opencode-workflow-guard 1.5.0 → 1.6.0

package/src/lib/types.ts

@@ -7,6 +7,10 @@ export interface TodoSdkClient {
 	session?: {
 		todo?: (opts: { path: { id: string } }) => Promise<{ data?: unknown }>;
 		get?: (opts: { path: { id: string } }) => Promise<{ data?: { parentID?: unknown } }>;
+		promptAsync?: (opts: {
+			path: { id: string };
+			body: { messageID?: string; parts: Array<{ type: "text"; text: string }> };
+		}) => Promise<unknown>;
 	};
 	tui?: {
 		showToast?: (opts: { body: { title?: string; message: string; variant?: string } }) => Promise<unknown>;
@@ -19,8 +23,16 @@ export interface TodoSdkClient {
 export interface ProjectConfig {
 	protectedBranches?: string[];
 	verifyCommand?: string;
+	postEditValidators?: Array<{
+		pattern: string;
+		command: string;
+		timeoutMs?: number;
+	}>;
 	requireReview?: boolean;
 	requireDocumentation?: boolean;
+	recoveryCheckpoints?: boolean;
+	projectMemory?: boolean;
+	learning?: boolean;
 	maxSubagentMutations?: number;
 	maxLearningInterventions?: number;
 }
@@ -51,8 +63,11 @@ export interface ReviewResult {
 export interface AuditEntry {
 	ts: string;
 	sessionID?: string;
+	callID?: string;
 	tool: string;
 	decision: "allow" | "block";
+	phase?: "decision" | "outcome" | "event";
+	durationMs?: number;
 	reason?: string;
 	input?: unknown;
 	evidence?: {
@@ -136,3 +151,28 @@ export interface ProjectMemoryInput {
 	paths?: string[];
 	supersedes?: string;
 }
+
+export type ReviewFollowupSeverity = "P2" | "P3";
+
+export interface ReviewFollowup {
+	id: string;
+	projectId: string;
+	severity: ReviewFollowupSeverity;
+	summary: string;
+	reviewer: string;
+	createdAt: number;
+	resolvedAt?: number;
+	sessionID?: string;
+	commit?: string;
+	paths: string[];
+	status: "open" | "resolved";
+}
+
+export interface ReviewFollowupInput {
+	severity: ReviewFollowupSeverity;
+	summary: string;
+	reviewer: string;
+	sessionID?: string;
+	commit?: string;
+	paths?: string[];
+}

package/src/lib/utils.ts

@@ -1,269 +1,32 @@
 import { getSdkClient } from "./state.ts";
 
 export function asRecord(value: unknown): Record<string, unknown> | undefined {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) {
-		return undefined;
-	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
 	return value as Record<string, unknown>;
 }
 
-export function extractCommands(input: unknown): string[] {
-	if (typeof input === "string") {
-		return [input];
-	}
+export function extractRecordTargetPath(input: unknown): string | undefined {
 	const record = asRecord(input);
-	if (!record) {
-		return [];
-	}
-	const commands: string[] = [];
-	if (typeof record.command === "string") commands.push(record.command);
-	if (Array.isArray(record.commands)) {
-		for (const c of record.commands) {
-			if (typeof c === "string") commands.push(c);
-		}
-	}
-	return commands;
-}
-
-export function normalize(cmd: string): string {
-	return cmd.replace(/\s+/g, " ");
+	if (typeof record?.filePath === "string") return record.filePath;
+	if (typeof record?.path === "string") return record.path;
+	return undefined;
 }
 
-export function decodeShellEscapes(text: string): string {
-	return text
-		// ANSI-C quoting wrapper: $'...' -> ...
-		.replace(/\$'([^']*)'/g, "$1")
-		// Hex escapes: \xHH
-		.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-		// Unicode escapes: \uHHHH
-		.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-		// Octal escapes: \0OO or \OOO (e.g. \162 -> 'r')
-		.replace(/\\([0-3][0-7]{2})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)))
-		// Single character escapes: \c -> c (e.g. \r\m -> rm)
-		.replace(/\\(.)/g, "$1");
+export function extractTargetPath(input: unknown): string | undefined {
+	return extractRecordTargetPath(input) ?? (typeof input === "string" ? input : undefined);
 }
 
