opencode-workflow-guard 1.13.4 → 1.13.6

package/docs/policies.md

@@ -90,6 +90,7 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
 - With project `recoveryCheckpoints: true`, or the `autonomous` operation profile unless explicitly overridden, genuine root-session user runs capture a private Git checkpoint before agent work starts. Checkpoints preserve tracked and untracked state without using the user's stash list; subagents and generated continuation prompts do not replace them. At `session.idle`, the run's resulting workspace fingerprint is recorded before automatic continuation. `guard_recovery_restore` is provenance-bound to the same root session and refuses restoration after any intervening workspace change. Operation profiles only set optional workflow defaults and cannot weaken core safety policies.
 - Automatic continuation remains synthetic. By default, an eligible root session with unfinished owned todos briefly waits for OpenCode's native asynchronous title generation before that continuation is sent; set `titleSettleWorkaround: false` to opt out. The bounded wait never rewrites titles or provider/model parameters.
 - **Git State & Snapshot Binding:** Verification evidence records the current git commit hash (`git rev-parse HEAD`) and working tree status. If unverified edits or index modifications occur after verification, fresh verification is enforced.
+- **Untracked Special Entries:** The worktree fingerprint binds untracked symlinks by their target string (git semantics - re-pointing a link moves the fingerprint, changing the link target's contents does not), FIFOs/sockets by path and mode, and skips unopenable entries with a `worktree-fingerprint` warning in the audit trail instead of voiding the whole fingerprint. One unreadable scratch symlink or `chmod 000` file can no longer make review/verification evidence permanently unfresh, and the PR preflight names the actual cause when an approval cannot be matched (no fingerprint binding, fingerprint mismatch, or uncomputable fingerprint) instead of the generic "review approval required". Documented tradeoff: the contents of a skipped entry are excluded from the fingerprint, so a file that stays unreadable to the guard's user across the entire window can change contents without moving the fingerprint; any readability transition is fingerprint-visible (fail-closed), and each skip is named in the durable audit trail.
 - **Durable Disk Cache:** Passing verification results (`~/.local/state/opencode/workflow-guard/last-verify.json`) and passing secondary review approvals (`~/.local/state/opencode/workflow-guard/last-review.json`) are cached to disk, allowing session restarts and multi-agent handoffs to retain valid verification and review evidence without redundant test runs. Durable evidence is **workspace-bound**: a cached result is only accepted for the workspace that produced it, so a passing run in one project can never satisfy finalization in another.
 - If verification fails, finalization is blocked with a structured summary of error markers, stack traces, and failure output.
 - OpenCode's current `lsp.client.diagnostics` event identifies the server and path but does not expose the diagnostics themselves, so the guard deliberately does not claim an LSP-clean finalization gate until the SDK provides a supported diagnostics source.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.13.4",
+  "version": "1.13.6",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/guard-dispatcher.ts

