opencode-workflow-guard 1.13.3 → 1.13.5

package/docs/policies.md

@@ -60,7 +60,8 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
   - Direct edits of the same paths through the `edit`/`write`/`apply_patch` tools
   - Shell commands invoking `opencode auth`, `opencode config`, `opencode permission`, or `opencode run --auto`
   - Evasion-normalized: quote-concatenation (`open''code.json`), escapes (`open\c\ode`), and glob wildcards (`opencode.jso?`) are stripped before matching.
-- Collaboration commands (`gh issue`, `gh pr`, `glab issue`, `glab pr`, `az repos pr`) and document content mentioning guarded paths are not tampering: quoted arguments are command data, not shell syntax (redirect analysis runs on the quote-stripped residue), and the redirect heuristic applies to shell commands only (write/edit content is guarded by the target path check instead).
+- Collaboration commands (`gh issue`, `gh pr`, `glab issue`, `glab pr`, `az repos pr`) and document content mentioning guarded paths are not tampering: quoted arguments are command data, not shell syntax, and the redirect heuristic applies to shell commands only (write/edit content is guarded by the target path check instead).
+- Quoted data spans are not shell syntax: pattern matching runs on the quote-stripped residue, where redirect targets are honored quoted or not and quote-concatenated paths keep normalizing. A quoted span containing a guarded path is never treated as a redirect or command verb; unquoted redirects into guarded paths stay blocked.
 - Plan files under `.opencode/plans/` are exempt: opencode's plan mode writes agent-authored plan markdown there, and plans are content, not configuration. Everything else under `.opencode/` (including the directory itself) stays protected.
 - **Read-only access is allowed** (`cat`, `less`, `grep`, `head`, `tail` on config files) - only modification attempts trigger the guard.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.13.3",
+  "version": "1.13.5",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/shell.ts

@@ -75,6 +75,24 @@ export function decodeShellEscapes(text: string): string {
 		.replace(/\\([0-3][0-7]{2})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)));
 }
 
+// Reduce a shell segment to the syntax that actually executes: redirect
+// targets are honored whether quoted or not (a quoted redirect target is
+// still a real file), while SELF-CONTAINED quoted spans preceded by
+// whitespace are command data and can never be shell redirects or
+// operators. Quote spans glued to bare text are shell concatenation inside
+// a single word (e.g. open''code.json) and are kept for the normalizer to
+// flatten. A quoted span at segment start is NOT stripped: it can be a
+// quoted command word ("opencode" auth) and must stay visible to verb
+// patterns.
+export function prepareRedirectResidue(segment: string): string {
+	const withTargets = segment
+		.replace(/(>>?)\s*'([^']*)'/g, "$1 $2")
+		.replace(/(>>?)\s*"([^"]*)"/g, '$1 $2');
+	return withTargets
+		.replace(/\s'[^']*'(?=$|[\s)>;&|])/g, " ")
+		.replace(/\s"[^"]*"(?=$|[\s)>;&|])/g, " ");
+}
+
 export function shellWords(command: string): string[] {
 	const words: string[] = [];
 	let word = "";

package/src/policies/boundary.ts

@@ -7,7 +7,7 @@ import {
 	getWorkspaceRootReal,
 	recordMutation,
 } from "../lib/state.ts";
-import { shellWords, unwrapShellCommand } from "../lib/shell.ts";
+import { prepareRedirectResidue, shellWords, unwrapShellCommand } from "../lib/shell.ts";
 import { isCollaborationInvocation, isProtectedPath, PROTECTED_PATH_REASON } from "./tamper.ts";
 import { isSecretPath, secretIn } from "./secrets.ts";
 import { onProtectedBranch, branchGuardReason } from "./git.ts";
@@ -129,10 +129,14 @@ export function teeTargetsIn(segment: string): string[] {
 
