@codyswann/lisa 4.74.9 → 4.75.1

package/plugins/lisa-devin/hooks/block-shell-json-parsing.sh

@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
+# PreToolUse hook for Bash: blocks structural JSON parsing with text tools.
+# Text tools (grep/sed/cut/awk) break on valid JSON — multiline values, escaped
+# quotes, reordered keys, nested objects — producing silently wrong output
+# instead of errors. jq is the required tool for structural JSON reads and
+# writes in shell. Promoted from host-rules prose to an executable
+# control by the learnings gardener (issue #1787).
+#
+# Precision-first: this hook fires only on high-confidence STRUCTURAL parsing
+# of a *.json input — never on plain text search. Blocked signatures:
+#   1. `sed -i` (or an s/…/…/ program) applied to a .json file or stream;
+#   2. `cut -d` with a structural delimiter (quote/colon/comma) on .json input;
+#   3. `awk` field extraction (-F or a $N program) on .json input;
+#   4. `grep -o` on .json input (value extraction, not search).
+# A "json input" is a *.json argument, a `< file.json` redirection, or a
+# pipeline stream originating from a .json file (e.g. `cat x.json | …`).
+#
+# Exemptions (allowed):
+#   - any command that invokes jq anywhere (already compliant or mixed-legit);
+#   - search-only usage: plain grep / grep -l / rg with no extraction signature;
+#   - *.jsonl targets (line-delimited streams are legitimately line-tooled);
+#   - heredoc payload text (stripped before classification).
+set -euo pipefail
+
+input="$(cat)"
+
+# Evaluate once per tool call when this guard is registered on both channels.
+#
+# Lisa reaches an agent through the repository dispatcher AND the plugin
+# manifest, and where both are live the harness runs this guard twice for one
+# tool call. `guard-dedupe.bash` short-circuits the second run ONLY when a
+# byte-identical copy already ALLOWED this exact payload on this exact tool
+# call; a differing vintage, a refusal, and a host with one channel all
+# evaluate exactly as before. Nothing is de-registered by it
+# (CodySwannGT/lisa#3814).
+#
+# Absent library means no dedupe, which is the pre-existing behaviour, so an
+# older channel copy that predates it is unaffected.
+lisa_guard_hook_dir="${BASH_SOURCE[0]%/*}"
+lisa_guard_dedupe_lib="$lisa_guard_hook_dir/guard-dedupe.bash"
+if [ -r "$lisa_guard_dedupe_lib" ]; then
+  # shellcheck source=guard-dedupe.bash
+  . "$lisa_guard_dedupe_lib"
+  trap 'lisa_guard_dedupe_record $?' EXIT
+  lisa_guard_dedupe block-shell-json-parsing "$input"
+fi
+
+# Probe the interpreters before the first use. Under `set -euo pipefail` an
+# absent jq does not merely skip the parse — the assignment below dies with
+# 127, and 127 is not a refusal, so the guard vanishes and the command runs.
+# Worse, that 127 used to outrank a sibling guard's 2 in
+# lisa-enforcement-fallback.sh, taking a real refusal down with it.
+#
+# Degrading to "allow" stays right: a hook that cannot parse its input cannot
+# tell a bypass from an ordinary command, and failing closed would block every
+# Bash call on a machine missing an interpreter. Doing it QUIETLY is what is
+# wrong — a guard that is silently absent reads exactly like a guard that is
+# passing. Mirrors block-no-verify.sh, which already had this.
+for required in jq python3; do
+  if ! command -v "$required" >/dev/null 2>&1; then
+    printf 'block-shell-json-parsing: %s not found; JSON-parsing protection is NOT active\n' \
+      "$required" >&2
+    exit 0
+  fi
+done
+
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty')"
+if [ "$tool_name" != "Bash" ]; then
+  exit 0
+fi
+
+command_str="$(printf '%s' "$input" | jq -r '.tool_input.command // empty')"
+if [ -z "$command_str" ]; then
+  exit 0
+fi
+
+# Fast path: no ".json" reference at all means nothing to classify.
+case "$command_str" in
+  *.json*) ;;
+  *) exit 0 ;;
+esac
+
+# python3 is probed with jq at the top now, announced rather than silent.
