opencode-workflow-guard 1.3.8 → 1.4.0

package/ACKNOWLEDGEMENTS.md

@@ -19,5 +19,8 @@
 * **[`changesets`](https://github.com/changesets/changesets)** by the [Changesets Team](https://github.com/changesets/changesets)  
   * For the fragment-based changelog and versioning model that prevents merge conflicts across parallel feature PRs.
 
+* **[`oh-my-pi`](https://github.com/can1357/oh-my-pi)** by [@can1357](https://github.com/can1357), **`omp-guardrails`** by [@breathi3552](https://github.com/breathi3552), **`agentsflow`** by [@xzhang17](https://github.com/xzhang17), **`tools`** by [@marcelsud](https://github.com/marcelsud), and the **Claude Code** security hook community  
+  * Inspired the hardened shell wrapper tokenization/normalization in **`unwrapShellWords`**, multi-ecosystem verification detection in **Policy 10**, structured severity ranking (P0-P3 blocker gate) for the secondary review rubric in **Policy 19 / `guard_review_rubric`**, disk wipe, reverse shell & system permission signatures in **Policy 4**, lockfile synchronization checks in **Policy 3**, and subagent read-only role confinement & mutation budgets in **Policy 1**.
+
 * **[OpenCode Team at Anomaly](https://github.com/anomalyco/opencode)**  
   * For building the OpenCode terminal AI coding agent and its extensible plugin architecture (`@opencode-ai/plugin`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.3.8",
+  "version": "1.4.0",
   "description": "OpenCode plugin enforcing workflow discipline through deterministic tool.execute.before hooks",
   "license": "MIT",
   "type": "module",

package/src/lib/review.ts

@@ -34,12 +34,18 @@ export function buildReviewRubric(diffText: string, taskPrompt?: string): string
 		"### 5. Platform & Architecture Fit (GitHub & Azure DevOps)",
 		"- Does the change fit established repository patterns and CI/CD pipelines?",
 		"",
+		"### Finding Severity & Priority Tiers (inspired by OMP Advisor):",
+		"- **P0**: Blocker / security vulnerability / data loss risk / release-blocking regression (must block approval).",
+		"- **P1**: Major defect / missing core requirement / broken error handling (must block approval).",
+		"- **P2**: Minor bug / edge case / hygiene issue / missing unit test.",
+		"- **P3**: Suggestion / nitpick / optimization idea.",
+		"",
 		taskPrompt ? `### User Request / Context:\n${taskPrompt}\n` : "",
 		"### Code Diff Under Review:",
 		"```diff",
 		diffText.slice(0, 30_000),
 		"```",
 		"",
-		"Provide your verdict: `[APPROVE]` or `[REQUEST_CHANGES]` with concise, actionable findings.",
+		"Provide your verdict: `[APPROVE]` or `[REQUEST_CHANGES]` with concise, actionable findings ranked by priority (P0-P3).",
 	].join("\n");
 }

package/src/lib/state.ts

@@ -275,3 +275,15 @@ export function isDocumentationRequired(root: string): boolean {
 	const cfg = getProjectConfig(root);
 	return cfg.requireDocumentation === true;
 }
+
+export function getSubagentMutationBudget(root: string): number {
+	if (process.env.WORKFLOW_GUARD_MAX_SUBAGENT_MUTATIONS) {
+		const parsed = parseInt(process.env.WORKFLOW_GUARD_MAX_SUBAGENT_MUTATIONS, 10);
+		if (!Number.isNaN(parsed) && parsed > 0) return parsed;
+	}
+	const cfg = getProjectConfig(root);
+	if (typeof cfg.maxSubagentMutations === "number" && cfg.maxSubagentMutations > 0) {
+		return cfg.maxSubagentMutations;
+	}
+	return 50;
+}

package/src/lib/types.ts

@@ -21,6 +21,7 @@ export interface ProjectConfig {
 	verifyCommand?: string;
 	requireReview?: boolean;
 	requireDocumentation?: boolean;
+	maxSubagentMutations?: number;
 }
 
 export interface VerifyResult {

package/src/lib/utils.ts

@@ -29,6 +29,20 @@ export function normalize(cmd: string): string {
 	return cmd.replace(/\s+/g, " ");
 }
 
