How It Works: 1. Interception: Uses OpenCode's TypeScript plugin system ("tool.execute.before") to intercept candidate tool calls (bash, read, edit, write) before they run. 2. Sidecar Verification: Passes tool parameters to a local Python daemon running guardians.verify(). 3. Formal Verification (~1.5ms): Evaluates Z3 path containment (blocking path traversal like ../../../../etc/passwd), secret taint tracking (preventing .env data from flowing to output files or shell commands), and security automata (enforcing read-before-edit rules). 4. Pre-Execution Abort: If a violation is flagged, the plugin throws an exception to block execution before any side effects happen on disk, forcing the agent to self-correct.
The repository links metareflection/guardians directly as a Git submodule (guardians-core), keeping the core verifier untouched and synced with upstream updates.
Repo & Setup Instructions: https://github.com/albertjoseph0/opencode-plugin-guardians
I would love to hear your thoughts or feedback!