opencode-workflow-guard 1.19.0 → 1.19.2

package/src/policies/git.ts

@@ -9,6 +9,8 @@ import {
 import {
 	unwrapShellWords,
 	splitShellSegments,
+	shellPrefixAssignments,
+	resolveGitRepoSelector,
 } from "../lib/shell.ts";
 
 export const PROTECTED_BRANCHES = new Set(["main", "master"]);
@@ -45,6 +47,10 @@ const GIT_DIR_OPTION_TAKES_VALUE = new Set([
 ]);
 const GIT_DIR_OPTION_PREFIXED =
 	/^(--git-dir=|--work-tree=|--namespace=|-c\S|--config-env=)/;
+// Git also accepts the attached short forms (`-C/path`, `-C~`). An unparsed
+// `-C` leaves the repository at the assumed base, which judges the write in the
+// wrong checkout, so the attached form is read as a claim like the spaced one.
+const GIT_DIR_SHORT_ATTACHED = /^-C(.+)$/;
 const GIT_GLOBAL_BOOLEAN_OPTIONS = new Set([
 	"--version",
 	"--help",
@@ -60,44 +66,88 @@ const GIT_GLOBAL_BOOLEAN_OPTIONS = new Set([
 	"--exec-path",
 ]);
 
-const GIT_ENV_DIR_RE =
-	/(?:^|\s)(?:env\s+(?:-\S+\s+)*)?(?:GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR)=(?:"([^"]*)"|'([^']*)'|(\S+))/;
+// Repository selection from the environment. It is read from the assignments
+// that precede the command word, never from the rest of the command text. A
+// bare `GIT_DIR=` used to be matched anywhere in the string, so an unquoted
+// commit message such as `git commit -m GIT_DIR=/repo` claimed an explicit
+// repository. That was harmless while the value only picked a base directory,
+// but `explicitRepoDir` is now a fact the permission seat trusts, so the claim
+// must be real. A `-c` config override is deliberately not a repository
+// selector: `GIT_DIR` is an environment variable, not a git config key.
+const GIT_REPO_ENV_ASSIGNMENT = /^(?:GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR)=(.*)$/s;
 
-export function parseGitInvocation(command: string): GitInvocation | undefined {
-	const root = getWorkspaceRoot();
+/**
+ * The repository an environment assignment selects, or undefined.
+ *
+ * Only assignments that the shell unwrapper actually consumed before the
+ * command word count. A value that merely appears inside an argument cannot be
+ * mistaken for one.
+ */
+function repoEnvironmentOverride(command: string): string | undefined {
+	for (const assignment of shellPrefixAssignments(command)) {
+		const match = GIT_REPO_ENV_ASSIGNMENT.exec(assignment);
+		if (match?.[1]) return match[1];
+	}
+	return undefined;
+}
+
+/**
+ * Parse one git invocation.
+ *
+ * `baseDir` is the directory the command actually runs in: a shell call's
+ * `workdir`, resolved against the call's workspace by the caller. It defaults
+ * to the ambient workspace root for callers that only classify command text.
+ * Without it, `git push` inside a linked worktree was resolved against the
+ * session-bound checkout, so every branch-state check judged the wrong tree.
+ *
+ * `explicitRepoDir` records whether the command text named the repository
+ * itself. A caller that cannot see `workdir` uses that flag to tell a fact
+ * from an assumption.
+ */
+export function parseGitInvocation(command: string, baseDir?: string): GitInvocation | undefined {
+	const root = baseDir ?? getWorkspaceRoot();
 	const tokens = unwrapShellWords(command);
 	if (tokens[0] !== "git") return undefined;
 	let i = 1;
 	let repoDir = root;
 	let sawDirOption = false;
 