+export function decodeShellEscapes(text: string): string {
+	return text
+		// ANSI-C quoting wrapper: $'...' -> ...
+		.replace(/\$'([^']*)'/g, "$1")
+		// Hex escapes: \xHH
+		.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+		// Unicode escapes: \uHHHH
+		.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+		// Octal escapes: \0OO or \OOO (e.g. \162 -> 'r')
+		.replace(/\\([0-3][0-7]{2})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)))
+		// Single character escapes: \c -> c (e.g. \r\m -> rm)
+		.replace(/\\(.)/g, "$1");
+}
+
 export function shellWords(command: string): string[] {
 	return (command.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) ?? []).map((word) =>
 		word.replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/, "$1$2"),
@@ -69,14 +83,69 @@ export function splitShellSegments(command: string): string[] {
 }
 
 export function unwrapShellWords(command: string): string[] {
-	const words = shellWords(command.trim());
+	let cleanCmd = decodeShellEscapes(command.trim());
+	// Strip outer grouping parentheses/braces if present e.g. ( git commit ) or { git commit; }
+	while (
+		(cleanCmd.startsWith("(") && cleanCmd.endsWith(")")) ||
+		(cleanCmd.startsWith("{") && cleanCmd.endsWith("}"))
+	) {
+		cleanCmd = cleanCmd.slice(1, -1).trim();
+		if (cleanCmd.endsWith(";")) cleanCmd = cleanCmd.slice(0, -1).trim();
+	}
+
+	const words = shellWords(cleanCmd);
 	let i = 0;
 	while (i < words.length) {
-		if (words[i] === "command") {
+		const rawWord = words[i]!;
+		const word = rawWord.replace(/^[\({]+/, "").replace(/[\)};]+$/, "");
+		if (!word) {
+			i++;
+			continue;
+		}
+
+		if (word === "command" || word === "exec" || word === "eval" || word === "nohup") {
+			i++;
+			continue;
+		}
+		if (word === "nice") {
+			i++;
+			if (i < words.length && (words[i] === "-n" || words[i]?.startsWith("-n"))) {
+				if (words[i] === "-n") i += 2;
+				else i++;
+			}
+			continue;
+		}
+		if (word === "timeout") {
+			i++;
+			while (i < words.length && words[i]!.startsWith("-")) {
+				const opt = words[i++]!;
+				if ((opt === "-k" || opt === "-s" || opt === "--signal" || opt === "--kill-after") && i < words.length) {
+					i++;
+				}
+			}
+			if (i < words.length && /^\d+[smhd]?$/.test(words[i]!)) {
+				i++;
+			}
+			continue;
+		}
+		if (word === "stdbuf") {
 			i++;
+			while (i < words.length && words[i]!.startsWith("-")) {
+				const opt = words[i++]!;
+				if ((opt === "-i" || opt === "-o" || opt === "-e") && i < words.length) {
+					i++;
+				}
+			}
+			continue;
+		}
+		if (word === "time") {
+			i++;
+			while (i < words.length && words[i]!.startsWith("-")) {
+				i++;
+			}
 			continue;
 		}
-		if (words[i] === "sudo") {
+		if (word === "sudo" || word === "doas") {
 			i++;
 			const valueOptions = new Set([
 				"-u",
@@ -100,7 +169,7 @@ export function unwrapShellWords(command: string): string[] {
 			}
 			continue;
 		}
-		if (words[i] === "env") {
+		if (word === "env") {
 			i++;
 			const valueOptions = new Set([
 				"-u",
@@ -111,24 +180,27 @@ export function unwrapShellWords(command: string): string[] {
 				"--split-string",
 			]);
 			while (i < words.length) {
-				const word = words[i]!;
-				if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
+				const w = words[i]!;
+				if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w)) {
 					i++;
 					continue;
 				}
-				if (!word.startsWith("-")) break;
+				if (!w.startsWith("-")) break;
 				i++;
-				if (valueOptions.has(word) && i < words.length) i++;
+				if (valueOptions.has(w) && i < words.length) i++;
 			}
 			continue;
 		}
-		if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]!)) {
+		if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
 			i++;
 			continue;
 		}
 		break;
 	}
-	return words.slice(i);
+	return words
+		.slice(i)
+		.map((w) => w.replace(/^[\({]+/, "").replace(/[\)};]+$/, ""))
+		.filter(Boolean);
 }
 