@@ -446,8 +446,27 @@ export async function guardToolCallImpl(
 						review = diskCached;
 					}
 				}
-				const reviewMatchesContext = review?.passed === true && isEvidenceFresh(reviewEvidence(review), { workspace: projectRootKey(prRoot), commitHash: getCurrentGitCommitHash(prRoot), worktreeFingerprint: getGitWorktreeFingerprint(prRoot), sessionID: review.targetSessionID }, 0) && (!review.targetSessionID || review.targetSessionID === context?.sessionID);
-				if (!reviewMatchesContext) preflightFailures.push("Passing secondary review approval is required; invoke a secondary review subagent and record approval with record_review.");
+				const prFingerprint = getGitWorktreeFingerprint(prRoot);
+				const reviewMatchesContext = review?.passed === true && isEvidenceFresh(reviewEvidence(review), { workspace: projectRootKey(prRoot), commitHash: getCurrentGitCommitHash(prRoot), worktreeFingerprint: prFingerprint, sessionID: review.targetSessionID }, 0) && (!review.targetSessionID || review.targetSessionID === context?.sessionID);
+				if (!reviewMatchesContext) {
+					// When an approval exists but cannot be matched to this
+					// worktree, the message must name the actual cause instead
+					// of the generic "review required" (which sends the agent
+					// into an endless re-review loop on an unreadable entry).
+					// Cause attribution only makes sense for approvals of THIS
+					// repository; a review of another repo is not evidence here.
+					const reviewIsForThisRepo = typeof review?.workspace === "string" && (projectRootKey(review.workspace) === projectRootKey(prRoot) || isSameGitRepo(review.workspace, prRoot));
+					const sameRepoApproval = review && review.passed === true && reviewIsForThisRepo ? review : undefined;
+					if (sameRepoApproval && prFingerprint === undefined) {
+						preflightFailures.push("Worktree fingerprint could not be computed (git unavailable or worktree unreadable), so review evidence cannot be bound to this worktree; resolve worktree readability and re-run the secondary review.");
+					} else if (sameRepoApproval && !sameRepoApproval.worktreeFingerprint) {
+						preflightFailures.push(`The recorded review approval from '${sameRepoApproval.reviewer}' has no worktree fingerprint binding (recorded against an unreadable worktree or an older guard version); re-run the secondary review and record it with record_review.`);
+					} else if (sameRepoApproval && sameRepoApproval.worktreeFingerprint !== prFingerprint) {
+						preflightFailures.push(`The recorded review approval from '${sameRepoApproval.reviewer}' does not match the current worktree contents (worktree fingerprint changed after review); re-run the secondary review and record it with record_review.`);
+					} else {
+						preflightFailures.push("Passing secondary review approval is required; invoke a secondary review subagent and record approval with record_review.");
+					}
+				}
 			}
 			if (isDocumentationRequired(prRoot) && !branchHasDocumentationChange(prRoot)) preflightFailures.push("Documentation update is required (Policy 21); update README.md or relevant documentation in docs/.");
 			const branchChangelog = branchHasChangelogChange(prRoot);

package/src/lib/verify.ts

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync, existsSync } from "node:fs";
+import { lstatSync, readFileSync, readlinkSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { dynamicShellSyntaxIn, normalize } from "./shell.ts";
 import { getCleanEnv } from "./utils.ts";
@@ -8,6 +8,7 @@ import { getProjectConfig } from "./state.ts";
 import { normalizeGitCommands } from "../policies/git.ts";
 import { liveMutationIn } from "../policies/destructive.ts";
 import { isSettingsTamper } from "../policies/tamper.ts";
+import { audit } from "./audit.ts";
 
 export function detectVerifyCommand(root: string): string | undefined {
 	if (process.env.WORKFLOW_GUARD_VERIFY !== undefined) {
@@ -118,6 +119,28 @@ export function getGitStatusSummary(root: string): string | undefined {
 	return undefined;
 }
 
+// One warning per unreadable/unopenable untracked entry per process: the
+// fingerprint skips the entry (fail-open per entry, path still hashed) but
+// the durable audit trail must name it, since evidence binding silently
+// excludes its contents from the worktree identity.
+const fingerprintSkipWarnings = new Set<string>();
+
+function warnFingerprintSkip(root: string, file: string, detail: string): void {
+	const key = `${root}\0${file}`;
+	if (fingerprintSkipWarnings.has(key)) return;
+	fingerprintSkipWarnings.add(key);
+	try {
+		audit({
+			ts: new Date().toISOString(),
+			tool: "worktree-fingerprint",
+			decision: "allow",
+			phase: "event",
+			reason: `fingerprint_entry_skipped: untracked entry '${file}' could not be read (${detail}); its contents are excluded from the worktree fingerprint`,
+			input: { root, file },
+		});
+	} catch {}
+}
+
 export function getGitWorktreeFingerprint(root: string): string | undefined {
 	try {
 		// Index listing captures the exact staged/tracked content (blob hashes);
@@ -143,11 +166,33 @@ export function getGitWorktreeFingerprint(root: string): string | undefined {
 		if (staged.status !== 0 || unstaged.status !== 0 || untracked.status !== 0) return undefined;
 		const hash = createHash("sha256").update(staged.stdout).update(unstaged.stdout);
 		for (const file of untracked.stdout.split("\0").filter(Boolean).sort()) {
+			// The path itself is always part of the fingerprint, so a skipped
+			// entry still binds its presence even when its contents do not.
 			hash.update("\0" + file + "\0");
 			try {
-				hash.update(readFileSync(join(root, file)));
-			} catch {
-				return undefined;
+				// Classify with lstat (never follows the final component):
+				// git's untracked listing treats a symlink as a file whose
+				// content is the target string, so hash link bytes for
+				// symlinks - a symlink to a directory (readFileSync throws
+				// EISDIR), a broken link, or a link whose target changes
+				// contents are all bound by the link itself, matching git.
+				const stats = lstatSync(join(root, file));
+				if (stats.isSymbolicLink()) {
+					hash.update(readlinkSync(join(root, file)));
+				} else if (stats.isFile()) {
+					hash.update(readFileSync(join(root, file)));
+				} else {
+					// FIFOs, sockets, devices: opening them can block or fail
+					// and they have no stable hashable content - bind their
+					// identity by path (above) and file mode.
+					hash.update(`special:${stats.mode}`);
+				}
+			} catch (error) {
+				// A single unreadable entry must never void the whole
+				// fingerprint: that made review/verification evidence
+				// permanently unfresh for the worktree. Skip its contents
+				// and name the entry in the audit trail instead.
+				warnFingerprintSkip(root, file, error instanceof Error ? error.message : String(error));
 			}
 		}
 		return hash.digest("hex");