+
+if ! BLOCK_SHELL_JSON_COMMAND="$command_str" python3 - <<'PY'
+import os
+import re
+import shlex
+import sys
+
+command = os.environ.get("BLOCK_SHELL_JSON_COMMAND", "")
+
+TEXT_TOOLS = {"grep", "egrep", "fgrep", "sed", "gsed", "awk", "gawk", "cut"}
+WRAPPERS = {"command", "env", "sudo", "time", "nohup"}
+ASSIGNMENT = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+
+
+def strip_heredoc_bodies(text: str) -> str:
+    """Remove heredoc payload lines so prose .json mentions never classify."""
+    lines = text.splitlines()
+    output = []
+    marker_pattern = re.compile(
+        r"<<-?\s*(?:'([^']+)'|\"([^\"]+)\"|\\?([A-Za-z_][A-Za-z0-9_]*))"
+    )
+    index = 0
+    while index < len(lines):
+        line = lines[index]
+        output.append(line)
+        markers = [
+            next(group for group in match.groups() if group)
+            for match in marker_pattern.finditer(line)
+        ]
+        index += 1
+        for marker in markers:
+            while index < len(lines):
+                if lines[index].strip() == marker:
+                    index += 1
+                    break
+                index += 1
+    return "\n".join(output)
+
+
+def tokenize(text: str):
+    lex = shlex.shlex(text, posix=True, punctuation_chars="|&;<>")
+    lex.whitespace_split = True
+    try:
+        return list(lex)
+    except ValueError:
+        return None
+
+
+def is_json_path(token: str) -> bool:
+    return token.lower().rstrip(")};").endswith(".json")
+
+
+def split_pipelines(tokens):
+    """Yield lists of pipe-connected segments; each segment is a token list."""
+    pipelines, pipeline, segment = [], [], []
+    for token in tokens:
+        if token in ("|", "|&"):
+            pipeline.append(segment)
+            segment = []
+        elif token in (";", "&&", "||", "&", "\n"):
+            pipeline.append(segment)
+            pipelines.append(pipeline)
+            pipeline, segment = [], []
+        else:
+            segment.append(token)
+    pipeline.append(segment)
+    pipelines.append(pipeline)
+    return pipelines
+
+
+def segment_parts(segment):
+    """Return (tool, args, reads_json) for one pipeline segment."""
+    reads_json = False
+    tool = None
+    args = []
+    index = 0
+    while index < len(segment):
+        token = segment[index]
+        if token == "<":
+            if index + 1 < len(segment) and is_json_path(segment[index + 1]):
+                reads_json = True
+            index += 2
+            continue
+        if token in (">", ">>", "<<", "<<<"):
+            index += 2
+            continue
+        if tool is None and (ASSIGNMENT.match(token) or token in WRAPPERS):
+            index += 1
+            continue
+        if tool is None:
+            tool = token.rsplit("/", 1)[-1]
+        else:
+            args.append(token)
+            if is_json_path(token):
+                reads_json = True
+        index += 1
+    return tool, args, reads_json
+
+
+def flags_of(args):
+    return [a for a in args if a.startswith("-")]
+
+
+def is_violation(tool, args, has_json_input):
+    if not has_json_input:
+        return False
+    flags = flags_of(args)
+    if tool in ("grep", "egrep", "fgrep"):
+        if any(f in ("-l", "-L", "--files-with-matches", "--files-without-match") for f in flags):
+            return False
+        return any(f == "-o" or f == "--only-matching" or ("o" in f[1:] and not f.startswith("--")) for f in flags)
+    if tool in ("sed", "gsed"):
+        if any(f.startswith("-i") or f == "--in-place" for f in flags):
+            return True
+        return any(re.match(r"^-?\d*s[/|#]", a) or a.startswith("s/") or a.startswith("s|") for a in args)
+    if tool == "cut":
+        for i, arg in enumerate(args):
+            if arg == "-d" and i + 1 < len(args) and args[i + 1] in ('"', "'", ":", ","):
+                return True
+            if arg.startswith("-d") and len(arg) > 2 and arg[2:] in ('"', "'", ":", ","):
+                return True
+        return False
+    if tool in ("awk", "gawk"):
+        if any(f == "-F" or f.startswith("-F") for f in flags):
+            return True
+        return any(re.search(r"\$\d", a) for a in args if not a.startswith("-"))
+    return False
+
+
+tokens = tokenize(strip_heredoc_bodies(command))
+if tokens is None:
+    sys.exit(0)
+
+pipelines = split_pipelines(tokens)
+
+# Whole-command jq exemption: any jq stage means the author is already using
+# the right tool; mixed pipelines (jq | grep) are legitimate.