 function redirectMutationsIn(segment: string): ShellMutation[] {
 	const mutations: ShellMutation[] = [];
+	// Redirect detection runs on the quote-stripped residue: quoted data
+	// spans are command data and their ">" characters are not redirects,
+	// while redirect targets keep their value whether quoted or not.
 	// The `(?!=)` lookahead after the op rejects comparison operators (`>=`,
 	// `==`) so they cannot match as a redirect op with `=` as its target.
+	const residue = prepareRedirectResidue(segment);
 	const redirectRe = /(?:^|[\s>]|(?<=[^\s"']))([0-9]*&?>>?&?(?!=))\s*["']?([^\s>&|;"']+)/g;
-	for (const redirectMatch of segment.matchAll(redirectRe)) {
+	for (const redirectMatch of residue.matchAll(redirectRe)) {
 		if (!redirectMatch[1] || !redirectMatch[2]) continue;
 		const op = redirectMatch[1];
 		const target = redirectMatch[2];
@@ -314,7 +318,10 @@ export function secretSourceInFilesystemCommand(segment: string): string | undef
 // Remove single- and double-quoted spans from a shell segment. Used to
 // analyze the residue of collaboration invocations: quoted arguments are
 // command data and can never be shell redirects, while unquoted redirects
-// keep receiving full validation.
+// keep receiving full validation. NOTE: unlike shell.ts's
+// prepareRedirectResidue, this strips EVERY span including redirect
+// targets and glued concatenations - only use it for collaboration
+// segments where all quoted content is command data.
 function stripQuotedSpans(segment: string): string {
 	return segment.replace(/'[^'\n]*'/g, " ").replace(/"[^"\n]*"/g, " ");
 }

package/src/policies/tamper.ts

@@ -1,7 +1,7 @@
 import { realpathSync } from "node:fs";
 import { basename, relative, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
-import { decodeShellEscapes } from "../lib/shell.ts";
+import { decodeShellEscapes, prepareRedirectResidue } from "../lib/shell.ts";
 
 export const PROTECTED_PATH_REASON =
 	"Blocked: modifying Open" +
@@ -23,6 +23,15 @@ export const SETTINGS_TAMPER_PATTERNS: RegExp[] = [
 	new RegExp("(?:" + "^|\\s)(?:op" + "encode)\\s+(?:run\\s+)?--auto\\b", "i"),
 ];
 
+// Patterns 1-4 match redirect operators and mutation verbs writing into
+// guarded paths: they run on the quote-stripped residue (quoted data spans
+// are command data and their ">" characters are not redirects). Patterns
+// 5-6 match the opencode CLI verbs themselves: those run on the
+// quote-FLATTENED text, because a quoted command word or an eval payload
+// still executes the verb.
+const PATH_PATTERNS = SETTINGS_TAMPER_PATTERNS.slice(0, 4);
+const VERB_PATTERNS = SETTINGS_TAMPER_PATTERNS.slice(4);
+
 export function normalizeShellEvasion(text: string): string {
 	return decodeShellEscapes(text)
 		.replace(/'([^']*)'/g, "$1")
@@ -48,13 +57,12 @@ export function isCollaborationInvocation(segment: string): boolean {
 }
 
 export function isSettingsTamper(command: string): boolean {
-	const segments = command.split(/[\n|;&]+/).map((s) =>
-		normalizeGlobPathEvasion(normalizeShellEvasion(s)),
-	);
-	return segments.some((segment) =>
-		!isCollaborationInvocation(segment) &&
-		SETTINGS_TAMPER_PATTERNS.some((re) => re.test(segment)),
-	);
+	return command.split(/[\n|;&]+/).some((s) => {
+		if (isCollaborationInvocation(s)) return false;
+		const residue = normalizeGlobPathEvasion(normalizeShellEvasion(prepareRedirectResidue(s)));
+		const flattened = normalizeGlobPathEvasion(normalizeShellEvasion(s));
+		return PATH_PATTERNS.some((re) => re.test(residue)) || VERB_PATTERNS.some((re) => re.test(flattened));
+	});
 }
 
