opencode-workflow-guard 1.18.1 → 1.19.1

package/src/policies/interpreter.ts

@@ -1,25 +1,102 @@
 import { isSecretPath } from "./secrets.ts";
 import { isPathOutsideWorkspace } from "./boundary.ts";
+import { heredocBodyIsCode, heredocRanges, maskDataHeredocBodies } from "../lib/shell.ts";
+
+// `eval` runs its argument as shell text, so its payload is scanned like an
+// inline interpreter body. It is the one launcher with no option word, so the
+// quoted body follows the command directly.
+const LAUNCHER_RE = /\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*|\beval\s+/i;
+
+/**
+ * The quoted shell word that follows an inline interpreter launcher.
+ *
+ * A shell word is one argument however many quoted spans it concatenates, so
+ * `'bash -c '\''cd /other && rm -rf x'\'''` is a single payload. Stopping at
+ * the first closing quote truncated that word to `bash -c `, and the nested
+ * command escaped the payload scan entirely.
+ */
+function inlinePayloadWord(segment: string, start: number): string | undefined {
+	let out = "";
+	let i = start;
+	while (i < segment.length) {
+		const char = segment[i]!;
+		if (char === "'") {
+			i += 1;
+			let closed = false;
+			while (i < segment.length) {
+				const inner = segment[i]!;
+				// `'\''` is the idiom for a literal quote inside a single-quoted
+				// span: the span closes, an escaped quote follows, a new span opens.
+				if (inner === "'" && segment[i + 1] === "\\" && segment[i + 2] === "'" && segment[i + 3] === "'") {
+					out += "'";
+					i += 4;
+					continue;
+				}
+				if (inner === "'") {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += inner;
+				i += 1;
+			}
+			if (!closed) return undefined;
+			continue;
+		}
+		if (char === '"') {
+			i += 1;
+			let closed = false;
+			while (i < segment.length) {
+				const inner = segment[i]!;
+				if (inner === "\\" && segment[i + 1] !== undefined) {
+					out += segment[i + 1];
+					i += 2;
+					continue;
+				}
+				if (inner === '"') {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += inner;
+				i += 1;
+			}
+			if (!closed) return undefined;
+			continue;
+		}
+		// Unquoted text ends the word at whitespace or a shell operator.
+		if (/\s/.test(char) || "|&;()<>".includes(char)) break;
+		if (char === "\\" && segment[i + 1] !== undefined) {
+			out += segment[i + 1];
+			i += 2;
+			continue;
+		}
+		out += char;
+		i += 1;
+	}
+	return out === "" ? undefined : out;
+}
 
