opencode-workflow-guard 1.12.1 → 1.13.2

package/test/test-e2e.mts

@@ -7,8 +7,9 @@ import { parse as parseJsonc } from "jsonc-parser";
 let pass = 0;
 let fail = 0;
 let unavailable = 0;
-const check = (name: string, cond: unknown): void => {
+const check = (name: string, cond: unknown): boolean => {
 	cond ? (pass++, console.log("  ok  " + name)) : (fail++, console.log("FAIL  " + name));
+	return Boolean(cond);
 };
 const providerUnavailable = (output: string): boolean =>
 	/available credits|insufficient credits|rate limit|too many requests|capacity|overloaded/i.test(output);
@@ -137,7 +138,7 @@ check("server and TUI package specs resolve to different modules", installedPack
 const opencodeCheck = spawnSync("opencode", ["--version"], { encoding: "utf8" });
 if (opencodeCheck.status !== 0) {
 	console.log("SKIP: opencode CLI is not available in PATH. Package checks passed; skipping live runtime load tests.");
-	rmSync(testDir, { recursive: true, force: true });
+	if (!process.env.WG_E2E_KEEP) rmSync(testDir, { recursive: true, force: true });
 	console.log(`\n${pass} passed, ${fail} failed`);
 	process.exit(fail > 0 ? 1 : 0);
 }
@@ -149,20 +150,41 @@ mkdirSync(pluginsDir, { recursive: true });
 
 // Pre-seed .opencode with dependencies already installed into testDir
 // so opencode does not execute a cold network install at runtime startup.
-const opencodeVersion = opencodeCheck.stdout.trim();
+const opencodeVersionRaw = opencodeCheck.stdout.trim();
+const opencodeSemver = opencodeVersionRaw.match(/(\d+\.\d+\.\d+)/)?.[1] ?? opencodeVersionRaw;
+const opencodeMajor = Number(opencodeSemver.split(".")[0] ?? 1);
+const isOpenCodeV2 = opencodeMajor >= 2;
 const lockPath = join(testDir, "package-lock.json");
 if (existsSync(lockPath) && existsSync(join(testDir, "node_modules"))) {
 	try {
 		const lock = JSON.parse(readFileSync(lockPath, "utf8"));
 		lock.name = ".opencode";
-		if (lock.packages?.["node_modules/@opencode-ai/plugin"]) {
-			lock.packages["node_modules/@opencode-ai/plugin"].version = opencodeVersion;
+		const installedVersions: Record<string, string> = {};
+		for (const key of ["node_modules/@opencode-ai/plugin", "node_modules/@opencode/plugin"]) {
+			const version = lock.packages?.[key]?.version;
+			if (typeof version === "string" && version) installedVersions[key.replace("node_modules/", "")] = version;
 		}
-		if (lock.packages?.[""]) {
-			lock.packages[""].dependencies = { "@opencode-ai/plugin": opencodeVersion };
+		if (isOpenCodeV2) {
+			// V2 loads .opencode deps with the real installed versions; rewriting
+			// them to the CLI version string would produce invalid semver.
+			const dependencies: Record<string, string> = {};
+			for (const [name, version] of Object.entries(installedVersions)) dependencies[name] = version;
+			if (!Object.keys(dependencies).length) dependencies["@opencode/plugin"] = "latest";
+			if (lock.packages?.[""]) {
+				lock.packages[""].dependencies = dependencies;
+			}
+			writeFileSync(join(opencodeDir, "package-lock.json"), JSON.stringify(lock, null, 2) + "\n");
+			writeFileSync(join(opencodeDir, "package.json"), JSON.stringify({ name: ".opencode", dependencies }, null, 2) + "\n");
+		} else {
+			if (lock.packages?.["node_modules/@opencode-ai/plugin"]) {
+				lock.packages["node_modules/@opencode-ai/plugin"].version = opencodeSemver;
+			}
+			if (lock.packages?.[""]) {
+				lock.packages[""].dependencies = { "@opencode-ai/plugin": opencodeSemver };
+			}
+			writeFileSync(join(opencodeDir, "package-lock.json"), JSON.stringify(lock, null, 2) + "\n");
+			writeFileSync(join(opencodeDir, "package.json"), JSON.stringify({ name: ".opencode", dependencies: { "@opencode-ai/plugin": opencodeSemver } }, null, 2) + "\n");
 		}
-		writeFileSync(join(opencodeDir, "package-lock.json"), JSON.stringify(lock, null, 2) + "\n");
-		writeFileSync(join(opencodeDir, "package.json"), JSON.stringify({ name: ".opencode", dependencies: { "@opencode-ai/plugin": opencodeVersion } }, null, 2) + "\n");
 		cpSync(join(testDir, "node_modules"), join(opencodeDir, "node_modules"), { recursive: true });
 	} catch {}
 }
@@ -179,20 +201,63 @@ const importedMarker = join(testDir, ".workflow-guard-imported");
 const initializedMarker = join(testDir, ".workflow-guard-initialized");
 const accountabilityMarker = join(testDir, ".workflow-guard-accountability");
 writeFileSync(localAdapter, `import { writeFileSync } from "node:fs";
+import { Plugin } from "@opencode/plugin";
 