-	const envDirMatch = command.match(GIT_ENV_DIR_RE);
-	if (envDirMatch) {
-		const envVal = envDirMatch[1] ?? envDirMatch[2] ?? envDirMatch[3];
-		if (envVal) {
-			repoDir = resolve(root, envVal);
-			sawDirOption = true;
-		}
+	const envDirValue = repoEnvironmentOverride(command);
+	if (envDirValue) {
+		repoDir = resolveGitRepoSelector(root, envDirValue);
+		sawDirOption = true;
 	}
 
 	while (i < tokens.length) {
 		const tok = tokens[i]!;
 		if (GIT_DIR_OPTION_TAKES_VALUE.has(tok)) {
 			const value = tokens[i + 1];
-			if (value === undefined) return { repoDir, rest: "" };
-			if (tok === "-C" || tok === "--git-dir" || tok === "--work-tree") {
-				repoDir = resolve(root, value);
+			const namesRepository = tok === "-C" || tok === "--git-dir" || tok === "--work-tree";
+			// A trailing `-C` with no value names no repository, but the flag is
+			// still present in the text. Report it as a claim so both seats agree
+			// the command is unclassifiable rather than one judging it and the
+			// other deferring it. `-c` and `--config-env` name no repository.
+			if (value === undefined) return { repoDir, rest: "", explicitRepoDir: sawDirOption || namesRepository };
+			if (namesRepository) {
+				repoDir = resolveGitRepoSelector(root, value);
 				sawDirOption = true;
 			}
 			i += 2;
 			continue;
 		}
+		const attached = GIT_DIR_SHORT_ATTACHED.exec(tok);
+		if (attached) {
+			repoDir = resolveGitRepoSelector(root, attached[1]!);
+			sawDirOption = true;
+			i += 1;
+			continue;
+		}
 		if (GIT_DIR_OPTION_PREFIXED.test(tok)) {
 			if (tok.startsWith("--git-dir=")) {
-				repoDir = resolve(root, tok.slice("--git-dir=".length));
+				repoDir = resolveGitRepoSelector(root, tok.slice("--git-dir=".length));
 				sawDirOption = true;
 			} else if (tok.startsWith("--work-tree=")) {
-				repoDir = resolve(root, tok.slice("--work-tree=".length));
+				repoDir = resolveGitRepoSelector(root, tok.slice("--work-tree=".length));
 				sawDirOption = true;
 			}
 			i += 1;
@@ -109,8 +159,7 @@ export function parseGitInvocation(command: string): GitInvocation | undefined {
 		}
 		break;
 	}
-	if (!sawDirOption) repoDir = root;
-	return { repoDir, rest: tokens.slice(i).join(" ") };
+	return { repoDir, rest: tokens.slice(i).join(" "), explicitRepoDir: sawDirOption };
 }
 
 export function normalizeGitCommands(command: string): string {
@@ -125,6 +174,17 @@ export function normalizeGitCommands(command: string): string {
 export const GIT_WRITE_RE =
 	/\bgit\s+(add|rm|mv|commit|merge|rebase|cherry-pick|revert|stash\s+pop|apply|am|restore|reset|update-ref|filter-branch)\b|\bgit\s+tag\s+(?!--?list\b|-l\b)(?:[^|;&]*\s)?(?:-d\b|--delete\b)|\bgit\s+checkout\s+(?!-b\b)|\bgit\s+branch\s+(?:[^|;&]*\s)?-[dDM]\b/;
 
+/**
+ * True when `text` invokes git in a way that changes a tree's refs or content.
+ *
+ * One predicate for every caller: the shell segment walk, the nested payload
+ * check, and the foreign-workdir gate. Keeping copies is how the payload check
+ * drifted wider than the segment check once already.
+ */
+export function isGitTreeWriteText(text: string): boolean {
+	return GIT_WRITE_RE.test(text) || GIT_BRANCH_CREATE_RE.test(text) || /\bgit\s+push\b/.test(text);
+}
+
 export function currentGitBranch(root: string): string | undefined {
 	const result = spawnSync("git", ["branch", "--show-current"], {
 		cwd: root,
@@ -304,14 +364,76 @@ export function isBranchAlreadyMergedOrClosed(
 	return { merged: false };
 }
 