 export function isProtectedPath(targetPath: string): boolean {

package/src/workflow-guard-ui.ts

@@ -8,15 +8,106 @@
  */
 
 import type { TuiPlugin, TuiPluginModule } from "@opencode-ai/plugin/tui";
-import { Plugin } from "@opencode/plugin/tui";
+import { Plugin, usePlugin } from "@opencode/plugin/tui";
 import type { JSX } from "@opentui/solid";
-import { createElement, insert, setProp } from "@opentui/solid";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createElement, insert, setProp, RendererContext } from "@opentui/solid";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative } from "node:path";
+import { homedir } from "node:os";
+import { getOwner, useContext } from "solid-js";
 import { applyEdits, modify, parse, type ParseError } from "jsonc-parser";
 import { projectConfigPath } from "./lib/project-config.ts";
 import { canonicalPath } from "./policies/file-claims.ts";
 
+// ── V2 render diagnostics (bounded; never throws) ────────────────────────────
+// Slot renders run inside the TUI provider tree, but recurring failures have
+// been observed in long-running sessions after plugin versions were swapped
+// (opencode 2.0.10, "No renderer found" from @opentui/solid createElement).
+// Instead of rethrowing — which makes the host error boundary toast on every
+// retry for a cosmetic badge — a failing slot renders null, and failures are
+// logged with owner/renderer context to a state file, bounded to the first
+// DIAG_MAX_FAILURES_PER_SLOT failures per slot between successes. The next
+// render attempt retries naturally, and a later success is logged again.
+const DIAG_DIR = join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "opencode");
+const DIAG_LOG = join(DIAG_DIR, "workflow-guard-ui.log");
+const DIAG_MAX_FAILURES_PER_SLOT = 3;
+const DIAG_MAX_LOG_BYTES = 2_000_000;
+
+function diag(line: string): void {
+	try {
+		mkdirSync(DIAG_DIR, { recursive: true });
+		if (existsSync(DIAG_LOG) && statSync(DIAG_LOG).size > DIAG_MAX_LOG_BYTES) {
+			writeFileSync(DIAG_LOG, "", { mode: 0o600 });
+		}
+		appendFileSync(DIAG_LOG, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+	} catch {
+		// diagnostics must never crash the plugin
+	}
+}
+
+try {
+	diag(`module load: ${import.meta.url}; @opentui/solid -> ${import.meta.resolve("@opentui/solid")}; solid-js -> ${import.meta.resolve("solid-js")}`);
+} catch (error) {
+	diag(`module load: ${import.meta.url}; resolve probe failed: ${error}`);
+}
+
+const diagOkSlots = new Set<string>();
+const diagFailureCount = new Map<string, number>();
+
+function diagRender(slot: string): void {
+	try {
+		const owner = getOwner() as { context?: Record<string, unknown> | null } | null;
+		const contextKeys = owner ? (owner.context ? Object.keys(owner.context).join(",") : "null") : "no-owner";
+		const renderer = useContext(RendererContext);
+		let plugin = "ok";
+		try {
+			usePlugin();
+		} catch (error) {
+			plugin = `FAILED: ${error}`;
+		}
+		if (!diagOkSlots.has(slot)) {
+			diagOkSlots.add(slot);
+			diag(`render ${slot} ok; owner=${owner ? "present" : "null"}; contextKeys=[${contextKeys}]; rendererContext=${renderer ? "found" : "MISSING"}; usePlugin=${plugin}`);
+		}
+	} catch (error) {
+		diag(`render ${slot} probe FAILED: ${error instanceof Error ? `${error.message}\n${error.stack}` : String(error)}`);
+	}
+}
+
+function diagFailure(slot: string, error: unknown): void {
+	const count = (diagFailureCount.get(slot) ?? 0) + 1;
+	diagFailureCount.set(slot, count);
+	if (count > DIAG_MAX_FAILURES_PER_SLOT) {
+		if (count === DIAG_MAX_FAILURES_PER_SLOT + 1) {
+			diag(`render ${slot} still failing after ${DIAG_MAX_FAILURES_PER_SLOT} logged failures; further failures are suppressed until a render succeeds`);
+		}
+		return;
+	}
+	const lines = [
+		`render ${slot} FAILED (${count}/${DIAG_MAX_FAILURES_PER_SLOT}): ${error instanceof Error ? error.message : String(error)}`,
+		`  stack: ${error instanceof Error ? error.stack : "(none)"}`,
+	];
+	try {
+		const owner = getOwner() as { context?: Record<string, unknown> | null } | null;
+		lines.push(`  owner=${owner ? "present" : "null"}; contextKeys=[${owner ? (owner.context ? Object.keys(owner.context).join(",") : "null") : "none"}]`);
+	} catch (probeError) {
+		lines.push(`  owner probe failed: ${probeError}`);
+	}
+	try {
+		lines.push(`  useContext(RendererContext): ${useContext(RendererContext) ? "found" : "MISSING"}`);
+	} catch (probeError) {
+		lines.push(`  renderer probe failed: ${probeError}`);
+	}
+	try {
+		usePlugin();
+		lines.push(`  usePlugin: ok`);
+	} catch (probeError) {
+		lines.push(`  usePlugin: FAILED ${probeError}`);
+	}
+	diag(lines.join("\n"));
+}
+// ── end render diagnostics ───────────────────────────────────────────────────
+
 type Child = JSX.Element | string | number | null | undefined | false;
 