package/src/workflow-guard-ui.ts

@@ -8,15 +8,106 @@
  */
 
 import type { TuiPlugin, TuiPluginModule } from "@opencode-ai/plugin/tui";
-import { Plugin } from "@opencode/plugin/tui";
+import { Plugin, usePlugin } from "@opencode/plugin/tui";
 import type { JSX } from "@opentui/solid";
-import { createElement, insert, setProp } from "@opentui/solid";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createElement, insert, setProp, RendererContext } from "@opentui/solid";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative } from "node:path";
+import { homedir } from "node:os";
+import { getOwner, useContext } from "solid-js";
 import { applyEdits, modify, parse, type ParseError } from "jsonc-parser";
 import { projectConfigPath } from "./lib/project-config.ts";
 import { canonicalPath } from "./policies/file-claims.ts";
 
+// ── V2 render diagnostics (bounded; never throws) ────────────────────────────
+// Slot renders run inside the TUI provider tree, but recurring failures have
+// been observed in long-running sessions after plugin versions were swapped
+// (opencode 2.0.10, "No renderer found" from @opentui/solid createElement).
+// Instead of rethrowing — which makes the host error boundary toast on every
+// retry for a cosmetic badge — a failing slot renders null, and failures are
+// logged with owner/renderer context to a state file, bounded to the first
+// DIAG_MAX_FAILURES_PER_SLOT failures per slot between successes. The next
+// render attempt retries naturally, and a later success is logged again.
+const DIAG_DIR = join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "opencode");
+const DIAG_LOG = join(DIAG_DIR, "workflow-guard-ui.log");
+const DIAG_MAX_FAILURES_PER_SLOT = 3;
+const DIAG_MAX_LOG_BYTES = 2_000_000;
+
+function diag(line: string): void {
+	try {
+		mkdirSync(DIAG_DIR, { recursive: true });
+		if (existsSync(DIAG_LOG) && statSync(DIAG_LOG).size > DIAG_MAX_LOG_BYTES) {
+			writeFileSync(DIAG_LOG, "", { mode: 0o600 });
+		}
+		appendFileSync(DIAG_LOG, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+	} catch {
+		// diagnostics must never crash the plugin
+	}
+}
+
+try {
+	diag(`module load: ${import.meta.url}; @opentui/solid -> ${import.meta.resolve("@opentui/solid")}; solid-js -> ${import.meta.resolve("solid-js")}`);
+} catch (error) {
+	diag(`module load: ${import.meta.url}; resolve probe failed: ${error}`);
+}
+
+const diagOkSlots = new Set<string>();
+const diagFailureCount = new Map<string, number>();
+
+function diagRender(slot: string): void {
+	try {
+		const owner = getOwner() as { context?: Record<string, unknown> | null } | null;
+		const contextKeys = owner ? (owner.context ? Object.keys(owner.context).join(",") : "null") : "no-owner";
+		const renderer = useContext(RendererContext);
+		let plugin = "ok";
+		try {
+			usePlugin();
+		} catch (error) {
+			plugin = `FAILED: ${error}`;
+		}
+		if (!diagOkSlots.has(slot)) {
+			diagOkSlots.add(slot);
+			diag(`render ${slot} ok; owner=${owner ? "present" : "null"}; contextKeys=[${contextKeys}]; rendererContext=${renderer ? "found" : "MISSING"}; usePlugin=${plugin}`);