-export function shellWords(command: string): string[] {
-	const words: string[] = [];
-	let word = "";
-	let quote: "'" | '"' | undefined;
-	let escaped = false;
-	let started = false;
-	for (const char of command) {
-		if (escaped) {
-			word += char;
-			escaped = false;
-			started = true;
-			continue;
-		}
-		if (char === "\\" && quote !== "'") {
-			escaped = true;
-			started = true;
-			continue;
-		}
-		if (char === "'" || char === '"') {
-			if (!quote) quote = char;
-			else if (quote === char) quote = undefined;
-			else word += char;
-			started = true;
-			continue;
-		}
-		if (!quote && /\s/.test(char)) {
-			if (started) words.push(word);
-			word = "";
-			started = false;
-			continue;
-		}
-		word += char;
-		started = true;
-	}
-	if (escaped) word += "\\";
-	if (started) words.push(word);
-	return words;
-}
+export const SENSITIVE_ENV_KEYS = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_KEY", "KUBECONFIG", "NPM_TOKEN", "DOCKER_AUTH", "GOOGLE_APPLICATION_CREDENTIALS", "GCLOUD_AUTH", "AZURE_CREDENTIALS", "SLACK_TOKEN"];
+export const SENSITIVE_ENV_RE = /^(AWS_|KUBE|OPENAI|ANTHROPIC|GOOGLE_|GCP_|AZURE_|SLACK_|NPM_|DOCKER_|KUBECONFIG)/;
 
-export function splitShellSegments(command: string): string[] {
-	const segments: string[] = [];
-	let current = "";
-	let quote: "'" | '"' | undefined;
-	let escaped = false;
-	for (const char of command) {
-		if (escaped) {
-			current += char;
-			escaped = false;
-			continue;
-		}
-		if (char === "\\" && quote !== "'") {
-			current += char;
-			escaped = true;
-			continue;
-		}
-		if (char === "'" || char === '"') {
-			if (!quote) quote = char;
-			else if (quote === char) quote = undefined;
-			current += char;
-			continue;
-		}
-		if (!quote && /[\n|;&]/.test(char)) {
-			if (current.trim()) segments.push(current.trim());
-			current = "";
-			continue;
-		}
-		current += char;
-	}
-	if (current.trim()) segments.push(current.trim());
-	return segments;
+export function isSensitiveEnvKey(key: string): boolean {
+	return SENSITIVE_ENV_KEYS.includes(key) || SENSITIVE_ENV_RE.test(key);
 }
 
