@codyswann/lisa 4.60.2 → 4.60.4

package/dist/opencode/plugin-templates/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match

package/expo/package-lisa/package.lisa.json

@@ -26,8 +26,8 @@
       "fetch:graphql:schema:dev": "./scripts/fetch-graphql-schema.sh development",
       "fetch:graphql:schema:production": "./scripts/fetch-graphql-schema.sh production",
       "fetch:graphql:schema:staging": "./scripts/fetch-graphql-schema.sh staging",
-      "lint:fix": "oxlint --fix && eslint . --fix",
-      "lint:lisa": "oxlint && eslint . --quiet",
+      "lint:fix": "node scripts/lib/worktree-dependencies.mjs && oxlint --fix && eslint . --fix",
+      "lint:lisa": "node scripts/lib/worktree-dependencies.mjs && oxlint && eslint . --quiet",
       "maestro:classify": "node scripts/classify-maestro-failures.mjs",
       "pre-build:eas": "cat .gitignore > .easignore && cat .easignore.extra >> .easignore",
       "security:zap": "bash scripts/zap-baseline.sh",
@@ -45,14 +45,14 @@
       "start:simulator:ios:production": "cp .env.production .env.local && STAGE=production expo start --ios",
       "start:simulator:ios:staging": "cp .env.staging .env.local && STAGE=staging expo start --ios",
       "start:staging": "cp .env.staging .env.local && STAGE=staging expo start",
-      "test:cov:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage",
-      "test:cov:unit:lisa": "LISA_COVERAGE_SCOPE=unit NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:integration:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathPatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest",
-      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-mutation.mjs",
-      "test:node:lisa": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-test-node.mjs",
-      "test:unit:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
-      "test:watch:lisa": "NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --watch"
+      "test:cov:lisa": "node scripts/lib/worktree-dependencies.mjs && NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage",
+      "test:cov:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --coverage --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:integration:lisa": "node scripts/lib/worktree-dependencies.mjs && NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathPatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:lisa": "node scripts/lib/worktree-dependencies.mjs && NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest",
+      "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:node:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile expo --adapter direct -- node scripts/lisa-test-node.mjs",
+      "test:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --testPathIgnorePatterns=\"\\.integration[.\\\\-](test|spec)\\.(ts|tsx)$\"",
+      "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && NODE_ENV=test lisa-test-run --profile expo --adapter direct -- jest --watch"
     },
     "dependencies": {
       "@apollo/client": "^3.10.8",
@@ -176,13 +176,13 @@
       "lighthouse:check": "lhci autorun --collect.settings.chromeFlags='--no-sandbox --disable-gpu --headless' --assert.assertions.forced-reflow-insight=off && node scripts/check-lighthouse-details.mjs",
       "lint": "$npm_execpath run lint:lisa",
       "maestro:studio": "maestro studio",
-      "maestro:test": "lisa-test-run --profile expo --adapter direct -- maestro test .maestro/flows",
-      "maestro:test:android": "lisa-test-run --profile expo --adapter direct -- maestro test -p android .maestro/flows",
-      "maestro:test:ios": "lisa-test-run --profile expo --adapter direct -- maestro test -p ios .maestro/flows",
-      "maestro:test:smoke": "lisa-test-run --profile expo --adapter direct -- maestro test -p ios --include-tags=smoke .maestro/flows",
+      "maestro:test": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile expo --adapter direct -- maestro test .maestro/flows",
+      "maestro:test:android": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile expo --adapter direct -- maestro test -p android .maestro/flows",
+      "maestro:test:ios": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile expo --adapter direct -- maestro test -p ios .maestro/flows",
+      "maestro:test:smoke": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile expo --adapter direct -- maestro test -p ios --include-tags=smoke .maestro/flows",
       "playwright:build": "expo export --platform web",
-      "playwright:test": "bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test",
-      "playwright:test:ui": "bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test --ui",
+      "playwright:test": "node scripts/lib/worktree-dependencies.mjs && bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test",
+      "playwright:test:ui": "node scripts/lib/worktree-dependencies.mjs && bun run playwright:build && lisa-test-run --profile expo --adapter direct -- playwright test --ui",
       "test": "$npm_execpath run test:lisa",
       "test:cov": "$npm_execpath run test:cov:lisa",
       "test:cov:unit": "$npm_execpath run test:cov:unit:lisa",