+		}
+	} catch (error) {
+		diag(`render ${slot} probe FAILED: ${error instanceof Error ? `${error.message}\n${error.stack}` : String(error)}`);
+	}
+}
+
+function diagFailure(slot: string, error: unknown): void {
+	const count = (diagFailureCount.get(slot) ?? 0) + 1;
+	diagFailureCount.set(slot, count);
+	if (count > DIAG_MAX_FAILURES_PER_SLOT) {
+		if (count === DIAG_MAX_FAILURES_PER_SLOT + 1) {
+			diag(`render ${slot} still failing after ${DIAG_MAX_FAILURES_PER_SLOT} logged failures; further failures are suppressed until a render succeeds`);
+		}
+		return;
+	}
+	const lines = [
+		`render ${slot} FAILED (${count}/${DIAG_MAX_FAILURES_PER_SLOT}): ${error instanceof Error ? error.message : String(error)}`,
+		`  stack: ${error instanceof Error ? error.stack : "(none)"}`,
+	];
+	try {
+		const owner = getOwner() as { context?: Record<string, unknown> | null } | null;
+		lines.push(`  owner=${owner ? "present" : "null"}; contextKeys=[${owner ? (owner.context ? Object.keys(owner.context).join(",") : "null") : "none"}]`);
+	} catch (probeError) {
+		lines.push(`  owner probe failed: ${probeError}`);
+	}
+	try {
+		lines.push(`  useContext(RendererContext): ${useContext(RendererContext) ? "found" : "MISSING"}`);
+	} catch (probeError) {
+		lines.push(`  renderer probe failed: ${probeError}`);
+	}
+	try {
+		usePlugin();
+		lines.push(`  usePlugin: ok`);
+	} catch (probeError) {
+		lines.push(`  usePlugin: FAILED ${probeError}`);
+	}
+	diag(lines.join("\n"));
+}
+// ── end render diagnostics ───────────────────────────────────────────────────
+
 type Child = JSX.Element | string | number | null | undefined | false;
 
 function element(
@@ -98,6 +189,8 @@ const TOGGLE_OPTIONS: Array<{ key: ProjectToggle; label: string; description: st
 ];
 
 export const WorkflowGuardTuiV2 = (ctx: TuiContext) => {
+	diag(`setup: app=${ctx.app?.version ?? "?"}; location=${ctx.location?.directory ?? "?"}`);
+
 	const badge = () => {
 		const formatted = formatBadge();
 		return text({ fg: ctx.theme.text.feedback.success.base }, [formatted.text]);
@@ -164,8 +257,29 @@ export const WorkflowGuardTuiV2 = (ctx: TuiContext) => {
 		},
 	});
 
-	ctx.ui.slot({ append: "home.footer.status", render: () => badge() });
-	ctx.ui.slot({ append: "prompt.footer.status", render: () => badge() });
+	const registerBadgeSlot = (slot: NonNullable<Parameters<TuiContext["ui"]["slot"]>[0]["append"]>) => {
+		ctx.ui.slot({
+			append: slot,
+			render: () => {
+				try {
+					const element = badge();
+					if (!diagOkSlots.has(slot)) {
+						diagOkSlots.add(slot);
+						diagFailureCount.delete(slot);
+						diag(`render ${slot} ok`);
+					}
+					return element;
+				} catch (error) {
+					diagOkSlots.delete(slot);
+					diagFailure(slot, error);
+					return null;
+				}
+			},
+		});
+	};
+	registerBadgeSlot("home.footer.status");
+	registerBadgeSlot("prompt.footer.status");
+	diagRender("probe-after-setup");
 
 	return () => {
 		// Slot claims and keymap layers are disposed automatically on unload.

