opencode-workflow-guard 1.14.0 → 1.15.0

package/src/policies/shell-safety.ts

@@ -84,23 +84,43 @@ const INTERACTIVE_COMMAND_PATTERNS: Array<{ regex: RegExp; name: string; advice:
 
 const MONITOR_ADVICE = "Use ps aux, uptime, or batch flags (e.g. top -b -n 1) instead of interactive monitors.";
 const PAGER_ADVICE = "Use cat, head, or grep with non-interactive pipes instead of interactive pagers.";
-// Process monitoring tokens are matched on whitespace/segment boundaries so that
-// an unrelated word such as `desktop`, a hyphenated filename like `top-level-dir`,
-// or a quoted argument like `echo "top"` is not mistaken for the `top` command.
-const ALWAYS_INTERACTIVE_MONITOR_RE = /(?:^|[;&|\s])(?:htop|btop|atop|glances)(?:$|[;&|\s])/i;
-const TOP_COMMAND_RE = /(?:^|[;&|\s])top(?:$|[;&|\s])/i;
+// Monitor tokens are only interactive when they are the command of a
+// segment: a `top` in an argument (a secret name, a grep pattern, `echo
+// top`) is data, not the monitor. Wrappers are stripped first, so `sudo top`
+// and `timeout 5 top` are still caught, and `eval top` / `sh -c top` recurse
+// like the pager check. `top` in batch mode stays allowed. Indirection that
+// this does not model (`watch top`, `xargs top`, `man top`, shell loop bodies
+// such as `while true; do top; done`) is a known, documented limitation.
+const INTERACTIVE_MONITORS = new Set(["top", "htop", "btop", "atop", "glances"]);
 const TOP_BATCH_FLAG_RE = /(?:^|\s)(?:--batch|-[A-Za-z]*b[A-Za-z]*)(?:\s|$)/i;
 
-function checkProcessMonitorCommand(command: string): { isInteractive: boolean; name?: string; advice?: string } {
-	for (const segment of command.split(/[;&|\n]+/)) {
-		if (ALWAYS_INTERACTIVE_MONITOR_RE.test(segment)) {
-			return { isInteractive: true, name: "interactive process monitor", advice: MONITOR_ADVICE };
+function containsMonitorCommand(command: string, depth = 0): boolean {
+	if (depth >= 16) return false;
+	for (const segment of splitShellSegments(command)) {
+		const words = unwrapShellWords(segment);
+		while (words[0] === "--") words.shift();
+		const executable = basename(words[0] ?? "").toLowerCase();
+		const candidate = executable === "busybox" ? basename(words[1] ?? "").toLowerCase() : executable;
+		if (INTERACTIVE_MONITORS.has(candidate)) {
+			// Batch mode is the monitor's own flag, not a wrapper's (e.g. `sudo -b
+			// top` backgrounds sudo; it does not put `top` in batch mode).
+			const monitorIndex = executable === candidate ? 0 : 1;
+			if (candidate === "top" && TOP_BATCH_FLAG_RE.test(words.slice(monitorIndex + 1).join(" "))) continue;
+			return true;
 		}
-		if (TOP_COMMAND_RE.test(segment) && !TOP_BATCH_FLAG_RE.test(segment)) {
-			return { isInteractive: true, name: "interactive process monitor", advice: MONITOR_ADVICE };
+		if (executable === "eval" && words.length > 1 && containsMonitorCommand(words.slice(1).join(" "), depth + 1)) return true;
+		if (/^(?:ba|z|da|k)?sh$/i.test(executable)) {
+			const commandFlag = words.findIndex((word, index) => index > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
+			if (commandFlag >= 0 && words[commandFlag + 1] && containsMonitorCommand(words[commandFlag + 1]!, depth + 1)) return true;
 		}
 	}
-	return { isInteractive: false };
+	return false;
+}
+
+function checkProcessMonitorCommand(command: string): { isInteractive: boolean; name?: string; advice?: string } {
+	return containsMonitorCommand(command)
+		? { isInteractive: true, name: "interactive process monitor", advice: MONITOR_ADVICE }
+		: { isInteractive: false };
 }
 
 function containsPagerCommand(command: string, depth = 0): boolean {

package/src/policies/stale-write.ts

@@ -51,6 +51,23 @@ export function recordSuccessfulRead(observation: ReadObservation, sessionID: st
 	reads.set(sessionID, sessionReads);
 }
 
