@agent-guardrails/opencode-shell-warden-hook 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-guardrails/opencode-shell-warden-hook",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "OpenCode V2 hook plugin: forwards shell permission decisions to the shell-warden engine over NDJSON JSON-RPC stdio",
   "type": "module",
   "repository": {

package/src/apply.ts

@@ -27,24 +27,29 @@ export function cacheKey(action: string, resources: readonly string[], cwd: stri
     .digest("hex")
 }
 
-/** Letter per 02-letter-verdict.md §2.2 — exactly the schema fields, no extras. */
+/** Letter per 02-letter-verdict.md §2.2 — exactly the schema fields, no extras.
+ * `projectDir` is required and non-empty: the engine invalidates every letter whose
+ * commands[].cwd is empty ("letter commands[0].cwd must be 1..4096 chars"), and the
+ * ask payload carries no per-command cwd — the permission request's directory is the
+ * only cwd the shim has. Callers without a directory must degrade before calling. */
 export function buildLetter(args: {
   data: AskData
   invocationId: string
-  projectDir?: string
+  projectDir: string
   agent?: string
 }): Letter {
   const { data, invocationId, projectDir, agent } = args
+  if (!projectDir) throw new Error("buildLetter: projectDir is required — the engine rejects letters with an empty commands[].cwd")
   return {
     version: 1,
     invocation: {
       id: invocationId,
       sessionID: data.sessionID ?? "",
       ...(agent !== undefined ? { agent } : {}),
-      ...(projectDir !== undefined ? { projectDir } : {}),
+      projectDir,
     },
     action: data.action ?? "",
-    commands: (data.resources ?? []).map((raw, index) => ({ index, raw, cwd: "" })),
+    commands: (data.resources ?? []).map((raw, index) => ({ index, raw, cwd: projectDir })),
   }
 }
 

package/src/index.ts

@@ -80,8 +80,17 @@ export default Plugin.define({
           try {
             if (!(cfg.actionsAll || cfg.actions.includes(d.action))) continue
             const invocationId = invocationIdOf(d.source, d.sessionID, d.action)
-            const projectDir = myLocation || undefined
-            const key = cacheKey(d.action, d.resources, projectDir ?? "")
+            // The ask payload carries no per-command cwd; the permission event's
+            // location is the only directory the shim has. Letters with an empty
+            // commands[].cwd are rejected by the engine, so without one we degrade —
+            // never spawn a letter the engine would refuse.
+            const projectDir = loc || myLocation || ""
+            if (!projectDir) {
+              log("warn", `no project directory for ${invocationId} — degrade (${cfg.onCheckerError})`)
+              if (cfg.onCheckerError === "deny") await reply(d.sessionID, d.id, "reject", undefined).catch(() => {})
+              continue
+            }
+            const key = cacheKey(d.action, d.resources, projectDir)
 
             if (cfg.cache.enabled) {
               const cached = cache.get(key)