-export function checkMergeConflicts(root: string): {
+/**
+ * The source branch a PR-creation command names, if any.
+ *
+ * `gh` names it with `--head`/`-H`, and Azure DevOps with `--source-branch`.
+ * Fork forms carry an `owner:` prefix; a ref cannot contain `:`, so the last
+ * segment is the local branch name the caller looks up. Callers fall back to
+ * the invoking checkout when the branch is not checked out anywhere locally.
+ */
+export function prSourceBranch(command: string): string | undefined {
+	const words = unwrapShellWords(command);
+	let source: string | undefined;
+	for (let i = 0; i < words.length; i++) {
+		const word = words[i]!;
+		let raw: string | undefined;
+		if (word === "--head" || word === "-H" || word === "--source-branch") {
+			raw = words[i + 1];
+		} else if (/^--(?:head|source-branch)=/.test(word)) {
+			raw = word.slice(word.indexOf("=") + 1);
+		} else if (/^-H\S/.test(word)) {
+			raw = word.slice(2);
+		}
+		if (raw === undefined) continue;
+		const branch = raw.includes(":") ? raw.slice(raw.lastIndexOf(":") + 1) : raw;
+		if (branch) source = branch;
+	}
+	return source;
+}
+
+/**
+ * Which checkout of this repository has `branch` checked out, if any.
+ *
+ * A PR is evaluated against the tree the branch actually lives in, not against
+ * whatever the caller's checkout happens to hold. Linked worktrees are the
+ * normal case: a session may sit in the primary checkout while the reviewed
+ * branch is checked out in an isolated worktree.
+ */
+export function findWorktreeForBranch(root: string, branch: string): string | undefined {
+	const target = branch.replace(/^refs\/heads\//, "").trim();
+	if (!target) return undefined;
+	const res = spawnSync("git", ["worktree", "list", "--porcelain"], {
+		cwd: root,
+		encoding: "utf8",
+		timeout: 10_000,
+	});
+	if (res.status !== 0) return undefined;
+	let current: string | undefined;
+	for (const line of res.stdout.split("\n")) {
+		if (line.startsWith("worktree ")) {
+			current = line.slice("worktree ".length).trim();
+			continue;
+		}
+		if (line.startsWith("branch ") && current) {
+			if (line.slice("branch ".length).trim().replace(/^refs\/heads\//, "") === target) return current;
+		}
+	}
+	return undefined;
+}
+
+export function checkMergeConflicts(root: string, ref?: string): {
 	hasConflicts: boolean;
 	baseBranch?: string;
 	reason?: string;
 } {
+	// A branch that is not checked out anywhere still has to be judged; the
+	// caller passes its ref, and HEAD stands in only when no ref was named.
+	const subject = typeof ref === "string" && ref.trim() ? ref.trim() : "HEAD";
+	const subjectLabel = subject === "HEAD" ? "" : `Branch '${subject}'`;
 	const candidates = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
 	for (const base of candidates) {
-		const mergeBaseRes = spawnSync("git", ["merge-base", "HEAD", base], {
+		const mergeBaseRes = spawnSync("git", ["merge-base", subject, base], {
 			cwd: root,
 			encoding: "utf8",
 			timeout: 5_000,
@@ -319,7 +441,7 @@ export function checkMergeConflicts(root: string): {
 		if (mergeBaseRes.status !== 0 || !mergeBaseRes.stdout.trim()) continue;
 		const mergeBase = mergeBaseRes.stdout.trim();
 