+for pipeline in pipelines:
+    for segment in pipeline:
+        tool, _args, _reads = segment_parts(segment)
+        if tool == "jq":
+            sys.exit(0)
+
+for pipeline in pipelines:
+    json_stream = False
+    for segment in pipeline:
+        tool, args, reads_json = segment_parts(segment)
+        if tool is None:
+            continue
+        has_json_input = reads_json or json_stream
+        if tool in TEXT_TOOLS and is_violation(tool, args, has_json_input):
+            sys.exit(1)
+        # Streams originating from a .json file stay json-classified through
+        # pass-through text stages (cat x.json | grep … | cut …).
+        if reads_json or (json_stream and tool in TEXT_TOOLS | {"cat", "head", "tail", "sort", "uniq", "tr", "xargs"}):
+            json_stream = True
+        else:
+            json_stream = False
+
+sys.exit(0)
+PY
+then
+  cat >&2 <<'EOF'
+BLOCKED: this command parses JSON with text tools (grep/sed/cut/awk). Text
+tools break on valid JSON — multiline values, escaped quotes, reordered keys,
+nested objects — producing silently wrong output instead of errors. Use jq for
+all structural JSON reads and writes in shell. Typical fixes:
+  read a field:   jq -r '.field' file.json
+  filter items:   jq '.items[] | select(.name=="x")' file.json
+  edit in place:  jq '.key="value"' file.json > tmp && mv tmp file.json
+If you are only SEARCHING text inside a JSON file (not extracting values), use
+`rg <pattern> file.json` with no extraction pipe and this hook will not fire.
+EOF
+  exit 2
+fi
+
+exit 0

package/plugins/lisa-devin/hooks/cleanup-stale-worktrees.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+# This file is managed by Lisa.
+# Do not edit directly — changes will be overwritten on the next `lisa` run.
+#
+# SessionEnd sweep of abandoned agent worktrees under <repo>/.claude/worktrees.
+#
+# Why: Claude Code's built-in cleanup (cleanupPeriodDays) only removes
+# PRISTINE subagent worktrees — no changes, no untracked files, no unpushed
+# commits. Real agent worktrees almost always carry untracked junk
+# (node_modules, build output), so they survive forever and accumulate;
+# one long-lived repo reached 415 worktrees / 823GB, which also crashes
+# jest-haste-map's find-buffer crawl.
+#
+# Safety model — a worktree is removed only when ALL hold:
+#   * it lives under .claude/worktrees/ (never the primary checkout)
+#   * no modified or staged TRACKED files (real work is never deleted)
+#   * its HEAD commit is reachable from some remote ref (nothing unpushed)
+#   * its directory mtime is older than LISA_WORKTREE_MAX_AGE_DAYS (default 7)
+#   * lisa-worktree-guard reports no uncommitted bytes that exist in no commit
+# Untracked-only dirt does NOT block removal — that junk is exactly what
+# defeats the built-in sweep. But "untracked" and "junk" are not the same word:
+# a brand-new source file an agent has written and not yet committed is
+# untracked too, and this sweep would delete it (CodySwannGT/lisa#3863). The
+# guard draws the line by CONTENT rather than by tracking state — a file whose
+# exact bytes are already in some commit is free to delete, one whose bytes
+# exist nowhere else is not, and ignored paths (node_modules, build output)
+# never reach the question. Set LISA_WORKTREE_CLEANUP=off to disable.
+
+set -u
+
+[ "${LISA_WORKTREE_CLEANUP:-on}" = "off" ] && exit 0
+
+MAX_AGE_DAYS="${LISA_WORKTREE_MAX_AGE_DAYS:-7}"
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+
+# Never run the sweep from INSIDE an agent worktree — only the primary
+# checkout owns cleanup (a worktree deleting its siblings mid-session
+# would race other live sessions in the same repo).
+case "$repo_root" in
+  */.claude/worktrees/*) exit 0 ;;
+esac
+
+wt_root="$repo_root/.claude/worktrees"
+[ -d "$wt_root" ] || exit 0
+
+# Resolve the content-reachability guard once. Three homes, in the order a host
+# project actually has them: the applied copy, the installed package, and Lisa's
+# own delivery tree (Lisa does not apply this script to itself).
