opencode-workflow-guard 1.13.3 → 1.13.4

package/docs/policies.md

@@ -60,7 +60,8 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
   - Direct edits of the same paths through the `edit`/`write`/`apply_patch` tools
   - Shell commands invoking `opencode auth`, `opencode config`, `opencode permission`, or `opencode run --auto`
   - Evasion-normalized: quote-concatenation (`open''code.json`), escapes (`open\c\ode`), and glob wildcards (`opencode.jso?`) are stripped before matching.
-- Collaboration commands (`gh issue`, `gh pr`, `glab issue`, `glab pr`, `az repos pr`) and document content mentioning guarded paths are not tampering: quoted arguments are command data, not shell syntax (redirect analysis runs on the quote-stripped residue), and the redirect heuristic applies to shell commands only (write/edit content is guarded by the target path check instead).
+- Collaboration commands (`gh issue`, `gh pr`, `glab issue`, `glab pr`, `az repos pr`) and document content mentioning guarded paths are not tampering: quoted arguments are command data, not shell syntax, and the redirect heuristic applies to shell commands only (write/edit content is guarded by the target path check instead).
+- Quoted data spans are not shell syntax: pattern matching runs on the quote-stripped residue, where redirect targets are honored quoted or not and quote-concatenated paths keep normalizing. A quoted span containing a guarded path is never treated as a redirect or command verb; unquoted redirects into guarded paths stay blocked.
 - Plan files under `.opencode/plans/` are exempt: opencode's plan mode writes agent-authored plan markdown there, and plans are content, not configuration. Everything else under `.opencode/` (including the directory itself) stays protected.
 - **Read-only access is allowed** (`cat`, `less`, `grep`, `head`, `tail` on config files) - only modification attempts trigger the guard.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.13.3",
+  "version": "1.13.4",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/shell.ts

@@ -75,6 +75,24 @@ export function decodeShellEscapes(text: string): string {
 		.replace(/\\([0-3][0-7]{2})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)));
 }
 
+// Reduce a shell segment to the syntax that actually executes: redirect
+// targets are honored whether quoted or not (a quoted redirect target is
+// still a real file), while SELF-CONTAINED quoted spans preceded by
+// whitespace are command data and can never be shell redirects or
+// operators. Quote spans glued to bare text are shell concatenation inside
+// a single word (e.g. open''code.json) and are kept for the normalizer to
+// flatten. A quoted span at segment start is NOT stripped: it can be a
+// quoted command word ("opencode" auth) and must stay visible to verb
+// patterns.
+export function prepareRedirectResidue(segment: string): string {
+	const withTargets = segment
+		.replace(/(>>?)\s*'([^']*)'/g, "$1 $2")
+		.replace(/(>>?)\s*"([^"]*)"/g, '$1 $2');
+	return withTargets
+		.replace(/\s'[^']*'(?=$|[\s)>;&|])/g, " ")
+		.replace(/\s"[^"]*"(?=$|[\s)>;&|])/g, " ");
+}
+
 export function shellWords(command: string): string[] {
 	const words: string[] = [];
 	let word = "";

package/src/policies/boundary.ts

@@ -7,7 +7,7 @@ import {
 	getWorkspaceRootReal,
 	recordMutation,
 } from "../lib/state.ts";
-import { shellWords, unwrapShellCommand } from "../lib/shell.ts";
+import { prepareRedirectResidue, shellWords, unwrapShellCommand } from "../lib/shell.ts";
 import { isCollaborationInvocation, isProtectedPath, PROTECTED_PATH_REASON } from "./tamper.ts";
 import { isSecretPath, secretIn } from "./secrets.ts";
 import { onProtectedBranch, branchGuardReason } from "./git.ts";
@@ -129,10 +129,14 @@ export function teeTargetsIn(segment: string): string[] {
 
 function redirectMutationsIn(segment: string): ShellMutation[] {
 	const mutations: ShellMutation[] = [];
+	// Redirect detection runs on the quote-stripped residue: quoted data
+	// spans are command data and their ">" characters are not redirects,
+	// while redirect targets keep their value whether quoted or not.
 	// The `(?!=)` lookahead after the op rejects comparison operators (`>=`,
 	// `==`) so they cannot match as a redirect op with `=` as its target.
+	const residue = prepareRedirectResidue(segment);
 	const redirectRe = /(?:^|[\s>]|(?<=[^\s"']))([0-9]*&?>>?&?(?!=))\s*["']?([^\s>&|;"']+)/g;
-	for (const redirectMatch of segment.matchAll(redirectRe)) {
+	for (const redirectMatch of residue.matchAll(redirectRe)) {
 		if (!redirectMatch[1] || !redirectMatch[2]) continue;
 		const op = redirectMatch[1];
 		const target = redirectMatch[2];
@@ -314,7 +318,10 @@ export function secretSourceInFilesystemCommand(segment: string): string | undef
 // Remove single- and double-quoted spans from a shell segment. Used to
 // analyze the residue of collaboration invocations: quoted arguments are
 // command data and can never be shell redirects, while unquoted redirects
-// keep receiving full validation.
+// keep receiving full validation. NOTE: unlike shell.ts's
+// prepareRedirectResidue, this strips EVERY span including redirect
+// targets and glued concatenations - only use it for collaboration
+// segments where all quoted content is command data.
 function stripQuotedSpans(segment: string): string {
 	return segment.replace(/'[^'\n]*'/g, " ").replace(/"[^"\n]*"/g, " ");
 }