-		const treeRes = spawnSync("git", ["merge-tree", mergeBase, "HEAD", base], {
+		const treeRes = spawnSync("git", ["merge-tree", mergeBase, subject, base], {
 			cwd: root,
 			encoding: "utf8",
 			timeout: 10_000,
@@ -328,7 +450,7 @@ export function checkMergeConflicts(root: string): {
 			return {
 				hasConflicts: true,
 				baseBranch: base,
-				reason: `Branch has merge conflicts with base branch '${base}'. Rebase or merge '${base}' to resolve all conflicts before opening a PR or handing off.`,
+				reason: `${subjectLabel || "Branch"} has merge conflicts with base branch '${base}'. Rebase or merge '${base}' to resolve all conflicts before opening a PR or handing off.`,
 			};
 		}
 	}

package/src/policies/interpreter.ts

@@ -1,25 +1,102 @@
 import { isSecretPath } from "./secrets.ts";
 import { isPathOutsideWorkspace } from "./boundary.ts";
+import { heredocBodyIsCode, heredocRanges, maskDataHeredocBodies } from "../lib/shell.ts";
+
+// `eval` runs its argument as shell text, so its payload is scanned like an
+// inline interpreter body. It is the one launcher with no option word, so the
+// quoted body follows the command directly.
+const LAUNCHER_RE = /\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*|\beval\s+/i;
+
+/**
+ * The quoted shell word that follows an inline interpreter launcher.
+ *
+ * A shell word is one argument however many quoted spans it concatenates, so
+ * `'bash -c '\''cd /other && rm -rf x'\'''` is a single payload. Stopping at
+ * the first closing quote truncated that word to `bash -c `, and the nested
+ * command escaped the payload scan entirely.
+ */
+function inlinePayloadWord(segment: string, start: number): string | undefined {
+	let out = "";
+	let i = start;
+	while (i < segment.length) {
+		const char = segment[i]!;
+		if (char === "'") {
+			i += 1;
+			let closed = false;
+			while (i < segment.length) {
+				const inner = segment[i]!;
+				// `'\''` is the idiom for a literal quote inside a single-quoted
+				// span: the span closes, an escaped quote follows, a new span opens.
+				if (inner === "'" && segment[i + 1] === "\\" && segment[i + 2] === "'" && segment[i + 3] === "'") {
+					out += "'";
+					i += 4;
+					continue;
+				}
+				if (inner === "'") {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += inner;
+				i += 1;
+			}
+			if (!closed) return undefined;
+			continue;
+		}
+		if (char === '"') {
+			i += 1;
+			let closed = false;
+			while (i < segment.length) {
+				const inner = segment[i]!;
+				if (inner === "\\" && segment[i + 1] !== undefined) {
+					out += segment[i + 1];
+					i += 2;
+					continue;
+				}
+				if (inner === '"') {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += inner;
+				i += 1;
+			}
+			if (!closed) return undefined;
+			continue;
+		}
+		// Unquoted text ends the word at whitespace or a shell operator.
+		if (/\s/.test(char) || "|&;()<>".includes(char)) break;
+		if (char === "\\" && segment[i + 1] !== undefined) {
+			out += segment[i + 1];
+			i += 2;
+			continue;
+		}
+		out += char;
+		i += 1;
+	}
+	return out === "" ? undefined : out;
+}
 
