opencode-workflow-guard 1.1.5 → 1.3.0

package/src/policies/secrets.ts

@@ -0,0 +1,133 @@
+import { realpathSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { getWorkspaceRoot } from "../lib/state.ts";
+
+export const SAFE_ENV_FIXTURE_RE =
+	/\.env\.(example|sample|template|dist|schema)(\.[\w-]+)*$/i;
+
+export interface SecretPattern {
+	re: RegExp;
+	what: string;
+}
+
+export const SECRET_PATTERNS: SecretPattern[] = [
+	{ re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/, what: "private key material" },
+	{ re: /\bAKIA[0-9A-Z]{16}\b/, what: "AWS access key ID" },
+	{ re: /\bASIA[0-9A-Z]{16}\b/, what: "AWS temporary session credential" },
+	{ re: /\bghp_[A-Za-z0-9]{36}\b/, what: "GitHub personal access token" },
+	{ re: /\bgithub_pat_[A-Za-z0-9_]{82}\b/, what: "GitHub fine-grained PAT" },
+	{ re: /\bgho_[A-Za-z0-9]{36}\b/, what: "GitHub OAuth token" },
+	{ re: /\bghu_[A-Za-z0-9]{36}\b/, what: "GitHub user-to-server token" },
+	{ re: /\bghs_[A-Za-z0-9]{36}\b/, what: "GitHub server-to-server token" },
+	{ re: /\bghr_[A-Za-z0-9]{36}\b/, what: "GitHub refresh token" },
+	{ re: /\bsk-[A-Za-z0-9]{20,}\b/, what: "OpenAI-style API key" },
+	{ re: /\bog-[A-Za-z0-9]{20,}\b/, what: "OpenCode/legacy API key" },
+	{ re: /\bAIza[0-9A-Za-z_-]{35}\b/, what: "Google API key" },
+	{ re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, what: "Slack token (xox family)" },
+	{ re: /(?:^|\s)(?:AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)\s*=\s*\S+/, what: "AWS credential assignment" },
+	{ re: /(?:^|\s)(?:OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENAI_KEY)\s*=\s*\S+/, what: "LLM API key assignment" },
+];
+
+export function secretIn(content: string): string | undefined {
+	for (const { re, what } of SECRET_PATTERNS) {
+		if (re.test(content)) return what;
+	}
+	return undefined;
+}
+
+export function isSecretPath(targetPath: string): boolean {
+	if (!targetPath) return false;
+	const root = getWorkspaceRoot();
+	const resolved = resolve(root, targetPath);
+	const matches = (path: string): boolean => {
+		const base = basename(path).toLowerCase();
+		const full = path.toLowerCase();
+
+		// Safe fixtures
+		if (SAFE_ENV_FIXTURE_RE.test(base)) {
+			return false;
+		}
+
+		// .env files (e.g. .env, .env.local, .env.prod, .env.secret)
+		if (/^\.env(?:\.|$)/i.test(base)) {
+			return true;
+		}
+
+		// SSH & TLS key material
+		if (
+			/^(id_rsa|id_dsa|id_ecdsa|id_ed25519)(?:\.|$)/i.test(base) ||
+			/\.(pem|key|pkcs12|pfx|p12)$/i.test(base)
+		) {
+			return true;
+		}
