opencode-workflow-guard 1.4.0 → 1.5.0

package/src/policies/boundary.ts

@@ -127,23 +127,29 @@ export function teeTargetsIn(segment: string): string[] {
 	return targets;
 }
 
-export function shellMutationIn(segment: string): ShellMutation | undefined {
-	const redirectMatch = segment.match(
-		/(?:^|[\s>]|(?<=[^\s"']))([0-9]*&?>>?&?)\s*["']?([^\s>&|;"']+)/,
-	);
-	if (redirectMatch?.[1] && redirectMatch?.[2]) {
+function redirectMutationsIn(segment: string): ShellMutation[] {
+	const mutations: ShellMutation[] = [];
+	const redirectRe = /(?:^|[\s>]|(?<=[^\s"']))([0-9]*&?>>?&?)\s*["']?([^\s>&|;"']+)/g;
+	for (const redirectMatch of segment.matchAll(redirectRe)) {
+		if (!redirectMatch[1] || !redirectMatch[2]) continue;
 		const op = redirectMatch[1];
 		const target = redirectMatch[2];
 		// Filter fd duplication (e.g. 2>&1, >&2) where target is purely an fd number
 		const isFdDup = op.endsWith("&") && /^\d+$/.test(target);
 		if (!isFdDup && !/^\/dev\/(?:null|stdout|stderr|tty|fd\/\d+)$/.test(target)) {
-			return {
+			mutations.push({
 				kind: "redirect",
 				target,
 				what: `file redirect to '${target}'`,
-			};
+			});
 		}
 	}
+	return mutations;
+}
+
+export function shellMutationIn(segment: string): ShellMutation | undefined {
+	const redirectMutation = redirectMutationsIn(segment)[0];
+	if (redirectMutation) return redirectMutation;
 	const teeTargets = teeTargetsIn(segment);
 	if (teeTargets.length > 0) {
 		return {
@@ -152,10 +158,11 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 			what: `tee to '${teeTargets[0]!}'`,
 		};
 	}
-	const sedMatch = segment.match(/\bsed\s+(?:-(?:[a-zA-Z]*i[a-zA-Z]*|i\S*)\s+)+[^\s;&|]+/);
-	if (sedMatch) {
-		const tokens = sedMatch[0]!.split(/\s+/);
-		const target = tokens[tokens.length - 1];
+	const sedWords = shellWords(unwrapShellCommand(segment));
+	if (sedWords[0] === "sed" && sedWords.slice(1).some((word) => /^-(?:[a-zA-Z]*i|i\S*)$/.test(word) || /^--in-place(?:=.*)?$/.test(word))) {
+		const operands = sedWords.slice(1).filter((word) => !word.startsWith("-"));
+		const target = operands.at(-1);
+		if (!target) return undefined;
 		return { kind: "command", target, what: `sed -i on '${target}'` };
 	}
 	const transfer = filesystemTransferInfo(segment);
@@ -192,12 +199,57 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 	return undefined;
 }
 
+const SIMPLE_MUTATION_COMMANDS = new Set(["touch", "mkdir", "rm", "unlink", "rmdir", "truncate"]);
+const TRANSFER_COMMANDS = new Set(["cp", "mv", "ln"]);
+
 export function simpleFilesystemMutations(segment: string): ShellMutation[] {
 	const words = shellWords(unwrapShellCommand(segment));
 	const command = words[0];
-	if (!command || !new Set(["touch", "mkdir", "rm", "unlink", "rmdir"]).has(command)) {
+	if (!command) {
 		return [];
 	}
+	if (command === "dd") {
+		return words
+			.slice(1)
+			.filter((word) => word.startsWith("of=") && word.length > 3)
+			.map((word) => {
+				const target = word.slice(3);
+				return {
+					kind: "command" as const,
+					target,
+					what: `dd output to '${target}'`,
+				};
+			});
+	}
+	if (command === "sed") {
+		let inPlace = false;
+		let scriptSupplied = false;
+		const targets: string[] = [];
+		for (let i = 1; i < words.length; i++) {
+			const word = words[i]!;
+			if (/^-(?:[a-zA-Z]*i|i\S*)$/.test(word) || /^--in-place(?:=.*)?$/.test(word)) {
+				inPlace = true;
+				continue;
+			}
+			if (word === "-e" || word === "--expression" || word === "-f" || word === "--file") {
+				scriptSupplied = true;
+				i++;
+				continue;
+			}
+			if (/^(?:-e|--expression=|-f|--file=)/.test(word) || word.startsWith("-")) {
+				if (/^(?:-e|--expression=)/.test(word)) scriptSupplied = true;
+				continue;
+			}
+			if (!scriptSupplied) {
+				scriptSupplied = true;
+				continue;
+			}
+			targets.push(word);
+		}
+		if (!inPlace) return [];
+		return targets.map((target) => ({ kind: "command" as const, target, what: `sed -i on '${target}'` }));
+	}
+	if (!SIMPLE_MUTATION_COMMANDS.has(command)) return [];
 	return words
 		.slice(1)
 		.filter((word) => !word.startsWith("-"))
@@ -212,7 +264,7 @@ export function filesystemTransferInfo(
 	segment: string,
 ): { sources: string[]; destination?: string } | undefined {
 	const words = shellWords(unwrapShellCommand(segment));
-	if (!words[0] || !new Set(["cp", "mv", "ln"]).has(words[0])) return undefined;
+	if (!words[0] || !TRANSFER_COMMANDS.has(words[0])) return undefined;
 	const operands: string[] = [];
 	let targetDirectory: string | undefined;
 	for (let i = 1; i < words.length; i++) {
@@ -295,14 +347,12 @@ export async function guardShellMutation(
 			target,
 			what: `tee to '${target}'`,
 		}));
-		const fallbackMutation = shellMutationIn(segment.trim());
-		const mutations = simpleMutations.length > 0
-			? simpleMutations
-			: teeMutations.length > 0
-				? teeMutations
-				: fallbackMutation
-					? [fallbackMutation]
-					: [];
+		const redirectMutations = redirectMutationsIn(segment.trim());
+		const mutations = [...simpleMutations, ...teeMutations, ...redirectMutations];
+		if (mutations.length === 0) {
+			const fallbackMutation = shellMutationIn(segment.trim());
+			if (fallbackMutation) mutations.push(fallbackMutation);
+		}
 		for (const mutation of mutations) {
 			hasMutation = true;
 			const secret = secretIn(segment);