 export function extractInterpreterPayload(segment: string): string[] {
 	const payloads: string[] = [];
-	const inlineMatch = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*(?:"([^"]*)"|'([^']*)')/i,
-	);
-	if (inlineMatch?.[1] || inlineMatch?.[2]) {
-		payloads.push(inlineMatch[1] ?? inlineMatch[2] ?? "");
+	// A heredoc body is prose unless the command reading it executes it, so the
+	// launcher scan runs on the masked text instead of reading documentation as
+	// code (`bash -c 'cd /other && rm -rf x'` quoted inside a `cat` body).
+	const masked = maskDataHeredocBodies(segment);
+	const launcher = LAUNCHER_RE.exec(masked);
+	if (launcher) {
+		const payload = inlinePayloadWord(segment, (launcher.index ?? 0) + launcher[0].length);
+		if (payload !== undefined) payloads.push(payload);
 	}
-	const heredocHeader = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\b[^\n]*<<(-?)\s*(?:'([^'\n]+)'|"([^"\n]+)"|([^\s'";|&()<>\n]+))[^\n]*\n/i,
-	);
-	if (heredocHeader) {
-		const delimiter = heredocHeader[2] ?? heredocHeader[3] ?? heredocHeader[4];
-		const bodyStart = (heredocHeader.index ?? 0) + heredocHeader[0].length;
-		const lines = segment.slice(bodyStart).split("\n");
-		const terminator = lines.findIndex((line) => (heredocHeader[1] ? line.replace(/^\t+/, "") : line) === delimiter);
-		if (terminator >= 0) payloads.push(lines.slice(0, terminator).join("\n"));
+	// A heredoc body is code when the command that reads it executes it. An
+	// unterminated body still runs, so it is scanned to end of input. The
+	// terminator's own newline is not part of the body.
+	for (const range of heredocRanges(segment)) {
+		if (!heredocBodyIsCode(segment, range.start)) continue;
+		const body = segment.slice(range.bodyStart, range.bodyEnd).replace(/\n$/, "");
+		if (body !== "") payloads.push(body);
 	}
-	const psMatch = segment.match(
+	const psMatch = masked.match(
 		/\b(?:powershell|pwsh)\s+(?:-[a-zA-Z]*enc[a-zA-Z]*\s+)([A-Za-z0-9+/=]+)/i,
 	);
 	if (psMatch?.[1]) {
@@ -28,7 +105,7 @@ export function extractInterpreterPayload(segment: string): string[] {
 			payloads.push(buf.toString("utf8"), buf.toString("utf16le"));
 		} catch {}
 	}
-	const b64PipeMatch = segment.match(
+	const b64PipeMatch = masked.match(
 		/echo\s+["']?([A-Za-z0-9+/=]{4,})["']?\s*\|\s*base64\s+(?:-[a-zA-Z]*d[a-zA-Z]*|--decode)\s*\|\s*(?:bash|sh|zsh)/i,
 	);
 	if (b64PipeMatch?.[1]) {

package/src/workflow-guard.ts

@@ -17,15 +17,15 @@ import { join } from "node:path";
 import { loadedPluginVersion } from "./lib/version.ts";
 import { editTargets, runPostEditValidators, snapshotFile, type FileSnapshot } from "./policies/post-edit-validation.ts";
 import { claimFiles, releaseFileClaims } from "./policies/file-claims.ts";
-import { extractCommands, splitShellSegments } from "./lib/shell.ts";
+import { extractCommands, planShellSegments } from "./lib/shell.ts";
 import { expandShellTargetPath, isPathOutsideWorkspace, OPENCODE_SCRATCH_DIR, redirectMutationsIn } from "./policies/boundary.ts";
 import { beginReadObservation, clearReadFingerprints, recordMutationObservation, recordSuccessfulRead, staleWriteReason } from "./policies/stale-write.ts";
 import { ToolInvocationLifecycle } from "./lib/tool-lifecycle.ts";
 import { ToolOutcomeTracker, type ToolOutcomePart } from "./lib/tool-outcomes.ts";
-import { guardToolCallImpl, isMutatingSurfaceTool, isReadOnlyRole, SHELL_TOOL_NAMES } from "./lib/guard-dispatcher.ts";
+import { isMutatingSurfaceTool, isReadOnlyRole, SHELL_TOOL_NAMES } from "./lib/guard-dispatcher.ts";
 import { createCustomTools, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
 import { evaluateDogfoodGate } from "./lib/dogfood.ts";
-import type { PolicyDecision, TodoSdkClient } from "./lib/types.ts";
+import type { TodoSdkClient } from "./lib/types.ts";
 export { isReadOnlyRole } from "./lib/guard-dispatcher.ts";
 export { extractReviewFollowups, buildWorkflowGuardSystemGuidance } from "./lib/custom-tools.ts";
 export { evaluateDogfoodGate } from "./lib/dogfood.ts";
@@ -59,7 +59,6 @@ import {
 	setSdkClient,
 	getSdkClient,
 	runWithRuntimeState,
-	lastMutationTimestamp,
 	getLastMutationTimestamp,
 	getMutationCount,
 	getSessionMutationCount,
@@ -101,6 +100,8 @@ import {
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
+	rebindSessionWorkspaceFromHost,
+	forgetSessionWorkspace,
 	registerSessionWorkspaceFromToolCall,
 	resolveInheritedWorkspace,
 	resolveSessionBoundWorkspace,
@@ -148,6 +149,8 @@ export {
 	setSessionWorkspace,
 	getSessionWorkspace,
 	getSessionBoundWorkspace,
+	rebindSessionWorkspaceFromHost,
+	forgetSessionWorkspace,
 	registerSessionWorkspaceFromToolCall,
 	resolveInheritedWorkspace,
 	resolveSessionBoundWorkspace,
@@ -159,7 +162,6 @@ export {
 // ── Shared shell/env utilities ───────────────────────────────────────────────
 import {
 	asRecord,
-	extractRecordTargetPath,
 	getCleanEnv,
 	showBlockToast,
 	isSensitiveEnvKey,
@@ -208,13 +210,19 @@ import {
 	persistReviewCache,
 	loadReviewCache,
 	audit,
-	logDecision,
 	summarizeInput,
 } from "./lib/audit.ts";
 
