opencode-workflow-guard 1.19.0 → 1.19.2

package/src/lib/permission-seat.ts

@@ -29,6 +29,9 @@
 
 import { guardToolCallImpl } from "./guard-dispatcher.ts";
 import { getSessionBoundWorkspace, runWithRuntimeState } from "./state.ts";
+import { GIT_BRANCH_CREATE_RE, GIT_WRITE_RE, PUSH_TO_MAIN_RE, parseGitInvocation } from "../policies/git.ts";
+import { hasPrCreateInvocation } from "../policies/changelog.ts";
+import { splitShellSegments } from "./shell.ts";
 import { mcpMutationTool } from "../policies/mcp.ts";
 import type { PolicyDecision } from "./types.ts";
 
@@ -61,6 +64,55 @@ export interface PermissionSeatResult {
 
 const EDIT_ACTIONS = new Set(["edit", "write", "patch", "apply_patch"]);
 
+/**
+ * Commands whose verdict depends on WHICH checkout they run in.
+ *
+ * A bare `git push`, `git commit`, or branch creation is judged against the
+ * repository the shell's working directory resolves to, and PR preflight is
+ * judged against the branch the PR publishes. This seat sees normalized
+ * `action`/`resources` only, never the tool's `workdir`, so for those commands
+ * the repository is an assumption rather than a fact: the session-bound
+ * checkout may be the primary tree while the command targets a linked
+ * worktree. Deciding on the assumption denied legitimate pushes and PRs, so
+ * the seat defers them to `execute.before`, which sees the raw arguments.
+ *
+ * Two cases stay decisive:
+ *
+ * - An explicit `-C`/`--git-dir`/`--work-tree`/`GIT_DIR` names the repository
+ *   in the command text, so it is a fact the seat can judge.
+ * - A push whose destination is an explicitly named protected branch is a
+ *   finding in every checkout, so no `workdir` can change the verdict.
+ */
+function repositoryDependent(command: string): boolean {
+	for (const segment of splitShellSegments(command)) {
+		// PR creation names no repository at all: the checkout is cwd-derived,
+		// and a `--head`/`--source-branch` may live in another worktree.
+		if (hasPrCreateInvocation(segment)) return true;
+		const parsed = parseGitInvocation(segment);
+		if (!parsed) continue;
+		const rest = `git ${parsed.rest}`;
+		if (parsed.explicitRepoDir) continue;
+		if (PUSH_TO_MAIN_RE.test(rest)) continue;
+		const repositorySensitive =
+			/\bgit\s+push\b/.test(rest) ||
+			GIT_WRITE_RE.test(rest) ||
+			GIT_BRANCH_CREATE_RE.test(rest);
+		if (repositorySensitive) return true;
+	}
+	return false;
+}
+
+/**
+ * Policies whose verdict is derived from the selected checkout.
+ *
+ * A block from one of these may be an artifact of judging the wrong tree: the
+ * original defect was a push denied for the protected branch of the primary
+ * checkout while the command targeted a linked feature worktree. A block from
+ * any other policy (destructive, shell-safety, secrets, tamper, todo) is a
+ * finding about the command text itself, so no working directory can change it.
+ */
+const CHECKOUT_DERIVED_POLICIES = new Set(["git", "pr-preflight"]);
+
 /**
  * Map one simulated policy decision onto the seat's effect.
  *
@@ -117,18 +169,46 @@ export async function evaluatePermissionSeat(
 
 	const mapping = mappedToolFor(event.action);
 	if (mapping) {
+		let deferred: PermissionSeatResult | undefined;
 		for (const resource of resources) {
+			// Where the command runs is part of the decision for some commands,
+			// and this seat cannot see the tool's `workdir`. Both directions of a
+			// checkout-derived verdict are then unreliable: a block may be the
+			// protected branch of the wrong tree, and an allow may be a feature
+			// checkout that hides a push to a protected destination. Defer those
+			// to `execute.before`, which resolves the shell's workdir.
+			const cwdDependent = mapping.tool === "bash" && repositoryDependent(resource);
 			const decision = await decide(mapping.tool, mapping.input(resource));
 			const verdict = seatVerdict(decision, mapping.tool);
+			if (cwdDependent) {
+				// A block from any OTHER policy is a finding about the command
+				// text itself (`cat .env` or a destructive live command in the
+				// same compound command), so no working directory can change it
+				// and it keeps its denial. Everything else defers.
+				if (verdict?.effect === "deny" && !CHECKOUT_DERIVED_POLICIES.has(decision.policy ?? "")) return verdict;
+				deferred = {
+					effect: "abstain",
+					mappedTool: mapping.tool,
+					decision: {
+						status: "needs_approval",
+						policy: decision.policy ?? "git",
+						code: "repository_unidentified",
+						message: "[workflow-guard permission.evaluate] Deferred: this command's verdict depends on the directory it runs in, which the permission seat cannot see. `execute.before` resolves the shell's workdir and enforces there.",
+					},
+				};
+				continue;
+			}
 			if (verdict) return verdict;
 		}
-		return { effect: "allow", mappedTool: mapping.tool };
+		return deferred ?? { effect: "allow", mappedTool: mapping.tool };
 	}
 
 	// `<server>_<tool>` MCP actions: only the guarded live-system servers are
 	// mapped (GitHub/Azure DevOps), matching the execute.before MCP policy.
+	// Cache the host action's mutability to avoid recomputing it on every iteration.
+	const actionIsMutating = mcpMutationTool(event.action);
 	for (const resource of resources) {
-		if (!mcpMutationTool(event.action) && !mcpMutationTool(resource)) continue;
+		if (!actionIsMutating && !mcpMutationTool(resource)) continue;
 		const decision = await decide(event.action, {});
 		return seatVerdict(decision, event.action) ?? { effect: "allow", mappedTool: event.action };
 	}