package/src/policies/destructive.ts

@@ -1,4 +1,4 @@
-import { asRecord } from "../lib/utils.ts";
+import { asRecord, shellWords, splitShellSegments } from "../lib/utils.ts";
 
 export interface LivePattern {
 	re: RegExp;
@@ -62,9 +62,48 @@ export const LIVE_MUTATION_PATTERNS: LivePattern[] = [
 	{ re: /\bmknod\s+\S+\s+p\b/, what: ["named FIFO pipe ", "creation (reverse shell backpipe)"].join("") },
 ];
 
+const KUBECTL_VALUE_GLOBALS = new Set([
+	"--as", "--as-group", "--as-uid", "--as-user-extra", "--cache-dir", "--certificate-authority", "--client-certificate", "--client-key",
+	"--cluster", "--context", "--kubeconfig", "--kuberc", "--namespace", "--password", "--profile", "--profile-output", "--request-timeout",
+	"--server", "--storage-driver-buffer-duration", "--storage-driver-db", "--storage-driver-host", "--storage-driver-password", "--storage-driver-table",
+	"--storage-driver-user", "--tls-server-name", "--token", "--user", "--username", "-n", "-s",
+]);
+const KUBECTL_BOOLEAN_GLOBALS = new Set(["--disable-compression", "--insecure-skip-tls-verify", "--match-server-version", "--storage-driver-secure", "--version", "--warnings-as-errors"]);
+
+function normalizedKubectlCommands(command: string): string {
+	const normalized: string[] = [];
+	for (const segment of splitShellSegments(command)) {
+		const words = shellWords(segment);
+		for (let i = 0; i < words.length; i++) {
+			if (words[i] !== "kubectl") continue;
+			let j = i + 1;
+			while (j < words.length) {
+				const option = words[j];
+				const name = option.split("=", 1)[0];
+				if (/^-[ns].+/.test(option) && !option.startsWith("--")) {
+					j++;
+					continue;
+				}
+				if (KUBECTL_VALUE_GLOBALS.has(name)) {
+					j += option.includes("=") ? 1 : 2;
+					continue;
+				}
+				if (KUBECTL_BOOLEAN_GLOBALS.has(name)) {
+					j++;
+					continue;
+				}
+				break;
+			}
+			if (j < words.length) normalized.push(`kubectl ${words.slice(j).join(" ")}`);
+		}
+	}
+	return normalized.join(" ; ");
+}
+
 export function liveMutationIn(command: string): string | undefined {
+	const optionNormalized = `${normalizedKubectlCommands(command)} ; ${command.replace(/\b(terraform|tofu)\s+(?:(?:-chdir(?:=\S+|\s+\S+)|-(?:no-color|version))\s+)*/g, "$1 ")}`;
 	for (const { re, what } of LIVE_MUTATION_PATTERNS) {
-		if (re.test(command)) {
+		if (re.test(command) || re.test(optionNormalized)) {
 			return what;
 		}
 	}

package/src/policies/git.ts

@@ -16,6 +16,22 @@ export const PROTECTED_BRANCHES = new Set(["main", "master"]);
 export const PUSH_TO_MAIN_RE =
 	/\bgit\s+push\b[^|;&]*(?:^|\s)\+?[\w./-]*:(?:main|master)(?![\w./-])|\bgit\s+push\b[^|;&]*(?:\s|\/)(?:main|master)(?![\w./-])/;
 