-export function unwrapShellWords(command: string): string[] {
-	let cleanCmd = decodeShellEscapes(command.trim());
-	// Strip outer grouping parentheses/braces if present e.g. ( git commit ) or { git commit; }
-	while (
-		(cleanCmd.startsWith("(") && cleanCmd.endsWith(")")) ||
-		(cleanCmd.startsWith("{") && cleanCmd.endsWith("}"))
-	) {
-		cleanCmd = cleanCmd.slice(1, -1).trim();
-		if (cleanCmd.endsWith(";")) cleanCmd = cleanCmd.slice(0, -1).trim();
-	}
-
-	const words = shellWords(cleanCmd);
-	let i = 0;
-	while (i < words.length) {
-		const rawWord = words[i]!;
-		const word = rawWord.replace(/^[\({]+/, "").replace(/[\)};]+$/, "");
-		if (!word) {
-			i++;
-			continue;
-		}
-
-		if (word === "command" || word === "exec" || word === "eval" || word === "nohup") {
-			i++;
-			continue;
-		}
-		if (word === "nice") {
-			i++;
-			if (i < words.length && (words[i] === "-n" || words[i]?.startsWith("-n"))) {
-				if (words[i] === "-n") i += 2;
-				else i++;
-			}
-			continue;
-		}
-		if (word === "timeout") {
-			i++;
-			while (i < words.length && words[i]!.startsWith("-")) {
-				const opt = words[i++]!;
-				if ((opt === "-k" || opt === "-s" || opt === "--signal" || opt === "--kill-after") && i < words.length) {
-					i++;
-				}
-			}
-			if (i < words.length && /^\d+[smhd]?$/.test(words[i]!)) {
-				i++;
-			}
-			continue;
-		}
-		if (word === "stdbuf") {
-			i++;
-			while (i < words.length && words[i]!.startsWith("-")) {
-				const opt = words[i++]!;
-				if ((opt === "-i" || opt === "-o" || opt === "-e") && i < words.length) {
-					i++;
-				}
-			}
-			continue;
-		}
-		if (word === "time") {
-			i++;
-			while (i < words.length && words[i]!.startsWith("-")) {
-				i++;
-			}
-			continue;
-		}
-		if (word === "sudo" || word === "doas") {
-			i++;
-			const valueOptions = new Set([
-				"-u",
-				"--user",
-				"-g",
-				"--group",
-				"-h",
-				"--host",
-				"-p",
-				"--prompt",
-				"-C",
-				"--close-from",
-				"-R",
-				"--chroot",
-				"-D",
-				"--chdir",
-			]);
-			while (i < words.length && words[i]!.startsWith("-")) {
-				const option = words[i++]!;
-				if (valueOptions.has(option) && i < words.length) i++;
-			}
-			continue;
-		}
-		if (word === "env") {
-			i++;
-			const valueOptions = new Set([
-				"-u",
-				"--unset",
-				"-C",
-				"--chdir",
-				"-S",
-				"--split-string",
-			]);
-			while (i < words.length) {
-				const w = words[i]!;
-				if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w)) {
-					i++;
-					continue;
-				}
-				if (!w.startsWith("-")) break;
-				i++;
-				if (valueOptions.has(w) && i < words.length) i++;
-			}
-			continue;
-		}
-		if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
-			i++;
-			continue;
-		}
-		break;
-	}
-	return words
-		.slice(i)
-		.map((w) => w.replace(/^[\({]+/, "").replace(/[\)};]+$/, ""))
-		.filter(Boolean);
-}
-
-export function unwrapShellCommand(command: string): string {
-	return unwrapShellWords(command).join(" ");
-}
-
-export const SENSITIVE_ENV_KEYS = [
-	"OPENAI_API_KEY",
-	"ANTHROPIC_API_KEY",
-	"OPENAI_KEY",
-	"KUBECONFIG",
-	"NPM_TOKEN",
-	"DOCKER_AUTH",
-	"GOOGLE_APPLICATION_CREDENTIALS",
-	"GCLOUD_AUTH",
-	"AZURE_CREDENTIALS",
-	"SLACK_TOKEN",
-];
-export const SENSITIVE_ENV_RE =
-	/^(AWS_|KUBE|OPENAI|ANTHROPIC|GOOGLE_|GCP_|AZURE_|SLACK_|NPM_|DOCKER_|KUBECONFIG)/;
-
 export function getCleanEnv(): Record<string, string> {
 	const env: Record<string, string> = { ...(process.env as Record<string, string>) };
-	for (const key of SENSITIVE_ENV_KEYS) {
-		delete env[key];
-	}
 	for (const key of Object.keys(env)) {
-		if (SENSITIVE_ENV_RE.test(key)) {
-			delete env[key];
-		}
+		if (isSensitiveEnvKey(key)) delete env[key];
 	}
 	return env;
 }
@@ -271,12 +34,6 @@ export function getCleanEnv(): Record<string, string> {
 export async function showBlockToast(message: string): Promise<void> {
 	try {
 		const client = getSdkClient();
-		await client?.tui?.showToast?.({
-			body: {
-				title: "Workflow Guard Blocked",
-				message: message.slice(0, 180),
-				variant: "warning",
-			},
-		});
+		await client?.tui?.showToast?.({ body: { title: "Workflow Guard Blocked", message: message.slice(0, 180), variant: "warning" } });
 	} catch {}
 }

package/src/lib/verify.ts

@@ -2,7 +2,8 @@ import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
-import { getCleanEnv, normalize } from "./utils.ts";
+import { dynamicShellSyntaxIn, normalize } from "./shell.ts";
+import { getCleanEnv } from "./utils.ts";
 import { getProjectConfig } from "./state.ts";
 import { normalizeGitCommands } from "../policies/git.ts";
 import { liveMutationIn } from "../policies/destructive.ts";
@@ -163,6 +164,14 @@ export async function runVerify(
 	const allowLive = process.env.WORKFLOW_GUARD_ALLOW_LIVE === "1";
 
