opencode-workflow-guard 1.4.1 → 1.5.1

package/src/policies/boundary.ts

@@ -158,10 +158,11 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 			what: `tee to '${teeTargets[0]!}'`,
 		};
 	}
-	const sedMatch = segment.match(/\bsed\s+(?:-(?:[a-zA-Z]*i[a-zA-Z]*|i\S*)\s+)+[^\s;&|]+/);
-	if (sedMatch) {
-		const tokens = sedMatch[0]!.split(/\s+/);
-		const target = tokens[tokens.length - 1];
+	const sedWords = shellWords(unwrapShellCommand(segment));
+	if (sedWords[0] === "sed" && sedWords.slice(1).some((word) => /^-(?:[a-zA-Z]*i|i\S*)$/.test(word) || /^--in-place(?:=.*)?$/.test(word))) {
+		const operands = sedWords.slice(1).filter((word) => !word.startsWith("-"));
+		const target = operands.at(-1);
+		if (!target) return undefined;
 		return { kind: "command", target, what: `sed -i on '${target}'` };
 	}
 	const transfer = filesystemTransferInfo(segment);
@@ -220,6 +221,34 @@ export function simpleFilesystemMutations(segment: string): ShellMutation[] {
 				};
 			});
 	}
+	if (command === "sed") {
+		let inPlace = false;
+		let scriptSupplied = false;
+		const targets: string[] = [];
+		for (let i = 1; i < words.length; i++) {
+			const word = words[i]!;
+			if (/^-(?:[a-zA-Z]*i|i\S*)$/.test(word) || /^--in-place(?:=.*)?$/.test(word)) {
+				inPlace = true;
+				continue;
+			}
+			if (word === "-e" || word === "--expression" || word === "-f" || word === "--file") {
+				scriptSupplied = true;
+				i++;
+				continue;
+			}
+			if (/^(?:-e|--expression=|-f|--file=)/.test(word) || word.startsWith("-")) {
+				if (/^(?:-e|--expression=)/.test(word)) scriptSupplied = true;
+				continue;
+			}
+			if (!scriptSupplied) {
+				scriptSupplied = true;
+				continue;
+			}
+			targets.push(word);
+		}
+		if (!inPlace) return [];
+		return targets.map((target) => ({ kind: "command" as const, target, what: `sed -i on '${target}'` }));
+	}
 	if (!SIMPLE_MUTATION_COMMANDS.has(command)) return [];
 	return words
 		.slice(1)

package/src/policies/changelog.ts

@@ -1,8 +1,8 @@
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
-import { splitShellSegments, unwrapShellCommand } from "../lib/utils.ts";
+import { splitShellSegments, unwrapShellCommand, unwrapShellWords } from "../lib/utils.ts";
 
 export const CHANGELOG_SECTION_RE = /^\s*(?:#{1,6}\s*)?changelog\s*(?::|$)/im;
 
@@ -20,6 +20,84 @@ export function hasPrCreateInvocation(command: string): boolean {
 // Accepts either a CHANGELOG file modification or a .changeset/*.md file.
 const CHANGELOG_OR_CHANGESET_RE = /(?:changelog|\.changeset\/[^/]+\.md$)/i;
 