 export function extractInterpreterPayload(segment: string): string[] {
 	const payloads: string[] = [];
-	const inlineMatch = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*(?:"([^"]*)"|'([^']*)')/i,
-	);
-	if (inlineMatch?.[1] || inlineMatch?.[2]) {
-		payloads.push(inlineMatch[1] ?? inlineMatch[2] ?? "");
+	// A heredoc body is prose unless the command reading it executes it, so the
+	// launcher scan runs on the masked text instead of reading documentation as
+	// code (`bash -c 'cd /other && rm -rf x'` quoted inside a `cat` body).
+	const masked = maskDataHeredocBodies(segment);
+	const launcher = LAUNCHER_RE.exec(masked);
+	if (launcher) {
+		const payload = inlinePayloadWord(segment, (launcher.index ?? 0) + launcher[0].length);
+		if (payload !== undefined) payloads.push(payload);
 	}
-	const heredocHeader = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\b[^\n]*<<(-?)\s*(?:'([^'\n]+)'|"([^"\n]+)"|([^\s'";|&()<>\n]+))[^\n]*\n/i,
-	);
-	if (heredocHeader) {
-		const delimiter = heredocHeader[2] ?? heredocHeader[3] ?? heredocHeader[4];
-		const bodyStart = (heredocHeader.index ?? 0) + heredocHeader[0].length;
-		const lines = segment.slice(bodyStart).split("\n");
-		const terminator = lines.findIndex((line) => (heredocHeader[1] ? line.replace(/^\t+/, "") : line) === delimiter);
-		if (terminator >= 0) payloads.push(lines.slice(0, terminator).join("\n"));
+	// A heredoc body is code when the command that reads it executes it. An
+	// unterminated body still runs, so it is scanned to end of input. The
+	// terminator's own newline is not part of the body.
+	for (const range of heredocRanges(segment)) {
+		if (!heredocBodyIsCode(segment, range.start)) continue;
+		const body = segment.slice(range.bodyStart, range.bodyEnd).replace(/\n$/, "");
+		if (body !== "") payloads.push(body);
 	}
-	const psMatch = segment.match(
+	const psMatch = masked.match(
 		/\b(?:powershell|pwsh)\s+(?:-[a-zA-Z]*enc[a-zA-Z]*\s+)([A-Za-z0-9+/=]+)/i,
 	);
 	if (psMatch?.[1]) {
@@ -28,7 +105,7 @@ export function extractInterpreterPayload(segment: string): string[] {
 			payloads.push(buf.toString("utf8"), buf.toString("utf16le"));
 		} catch {}
 	}
-	const b64PipeMatch = segment.match(
+	const b64PipeMatch = masked.match(
 		/echo\s+["']?([A-Za-z0-9+/=]{4,})["']?\s*\|\s*base64\s+(?:-[a-zA-Z]*d[a-zA-Z]*|--decode)\s*\|\s*(?:bash|sh|zsh)/i,
 	);
 	if (b64PipeMatch?.[1]) {

package/src/workflow-guard.ts

@@ -17,16 +17,18 @@ import { join } from "node:path";
 import { loadedPluginVersion } from "./lib/version.ts";
 import { editTargets, runPostEditValidators, snapshotFile, type FileSnapshot } from "./policies/post-edit-validation.ts";
 import { claimFiles, releaseFileClaims } from "./policies/file-claims.ts";
-import { extractCommands, splitShellSegments } from "./lib/shell.ts";
+import { extractCommands, planShellSegments } from "./lib/shell.ts";
 import { expandShellTargetPath, isPathOutsideWorkspace, OPENCODE_SCRATCH_DIR, redirectMutationsIn } from "./policies/boundary.ts";
 import { beginReadObservation, clearReadFingerprints, recordMutationObservation, recordSuccessfulRead, staleWriteReason } from "./policies/stale-write.ts";
 import { ToolInvocationLifecycle } from "./lib/tool-lifecycle.ts";
 import { ToolOutcomeTracker, type ToolOutcomePart } from "./lib/tool-outcomes.ts";
 import { guardToolCallImpl, isMutatingSurfaceTool, isReadOnlyRole, SHELL_TOOL_NAMES } from "./lib/guard-dispatcher.ts";
 import { createCustomTools, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
+import { evaluateDogfoodGate } from "./lib/dogfood.ts";
 import type { PolicyDecision, TodoSdkClient } from "./lib/types.ts";
 export { isReadOnlyRole } from "./lib/guard-dispatcher.ts";
 export { extractReviewFollowups, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
+export { evaluateDogfoodGate } from "./lib/dogfood.ts";
 
 // ── Types ────────────────────────────────────────────────────────────────────
 export type {
@@ -47,7 +49,7 @@ export type {
 	LearningOpportunity,
 } from "./lib/types.ts";
 export type { TodoSdkClient };
-export { verificationEvidence, reviewEvidence, toolOutcomeEvidence, policyDecisionEvidence, lifecycleStateEvidence, agentAssertionEvidence, evidenceMatchesSubject, isEvidenceFresh } from "./lib/evidence.ts";
+export { verificationEvidence, reviewEvidence, dogfoodEvidence, toolOutcomeEvidence, policyDecisionEvidence, lifecycleStateEvidence, agentAssertionEvidence, evidenceMatchesSubject, isEvidenceFresh } from "./lib/evidence.ts";
 export { getRalphOutcome } from "./policies/continuation.ts";
 
