opencode-workflow-guard 1.7.2 → 1.8.1

package/README.md

@@ -1,10 +1,12 @@
-# opencode-workflow-guard
+# OpenCode Workflow Guard
 
 [![npm](https://img.shields.io/npm/v/opencode-workflow-guard.svg)](https://www.npmjs.com/package/opencode-workflow-guard)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Tests](https://img.shields.io/badge/tests-415%2B%20passing-brightgreen.svg)](test/test.mts)
 
-OpenCode plugin enforcing workflow discipline, agent focus, and deterministic safety boundaries through **hard plugin hooks**, not prompt instructions that LLMs can ignore.
+Deterministic policy and enforcement layer for OpenCode. Workflow Guard enforces workflow and safety invariants through **hard plugin hooks**, not prompt instructions that LLMs can ignore.
+
+Workflow Guard is deliberately **not an agent harness**: it can constrain actions, record and explain decisions, and supply bounded context, but it does not plan, prioritize, delegate, or autonomously sequence the agent's work. Bounded continuation may resume an existing session with unfinished owned todos; it never chooses the next task or creates new work.
 
 ---
 
@@ -12,26 +14,18 @@ OpenCode plugin enforcing workflow discipline, agent focus, and deterministic sa
 
 ### 1. Installation
 
-Run the setup command to register both the server guard and TUI companion globally:
+Install the current published version globally with OpenCode's plugin installer:
 
 ```bash
-npx opencode-workflow-guard setup
+VERSION=$(npm view opencode-workflow-guard version)
+opencode plugin "opencode-workflow-guard@$VERSION" --global --force
 ```
 
-For server-only setup, add the package to your project's `opencode.json` or global `~/.config/opencode/opencode.json`:
-
-```json
-{
-  "$schema": "https://opencode.ai/config.json",
-  "plugin": [
-    "opencode-workflow-guard"
-  ]
-}
-```
+*Requires OpenCode >= 1.18.* OpenCode detects the package's server and TUI targets and updates both global configs. Use the same command after a release to upgrade; the explicit version gives OpenCode a fresh package-cache key. Restart OpenCode after installation. See [docs/installation.md](docs/installation.md) for details and links to the OpenCode plugin documentation.
 
-*Requires OpenCode >= 1.18.* Restart OpenCode after setup. See [docs/installation.md](docs/installation.md) for full setup options.
+For the optional TUI badge, configure `"opencode-workflow-guard"` in `tui.json`. OpenCode resolves the package's exported `./tui` entrypoint automatically for TUI plugins. The companion shows a `Workflow Guard` shield in the prompt bar and reflects blocked state without changing agent behavior. Do not place the TUI module under the server `plugins/` directory.
 
-For the optional TUI badge, configure `"opencode-workflow-guard"` in `tui.json`. OpenCode resolves the package's exported `./tui` entrypoint automatically for TUI plugins. Do not place the TUI module under the server `plugins/` directory.
+![Workflow Guard status badge in the OpenCode TUI](docs/assets/workflow-guard-tui-badge.png)
 
 ### 2. Verification
 
@@ -71,70 +65,6 @@ For complete policy specifications and override rules, see [docs/policies.md](do
 
