opencode-workflow-guard 1.15.0 → 1.15.2

package/src/policies/changelog.ts

@@ -193,16 +193,114 @@ export function prBodyHasLiteralLineBreakEscapes(command: string): boolean {
 	return false;
 }
 
+/**
+ * Top-level package.json sections whose change requires a matching lockfile
+ * update: the dependency maps (including peerDependenciesMeta) plus every
+ * other section a supported package manager records in its lockfile
+ * (engines/packageManager, overrides/resolutions, the pnpm section with
+ * pnpm.overrides and pnpm.patchedDependencies, the workspace graph, and the
+ * project name/version stored in the lockfile root). A scripts-only or
+ * metadata-only manifest edit regenerates the lockfile byte-identical —
+ * demanding a lockfile change for it is unsatisfiable and must not block PR
+ * creation.
+ */
+const LOCKFILE_RELEVANT_MANIFEST_KEYS = new Set([
+	"name",
+	"version",
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies",
+	"peerDependenciesMeta",
+	"engines",
+	"packageManager",
+	"overrides",
+	"resolutions",
+	"workspaces",
+	// pnpm-specific top-level section: pnpm.overrides and
+	// pnpm.patchedDependencies are recorded in pnpm-lock.yaml.
+	"pnpm",
+]);
+
+/** Order-insensitive JSON comparison: dependency maps are semantically
+ * unordered, so reordering keys alone is not a lockfile-relevant change. */
+function canonicalJsonValue(value: unknown): string {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
+	if (Array.isArray(value)) return `[${value.map(canonicalJsonValue).join(",")}]`;
+	const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+	return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalJsonValue(item)}`).join(",")}}`;
+}
+
+function manifestTouchesLockfileRelevantKeys(oldSource: string | undefined, newSource: string | undefined): boolean {
+	try {
+		const parse = (source: string | undefined): Record<string, unknown> | undefined => {
+			if (source === undefined) return undefined;
+			const parsed = JSON.parse(source) as unknown;
+			if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not a manifest object");
+			return parsed as Record<string, unknown>;
+		};
+		const oldManifest = parse(oldSource);
+		const newManifest = parse(newSource);
+		const keys = new Set([...Object.keys(oldManifest ?? {}), ...Object.keys(newManifest ?? {})]);
+		for (const key of keys) {
+			if (!LOCKFILE_RELEVANT_MANIFEST_KEYS.has(key)) continue;
+			if (canonicalJsonValue(oldManifest?.[key]) !== canonicalJsonValue(newManifest?.[key])) return true;
+		}
+		return false;
+	} catch {
+		return true; // unreadable manifest: fail closed and keep demanding the lockfile
+	}
+}
+
+function manifestSourceAt(root: string, revision: string, manifestPath: string): string | undefined {
+	const res = spawnSync("git", ["show", `${revision}:${manifestPath}`], { cwd: root, encoding: "utf8", timeout: 10_000 });
+	if (res.status !== 0) return undefined;
+	return res.stdout;
+}
+
+function workingTreeManifestSource(root: string, manifestPath: string): string | undefined {
+	try {
+		return readFileSync(resolve(root, manifestPath), "utf8");
+	} catch {
+		return undefined; // deleted from the working tree
+	}
+}
+
+/**
+ * Whether a manifest change demands a lockfile update. package.json is
+ * compared section-by-section (scripts-only edits pass); Cargo.toml and
+ * go.mod have no dependency-section parser here, so any change to them
+ * conservatively demands the lockfile (unchanged behavior).
+ */
+function manifestChangeRequiresLockfile(root: string, mergeBaseCommit: string | undefined, manifestPath: string): boolean {
+	if (!/(?:^|\/)package\.json$/.test(manifestPath)) return true;
+	let oldSource: string | undefined;
+	if (mergeBaseCommit) {
+		// Absent at the merge base means the manifest was introduced on this
+		// branch (or is untracked): the pre-branch state had no manifest, so
+		// every lockfile-relevant key it has counts as new.
+		oldSource = manifestSourceAt(root, mergeBaseCommit, manifestPath);
+	} else {
+		oldSource = manifestSourceAt(root, "HEAD", manifestPath);
+	}
+	const newSource = workingTreeManifestSource(root, manifestPath);
+	if (oldSource === undefined && newSource === undefined) return true;
+	return manifestTouchesLockfileRelevantKeys(oldSource, newSource);
+}
+
 export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifest?: string; lockfile?: string; reason?: string } {
 	try {
 		let modifiedFiles: string[] = [];
+		let mergeBaseCommit: string | undefined;
 		const baseCandidates = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
 		for (const base of baseCandidates) {
 			const mergeBase = spawnSync("git", ["merge-base", "HEAD", base], { cwd: root, encoding: "utf8", timeout: 10_000 });
 			if (mergeBase.status !== 0 || !mergeBase.stdout.trim()) continue;
-			const diff = spawnSync("git", ["diff", "--name-only", `${mergeBase.stdout.trim()}...HEAD`], { cwd: root, encoding: "utf8", timeout: 10_000 });
+			const baseCommit = mergeBase.stdout.trim();
+			const diff = spawnSync("git", ["diff", "--name-only", `${baseCommit}...HEAD`], { cwd: root, encoding: "utf8", timeout: 10_000 });
 			if (diff.status === 0 && diff.stdout.trim()) {
 				modifiedFiles = diff.stdout.split("\n").map((f) => f.trim()).filter(Boolean);
+				mergeBaseCommit = baseCommit;
 				break;
 			}
 		}
@@ -236,16 +334,19 @@ export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifes
 		];
 