package/harper-fabric/package-lisa/package.lisa.json

@@ -2,30 +2,30 @@
   "force": {
     "scripts": {
       "bootstrap": "bash scripts/bootstrap.sh",
-      "format": "prettier --check . --write",
-      "format:check:lisa": "prettier --check .",
-      "knip:check:lisa": "knip",
-      "knip:fix": "knip --fix",
-      "lint:fix": "oxlint --fix && eslint . --fix",
-      "lint:lisa": "oxlint && eslint . --quiet",
-      "lint:slow:lisa": "eslint . --config eslint.slow.config.ts --quiet",
+      "format": "node scripts/lib/worktree-dependencies.mjs && prettier --check . --write",
+      "format:check:lisa": "node scripts/lib/worktree-dependencies.mjs && prettier --check .",
+      "knip:check:lisa": "node scripts/lib/worktree-dependencies.mjs && knip",
+      "knip:fix": "node scripts/lib/worktree-dependencies.mjs && knip --fix",
+      "lint:fix": "node scripts/lib/worktree-dependencies.mjs && oxlint --fix && eslint . --fix",
+      "lint:lisa": "node scripts/lib/worktree-dependencies.mjs && oxlint && eslint . --quiet",
+      "lint:slow:lisa": "node scripts/lib/worktree-dependencies.mjs && eslint . --config eslint.slow.config.ts --quiet",
       "prepare": "husky install || true",
       "reset": "harperdb stop || true; [ -n \"$HOME\" ] && rm -rf \"$HOME/.harperdb\" && bun run bootstrap && bun run seed && bun run verify",
       "setup:deploy-key": "setup-deploy-key",
-      "sg:scan:lisa": "ast-grep scan",
-      "sg:test": "ast-grep test",
+      "sg:scan:lisa": "node scripts/lib/worktree-dependencies.mjs && ast-grep scan",
+      "sg:test": "node scripts/lib/worktree-dependencies.mjs && ast-grep test",
       "start": "harperdb start",
       "status": "harperdb status",
       "stop": "harperdb stop",
-      "test:cov:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage",
-      "test:cov:unit:lisa": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage --exclude='**/integration/**'",
-      "test:integration:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run '.integration.' 'integration/'",
-      "test:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run",
-      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-mutation.mjs",
-      "test:node:lisa": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-test-node.mjs",
-      "test:unit:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --exclude='**/integration/**'",
-      "test:watch:lisa": "lisa-test-run --profile harper-fabric --adapter vitest -- vitest",
-      "typecheck:lisa": "tsc --noEmit"
+      "test:cov:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage",
+      "test:cov:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --coverage --exclude='**/integration/**'",
+      "test:integration:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile harper-fabric --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile harper-fabric --adapter vitest -- vitest run",
+      "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:node:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile harper-fabric --adapter direct -- node scripts/lisa-test-node.mjs",
+      "test:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile harper-fabric --adapter vitest -- vitest run --exclude='**/integration/**'",
+      "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile harper-fabric --adapter vitest -- vitest",
+      "typecheck:lisa": "node scripts/lib/worktree-dependencies.mjs && tsc --noEmit"
     },
     "dependencies": {
       "harperdb": "^4.7.29"
@@ -79,7 +79,7 @@
   },
   "defaults": {
     "scripts": {
-      "build": "tsc && node dist/build/build.js",
+      "build": "node scripts/lib/worktree-dependencies.mjs && tsc && node dist/build/build.js",
       "deploy": "bun run build && node dist/scripts/deploy.js",
       "dev:server": "bun run build && node dist/scripts/dev_server.js",
       "format:check": "$npm_execpath run format:check:lisa",