 export function unwrapShellCommand(command: string): string {

package/src/lib/verify.ts

@@ -1,5 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { getCleanEnv, normalize } from "./utils.ts";
 import { getProjectConfig } from "./state.ts";
@@ -18,11 +18,35 @@ export function detectVerifyCommand(root: string): string | undefined {
 		return cmd || undefined;
 	}
 	try {
-		const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8")) as {
-			scripts?: Record<string, string>;
-		};
-		if (pkg.scripts?.test) return "npm test";
+		const pkgPath = join(root, "package.json");
+		if (existsSync(pkgPath)) {
+			const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as {
+				scripts?: Record<string, string>;
+			};
+			if (pkg.scripts?.test) return "npm test";
+			if (pkg.scripts?.typecheck) return "npm run typecheck";
+			if (pkg.scripts?.check) return "npm run check";
+			if (pkg.scripts?.build) return "npm run build";
+		}
 	} catch {}
+
+	if (existsSync(join(root, "Cargo.toml"))) {
+		return "cargo test";
+	}
+	if (existsSync(join(root, "go.mod"))) {
+		return "go test ./...";
+	}
+	if (
+		existsSync(join(root, "pytest.ini")) ||
+		existsSync(join(root, "pyproject.toml")) ||
+		existsSync(join(root, "setup.py"))
+	) {
+		return "pytest";
+	}
+	if (existsSync(join(root, "deno.json")) || existsSync(join(root, "deno.jsonc"))) {
+		return "deno test";
+	}
+
 	return undefined;
 }
 

package/src/policies/boundary.ts

@@ -244,6 +244,24 @@ export function secretSourceInFilesystemCommand(segment: string): string | undef
 	return undefined;
 }
 
+export function detectShellMutation(command: string): ShellMutation | undefined {
+	for (const segment of command.split(/[\n|;&]+/)) {
+		const simpleMutations = simpleFilesystemMutations(segment);
+		if (simpleMutations.length > 0) return simpleMutations[0];
+		const teeTargets = teeTargetsIn(segment);
+		if (teeTargets.length > 0) {
+			return {
+				kind: "command",
+				target: teeTargets[0],
+				what: `tee to '${teeTargets[0]}'`,
+			};
+		}
+		const fallback = shellMutationIn(segment.trim());
+		if (fallback) return fallback;
+	}
+	return undefined;
+}
+
 export async function guardShellMutation(
 	command: string,
 	sessionID: string | undefined,

package/src/policies/changelog.ts

@@ -78,3 +78,62 @@ export function prBodyIncludesChangelog(command: string): boolean {
 	}
 	return false;
 }
+
+export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifest?: string; lockfile?: string; reason?: string } {
+	try {
+		let modifiedFiles: string[] = [];
+		const baseCandidates = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
+		for (const base of baseCandidates) {
+			const mergeBase = spawnSync("git", ["merge-base", "HEAD", base], { cwd: root, encoding: "utf8", timeout: 10_000 });
+			if (mergeBase.status !== 0 || !mergeBase.stdout.trim()) continue;
+			const diff = spawnSync("git", ["diff", "--name-only", `${mergeBase.stdout.trim()}...HEAD`], { cwd: root, encoding: "utf8", timeout: 10_000 });
+			if (diff.status === 0 && diff.stdout.trim()) {
+				modifiedFiles = diff.stdout.split("\n").map((f) => f.trim()).filter(Boolean);
+				break;
+			}
+		}
+		const headDiff = spawnSync("git", ["diff", "--name-only", "HEAD"], { cwd: root, encoding: "utf8", timeout: 10_000 });
+		if (headDiff.status === 0 && headDiff.stdout.trim()) {
+			const uncommitted = headDiff.stdout.split("\n").map((f) => f.trim()).filter(Boolean);
+			modifiedFiles = Array.from(new Set([...modifiedFiles, ...uncommitted]));
+		}
+		const untracked = spawnSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8", timeout: 10_000 });
+		if (untracked.status === 0 && untracked.stdout.trim()) {
+			const files = untracked.stdout.split("\n").map((l) => l.slice(3).trim()).filter(Boolean);
+			modifiedFiles = Array.from(new Set([...modifiedFiles, ...files]));
+		}
+
+		const manifestToLockfiles: Array<{ manifest: RegExp; lockfiles: RegExp; name: string }> = [
+			{
+				manifest: /(?:^|\/)package\.json$/,
+				lockfiles: /(?:^|\/)(?:package-lock\.json|bun\.lock|bun\.lockb|pnpm-lock\.yaml|yarn\.lock)$/,
+				name: "package.json",
+			},
+			{
+				manifest: /(?:^|\/)Cargo\.toml$/,
+				lockfiles: /(?:^|\/)Cargo\.lock$/,
+				name: "Cargo.toml",
+			},
+			{
+				manifest: /(?:^|\/)go\.mod$/,
+				lockfiles: /(?:^|\/)go\.sum$/,
+				name: "go.mod",
+			},
+		];
+
+		for (const item of manifestToLockfiles) {
+			const hasManifest = modifiedFiles.some((f) => item.manifest.test(f));
+			if (hasManifest) {
+				const hasLockfile = modifiedFiles.some((f) => item.lockfiles.test(f));
+				if (!hasLockfile) {
+					return {
+						isOutOfSync: true,
+						manifest: item.name,
+						reason: `Package manifest '${item.name}' was modified without updating its corresponding lockfile. Run the package manager install/lock command before opening a PR.`,
+					};
+				}
+			}
+		}
+	} catch {}
+	return { isOutOfSync: false };
+}

