@codyswann/lisa 4.73.0 → 4.73.2

package/plugins/lisa-agy/hooks/block-blind-automerge.sh

@@ -211,6 +211,7 @@ if [ -z "$command_str" ]; then
 fi
 
 if ! BLOCK_BLIND_AUTOMERGE_COMMAND="$command_str" python3 - <<'PY'
+import io
 import json
 import os
 import re
@@ -244,7 +245,41 @@ MERGE_SEPARATE_VALUE = {
 
 COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
+    # `|&` pipes stdout AND stderr into the next command, so it ends a command
+    # exactly as `|` does. shlex emits it as one token, and before it was listed
+    # here `echo hi |& git commit --no-verify` read as a single `echo` command
+    # whose arguments happened to include git. The case terminators end a
+    # command the same way.
+    "|&", ";;", ";&", ";;&",
 }
+# shlex also GLUES adjacent punctuation into one token across distinct
+# operators: `(echo hi)|&git ...` arrives as `)|&`, which no set membership
+# test can recognise. An operator-only token is therefore re-split into the
+# operators it is made of, longest first. Redirections are kept whole and are
+# deliberately NOT separators, so `git commit 2>&1 -n` keeps its `-n` inside the
+# commit's argv scope.
+OPERATOR_ONLY = re.compile(r"^[();<>|&]+$")
+SHELL_OPERATOR = re.compile("|".join(
+    re.escape(operator) for operator in sorted(
+        COMMAND_SEPARATORS | {">|", "&>", "&>>", ">&", "<&", "<>", "<<<"},
+        key=lambda operator: (-len(operator), operator),
+    )
+))
+
+
+def split_operators(token):
+    """Split a glued operator-only token into the shell operators it holds.
+
+    Args:
+        token: One shlex token that was not read inside a quote or escape.
+
+    Returns:
+        The operators, longest first, or the token itself when it is not
+        made only of shell punctuation.
+    """
+    if OPERATOR_ONLY.match(token):
+        return SHELL_OPERATOR.findall(token)
+    return [token]
 
 # Shell wrappers whose `-c` argument is a command in a string rather than argv.
 # The outer argv names bash, so the arming is invisible without recursing once.
@@ -422,12 +457,40 @@ def shell_tokens(text):
     Returns:
         The token list, with `;`, `|`, `&&`, `(` and friends standing alone.
     """
-    lexer = shlex.shlex(
-        line_boundaries_as_separators(text), posix=True, punctuation_chars=True
-    )
+    stream = OperatorStream(line_boundaries_as_separators(text))
+    lexer = shlex.shlex(stream, posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     lexer.commenters = ""
-    return list(lexer)
+    stream.lexer = lexer
+    tokens = []
+    while True:
+        stream.literal_operator = False
+        token = lexer.get_token()
+        if token is None:
+            return tokens
+        # Quoted punctuation is an argument, never a boundary: a branch can be
+        # named `|&`, and `gh pr merge '|&' --auto` must keep `--auto` in the
+        # merge's own argv. Only real operator runs are split.
+        if stream.literal_operator:
+            tokens.append(
+                chr(0) + token if token in COMMAND_SEPARATORS else token
+            )
+        else:
+            tokens.extend(split_operators(token))
+
+
+class OperatorStream(io.StringIO):
+    """Remember punctuation read while shlex is inside a quote or escape."""
+
+    lexer = None
+    literal_operator = False
+
+    def read(self, size=-1):
+        value = super().read(size)
+        if (self.lexer is not None and self.lexer.state in {"'", '"', chr(92)}
+                and any(char in "();|&<>" for char in value)):
+            self.literal_operator = True
+        return value
 
 
 def is_gh(token):
@@ -493,6 +556,22 @@ def arms_auto_merge(argv):
     return False
 
 
+def literal_value(token):
+    """The argument a token stands for, without the quoted-separator marker.
+
+    `shell_tokens` prefixes a QUOTED separator with NUL so no scan stops at it.
+    That marker is for boundary checks only: a value handed to a gh probe
+    (a selector, a base ref, a repo) must be the argument the shell passes.
+
+    Args:
+        token: One token from `shell_tokens`.
+
+    Returns:
+        The token as the shell would pass it.
+    """
+    return token[1:] if token.startswith(chr(0)) else token
+
+
 def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
     """The PR the command names, as gh itself would read it.
 