 ---
 
-## Custom Tools Registered in OpenCode
-
-| Tool | Purpose |
-|---|---|
-| `guard_next_tasks` | Load `TODO.md`, or fall back to repository roadmap/plan/task Markdown when deciding what to work on next |
-| `guard_status` | Inspect active guardrails, current branch protection, and verification/review status |
-| `guard_why` | Simulate and explain whether a specific tool call or command would be blocked |
-| `guard_audit` | View recent audit log entries recorded in `workflow-guard.jsonl` |
-| `guard_review_rubric` | Generate the 5-axis secondary review rubric for the current branch diff |
-| `record_review` | Record a secondary reviewer subagent's verdict evaluated against the review rubric |
-| `guard_review_followups` | List durable local P2/P3 review findings that remain open across sessions |
-| `guard_review_followup_resolve` | Resolve a durable review finding after its underlying issue is fixed and verified |
-| `guard_worktree_create` | Create an isolated git worktree directory for concurrent subagent execution |
-| `guard_worktree_cleanup` | Snapshot-commit remaining changes and remove an isolated worktree directory |
-| `learning_profile` | Inspect the evidence-based local learner profile (when learning mode is enabled) |
-| `learning_checkpoint` | Rank high-value Socratic opportunities while respecting the session intervention budget |
-| `learning_record` | Persist concise evidence observed during a real learning interaction |
-| `project_memory_search` | Search current durable project knowledge in the local index |
-| `project_memory_record` | Record a durable fact, decision, constraint, or lesson with provenance |
-| `project_memory_export` | Explicitly promote selected records to repo-local human-readable JSONL |
-| `project_memory_import` | Import promoted repo-local knowledge into the local index |
-
-### Experimental Socratic Learning
-
-Learning mode is opt-in and advisory: it never blocks tool calls or weakens deterministic guardrails. Enable it with `learning: true` in `.opencode/workflow-guard.json[c]` or through `/guard-options`; `WORKFLOW_GUARD_LEARNING=1` in the user environment also enables it regardless of project configuration. `maxLearningInterventions` defaults to 3 per session and can be set to `0` to suppress checkpoints.
-
-The learner profile is global to the local user and follows the XDG data convention: `$XDG_DATA_HOME/opencode/workflow-guard/learner-profile.json`, or `~/.local/share/opencode/workflow-guard/learner-profile.json` when `XDG_DATA_HOME` is unset. It stores distilled concept evidence, session/project provenance, and progression (`exposed` through `critique`), not conversation transcripts or numeric grades. Unobserved concepts remain unknown rather than being labeled knowledge gaps. Back up or delete this file independently from project repositories as desired.
-
-### Project Memory
-
-Project memory keeps durable working knowledge between sessions without treating conversation history as project truth. It is enabled by default and can be disabled with `projectMemory: false` or through `/guard-options`. Facts, decisions, constraints, and lessons are stored in a local SQLite/FTS5 index under `$XDG_DATA_HOME/opencode/workflow-guard/project-memory/`, or `~/.local/share/opencode/workflow-guard/project-memory/` when `XDG_DATA_HOME` is unset. Git repositories are identified from their common Git directory, so linked worktrees share the same local project index.
-
-The local index is private working memory. Nothing from it is committed automatically. `project_memory_export` promotes only the explicitly selected current record IDs to `.opencode/memory/project-memory.jsonl`, a human-readable portable representation that another clone can import. The plugin adds `.opencode/memory/` to the clone-local `.git/info/exclude` by default; teams that deliberately want to version promoted knowledge can remove that exclusion or force-add the JSONL file. SQLite databases themselves should not be committed.
-
-Memory is supporting context, not authority. Superseded records are excluded from normal retrieval, recording and plugin imports reject content recognized by Workflow Guard's secret detector, and compaction injects at most eight recent current local records. Portable repository records are never injected automatically; they are available through explicit memory search after import. A local record tied to repository paths and a Git commit is omitted from compaction when those paths have committed, staged, or unstaged changes after that commit. Always prefer current repository state when it conflicts with historical memory.
-
----
-
-## Repository Tree
-
-```
-opencode-workflow-guard/
-├── src/                       # Production plugin sources
-│   ├── workflow-guard.ts      # Server plugin entrypoint (hook orchestrator & public exports)
-│   ├── workflow-guard-ui.ts   # Optional TUI companion prompt badge
-│   ├── policies/              # Modular policy implementations (task gate, git, secrets, boundary, ...)
-│   └── lib/                   # Engine services (state, verify, audit, review, worktree, utils, types)
-├── test/                      # Test suites
-│   ├── test.mts               # 415+ in-memory unit & adversarial tests
-│   └── test-e2e.mts           # npm tarball resolution + live runtime OpenCode loader tests
-├── docs/                      # In-depth documentation & guides
-│   ├── policies.md            # Complete 24-policy reference & overrides
-│   ├── installation.md        # Setup options, worktrees & permissions
-│   ├── troubleshooting.md     # Error diagnosis & bypass explanations
-│   └── testing.md             # Test architecture & coverage matrix
-├── .changeset/                # Fragment-based versioning & release changelogs
-├── ACKNOWLEDGEMENTS.md        # Open-source community credits & inspirations
-├── CONTRIBUTING.md            # Development guide, test patterns & PR rules
-├── CHANGELOG.md               # Version history
-└── SECURITY.md                # Vulnerability disclosure policy
-```
-
----
-
 ## License
 