package/src/policies/destructive.ts

@@ -48,6 +48,18 @@ export const LIVE_MUTATION_PATTERNS: LivePattern[] = [
 	{ re: /\b(?:curl|wget)\b[^;&]*\|\s*(?:bash|sh|zsh)\b/, what: ["remote ", "download piped directly to a shell"].join("") },
 	// Destructive git operations
 	{ re: /\bgit\s+push\b[^|;&]*(?:--force\b|--force-with-lease\b|\s-f\b)/, what: ["force ", "push"].join("") },
+	// Low-level disk / filesystem / partition destruction
+	{ re: /\b(?:mkfs(?:\.[a-z0-9]+)?|wipefs|parted|sfdisk|gdisk)\b/, what: ["disk/filesystem ", "format or partition manipulation"].join("") },
+	{ re: /\bdd\s+[^|;&]*\bof=\/dev\/(?:sd[a-z]|nvme\d|vd[a-z]|hd[a-z]|disk\d|rdisk\d|loop\d)/, what: ["raw disk/block device ", "overwrite via dd"].join("") },
+	{ re: /\bshred\s+[^|;&]*\/dev\/(?:sd[a-z]|nvme\d|vd[a-z]|hd[a-z]|disk\d|rdisk\d|loop\d)/, what: ["disk device ", "shredding"].join("") },
+	// Recursive permission/ownership clobbering on root or home
+	{ re: /\bchmod\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+\S+\s+(?:\/|~|\$HOME)(?:\s|$)/, what: ["recursive ", "permission clobbering of root/home path"].join("") },
+	{ re: /\bchown\s+-[a-zA-Z]*[rR][a-zA-Z]*\s+\S+\s+(?:\/|~|\$HOME)(?:\s|$)/, what: ["recursive ", "ownership clobbering of root/home path"].join("") },
+	// Network reverse shell / raw socket execution / data exfiltration channels
+	{ re: /\/dev\/(?:tcp|udp)\/[a-zA-Z0-9_.-]+\/\d+/, what: ["raw network socket / ", "reverse shell channel (/dev/tcp or /dev/udp)"].join("") },
+	{ re: /\b(?:nc|ncat|netcat)\b[^|;&]*-[a-zA-Z]*e[a-zA-Z]*\s+(?:\/bin\/(?:ba)?sh|sh|bash|cmd\.exe|powershell)/i, what: ["netcat reverse ", "shell execution (-e)"].join("") },
+	{ re: /\bsocat\b[^|;&]*\bexec:\s*['"]?(?:\/bin\/(?:ba)?sh|sh|bash)/i, what: ["socat interactive ", "reverse shell spawn"].join("") },
+	{ re: /\bmknod\s+\S+\s+p\b/, what: ["named FIFO pipe ", "creation (reverse shell backpipe)"].join("") },
 ];
 
 export function liveMutationIn(command: string): string | undefined {

package/src/policies/tamper.ts

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { basename, relative, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
+import { decodeShellEscapes } from "../lib/utils.ts";
 
 export const PROTECTED_PATH_REASON =
 	"Blocked: modifying Open" +
@@ -23,10 +24,9 @@ export const SETTINGS_TAMPER_PATTERNS: RegExp[] = [
 ];
 