+
+		// Cloud / cluster / service account credentials
+		if (
+			/kubeconfig/i.test(base) ||
+			full.includes("/.kube/config") ||
+			/^(service[-_]?account|client[-_]?secret).*\.json$/i.test(base) ||
+			/credentials\.json$/i.test(base) ||
+			full.includes("/.aws/credentials") ||
+			full.includes("/.docker/config.json") ||
+			base === ".netrc" ||
+			base === ".git-credentials"
+		) {
+			return true;
+		}
+
+		return false;
+	};
+
+	if (matches(resolved)) return true;
+	try {
+		return matches(realpathSync(resolved));
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Returns true specifically for environment variable files (.env, .env.local,
+ * etc.) that can safely present their schema (masked keys) to agents without
+ * exposing secret values.
+ */
+export function isEnvFilePath(targetPath: string): boolean {
+	if (!targetPath) return false;
+	const base = basename(targetPath).toLowerCase();
+	if (SAFE_ENV_FIXTURE_RE.test(base)) return false;
+	return /^\.env(?:\.|$)/i.test(base);
+}
+
+/**
+ * Parses a raw .env file and returns a sanitized schema mask where variable
+ * names and comment structures are preserved, but sensitive values are
+ * redacted to '********'.
+ */
+export function generateMaskedEnvSchema(content: string): string {
+	const lines = content.split("\n");
+	return lines
+		.map((line) => {
+			const trimmed = line.trim();
+			if (!trimmed || trimmed.startsWith("#")) return line;
+			const eqIdx = line.indexOf("=");
+			if (eqIdx === -1) return line;
+			const key = line.slice(0, eqIdx);
+			return `${key}=********`;
+		})
+		.join("\n");
+}
+
+export const SECRET_READ_COMMAND_RE =
+	/(?:^|\s)(?:cat|head|tail|less|more|grep|awk|sed|od|hexdump|strings|base64|xxd|nl|sort|uniq|view|nano|vim?)\s+[^|;&]*?(?:["']?)([\w\/.~-]*\.(?:pem|key|pfx|p12)|[\w\/.~-]*\.env(?:\.[\w-]+)*|[\w\/.~-]*id_(?:rsa|dsa|ecdsa|ed25519)[\w.-]*|[\w\/.~-]*kubeconfig[\w.-]*|[\w\/.~-]*(?:service[-_]?account|credentials|client[-_]?secret)[\w.-]*\.json)(?:["']?)/i;
+export const SIMPLE_FILE_READ_COMMAND_RE =
+	/(?:^|\s)(?:cat|head|tail|less|more|od|hexdump|strings|base64|xxd|nl|view|nano|vim?)\s+(?:-\S+\s+)*["']?([^\s|;&"']+)/i;
+
+export function secretFileReadIn(segment: string): string | undefined {
+	const match = segment.match(SECRET_READ_COMMAND_RE);
+	if (match?.[1] && isSecretPath(match[1])) {
+		return match[1];
+	}
+	const simpleMatch = segment.match(SIMPLE_FILE_READ_COMMAND_RE);
+	if (simpleMatch?.[1] && isSecretPath(simpleMatch[1])) return simpleMatch[1];
+	return undefined;
+}