+guard=""
+for candidate in \
+  "$repo_root/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/node_modules/@codyswann/lisa/all/copy-overwrite/scripts/lisa-worktree-guard.mjs" \
+  "$repo_root/all/copy-overwrite/scripts/lisa-worktree-guard.mjs"; do
+  if [ -f "$candidate" ]; then
+    guard="$candidate"
+    break
+  fi
+done
+command -v node > /dev/null 2>&1 || guard=""
+
+# Whether a worktree's uncommitted content is safe to destroy. With the guard
+# present the question is answered by content; without it (no node, no delivered
+# script) the sweep falls back to the conservative shape — ANY non-ignored
+# untracked file keeps the tree. A missing guard must not read as consent.
+removal_allowed() {
+  if [ -n "$guard" ]; then
+    node "$guard" check "$1" > /dev/null 2>&1
+    return $?
+  fi
+  [ -z "$(git -C "$1" ls-files --others --exclude-standard 2> /dev/null | head -1)" ]
+}
+
+now=$(date +%s)
+max_age_secs=$((MAX_AGE_DAYS * 86400))
+removed=0
+
+git -C "$repo_root" worktree prune 2>/dev/null
+
+for wt in "$wt_root"/*/; do
+  wt="${wt%/}"
+  [ -d "$wt" ] || continue
+
+  # Age gate: skip anything recently touched (possibly a live session).
+  # GNU `stat -c` is tried first: GNU's `-f` means "filesystem status" (not
+  # BSD's "format"), so `stat -f %m` on Linux silently misparses instead of
+  # failing cleanly, defeating the fallback. Try the GNU form first — it
+  # fails cleanly with no stdout on BSD/macOS, letting `-f %m` take over.
+  mtime=$(stat -c %Y "$wt" 2>/dev/null || stat -f %m "$wt" 2>/dev/null) || continue
+  [ $((now - mtime)) -ge "$max_age_secs" ] || continue
+
+  if [ -e "$wt/.git" ]; then
+    # Real work gate: modified/staged tracked files survive. A failed
+    # `git status` (corrupted index, permission issue, etc.) must NOT be
+    # treated as clean — capture its exit status too and skip on failure.
+    status_output=$(git -C "$wt" status --porcelain --untracked-files=no 2>/dev/null) || continue
+    [ -z "$status_output" ] || continue
+
+    # Unpushed gate: HEAD must be reachable from a remote ref.
+    sha=$(git -C "$wt" rev-parse HEAD 2>/dev/null) || continue
+    [ -n "$(git -C "$wt" branch -r --contains "$sha" 2>/dev/null | head -1)" ] || continue
+
+    # Content gate: refuse to destroy bytes that live in no commit. The
+    # tracked-file check above answers a different question — a file an agent
+    # has written but never `git add`ed is untracked, so that check reports the
+    # tree clean while the whole deliverable sits in it. Only commits are shared
+    # between worktrees; this directory's working files and index are not.
+    removal_allowed "$wt" || continue
+
+    # git worktree lock (held during live agent execution) blocks removal;
+    # --force only clears untracked junk, never the gates above.
+    git -C "$repo_root" worktree remove --force "$wt" 2>/dev/null && removed=$((removed + 1))
+  else
+    # Orphan directory git no longer tracks (post-prune leftover).
+    rm -rf "$wt" && removed=$((removed + 1))
+  fi
+done
+
+git -C "$repo_root" worktree prune 2>/dev/null
+
+[ "$removed" -gt 0 ] && echo "Removed $removed stale agent worktree(s) from .claude/worktrees" >&2
+exit 0

package/plugins/lisa-devin/hooks/devin-tool-name-shim.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Generated by scripts/generate-devin-plugin-artifacts.mjs — do not edit.
+#
+# Devin CLI names its tools in lowercase (exec, write, edit, read, ...) while
+# Lisa's guards test Claude's names (Bash, Write, Edit, Read, ...). The field
+# names inside tool_input already match, so translating tool_name is enough
+# for an unchanged guard to evaluate a Devin tool call (CodySwannGT/lisa#4426).
+#
+# Usage: devin-tool-name-shim.sh <hook command> [args...]
+payload=$(cat)
+normalized=$payload
+if command -v jq >/dev/null 2>&1; then
+  mapped=$(printf '%s' "$payload" | jq -c '
+    if (.tool_name | type) == "string" then
+      .tool_name |= ({
+        "exec": "Bash",
+        "write": "Write",
+        "edit": "Edit",
+        "read": "Read",
+        "notebook_edit": "NotebookEdit",
+        "grep": "Grep",
+        "glob": "Glob",
+        "webfetch": "WebFetch",
+        "run_subagent": "Task",
+        "skill": "Skill",
+        "todo_write": "TodoWrite"
+      }[.] // .)