 writeFileSync(${JSON.stringify(importedMarker)}, "imported\\n");
 
-export const WorkflowGuardE2E = async (ctx: any) => {
-\tconst { WorkflowGuard } = await import("../workflow-guard-source/workflow-guard.ts");
-\tconst hooks = await WorkflowGuard(ctx);
-\tconst status = await hooks.tool?.guard_status?.execute({}, { sessionID: "headless-e2e", directory: ctx.directory, worktree: ctx.worktree });
-\tconst why = await hooks.tool?.guard_why?.execute({ tool: "bash", input: { command: "git push origin main" } }, { sessionID: "headless-e2e", directory: ctx.directory, worktree: ctx.worktree });
+// Load the shipped dual plugin: V1 probes call server(), V2 runs the real
+// setup(ctx) against the real plugin context and probes the REGISTERED tools.
+const loaded = await import("../workflow-guard-source/workflow-guard.ts");
+
+const headlessToolContext = { sessionID: "headless-e2e", agent: "build", messageID: "msg_headless", id: "call_headless", progress: async () => {} };
+
+const runV2Probes = async (ctx: any) => {
+\tawait loaded.default.setup(ctx);
+\tconst tools = await ctx.tool.list();
+\tconst byId = (id: string) => tools.find((t: any) => t.id === id);
+\tconst todowrite = byId("todowrite");
+\tconst guardStatus = byId("guard_status");
+\tconst guardWhy = byId("guard_why");
+\tconst pick = (r: any) => (typeof r?.content === "string" ? r.content : JSON.stringify(r));
+\tconst statusRes = guardStatus ? await guardStatus.execute({}, headlessToolContext) : undefined;
+\tconst whyRes = guardWhy ? await guardWhy.execute({ tool: "bash", input: { command: "git push origin main" } }, headlessToolContext) : undefined;
+\twriteFileSync(${JSON.stringify(accountabilityMarker)}, JSON.stringify({
+\t\ttools: tools.map((t: any) => t.id),
+\t\ttodowriteEnriched: Boolean(todowrite?.description?.includes("Workflow Guard lifecycle")),
+\t\tstatus: JSON.parse(pick(statusRes)),
+\t\twhy: JSON.parse(pick(whyRes)),
+\t}) + "\\n");
+\twriteFileSync(${JSON.stringify(initializedMarker)}, "initialized\\n");
+};
+
+const runV1Probes = async (ctx: any) => {
+\tconst hooks = await loaded.default.server(ctx);
+\tconst directory = ctx?.location?.directory ?? ctx?.directory ?? process.cwd();
+\tconst toolCtx = { sessionID: "headless-e2e", directory, worktree: directory };
+\tconst status = await hooks.tool?.guard_status?.execute({}, toolCtx);
+\tconst why = await hooks.tool?.guard_why?.execute({ tool: "bash", input: { command: "git push origin main" } }, toolCtx);
 \twriteFileSync(${JSON.stringify(accountabilityMarker)}, JSON.stringify({ status: JSON.parse(String(status)), why: JSON.parse(String(why)) }) + "\\n");
 \twriteFileSync(${JSON.stringify(initializedMarker)}, "initialized\\n");
 \treturn hooks;
 };
 