package/src/policies/shell-safety.ts

@@ -0,0 +1,128 @@
+import { spawn } from "node:child_process";
+
+// AI agents frequently run dangerous package manager flags (e.g. npm audit fix --force,
+// npm install -g, pip install --force-reinstall, agent-driven publish) that introduce
+// breaking changes, downgrade packages insecurely, or execute arbitrary code.
+
+const PACKAGE_HYGIENE_PATTERNS: Array<{ regex: RegExp; name: string; advice: string }> = [
+	{
+		regex: /\bnpm\s+audit\s+fix\s+--force\b/i,
+		name: "destructive npm audit fix --force",
+		advice: "Run 'npm audit' or update dependencies individually in package.json. '--force' introduces breaking major version downgrades.",
+	},
+	{
+		regex: /\b(?:npm|pnpm|yarn|bun)\s+(?:install|i|add)\s+-[a-zA-Z]*g\b/i,
+		name: "global package installation",
+		advice: "Install packages locally as devDependencies (--save-dev) or execute with npx/bunx rather than polluting global machine state.",
+	},
+	{
+		regex: /\bpip\s+install\s+(?:--upgrade\s+)?--force-reinstall\b/i,
+		name: "destructive pip force reinstall",
+		advice: "Specify exact versions in requirements.txt or pyproject.toml instead of force reinstalling.",
+	},
+	{
+		regex: /\b(?:npm|yarn|pnpm|bun)\s+publish\b/i,
+		name: "direct package publish from agent subshell",
+		advice: "Package publishing must be managed by automated release workflows or explicit user release commands.",
+	},
+];
+
+export function checkPackageHygiene(command: string): { isViolating: boolean; name?: string; advice?: string } {
+	for (const { regex, name, advice } of PACKAGE_HYGIENE_PATTERNS) {
+		if (regex.test(command)) {
+			return { isViolating: true, name, advice };
+		}
+	}
+	return { isViolating: false };
+}
+
+// AI agents running in non-interactive terminal subshells hang indefinitely when an
+// interactive prompt (vim, nano, less, top, sudo, npm init without -y, apt without -y,
+// git rebase -i) waits for TTY input.
+
+const INTERACTIVE_COMMAND_PATTERNS: Array<{ regex: RegExp; name: string; advice: string }> = [
+	{
+		regex: /\b(?:nano|vim?|emacs|pico|joe|micro)\b/i,
+		name: "interactive text editor",
+		advice: "Use the edit, write, or apply_patch tools instead of interactive terminal editors.",
+	},
+	{
+		regex: /\b(?:less|more|most)\b/i,
+		name: "terminal pager",
+		advice: "Use cat, head, or grep with non-interactive pipes instead of interactive pagers.",
+	},
+	{
+		regex: /\b(?:top|htop|btop|atop|glances)\b/i,
+		name: "interactive process monitor",
+		advice: "Use ps aux, uptime, or batch flags (e.g. top -b -n 1) instead of interactive monitors.",
+	},
+	{
+		regex: /\bsudo\b/i,
+		name: "sudo with password prompt",
+		advice: "Avoid sudo in agent sessions; run commands directly or request user execution.",
+	},
+	{
+		regex: /\bgit\s+rebase\s+-[a-zA-Z]*i/i,
+		name: "git interactive rebase",
+		advice: "Use non-interactive git commands or explicit cherry-pick/merge sequences.",
+	},
+	{
+		regex: /\bgit\s+add\s+-[a-zA-Z]*p/i,
+		name: "git interactive patch",
+		advice: "Use git add <file> or git apply rather than interactive patch selection.",
+	},
+	{
+		regex: /\bnpm\s+init\b(?!\s+(?:-y|--yes|--force))\b/i,
+		name: "npm init without non-interactive flag",
+		advice: "Add -y or --yes flag: npm init -y",
+	},
+	{
+		regex: /\b(?:apt|apt-get)\s+(?:install|remove|purge|upgrade|dist-upgrade)\b(?!\s+(?:-y|--yes|--assume-yes))\b/i,
+		name: "apt command without non-interactive flag",
+		advice: "Add -y flag to avoid interactive confirmation prompts (e.g. apt-get install -y <pkg>).",
+	},
+	{
+		regex: /\b(?:yum|dnf)\s+(?:install|remove|upgrade)\b(?!\s+-y)\b/i,
+		name: "yum/dnf command without non-interactive flag",
+		advice: "Add -y flag to avoid interactive confirmation prompts (e.g. dnf install -y <pkg>).",
+	},
+];
+
+export function checkInteractiveTtyCommand(command: string): { isInteractive: boolean; name?: string; advice?: string } {
+	for (const { regex, name, advice } of INTERACTIVE_COMMAND_PATTERNS) {
+		if (regex.test(command)) {
+			return { isInteractive: true, name, advice };
+		}
+	}
+	return { isInteractive: false };
+}
+
+/**
+ * Dispatches a native OS desktop notification (macOS osascript or Linux notify-send)
+ * on important guard events (policy blocks, verification completion).
+ * Non-blocking, fails gracefully.
+ */
+export function sendDesktopNotification(title: string, message: string): void {
+	if (process.env.WORKFLOW_GUARD_NOTIFY === "0") return;
+	const safeTitle = title.replace(/"/g, '\\"');
+	const safeMsg = message.slice(0, 150).replace(/"/g, '\\"');
+
+	try {
+		if (process.platform === "darwin") {
+			const child = spawn(
+				"osascript",
+				["-e", `display notification "${safeMsg}" with title "${safeTitle}"`],
+				{ stdio: "ignore", detached: true },
+			);
+			child.on("error", () => {});
+			child.unref();
+		} else if (process.platform === "linux") {
+			const child = spawn("notify-send", [safeTitle, safeMsg], {
+				stdio: "ignore",
+				detached: true,
+			});
+			child.on("error", () => {});
+			child.unref();
+		}
+	} catch {}
+}

