npm - tamperward - Versions diffs - 1.10.0 → 1.10.2 - Mend

tamperward 1.10.0 → 1.10.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/cli/index.js +46 -9
package/package.json +1 -1

package/dist/cli/index.js CHANGED Viewed

@@ -272,6 +272,19 @@ function diffWorktree(opts = {}) {
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
 }
+function diffWorktreeWithUntracked(opts = {}) {
+  const tracked = diffWorktree(opts);
+  const others = git(["ls-files", "--others", "--exclude-standard", "-z"], opts.cwd).split("\0").filter(Boolean);
+  const seen = new Set(tracked.filter((c) => c.kind === "file").map((c) => c.path));
+  const untracked = others.filter((rel) => !seen.has(rel)).map(
+    (rel) => enrich(
+      { kind: "file", path: rel, oldPath: null, op: "add", before: null, after: null, binary: false, hunks: [] },
+      () => null,
+      (p) => fromDisk(p, opts.cwd)
+    )
+  );
+  return [...tracked, ...untracked];
+}
 // src/detectors/finding.ts
 function severityOf(rule, policy, fallback = "block") {
@@ -1840,7 +1853,7 @@ function report(input) {
 // src/cli/check.ts
 function check(opts) {
-  let policy = loadPolicy(opts.cwd);
+  let policy = opts.policyOverride ?? loadPolicy(opts.cwd);
   const cwd = opts.cwd ?? process.cwd();
   let changes;
   let layer;
@@ -1850,8 +1863,8 @@ function check(opts) {
     layer = "local";
     view = "staged";
   } else if (opts.worktree) {
-    changes = diffWorktree({ cwd: opts.cwd });
-    layer = "local";
+    changes = opts.includeUntracked ? diffWorktreeWithUntracked({ cwd: opts.cwd }) : diffWorktree({ cwd: opts.cwd });
+    layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
     const [base, head] = opts.diff.split(/\.{2,3}/);
@@ -1863,7 +1876,7 @@ function check(opts) {
     changes = diffRange(base, head, { cwd: opts.cwd });
     layer = "ci";
     view = "range";
-    policy = loadPolicyAt(mergeBaseOf(base, head, { cwd: opts.cwd }), opts.cwd) ?? defaultPolicy();
+    policy = opts.policyOverride ?? loadPolicyAt(mergeBaseOf(base, head, { cwd: opts.cwd }), opts.cwd) ?? defaultPolicy();
   } else {
     process.stderr.write("tamperward: specify --staged, --worktree, or --diff <base>...<head>\n");
     return 2;
@@ -2820,7 +2833,7 @@ function runVerify(opts) {
   const out2 = (s) => void process.stdout.write(s + "\n");
   let policy;
   try {
-    policy = loadPolicy(cwd);
+    policy = opts.policyOverride ?? loadPolicy(cwd);
   } catch (e) {
     out2(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
@@ -2932,6 +2945,22 @@ function runEnvelope(opts) {
     err(`tamperward run: cannot resolve trusted base ${opts.base ?? "HEAD"} \u2014 failing closed.`);
     return 2;
   }
+  let frozenPolicy;
+  let frozenCmd;
+  let frozenBudget;
+  try {
+    frozenPolicy = loadPolicyAt(base, cwd) ?? defaultPolicy();
+    frozenCmd = opts.cmd ?? frozenPolicy.verify?.command;
+    frozenBudget = opts.budget ?? frozenPolicy.verify?.budget;
+  } catch (e) {
+    err(`tamperward run: cannot load the entry-time policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed.`);
+    return 2;
+  }
+  if (!frozenCmd) {
+    err("tamperward run: no suite command at entry (policy `verify: { command: ... }` or --cmd) \u2014");
+    err("refusing to start: a verifier that appears after the agent runs would be agent-authored.");
+    return 2;
+  }
   if (!opts.allowDirty) {
     const dirty = git3(["status", "--porcelain"], cwd).trim();
     if (dirty) {
@@ -2944,16 +2973,24 @@ function runEnvelope(opts) {
   const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
   const agentExit = agent.status ?? 1;
   const head = git3(["rev-parse", "HEAD"], cwd).trim();
+  const isAncestor = spawnSync2("git", ["merge-base", "--is-ancestor", base, head], { cwd });
+  if (isAncestor.status !== 0) {
+    err(`tamperward run: HEAD ${head.slice(0, 10)} is not a descendant of the trusted base ${base.slice(0, 10)} \u2014`);
+    err("the agent rewrote history out from under the anchor. That is the finding.");
+    out(`
+tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMENT_FAILED`);
+    return 1;
+  }
   let diffCode = 0;
   if (head !== base) {
     out(`
 [envelope] policy check over committed changes (${base.slice(0, 10)}...${head.slice(0, 10)}):`);
-    diffCode = runCheck({ diff: `${base}...${head}`, cwd });
+    diffCode = runCheck({ diff: `${base}...${head}`, cwd, policyOverride: frozenPolicy });
   }
-  out("\n[envelope] policy check over the working tree:");
-  const workCode = runCheck({ worktree: true, cwd });
+  out("\n[envelope] policy check over the working tree (frozen policy, untracked included, no local ledger):");
+  const workCode = runCheck({ worktree: true, cwd, policyOverride: frozenPolicy, includeUntracked: true, ciLayer: true });
   out("\n[envelope] pristine verification against the trusted base:");
-  const verifyCode = runVerify({ cwd, base, cmd: opts.cmd, budget: opts.budget });
+  const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",