-export default { id: "workflow-guard-e2e", server: WorkflowGuardE2E };
+export default {
+\t...Plugin.define({
+\t\tid: "workflow-guard-e2e",
+\t\tasync setup(ctx: any) {
+\t\t\twriteFileSync(${JSON.stringify(importedMarker)}, "imported\\n");
+\t\t\ttry {
+\t\t\t\tawait runV2Probes(ctx);
+\t\t\t} catch (error) {
+\t\t\t\twriteFileSync(${JSON.stringify(accountabilityMarker)}, JSON.stringify({ error: String((error as Error)?.message ?? error), stack: String((error as Error)?.stack ?? "") }) + "\\n");
+\t\t\t\tthrow error;
+\t\t\t}
+\t\t},
+\t}),
+\tserver: async (ctx: any) => {
+\t\treturn await runV1Probes(ctx);
+\t},
+};
 `);
 writeFileSync(join(testDir, ".opencode", "opencode.json"), `${JSON.stringify({ plugin: ["./plugins/workflow-guard.ts"] }, null, 2)}\n`);
 check("local plugin adapter and source copied successfully", existsSync(localAdapter) && existsSync(targetPlugin));
@@ -211,6 +276,13 @@ const runtimeEnv: NodeJS.ProcessEnv = {
 delete runtimeEnv.OPENCODE_PID;
 delete runtimeEnv.OPENCODE_PURE;
 delete runtimeEnv.OPENCODE;
+if (isOpenCodeV2) {
+	// V2 runs a shared managed service on a fixed default port. Each run uses
+	// its own isolated XDG dirs, so pick a run-unique port to keep concurrent
+	// and sequential runs from colliding on service startup.
+	const servicePort = 49400 + (process.pid % 1000);
+	spawnSync("opencode", ["service", "set", "port", String(servicePort)], { cwd: testDir, encoding: "utf8", env: runtimeEnv, timeout: 30_000 });
+}
 const runOpenCode = (args: string[], timeout: number) =>
 	spawnSync("opencode", ["run", "--dir", testDir, ...args], { cwd: testDir, encoding: "utf8", timeout, env: runtimeEnv });
 const configProbe = await new Promise<{ status: number | null; stdout: string; stderr: string }>((resolve) => {
@@ -229,7 +301,11 @@ const configProbe = await new Promise<{ status: number | null; stdout: string; s
 
 	const checkReady = () => {
 		try {
-			if (JSON.parse(stdout)?.plugin_origins && existsSync(initializedMarker)) {
+			const parsed = JSON.parse(stdout);
+			// V1 prints an object with plugin_origins; V2 prints a config document
+			// array. Either way, the adapter's setup/server must have run.
+			const hasConfig = Boolean(parsed?.plugin_origins) || Array.isArray(parsed);
+			if (hasConfig && existsSync(initializedMarker)) {
 				done(0);
 			}
 		} catch {}
@@ -247,26 +323,52 @@ const configProbe = await new Promise<{ status: number | null; stdout: string; s
 
 	timer = setTimeout(() => done(null), 30_000);
 });
+if (isOpenCodeV2) {
+	// V2's debug config can exit before plugin setup completes; wait briefly
+	// for the adapter's initialized marker before evaluating plugin checks.
+	for (let i = 0; i < 200 && !existsSync(initializedMarker); i++) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+	}
+}
 let configLoadsLocalPlugin = false;
 try {
-	const config = JSON.parse(configProbe.stdout);
-	configLoadsLocalPlugin = config.plugin_origins?.some(
-		(origin: { spec?: unknown; source?: unknown; scope?: unknown }) =>
-			typeof origin.spec === "string" &&
-			origin.spec.endsWith("/.opencode/plugins/workflow-guard.ts") &&
-			origin.scope === "local",
-	);
+	if (isOpenCodeV2) {
+		// V2 has no plugin_origins in debug config output; the adapter's setup
+		// writing the imported marker is the plugin-load proof.
+		configLoadsLocalPlugin = existsSync(importedMarker) && existsSync(initializedMarker);
+	} else {
+		const config = JSON.parse(configProbe.stdout);
+		configLoadsLocalPlugin = config.plugin_origins?.some(
+			(origin: { spec?: unknown; source?: unknown; scope?: unknown }) =>
+				typeof origin.spec === "string" &&
+				origin.spec.endsWith("/.opencode/plugins/workflow-guard.ts") &&
+				origin.scope === "local",
+		);
+	}
 } catch {}
-check("OpenCode resolves isolated local plugin config without a model provider", configProbe.status === 0 && configLoadsLocalPlugin);
+const configCheckPassed = Boolean(check("OpenCode resolves isolated local plugin config without a model provider", configProbe.status === 0 && configLoadsLocalPlugin));
+if (!configCheckPassed) {
+	console.log(`  configProbe stderr: ${configProbe.stderr.slice(0, 2000)}`);
+	console.log(`  configProbe stdout: ${configProbe.stdout.slice(0, 2000)}`);
+	console.log(`  importedMarker: ${existsSync(importedMarker)} initializedMarker: ${existsSync(initializedMarker)}`);
+}
 let headlessAccountability: any;
 try {
 	headlessAccountability = JSON.parse(readFileSync(accountabilityMarker, "utf8"));
 } catch {}
 check("headless OpenCode runtime exposes structured guard status and why without TUI", headlessAccountability?.status?.workspaceRoot === testDir && headlessAccountability?.why?.policy === "git" && headlessAccountability?.why?.code === "protected_branch_push");
+if (isOpenCodeV2) {
+	// The V2 adapter runs the shipped setup(ctx) for real; verify the
+	// registered tool surface. Builtin description enrichment is best-effort:
+	// builtins are not visible to ctx.tool.list() during plugin setup, so
+	// todowriteEnriched is reported but not asserted.
+	check("V2 setup registers custom guard tools", (headlessAccountability?.tools ?? []).includes("guard_status") && (headlessAccountability?.tools ?? []).includes("guard_why"));
+	console.log(`  note: builtin todowrite description enriched under V2: ${headlessAccountability?.todowriteEnriched === true ? "yes" : "unknown at setup time"}`);
+}
 