package/src/policies/tamper.ts

@@ -0,0 +1,86 @@
+import { realpathSync } from "node:fs";
+import { basename, relative, resolve } from "node:path";
+import { getWorkspaceRoot } from "../lib/state.ts";
+
+export const PROTECTED_PATH_REASON =
+	"Blocked: modifying Open" +
+	"Code settings, permissions, auth, or the guard " +
+	"plugin itself is not allowed from the agent. The user must change " +
+	"these manually in configuration or the UI.";
+
+const GT = String.fromCharCode(62);
+const V_LIST = ["sed\\s+-i", "tee", "mv", "cp", "rm", "chmod", "chown", "ln", "install", "truncate", "dd"].join("|");
+const C_LIST = ["open" + "code\\.jsonc?", "\\.config\\/open" + "code", "\\.open" + "code\\/"].join("|");
+const U_LIST = ["\\.config\\/open" + "code\\/(?:plugins|ui)\\/"].join("|");
+
+export const SETTINGS_TAMPER_PATTERNS: RegExp[] = [
+	new RegExp(`(?:^|\\s)(?:${V_LIST})\\s+[^|;&]*?(?:[\\w\\/.~-]*(?:${C_LIST}))`, "i"),
+	new RegExp(`${GT}\\s*["']?[\\w\\/.~-]*(?:${C_LIST})`, "i"),
+	new RegExp(`(?:^|\\s)(?:${V_LIST})\\s+[^|;&]*?[\\w\\/.~-]*(?:${U_LIST})`, "i"),
+	new RegExp(`${GT}\\s*["']?[\\w\\/.~-]*(?:${U_LIST})`, "i"),
+	new RegExp("(?:" + "^|\\s)(?:op" + "encode)\\s+(?:auth|config|permission)\\b", "i"),
+	new RegExp("(?:" + "^|\\s)(?:op" + "encode)\\s+(?:run\\s+)?--auto\\b", "i"),
+];
+
+export function normalizeShellEvasion(text: string): string {
+	return text
+		.replace(/'([^']*)'/g, "$1")
+		.replace(/"([^"]*)"/g, "$1")
+		.replace(/\\(.)/g, "$1");
+}
+
+export function normalizeGlobPathEvasion(text: string): string {
+	const ocJson = "op" + "encode.json";
+	return text
+		.replace(/opencode\.jso[?]/gi, ocJson)
+		.replace(/opencode\.[?*]/gi, ocJson);
+}
+
+export function isSettingsTamper(command: string): boolean {
+	const segments = command.split(/[\n|;&]+/).map((s) =>
+		normalizeGlobPathEvasion(normalizeShellEvasion(s)),
+	);
+	return segments.some((segment) =>
+		SETTINGS_TAMPER_PATTERNS.some((re) => re.test(segment)),
+	);
+}
+
+export function isProtectedPath(targetPath: string): boolean {
+	if (!targetPath) return false;
+	const root = getWorkspaceRoot();
+	const resolved = resolve(root, targetPath);
+	const matches = (path: string): boolean => {
+		const base = basename(path);
+		const lower = path.toLowerCase();
+		const dotOc = "." + "opencode/";
+		const cfgOc = "/.config/" + "opencode/";
+		const cfgOcJson = "/.config/" + "opencode.json";
+		return (
+			/^opencode\.jsonc?$/i.test(base) ||
+			/^workflow-guard\.jsonc?$/i.test(base) ||
+			// the .opencode directory itself and anything under it (project
+		// plugins, agents) - including the exact directory, not just paths
+		// nested inside it
+		lower === ".opencode" ||
+		lower.endsWith("/.opencode") ||
+		lower.includes("/" + dotOc) ||
+			lower.includes(cfgOc) ||
+			lower.includes(cfgOcJson)
+		);
+	};
+	if (matches(resolved)) return true;
+	try {
+		return matches(realpathSync(resolved));
+	} catch {
+		let ancestor = resolve(resolved, "..");
+		while (ancestor !== resolve(ancestor, "..")) {
+			try {
+				const realAncestor = realpathSync(ancestor);
+				return matches(resolve(realAncestor, relative(ancestor, resolved)));
+			} catch {
+				ancestor = resolve(ancestor, "..");
+			}
+		}
+		return false;
+	}
+}