 	if (!allowLive) {
+		const dynamicSyntax = dynamicShellSyntaxIn(command);
+		if (dynamicSyntax) {
+			return {
+				passed: false,
+				output: `Verification command blocked: contains ${dynamicSyntax}`,
+				durationMs: 0,
+			};
+		}
 		const normalized = normalizeGitCommands(normalize(command));
 		const liveCheck = liveMutationIn(normalized);
 		if (liveCheck) {
@@ -184,11 +193,13 @@ export async function runVerify(
 	return new Promise((resolve) => {
 		let output = "";
 		let timer: NodeJS.Timeout | undefined;
+		let timedOut = false;
 		let child: ReturnType<typeof spawn>;
 		try {
 			child = spawn(command, {
 				cwd: root,
 				shell: true,
+				detached: process.platform !== "win32",
 				env: getCleanEnv(),
 				stdio: ["ignore", "pipe", "pipe"],
 			});
@@ -201,13 +212,13 @@ export async function runVerify(
 		}
 
 		timer = setTimeout(() => {
-			try {
-				child.kill("SIGKILL");
-			} catch {}
-			resolve({
-				passed: false,
-				output: output + `\n(Verification timed out after ${Math.round(timeoutMs / 1000)}s)`,
-				durationMs: Date.now() - start,
+			timedOut = true;
+			void terminateProcessTree(child.pid, () => child.kill("SIGKILL")).finally(() => {
+				resolve({
+					passed: false,
+					output: output + `\n(Verification timed out after ${Math.round(timeoutMs / 1000)}s)`,
+					durationMs: Date.now() - start,
+				});
 			});
 		}, timeoutMs);
 
@@ -221,11 +232,61 @@ export async function runVerify(
 		});
 		child.on("close", (code) => {
 			if (timer) clearTimeout(timer);
+			if (timedOut) return;
 			resolve({ passed: code === 0, output, durationMs: Date.now() - start });
 		});
 		child.on("error", (err) => {
 			if (timer) clearTimeout(timer);
+			if (timedOut) return;
 			resolve({ passed: false, output: `(spawn failed: ${err.message})`, durationMs: Date.now() - start });
 		});
 	});
 }
+
+type WindowsTreeKiller = (pid: number) => Promise<void>;
+
+function killWindowsProcessTree(pid: number): Promise<void> {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let killer: ReturnType<typeof spawn> | undefined;
+		const finish = (err?: Error) => {
+			if (!settled) {
+				settled = true;
+				clearTimeout(cleanupTimer);
+				err ? reject(err) : resolve();
+			}
+		};
+		const cleanupTimer = setTimeout(() => {
+			try { killer?.kill("SIGKILL"); } catch {}
+			finish(new Error("taskkill timed out"));
+		}, 5_000);
+		try {
+			killer = spawn("taskkill", ["/pid", String(pid), "/t", "/f"], { stdio: "ignore" });
+			killer.once("close", (code) => finish(code === 0 ? undefined : new Error(`taskkill exited ${code}`)));
+			killer.once("error", (err) => finish(err));
+		} catch (err) {
+			finish(err instanceof Error ? err : new Error("taskkill failed"));
+		}
+	});
+}
+
+export async function terminateProcessTree(
+	pid: number | undefined,
+	fallbackKill: () => void,
+	platform: NodeJS.Platform = process.platform,
+	windowsTreeKiller: WindowsTreeKiller = killWindowsProcessTree,
+): Promise<void> {
+	try {
+		if (platform === "win32" && pid) {
+			await windowsTreeKiller(pid);
+		} else if (pid) {
+			process.kill(-pid, "SIGKILL");
+		} else {
+			fallbackKill();
+		}
+	} catch {
+		try {
+			fallbackKill();
+		} catch {}
+	}
+}