 if (process.env.WORKFLOW_GUARD_LIVE_E2E !== "1") {
 	console.log("SKIP: model-driven policy probes require WORKFLOW_GUARD_LIVE_E2E=1.");
-	rmSync(testDir, { recursive: true, force: true });
+	if (!process.env.WG_E2E_KEEP) rmSync(testDir, { recursive: true, force: true });
 	console.log(`\n${pass} passed, ${fail} failed`);
 	process.exit(fail > 0 ? 1 : 0);
 }
@@ -286,7 +388,7 @@ try {
 const liveModel = process.env.WORKFLOW_GUARD_LIVE_MODEL?.trim() || recentModel;
 if (!liveModel) {
 	console.error(`FAIL: no recent OpenCode model found in ${recentModelPath}; select a model in OpenCode or set WORKFLOW_GUARD_LIVE_MODEL=provider/model.`);
-	rmSync(testDir, { recursive: true, force: true });
+	if (!process.env.WG_E2E_KEEP) rmSync(testDir, { recursive: true, force: true });
 	process.exit(1);
 }
 console.log(`  Using live model: ${liveModel}`);
@@ -337,7 +439,7 @@ if (!run3AccountedFor) {
 }
 
 // Clean up
-rmSync(testDir, { recursive: true, force: true });
+if (!process.env.WG_E2E_KEEP) rmSync(testDir, { recursive: true, force: true });
 
 console.log(`\n${pass} passed, ${fail} failed, ${unavailable} live unavailable`);
 process.exit(fail ? 1 : 0);

package/test/test.mts

@@ -14,6 +14,7 @@ import {
 	WorkflowGuard,
 	buildCompactionContext,
 	detectVerifyCommand,
+	resolveVerifyTimeoutMs,
 	runVerify,
 	getCleanEnv,
 	resetVerifyState,
@@ -442,6 +443,11 @@ check("block auth with global flags (--dir)", blocked(await shell(`${ocCli} --di
 check("block config with global flags (-d)", blocked(await shell(`${ocCli} -d . ${"con" + "fig"} edit`)));
 check("block permission with global flags (--workspace)", blocked(await shell(`${ocCli} --workspace . ${"perm" + "ission"} grant`)));
 check("allow normal command", !(await shell("ls -la && git status")));
+const ocDir = ".open" + "code/plans/";
+check("allow gh issue create mentioning .opencode paths (not tamper)", !(await shell(`gh issue create --repo example/proj --title t --body 'see <project>/${ocDir}'`)));
+check("compound collaboration + tamper still blocked", blocked(await shell(`gh issue create --repo example/proj --title t && echo x > open${"code.json"}`)));
+check("collaboration command with real redirect to global config still blocked", blocked(await shell(`gh issue list > /var/home/x/.config/open${"code"}/opencode.json`)));
+check("collaboration command with redirect outside workspace still blocked", blocked(await shell(`gh pr create --title t > /tmp/wg-escape-probe`)));
 