@@ -518,7 +597,7 @@ def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
             index += 1
             continue
         if not token.startswith("-"):
-            return token
+            return literal_value(token)
     return None
 
 
@@ -538,7 +617,7 @@ def retarget_target(argv):
         if token in COMMAND_SEPARATORS:
             return None
         if token in BASE_FLAGS and index < len(argv):
-            return argv[index]
+            return literal_value(argv[index])
         if token.startswith("--base="):
             return token.split("=", 1)[1]
         if token in EDIT_SEPARATE_VALUE:
@@ -562,7 +641,7 @@ def repo_flag(tokens, start):
         if token in COMMAND_SEPARATORS:
             break
         if token in {"-R", "--repo"} and index + 1 < len(tokens):
-            return ["--repo", tokens[index + 1]]
+            return ["--repo", literal_value(tokens[index + 1])]
         if token.startswith("--repo="):
             return ["--repo", token.split("=", 1)[1]]
         index += 1

package/plugins/lisa-agy/hooks/block-managed-file-edits.sh

@@ -597,7 +597,13 @@ ENV_SPLIT_UNRESOLVED = 42
 BACKSLASH = chr(92)
 NEWLINE = chr(10)
 
-STATEMENT_SEPARATORS = {";", "|", "||", "&", "&&", "(", ")", "&|"}
+# `|&` pipes stdout and stderr into the next command, and the case terminators
+# end a statement as `;` does. Without them `printf x |& tee <managed>` stayed
+# one statement whose command word was `printf`, so the `tee` write target was
+# never examined.
+STATEMENT_SEPARATORS = {
+    ";", "|", "||", "&", "&&", "(", ")", "&|", "|&", ";;", ";&", ";;&",
+}
 # Ordinary output, noclobber override, and combined stdout/stderr output.
 # shlex separates fd prefixes (e.g. 10>>) from the operator automatically.
 REDIRECT_OUT = {">", ">>", ">|", "&>", "&>>", ">&"}

package/plugins/lisa-agy/hooks/block-no-verify.agy.sh

@@ -170,7 +170,41 @@ def disables_verification(token):
 # tokens, so the invocation's boundary is a token the scan can stop at.
 COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
+    # `|&` pipes stdout AND stderr into the next command, so it ends a command
+    # exactly as `|` does. shlex emits it as one token, and before it was listed
+    # here `echo hi |& git commit --no-verify` read as a single `echo` command
+    # whose arguments happened to include git. The case terminators end a
+    # command the same way.
+    "|&", ";;", ";&", ";;&",
 }
+# shlex also GLUES adjacent punctuation into one token across distinct
+# operators: `(echo hi)|&git ...` arrives as `)|&`, which no set membership
+# test can recognise. An operator-only token is therefore re-split into the
+# operators it is made of, longest first. Redirections are kept whole and are
+# deliberately NOT separators, so `git commit 2>&1 -n` keeps its `-n` inside the
+# commit's argv scope.
+OPERATOR_ONLY = re.compile(r"^[();<>|&]+$")
+SHELL_OPERATOR = re.compile("|".join(
+    re.escape(operator) for operator in sorted(
+        COMMAND_SEPARATORS | {">|", "&>", "&>>", ">&", "<&", "<>", "<<<"},
+        key=lambda operator: (-len(operator), operator),
+    )
+))
+
+
+def split_operators(token):
+    """Split a glued operator-only token into the shell operators it holds.
+
+    Args:
+        token: One shlex token that was not read inside a quote or escape.
+
+    Returns:
+        The operators, longest first, or the token itself when it is not
+        made only of shell punctuation.
+    """
+    if OPERATOR_ONLY.match(token):
+        return SHELL_OPERATOR.findall(token)
+    return [token]
 