 export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getDogfoodCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, persistDogfoodCache, loadDogfoodCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
 export { summarizeInput };
 
+// The guard entry surface lives in a leaf module so the V2 entrypoint can
+// import it without pulling in this V1 file (and its SDK subtree) through a
+// cycle. Re-exported here because the test harness imports this public surface.
+export { guardToolCall, guardToolDecision, buildCompactionContext } from "./lib/guard-api.ts";
+import { guardToolCall, buildCompactionContext } from "./lib/guard-api.ts";
+import { TODOWRITE_SUFFIX, TODOWRITE_MARKER, EDIT_SUFFIX, EDIT_MARKER, SUBAGENT_SUFFIX, SUBAGENT_MARKER, appendToolDescriptionSuffix } from "./lib/tool-descriptions.ts";
+
 export function managedConfigDiagnostic(platform = process.platform, env: NodeJS.ProcessEnv = process.env): string {
 	const directory = platform === "darwin"
 		? "/Library/Application Support/opencode"
@@ -251,6 +259,7 @@ export {
 	getGitWorktreeFingerprint,
 	getTrackedWorktreeFingerprint,
 };
+export type { VerifyRun } from "./lib/verify.ts";
 
 // ── Secondary review rubric ──────────────────────────────────────────────────
 import { buildReviewRubric } from "./lib/review.ts";
@@ -309,6 +318,9 @@ import {
 	isBranchAlreadyMergedOrClosed,
 	checkMergeConflicts,
 	checkBranchBaseIsUpToDate,
+	findWorktreeForBranch,
+	parseGitInvocation,
+	prSourceBranch,
 } from "./policies/git.ts";
 
 export {
@@ -316,6 +328,9 @@ export {
 	isBranchAlreadyMergedOrClosed,
 	checkMergeConflicts,
 	checkBranchBaseIsUpToDate,
+	findWorktreeForBranch,
+	parseGitInvocation,
+	prSourceBranch,
 };
 
 import {
@@ -387,69 +402,10 @@ function logWarn(client: unknown, message: string): void {
 	} catch {}
 }
 