package/test/test.mts

@@ -114,7 +114,7 @@ import { audit } from "../src/lib/audit.ts";
 import { isProjectMemoryFreshAsync } from "../src/lib/project-memory.ts";
 import { ToolOutcomeTracker } from "../src/lib/tool-outcomes.ts";
 import { createRecoveryCheckpoint, finalizeRecoveryCheckpoint, listRecoveryCheckpoints, restoreRecoveryCheckpoint, setCheckpointGitForTesting } from "../src/lib/checkpoint.ts";
-import { WorkflowGuardTui, formatBadge, readProjectOption, readRecoveryCheckpointsOption, writeRecoveryCheckpointsOption } from "../src/workflow-guard-ui.ts";
+import { WorkflowGuardTui, WorkflowGuardTuiV2, formatBadge, readProjectOption, readRecoveryCheckpointsOption, writeRecoveryCheckpointsOption } from "../src/workflow-guard-ui.ts";
 import { scanSessionTodos, toolPartName } from "../src/lib/v2-todo.ts";
 import { effectiveTodosWithOwner } from "../src/policies/todo.ts";
 
@@ -1345,6 +1345,32 @@ check("recovery checkpoint project option refuses symlink escape", tuiSymlinkRej
 rmSync(outsideTuiOptions, { recursive: true, force: true });
 rmSync(tuiOptionsDir, { recursive: true, force: true });
 
+// V2 TUI companion degrades gracefully when slot renders fail (bounded diagnostics)
+const v2SlotClaims: Array<{ append: string; render: () => unknown }> = [];
+const fakeV2TuiCtx = {
+	app: { version: "9.9.9-test", channel: "test" },
+	location: { directory: tuiCommandOptionsDir },
+	theme: { text: { feedback: { success: { base: "#00ff00" } } } },
+	ui: { slot: (claim: { append: string; render: () => unknown }) => { v2SlotClaims.push(claim); } },
+};
+await WorkflowGuardTuiV2(fakeV2TuiCtx as any);
+check("v2 tui companion registers home and prompt status slots", v2SlotClaims.filter((claim) => claim.append === "home.footer.status" || claim.append === "prompt.footer.status").length === 2);
+const diagLogPath = join(process.env.XDG_STATE_HOME!, "opencode", "workflow-guard-ui.log");
+const diagLogText = () => readFileSync(diagLogPath, "utf8");
+check("v2 tui companion logs module load and setup with app version", diagLogText().includes("module load:") && diagLogText().includes("setup: app=9.9.9-test"));
+const v2HomeRender = v2SlotClaims.find((claim) => claim.append === "home.footer.status")!.render;
+// In a plain Node process there is no OpenTUI renderer, so badge() throws the
+// same "No renderer found" the long-running-session bug produced in the TUI.
+check("v2 slot render returns null instead of throwing when the render context is unavailable", v2HomeRender() === null);
+check("v2 slot failure log records probes and stack", diagLogText().includes("render home.footer.status FAILED (1/3)") && diagLogText().includes("owner=null") && diagLogText().includes("useContext(RendererContext): MISSING") && diagLogText().includes("  stack: "));
+for (let i = 0; i < 6; i++) v2HomeRender();
+const v2FailuresLogged = diagLogText().split("\n").filter((line) => line.includes("render home.footer.status FAILED (")).length;
+check("v2 slot failure logging is bounded to 3 per success epoch", v2FailuresLogged === 3);
+check("v2 slot failure suppression notice is logged once", diagLogText().split("still failing after 3 logged failures").length === 2);
+const v2PromptRender = v2SlotClaims.find((claim) => claim.append === "prompt.footer.status")!.render;
+check("v2 prompt status slot also degrades to null on render failure", v2PromptRender() === null);
+
+
 // ── Adversarial tests & hardened invariants ──
 console.log("- Adversarial tests & hardened invariants -");
 
@@ -1719,6 +1745,53 @@ check("commitless repo content change updates review fingerprint", getGitWorktre
 rmSync(commitlessRepo, { recursive: true, force: true });
 rmSync(fingerprintRepo, { recursive: true, force: true });
 