 SHELL_PROGRAMS = {"bash", "dash", "ksh", "sh", "zsh"}
 MAX_SHELL_NESTING = 8
@@ -324,14 +358,28 @@ def shell_tokens(text):
     Returns:
         The token list, with `;`, `|`, `&&`, `(` and friends standing alone.
     """
-    lexer = shlex.shlex(
-        line_boundaries_as_separators(text), posix=True, punctuation_chars=True
-    )
+    stream = OperatorStream(line_boundaries_as_separators(text))
+    lexer = shlex.shlex(stream, posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     # shlex treats `#` as a comment introducer by default and would silently
     # truncate the rest of the line; `shlex.split` disables it, and so must this.
     lexer.commenters = ""
-    return list(lexer)
+    stream.lexer = lexer
+    tokens = []
+    while True:
+        stream.literal_operator = False
+        token = lexer.get_token()
+        if token is None:
+            return tokens
+        # Quoted punctuation is an argument, never a boundary: it stays whole,
+        # and a quoted separator is marked so no scan stops at it (a path or
+        # branch can be named `|&`). Only real operator runs are split.
+        if stream.literal_operator:
+            tokens.append(
+                chr(0) + token if token in COMMAND_SEPARATORS else token
+            )
+        else:
+            tokens.extend(split_operators(token))
 
 
 def cluster_skips_verification(cluster):
@@ -947,6 +995,10 @@ def resolve_script(token):
     """
     if COMPUTED_VALUE.search(token):
         return (None, "a computed path the guard cannot resolve before the shell does")
+    # A quoted separator carries a NUL marker from shell_tokens; the path the
+    # shell passes is the argument without it.
+    if token.startswith(chr(0)):
+        token = token[1:]
     text = os.path.expanduser(token.strip().strip("'\""))
     # `bash -` and a bare `-` read the script from stdin; there is no file.
     if not text or text == "-":
@@ -1897,9 +1949,12 @@ def flat_tokens(text):
             # shlex otherwise makes quoted ";" indistinguishable from a real
             # command boundary. Keep literal destinations as data, so a setter
             # cannot masquerade as a one-operand configuration read.
-            if token in COMMAND_SEPARATORS and stream.literal_operator:
-                token = "\x00" + token
-            tokens.append(token)
+            if stream.literal_operator:
+                if token in COMMAND_SEPARATORS:
+                    token = "\x00" + token
+                tokens.append(token)
+            else:
+                tokens.extend(split_operators(token))
         return [
             token
             for index, token in enumerate(tokens)

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "4.73.0",
+  "version": "4.73.2",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/hooks/auto-update.mjs

@@ -42,6 +42,7 @@ import { execFile } from "child_process";
 import {
   existsSync,
   lstatSync,
+  readlinkSync,
   mkdirSync,
   openSync,
   closeSync,
@@ -580,6 +581,70 @@ async function applyUpdate(ctx, update) {
   }
 }
 