package/nestjs/package-lisa/package.lisa.json

@@ -40,8 +40,8 @@
       "k6:soak": "./scripts/k6-run.sh --scenario soak",
       "k6:spike": "./scripts/k6-run.sh --scenario spike",
       "k6:stress": "./scripts/k6-run.sh --scenario stress",
-      "lint:fix": "oxlint --fix && eslint . --fix",
-      "lint:lisa": "oxlint && eslint . --quiet",
+      "lint:fix": "node scripts/lib/worktree-dependencies.mjs && oxlint --fix && eslint . --fix",
+      "lint:lisa": "node scripts/lib/worktree-dependencies.mjs && oxlint && eslint . --quiet",
       "security:zap": "bash scripts/zap-baseline.sh",
       "setup:deploy-key": "setup-deploy-key",
       "start:dev": "IS_OFFLINE=true sls offline start --stage dev",
@@ -49,14 +49,14 @@
       "start:docker:build": "docker compose up --build",
       "start:docker:down": "docker compose down",
       "start:local": "IS_OFFLINE=true sls offline start --noTimeout",
-      "test:cov:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage",
-      "test:cov:unit:lisa": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:integration:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest run '.integration.' 'integration/'",
-      "test:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest run",
-      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-mutation.mjs",
-      "test:node:lisa": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-test-node.mjs",
-      "test:unit:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:watch:lisa": "lisa-test-run --profile nestjs --adapter vitest -- vitest"
+      "test:cov:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage",
+      "test:cov:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit lisa-test-run --profile nestjs --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:integration:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile nestjs --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile nestjs --adapter vitest -- vitest run",
+      "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:node:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile nestjs --adapter direct -- node scripts/lisa-test-node.mjs",
+      "test:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile nestjs --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile nestjs --adapter vitest -- vitest"
     },
     "dependencies": {
       "@apollo/server": "^5.4.0",

package/npm-package/package-lisa/package.lisa.json

@@ -4,14 +4,14 @@
       "prepare": "$npm_execpath run build && husky install || true",
       "prepublishOnly": "$npm_execpath run build",
       "setup:deploy-key": "setup-deploy-key",
-      "test:cov:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage",
-      "test:cov:unit:lisa": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:integration:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest run '.integration.' 'integration/'",
-      "test:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest run",
-      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-mutation.mjs",
-      "test:node:lisa": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-test-node.mjs",
-      "test:unit:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:watch:lisa": "lisa-test-run --profile npm-package --adapter vitest -- vitest"
+      "test:cov:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage",
+      "test:cov:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit lisa-test-run --profile npm-package --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:integration:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest run",
+      "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:node:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile npm-package --adapter direct -- node scripts/lisa-test-node.mjs",
+      "test:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile npm-package --adapter vitest -- vitest"
     },
     "devDependencies": {
       "vite": "^8.0.16",