+function decodeAnsiCLineBreaks(value: string): string {
+	let decoded = "";
+	for (let i = 0; i < value.length; i += 1) {
+		if (value[i] !== "\\" || i + 1 >= value.length) {
+			decoded += value[i];
+			continue;
+		}
+		const next = value[++i];
+		if (next === "n") decoded += "\n";
+		else if (next === "r") decoded += "\r";
+		else if (next === "\\") decoded += "\\";
+		else decoded += `\\${next}`;
+	}
+	return decoded;
+}
+
+function preserveAnsiCLineBreaks(command: string): string {
+	return command.replace(/\$'((?:\\.|[^'])*)'/g, (_match, value: string) => {
+		const decoded = decodeAnsiCLineBreaks(value).replace(/'/g, "'\\''");
+		return `'${decoded}'`;
+	});
+}
+
+function prShellWords(command: string): string[] {
+	const words: string[] = [];
+	let word = "";
+	let quote: "'" | '"' | "ansi" | undefined;
+	let started = false;
+	for (let i = 0; i < command.length; i += 1) {
+		const char = command[i]!;
+		if (!quote && char === "$" && command[i + 1] === "'") {
+			quote = "ansi";
+			started = true;
+			i += 1;
+			continue;
+		}
+		if (quote === "ansi") {
+			if (char === "'") {
+				quote = undefined;
+				continue;
+			}
+			if (char === "\\" && i + 1 < command.length) {
+				let escape = char + command[++i];
+				word += decodeAnsiCLineBreaks(escape);
+				continue;
+			}
+			word += char;
+			continue;
+		}
+		if (char === "'" || char === '"') {
+			if (!quote) quote = char;
+			else if (quote === char) quote = undefined;
+			else word += char;
+			started = true;
+			continue;
+		}
+		if (char === "\\" && quote !== "'") {
+			const next = command[++i];
+			if (next !== "\n") {
+				if (quote === '"' && next && !['$', '`', '"', '\\'].includes(next)) word += "\\";
+				word += next ?? "\\";
+			}
+			started = true;
+			continue;
+		}
+		if (!quote && /\s/.test(char)) {
+			if (started) words.push(word);
+			word = "";
+			started = false;
+			continue;
+		}
+		word += char;
+		started = true;
+	}
+	if (started) words.push(word);
+	return words;
+}
+
 export function branchHasChangelogChange(root: string): boolean {
 	try {
 		const baseCandidates = ["origin/HEAD", "origin/main", "origin/master"];
@@ -54,23 +132,44 @@ export function branchHasChangelogChange(root: string): boolean {
 	}
 }
 
-export function prBodyIncludesChangelog(command: string): boolean {
-	const bodyMatch = command.match(
-		/(?:--body|--description|-d|-b)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s|;&]+))/,
-	);
-	const body = bodyMatch?.[1] ?? bodyMatch?.[2] ?? bodyMatch?.[3] ?? "";
-	if (CHANGELOG_SECTION_RE.test(body)) {
-		return true;
+export function prBodyIncludesChangelog(command: string, invocationRoot: string | null = getWorkspaceRoot()): boolean {
+	const parsedWords = prShellWords(command);
+	const envIndex = parsedWords.indexOf("env");
+	const usesEnvSplitString = envIndex >= 0 && parsedWords.slice(envIndex + 1).some((word) =>
+		word === "-S" || word.startsWith("-S") || word === "--split-string" || word.startsWith("--split-string="));
+	const commandWords = usesEnvSplitString
+		? unwrapShellWords(preserveAnsiCLineBreaks(command))
+		: parsedWords;
+	const cliIndex = commandWords.findIndex((word) => word === "gh" || word === "az");
+	const words = cliIndex >= 0 ? commandWords.slice(cliIndex) : [];
+	let body = "";
+	let bodyFile: string | undefined;
+	const valueOptions = new Set([
+		"--assignee", "--base", "--head", "--head-repo", "--label", "--milestone",
+		"--project", "--recover", "--reviewer", "--template", "--title",
+		"--bypass-policy-reason", "--labels", "--merge-commit-message", "--org",
+		"--repository", "--required-reviewer-ids", "--reviewer-ids", "--source-branch",
+		"--target-branch", "--work-items", "-a", "-B", "-H", "-l", "-m", "-p", "-r", "-T", "-t",
+	]);
+	for (let i = 0; i < words.length; i += 1) {
+		const word = words[i]!;
+		if (["--description", "-d"].includes(word)) {
+			const lines: string[] = [];
+			while (i + 1 < words.length && !words[i + 1]!.startsWith("-")) lines.push(words[++i]!);
+			body = lines.join("\n");
+		}
+		else if (["--body", "-b"].includes(word)) body = words[++i] ?? "";
+		else if (/^(?:--body|--description)=/.test(word)) body = word.slice(word.indexOf("=") + 1);
+		else if (["--body-file", "--description-file", "-F"].includes(word)) bodyFile = words[++i];
+		else if (/^(?:--body-file|--description-file)=/.test(word)) bodyFile = word.slice(word.indexOf("=") + 1);
+		else if (valueOptions.has(word)) i += 1;
 	}
-	const bodyFileMatch = command.match(
-		/(?:--body-file|--description-file|-F)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s|;&]+))/,
-	);
-	const bodyFile =
-		bodyFileMatch?.[1] ?? bodyFileMatch?.[2] ?? bodyFileMatch?.[3];
+	if (CHANGELOG_SECTION_RE.test(body)) return true;
 	if (bodyFile) {
 		try {
+			if (!isAbsolute(bodyFile) && invocationRoot === null) return false;
 			return CHANGELOG_SECTION_RE.test(
-				readFileSync(resolve(getWorkspaceRoot(), bodyFile), "utf8"),
+				readFileSync(isAbsolute(bodyFile) ? bodyFile : resolve(invocationRoot!, bodyFile), "utf8"),
 			);
 		} catch {
 			return false;

