opencode-workflow-guard 1.8.2 → 1.8.3

package/README.md

@@ -33,7 +33,7 @@ For the optional TUI badge, configure `"opencode-workflow-guard"` in `tui.json`.
 npm run typecheck    # Strict TypeScript check (0 errors)
 npm test             # Run 415+ unit and adversarial tests
 npm run test:all     # Typecheck + unit + install/load checks
-WORKFLOW_GUARD_LIVE_E2E=1 npm run test:install # Also run model-driven OpenCode policy probes
+WORKFLOW_GUARD_LIVE_E2E=1 npm run test:install # Also run policy probes with OpenCode's most recently selected model
 ```
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/audit.ts

@@ -2,7 +2,7 @@ import { appendFileSync, chmodSync, existsSync, mkdirSync, openSync, readSync, c
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { DatabaseSync } from "node:sqlite";
+import { Database, type SqliteDatabase } from "./sqlite.ts";
 import type { AuditEntry, VerifyResult } from "./types.ts";
 import { asRecord } from "./utils.ts";
 
@@ -19,7 +19,7 @@ const RETAIN_AUDIT_BYTES = 2 * 1024 * 1024;
 const MAX_VERIFY_HISTORY_BYTES = 1024 * 1024;
 const RETAIN_VERIFY_HISTORY_BYTES = 512 * 1024;
 let verifiedHistoryState: { size: number; mtimeMs: number; ctimeMs: number; ino: number | bigint } | undefined;
-const lockDatabases = new Map<string, DatabaseSync>();
+const lockDatabases = new Map<string, SqliteDatabase>();
 
 function getVerifyHistoryState(): typeof verifiedHistoryState {
 	const stat = statSync(VERIFY_HISTORY_FILE);
@@ -34,7 +34,7 @@ function withFileLock<T>(path: string, action: () => T): T {
 	let db = lockDatabases.get(path);
 	if (!db) {
 		const lockPath = `${path}.lock.sqlite`;
-		db = new DatabaseSync(lockPath);
+		db = new Database(lockPath);
 		db.exec("PRAGMA busy_timeout = 5000");
 		chmodSync(lockPath, 0o600);
 		lockDatabases.set(path, db);

package/src/lib/guard-dispatcher.ts

@@ -34,7 +34,7 @@ import {
 	snipVerifyOutput,
 } from "./verify.ts";
 import { detectShellMutation, extractPatchPaths, guardShellMutation, isPathOutsideWorkspace } from "../policies/boundary.ts";
-import { branchHasChangelogChange, checkLockfileSync, hasPrCreateInvocation, prBodyIncludesChangelog } from "../policies/changelog.ts";
+import { branchHasChangelogChange, checkLockfileSync, hasPrCreateInvocation, prBodyHasLiteralLineBreakEscapes, prBodyIncludesChangelog } from "../policies/changelog.ts";
 import { extractEditContent, liveMutationIn } from "../policies/destructive.ts";
 import { branchHasDocumentationChange } from "../policies/docs.ts";
 import { claimFiles } from "../policies/file-claims.ts";
@@ -413,6 +413,7 @@ export async function guardToolCallImpl(
 			const prTool = isAz ? "az repos pr create" : "gh pr create";
 			const descFlag = isAz ? "--description" : "--body";
 			const preflightFailures: string[] = [];
+			if (prBodyHasLiteralLineBreakEscapes(raw)) preflightFailures.push(`PR description contains literal \\n/\\r escapes that will render as text; use real newlines, ANSI-C quoting ($'...\\n...'), or a body/description file instead.`);
 			const conflictCheck = checkMergeConflicts(prRoot);
 			if (conflictCheck.hasConflicts) preflightFailures.push(conflictCheck.reason ?? "Branch has merge conflicts with its base branch.");
 			const branch = currentGitBranch(prRoot);

package/src/lib/project-memory.ts

@@ -2,14 +2,14 @@ import { createHash, randomUUID } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawnSync } from "node:child_process";
-import { DatabaseSync } from "node:sqlite";
+import { Database, type SqliteDatabase } from "./sqlite.ts";
 import type { ProjectMemoryInput, ProjectMemoryKind, ProjectMemoryRecord, ProjectMemorySource, ReviewFollowup, ReviewFollowupInput } from "./types.ts";
 
 const KINDS = new Set<ProjectMemoryKind>(["fact", "decision", "constraint", "lesson"]);
 const SOURCES = new Set<ProjectMemorySource>(["user", "file", "git", "tool", "agent", "portable"]);
 
 export interface ProjectMemoryStore {
-	db: DatabaseSync;
+	db: SqliteDatabase;
 	projectId: string;
 	close(): void;
 }
@@ -66,7 +66,7 @@ export async function isProjectMemoryFreshAsync(memory: ProjectMemoryRecord, roo
 export function openProjectMemory(projectId: string, directory = getProjectMemoryDir()): ProjectMemoryStore {
 	if (!projectId || projectId.length > 200) throw new Error("Invalid project memory identity.");
 	mkdirSync(directory, { recursive: true, mode: 0o700 });
-	const db = new DatabaseSync(join(directory, `${projectId.replace(/[^a-zA-Z0-9._-]/g, "_")}.sqlite`));
+	const db = new Database(join(directory, `${projectId.replace(/[^a-zA-Z0-9._-]/g, "_")}.sqlite`));
 	db.exec(`
 		PRAGMA journal_mode = WAL;
 		PRAGMA busy_timeout = 2000;

package/src/lib/sqlite.ts

@@ -0,0 +1,20 @@
+type RunResult = { changes: number | bigint };
+type Statement = {
+	run(...params: unknown[]): RunResult;
+	all(...params: unknown[]): unknown[];
+	get(...params: unknown[]): unknown;
+};
+
+export interface SqliteDatabase {
+	exec(sql: string): unknown;
+	prepare(sql: string): Statement;
+	close(): void;
+}
+
+type DatabaseConstructor = new (path: string) => SqliteDatabase;
+const sqliteModuleName = "Bun" in globalThis ? "bun:sqlite" : "node:sqlite";
+const sqliteModule = await import(sqliteModuleName) as { Database?: DatabaseConstructor; DatabaseSync?: DatabaseConstructor };
+
+const DatabaseImpl = sqliteModule.Database ?? sqliteModule.DatabaseSync;
+if (!DatabaseImpl) throw new Error(`SQLite database implementation unavailable from ${sqliteModuleName}`);
+export const Database: DatabaseConstructor = DatabaseImpl;

package/src/policies/changelog.ts

@@ -178,6 +178,21 @@ export function prBodyIncludesChangelog(command: string, invocationRoot: string
 	return false;
 }
 
+export function prBodyHasLiteralLineBreakEscapes(command: string): boolean {
+	const words = prShellWords(command);
+	const cliIndex = words.findIndex((word) => word === "gh" || word === "az");
+	if (cliIndex < 0) return false;
+
+	for (let i = cliIndex; i < words.length; i += 1) {
+		const word = words[i]!;
+		let body: string | undefined;
+		if (["--body", "-b", "--description", "-d"].includes(word)) body = words[i + 1];
+		else if (/^(?:--body|--description)=/.test(word)) body = word.slice(word.indexOf("=") + 1);
+		if (body && /\\[nr](?:\\[nr]|(?=\s*[-*#]))/.test(body)) return true;
+	}
+	return false;
+}
+
 export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifest?: string; lockfile?: string; reason?: string } {
 	try {
 		let modifiedFiles: string[] = [];