opencode-workflow-guard 1.10.0 → 1.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/tool-outcomes.ts

@@ -27,6 +27,7 @@ export class ToolOutcomeTracker {
 	private readonly terminalCalls = new Map<string, Set<string>>();
 	private readonly fallbackCalls = new Map<string, Set<string>>();
 	private readonly failures = new Map<string, { signature: string; count: number }>();
+	private readonly consecutiveFailures = new Map<string, number>();
 
 	record(part: ToolOutcomePart): ToolOutcome | undefined {
 		if (part.type !== "tool" || typeof part.sessionID !== "string" || typeof part.callID !== "string" || typeof part.tool !== "string") return undefined;
@@ -51,6 +52,7 @@ export class ToolOutcomeTracker {
 		const durationMs = typeof start === "number" && Number.isFinite(start) && typeof end === "number" && Number.isFinite(end) ? Math.max(0, end - start) : undefined;
 		if (status === "completed") {
 			this.failures.delete(part.sessionID);
+			this.consecutiveFailures.delete(part.sessionID);
 			return { sessionID: part.sessionID, callID: part.callID, tool: part.tool, status, durationMs };
 		}
 
@@ -59,6 +61,10 @@ export class ToolOutcomeTracker {
 		const previous = this.failures.get(part.sessionID);
 		const count = previous?.signature === signature ? previous.count + 1 : 1;
 		this.failures.set(part.sessionID, { signature, count });
+
+		const consecutive = (this.consecutiveFailures.get(part.sessionID) ?? 0) + 1;
+		this.consecutiveFailures.set(part.sessionID, consecutive);
+
 		return { sessionID: part.sessionID, callID: part.callID, tool: part.tool, status, durationMs, repeatedFailureCount: count };
 	}
 
@@ -75,11 +81,14 @@ export class ToolOutcomeTracker {
 	}
 
 	getFailureCount(sessionID: string): number {
-		return this.failures.get(sessionID)?.count ?? 0;
+		const consecutive = this.consecutiveFailures.get(sessionID) ?? 0;
+		const equivalent = this.failures.get(sessionID)?.count ?? 0;
+		return Math.max(consecutive, equivalent);
 	}
 
 	clearSession(sessionID: string): void {
 		this.failures.delete(sessionID);
+		this.consecutiveFailures.delete(sessionID);
 		this.terminalCalls.delete(sessionID);
 		this.fallbackCalls.delete(sessionID);
 	}

package/src/policies/boundary.ts

@@ -158,13 +158,9 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 			what: `tee to '${teeTargets[0]!}'`,
 		};
 	}
-	const sedWords = shellWords(unwrapShellCommand(segment));
-	if (sedWords[0] === "sed" && sedWords.slice(1).some((word) => /^-(?:[a-zA-Z]*i|i\S*)$/.test(word) || /^--in-place(?:=.*)?$/.test(word))) {
-		const operands = sedWords.slice(1).filter((word) => !word.startsWith("-"));
-		const target = operands.at(-1);
-		if (!target) return undefined;
-		return { kind: "command", target, what: `sed -i on '${target}'` };
-	}
+	const simple = simpleFilesystemMutations(segment);
+	if (simple.length > 0) return simple[0];
+
 	const transfer = filesystemTransferInfo(segment);
 	if (transfer?.destination) {
 		return {
@@ -173,34 +169,45 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 			what: `copy/move/link to '${transfer.destination}'`,
 		};
 	}
-	const fsMutationMatch = segment.match(
-		/\b(?:touch|mkdir|rm|unlink|rmdir|ln)\b[^|;&]*\s+["']?([^\s;&|"']+)["']?\s*$/,
-	);
-	if (fsMutationMatch?.[1] && !fsMutationMatch[1].startsWith("-")) {
-		return {
-			kind: "command",
-			target: fsMutationMatch[1],
-			what: `filesystem mutation of '${fsMutationMatch[1]}'`,
-		};
+	const words = shellWords(unwrapShellCommand(segment));
+	const command = words[0];
+	if (!command) return undefined;
+
+	if (command === "curl") {
+		for (let i = 1; i < words.length; i++) {
+			const w = words[i]!;
+			if ((w === "-o" || w === "--output") && i + 1 < words.length) {
+				return { kind: "command", target: words[i + 1]!, what: `curl output to '${words[i + 1]!}'` };
+			}
+			if (w.startsWith("--output=")) {
+				const target = w.slice("--output=".length);
+				return { kind: "command", target, what: `curl output to '${target}'` };
+			}
+		}
 	}
-	const copyMatch = segment.match(
-		/\b(?:cp|mv|rsync|install|cpio|scp|wget|curl)\b[^|;&]*?(-o\s+)?(["']?)([^\s;&|"']+)\2?\s*$/,
-	);
-	if (copyMatch?.[3] && /\b(?:cp|mv|rsync|install)\b/.test(segment)) {
-		return {
-			kind: "command",
-			target: copyMatch[3],
-			what: `copy/move to '${copyMatch[3]}'`,
-		};
+	if (command === "wget") {
+		for (let i = 1; i < words.length; i++) {
+			const w = words[i]!;
+			if ((w === "-O" || w === "--output-document") && i + 1 < words.length) {
+				return { kind: "command", target: words[i + 1]!, what: `wget output to '${words[i + 1]!}'` };
+			}
+			if (w.startsWith("--output-document=")) {
+				const target = w.slice("--output-document=".length);
+				return { kind: "command", target, what: `wget output to '${target}'` };
+			}
+		}
 	}
-	if (/\bgit\s+(?:apply|am)\b/.test(segment)) {
-		return { kind: "command", what: "git apply/am (patch via shell)" };
+	if (command === "git") {
+		const sub = words.slice(1).find((w) => !w.startsWith("-"));
+		if (sub === "apply" || sub === "am") {
+			return { kind: "command", what: "git apply/am (patch via shell)" };
+		}
 	}
 	return undefined;
 }
 