+/**
+ * What each pending file holds right now, so the later commit can prove it is
+ * still committing the update's bytes and not an edit made since
+ * (CodySwannGT/lisa#4393).
+ *
+ * A path maps to `"<git mode> <identity>"`, or to null when it is absent (the
+ * update deleted it). A regular file is `100644`/`100755` plus its
+ * `git hash-object` blob id, so an executable-bit change alone is caught. A
+ * symlink is `120000 link:<target>`: hash-object follows a link and hashes what
+ * it reaches, so a link retargeted at identical bytes would otherwise read as
+ * unchanged. Anything else (a directory, a submodule) is left OUT: it cannot be
+ * proved, and the reader treats a missing entry as "differs", so it never
+ * auto-commits on it. `lisa-work-item.mjs` recomputes these the same way.
+ * @param {(argv: string[], options: object) => Promise<string>} run Runner.
+ * @param {string} cwd Project directory.
+ * @param {readonly string[]} files Pending paths.
+ * @returns {Promise<Record<string, string | null> | null>} Digests, or null when they could not be read.
+ */
+export async function workingTreeDigests(run, cwd, files) {
+  const digests = {};
+  const present = [];
+  for (const file of files) {
+    let stat;
+    try {
+      stat = lstatSync(path.join(cwd, file));
+    } catch {
+      digests[file] = null;
+      continue;
+    }
+    if (stat.isSymbolicLink()) {
+      // A link that vanishes before it can be read is left out, which the
+      // reader treats as "differs".
+      try {
+        digests[file] = `120000 link:${readlinkSync(path.join(cwd, file))}`;
+      } catch {
+        continue;
+      }
+    } else if (stat.isFile())
+      present.push([file, stat.mode & 0o111 ? "100755" : "100644"]);
+  }
+  if (present.length > 0) {
+    const ids = (
+      await run(
+        ["git", "hash-object", "--", ...present.map(([file]) => file)],
+        {
+          cwd,
+        }
+      )
+    )
+      .split("\n")
+      .map(line => line.trim())
+      .filter(Boolean);
+    if (
+      ids.length !== present.length ||
+      !ids.every(id => /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u.test(id))
+    )
+      return null;
+    present.forEach(([file, mode], index) => {
+      digests[file] = `${mode} ${ids[index]}`;
+    });
+  }
+  return digests;
+}
+
 /**
  * Commit the update now, or leave it pending for the first work-item binding.
  * @param {object} ctx Context.
@@ -635,10 +700,13 @@ async function settle(ctx, update) {
     projectDir,
     await gitPath("lisa/pending-update.json")
   );
+  const digests = await workingTreeDigests(run, projectDir, changed).catch(
+    () => null
+  );
   mkdirSync(path.dirname(marker), { recursive: true });
   writeFileSync(
     marker,
-    `${JSON.stringify({ from: update.from, to: update.to, files: changed }, null, 2)}\n`
+    `${JSON.stringify({ from: update.from, to: update.to, files: changed, ...(digests ? { digests } : {}) }, null, 2)}\n`
   );
   return `It is NOT committed yet (${decision.reason}). The ${changed.length} changed file(s) are left in the working tree and recorded as a pending update; binding a work item on a feature branch (\`lisa-work-item.mjs link\` / \`attach-branch\`, which /lisa:track runs) commits them first, as their own commit. Do not fold these files into a feature commit.`;
 }

package/plugins/lisa-copilot/hooks/block-blind-automerge.sh

@@ -211,6 +211,7 @@ if [ -z "$command_str" ]; then
 fi
 
 if ! BLOCK_BLIND_AUTOMERGE_COMMAND="$command_str" python3 - <<'PY'
+import io
 import json
 import os
 import re
@@ -244,7 +245,41 @@ MERGE_SEPARATE_VALUE = {
 
 COMMAND_SEPARATORS = {
     ";", "|", "||", "&", "&&", "(", ")", "<", ">", ">>", "<<", "&|",
+    # `|&` pipes stdout AND stderr into the next command, so it ends a command
+    # exactly as `|` does. shlex emits it as one token, and before it was listed
+    # here `echo hi |& git commit --no-verify` read as a single `echo` command
+    # whose arguments happened to include git. The case terminators end a
+    # command the same way.
+    "|&", ";;", ";&", ";;&",
 }
+# shlex also GLUES adjacent punctuation into one token across distinct
+# operators: `(echo hi)|&git ...` arrives as `)|&`, which no set membership
+# test can recognise. An operator-only token is therefore re-split into the
+# operators it is made of, longest first. Redirections are kept whole and are
+# deliberately NOT separators, so `git commit 2>&1 -n` keeps its `-n` inside the
+# commit's argv scope.
+OPERATOR_ONLY = re.compile(r"^[();<>|&]+$")
+SHELL_OPERATOR = re.compile("|".join(
+    re.escape(operator) for operator in sorted(
+        COMMAND_SEPARATORS | {">|", "&>", "&>>", ">&", "<&", "<>", "<<<"},
+        key=lambda operator: (-len(operator), operator),
+    )
+))
+
+
+def split_operators(token):
+    """Split a glued operator-only token into the shell operators it holds.
+
+    Args:
+        token: One shlex token that was not read inside a quote or escape.
+
+    Returns:
+        The operators, longest first, or the token itself when it is not
+        made only of shell punctuation.
+    """
+    if OPERATOR_ONLY.match(token):
+        return SHELL_OPERATOR.findall(token)
+    return [token]
 