package/src/policies/continuation.ts

@@ -0,0 +1,83 @@
+import { randomUUID } from "node:crypto";
+import { getSdkClient } from "../lib/state.ts";
+import { effectiveTodosWithOwner, hasActiveTodo } from "./todo.ts";
+
+const MAX_CONSECUTIVE_CONTINUATIONS = 3;
+type ContinuationState = {
+	counts: Map<string, number>;
+	generatedMessageIDs: Map<string, Set<string>>;
+	inFlight: Set<string>;
+};
+const states = new WeakMap<object, ContinuationState>();
+
+function getState(): ContinuationState | undefined {
+	const client = getSdkClient();
+	if (!client || (typeof client !== "object" && typeof client !== "function")) return undefined;
+	let state = states.get(client as object);
+	if (!state) {
+		state = { counts: new Map(), generatedMessageIDs: new Map(), inFlight: new Set() };
+		states.set(client as object, state);
+	}
+	return state;
+}
+
+export async function continueUnfinishedSession(sessionID: string): Promise<boolean> {
+	const state = getState();
+	if (!state || state.inFlight.has(sessionID)) return false;
+	state.inFlight.add(sessionID);
+	try {
+		const effective = await effectiveTodosWithOwner(sessionID);
+		if (!effective || !hasActiveTodo(effective.todos) || effective.ownerSessionID !== sessionID) return false;
+
+		const count = state.counts.get(sessionID) ?? 0;
+		if (count >= MAX_CONSECUTIVE_CONTINUATIONS) return false;
+
+		const session = getSdkClient()?.session;
+		if (typeof session?.promptAsync !== "function") return false;
+
+		const messageID = `workflow-guard-${randomUUID()}`;
+		state.counts.set(sessionID, count + 1);
+		const generatedIDs = state.generatedMessageIDs.get(sessionID) ?? new Set<string>();
+		generatedIDs.add(messageID);
+		state.generatedMessageIDs.set(sessionID, generatedIDs);
+		try {
+			await session.promptAsync({
+				path: { id: sessionID },
+				body: {
+					messageID,
+					parts: [{
+						type: "text",
+						text: "Workflow Guard: unfinished todos remain. Continue working through them. If you need user input, use the question tool instead of ending the run.",
+					}],
+				},
+			});
+			return true;
+		} catch {
+			state.counts.set(sessionID, count);
+			generatedIDs.delete(messageID);
+			if (generatedIDs.size === 0) state.generatedMessageIDs.delete(sessionID);
+			return false;
+		}
+	} finally {
+		state.inFlight.delete(sessionID);
+	}
+}
+
+export function recordUserMessage(sessionID: string, messageID?: string): void {
+	const state = getState();
+	if (!state) return;
+	const generatedIDs = state.generatedMessageIDs.get(sessionID);
+	if (messageID && generatedIDs?.delete(messageID)) {
+		if (generatedIDs.size === 0) state.generatedMessageIDs.delete(sessionID);
+		return;
+	}
+	state.counts.delete(sessionID);
+}
+
+export function clearContinuationState(sessionID: string): void {
+	const state = getState();
+	if (!state) return;
+	state.counts.delete(sessionID);
+	state.generatedMessageIDs.delete(sessionID);
+	state.inFlight.delete(sessionID);
+}

package/src/policies/destructive.ts

@@ -1,4 +1,4 @@
-import { asRecord } from "../lib/utils.ts";
+import { asRecord, shellWords, splitShellSegments } from "../lib/utils.ts";
 
 export interface LivePattern {
 	re: RegExp;
@@ -62,9 +62,48 @@ export const LIVE_MUTATION_PATTERNS: LivePattern[] = [
 	{ re: /\bmknod\s+\S+\s+p\b/, what: ["named FIFO pipe ", "creation (reverse shell backpipe)"].join("") },
 ];
 