-/**
- * Public guard entry point. Audits every decision (block or allow) to a
- * durable JSONL file before returning.
- */
-export async function guardToolDecision(
-	toolName: string,
-	input: unknown,
-	context?: { sessionID?: string; callID?: string; worktree?: string; directory?: string; agent?: string },
-): Promise<PolicyDecision> {
-	const customRoot = context?.worktree || context?.directory;
-	const runImpl = () => guardToolCallImpl(toolName, input, context);
-	return customRoot
-		? await runWithRuntimeState(customRoot, getSdkClient(), runImpl)
-		: await runImpl();
-}
-
-export async function guardToolCall(
-	toolName: string,
-	input: unknown,
-	context?: { sessionID?: string; callID?: string; worktree?: string; directory?: string; agent?: string },
-): Promise<string | undefined> {
-	const decision = await guardToolDecision(toolName, input, context);
-	const allowLive = process.env.WORKFLOW_GUARD_ALLOW_LIVE === "1";
-	const isMutation = EDIT_TOOL_NAMES.has(toolName);
-	const targetPath = extractRecordTargetPath(input);
-	logDecision(toolName, input, context, decision, {
-		mutation: isMutation,
-		targetPath,
-		allowLive,
-		verification: lastVerify
-			? {
-					command: lastVerify.command,
-					passed: lastVerify.passed,
-					fresh: lastVerify.timestamp >= lastMutationTimestamp,
-					durationMs: lastVerify.durationMs,
-				}
-			: undefined,
-	});
-	return decision.status === "allowed" ? undefined : decision.message;
-}
-
 async function emitBlockFeedback(message: string): Promise<void> {
 	await showBlockToast(message);
 }
 