 export function normalizeShellEvasion(text: string): string {
-	return text
+	return decodeShellEscapes(text)
 		.replace(/'([^']*)'/g, "$1")
-		.replace(/"([^"]*)"/g, "$1")
-		.replace(/\\(.)/g, "$1");
+		.replace(/"([^"]*)"/g, "$1");
 }
 
 export function normalizeGlobPathEvasion(text: string): string {

package/src/workflow-guard.ts

@@ -47,6 +47,7 @@ import {
 	stripJsonComments,
 	isReviewRequired,
 	isDocumentationRequired,
+	getSubagentMutationBudget,
 	recordReviewResult,
 	getLastReviewResult,
 	resetReviewState,
@@ -68,6 +69,7 @@ export {
 	stripJsonComments,
 	isReviewRequired,
 	isDocumentationRequired,
+	getSubagentMutationBudget,
 	recordReviewResult,
 	getLastReviewResult,
 	resetReviewState,
@@ -179,8 +181,11 @@ import {
 	hasPrCreateInvocation,
 	branchHasChangelogChange,
 	prBodyIncludesChangelog,
+	checkLockfileSync,
 } from "./policies/changelog.ts";
 
+export { checkLockfileSync };
+
 import { liveMutationIn, extractEditContent } from "./policies/destructive.ts";
 
 import { mcpMutationTool } from "./policies/mcp.ts";
@@ -197,6 +202,7 @@ import {
 	isPathOutsideWorkspace,
 	extractPatchPaths,
 	guardShellMutation,
+	detectShellMutation,
 } from "./policies/boundary.ts";
 
 import { isSecretPath, secretIn, secretFileReadIn, isEnvFilePath, generateMaskedEnvSchema } from "./policies/secrets.ts";
@@ -240,13 +246,38 @@ function logBlock(message: string): void {
 	} catch {}
 }
 
+const READ_ONLY_ROLES = new Set([
+	"reviewer",
+	"planner",
+	"advisor",
+	"critic",
+	"explorer",
+	"scout",
+	"evaluator",
+]);
+
+export function isReadOnlyRole(agent?: string): boolean {
+	if (!agent) return false;
+	const lower = agent.toLowerCase().trim();
+	return READ_ONLY_ROLES.has(lower) || Array.from(READ_ONLY_ROLES).some((r) => lower.includes(r));
+}
+
 async function guardToolCallImpl(
 	toolName: string,
 	input: unknown,
-	context?: { sessionID?: string },
+	context?: { sessionID?: string; worktree?: string; directory?: string; agent?: string },
 ): Promise<string | undefined> {
 	const currentRoot = getWorkspaceRoot();
 
+	// ── Role confinement: subagents in read-only roles cannot mutate files ──
+	if (context?.agent && isReadOnlyRole(context.agent)) {
+		if (EDIT_TOOL_NAMES.has(toolName) || toolName.startsWith("guard_worktree_")) {
+			const reason = `Blocked: subagent with read-only role '${context.agent}' cannot perform file mutations or lifecycle changes.`;
+			logBlock(`[workflow-guard] ${reason}`);
+			return reason;
+		}
+	}
+
 	// ── Policy 17: secret file read block via read tool ──
 	if (toolName === "read" || toolName === "read_file") {
 		const record = asRecord(input);
@@ -499,6 +530,18 @@ async function guardToolCallImpl(
 				"starting new work."
 			);
 		}
+		if (context?.sessionID) {
+			const parentID = await fetchParentSessionID(context.sessionID);
+			if (parentID) {
+				const count = getMutationCount(context.sessionID);
+				const budget = getSubagentMutationBudget(currentRoot);
+				if (count >= budget) {
+					const reason = `Blocked: subagent session '${context.sessionID}' has reached its mutation budget (${count}/${budget}). Hand work back to parent orchestrator.`;
+					logBlock(`[workflow-guard] ${reason}`);
+					return reason;
+				}
+			}
+		}
 		recordMutation(await effectiveTodoOwnerSessionID(context?.sessionID));
 		return undefined;
 	}
@@ -802,6 +845,13 @@ async function guardToolCallImpl(
 					`'Changelog:' section in the PR description (${descFlag}).`
 				);
 			}
+
+			// Lockfile synchronization pre-flight gate
+			const lockCheck = checkLockfileSync(currentRoot);
+			if (lockCheck.isOutOfSync) {
+				logBlock(`[workflow-guard] blocked ${prTool}: ${lockCheck.reason}`);
+				return `Blocked: ${lockCheck.reason}`;
+			}
 		}
 