 function element(
@@ -98,6 +189,8 @@ const TOGGLE_OPTIONS: Array<{ key: ProjectToggle; label: string; description: st
 ];
 
 export const WorkflowGuardTuiV2 = (ctx: TuiContext) => {
+	diag(`setup: app=${ctx.app?.version ?? "?"}; location=${ctx.location?.directory ?? "?"}`);
+
 	const badge = () => {
 		const formatted = formatBadge();
 		return text({ fg: ctx.theme.text.feedback.success.base }, [formatted.text]);
@@ -164,8 +257,29 @@ export const WorkflowGuardTuiV2 = (ctx: TuiContext) => {
 		},
 	});
 
-	ctx.ui.slot({ append: "home.footer.status", render: () => badge() });
-	ctx.ui.slot({ append: "prompt.footer.status", render: () => badge() });
+	const registerBadgeSlot = (slot: NonNullable<Parameters<TuiContext["ui"]["slot"]>[0]["append"]>) => {
+		ctx.ui.slot({
+			append: slot,
+			render: () => {
+				try {
+					const element = badge();
+					if (!diagOkSlots.has(slot)) {
+						diagOkSlots.add(slot);
+						diagFailureCount.delete(slot);
+						diag(`render ${slot} ok`);
+					}
+					return element;
+				} catch (error) {
+					diagOkSlots.delete(slot);
+					diagFailure(slot, error);
+					return null;
+				}
+			},
+		});
+	};
+	registerBadgeSlot("home.footer.status");
+	registerBadgeSlot("prompt.footer.status");
+	diagRender("probe-after-setup");
 
 	return () => {
 		// Slot claims and keymap layers are disposed automatically on unload.

package/test/test.mts

@@ -114,7 +114,7 @@ import { audit } from "../src/lib/audit.ts";
 import { isProjectMemoryFreshAsync } from "../src/lib/project-memory.ts";
 import { ToolOutcomeTracker } from "../src/lib/tool-outcomes.ts";
 import { createRecoveryCheckpoint, finalizeRecoveryCheckpoint, listRecoveryCheckpoints, restoreRecoveryCheckpoint, setCheckpointGitForTesting } from "../src/lib/checkpoint.ts";
-import { WorkflowGuardTui, formatBadge, readProjectOption, readRecoveryCheckpointsOption, writeRecoveryCheckpointsOption } from "../src/workflow-guard-ui.ts";
+import { WorkflowGuardTui, WorkflowGuardTuiV2, formatBadge, readProjectOption, readRecoveryCheckpointsOption, writeRecoveryCheckpointsOption } from "../src/workflow-guard-ui.ts";
 import { scanSessionTodos, toolPartName } from "../src/lib/v2-todo.ts";
 import { effectiveTodosWithOwner } from "../src/policies/todo.ts";
 