 		for (const item of manifestToLockfiles) {
-			const hasManifest = modifiedFiles.some((f) => item.manifest.test(f));
-			if (hasManifest) {
-				const hasLockfile = modifiedFiles.some((f) => item.lockfiles.test(f));
-				if (!hasLockfile) {
-					return {
-						isOutOfSync: true,
-						manifest: item.name,
-						reason: `Package manifest '${item.name}' was modified without updating its corresponding lockfile. Run the package manager install/lock command before opening a PR.`,
-					};
-				}
+			const manifestPaths = modifiedFiles.filter((f) => item.manifest.test(f));
+			if (manifestPaths.length === 0) continue;
+			const hasLockfile = modifiedFiles.some((f) => item.lockfiles.test(f));
+			if (hasLockfile) continue;
+			// Only a lockfile-relevant manifest change demands the lockfile: a
+			// scripts-only edit regenerates it byte-identical, so demanding one
+			// is unsatisfiable.
+			if (manifestPaths.some((manifestPath) => manifestChangeRequiresLockfile(root, mergeBaseCommit, manifestPath))) {
+				return {
+					isOutOfSync: true,
+					manifest: item.name,
+					reason: `Package manifest '${item.name}' was modified without updating its corresponding lockfile. Run the package manager install/lock command before opening a PR.`,
+				};
 			}
 		}
 	} catch {}

package/src/policies/git.ts

@@ -335,29 +335,152 @@ export function checkMergeConflicts(root: string): {
 	return { hasConflicts: false };
 }
 