+const KUBECTL_VALUE_GLOBALS = new Set([
+	"--as", "--as-group", "--as-uid", "--as-user-extra", "--cache-dir", "--certificate-authority", "--client-certificate", "--client-key",
+	"--cluster", "--context", "--kubeconfig", "--kuberc", "--namespace", "--password", "--profile", "--profile-output", "--request-timeout",
+	"--server", "--storage-driver-buffer-duration", "--storage-driver-db", "--storage-driver-host", "--storage-driver-password", "--storage-driver-table",
+	"--storage-driver-user", "--tls-server-name", "--token", "--user", "--username", "-n", "-s",
+]);
+const KUBECTL_BOOLEAN_GLOBALS = new Set(["--disable-compression", "--insecure-skip-tls-verify", "--match-server-version", "--storage-driver-secure", "--version", "--warnings-as-errors"]);
+
+function normalizedKubectlCommands(command: string): string {
+	const normalized: string[] = [];
+	for (const segment of splitShellSegments(command)) {
+		const words = shellWords(segment);
+		for (let i = 0; i < words.length; i++) {
+			if (words[i] !== "kubectl") continue;
+			let j = i + 1;
+			while (j < words.length) {
+				const option = words[j];
+				const name = option.split("=", 1)[0];
+				if (/^-[ns].+/.test(option) && !option.startsWith("--")) {
+					j++;
+					continue;
+				}
+				if (KUBECTL_VALUE_GLOBALS.has(name)) {
+					j += option.includes("=") ? 1 : 2;
+					continue;
+				}
+				if (KUBECTL_BOOLEAN_GLOBALS.has(name)) {
+					j++;
+					continue;
+				}
+				break;
+			}
+			if (j < words.length) normalized.push(`kubectl ${words.slice(j).join(" ")}`);
+		}
+	}
+	return normalized.join(" ; ");
+}
+
 export function liveMutationIn(command: string): string | undefined {
+	const optionNormalized = `${normalizedKubectlCommands(command)} ; ${command.replace(/\b(terraform|tofu)\s+(?:(?:-chdir(?:=\S+|\s+\S+)|-(?:no-color|version))\s+)*/g, "$1 ")}`;
 	for (const { re, what } of LIVE_MUTATION_PATTERNS) {
-		if (re.test(command)) {
+		if (re.test(command) || re.test(optionNormalized)) {
 			return what;
 		}
 	}

package/src/policies/git.ts

@@ -16,6 +16,22 @@ export const PROTECTED_BRANCHES = new Set(["main", "master"]);
 export const PUSH_TO_MAIN_RE =
 	/\bgit\s+push\b[^|;&]*(?:^|\s)\+?[\w./-]*:(?:main|master)(?![\w./-])|\bgit\s+push\b[^|;&]*(?:\s|\/)(?:main|master)(?![\w./-])/;
 
+export function hasUnsafeGitAlias(command: string): boolean {
+	return splitShellSegments(command).some((segment) => {
+		const words = unwrapShellWords(segment);
+		const gitIndex = words.findIndex((word, index) =>
+			word === "git" && words.slice(0, index).every((prefix) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(prefix)),
+		);
+		if (gitIndex < 0) return false;
+		const args = words.slice(gitIndex + 1);
+		return args.some((arg, index) =>
+			/^-calias\./i.test(arg) ||
+			/^--config-env=alias\./i.test(arg) ||
+			((arg === "-c" || arg === "--config-env") && /^alias\./i.test(args[index + 1] ?? "")),
+		);
+	});
+}
+
 export const GIT_BRANCH_CREATE_RE =
 	/\bgit\s+(?:checkout\s+-b|switch\s+(?:-c|--create))\b/;
 