+export function hasUnsafeGitAlias(command: string): boolean {
+	return splitShellSegments(command).some((segment) => {
+		const words = unwrapShellWords(segment);
+		const gitIndex = words.findIndex((word, index) =>
+			word === "git" && words.slice(0, index).every((prefix) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(prefix)),
+		);
+		if (gitIndex < 0) return false;
+		const args = words.slice(gitIndex + 1);
+		return args.some((arg, index) =>
+			/^-calias\./i.test(arg) ||
+			/^--config-env=alias\./i.test(arg) ||
+			((arg === "-c" || arg === "--config-env") && /^alias\./i.test(args[index + 1] ?? "")),
+		);
+	});
+}
+
 export const GIT_BRANCH_CREATE_RE =
 	/\bgit\s+(?:checkout\s+-b|switch\s+(?:-c|--create))\b/;
 

package/src/policies/interpreter.ts

@@ -4,7 +4,7 @@ import { isPathOutsideWorkspace } from "./boundary.ts";
 export function extractInterpreterPayload(segment: string): string[] {
 	const payloads: string[] = [];
 	const inlineMatch = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce]\s+)(?:"([^"]*)"|'([^']*)')/i,
+		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*(?:"([^"]*)"|'([^']*)')/i,
 	);
 	if (inlineMatch?.[1] || inlineMatch?.[2]) {
 		payloads.push(inlineMatch[1] ?? inlineMatch[2] ?? "");
@@ -49,9 +49,14 @@ export function secretPathInPayload(payload: string): string | undefined {
 	return undefined;
 }
 
-const FUNCTION_TARGET_PATTERNS: RegExp[] = [
+const WRITE_TARGET_PATTERNS: RegExp[] = [
 	/\b(?:writeFileSync|writeFile|appendFile|appendFileSync|createWriteStream|unlink|unlinkSync|rmSync|rmdirSync|mkdirSync|renameSync|copyFileSync|cpSync|truncateSync)\s*\(\s*["']([^"']+)["']/g,
-	/\b(?:open|os\.remove|os\.unlink|os\.rmdir|os\.mkdir|os\.makedirs|os\.rename|shutil\.rmtree|shutil\.copy|shutil\.copy2|shutil\.move|Path)\s*\(\s*["']([^"']+)["']/g,
+	/\b(?:renameSync|copyFileSync|cpSync)\s*\(\s*["'][^"']+["']\s*,\s*["']([^"']+)["']/g,
+	/\b(?:os\.remove|os\.unlink|os\.rmdir|os\.mkdir|os\.makedirs|os\.rename|shutil\.rmtree|shutil\.copy|shutil\.copy2|shutil\.move)\s*\(\s*["']([^"']+)["']/g,
+	/\b(?:os\.rename|shutil\.copy|shutil\.copy2|shutil\.move)\s*\(\s*["'][^"']+["']\s*,\s*["']([^"']+)["']/g,
+	/\bopen\s*\(\s*["']([^"']+)["']\s*,\s*["'][^"']*[wax+][^"']*["']/g,
+	/\bPath\s*\(\s*["']([^"']+)["']\s*\)\s*\.\s*(?:write_text|write_bytes|unlink|mkdir|touch|rename|replace)\s*\(/g,
+	/\bPath\s*\(\s*["'][^"']+["']\s*\)\s*\.\s*(?:rename|replace)\s*\(\s*["']([^"']+)["']/g,
 	/[>]{1,2}\s*["']?([^\s;&"'|)]+)/g,
 ];
 
@@ -63,7 +68,7 @@ const FUNCTION_TARGET_PATTERNS: RegExp[] = [
 export function outsideWritePathInPayload(payload: string, root: string): string | undefined {
 	const candidates = new Set<string>();
 