-export function checkBranchBaseIsUpToDate(root: string): {
+const BRANCH_CREATION_VALUELESS_FLAGS = new Set([
+	"-f",
+	"--force",
+	"--discard-changes",
+	"-m",
+	"--merge",
+	"-q",
+	"--quiet",
+	"--no-track",
+]);
+
+// Classifies the optional start-point operand of an already-matched branch
+// creation invocation (`git switch -c|--create` / `git checkout -b`). Returns
+// the explicit start point when present, `{ start: undefined }` when the
+// invocation creates a branch from the current HEAD, and `undefined` when the
+// shape cannot be confidently classified — the caller must then fail closed to
+// the HEAD-based staleness check. Indeterminate tokens (variables, quotes,
+// unknown or value-taking flags) are never classified.
+export function branchCreationStartPoint(rest: string): { start?: string } | undefined {
+	const tokens = rest.split(/\s+/).filter(Boolean);
+	let sawCreate = false;
+	let named = false;
+	for (const token of tokens) {
+		const indeterminate = /[$`"']/.test(token);
+		if (!sawCreate) {
+			if (token === "switch" || token === "checkout") continue;
+			if (token === "-c" || token === "--create" || token === "-b") {
+				sawCreate = true;
+				continue;
+			}
+			if (token.startsWith("--create=")) {
+				sawCreate = true;
+				named = true;
+				continue;
+			}
+			if (!token.startsWith("--") && token.length > 2 && (token.startsWith("-c") || token.startsWith("-b"))) {
+				sawCreate = true;
+				named = true;
+				continue;
+			}
+			if (token.startsWith("-")) {
+				if (BRANCH_CREATION_VALUELESS_FLAGS.has(token)) continue;
+				return undefined;
+			}
+			return undefined;
+		}
+		if (!named) {
+			if (token.startsWith("-")) {
+				if (BRANCH_CREATION_VALUELESS_FLAGS.has(token)) continue;
+				return undefined;
+			}
+			if (indeterminate) return undefined;
+			named = true;
+			continue;
+		}
+		if (token.startsWith("-")) {
+			if (BRANCH_CREATION_VALUELESS_FLAGS.has(token)) continue;
+			return undefined;
+		}
+		if (indeterminate) return undefined;
+		return { start: token };
+	}
+	return sawCreate ? { start: undefined } : undefined;
+}
+
+// A branch created from an explicit start point that already contains the
+// remote default is fresh by construction, so the current branch's staleness
+// is irrelevant for it; every provided start point must resolve and contain
+// the base, and any missing start point keeps the HEAD-based check. Start
+// points that cannot be resolved fail closed. Block reasons name what was
+// actually checked and remedies that work under the guard.
+function evaluateBranchCreationStarts(
+	root: string,
+	base: string,
+	startPoints: ReadonlyArray<string>,
+): { isBehind: true; baseRef: string; reason: string } | undefined {
+	for (const startPoint of startPoints) {
+		const resolved = spawnSync("git", ["rev-parse", "--verify", "--quiet", startPoint], {
+			cwd: root,
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (resolved.status !== 0 || !resolved.stdout.trim()) {
+			return {
+				isBehind: true,
+				baseRef: base,
+				reason: `the explicit start point '${startPoint}' could not be resolved as a commit, so freshness cannot be classified (fail closed). Use a literal branch name or ref as the start point.`,
+			};
+		}
+		const startSha = resolved.stdout.trim();
+		const contains = spawnSync("git", ["merge-base", "--is-ancestor", base, startSha], {
+			cwd: root,
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (contains.status !== 0) {
+			const behind = spawnSync("git", ["rev-list", `${startSha}..${base}`, "--count"], {
+				cwd: root,
+				encoding: "utf8",
+				timeout: 5_000,
+			});
+			const behindCount = parseInt((behind.stdout ?? "").trim(), 10);
+			return {
+				isBehind: true,
+				baseRef: base,
+				reason: `the explicit start point '${startPoint}' is ${isNaN(behindCount) ? "" : `${behindCount} `}commit(s) behind ${base}. Create the branch from ${base}, or from any ref that contains it, instead.`,
+			};
+		}
+	}
+	return undefined;
+}
+
+export function checkBranchBaseIsUpToDate(
+	root: string,
+	startPoints?: ReadonlyArray<string | undefined>,
+): {
 	isBehind: boolean;
 	count?: number;
 	baseRef?: string;
 	reason?: string;
 } {
+	const classified = startPoints && startPoints.length > 0 ? startPoints : undefined;
 	for (const base of ["origin/HEAD", "origin/main", "origin/master"]) {
 		const res = spawnSync("git", ["rev-list", `HEAD..${base}`, "--count"], {
 			cwd: root,
 			encoding: "utf8",
 			timeout: 5_000,
 		});
-		if (res.status === 0 && res.stdout.trim()) {
-			const count = parseInt(res.stdout.trim(), 10);
-			if (!isNaN(count) && count > 0) {
-				return {
-					isBehind: true,
-					count,
-					baseRef: base,
-					reason: `Local base branch is ${count} commit(s) behind remote (${base}). Run 'git pull' or 'git fetch' on main before creating a fresh feature branch to prevent upstream conflicts.`,
-				};
-			}
+		if (res.status !== 0 || !res.stdout.trim()) continue;
+		const count = parseInt(res.stdout.trim(), 10);
+		if (isNaN(count)) continue;
+		const explicit = (classified ?? []).filter((startPoint): startPoint is string => startPoint !== undefined);
+		if (explicit.length > 0) {
+			const startBlock = evaluateBranchCreationStarts(root, base, explicit);
+			if (startBlock) return startBlock;
+		}
+		if (count > 0 && (!classified || classified.some((startPoint) => startPoint === undefined))) {
+			const branch = currentGitBranch(root) || "detached HEAD";
+			return {
+				isBehind: true,
+				count,
+				baseRef: base,
+				reason: `current branch '${branch}' is ${count} commit(s) behind remote default (${base}), so a branch created from it starts stale. Update this branch first (git rebase ${base} or git merge --ff-only ${base}), or create the new branch from ${base} directly.`,
+			};
 		}
+		return { isBehind: false };
 	}
 	return { isBehind: false };
 }