package/src/policies/interpreter.ts

@@ -4,7 +4,7 @@ import { isPathOutsideWorkspace } from "./boundary.ts";
 export function extractInterpreterPayload(segment: string): string[] {
 	const payloads: string[] = [];
 	const inlineMatch = segment.match(
-		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce]\s+)(?:"([^"]*)"|'([^']*)')/i,
+		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\s+(?:-[a-zA-Z]*[ce])\s*(?:"([^"]*)"|'([^']*)')/i,
 	);
 	if (inlineMatch?.[1] || inlineMatch?.[2]) {
 		payloads.push(inlineMatch[1] ?? inlineMatch[2] ?? "");
@@ -49,9 +49,14 @@ export function secretPathInPayload(payload: string): string | undefined {
 	return undefined;
 }
 
-const FUNCTION_TARGET_PATTERNS: RegExp[] = [
+const WRITE_TARGET_PATTERNS: RegExp[] = [
 	/\b(?:writeFileSync|writeFile|appendFile|appendFileSync|createWriteStream|unlink|unlinkSync|rmSync|rmdirSync|mkdirSync|renameSync|copyFileSync|cpSync|truncateSync)\s*\(\s*["']([^"']+)["']/g,
-	/\b(?:open|os\.remove|os\.unlink|os\.rmdir|os\.mkdir|os\.makedirs|os\.rename|shutil\.rmtree|shutil\.copy|shutil\.copy2|shutil\.move|Path)\s*\(\s*["']([^"']+)["']/g,
+	/\b(?:renameSync|copyFileSync|cpSync)\s*\(\s*["'][^"']+["']\s*,\s*["']([^"']+)["']/g,
+	/\b(?:os\.remove|os\.unlink|os\.rmdir|os\.mkdir|os\.makedirs|os\.rename|shutil\.rmtree|shutil\.copy|shutil\.copy2|shutil\.move)\s*\(\s*["']([^"']+)["']/g,
+	/\b(?:os\.rename|shutil\.copy|shutil\.copy2|shutil\.move)\s*\(\s*["'][^"']+["']\s*,\s*["']([^"']+)["']/g,
+	/\bopen\s*\(\s*["']([^"']+)["']\s*,\s*["'][^"']*[wax+][^"']*["']/g,
+	/\bPath\s*\(\s*["']([^"']+)["']\s*\)\s*\.\s*(?:write_text|write_bytes|unlink|mkdir|touch|rename|replace)\s*\(/g,
+	/\bPath\s*\(\s*["'][^"']+["']\s*\)\s*\.\s*(?:rename|replace)\s*\(\s*["']([^"']+)["']/g,
 	/[>]{1,2}\s*["']?([^\s;&"'|)]+)/g,
 ];
 
@@ -63,7 +68,7 @@ const FUNCTION_TARGET_PATTERNS: RegExp[] = [
 export function outsideWritePathInPayload(payload: string, root: string): string | undefined {
 	const candidates = new Set<string>();
 
-	for (const pattern of FUNCTION_TARGET_PATTERNS) {
+	for (const pattern of WRITE_TARGET_PATTERNS) {
 		const matches = payload.matchAll(pattern);
 		for (const m of matches) {
 			if (m[1]) candidates.add(m[1]);
@@ -78,3 +83,13 @@ export function outsideWritePathInPayload(payload: string, root: string): string
 	}
 	return undefined;
 }
+
+export function writePathsInPayload(payload: string): string[] {
+	const candidates = new Set<string>();
+	for (const pattern of WRITE_TARGET_PATTERNS) {
+		for (const match of payload.matchAll(pattern)) {
+			if (match[1]) candidates.add(match[1]);
+		}
+	}
+	return [...candidates];
+}