 		const hasGitMutation = gitInvocations.some((invocation) => {
@@ -811,6 +861,35 @@ async function guardToolCallImpl(
 				/\bgit\s+(?:switch|checkout)\b/.test(normalizedInvocation)
 			);
 		});
+
+		if (context?.agent && isReadOnlyRole(context.agent)) {
+			const mutation = detectShellMutation(command);
+			if (mutation) {
+				logBlock(`[workflow-guard] blocked shell mutation for read-only role ${context.agent}: ${mutation.what}`);
+				return `Blocked: subagent with read-only role '${context.agent}' cannot perform shell file mutations (${mutation.what}).`;
+			}
+			if (hasGitMutation) {
+				logBlock(`[workflow-guard] blocked git mutation for read-only role ${context.agent}`);
+				return `Blocked: subagent with read-only role '${context.agent}' cannot mutate git history or state.`;
+			}
+		}
+
+		const shellMut = detectShellMutation(command);
+		if (hasGitMutation || shellMut) {
+			if (context?.sessionID) {
+				const parentID = await fetchParentSessionID(context.sessionID);
+				if (parentID) {
+					const count = getMutationCount(context.sessionID);
+					const budget = getSubagentMutationBudget(currentRoot);
+					if (count >= budget) {
+						const reason = `Blocked: subagent session '${context.sessionID}' has reached its mutation budget (${count}/${budget}). Hand work back to parent orchestrator.`;
+						logBlock(`[workflow-guard] ${reason}`);
+						return reason;
+					}
+				}
+			}
+		}
+
 		if (hasGitMutation) {
 			recordMutation(await effectiveTodoOwnerSessionID(context?.sessionID));
 		}
@@ -826,9 +905,13 @@ async function guardToolCallImpl(
 export async function guardToolCall(
 	toolName: string,
 	input: unknown,
-	context?: { sessionID?: string },
+	context?: { sessionID?: string; worktree?: string; directory?: string; agent?: string },
 ): Promise<string | undefined> {
-	const reason = await guardToolCallImpl(toolName, input, context);
+	const customRoot = context?.worktree || context?.directory;
+	const runImpl = () => guardToolCallImpl(toolName, input, context);
+	const reason = customRoot
+		? await runWithRuntimeState(customRoot, getSdkClient(), runImpl)
+		: await runImpl();
 	const allowLive = process.env.WORKFLOW_GUARD_ALLOW_LIVE === "1";
 	const isMutation = EDIT_TOOL_NAMES.has(toolName);
 	const record = asRecord(input);
@@ -998,6 +1081,14 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 							`evaluate each axis, and include findings per axis in the summary.`
 						);
 					}
+					if (args.passed) {
+						if (/(?:^|\s)(?:\[p[01]\]|p[01]\s*:\s*(?:blocker|defect|vulnerability|error|bug|issue)|p[01]\s+blocker)/i.test(args.summary)) {
+							return (
+								"[workflow-guard] Review rejected: cannot record approval when P0 or P1 blockers are flagged in findings. " +
+								"Resolve all P0/P1 issues before approving or record review with passed=false."
+							);
+						}
+					}
 					recordReviewResult(
 						args.reviewer,
 						args.summary,
@@ -1116,12 +1207,23 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 		},
 
 		"tool.execute.before": async (input, output) => {
-			return runWithRuntimeState(effectiveRoot, ctx.client, async () => {
+			const toolWorktree =
+				(input as { worktree?: string })?.worktree ||
+				(input as { directory?: string })?.directory ||
+				(output as { worktree?: string })?.worktree ||
+				(output as { directory?: string })?.directory ||
+				effectiveRoot;
+			const toolAgent =
+				(input as { agent?: string })?.agent ||
+				(output as { agent?: string })?.agent;
+			return runWithRuntimeState(toolWorktree, ctx.client, async () => {
 				const args =
 					(output as { args?: unknown } | undefined)?.args ??
 					(input as { args?: unknown }).args;
 				const reason = await guardToolCall(input.tool, args, {
 					sessionID: input.sessionID,
+					worktree: toolWorktree,
+					agent: toolAgent,
 				});
 				if (reason !== undefined) {
 					await emitBlockFeedback(reason);