package/package.json

@@ -1,39 +1,39 @@
 {
   "scripts": {
     "build": "bun run build:dist && bun run build:plugins",
-    "build:dist": "node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
-    "build:dist:in-place": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
-    "lisa-test-run": "bun run build && node dist/cli/lisa-test-run.js --profile lisa",
-    "test:integration": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration",
-    "test:integration:push": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",
+    "build:dist": "node scripts/lib/worktree-dependencies.mjs && node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
+    "build:dist:in-place": "node scripts/lib/worktree-dependencies.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",
+    "lisa-test-run": "node scripts/lib/worktree-dependencies.mjs && bun run build && node dist/cli/lisa-test-run.js --profile lisa",
+    "test:integration": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration",
+    "test:integration:push": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",
     "postinstall": "bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ ! -f tsconfig.json ] || tsc -p tsconfig.json || true",
     "pretest": "bun run build",
-    "test": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run",
-    "test:unit": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
-    "test:cov": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage",
-    "test:cov:unit": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-    "test:cov:unit:push": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*' --exclude='**/measure-tmpdir-growth-performance.test.ts'",
+    "test": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run",
+    "test:unit": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+    "test:cov": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage",
+    "test:cov:unit": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+    "test:cov:unit:push": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*' --exclude='**/measure-tmpdir-growth-performance.test.ts'",
     "pretest:mutation": "bun run build",
-    "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs",
-    "test:mutation:full": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs --all",
-    "lint": "oxlint --disable-nested-config && eslint . --quiet",
-    "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",
-    "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",
-    "typecheck": "tsc --noEmit && bun run typecheck:tests && bun run typecheck:engine-floor",
+    "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs",
+    "test:mutation:full": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs --all",
+    "lint": "node scripts/lib/worktree-dependencies.mjs && oxlint --disable-nested-config && eslint . --quiet",
+    "lint:fix": "node scripts/lib/worktree-dependencies.mjs && oxlint --fix --disable-nested-config && eslint . --fix",
+    "lint:slow": "node scripts/lib/worktree-dependencies.mjs && eslint . --config eslint.slow.config.ts --quiet",
+    "typecheck": "node scripts/lib/worktree-dependencies.mjs && tsc --noEmit && bun run typecheck:tests && bun run typecheck:engine-floor",
     "typecheck:tests": "node scripts/check-typecheck-tests.mjs",
     "typecheck:engine-floor": "node scripts/check-engine-floor.mjs",
     "measure:scripts-profile-gap": "bun scripts/measure-scripts-profile-gap.mts",
-    "format:check": "prettier --check .",
-    "format": "prettier --check . --write",
-    "knip:check": "knip",
-    "knip:fix": "knip --fix",
-    "sg:scan": "ast-grep scan",
-    "sg:test": "ast-grep test",
+    "format:check": "node scripts/lib/worktree-dependencies.mjs && prettier --check .",
+    "format": "node scripts/lib/worktree-dependencies.mjs && prettier --check . --write",
+    "knip:check": "node scripts/lib/worktree-dependencies.mjs && knip",
+    "knip:fix": "node scripts/lib/worktree-dependencies.mjs && knip --fix",
+    "sg:scan": "node scripts/lib/worktree-dependencies.mjs && ast-grep scan",
+    "sg:test": "node scripts/lib/worktree-dependencies.mjs && ast-grep test",
     "build:plugins": "bash scripts/build-plugins.sh",
     "prepare": "node -e \"if (process.env.INIT_CWD?.includes('.serverless')) process.exit(0); process.exit(1);\" || husky install || true",
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
-    "test:watch": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest",
+    "test:watch": "node scripts/lib/worktree-dependencies.mjs && $npm_execpath run lisa-test-run -- --adapter vitest -- vitest",
     "update-node-version": "tsx scripts/update-node-version.ts",
     "cleanup:amplify-branches": "bash scripts/cleanup-amplify-branches.sh",
     "cleanup:github-branches": "bash scripts/cleanup-github-branches.sh",
@@ -71,7 +71,7 @@
     "check:cwd-resolution-corpus": "node scripts/check-cwd-resolution-corpus.mjs",
     "check:probe-absence-direction": "node scripts/check-probe-absence-direction.mjs",
     "check:guard-parity-notes": "node scripts/check-guard-parity-notes.mjs",
-    "check:shell-guard-refusals": "bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs --trace-out .lisa/shell-guard-trace.jsonl",
+    "check:shell-guard-refusals": "node scripts/lib/worktree-dependencies.mjs && bun run build && $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/check-shell-guard-refusal-coverage.mjs --trace-out .lisa/shell-guard-trace.jsonl",
     "check:workflow-inputs": "node scripts/detect-stale-workflow-inputs.mjs --project . --project typescript/create-only --project rails/create-only --json",
     "check:conflict-markers": "node all/copy-overwrite/scripts/check-conflict-markers.mjs",
     "check:vacuous-required-checks": "node typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs --vacuity",
@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.60.2",
+  "version": "4.60.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "786e4333ea500300015f7e2292dbdca15b3cfd29",
-  "gitHead": "786e4333ea500300015f7e2292dbdca15b3cfd29",
-  "lisaReleaseTag": "v4.60.2"
+  "lisaReleaseCommit": "a5aa6f4c2d82967499ffda11f3ab637dc3041ab7",
+  "gitHead": "a5aa6f4c2d82967499ffda11f3ab637dc3041ab7",
+  "lisaReleaseTag": "v4.60.4"
 }