 # Shell wrappers whose `-c` argument is a command in a string rather than argv.
 # The outer argv names bash, so the arming is invisible without recursing once.
@@ -422,12 +457,40 @@ def shell_tokens(text):
     Returns:
         The token list, with `;`, `|`, `&&`, `(` and friends standing alone.
     """
-    lexer = shlex.shlex(
-        line_boundaries_as_separators(text), posix=True, punctuation_chars=True
-    )
+    stream = OperatorStream(line_boundaries_as_separators(text))
+    lexer = shlex.shlex(stream, posix=True, punctuation_chars=True)
     lexer.whitespace_split = True
     lexer.commenters = ""
-    return list(lexer)
+    stream.lexer = lexer
+    tokens = []
+    while True:
+        stream.literal_operator = False
+        token = lexer.get_token()
+        if token is None:
+            return tokens
+        # Quoted punctuation is an argument, never a boundary: a branch can be
+        # named `|&`, and `gh pr merge '|&' --auto` must keep `--auto` in the
+        # merge's own argv. Only real operator runs are split.
+        if stream.literal_operator:
+            tokens.append(
+                chr(0) + token if token in COMMAND_SEPARATORS else token
+            )
+        else:
+            tokens.extend(split_operators(token))
+
+
+class OperatorStream(io.StringIO):
+    """Remember punctuation read while shlex is inside a quote or escape."""
+
+    lexer = None
+    literal_operator = False
+
+    def read(self, size=-1):
+        value = super().read(size)
+        if (self.lexer is not None and self.lexer.state in {"'", '"', chr(92)}
+                and any(char in "();|&<>" for char in value)):
+            self.literal_operator = True
+        return value
 
 
 def is_gh(token):
@@ -493,6 +556,22 @@ def arms_auto_merge(argv):
     return False
 
 
+def literal_value(token):
+    """The argument a token stands for, without the quoted-separator marker.
+
+    `shell_tokens` prefixes a QUOTED separator with NUL so no scan stops at it.
+    That marker is for boundary checks only: a value handed to a gh probe
+    (a selector, a base ref, a repo) must be the argument the shell passes.
+
+    Args:
+        token: One token from `shell_tokens`.
+
+    Returns:
+        The token as the shell would pass it.
+    """
+    return token[1:] if token.startswith(chr(0)) else token
+
+
 def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
     """The PR the command names, as gh itself would read it.
 
@@ -518,7 +597,7 @@ def pr_selector(argv, separate_value=MERGE_SEPARATE_VALUE):
             index += 1
             continue
         if not token.startswith("-"):
-            return token
+            return literal_value(token)
     return None
 
 
@@ -538,7 +617,7 @@ def retarget_target(argv):
         if token in COMMAND_SEPARATORS:
             return None
         if token in BASE_FLAGS and index < len(argv):
-            return argv[index]
+            return literal_value(argv[index])
         if token.startswith("--base="):
             return token.split("=", 1)[1]
         if token in EDIT_SEPARATE_VALUE:
@@ -562,7 +641,7 @@ def repo_flag(tokens, start):
         if token in COMMAND_SEPARATORS:
             break
         if token in {"-R", "--repo"} and index + 1 < len(tokens):
-            return ["--repo", tokens[index + 1]]
+            return ["--repo", literal_value(tokens[index + 1])]
         if token.startswith("--repo="):
             return ["--repo", token.split("=", 1)[1]]
         index += 1

package/plugins/lisa-copilot/hooks/block-managed-file-edits.sh

@@ -597,7 +597,13 @@ ENV_SPLIT_UNRESOLVED = 42
 BACKSLASH = chr(92)
 NEWLINE = chr(10)
 
-STATEMENT_SEPARATORS = {";", "|", "||", "&", "&&", "(", ")", "&|"}
+# `|&` pipes stdout and stderr into the next command, and the case terminators
+# end a statement as `;` does. Without them `printf x |& tee <managed>` stayed
+# one statement whose command word was `printf`, so the `tee` write target was
+# never examined.
+STATEMENT_SEPARATORS = {
+    ";", "|", "||", "&", "&&", "(", ")", "&|", "|&", ";;", ";&", ";;&",
+}
 # Ordinary output, noclobber override, and combined stdout/stderr output.
 # shlex separates fd prefixes (e.g. 10>>) from the operator automatically.
 REDIRECT_OUT = {">", ">>", ">|", "&>", "&>>", ">&"}