[luv-336] fix: anchor workflow-policy regexes to command boundaries

The `release-prep-check`, `changelog-check`, `docs-check`, and
`pr-description-check` policies used unanchored regexes against the
Bash command string, so the literal phrases (`gh pr create`,
`git commit`, `git push`) matched anywhere — including inside HEREDOC
bodies or quoted arguments. Concrete failure: editing a PR body that
contained the words "gh pr create" inside backticks fired the new
`release-prep-check` policy on the `gh pr edit` invocation.

Extracts a shared `matchesCommand(cmd, verbPattern)` helper that
anchors the verb-phrase match to a command boundary (`^`, `;`, `&&`,
`||`, `|`, or newline). All four policies route through it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: NiveditJain

.failproofai/policies/workflow-policies.mjs

@@ -5,6 +5,19 @@
  */
 import { customPolicies, allow, instruct } from "failproofai";
 
+/**
+ * Match `<verb-phrase>` only when it appears at a command boundary (start of
+ * string, `;`, `&&`, `||`, `|`, or newline). Avoids false-positive matches
+ * when the literal phrase appears inside a HEREDOC or a quoted argument
+ * (e.g. `gh pr edit --body "...gh pr create..."` would previously trigger
+ * `release-prep-check` because the regex matched anywhere in the string).
+ */
+function matchesCommand(cmd, verbPhrasePattern) {
+  return new RegExp(
+    String.raw`(?:^|[;\n|]|&&|\|\|)\s*` + verbPhrasePattern + String.raw`\b`,
+  ).test(cmd);
+}
+
 // Remind to update CHANGELOG before committing
 customPolicies.add({
   name: "changelog-check",
@@ -13,7 +26,7 @@ customPolicies.add({
   fn: async (ctx) => {
     if (ctx.toolName !== "Bash") return allow();
     const cmd = String(ctx.toolInput?.command ?? "");
-    if (/git\s+commit/.test(cmd)) {
+    if (matchesCommand(cmd, String.raw`git\s+commit`)) {
       return instruct(
         "Check whether CHANGELOG.md needs an update for this commit. " +
         "Every PR must include an entry under the current `## <version> — <YYYY-MM-DD>` section " +
@@ -34,7 +47,7 @@ customPolicies.add({
   fn: async (ctx) => {
     if (ctx.toolName !== "Bash") return allow();
     const cmd = String(ctx.toolInput?.command ?? "");
-    if (/git\s+commit/.test(cmd)) {
+    if (matchesCommand(cmd, String.raw`git\s+commit`)) {
       return instruct(
         "Check whether documentation needs updating for this change. " +
         "Consider: docs/*.mdx files, README.md, and examples/ directory. " +
@@ -53,7 +66,7 @@ customPolicies.add({
   fn: async (ctx) => {
     if (ctx.toolName !== "Bash") return allow();
     const cmd = String(ctx.toolInput?.command ?? "");
-    if (/git\s+push/.test(cmd)) {
+    if (matchesCommand(cmd, String.raw`git\s+push`)) {
       return instruct(
         "After pushing, check if there is an open PR for this branch. " +
         "If so, update the PR description to reflect the latest changes."
@@ -74,7 +87,7 @@ customPolicies.add({
   fn: async (ctx) => {
     if (ctx.toolName !== "Bash") return allow();
     const cmd = String(ctx.toolInput?.command ?? "");
-    if (!/\bgh\s+pr\s+create\b/.test(cmd)) return allow();
+    if (!matchesCommand(cmd, String.raw`gh\s+pr\s+create`)) return allow();
     return instruct(
       "Before creating the PR, ensure CHANGELOG.md entries land under a versioned section so the PR ships release-ready:\n" +
       "  1. Read `version` from package.json (e.g. `0.0.10-beta.10`).\n" +

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ### Fixes
 - `lib/opencode-projects.ts`: align `ProjectFolder.name` for OpenCode projects with the URL-slug encoding every other CLI uses (`encodeFolderName(worktree)`, e.g. `-home-nivedit-dev-purge`), replacing the previous `proj.name`/`basename(worktree)` fallback chain that produced bare names like `dev-purge`. The `[name]` route handler resolves OpenCode sessions via `encodeFolderName(p.worktree) === name` in `getOpenCodeSessionsByEncodedName`, and the Projects-list link in `app/components/project-list.tsx:330` is built from `folder.name` — so an OpenCode-only project at `/home/nivedit/dev-purge` was emitting `/project/dev-purge`, which 404'd, while the session-row URL built elsewhere via `encodeCwdForUrl(cwd)` correctly used `-home-nivedit-dev-purge` and worked. Side benefit: `mergeProjectFolders` (`lib/projects.ts:107`) keys by `f.name`, so OpenCode projects now merge with their Claude / Codex / Copilot / Cursor / Pi / Gemini siblings into a single row with multiple CLI badges instead of appearing as two separate rows. Display via `decodeFolderName(folder.name)` in the Projects table now shows the full path (`/home/nivedit/dev-purge`) instead of the prior `dev/purge`, matching every other CLI. Three test assertions in `__tests__/lib/opencode-projects.test.ts` updated to pin the encoded form (`-repo`, `-other`); existing `getOpenCodeSessionsByEncodedName` tests already asserted the correct contract and didn't need changes (#335).
-- `.failproofai/policies/workflow-policies.mjs`: new `release-prep-check` policy fires on `gh pr create` and instructs the agent to ensure CHANGELOG entries land under a versioned `## <version> — <YYYY-MM-DD>` heading (creating that heading above the previous version's section if needed) so each merged feature PR ships release-ready. The existing `changelog-check` policy is updated to match — the `## Unreleased` section is gone; entries always go under a dated, versioned heading. Version bumps in `package.json` remain reserved for `luv-cut-*` PRs by the existing `block-version-bumps` policy.
+- `.failproofai/policies/workflow-policies.mjs`: new `release-prep-check` policy fires on `gh pr create` and instructs the agent to ensure CHANGELOG entries land under a versioned `## <version> — <YYYY-MM-DD>` heading (creating that heading above the previous version's section if needed) so each merged feature PR ships release-ready. The existing `changelog-check` policy is updated to match — the `## Unreleased` section is gone; entries always go under a dated, versioned heading. Version bumps in `package.json` remain reserved for `luv-cut-*` PRs by the existing `block-version-bumps` policy. All four policies in this file (`changelog-check`, `docs-check`, `pr-description-check`, `release-prep-check`) now route through a shared `matchesCommand` helper that anchors verb-phrase matches to a command boundary (`^`, `;`, `&&`, `||`, `|`, or newline), so the literal phrases `git commit` / `git push` / `gh pr create` no longer false-positive when they appear inside HEREDOC bodies or quoted arguments (e.g. `gh pr edit --body "...gh pr create..."` no longer triggers `release-prep-check`).
 
 ## 0.0.10-beta.9 — 2026-05-09