package/src/policies/todo.ts

@@ -0,0 +1,106 @@
+import type { TodoItem } from "../lib/types.ts";
+import { getSdkClient } from "../lib/state.ts";
+
+export const EDIT_TOOL_NAMES = new Set(["edit", "write", "patch", "apply_patch"]);
+export const ACTIVE_TODO_STATUSES = new Set(["pending", "in_progress"]);
+
+export async function fetchSessionTodos(sessionID: string): Promise<TodoItem[] | undefined> {
+	const client = getSdkClient();
+	const session = client?.session;
+	const todo = session?.todo;
+	if (typeof todo !== "function") return undefined;
+	try {
+		const result = await todo.call(session, { path: { id: sessionID } });
+		const data = (result as { data?: unknown } | undefined)?.data;
+		return Array.isArray(data) ? (data as TodoItem[]) : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+export async function fetchParentSessionID(sessionID: string): Promise<string | undefined> {
+	const client = getSdkClient();
+	const session = client?.session;
+	const get = session?.get;
+	if (typeof get !== "function") return undefined;
+	try {
+		const result = await get.call(session, { path: { id: sessionID } });
+		const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
+		return typeof parent === "string" && parent ? parent : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+export async function effectiveTodos(
+	sessionID: string | undefined,
+): Promise<TodoItem[] | undefined> {
+	if (!sessionID) return undefined;
+	const seen = new Set<string>();
+	let current: string | undefined = sessionID;
+	while (current && !seen.has(current)) {
+		seen.add(current);
+		const todos = await fetchSessionTodos(current);
+		if (todos === undefined) return undefined;
+		if (todos.length > 0) return todos;
+		current = await fetchParentSessionID(current);
+	}
+	return [];
+}
+
+export async function effectiveTodoOwnerSessionID(
+	sessionID: string | undefined,
+): Promise<string | undefined> {
+	if (!sessionID) return undefined;
+	const seen = new Set<string>();
+	let current: string | undefined = sessionID;
+	while (current && !seen.has(current)) {
+		seen.add(current);
+		const todos = await fetchSessionTodos(current);
+		if (todos === undefined) return sessionID;
+		if (todos.length > 0) return current;
+		current = await fetchParentSessionID(current);
+	}
+	return sessionID;
+}
+
+export function hasActiveTodo(todos: TodoItem[]): boolean {
+	return todos.some((todo) => ACTIVE_TODO_STATUSES.has(String(todo.status ?? "")));
+}
+
+export function validateTodoLifecycle(
+	newTodos: TodoItem[],
+	existingTodos: TodoItem[] | undefined,
+): string | undefined {
+	// Rule: No silent task deletion while active work remains
+	// (single-focus rule removed: multiple tasks may be in_progress to allow
+	// concurrent subagent work on different tasks)
+	if (existingTodos && existingTodos.length > 0) {
+		const activeExisting = existingTodos.filter((t) => {
+			const s = String(t.status ?? "");
+			return s === "pending" || s === "in_progress";
+		});
+		if (activeExisting.length > 0) {
+			const newContentCounts = new Map<string, number>();
+			for (const todo of newTodos) {
+				const content = String(todo.content ?? "").trim();
+				newContentCounts.set(content, (newContentCounts.get(content) ?? 0) + 1);
+			}
+			const missing = activeExisting.find((todo) => {
+				const content = String(todo.content ?? "").trim();
+				const remaining = newContentCounts.get(content) ?? 0;
+				if (remaining === 0) return true;
+				newContentCounts.set(content, remaining - 1);
+				return false;
+			});
+			if (missing) {
+				return (
+					`Blocked todowrite: active task '${String(missing.content ?? "")}' was removed ` +
+					"without being marked completed or cancelled. Tasks cannot silently disappear."
+				);
+			}
+		}
+	}
+
+	return undefined;
+}