 [MIT](LICENSE)

package/bin/opencode-workflow-guard.mjs

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { parse, modify, applyEdits } from "jsonc-parser";
 
-const SERVER_SPEC = "opencode-workflow-guard";
-const TUI_SPEC = "opencode-workflow-guard";
+const PACKAGE_NAME = "opencode-workflow-guard";
+const PACKAGE_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+const SERVER_SPEC = `${PACKAGE_NAME}@${PACKAGE_VERSION}`;
+const TUI_SPEC = SERVER_SPEC;
 const LEGACY_TUI_SPEC = "opencode-workflow-guard/tui";
 
 function configHome() {
@@ -16,9 +18,19 @@ function configHome() {
 function existingConfig(base, name) {
 	const json = join(base, name + ".json");
 	const jsonc = join(base, name + ".jsonc");
+	if (existsSync(json) && existsSync(jsonc)) throw new Error(`Cannot choose between both ${json} and ${jsonc}; remove the unused config first.`);
 	return existsSync(json) ? json : existsSync(jsonc) ? jsonc : json;
 }
 
+function restoreConfig(path, previous) {
+	if (previous === undefined) rmSync(path, { force: true });
+	else writeFileSync(path, previous);
+}
+
+function matchesPackageSpec(entry, spec) {
+	const value = Array.isArray(entry) ? entry[0] : entry;
+	return typeof value === "string" && (value === spec || value.startsWith(`${spec}@`));
+}
 function preparePluginUpdate(path, schema, spec, legacySpec) {
 	const source = existsSync(path) ? readFileSync(path, "utf8") : `{
   "$schema": "${schema}"
@@ -32,17 +44,18 @@ function preparePluginUpdate(path, schema, spec, legacySpec) {
 		throw new Error(`Cannot update ${path}: "plugin" must be an array`);
 	}
 	const plugins = config.plugin ?? [];
-	const matches = (entry, target) => entry === target || (Array.isArray(entry) && entry[0] === target);
-	if (!legacySpec) {
-		if (plugins.some((entry) => matches(entry, spec))) return undefined;
-		return applyEdits(source, modify(source, ["plugin", plugins.length], spec, {
+	const hasSpec = plugins.some((entry) => matchesPackageSpec(entry, PACKAGE_NAME));
+	const updatedPlugins = legacySpec
+		? plugins.filter((entry) => !matchesPackageSpec(entry, legacySpec))
+		: plugins;
+	if (updatedPlugins.length !== plugins.length) {
+		if (!hasSpec) updatedPlugins.push(spec);
+		return applyEdits(source, modify(source, ["plugin"], updatedPlugins, {
 			formattingOptions: { insertSpaces: true, tabSize: 2 },
 		}));
 	}
-	const updatedPlugins = plugins.filter((entry) => !matches(entry, legacySpec));
-	if (!updatedPlugins.some((entry) => matches(entry, spec))) updatedPlugins.push(spec);
-	if (updatedPlugins.length === plugins.length && updatedPlugins.every((entry, index) => entry === plugins[index])) return undefined;
-	return applyEdits(source, modify(source, ["plugin"], updatedPlugins, {
+	if (hasSpec) return undefined;
+	return applyEdits(source, modify(source, ["plugin", plugins.length], spec, {
 		formattingOptions: { insertSpaces: true, tabSize: 2 },
 	}));
 }
@@ -57,9 +70,21 @@ if (process.argv[2] !== "setup" || process.argv.length > 3) {
 		const tuiPath = existingConfig(base, "tui");
 		const serverUpdate = preparePluginUpdate(serverPath, "https://opencode.ai/config.json", SERVER_SPEC);
 		const tuiUpdate = preparePluginUpdate(tuiPath, "https://opencode.ai/tui.json", TUI_SPEC, LEGACY_TUI_SPEC);
+		const serverBefore = existsSync(serverPath) ? readFileSync(serverPath, "utf8") : undefined;
+		const tuiBefore = existsSync(tuiPath) ? readFileSync(tuiPath, "utf8") : undefined;
 		mkdirSync(base, { recursive: true });
-		if (serverUpdate !== undefined) writeFileSync(serverPath, serverUpdate);
-		if (tuiUpdate !== undefined) writeFileSync(tuiPath, tuiUpdate);
+		try {
+			if (serverUpdate !== undefined) writeFileSync(serverPath, serverUpdate);
+			if (tuiUpdate !== undefined) writeFileSync(tuiPath, tuiUpdate);
+		} catch (error) {
+			try {
+				restoreConfig(serverPath, serverBefore);
+				restoreConfig(tuiPath, tuiBefore);
+			} catch (rollbackError) {
+				throw new Error(`Setup failed and config rollback also failed: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`, { cause: error });
+			}
+			throw error;
+		}
 		console.log(`Workflow Guard configured in ${serverPath} and ${tuiPath}.`);
 		console.log("Restart OpenCode to load both plugins.");
 	} catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.7.2",
-  "description": "OpenCode plugin enforcing workflow discipline through deterministic tool.execute.before hooks",
+  "version": "1.8.1",
+  "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",
   "main": "src/workflow-guard.ts",