package/src/policies/planning.ts

@@ -0,0 +1,50 @@
+import { lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+
+const PRIMARY_TODO_NAMES = ["TODO.md", "todo.md"];
+const FALLBACK_NAMES = [
+	"ROADMAP.md", "roadmap.md",
+	"PLAN.md", "plan.md",
+	"TASKS.md", "tasks.md",
+	"BACKLOG.md", "backlog.md",
+];
+
+export interface PlanningSource {
+	path: string;
+	content: string;
+}
+
+export function discoverPlanningSources(root: string): PlanningSource[] {
+	let realRoot: string;
+	try {
+		realRoot = realpathSync(root);
+	} catch {
+		return [];
+	}
+	const isConfined = (path: string): boolean => {
+		const rel = relative(realRoot, realpathSync(path));
+		return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+	};
+	const readSources = (paths: string[]): PlanningSource[] => paths.flatMap((path) => {
+		try {
+			// Planning discovery is read-only and must not become a symlink escape hatch.
+			if (!lstatSync(path).isFile() || !isConfined(path)) return [];
+			return [{ path: relative(root, path), content: readFileSync(path, "utf8").slice(0, 20_000) }];
+		} catch {
+			return [];
+		}
+	});
+
+	const primary = readSources(PRIMARY_TODO_NAMES.map((name) => join(root, name)));
+	if (primary.length > 0) return primary;
+
+	const candidates = FALLBACK_NAMES.flatMap((name) => [join(root, name), join(root, "docs", name)]);
+	const plansDir = join(root, "docs", "plans");
+	try {
+		if (!lstatSync(plansDir).isDirectory() || !isConfined(plansDir)) return readSources(candidates);
+		for (const entry of readdirSync(plansDir, { withFileTypes: true })) {
+			if (entry.isFile() && entry.name.toLowerCase().endsWith(".md")) candidates.push(join(plansDir, entry.name));
+		}
+	} catch {}
+	return readSources(candidates);
+}

package/src/policies/secrets.ts

@@ -1,6 +1,7 @@
 import { realpathSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
+import { shellWords, unwrapShellCommand } from "../lib/utils.ts";
 
 export const SAFE_ENV_FIXTURE_RE =
 	/\.env\.(example|sample|template|dist|schema)(\.[\w-]+)*$/i;
@@ -154,5 +155,16 @@ export function secretFileReadIn(segment: string): string | undefined {
 	}
 	const simpleMatch = segment.match(SIMPLE_FILE_READ_COMMAND_RE);
 	if (simpleMatch?.[1] && isSecretPath(simpleMatch[1])) return simpleMatch[1];
+	const words = shellWords(unwrapShellCommand(segment));
+	if (["cat", "head", "tail", "less", "more", "od", "hexdump", "strings", "base64", "xxd", "nl", "view", "nano", "vim"].includes(words[0] ?? "")) {
+		for (const operand of words.slice(1).filter((word) => !word.startsWith("-"))) {
+			if (isSecretPath(operand)) return operand;
+		}
+	}
+	if (words[0] === "dd") {
+		for (const word of words.slice(1)) {
+			if (word.startsWith("if=") && isSecretPath(word.slice(3))) return word.slice(3);
+		}
+	}
 	return undefined;
 }

package/src/policies/todo.ts

@@ -35,6 +35,12 @@ export async function fetchParentSessionID(sessionID: string): Promise<string |
 export async function effectiveTodos(
 	sessionID: string | undefined,
 ): Promise<TodoItem[] | undefined> {
+	return (await effectiveTodosWithOwner(sessionID))?.todos;
+}
+
+export async function effectiveTodosWithOwner(
+	sessionID: string | undefined,
+): Promise<{ todos: TodoItem[]; ownerSessionID?: string } | undefined> {
 	if (!sessionID) return undefined;
 	const seen = new Set<string>();
 	let current: string | undefined = sessionID;
@@ -42,10 +48,10 @@ export async function effectiveTodos(
 		seen.add(current);
 		const todos = await fetchSessionTodos(current);
 		if (todos === undefined) return undefined;
-		if (todos.length > 0) return todos;
+		if (todos.length > 0) return { todos, ownerSessionID: current };
 		current = await fetchParentSessionID(current);
 	}
-	return [];
+	return { todos: [] };
 }
 
 export async function effectiveTodoOwnerSessionID(