package/src/policies/tamper.ts

@@ -1,7 +1,7 @@
 import { realpathSync } from "node:fs";
 import { basename, relative, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
-import { decodeShellEscapes } from "../lib/shell.ts";
+import { decodeShellEscapes, prepareRedirectResidue } from "../lib/shell.ts";
 
 export const PROTECTED_PATH_REASON =
 	"Blocked: modifying Open" +
@@ -23,6 +23,15 @@ export const SETTINGS_TAMPER_PATTERNS: RegExp[] = [
 	new RegExp("(?:" + "^|\\s)(?:op" + "encode)\\s+(?:run\\s+)?--auto\\b", "i"),
 ];
 
+// Patterns 1-4 match redirect operators and mutation verbs writing into
+// guarded paths: they run on the quote-stripped residue (quoted data spans
+// are command data and their ">" characters are not redirects). Patterns
+// 5-6 match the opencode CLI verbs themselves: those run on the
+// quote-FLATTENED text, because a quoted command word or an eval payload
+// still executes the verb.
+const PATH_PATTERNS = SETTINGS_TAMPER_PATTERNS.slice(0, 4);
+const VERB_PATTERNS = SETTINGS_TAMPER_PATTERNS.slice(4);
+
 export function normalizeShellEvasion(text: string): string {
 	return decodeShellEscapes(text)
 		.replace(/'([^']*)'/g, "$1")
@@ -48,13 +57,12 @@ export function isCollaborationInvocation(segment: string): boolean {
 }
 
 export function isSettingsTamper(command: string): boolean {
-	const segments = command.split(/[\n|;&]+/).map((s) =>
-		normalizeGlobPathEvasion(normalizeShellEvasion(s)),
-	);
-	return segments.some((segment) =>
-		!isCollaborationInvocation(segment) &&
-		SETTINGS_TAMPER_PATTERNS.some((re) => re.test(segment)),
-	);
+	return command.split(/[\n|;&]+/).some((s) => {
+		if (isCollaborationInvocation(s)) return false;
+		const residue = normalizeGlobPathEvasion(normalizeShellEvasion(prepareRedirectResidue(s)));
+		const flattened = normalizeGlobPathEvasion(normalizeShellEvasion(s));
+		return PATH_PATTERNS.some((re) => re.test(residue)) || VERB_PATTERNS.some((re) => re.test(flattened));
+	});
 }
 
 export function isProtectedPath(targetPath: string): boolean {

package/test/test.mts

@@ -539,6 +539,11 @@ check("allow gh issue create mentioning .opencode paths (not tamper)", !(await s
 check("compound collaboration + tamper still blocked", blocked(await shell(`gh issue create --repo example/proj --title t && echo x > open${"code.json"}`)));
 check("collaboration command with real redirect to global config still blocked", blocked(await shell(`gh issue list > /var/home/x/.config/open${"code"}/opencode.json`)));
 check("collaboration command with redirect outside workspace still blocked", blocked(await shell(`gh pr create --title t > /tmp/wg-escape-probe`)));
+check("allow command with guarded-path text in quoted data (not tamper)", !(await shell(`echo "flow: x > ${ocDir}" > notes.md`)));
+check("block unquoted redirect into .opencode", blocked(await shell(`echo x > .open${"code"}/y`)));
+check("block redirect with quoted real target", blocked(await shell(`echo x > ".open${"code"}/opencode.json"`)));
+check("block quoted command word running the CLI auth flow", blocked(await shell(`"open${"code"}" auth login`)));
+check("block eval of a quoted CLI auth payload", blocked(await shell(`eval 'open${"code"} auth login'`)));
 
 console.log("- Policy 6: tamper via edit tools (path protection) -");
 check("block edit of project opencode.json", blocked(await call("edit", { filePath: join(root, "opencode.json"), oldString: "a", newString: "b" }, { sessionID: "s-active" })));