package/src/lib/checkpoint.ts

@@ -88,11 +88,50 @@ function withStoreLock<T>(workspace: string, action: () => T): T {
 	const path = metadataPath(workspace);
 	mkdirSync(dirname(path), { recursive: true });
 	const lockPath = `${path}.lock`;
+	const reclaimPath = `${lockPath}.reclaim`;
 	let lock: number;
 	try {
 		lock = openSync(lockPath, "wx", 0o600);
 	} catch {
-		throw new Error("Recovery checkpoint metadata is busy; refusing an unsafe concurrent update.");
+		let reclaim: number;
+		try {
+			reclaim = openSync(reclaimPath, "wx", 0o600);
+		} catch {
+			let staleReclaim = false;
+			try {
+				const owner = Number(readFileSync(reclaimPath, "utf8").trim());
+				if (Number.isInteger(owner) && owner > 0) {
+					try { process.kill(owner, 0); } catch (error) {
+						if ((error as NodeJS.ErrnoException).code === "ESRCH") staleReclaim = true;
+					}
+				}
+			} catch {}
+			if (!staleReclaim) throw new Error("Recovery checkpoint metadata is busy; refusing an unsafe concurrent update.");
+			try {
+				unlinkSync(reclaimPath);
+				reclaim = openSync(reclaimPath, "wx", 0o600);
+			} catch {
+				throw new Error("Recovery checkpoint metadata is busy; refusing an unsafe concurrent update.");
+			}
+		}
+		try {
+			writeFileSync(reclaim, String(process.pid));
+			let stale = false;
+			try {
+				const owner = Number(readFileSync(lockPath, "utf8").trim());
+				if (Number.isInteger(owner) && owner > 0) {
+					try { process.kill(owner, 0); } catch (error) {
+						if ((error as NodeJS.ErrnoException).code === "ESRCH") stale = true;
+					}
+				}
+			} catch {}
+			if (!stale) throw new Error("Recovery checkpoint metadata is busy; refusing an unsafe concurrent update.");
+			unlinkSync(lockPath);
+			lock = openSync(lockPath, "wx", 0o600);
+		} finally {
+			closeSync(reclaim);
+			try { unlinkSync(reclaimPath); } catch {}
+		}
 	}
 	try {
 		writeFileSync(lock, String(process.pid));