 // ── State & runtime context ──────────────────────────────────────────────────
@@ -76,6 +78,10 @@ import {
 	isReviewRequired,
 	isSubagentReviewRequired,
 	isDocumentationRequired,
+	isDogfoodRequired,
+	getDogfoodDeployMatrix,
+	getDogfoodDepth,
+	isDogfoodActor,
 	isLiveDocsRequired,
 	getLiveDocFailureThreshold,
 	getResearchToolPatterns,
@@ -88,9 +94,15 @@ import {
 	getLastReviewResultForWorkspace,
 	resetReviewState,
 	sessionReviews,
+	recordDogfoodResult,
+	getLastDogfoodResultForWorkspace,
+	getDogfoodRecordsForWorkspace,
+	resetDogfoodState,
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
+	rebindSessionWorkspaceFromHost,
+	forgetSessionWorkspace,
 	registerSessionWorkspaceFromToolCall,
 	resolveInheritedWorkspace,
 	resolveSessionBoundWorkspace,
@@ -117,6 +129,10 @@ export {
 	isReviewRequired,
 	isSubagentReviewRequired,
 	isDocumentationRequired,
+	isDogfoodRequired,
+	getDogfoodDeployMatrix,
+	getDogfoodDepth,
+	isDogfoodActor,
 	isLiveDocsRequired,
 	getLiveDocFailureThreshold,
 	getResearchToolPatterns,
@@ -127,9 +143,15 @@ export {
 	getLastReviewResult,
 	getLastReviewResultForWorkspace,
 	resetReviewState,
+	recordDogfoodResult,
+	getLastDogfoodResultForWorkspace,
+	getDogfoodRecordsForWorkspace,
+	resetDogfoodState,
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
+	rebindSessionWorkspaceFromHost,
+	forgetSessionWorkspace,
 	registerSessionWorkspaceFromToolCall,
 	resolveInheritedWorkspace,
 	resolveSessionBoundWorkspace,
@@ -194,7 +216,7 @@ import {
 	summarizeInput,
 } from "./lib/audit.ts";
 
-export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
+export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getDogfoodCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, persistDogfoodCache, loadDogfoodCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
 export { summarizeInput };
 
 export function managedConfigDiagnostic(platform = process.platform, env: NodeJS.ProcessEnv = process.env): string {
@@ -233,6 +255,7 @@ export {
 	getGitWorktreeFingerprint,
 	getTrackedWorktreeFingerprint,
 };
+export type { VerifyRun } from "./lib/verify.ts";
 
 // ── Secondary review rubric ──────────────────────────────────────────────────
 import { buildReviewRubric } from "./lib/review.ts";
@@ -291,6 +314,9 @@ import {
 	isBranchAlreadyMergedOrClosed,
 	checkMergeConflicts,
 	checkBranchBaseIsUpToDate,
+	findWorktreeForBranch,
+	parseGitInvocation,
+	prSourceBranch,
 } from "./policies/git.ts";
 
 export {
@@ -298,6 +324,9 @@ export {
 	isBranchAlreadyMergedOrClosed,
 	checkMergeConflicts,
 	checkBranchBaseIsUpToDate,
+	findWorktreeForBranch,
+	parseGitInvocation,
+	prSourceBranch,
 };
 