package/src/workflow-guard-ui.ts

@@ -24,19 +24,75 @@ function text(props: Record<string, unknown>, children: Child[]) {
 	return element("text", props, children);
 }
 
-const BADGE = "🛡️ [Workflow Guard: Active]";
+const BADGE_ACTIVE = "🛡️ [Workflow Guard: Active]";
+let lastBlockedReason: string | undefined;
+const sessionBlockedReasons = new Map<string, string>();
+const badgeNodes = new Map<string, unknown>();
+
+export function setLastBlockedReasonForTesting(reason: string | undefined): void {
+	lastBlockedReason = reason;
+	if (reason === undefined) sessionBlockedReasons.clear();
+}
+
+export function getLastBlockedReason(): string | undefined {
+	return lastBlockedReason;
+}
+
+export function formatBadge(sessionID?: string): { text: string; isBlocked: boolean } {
+	const reason = sessionID ? sessionBlockedReasons.get(sessionID) : lastBlockedReason;
+	if (!reason) {
+		return { text: BADGE_ACTIVE, isBlocked: false };
+	}
+	const cleanReason = reason.replace(/^\[workflow-guard\]\s*/, "").replace(/^Blocked:\s*/, "");
+	const shortReason = cleanReason.length > 30 ? cleanReason.slice(0, 27) + "..." : cleanReason;
+	return { text: `🛡️ [Workflow Guard: Blocked: ${shortReason}]`, isBlocked: true };
+}
 
 export const WorkflowGuardTui: TuiPlugin = async (api) => {
+	try {
+		api.event?.on?.("tui.toast.show" as any, (e: any) => {
+			const title = e?.properties?.title ?? e?.title;
+			const msg = e?.properties?.message ?? e?.message;
+			if (title === "Workflow Guard Blocked" && typeof msg === "string") {
+				lastBlockedReason = msg;
+				const route = api.route.current;
+				const sessionID =
+					route.name === "session" && typeof route.params?.sessionID === "string"
+						? route.params.sessionID
+						: undefined;
+				if (sessionID) sessionBlockedReasons.set(sessionID, msg);
+				const key = sessionID ?? "home";
+				const node = badgeNodes.get(key);
+				if (node) {
+					const badge = formatBadge(sessionID);
+					setProp(node as any, "content", badge.text);
+					setProp(node as any, "fg", badge.isBlocked ? api.theme.current.warning : api.theme.current.success);
+				}
+			}
+		});
+	} catch {}
+
 	api.slots.register({
 		order: 1,
 		slots: {
 			home_prompt_right() {
 				const theme = api.theme.current;
-				return text({ fg: theme.success }, [BADGE]);
+				const badge = formatBadge();
+				const node = text({ fg: badge.isBlocked ? theme.warning : theme.success }, [badge.text]);
+				badgeNodes.set("home", node);
+				return node;
 			},
 			session_prompt_right() {
 				const theme = api.theme.current;
-				return text({ fg: theme.success }, [BADGE]);
+				const route = api.route.current;
+				const sessionID =
+					route.name === "session" && typeof route.params?.sessionID === "string"
+						? route.params.sessionID
+						: undefined;
+				const badge = formatBadge(sessionID);
+				const node = text({ fg: badge.isBlocked ? theme.warning : theme.success }, [badge.text]);
+				if (sessionID) badgeNodes.set(sessionID, node);
+				return node;
 			},
 		},
 	});