package/src/lib/guard-dispatcher.ts

@@ -90,7 +90,7 @@ export function isReadOnlyRole(agent?: string): boolean {
 
 function logBlock(message: string): void {
 	try {
-		void (getSdkClient() as any)?.app?.log?.({
+		void getSdkClient()?.app?.log?.({
 			body: {
 				service: "workflow-guard",
 				level: "warn",
@@ -140,7 +140,7 @@ export async function guardToolCallImpl(
 		const record = asRecord(input);
 		const rawTodos = record?.todos;
 		if (Array.isArray(rawTodos)) {
-			const newTodos = rawTodos as any[];
+			const newTodos = rawTodos;
 			const existingTodos = context?.sessionID ? await fetchSessionTodos(context.sessionID) : undefined;
 			const err = validateTodoLifecycle(newTodos, existingTodos);
 			if (err) {
@@ -341,7 +341,7 @@ export async function guardToolCallImpl(
 				return `Blocked: reading sensitive credential/secret file '${secretFile}' via shell is not permitted. Reference environment variables by name or inspect safe templates (e.g. .env.example) instead.`;
 			}
 		}
-		for (const payload of extractInterpreterPayload(command)) {
+		for (const payload of extractInterpreterPayload(raw)) {
 			const outsidePath = outsideWritePathInPayload(payload, currentRoot);
 			if (outsidePath) {
 				logBlock(`[workflow-guard] blocked interpreter payload writing outside workspace: ${outsidePath}`);

package/src/lib/tool-lifecycle.ts

@@ -56,8 +56,10 @@ export class ToolInvocationLifecycle {
 
 	clearSession(sessionID: string): void {
 		const prefix = `${sessionID}\0`;
-		for (const key of this.startedAt.keys()) {
-			if (key.startsWith(prefix)) this.startedAt.delete(key);
+		for (const map of [this.startedAt, this.readObservations, this.postEditSnapshots]) {
+			for (const key of map.keys()) {
+				if (key.startsWith(prefix)) map.delete(key);
+			}
 		}
 	}
 }

package/src/lib/tool-outcomes.ts

@@ -24,7 +24,6 @@ export interface ToolOutcome {
 export class ToolOutcomeTracker {
 	private readonly terminalCalls = new Map<string, Set<string>>();
 	private readonly failures = new Map<string, { signature: string; count: number }>();
-	private static readonly maxTerminalCallsPerSession = 1024;
 
 	record(part: ToolOutcomePart): ToolOutcome | undefined {
 		if (part.type !== "tool" || typeof part.sessionID !== "string" || typeof part.callID !== "string" || typeof part.tool !== "string") return undefined;
@@ -37,13 +36,10 @@ export class ToolOutcomeTracker {
 		}
 		if (terminalCalls.has(part.callID)) return undefined;
 		terminalCalls.add(part.callID);
-		if (terminalCalls.size > ToolOutcomeTracker.maxTerminalCallsPerSession) {
-			terminalCalls.delete(terminalCalls.values().next().value!);
-		}
 
 		const start = part.state?.time?.start;
 		const end = part.state?.time?.end;
-		const durationMs = typeof start === "number" && typeof end === "number" ? Math.max(0, end - start) : undefined;
+		const durationMs = typeof start === "number" && Number.isFinite(start) && typeof end === "number" && Number.isFinite(end) ? Math.max(0, end - start) : undefined;
 		if (status === "completed") {
 			this.failures.delete(part.sessionID);
 			return { sessionID: part.sessionID, callID: part.callID, tool: part.tool, status, durationMs };

package/src/lib/types.ts

@@ -4,6 +4,9 @@ export interface TodoItem {
 }
 
 export interface TodoSdkClient {
+	app?: {
+		log?: (opts: { body: { service: string; level: "debug" | "info" | "warn" | "error"; message: string } }) => Promise<unknown>;
+	};
 	session?: {
 		todo?: (opts: { path: { id: string } }) => Promise<{ data?: unknown }>;
 		get?: (opts: { path: { id: string } }) => Promise<{ data?: { parentID?: unknown } }>;