package/src/workflow-guard-ui.ts

@@ -2,7 +2,7 @@
  * Workflow Guard TUI companion plugin for OpenCode V2 (CLI plugin API).
  *
  * - Registers the `/guard-options` palette + slash command to toggle project options.
- * - Renders the Workflow Guard badge in the home and prompt footer status slots.
+ * - Renders the Workflow Guard badge in the prompt footer status slot.
  *
  * The V1 entrypoint (`WorkflowGuardTui`) remains for OpenCode 1.x TUI clients.
  */
@@ -277,7 +277,6 @@ export const WorkflowGuardTuiV2 = (ctx: TuiContext) => {
 			},
 		});
 	};
-	registerBadgeSlot("home.footer.status");
 	registerBadgeSlot("prompt.footer.status");
 	diagRender("probe-after-setup");
 

package/src/workflow-guard.ts

@@ -84,6 +84,9 @@ import {
 	sessionReviews,
 	setSessionWorkspace,
 	getSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
+	resolveSessionBoundWorkspace,
 	resolveEffectiveWorkspace,
 } from "./lib/state.ts";
 import { findGitRoot, isSameGitRepo, loadProjectConfig, reloadProjectConfig, stripJsonComments } from "./lib/project-config.ts";
@@ -116,6 +119,9 @@ export {
 	resetReviewState,
 	setSessionWorkspace,
 	getSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
+	resolveSessionBoundWorkspace,
 	resolveEffectiveWorkspace,
 	findGitRoot,
 	isSameGitRepo,
@@ -448,12 +454,16 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 		tool: createCustomTools({ effectiveRoot, projectMemoryEnabled, learningEnabled, projectMemory, followupStore, portableMemoryPath, learningInterventions, client: ctx.client }),
 
 		"tool.execute.before": async (input, output) => {
-			const toolWorktree =
+			const hostWorktree =
 				(input as { worktree?: string })?.worktree ||
 				(input as { directory?: string })?.directory ||
 				(output as { worktree?: string })?.worktree ||
-				(output as { directory?: string })?.directory ||
-				effectiveRoot;
+				(output as { directory?: string })?.directory;
+			// Session-bound workspace before the plugin-instance fallback:
+			// concurrent loops share this process, and a fallback derived from
+			// the last-active instance must not re-anchor another session's
+			// policy context.
+			const toolWorktree = hostWorktree || getSessionBoundWorkspace(input.sessionID) || effectiveRoot;
 			const toolAgent =
 				(input as { agent?: string })?.agent ||
 				(output as { agent?: string })?.agent;
@@ -480,11 +490,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					const record = asRecord(args);
 					const workdir = typeof record?.workdir === "string" ? record.workdir : undefined;
 					const filePath = typeof record?.filePath === "string" ? record.filePath : (typeof record?.path === "string" ? record.path : undefined);
-					const candidatePath = workdir ?? filePath ?? toolWorktree;
-					if (candidatePath) {
-						const gitRoot = findGitRoot(candidatePath);
-						if (gitRoot) setSessionWorkspace(input.sessionID, gitRoot);
-					}
+					registerSessionWorkspaceFromToolCall(input.sessionID, { workdir, filePath, hostWorktree, toolWorktree });
 				}
 				if (input.tool === "read") {
 					const target = editTargets(args, toolWorktree)[0];