@@ -539,6 +539,11 @@ check("allow gh issue create mentioning .opencode paths (not tamper)", !(await s
 check("compound collaboration + tamper still blocked", blocked(await shell(`gh issue create --repo example/proj --title t && echo x > open${"code.json"}`)));
 check("collaboration command with real redirect to global config still blocked", blocked(await shell(`gh issue list > /var/home/x/.config/open${"code"}/opencode.json`)));
 check("collaboration command with redirect outside workspace still blocked", blocked(await shell(`gh pr create --title t > /tmp/wg-escape-probe`)));
+check("allow command with guarded-path text in quoted data (not tamper)", !(await shell(`echo "flow: x > ${ocDir}" > notes.md`)));
+check("block unquoted redirect into .opencode", blocked(await shell(`echo x > .open${"code"}/y`)));
+check("block redirect with quoted real target", blocked(await shell(`echo x > ".open${"code"}/opencode.json"`)));
+check("block quoted command word running the CLI auth flow", blocked(await shell(`"open${"code"}" auth login`)));
+check("block eval of a quoted CLI auth payload", blocked(await shell(`eval 'open${"code"} auth login'`)));
 
 console.log("- Policy 6: tamper via edit tools (path protection) -");
 check("block edit of project opencode.json", blocked(await call("edit", { filePath: join(root, "opencode.json"), oldString: "a", newString: "b" }, { sessionID: "s-active" })));
@@ -1340,6 +1345,32 @@ check("recovery checkpoint project option refuses symlink escape", tuiSymlinkRej
 rmSync(outsideTuiOptions, { recursive: true, force: true });
 rmSync(tuiOptionsDir, { recursive: true, force: true });
 
+// V2 TUI companion degrades gracefully when slot renders fail (bounded diagnostics)
+const v2SlotClaims: Array<{ append: string; render: () => unknown }> = [];
+const fakeV2TuiCtx = {
+	app: { version: "9.9.9-test", channel: "test" },
+	location: { directory: tuiCommandOptionsDir },
+	theme: { text: { feedback: { success: { base: "#00ff00" } } } },
+	ui: { slot: (claim: { append: string; render: () => unknown }) => { v2SlotClaims.push(claim); } },
+};
+await WorkflowGuardTuiV2(fakeV2TuiCtx as any);
+check("v2 tui companion registers home and prompt status slots", v2SlotClaims.filter((claim) => claim.append === "home.footer.status" || claim.append === "prompt.footer.status").length === 2);
+const diagLogPath = join(process.env.XDG_STATE_HOME!, "opencode", "workflow-guard-ui.log");
+const diagLogText = () => readFileSync(diagLogPath, "utf8");
+check("v2 tui companion logs module load and setup with app version", diagLogText().includes("module load:") && diagLogText().includes("setup: app=9.9.9-test"));
+const v2HomeRender = v2SlotClaims.find((claim) => claim.append === "home.footer.status")!.render;
+// In a plain Node process there is no OpenTUI renderer, so badge() throws the
+// same "No renderer found" the long-running-session bug produced in the TUI.
+check("v2 slot render returns null instead of throwing when the render context is unavailable", v2HomeRender() === null);
+check("v2 slot failure log records probes and stack", diagLogText().includes("render home.footer.status FAILED (1/3)") && diagLogText().includes("owner=null") && diagLogText().includes("useContext(RendererContext): MISSING") && diagLogText().includes("  stack: "));
+for (let i = 0; i < 6; i++) v2HomeRender();
+const v2FailuresLogged = diagLogText().split("\n").filter((line) => line.includes("render home.footer.status FAILED (")).length;
+check("v2 slot failure logging is bounded to 3 per success epoch", v2FailuresLogged === 3);
+check("v2 slot failure suppression notice is logged once", diagLogText().split("still failing after 3 logged failures").length === 2);
+const v2PromptRender = v2SlotClaims.find((claim) => claim.append === "prompt.footer.status")!.render;
+check("v2 prompt status slot also degrades to null on render failure", v2PromptRender() === null);
+
+
 // ── Adversarial tests & hardened invariants ──
 console.log("- Adversarial tests & hardened invariants -");