package/src/policies/boundary.ts

@@ -7,7 +7,7 @@ import {
 	getWorkspaceRootReal,
 	recordMutation,
 } from "../lib/state.ts";
-import { shellWords, unwrapShellCommand } from "../lib/utils.ts";
+import { shellWords, unwrapShellCommand } from "../lib/shell.ts";
 import { isProtectedPath, PROTECTED_PATH_REASON } from "./tamper.ts";
 import { isSecretPath, secretIn } from "./secrets.ts";
 import { onProtectedBranch, branchGuardReason } from "./git.ts";
@@ -91,7 +91,7 @@ export function isPathOutsideWorkspace(targetPath: string, root: string): boolea
 export function extractPatchPaths(patchText: string): string[] {
 	const paths: string[] = [];
 	const markerRe =
-		/^\*\*\*\s+(?:Add File|Update File|Delete File|Move to|Move from):\s*(\S+)/gm;
+		/^\*\*\*\s+(?:Add File|Update File|Delete File|Move to|Move from):\s*(.+?)\s*$/gm;
 	let match: RegExpExecArray | null;
 	while ((match = markerRe.exec(patchText)) !== null) {
 		if (match[1]) paths.push(match[1]);

package/src/policies/changelog.ts

@@ -1,10 +1,10 @@
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { isAbsolute, resolve } from "node:path";
 import { getWorkspaceRoot } from "../lib/state.ts";
-import { splitShellSegments, unwrapShellCommand } from "../lib/utils.ts";
+import { splitShellSegments, unwrapShellCommand, unwrapShellWords } from "../lib/shell.ts";
 
-export const CHANGELOG_SECTION_RE = /^\s*(?:#{1,6}\s*)?changelog\s*(?::|$)/im;
+export const CHANGELOG_SECTION_RE = /^\s*(?:#{1,6}\s*)?(?:changelog|changes|release notes?|summary)\s*(?::\s*\S.+|:?\s*\r?\n\s*(?![\\#])\S.+)/im;
 
 export function hasPrCreateInvocation(command: string): boolean {
 	return splitShellSegments(command)
@@ -20,6 +20,84 @@ export function hasPrCreateInvocation(command: string): boolean {
 // Accepts either a CHANGELOG file modification or a .changeset/*.md file.
 const CHANGELOG_OR_CHANGESET_RE = /(?:changelog|\.changeset\/[^/]+\.md$)/i;
 
+function decodeAnsiCLineBreaks(value: string): string {
+	let decoded = "";
+	for (let i = 0; i < value.length; i += 1) {
+		if (value[i] !== "\\" || i + 1 >= value.length) {
+			decoded += value[i];
+			continue;
+		}
+		const next = value[++i];
+		if (next === "n") decoded += "\n";
+		else if (next === "r") decoded += "\r";
+		else if (next === "\\") decoded += "\\";
+		else decoded += `\\${next}`;
+	}
+	return decoded;
+}
+
+function preserveAnsiCLineBreaks(command: string): string {
+	return command.replace(/\$'((?:\\.|[^'])*)'/g, (_match, value: string) => {
+		const decoded = decodeAnsiCLineBreaks(value).replace(/'/g, "'\\''");
+		return `'${decoded}'`;
+	});
+}
+
+function prShellWords(command: string): string[] {
+	const words: string[] = [];
+	let word = "";
+	let quote: "'" | '"' | "ansi" | undefined;
+	let started = false;
+	for (let i = 0; i < command.length; i += 1) {
+		const char = command[i]!;
+		if (!quote && char === "$" && command[i + 1] === "'") {
+			quote = "ansi";
+			started = true;
+			i += 1;
+			continue;
+		}
+		if (quote === "ansi") {
+			if (char === "'") {
+				quote = undefined;
+				continue;
+			}
+			if (char === "\\" && i + 1 < command.length) {
+				let escape = char + command[++i];
+				word += decodeAnsiCLineBreaks(escape);
+				continue;
+			}
+			word += char;
+			continue;
+		}
+		if (char === "'" || char === '"') {
+			if (!quote) quote = char;
+			else if (quote === char) quote = undefined;
+			else word += char;
+			started = true;
+			continue;
+		}
+		if (char === "\\" && quote !== "'") {
+			const next = command[++i];
+			if (next !== "\n") {
+				if (quote === '"' && next && !['$', '`', '"', '\\'].includes(next)) word += "\\";
+				word += next ?? "\\";
+			}
+			started = true;
+			continue;
+		}
+		if (!quote && /\s/.test(char)) {
+			if (started) words.push(word);
+			word = "";
+			started = false;
+			continue;
+		}
+		word += char;
+		started = true;
+	}
+	if (started) words.push(word);
+	return words;
+}
+
 export function branchHasChangelogChange(root: string): boolean {
 	try {
 		const baseCandidates = ["origin/HEAD", "origin/main", "origin/master"];
@@ -54,23 +132,44 @@ export function branchHasChangelogChange(root: string): boolean {
 	}
 }
 