 import {
@@ -578,13 +607,13 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					const shellCwd = shellWorkdir ? resolve(toolWorktree, shellWorkdir) : toolWorktree;
 					const snapshots: FileSnapshot[] = [];
 					for (const command of extractCommands(args)) {
-						for (const segment of splitShellSegments(command)) {
+						for (const { segment, root } of planShellSegments(command, shellCwd)) {
 							for (const mutation of redirectMutationsIn(segment)) {
 								const target = mutation.target ?? "";
 								if (!target || target === "/dev/null") continue;
 								const expanded = expandShellTargetPath(target);
 								if (!expanded) continue;
-								const resolvedTarget = resolve(shellCwd, expanded);
+								const resolvedTarget = resolve(root ?? shellCwd, expanded);
 								if (resolvedTarget === OPENCODE_SCRATCH_DIR || resolvedTarget.startsWith(OPENCODE_SCRATCH_DIR + "/")) continue;
 								if (isPathOutsideWorkspace(resolvedTarget, toolWorktree)) continue;
 								snapshots.push(snapshotFile(resolvedTarget));
@@ -694,6 +723,14 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 						`- Secondary Review: ${lastR.passed ? "APPROVED" : "CHANGES REQUESTED"} by ${lastR.reviewer}`,
 					);
 				}
+				const dogfoodCtxGate = evaluateDogfoodGate(effectiveRoot);
+				if (dogfoodCtxGate.required) {
+					stateLines.push(
+						dogfoodCtxGate.missingHosts.length === 0
+							? `- Dogfood Evidence: PASS on ${(dogfoodCtxGate.matchedRecords ?? []).map((record) => record.host.label).join(", ") || "recorded host"}`
+							: `- Dogfood Evidence: MISSING for ${dogfoodCtxGate.missingHosts.join(", ")} (required before PR creation)`,
+					);
+				}
 				let openFollowups: ReturnType<typeof listReviewFollowups> = [];
 				try { openFollowups = followupStore ? listReviewFollowups(followupStore, "open", 8) : []; } catch {}
 				if (openFollowups.length > 0) {
@@ -838,6 +875,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					projectMemoryEnabled,
 					learningEnabled,
 					recoveryCheckpointsEnabled: isRecoveryCheckpointsEnabled(effectiveRoot),
+					dogfoodRequired: isDogfoodRequired(effectiveRoot),
 					isReadOnly,
 				});
 				output.system.push(guidance);
@@ -916,6 +954,18 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					await runWithRuntimeState(effectiveRoot, ctx.client, () => continueUnfinishedSession(sessionID, settleTitle));
 				}
 			}
+			if (event?.type === "session.updated") {
+				// `session_move` relocates a session between checkouts, and the
+				// host re-emits `session.updated` for the moved session. Its
+				// `directory` is the authoritative post-move location; without
+				// this rebind the session kept judging the tree it left. The
+				// rebind only takes a genuine move, so a title or cost update on
+				// a session bound to a linked worktree cannot drag it back.
+				const info = (event.properties as { info?: { id?: unknown; directory?: unknown } })?.info;
+				if (typeof info?.id === "string" && typeof info.directory === "string") {
+					rebindSessionWorkspaceFromHost(info.id, info.directory);
+				}
+			}
 			if (event?.type === "message.updated") {
 				const info = (event.properties as { info?: { id?: unknown; role?: unknown; sessionID?: unknown; error?: { name?: unknown } } })?.info;
 				if (info?.role === "user" && typeof info.sessionID === "string") {
@@ -945,6 +995,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					toolLifecycle.takeRecoveryRun(sessionID);
 					clearLiveDocsFloor(sessionID);
 					await runWithRuntimeState(effectiveRoot, ctx.client, () => clearContinuationState(sessionID));
+					forgetSessionWorkspace(sessionID);
 				}
 			}
 			if (

package/test/test-e2e.mts

@@ -453,10 +453,13 @@ if (isOpenCodeV2) {
 			headlessAccountability?.seat?.deny?.decision?.policy === "secrets" &&
 			headlessAccountability?.seat?.deny?.decision?.code === "secret_read",
 	);
+	// A bare `git push` names no repository. Its checkout comes from the tool's
+	// workdir, which the seat cannot see, so the seat defers it as
+	// cwd-dependent and `execute.before` enforces with the resolved workdir.
 	check(
 		"V2 permission seat abstains on an undecidable push instead of denying it",
 		headlessAccountability?.seat?.push?.effect === "abstain" &&
-			headlessAccountability?.seat?.push?.decision?.code === "remote_state_unchecked",
+			headlessAccountability?.seat?.push?.decision?.code === "repository_unidentified",
 	);
 }