisa_guard_memo_owner="${facts%% *}"
+  lisa_guard_memo_mode="${facts#* }"
+  case "$lisa_guard_memo_owner:$lisa_guard_memo_mode" in
+    *[!0-9:]* | :* | *:) return 1 ;;
+  esac
+  case "$lisa_guard_memo_mode" in *[!0-7]*) return 1 ;; esac
+  lisa_guard_memo_mode=$((8#$lisa_guard_memo_mode & 8#7777))
+}
+
+# Memo leaves must be private even when a sticky shared temp ancestor is safe.
+# Ownership alone allows another local account to plant a session/allow file
+# in an owned but group- or world-writable directory.
 #
 # $1 - candidate directory
 lisa_guard_memo_dir_usable() {
@@ -89,23 +100,42 @@ lisa_guard_memo_dir_usable() {
   [ -d "$1" ] || return 1
   [ ! -L "$1" ] || return 1
   [ -O "$1" ] || return 1
+  lisa_guard_memo_stat "$1" || return 1
+  [ $((lisa_guard_memo_mode & 8#0022)) -eq 0 ]
+}
+
+# Resolve parents physically and verify every ancestor. Plugin hooks do not
+# inherit the dispatcher's trust walk, and exported paths are still inputs.
+# $1 - candidate memo base; sets lisa_guard_memo_base only on success
+lisa_guard_memo_trust_base() {
+  lisa_guard_memo_dir_usable "$1" || return 1
+  local physical=""
+  physical="$(cd "$1" 2>/dev/null && pwd -P)" || return 1
+  local current="$physical"
+  while :; do
+    lisa_guard_memo_stat "$current" || return 1
+    [ "$lisa_guard_memo_owner" = 0 ] || [ -O "$current" ] || return 1
+    if [ $((lisa_guard_memo_mode & 8#0022)) -ne 0 ] &&
+      [ $((lisa_guard_memo_mode & 8#1000)) -eq 0 ]; then
+      return 1
+    fi
+    [ "$current" != / ] || break
+    current="${current%/*}"
+    [ -n "$current" ] || current=/
+  done
+  lisa_guard_memo_base="$physical"
 }
 
 # Establish the memo base directory.
 #
-# Preferred source is `LISA_GUARD_MEMO_DIR`, exported by the dispatcher, which
-# has already resolved `TMPDIR` physically and walked every parent for ownership
-# and mode. Guards it spawns therefore pay nothing for that walk. A guard
-# reached by the plugin channel has no such parent, so it creates the directory
-# itself under `TMPDIR` — private by umask, and used only when this user owns
-# it. If neither works the memo is unavailable and every guard evaluates, which
-# is today's behaviour.
+# Preferred source is `LISA_GUARD_MEMO_DIR`, exported by the dispatcher. Both
+# this input and the plugin channel's TMPDIR fallback receive the same trust
+# checks. Missing state is created privately; untrusted state disables memo use.
 lisa_guard_memo_resolve_base() {
   [ -z "$lisa_guard_memo_base" ] || return 0
 
   local candidate="${LISA_GUARD_MEMO_DIR:-}"
-  if lisa_guard_memo_dir_usable "$candidate"; then
-    lisa_guard_memo_base="$candidate"
+  if lisa_guard_memo_trust_base "$candidate"; then
     return 0
   fi
 
@@ -118,8 +148,7 @@ lisa_guard_memo_resolve_base() {
   if [ ! -e "$candidate" ] && [ ! -L "$candidate" ]; then
     (umask 077 && mkdir -p "$candidate") 2>/dev/null || true
   fi
-  if lisa_guard_memo_dir_usable "$candidate"; then
-    lisa_guard_memo_base="$candidate"
+  if lisa_guard_memo_trust_base "$candidate"; then
     return 0
   fi
   return 1
@@ -165,6 +194,7 @@ lisa_guard_memo_sweep() {
 #
 # $1 - guard name, used only to name the memo file
 # $2 - the raw tool payload this guard was handed on stdin
+# Remaining arguments - files containing delegated verdict code
 lisa_guard_dedupe() {
   local guard_name="${1:-}"
   local payload="${2:-}"
@@ -194,8 +224,7 @@ lisa_guard_dedupe() {
       fresh_session=1
     fi
   fi
-  [ -d "$session_dir" ] || return 0
-  [ ! -L "$session_dir" ] || return 0
+  lisa_guard_memo_dir_usable "$session_dir" || return 0
 
   # Swept once, by the process that created the session directory, so a
   # long-lived machine does not accumulate memo state. Off the hot path by
@@ -278,11 +307,18 @@ lisa_guard_dedupe() {
   case "$transcript_size" in "" | *[!0-9]*) return 0 ;; esac
 
   # One command substitution, covering everything the verdict depends on: the
-  # guard's own bytes, this library's bytes, the payload, and which call it is.
+  # guard's own bytes, this library, delegated code, payload, and call identity.
+  # Keep literal bytes (including trailing newlines), and propagate every read
+  # failure. A successful digest of a partial stream is not proof of identity.
   local key=""
   key="$(
+    set -o pipefail
     {
-      cat "$self_script" "${BASH_SOURCE[0]}" 2>/dev/null
+      local source_file=""
+      for source_file in "$self_script" "${BASH_SOURCE[0]}" "${@:3}"; do
+        cat "$source_file" 2>/dev/null || exit 1
+        printf '\0'
+      done
       printf '\n%s\n' "$payload"
       printf '%s\n' "$transcript_size"
     } | if [ "$lisa_guard_memo_digest_tool" = "shasum" ]; then
@@ -293,6 +329,7 @@ lisa_guard_dedupe() {
   )" || key=""
   key="${key%% *}"
   case "$key" in "" | *[!0-9a-f]*) return 0 ;; esac
+  [ "${#key}" -eq 64 ] || return 0
 
   # One memo file per guard per session, rewritten as the call moves on, so the
   # state directory stays a fixed size however long a session runs. A saturated

package/plugins/lisa-agy/hooks/parity-safety-net-heredoc.py

@@ -1,4 +1,7 @@
 #!/usr/bin/env python3
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 """Classify the only heredoc forms whose payload is non-executable text.
 
 SCOPE — read this before hardening anything here (issue #1993).

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
 # PreToolUse hook for Bash: a safety net that blocks destructive shell commands
 # before they run. Lisa-native reimplementation of the upstream
 # `safety-net@cc-marketplace` plugin's PreToolUse Bash-guard (parity work,
@@ -136,7 +139,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe parity-safety-net "$input"
+  lisa_guard_dedupe parity-safety-net "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.55.2",
+  "version": "4.55.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"