 console.log("- Policy 6: tamper via edit tools (path protection) -");
 check("block edit of project opencode.json", blocked(await call("edit", { filePath: join(root, "opencode.json"), oldString: "a", newString: "b" }, { sessionID: "s-active" })));
@@ -449,6 +455,22 @@ check("block write of .opencode/project config", blocked(await call("write", { f
 check("block write of global opencode config path", blocked(await call("write", { filePath: "/var/home/x/.config/opencode/opencode.json", content: "{}" }, { sessionID: "s-active" })));
 check("block apply_patch to opencode.json", blocked(await call("apply_patch", { patchText: "*** Update File: opencode.json\n" }, { sessionID: "s-active" })));
 check("allow edit of normal source file", !(await call("edit", { filePath: join(root, "src", "index.ts"), oldString: "a", newString: "b" }, { sessionID: "s-active" })));
+check("allow write of docs mentioning .opencode paths (not tamper)", !(await call("write", { filePath: join(root, "docs", "guard.md"), content: "see `<project>/" + ocDir + "` and -> isProtectedPath" }, { sessionID: "s-active" })));
+check("allow write of project plan file under .opencode/plans", !(await call("write", { filePath: join(root, ".opencode", "plans", "1789589538371-plan.md"), content: "# plan" }, { sessionID: "s-active" })));
+check("block write escaping plans dir via .. (still tamper)", blocked(await call("write", { filePath: join(root, ".opencode", "plans", "..", "opencode.json"), content: "{}" }, { sessionID: "s-active" })));
+check("block write of the plans directory itself (no trailing-slash exemption)", blocked(await call("write", { filePath: join(root, ".opencode", "plans"), content: "{}" }, { sessionID: "s-active" })));
+check("block write under .opencode/plansx prefix (still tamper)", blocked(await call("write", { filePath: join(root, ".opencode", "plansx", "x.md"), content: "{}" }, { sessionID: "s-active" })));
+check("block write to user-level config plans path (exemption is project-only)", blocked(await call("write", { filePath: "/var/home/x/.config/opencode/plans/x.md", content: "{}" }, { sessionID: "s-active" })));
+// Plans dir symlinked at a config-shaped real location: lexical target is
+// exempt but the realpath fallback must still block via the user-config check.
+const plansAliasDir = mkdtempSync(join(tmpdir(), "wg-plans-alias-"));
+mkdirSync(join(plansAliasDir, ".config", "opencode"), { recursive: true });
+mkdirSync(join(plansAliasDir, ".opencode"), { recursive: true });
+symlinkSync(join(plansAliasDir, ".config", "opencode"), join(plansAliasDir, ".opencode", "plans"), "dir");
+setWorkspaceRoot(plansAliasDir);
+check("write through plans symlink into config real path blocked (realpath fallback)", blocked(await call("write", { filePath: join(plansAliasDir, ".opencode", "plans", "x.md"), content: "{}" }, { sessionID: "s-active" })));
+setWorkspaceRoot(root);
+rmSync(plansAliasDir, { recursive: true, force: true });
 console.log("- Policy 7: branch guard -");
 // Non-git workspace (current `root` is a plain temp dir): git writes allowed.
 check("non-git workspace: git commit allowed", !(await shell("git commit -m test")));
@@ -464,7 +486,8 @@ check("on main: git merge blocked", blocked(await shell("git merge feature/x")))
 	check("on main: git checkout path mutation without separator blocked", blocked(await shell("git checkout tracked.txt")));
 	check("on main: git checkout -B reset blocked", blocked(await shell("git checkout -B main HEAD~1")));
 	check("on main: git add blocked", blocked(await shell("git add tracked.txt")));
-	check("on main: git tag blocked", blocked(await shell("git tag release-test")));
+	check("on main: git tag creation allowed", !blocked(await shell("git tag release-test")));
+	check("on main: git tag -d blocked", blocked(await shell("git tag -d release-test")));
 	check("on main: git tag --list allowed", !blocked(await shell("git tag --list")));
 check("on main: git switch -c allowed (branch creation)", !(await shell("git switch -c feat/x")));
 check("on main: git status allowed", !(await shell("git status")));