-	for (const pattern of FUNCTION_TARGET_PATTERNS) {
+	for (const pattern of WRITE_TARGET_PATTERNS) {
 		const matches = payload.matchAll(pattern);
 		for (const m of matches) {
 			if (m[1]) candidates.add(m[1]);
@@ -78,3 +83,13 @@ export function outsideWritePathInPayload(payload: string, root: string): string
 	}
 	return undefined;
 }
+
+export function writePathsInPayload(payload: string): string[] {
+	const candidates = new Set<string>();
+	for (const pattern of WRITE_TARGET_PATTERNS) {
+		for (const match of payload.matchAll(pattern)) {
+			if (match[1]) candidates.add(match[1]);
+		}
+	}
+	return [...candidates];
+}

package/src/policies/secrets.ts

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
+import { shellWords, unwrapShellCommand } from "../lib/utils.ts";
 
 export const SAFE_ENV_FIXTURE_RE =
 	/\.env\.(example|sample|template|dist|schema)(\.[\w-]+)*$/i;
@@ -154,5 +155,16 @@ export function secretFileReadIn(segment: string): string | undefined {
 	}
 	const simpleMatch = segment.match(SIMPLE_FILE_READ_COMMAND_RE);
 	if (simpleMatch?.[1] && isSecretPath(simpleMatch[1])) return simpleMatch[1];
+	const words = shellWords(unwrapShellCommand(segment));
+	if (["cat", "head", "tail", "less", "more", "od", "hexdump", "strings", "base64", "xxd", "nl", "view", "nano", "vim"].includes(words[0] ?? "")) {
+		for (const operand of words.slice(1).filter((word) => !word.startsWith("-"))) {
+			if (isSecretPath(operand)) return operand;
+		}
+	}
+	if (words[0] === "dd") {
+		for (const word of words.slice(1)) {
+			if (word.startsWith("if=") && isSecretPath(word.slice(3))) return word.slice(3);
+		}
+	}
 	return undefined;
 }

package/src/policies/shell-safety.ts

@@ -38,7 +38,9 @@ export function checkPackageHygiene(command: string): { isViolating: boolean; na
 
 // AI agents running in non-interactive terminal subshells hang indefinitely when an
 // interactive prompt (vim, nano, less, top, sudo, npm init without -y, apt without -y,
-// git rebase -i) waits for TTY input.
+// git rebase -i) waits for TTY input. Process monitors are handled separately in
+// checkProcessMonitorCommand because `top` can run in a safe batch mode, while the
+// other monitors cannot.
 
 const INTERACTIVE_COMMAND_PATTERNS: Array<{ regex: RegExp; name: string; advice: string }> = [
 	{
@@ -51,11 +53,6 @@ const INTERACTIVE_COMMAND_PATTERNS: Array<{ regex: RegExp; name: string; advice:
 		name: "terminal pager",
 		advice: "Use cat, head, or grep with non-interactive pipes instead of interactive pagers.",
 	},
-	{
-		regex: /\b(?:top|htop|btop|atop|glances)\b/i,
-		name: "interactive process monitor",
-		advice: "Use ps aux, uptime, or batch flags (e.g. top -b -n 1) instead of interactive monitors.",
-	},
 	{
 		regex: /\bsudo\b/i,
 		name: "sudo with password prompt",
@@ -88,7 +85,29 @@ const INTERACTIVE_COMMAND_PATTERNS: Array<{ regex: RegExp; name: string; advice:
 	},
 ];
 
+const MONITOR_ADVICE = "Use ps aux, uptime, or batch flags (e.g. top -b -n 1) instead of interactive monitors.";
+// Process monitoring tokens are matched on whitespace/segment boundaries so that
+// an unrelated word such as `desktop`, a hyphenated filename like `top-level-dir`,
+// or a quoted argument like `echo "top"` is not mistaken for the `top` command.
+const ALWAYS_INTERACTIVE_MONITOR_RE = /(?:^|[;&|\s])(?:htop|btop|atop|glances)(?:$|[;&|\s])/i;
+const TOP_COMMAND_RE = /(?:^|[;&|\s])top(?:$|[;&|\s])/i;
+const TOP_BATCH_FLAG_RE = /(?:^|\s)(?:--batch|-[A-Za-z]*b[A-Za-z]*)(?:\s|$)/i;
+
+function checkProcessMonitorCommand(command: string): { isInteractive: boolean; name?: string; advice?: string } {
+	for (const segment of command.split(/[;&|\n]+/)) {
+		if (ALWAYS_INTERACTIVE_MONITOR_RE.test(segment)) {
+			return { isInteractive: true, name: "interactive process monitor", advice: MONITOR_ADVICE };
+		}
+		if (TOP_COMMAND_RE.test(segment) && !TOP_BATCH_FLAG_RE.test(segment)) {
+			return { isInteractive: true, name: "interactive process monitor", advice: MONITOR_ADVICE };
+		}
+	}
+	return { isInteractive: false };
+}
+
 export function checkInteractiveTtyCommand(command: string): { isInteractive: boolean; name?: string; advice?: string } {
+	const monitor = checkProcessMonitorCommand(command);
+	if (monitor.isInteractive) return monitor;
 	for (const { regex, name, advice } of INTERACTIVE_COMMAND_PATTERNS) {
 		if (regex.test(command)) {
 			return { isInteractive: true, name, advice };