 const SIMPLE_MUTATION_COMMANDS = new Set(["touch", "mkdir", "rm", "unlink", "rmdir", "truncate", "chmod", "chown", "chgrp"]);
-const TRANSFER_COMMANDS = new Set(["cp", "mv", "ln"]);
+const TRANSFER_COMMANDS = new Set(["cp", "mv", "ln", "rsync", "install", "cpio", "scp"]);
 
 export function simpleFilesystemMutations(segment: string): ShellMutation[] {
 	const words = shellWords(unwrapShellCommand(segment));

package/test/test.mts

@@ -497,6 +497,9 @@ check("sed -i on opencode.json blocked (tamper)", blocked(await call("bash", { c
 check("git apply needs todos (patch via shell)", blocked(await call("bash", { command: "git apply patch.diff" }, { sessionID: "s-empty" })));
 check("git apply allowed with todos", !(await call("bash", { command: "git apply patch.diff" }, { sessionID: "s-active" })));
 check("non-mutating shell unaffected (ls, cat)", !(await call("bash", { command: "ls -la && cat file" }, { sessionID: "s-empty" })));
+check("inspection command with mutation keywords in grep argument is not blocked", !(await call("bash", { command: 'strings /bin/opencode | grep -E "install plugin and update config" -C 10' }, { sessionID: "s-empty" })));
+check("git log with mutation keywords in grep argument is not blocked", !(await call("bash", { command: 'git log --grep="rm old files"' }, { sessionID: "s-empty" })));
+check("grep searching for mutation command name is not blocked", !(await call("bash", { command: 'grep -rn "mkdir" src/' }, { sessionID: "s-empty" })));
 check("stderr redirect to /dev/null is not a file mutation", !(await call("bash", { command: "ls missing 2>/dev/null" }, { sessionID: "s-empty" })));
 check("touch outside workspace is blocked", blocked(await call("bash", { command: "touch /tmp/wg-outside-touch" }, { sessionID: "s-active" })));
 check("mkdir outside workspace is blocked", blocked(await call("bash", { command: "mkdir /tmp/wg-outside-dir" }, { sessionID: "s-active" })));
@@ -1112,6 +1115,12 @@ outcomeTracker.record({ type: "tool", sessionID: "s-tracker", callID: "success",
 check("successful tool outcomes reset equivalent failure tracking", outcomeTracker.record(failedPart("after-success", "same failure"))?.repeatedFailureCount === 1);
 outcomeTracker.record(failedPart("different", "different failure"));
 check("distinct failures reset equivalent failure tracking", outcomeTracker.record(failedPart("after-different", "same failure"))?.repeatedFailureCount === 1);
+const consecutiveTracker = new ToolOutcomeTracker();
+consecutiveTracker.record(failedPart("diverse-1", "failure A"));
+consecutiveTracker.record(failedPart("diverse-2", "failure B"));
+check("consecutive diverse failures track failure count for circuit breaker", consecutiveTracker.getFailureCount("s-tracker") === 2);
+consecutiveTracker.record({ type: "tool", sessionID: "s-tracker", callID: "diverse-success", tool: "bash", state: { status: "completed" } });
+check("successful tool outcome resets consecutive failure count", consecutiveTracker.getFailureCount("s-tracker") === 0);
 const boundedTracker = new ToolOutcomeTracker();
 for (let i = 0; i < 4096; i++) boundedTracker.record({ type: "tool", sessionID: "s-bounded", callID: `call-${i}`, tool: "bash", state: { status: "completed" } });
 check("terminal call deduplication remains stable within its bounded window", boundedTracker.record({ type: "tool", sessionID: "s-bounded", callID: "call-0", tool: "bash", state: { status: "completed" } }) === undefined);