@codyswann/lisa 4.60.3 → 4.60.4

package/dist/opencode/plugin-templates/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/dist/opencode/plugin-templates/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match

package/package.json

@@ -187,7 +187,7 @@
     "zod-validation-error": "^4.0.0"
   },
   "name": "@codyswann/lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {
@@ -336,7 +336,7 @@
     "test": "tests"
   },
   "types": "./dist/index.d.ts",
-  "lisaReleaseCommit": "b83339157643a03b9a8ab4503957f02aa8871109",
-  "gitHead": "b83339157643a03b9a8ab4503957f02aa8871109",
-  "lisaReleaseTag": "v4.60.3"
+  "lisaReleaseCommit": "a5aa6f4c2d82967499ffda11f3ab637dc3041ab7",
+  "gitHead": "a5aa6f4c2d82967499ffda11f3ab637dc3041ab7",
+  "lisaReleaseTag": "v4.60.4"
 }

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/hooks/block-instruction-file-edits.sh

@@ -52,7 +52,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe block-instruction-file-edits "$input"
+  lisa_guard_dedupe block-instruction-file-edits "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 command -v jq >/dev/null 2>&1 || exit 0
@@ -187,6 +188,15 @@ EOF
       grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
       exit 0
     fi
+    # Literal printf/echo arguments are content. The shared projection keeps
+    # the real redirect target, and leaves executable/ambiguous syntax intact.
+    if [[ "$command_str" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+      && command -v python3 >/dev/null 2>&1; then
+      if display_projection="$(printf '%s' "$command_str" | python3 \
+        "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+        command_str="$display_projection"
+      fi
+    fi
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.

package/plugins/lisa/hooks/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/plugins/lisa/hooks/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match

package/plugins/lisa-agy/hooks/block-instruction-file-edits.sh

@@ -52,7 +52,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe block-instruction-file-edits "$input"
+  lisa_guard_dedupe block-instruction-file-edits "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 command -v jq >/dev/null 2>&1 || exit 0
@@ -187,6 +188,15 @@ EOF
       grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
       exit 0
     fi
+    # Literal printf/echo arguments are content. The shared projection keeps
+    # the real redirect target, and leaves executable/ambiguous syntax intact.
+    if [[ "$command_str" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+      && command -v python3 >/dev/null 2>&1; then
+      if display_projection="$(printf '%s' "$command_str" | python3 \
+        "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+        command_str="$display_projection"
+      fi
+    fi
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.

package/plugins/lisa-agy/hooks/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/plugins/lisa-agy/hooks/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/block-instruction-file-edits.sh

@@ -52,7 +52,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe block-instruction-file-edits "$input"
+  lisa_guard_dedupe block-instruction-file-edits "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 command -v jq >/dev/null 2>&1 || exit 0
@@ -187,6 +188,15 @@ EOF
       grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
       exit 0
     fi
+    # Literal printf/echo arguments are content. The shared projection keeps
+    # the real redirect target, and leaves executable/ambiguous syntax intact.
+    if [[ "$command_str" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+      && command -v python3 >/dev/null 2>&1; then
+      if display_projection="$(printf '%s' "$command_str" | python3 \
+        "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+        command_str="$display_projection"
+      fi
+    fi
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.

package/plugins/lisa-copilot/hooks/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE

package/plugins/lisa-copilot/hooks/parity-safety-net.sh

@@ -431,6 +431,18 @@ case "$command_str" in
     ;;
 esac
 
+custom_command_for_guards="$command_for_guards"
+# A single literal printer writes data, not shell commands. Keep its actual
+# redirection in the scan; unsupported syntax and unavailable parsing retain
+# the original text. Chained commands and shell substitutions never qualify.
+if [[ "$command_for_guards" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+  && command -v python3 >/dev/null 2>&1; then
+  if display_projection="$(printf '%s' "$command_for_guards" | python3 \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+    command_for_guards="$display_projection"
+  fi
+fi
+
 # ─── Follow execution into the file a command RUNS (issue #3612) ─────────────
 #
 # Every guard below classifies SHELL COMMAND TEXT, and until this block existed
@@ -2380,6 +2392,9 @@ fi
 # 16. Project-local custom rules. Each non-comment line is an ERE; a match blocks.
 rules_file="${SAFETY_NET_RULES_FILE:-${CLAUDE_PROJECT_DIR:-$PWD}/.claude/safety-net-rules.txt}"
 if [ -f "$rules_file" ]; then
+  # Custom rules can intentionally govern text itself, so preserve their input.
+  custom_command_str="$(printf '%s\n%s' "$custom_command_for_guards" "$followed_text" \
+    | awk '{ if (sub(/\\$/, "")) printf "%s ", $0; else print }')"
   while IFS= read -r rule || [ -n "$rule" ]; do
     case "$rule" in
       '' | '#'*) continue ;;
@@ -2393,7 +2408,7 @@ if [ -f "$rules_file" ]; then
     # not a refusal. The `||` puts the pipeline in a condition context, where
     # a non-zero status is expected rather than fatal.
     rule_status=0
-    printf '%s' "$normalized_command_str" | grep -Eiq -- "$rule" || rule_status=$?
+    printf '%s' "$custom_command_str" | grep -Eiq -- "$rule" || rule_status=$?
     case "$rule_status" in
       0) block "matched a project custom safety rule (${rules_file##*/}): $rule" ;;
       1) ;; # no match