package/phaser/package-lisa/package.lisa.json

@@ -1,27 +1,27 @@
 {
   "force": {
     "scripts": {
-      "format": "prettier --write .",
-      "format:check:lisa": "prettier --check .",
-      "knip:check:lisa": "knip",
-      "knip:fix": "knip --fix",
-      "lint:fix": "oxlint --fix && eslint . --fix",
-      "lint:lisa": "oxlint && eslint . --quiet",
-      "lint:slow:lisa": "eslint . --config eslint.slow.config.ts --quiet",
+      "format": "node scripts/lib/worktree-dependencies.mjs && prettier --write .",
+      "format:check:lisa": "node scripts/lib/worktree-dependencies.mjs && prettier --check .",
+      "knip:check:lisa": "node scripts/lib/worktree-dependencies.mjs && knip",
+      "knip:fix": "node scripts/lib/worktree-dependencies.mjs && knip --fix",
+      "lint:fix": "node scripts/lib/worktree-dependencies.mjs && oxlint --fix && eslint . --fix",
+      "lint:lisa": "node scripts/lib/worktree-dependencies.mjs && oxlint && eslint . --quiet",
+      "lint:slow:lisa": "node scripts/lib/worktree-dependencies.mjs && eslint . --config eslint.slow.config.ts --quiet",
       "prepare": "husky install || true",
       "setup:deploy-key": "setup-deploy-key",
-      "sg:scan:lisa": "ast-grep scan",
-      "sg:test": "ast-grep test",
-      "test:cov:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage",
-      "test:cov:unit:lisa": "LISA_COVERAGE_SCOPE=unit lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:e2e": "lisa-test-run --profile phaser --adapter direct -- playwright test",
-      "test:integration:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest run '.integration.' 'integration/'",
-      "test:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest run",
-      "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-mutation.mjs",
-      "test:node:lisa": "LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-test-node.mjs",
-      "test:unit:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
-      "test:watch:lisa": "lisa-test-run --profile phaser --adapter vitest -- vitest",
-      "typecheck:lisa": "tsc --noEmit"
+      "sg:scan:lisa": "node scripts/lib/worktree-dependencies.mjs && ast-grep scan",
+      "sg:test": "node scripts/lib/worktree-dependencies.mjs && ast-grep test",
+      "test:cov:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage",
+      "test:cov:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_COVERAGE_SCOPE=unit lisa-test-run --profile phaser --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:e2e": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter direct -- playwright test",
+      "test:integration:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter vitest -- vitest run '.integration.' 'integration/'",
+      "test:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter vitest -- vitest run",
+      "test:mutation": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-mutation.mjs",
+      "test:node:lisa": "node scripts/lib/worktree-dependencies.mjs && LISA_TEST_SCRATCH_PREFIXES='[\"node-\"]' lisa-test-run --profile phaser --adapter direct -- node scripts/lisa-test-node.mjs",
+      "test:unit:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",
+      "test:watch:lisa": "node scripts/lib/worktree-dependencies.mjs && lisa-test-run --profile phaser --adapter vitest -- vitest",
+      "typecheck:lisa": "node scripts/lib/worktree-dependencies.mjs && tsc --noEmit"
     },
     "devDependencies": {
       "@ast-grep/cli": "^0.40.4",
@@ -80,15 +80,15 @@
   },
   "defaults": {
     "scripts": {
-      "build": "vite build",
-      "dev": "vite",
+      "build": "node scripts/lib/worktree-dependencies.mjs && vite build",
+      "dev": "node scripts/lib/worktree-dependencies.mjs && vite",
       "format:check": "$npm_execpath run format:check:lisa",
       "knip:check": "$npm_execpath run knip:check:lisa",
       "lint": "$npm_execpath run lint:lisa",
       "lint:slow": "$npm_execpath run lint:slow:lisa",
-      "preview": "vite preview",
+      "preview": "node scripts/lib/worktree-dependencies.mjs && vite preview",
       "sg:scan": "$npm_execpath run sg:scan:lisa",
-      "size": "size-limit",
+      "size": "node scripts/lib/worktree-dependencies.mjs && size-limit",
       "test": "$npm_execpath run test:lisa",
       "test:cov": "$npm_execpath run test:cov:lisa",
       "test:cov:unit": "$npm_execpath run test:cov:unit:lisa",

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.2",
+  "version": "4.60.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.2",
+  "version": "4.60.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-instruction-file-edits.sh

@@ -52,7 +52,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe block-instruction-file-edits "$input"
+  lisa_guard_dedupe block-instruction-file-edits "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 command -v jq >/dev/null 2>&1 || exit 0
@@ -187,6 +188,15 @@ EOF
       grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
       exit 0
     fi
+    # Literal printf/echo arguments are content. The shared projection keeps
+    # the real redirect target, and leaves executable/ambiguous syntax intact.
+    if [[ "$command_str" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+      && command -v python3 >/dev/null 2>&1; then
+      if display_projection="$(printf '%s' "$command_str" | python3 \
+        "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+        command_str="$display_projection"
+      fi
+    fi
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.

package/plugins/lisa/hooks/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match