package/src/lib/verify.ts

@@ -203,10 +203,10 @@ export async function runVerify(
 				env: getCleanEnv(),
 				stdio: ["ignore", "pipe", "pipe"],
 			});
-		} catch (err: any) {
+		} catch (err: unknown) {
 			return resolve({
 				passed: false,
-				output: `(spawn failed: ${err?.message ?? "unknown error"})`,
+				output: `(spawn failed: ${err instanceof Error ? err.message : "unknown error"})`,
 				durationMs: Date.now() - start,
 			});
 		}

package/src/lib/worktree.ts

@@ -106,8 +106,8 @@ export function createGitWorktree(
 		}
 
 		return { success: true, worktreePath: targetPath };
-	} catch (e: any) {
-		return { success: false, error: e?.message ?? String(e) };
+	} catch (e: unknown) {
+		return { success: false, error: e instanceof Error ? e.message : String(e) };
 	}
 }
 
@@ -210,7 +210,7 @@ export function cleanupGitWorktree(
 		}
 
 		return { success: true };
-	} catch (e: any) {
-		return { success: false, error: e?.message ?? String(e) };
+	} catch (e: unknown) {
+		return { success: false, error: e instanceof Error ? e.message : String(e) };
 	}
 }

package/src/policies/boundary.ts

@@ -199,7 +199,7 @@ export function shellMutationIn(segment: string): ShellMutation | undefined {
 	return undefined;
 }
 
-const SIMPLE_MUTATION_COMMANDS = new Set(["touch", "mkdir", "rm", "unlink", "rmdir", "truncate"]);
+const SIMPLE_MUTATION_COMMANDS = new Set(["touch", "mkdir", "rm", "unlink", "rmdir", "truncate", "chmod", "chown", "chgrp"]);
 const TRANSFER_COMMANDS = new Set(["cp", "mv", "ln"]);
 
 export function simpleFilesystemMutations(segment: string): ShellMutation[] {

package/src/policies/destructive.ts

@@ -101,10 +101,15 @@ function normalizedKubectlCommands(command: string): string {
 	return normalized.join(" ; ");
 }
 
+function normalizedShellCommands(command: string): string {
+	return splitShellSegments(command).map((segment) => shellWords(segment).join(" ")).join(" ; ");
+}
+
 export function liveMutationIn(command: string): string | undefined {
-	const optionNormalized = `${normalizedKubectlCommands(command)} ; ${command.replace(/\b(terraform|tofu)\s+(?:(?:-chdir(?:=\S+|\s+\S+)|-(?:no-color|version))\s+)*/g, "$1 ")}`;
+	const shellNormalized = normalizedShellCommands(command);
+	const optionNormalized = `${normalizedKubectlCommands(command)} ; ${shellNormalized.replace(/\b(terraform|tofu)\s+(?:(?:-chdir(?:=\S+|\s+\S+)|-(?:no-color|version))\s+)*/g, "$1 ")}`;
 	for (const { re, what } of LIVE_MUTATION_PATTERNS) {
-		if (re.test(command) || re.test(optionNormalized)) {
+		if (re.test(command) || re.test(shellNormalized) || re.test(optionNormalized)) {
 			return what;
 		}
 	}

package/src/policies/git.ts

@@ -123,7 +123,7 @@ export function normalizeGitCommands(command: string): string {
 }
 
 export const GIT_WRITE_RE =
-	/\bgit\s+(commit|merge|rebase|cherry-pick|revert|stash\s+pop|apply|am|restore|reset|update-ref|filter-branch)\b|\bgit\s+branch\s+(?:[^|;&]*\s)?-[dDM]\b/;
+	/\bgit\s+(add|rm|mv|commit|merge|rebase|cherry-pick|revert|stash\s+pop|apply|am|restore|reset|update-ref|filter-branch)\b|\bgit\s+tag\s+(?!--?list\b|-l\b)|\bgit\s+checkout\s+(?!-b\b)|\bgit\s+branch\s+(?:[^|;&]*\s)?-[dDM]\b/;
 