+    else . end' 2>/dev/null) && [ -n "$mapped" ] && normalized=$mapped
+fi
+printf '%s' "$normalized" | "$@"

package/plugins/lisa-devin/hooks/discharge-work-item-gates.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# This file is managed by Lisa and IS replaced on each `lisa` run.
+# Do not edit directly — durable changes belong upstream in Lisa.
+
+# =============================================================================
+# Discharge Deferred Work-Item Gates Hook (PostToolUse - Bash)
+# =============================================================================
+# Two of the five Work-Item Traceability gates live OUTSIDE the commits: gate 4
+# is the `Work-Item:` line in the pull-request BODY, and gate 5 is the managed
+# `[lisa-pr-link]` backlink on the item. A push cannot check either one —
+# both are properties of a pull request, and the push is what makes the pull
+# request possible — so until this hook existed the next thing that looked was
+# CI, one cycle later (CodySwannGT/lisa#3791).
+#
+# This fires the moment a pull request is created or its body edited, which is
+# the FIRST moment both gates are checkable. It evaluates them, and posts the
+# backlink that gate 5 needs, so neither waits for a red CI run to be revealed.
+#
+# Exit 2 blocks and hands the output back to the agent, which is the point: a
+# non-blocking notice here would be the same defect the discharge exists to
+# fix — a finding delivered somewhere nobody has to act on it.
+# =============================================================================
+set -uo pipefail
+
+JSON_INPUT="$(cat)"
+
+command -v jq >/dev/null 2>&1 || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+
+COMMAND="$(printf '%s' "$JSON_INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
+[ -n "$COMMAND" ] || exit 0
+
+# `gh pr create` opens one; `gh pr edit` is the other way a body comes to carry
+# — or lose — its declaration. Both change the answer to gate 4.
+#
+# `gh pr reopen` is here because a work item can hold more than one pull
+# request, and a reopened one is a named case: it was closed, so nothing has
+# discharged its gates since, and it is now live again with no CI run to reveal
+# that. Its backlink no longer displaces anyone else's, so re-running the
+# discharge for it is free (CodySwannGT/lisa#3916).
+case "$COMMAND" in
+  *"gh pr create"* | *"gh pr edit"* | *"gh pr reopen"*) ;;
+  *) exit 0 ;;
+esac
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 0
+[ -f "$repo_root/scripts/lisa-work-item.mjs" ] || exit 0
+
+output="$(cd "$repo_root" && node scripts/lisa-work-item.mjs discharge-pr-gates 2>&1)"
+status=$?
+
+# 0 is a clean discharge. 3 is the validator's own answer for "no pull request
+# to check yet", which PostToolUse reaches on every `gh pr create` that FAILED
+# — the tool call still ran, so the hook still fires. Collapsing 3 into the
+# blocking arm would report a work-item violation on somebody's typo.
+case "$status" in
+  0 | 3) exit 0 ;;
+esac
+
+# Plugin updates can precede a host's copied CLI. A generic usage refusal from
+# before this subcommand existed is not a ticket violation. Recognize only a
+# command-list line, then confirm that the no-argument usage probe returns the
+# SAME response and status. Never infer capabilities by grepping the entrypoint:
+# Lisa's own entrypoint is a thin import of the canonical implementation.
+# This shared hook fans out to every agent with a PostToolUse surface; agy's
+# documented lack of that surface remains covered by push/CI traceability.
+if [ "$status" -eq 1 ]; then
+  usage_commands="$(printf '%s\n' "$output" | sed -n \
+    -e 's/^Usage: lisa-work-item\.mjs //p' \
+    -e 's/^❌ Work-item tracking blocked this operation: Usage: lisa-work-item\.mjs //p')"
+  case "$usage_commands" in
+    '' | *[!a-z\|-]*) ;;
+    *)
+      case "|$usage_commands|" in
+        *'|discharge-pr-gates|'*) ;;
+        *'|validate-pr|'*)
+          probe_output="$(cd "$repo_root" && node scripts/lisa-work-item.mjs 2>&1)"
+          probe_status=$?
+          if [ "$probe_status" -eq 1 ] && [ "$probe_output" = "$output" ]; then
+            printf '%s\n' 'Lisa PR check unavailable: the host has an older Lisa command. Update Lisa in this project to enable the check.' >&2
+            exit 0
+          fi
+          ;;
+      esac
+      ;;
+  esac
+fi
+
+printf '%s\n' "$output" >&2
+exit 2