package/plugins/lisa-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.60.3",
+  "version": "4.60.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cursor/hooks/block-instruction-file-edits.sh

@@ -52,7 +52,8 @@ if [ -r "$lisa_guard_dedupe_lib" ]; then
   # shellcheck source=guard-dedupe.bash
   . "$lisa_guard_dedupe_lib"
   trap 'lisa_guard_dedupe_record $?' EXIT
-  lisa_guard_dedupe block-instruction-file-edits "$input"
+  lisa_guard_dedupe block-instruction-file-edits "$input" \
+    "$lisa_guard_hook_dir/parity-safety-net-heredoc.py"
 fi
 
 command -v jq >/dev/null 2>&1 || exit 0
@@ -187,6 +188,15 @@ EOF
       grep -Eqi '(agents|claude|copilot-instructions)\.md'; then
       exit 0
     fi
+    # Literal printf/echo arguments are content. The shared projection keeps
+    # the real redirect target, and leaves executable/ambiguous syntax intact.
+    if [[ "$command_str" =~ ^[[:blank:]]*(printf|echo)[[:blank:]] ]] \
+      && command -v python3 >/dev/null 2>&1; then
+      if display_projection="$(printf '%s' "$command_str" | python3 \
+        "$lisa_guard_hook_dir/parity-safety-net-heredoc.py" --literal-display 2>/dev/null)"; then
+        command_str="$display_projection"
+      fi
+    fi
     # Write signatures only. A bare mention (`cat AGENTS.md`, `rg x AGENTS.md`)
     # is a read and must stay allowed — the filename has to appear as the target
     # of a redirection, a tee, or an in-place sed.

package/plugins/lisa-cursor/hooks/parity-safety-net-heredoc.py

@@ -229,6 +229,46 @@ def shell_tokens(prefix: str) -> list[str] | None:
         return None
 
 
+def literal_display_projection(command: str) -> str:
+    """Remove data from one literal printer, retaining its real output target.
+
+    Reuse the literal simple-command grammar: pipes, chains, substitutions,
+    comments and ambiguous syntax keep the original scan. This is not a shell
+    parser or an execution exemption. ANSI-C quoting and computed targets also
+    keep their original scan rather than guessing their expanded spelling.
+    """
+    if "$'" in command:
+        return command
+
+    def printer(text: str) -> bool:
+        tokens = shell_tokens(text)
+        if not tokens or len(tokens) < 2:
+            return False
+        if tokens[0] == "echo":
+            return True
+        if tokens[0] != "printf":
+            return False
+        arguments = tokens[2:] if tokens[1] == "--" else tokens[1:]
+        if not arguments or arguments[0].startswith("-"):
+            return False
+        # %n writes a variable (including an evaluated array subscript), and a
+        # dynamic format could select it. Only known display conversions qualify.
+        remaining = re.sub(r"%%|%[sbqQ]", "", arguments[0])
+        return not any(char in remaining for char in "%$`*?[]~")
+
+    if printer(command):
+        return "printf '%s' literal-display-content"
+    for redirect in re.finditer(r">>|>\||>", command):
+        if not printer(command[:redirect.start()]):
+            continue
+        target = shell_tokens(command[redirect.end():])
+        if target and len(target) == 1 and not any(
+            char in target[0] for char in "$`\\\n\r*?[]~"
+        ):
+            return "printf '%s' literal-display-content " + redirect[0] + " " + shlex.quote(target[0])
+    return command
+
+
 def is_allowed_gh(tokens: list[str]) -> bool:
     return (
         len(tokens) >= 3
@@ -905,6 +945,9 @@ def marker_is_closed(command: str, marker: Marker) -> bool:
 
 def main() -> int:
     command = sys.stdin.read()
+    if sys.argv[1:] == ["--literal-display"]:
+        print(literal_display_projection(command), end="")
+        return SAFE
     if "<<" not in command:
         print(command, end="")
         return SAFE