 export function currentGitBranch(root: string): string | undefined {
 	const result = spawnSync("git", ["branch", "--show-current"], {

package/src/policies/interpreter.ts

@@ -9,6 +9,16 @@ export function extractInterpreterPayload(segment: string): string[] {
 	if (inlineMatch?.[1] || inlineMatch?.[2]) {
 		payloads.push(inlineMatch[1] ?? inlineMatch[2] ?? "");
 	}
+	const heredocHeader = segment.match(
+		/\b(?:python3?|node|perl|ruby|osascript|bash|sh|zsh|dash|ksh)\b[^\n]*<<(-?)\s*(?:'([^'\n]+)'|"([^"\n]+)"|([^\s'";|&()<>\n]+))[^\n]*\n/i,
+	);
+	if (heredocHeader) {
+		const delimiter = heredocHeader[2] ?? heredocHeader[3] ?? heredocHeader[4];
+		const bodyStart = (heredocHeader.index ?? 0) + heredocHeader[0].length;
+		const lines = segment.slice(bodyStart).split("\n");
+		const terminator = lines.findIndex((line) => (heredocHeader[1] ? line.replace(/^\t+/, "") : line) === delimiter);
+		if (terminator >= 0) payloads.push(lines.slice(0, terminator).join("\n"));
+	}
 	const psMatch = segment.match(
 		/\b(?:powershell|pwsh)\s+(?:-[a-zA-Z]*enc[a-zA-Z]*\s+)([A-Za-z0-9+/=]+)/i,
 	);
@@ -50,6 +60,8 @@ export function secretPathInPayload(payload: string): string | undefined {
 }
 
 const WRITE_TARGET_PATTERNS: RegExp[] = [
+	/\b(?:File|IO)\.(?:write|binwrite|delete|unlink|rename)\s*\(\s*["']([^"']+)["']/g,
+	/\bFile\.open\s*\(\s*["']([^"']+)["']\s*,\s*["'][^"']*[wa+][^"']*["']/g,
 	/\b(?:writeFileSync|writeFile|appendFile|appendFileSync|createWriteStream|unlink|unlinkSync|rmSync|rmdirSync|mkdirSync|renameSync|copyFileSync|cpSync|truncateSync)\s*\(\s*["']([^"']+)["']/g,
 	/\b(?:renameSync|copyFileSync|cpSync)\s*\(\s*["'][^"']+["']\s*,\s*["']([^"']+)["']/g,
 	/\b(?:os\.remove|os\.unlink|os\.rmdir|os\.mkdir|os\.makedirs|os\.rename|shutil\.rmtree|shutil\.copy|shutil\.copy2|shutil\.move)\s*\(\s*["']([^"']+)["']/g,

package/src/workflow-guard-ui.ts

@@ -1,4 +1,5 @@
 import type { TuiPlugin, TuiPluginModule } from "@opencode-ai/plugin/tui";
+import type { BaseRenderable } from "@opentui/core";
 import type { JSX } from "@opentui/solid";
 import { createElement, insert, setProp } from "@opentui/solid";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -32,7 +33,7 @@ function text(props: Record<string, unknown>, children: Child[]) {
 const BADGE_ACTIVE = "Workflow Guard 🛡️";
 let lastBlockedReason: string | undefined;
 const sessionBlockedReasons = new Map<string, string>();
-const badgeNodes = new Map<string, unknown>();
+const badgeNodes = new Map<string, BaseRenderable>();
 
 export function readProjectOption(root: string, option: "recoveryCheckpoints" | "projectMemory" | "learning"): boolean {
 	const path = projectConfigPath(root);
@@ -125,9 +126,9 @@ export const WorkflowGuardTui: TuiPlugin = async (api) => {
 	});
 