@@ -514,6 +537,10 @@ check("inspection command with mutation keywords in grep argument is not blocked
 check("git log with mutation keywords in grep argument is not blocked", !(await call("bash", { command: 'git log --grep="rm old files"' }, { sessionID: "s-empty" })));
 check("grep searching for mutation command name is not blocked", !(await call("bash", { command: 'grep -rn "mkdir" src/' }, { sessionID: "s-empty" })));
 check("stderr redirect to /dev/null is not a file mutation", !(await call("bash", { command: "ls missing 2>/dev/null" }, { sessionID: "s-empty" })));
+check("SQL > comparison in query is not a file mutation", !(await call("bash", { command: 'sqlite3 app.db "SELECT id FROM events WHERE count > 5"' }, { sessionID: "s-empty" })));
+check("SQL >= comparison in query is not a file mutation", !(await call("bash", { command: 'psql -c "SELECT 1 FROM metrics WHERE n >= 10"' }, { sessionID: "s-empty" })));
+check("numeric comparison in grep pattern is not a file mutation", !(await call("bash", { command: "grep -E 'latency > 200' src/log.ts" }, { sessionID: "s-empty" })));
+check("real redirect alongside numeric comparison still blocked", blocked(await call("bash", { command: 'echo "x > 5" > src/a.ts' }, { sessionID: "s-empty" })));
 check("touch outside workspace is blocked", blocked(await call("bash", { command: "touch /tmp/wg-outside-touch" }, { sessionID: "s-active" })));
 check("mkdir outside workspace is blocked", blocked(await call("bash", { command: "mkdir /tmp/wg-outside-dir" }, { sessionID: "s-active" })));
 check("single-file rm outside workspace is blocked", blocked(await call("bash", { command: "rm /tmp/wg-outside-file" }, { sessionID: "s-active" })));
@@ -1357,6 +1384,24 @@ rmSync(pipelineTimeoutMarker, { force: true });
 await runVerify(`node -e "setTimeout(() => require('fs').writeFileSync('${pipelineTimeoutMarker}', 'orphan'), 300)" | cat`, root, 50);
 await new Promise((resolve) => setTimeout(resolve, 450));
 check("runVerify timeout terminates descendants behind shell pipelines", !existsSync(pipelineTimeoutMarker));
+
+console.log("- Policy 10: verification timeout resolution -");
+const previousVerifyTimeoutEnv = process.env.WORKFLOW_GUARD_VERIFY_TIMEOUT_MS;
+if (previousVerifyTimeoutEnv !== undefined) delete process.env.WORKFLOW_GUARD_VERIFY_TIMEOUT_MS;
+check("verification timeout resolution defaults to 30s", resolveVerifyTimeoutMs(root) === 30_000);
+const verifyTimeoutConfigRoot = mkdtempSync(join(tmpdir(), "wg-verify-timeout-"));
+mkdirSync(join(verifyTimeoutConfigRoot, ".opencode"));
+writeFileSync(join(verifyTimeoutConfigRoot, ".opencode", "workflow-guard.json"), JSON.stringify({ verifyTimeoutMs: 60000 }));
+reloadProjectConfig(verifyTimeoutConfigRoot);
+check("verification timeout honors project config", resolveVerifyTimeoutMs(verifyTimeoutConfigRoot) === 60_000);
+writeFileSync(join(verifyTimeoutConfigRoot, ".opencode", "workflow-guard.json"), JSON.stringify({ verifyTimeoutMs: -5 }));
+reloadProjectConfig(verifyTimeoutConfigRoot);
+check("verification timeout ignores invalid project config values", resolveVerifyTimeoutMs(verifyTimeoutConfigRoot) === 30_000);
+process.env.WORKFLOW_GUARD_VERIFY_TIMEOUT_MS = "120000";
+check("verification timeout env overrides a valid project config", resolveVerifyTimeoutMs(verifyTimeoutConfigRoot) === 120_000);
+delete process.env.WORKFLOW_GUARD_VERIFY_TIMEOUT_MS;
+if (previousVerifyTimeoutEnv !== undefined) process.env.WORKFLOW_GUARD_VERIFY_TIMEOUT_MS = previousVerifyTimeoutEnv;
+rmSync(verifyTimeoutConfigRoot, { recursive: true, force: true });
 let windowsCleanupFinished = false;
 const windowsCleanup = terminateProcessTree(1234, () => {}, "win32", async (pid) => {
 	check("Windows timeout cleanup receives the child pid", pid === 1234);
@@ -2271,6 +2316,12 @@ const mergedCheck = isBranchAlreadyMergedOrClosed(conflictRepo, "feat/already-me
 check("isBranchAlreadyMergedOrClosed identifies branch with 0 diff from main", mergedCheck.merged);
 check("git push on already merged branch is blocked", blocked(await shell("git push origin feat/already-merged")));
 