-export function prBodyIncludesChangelog(command: string): boolean {
-	const bodyMatch = command.match(
-		/(?:--body|--description|-d|-b)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s|;&]+))/,
-	);
-	const body = bodyMatch?.[1] ?? bodyMatch?.[2] ?? bodyMatch?.[3] ?? "";
-	if (CHANGELOG_SECTION_RE.test(body)) {
-		return true;
+export function prBodyIncludesChangelog(command: string, invocationRoot: string | null = getWorkspaceRoot()): boolean {
+	const parsedWords = prShellWords(command);
+	const envIndex = parsedWords.indexOf("env");
+	const usesEnvSplitString = envIndex >= 0 && parsedWords.slice(envIndex + 1).some((word) =>
+		word === "-S" || word.startsWith("-S") || word === "--split-string" || word.startsWith("--split-string="));
+	const commandWords = usesEnvSplitString
+		? unwrapShellWords(preserveAnsiCLineBreaks(command))
+		: parsedWords;
+	const cliIndex = commandWords.findIndex((word) => word === "gh" || word === "az");
+	const words = cliIndex >= 0 ? commandWords.slice(cliIndex) : [];
+	let body = "";
+	let bodyFile: string | undefined;
+	const valueOptions = new Set([
+		"--assignee", "--base", "--head", "--head-repo", "--label", "--milestone",
+		"--project", "--recover", "--reviewer", "--template", "--title",
+		"--bypass-policy-reason", "--labels", "--merge-commit-message", "--org",
+		"--repository", "--required-reviewer-ids", "--reviewer-ids", "--source-branch",
+		"--target-branch", "--work-items", "-a", "-B", "-H", "-l", "-m", "-p", "-r", "-T", "-t",
+	]);
+	for (let i = 0; i < words.length; i += 1) {
+		const word = words[i]!;
+		if (["--description", "-d"].includes(word)) {
+			const lines: string[] = [];
+			while (i + 1 < words.length && !words[i + 1]!.startsWith("-")) lines.push(words[++i]!);
+			body = lines.join("\n");
+		}
+		else if (["--body", "-b"].includes(word)) body = words[++i] ?? "";
+		else if (/^(?:--body|--description)=/.test(word)) body = word.slice(word.indexOf("=") + 1);
+		else if (["--body-file", "--description-file", "-F"].includes(word)) bodyFile = words[++i];
+		else if (/^(?:--body-file|--description-file)=/.test(word)) bodyFile = word.slice(word.indexOf("=") + 1);
+		else if (valueOptions.has(word)) i += 1;
 	}
-	const bodyFileMatch = command.match(
-		/(?:--body-file|--description-file|-F)(?:=|\s+)(?:"([^"]*)"|'([^']*)'|([^\s|;&]+))/,
-	);
-	const bodyFile =
-		bodyFileMatch?.[1] ?? bodyFileMatch?.[2] ?? bodyFileMatch?.[3];
+	if (CHANGELOG_SECTION_RE.test(body)) return true;
 	if (bodyFile) {
 		try {
+			if (!isAbsolute(bodyFile) && invocationRoot === null) return false;
 			return CHANGELOG_SECTION_RE.test(
-				readFileSync(resolve(getWorkspaceRoot(), bodyFile), "utf8"),
+				readFileSync(isAbsolute(bodyFile) ? bodyFile : resolve(invocationRoot!, bodyFile), "utf8"),
 			);
 		} catch {
 			return false;