+// Untracked special entries must never void the worktree fingerprint: a
+// symlink to a directory (readFileSync throws EISDIR), a broken symlink,
+// an unreadable file, and a FIFO all keep the fingerprint computable and
+// stable. One unopenable entry previously returned undefined, making
+// review/verification evidence permanently unfresh for that worktree and
+// surfacing as a misleading "review approval required" preflight failure.
+const specialRepo = mkdtempSync(join(tmpdir(), "wg-fingerprint-specials-"));
+spawnSync("git", ["init", "-b", "main"], { cwd: specialRepo });
+spawnSync("git", ["config", "user.email", "test" + "@example.com"], { cwd: specialRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: specialRepo });
+writeFileSync(join(specialRepo, "tracked.txt"), "base\n");
+spawnSync("git", ["add", "tracked.txt"], { cwd: specialRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: specialRepo });
+mkdirSync(join(specialRepo, "target-dir"));
+symlinkSync(join(specialRepo, "target-dir"), join(specialRepo, "dir-link"));
+symlinkSync(join(specialRepo, "missing-target"), join(specialRepo, "broken-link"));
+writeFileSync(join(specialRepo, "locked.txt"), "unreadable\n");
+chmodSync(join(specialRepo, "locked.txt"), 0o000);
+const fifoPath = join(specialRepo, "pipe.fifo");
+if (process.platform !== "win32") spawnSync("mkfifo", [fifoPath], { cwd: specialRepo });
+const fpWithSpecials = getGitWorktreeFingerprint(specialRepo);
+check("fingerprint stays computable with untracked dir-symlink/broken-symlink/unreadable-file/fifo", typeof fpWithSpecials === "string" && fpWithSpecials.length === 64);
+check("fingerprint is stable across repeated computation with special entries", fpWithSpecials !== undefined && getGitWorktreeFingerprint(specialRepo) === fpWithSpecials);
+if ((process.getuid?.() ?? 1) !== 0) {
+	check("audit trail names the skipped unreadable entry", getRecentAuditEntries(50).some((entry) => entry.tool === "worktree-fingerprint" && (entry.input as { file?: string } | undefined)?.file === "locked.txt"));
+}
+// git's untracked listing binds a symlink to its target STRING (the link
+// bytes), never the target's contents. The link target lives outside the
+// repo so target contents cannot leak into the untracked listing.
+const linkTargetBase = mkdtempSync(join(tmpdir(), "wg-link-target-"));
+mkdirSync(join(linkTargetBase, "one"));
+mkdirSync(join(linkTargetBase, "two"));
+rmSync(join(specialRepo, "dir-link"));
+symlinkSync(join(linkTargetBase, "one"), join(specialRepo, "dir-link"));
+check("re-pointing an untracked directory symlink updates the fingerprint", getGitWorktreeFingerprint(specialRepo) !== fpWithSpecials);
+rmSync(join(specialRepo, "dir-link"));
+symlinkSync(join(linkTargetBase, "two"), join(specialRepo, "dir-link"));
+const fpAfterTargetChange = getGitWorktreeFingerprint(specialRepo);
+writeFileSync(join(linkTargetBase, "two", "inner.txt"), "changed inside the link target\n");
+check("changing symlink target contents does not change the fingerprint", getGitWorktreeFingerprint(specialRepo) === fpAfterTargetChange);
+rmSync(join(specialRepo, "dir-link"));
+check("removing an untracked symlink updates the fingerprint", getGitWorktreeFingerprint(specialRepo) !== fpAfterTargetChange);
+symlinkSync(join(specialRepo, "missing-target-2"), join(specialRepo, "broken-link-2"));
+check("adding an untracked symlink updates the fingerprint", getGitWorktreeFingerprint(specialRepo) !== fpWithSpecials);
+rmSync(specialRepo, { recursive: true, force: true });
+rmSync(linkTargetBase, { recursive: true, force: true });
+
 // 9. Secret-File READ Blocks (Policy 17)
 console.log("- Policy 17: Secret-File READ Blocks -");
 check("isSecretPath detects .env", isSecretPath(".env"));