+// Tag pushes are release operations, not branch mutations (#134).
+spawnSync("git", ["tag", "v0.3.0"], { cwd: conflictRepo });
+check("git push origin v0.3.0 allowed from merged branch", !blocked(await shell("git push origin v0.3.0")));
+check("git push origin refs/tags/v0.3.0 allowed", !blocked(await shell("git push origin refs/tags/v0.3.0")));
+check("git push origin :refs/tags/v0.3.0 still blocked", blocked(await shell("git push origin :refs/tags/v0.3.0")));
+
 // Create a branch with a genuine merge conflict against main
 spawnSync("git", ["switch", "main"], { cwd: conflictRepo });
 spawnSync("git", ["switch", "-c", "feat/conflict-branch"], { cwd: conflictRepo });
@@ -3080,6 +3131,20 @@ await continuationPlugin.event?.({ event: { type: "message.updated", properties:
 await continuationPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-resume-cap" } } } as any);
 check("genuine user message resets continuation budget", continuationPrompts.filter((id) => id === "s-resume-cap").length === 4);
 
+console.log("- Policy 1: user interrupt stops automatic continuation -");
+todo("s-resume-abort", item("work the user stopped", "pending"));
+await continuationPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-resume-abort" } } } as any);
+await continuationPlugin.event?.({ event: { type: "session.error", properties: { sessionID: "s-resume-abort", error: { name: "MessageAbortedError", data: { message: "aborted by user" } } } } } as any);
+await continuationPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-resume-abort" } } } as any);
+check("user interrupt (Esc / MessageAbortedError) stops automatic continuation", continuationPrompts.filter((id) => id === "s-resume-abort").length === 1);
+await continuationPlugin.event?.({ event: { type: "message.updated", properties: { info: { id: "genuine-restart", role: "user", sessionID: "s-resume-abort" } } } } as any);
+await continuationPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-resume-abort" } } } as any);
+check("genuine user input after an interrupt re-enables automatic continuation", continuationPrompts.filter((id) => id === "s-resume-abort").length === 2);
+todo("s-resume-api-error", item("work behind a flaky provider", "pending"));
+await continuationPlugin.event?.({ event: { type: "session.error", properties: { sessionID: "s-resume-api-error", error: { name: "APIError", data: { message: "provider overloaded" } } } } } as any);
+await continuationPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-resume-api-error" } } } as any);
+check("non-abort session errors do not disable automatic continuation", continuationPrompts.filter((id) => id === "s-resume-api-error").length === 1);
+
 const ralphRoot = mkdtempSync(join(tmpdir(), "wg-ralph-"));
 mkdirSync(join(ralphRoot, ".opencode"));
 writeFileSync(join(ralphRoot, ".opencode", "workflow-guard.json"), JSON.stringify({ ralphMode: true, ralphMaxIterations: 2 }));
@@ -3118,6 +3183,11 @@ check("duplicate genuine user events leave an active ralph run stopped", ralphPr
 await ralphPlugin.event?.({ event: { type: "message.updated", properties: { info: { id: "human-restart", role: "user", sessionID: "s-ralph-stop" } } } } as any);
 await ralphPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-ralph-stop" } } } as any);
 check("distinct later user input can establish a fresh ralph run", ralphPrompts.filter((id) => id === "s-ralph-stop").length === 2 && runWithRuntimeState(ralphRoot, ralphClient as any, () => getRalphOutcome("s-ralph-stop")) === "running");
+todo("s-ralph-abort", item("ralph work the user stopped", "pending"));
+await ralphPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-ralph-abort" } } } as any);
+await ralphPlugin.event?.({ event: { type: "session.error", properties: { sessionID: "s-ralph-abort", error: { name: "MessageAbortedError", data: { message: "aborted by user" } } } } } as any);
+await ralphPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-ralph-abort" } } } as any);
+check("user interrupt stops an active ralph run as user_stopped", ralphPrompts.filter((id) => id === "s-ralph-abort").length === 1 && runWithRuntimeState(ralphRoot, ralphClient as any, () => getRalphOutcome("s-ralph-abort")) === "user_stopped");
 todo("s-ralph-complete", item("completable work", "pending"));
 await ralphPlugin.event?.({ event: { type: "session.idle", properties: { sessionID: "s-ralph-complete" } } } as any);
 todo("s-ralph-complete", item("completable work", "completed"));