+/**
+ * Records the session's observation of a file it just mutated. A successful
+ * edit/write means the session authored the resulting bytes, so a follow-up
+ * edit to that file must not demand a redundant re-read. The pre-mutation
+ * digest is compared so a no-op or failed call (content unchanged) does not
+ * seed an observation, and an external change after the mutation still fails
+ * the next comparison.
+ */
+export function recordMutationObservation(path: string, sessionID: string, beforeDigest?: string): void {
+	const current = fingerprint(path);
+	if (!current) return;
+	if (beforeDigest !== undefined && current.digest === beforeDigest) return;
+	const sessionReads = reads.get(sessionID) ?? new Map<string, ReadFingerprint>();
+	sessionReads.set(canonicalPath(path), current);
+	reads.set(sessionID, sessionReads);
+}
+
 export function staleWriteReason(path: string, sessionID: string): string | undefined {
 	const current = fingerprint(path);
 	const canonical = canonicalPath(path);

package/src/workflow-guard.ts

@@ -14,9 +14,10 @@ import { WorkflowGuardV2 } from "./lib/v2-plugin.ts";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { join } from "node:path";
+import { loadedPluginVersion } from "./lib/version.ts";
 import { editTargets, runPostEditValidators, snapshotFile } from "./policies/post-edit-validation.ts";
 import { claimFiles, releaseFileClaims } from "./policies/file-claims.ts";
-import { beginReadObservation, clearReadFingerprints, recordSuccessfulRead, staleWriteReason } from "./policies/stale-write.ts";
+import { beginReadObservation, clearReadFingerprints, recordMutationObservation, recordSuccessfulRead, staleWriteReason } from "./policies/stale-write.ts";
 import { ToolInvocationLifecycle } from "./lib/tool-lifecycle.ts";
 import { ToolOutcomeTracker, type ToolOutcomePart } from "./lib/tool-outcomes.ts";
 import { guardToolCallImpl, isReadOnlyRole } from "./lib/guard-dispatcher.ts";
@@ -70,6 +71,7 @@ import {
 	getOperationProfile,
 	isRecoveryCheckpointsEnabled,
 	isReviewRequired,
+	isSubagentReviewRequired,
 	isDocumentationRequired,
 	getSubagentMutationBudget,
 	isLearningEnabled,
@@ -103,6 +105,7 @@ export {
 	getOperationProfile,
 	isRecoveryCheckpointsEnabled,
 	isReviewRequired,
+	isSubagentReviewRequired,
 	isDocumentationRequired,
 	getSubagentMutationBudget,
 	isLearningEnabled,
@@ -189,6 +192,8 @@ export function managedConfigDiagnostic(platform = process.platform, env: NodeJS
 		: "managed config location is unknown on this platform; plugin provenance is not verified by the OpenCode V1 API";
 }
 
+export { loadedPluginVersion } from "./lib/version.ts";
+
 // ── Verification engine ──────────────────────────────────────────────────────
 import {
 	detectVerifyCommand,
@@ -198,6 +203,7 @@ import {
 	getCurrentGitCommitHash,
 	getGitStatusSummary,
 	getGitWorktreeFingerprint,
+	getTrackedWorktreeFingerprint,
 } from "./lib/verify.ts";
 
 export {
@@ -208,6 +214,7 @@ export {
 	getCurrentGitCommitHash,
 	getGitStatusSummary,
 	getGitWorktreeFingerprint,
+	getTrackedWorktreeFingerprint,
 };
 
 // ── Secondary review rubric ──────────────────────────────────────────────────
@@ -221,6 +228,7 @@ import {
 	isValidBranchName,
 	createGitWorktree,
 	cleanupGitWorktree,
+	resolveWorktreeTimeoutMs,
 } from "./lib/worktree.ts";
 
 export {
@@ -229,6 +237,7 @@ export {
 	isValidBranchName,
 	createGitWorktree,
 	cleanupGitWorktree,
+	resolveWorktreeTimeoutMs,
 };
 
 // ── Policy modules ───────────────────────────────────────────────────────────
@@ -427,7 +436,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 			body: {
 				service: "workflow-guard",
 				level: "info",
-				message: `Workflow Guard plugin initialized for ${effectiveRoot}; ${managedConfigDiagnostic()}`,
+				message: `Workflow Guard v${loadedPluginVersion() ?? "unknown"} plugin initialized for ${effectiveRoot}; ${managedConfigDiagnostic()}`,
 			},
 		});
 	} catch {}
@@ -514,6 +523,12 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 			const pending = toolLifecycle.takePostEditSnapshots(input.sessionID, input.callID);
 			if (!pending) return;
 			await runWithRuntimeState(pending.root, ctx.client, async () => {
+				// A successful mutation means this session authored the resulting
+				// bytes, so seed its observation: a follow-up edit to a just
+				// created/modified file must not demand a redundant re-read. A
+				// no-op/failed call (content unchanged) seeds nothing, and an
+				// external change after the mutation still fails the comparison.
+				for (const before of pending.snapshots) recordMutationObservation(before.path, input.sessionID, before.digest);
 				const reports = await Promise.all(pending.snapshots.map((before) => runPostEditValidators(pending.root, before)));
 				const report = reports.filter((value): value is string => Boolean(value)).join("\n\n");
 				if (report) output.output = `${output.output}\n\n${report}`;