 	try {
-		api.event?.on?.("tui.toast.show" as any, (e: any) => {
-			const title = e?.properties?.title ?? e?.title;
-			const msg = e?.properties?.message ?? e?.message;
+		api.event.on("tui.toast.show", (e) => {
+			const title = e.properties.title;
+			const msg = e.properties.message;
 			if (title === "Workflow Guard Blocked" && typeof msg === "string") {
 				lastBlockedReason = msg;
 				const route = api.route.current;
@@ -140,8 +141,8 @@ export const WorkflowGuardTui: TuiPlugin = async (api) => {
 				const node = badgeNodes.get(key);
 				if (node) {
 					const badge = formatBadge(sessionID);
-					setProp(node as any, "content", badge.text);
-					setProp(node as any, "fg", badge.isBlocked ? api.theme.current.warning : api.theme.current.success);
+					setProp(node, "content", badge.text);
+					setProp(node, "fg", badge.isBlocked ? api.theme.current.warning : api.theme.current.success);
 				}
 			}
 		});
@@ -154,7 +155,7 @@ export const WorkflowGuardTui: TuiPlugin = async (api) => {
 				const theme = api.theme.current;
 				const badge = formatBadge();
 				const node = text({ fg: badge.isBlocked ? theme.warning : theme.success }, [badge.text]);
-				badgeNodes.set("home", node);
+				badgeNodes.set("home", node as unknown as BaseRenderable);
 				return node;
 			},
 			session_prompt_right() {
@@ -166,7 +167,7 @@ export const WorkflowGuardTui: TuiPlugin = async (api) => {
 						: undefined;
 				const badge = formatBadge(sessionID);
 				const node = text({ fg: badge.isBlocked ? theme.warning : theme.success }, [badge.text]);
-				if (sessionID) badgeNodes.set(sessionID, node);
+				if (sessionID) badgeNodes.set(sessionID, node as unknown as BaseRenderable);
 				return node;
 			},
 		},

package/src/workflow-guard.ts

@@ -19,13 +19,13 @@ import { ToolInvocationLifecycle } from "./lib/tool-lifecycle.ts";
 import { ToolOutcomeTracker, type ToolOutcomePart } from "./lib/tool-outcomes.ts";
 import { guardToolCallImpl, isReadOnlyRole } from "./lib/guard-dispatcher.ts";
 import { createCustomTools } from "./lib/custom-tools.ts";
+import type { TodoSdkClient } from "./lib/types.ts";
 export { isReadOnlyRole } from "./lib/guard-dispatcher.ts";
 export { extractReviewFollowups } from "./lib/custom-tools.ts";
 
 // ── Types ────────────────────────────────────────────────────────────────────
 export type {
 	TodoItem,
-	TodoSdkClient,
 	ProjectConfig,
 	VerifyResult,
 	ReviewResult,
@@ -36,6 +36,7 @@ export type {
 	LearningEvidence,
 	LearningOpportunity,
 } from "./lib/types.ts";
+export type { TodoSdkClient };
 
 // ── State & runtime context ──────────────────────────────────────────────────
 import {
@@ -281,7 +282,7 @@ export { checkInteractiveTtyCommand, checkPackageHygiene, sendDesktopNotificatio
 
 function logObservation(client: unknown, message: string): void {
 	try {
-		void (client as any)?.app?.log?.({
+		void (client as TodoSdkClient | undefined)?.app?.log?.({
 			body: { service: "workflow-guard", level: "info", message },
 		});
 	} catch {}
@@ -359,7 +360,7 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 	}
 
 	try {
-		await (ctx.client as any)?.app?.log?.({
+		await ctx.client.app.log({
 			body: {
 				service: "workflow-guard",
 				level: "info",
@@ -529,7 +530,7 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 					}
 					if (scrubbed.length > 0) {
 						try {
-							await (getSdkClient() as any)?.app?.log?.({
+							await getSdkClient()?.app?.log?.({
 								body: {
 									service: "workflow-guard",
 									level: "warn",
@@ -638,7 +639,6 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 			if (event?.type === "session.idle") {
 				const sessionID = (event.properties as { sessionID?: unknown })?.sessionID;
 				if (typeof sessionID === "string") {
-					toolOutcomes.clearSession(sessionID);
 					releaseFileClaims(sessionID);
 					clearReadFingerprints(sessionID);
 					toolLifecycle.clearSession(sessionID);