-export function buildCompactionContext(operationalState: string, priorityBlocks: string[], maxChars = 8_000): string {
-	if (!Number.isFinite(maxChars) || maxChars < 0 || !Number.isInteger(maxChars)) {
-		throw new RangeError("maxChars must be a non-negative finite integer");
-	}
-	const truncate = (value: string, limit: number): string => {
-		let end = Math.min(value.length, limit);
-		if (end > 0 && end < value.length && /[\uD800-\uDBFF]/.test(value[end - 1])) end -= 1;
-		return value.slice(0, end);
-	};
-	let context = truncate(operationalState, maxChars);
-	for (const block of priorityBlocks) {
-		const remaining = maxChars - context.length - 2;
-		if (remaining <= 0) break;
-		context += `\n\n${truncate(block, remaining)}`;
-	}
-	return context;
-}
-
 export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 	// Honor worktree if present (e.g. opencode worktrees or devcontainers)
 	// so worktree plugins cannot punch through boundary gates. When the host
@@ -596,13 +552,13 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					const shellCwd = shellWorkdir ? resolve(toolWorktree, shellWorkdir) : toolWorktree;
 					const snapshots: FileSnapshot[] = [];
 					for (const command of extractCommands(args)) {
-						for (const segment of splitShellSegments(command)) {
+						for (const { segment, root } of planShellSegments(command, shellCwd)) {
 							for (const mutation of redirectMutationsIn(segment)) {
 								const target = mutation.target ?? "";
 								if (!target || target === "/dev/null") continue;
 								const expanded = expandShellTargetPath(target);
 								if (!expanded) continue;
-								const resolvedTarget = resolve(shellCwd, expanded);
+								const resolvedTarget = resolve(root ?? shellCwd, expanded);
 								if (resolvedTarget === OPENCODE_SCRATCH_DIR || resolvedTarget.startsWith(OPENCODE_SCRATCH_DIR + "/")) continue;
 								if (isPathOutsideWorkspace(resolvedTarget, toolWorktree)) continue;
 								snapshots.push(snapshotFile(resolvedTarget));
@@ -828,28 +784,21 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 		// Similarly, mutating tools reflect their active-todo, feature-branch, and prior-read requirements.
 		// Subagent orchestration tools reflect worktree isolation and review expectations.
 		"tool.definition": async (input, output) => {
-			if (input.toolID === "todowrite") {
+			const append = (suffix: string, marker: string) => {
 				const description = typeof output.description === "string" ? output.description : "";
-				if (description.includes("verification evidence")) return;
-				output.description =
-					description +
-					"\n\nWorkflow Guard lifecycle: use todowrite to plan before working - it is the only view of progress the operator has, and every file mutation is gated on it. Each call replaces the complete task list: preserve every pending/in_progress task in subsequent updates until you explicitly mark it completed or cancelled, and do not omit active tasks when adding new work. A task may be marked completed only after its own work is recorded: the guard blocks a completion that has no file mutation in that task's active window, and one mutation cannot vouch for several completions. If a task is genuinely read-only (review, investigation, reading), append the marker `[read-only]` to its text; every such use is journaled. Use `cancelled` for work that was deliberately dropped. Marking every task completed triggers the finalization gate - fresh verification evidence (test run) is required after the last mutation, and protected-branch/conflict checks apply. Proactively call guard_next_tasks when planning work to discover existing roadmap/TODOs, and guard_status to check outstanding requirements.";
+				const next = appendToolDescriptionSuffix(description, suffix, marker);
+				if (next !== undefined) output.description = next;
+			};
+			if (input.toolID === "todowrite") {
+				append(TODOWRITE_SUFFIX, TODOWRITE_MARKER);
 				return;
 			}
 			if (EDIT_TOOL_NAMES.has(input.toolID)) {
-				const description = typeof output.description === "string" ? output.description : "";
-				if (description.includes("Workflow Guard requirement")) return;
-				output.description =
-					description +
-					"\n\nWorkflow Guard requirement: Modifications require an active task in todowrite (status pending or in_progress), a feature branch (edits on main/master are blocked), and a prior read of existing files in the current session.";
+				append(EDIT_SUFFIX, EDIT_MARKER);
 				return;
 			}
 			if (input.toolID === "task") {
-				const description = typeof output.description === "string" ? output.description : "";
-				if (description.includes("Workflow Guard subagent guidance")) return;
-				output.description =
-					description +
-					"\n\nWorkflow Guard subagent guidance: When spawning parallel worker subagents, use guard_worktree_create to isolate file mutations in separate worktrees. When conducting code reviews before task completion or PR creation, fetch the rubric with guard_review_rubric and provide it to a reviewer subagent to evaluate and record via record_review.";
+				append(SUBAGENT_SUFFIX, SUBAGENT_MARKER);
 				return;
 			}
 		},
@@ -943,6 +892,18 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					await runWithRuntimeState(effectiveRoot, ctx.client, () => continueUnfinishedSession(sessionID, settleTitle));
 				}
 			}
+			if (event?.type === "session.updated") {
+				// `session_move` relocates a session between checkouts, and the
+				// host re-emits `session.updated` for the moved session. Its
+				// `directory` is the authoritative post-move location; without
+				// this rebind the session kept judging the tree it left. The
+				// rebind only takes a genuine move, so a title or cost update on
+				// a session bound to a linked worktree cannot drag it back.
+				const info = (event.properties as { info?: { id?: unknown; directory?: unknown } })?.info;
+				if (typeof info?.id === "string" && typeof info.directory === "string") {
+					rebindSessionWorkspaceFromHost(info.id, info.directory);
+				}
+			}
 			if (event?.type === "message.updated") {
 				const info = (event.properties as { info?: { id?: unknown; role?: unknown; sessionID?: unknown; error?: { name?: unknown } } })?.info;
 				if (info?.role === "user" && typeof info.sessionID === "string") {
@@ -972,6 +933,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					toolLifecycle.takeRecoveryRun(sessionID);
 					clearLiveDocsFloor(sessionID);
 					await runWithRuntimeState(effectiveRoot, ctx.client, () => clearContinuationState(sessionID));
+					forgetSessionWorkspace(sessionID);
 				}
 			}
 			if (

package/test/test-e2e.mts

@@ -453,10 +453,13 @@ if (isOpenCodeV2) {
 			headlessAccountability?.seat?.deny?.decision?.policy === "secrets" &&
 			headlessAccountability?.seat?.deny?.decision?.code === "secret_read",
 	);
+	// A bare `git push` names no repository. Its checkout comes from the tool's
+	// workdir, which the seat cannot see, so the seat defers it as
+	// cwd-dependent and `execute.before` enforces with the resolved workdir.
 	check(
 		"V2 permission seat abstains on an undecidable push instead of denying it",
 		headlessAccountability?.seat?.push?.effect === "abstain" &&
-			headlessAccountability?.seat?.push?.decision?.code === "remote_state_unchecked",
+			headlessAccountability?.seat?.push?.decision?.code === "repository_unidentified",
 	);
 }