tamperward 1.10.2 → 1.10.4

package/dist/cli/index.js

@@ -329,7 +329,16 @@ var LITERAL = [
   { re: /(?:^|\s)--no-verify(?:\s|$)/, why: "--no-verify skips the pre-commit/pre-push hooks" },
   { re: /(?:^|\s)--no-hooks(?:\s|$)/, why: "--no-hooks disables hook execution" },
   { re: /(?:^|[\s;&|=])HUSKY=0(?:\s|$)/, why: "HUSKY=0 disables all Husky hooks" },
-  { re: /\bHUSKY_SKIP_HOOKS=1\b/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" }
+  { re: /\bHUSKY_SKIP_HOOKS=1\b/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" },
+  // git-native hook disabling. core.hooksPath is strictly MORE general than the
+  // flags above: it turns off husky, lefthook, plain .git/hooks and pre-commit
+  // alike, and it was reachable in three spellings the literal list missed
+  // (-c, `git config`, and GIT_CONFIG_* env injection). (P1-9, external review.)
+  { re: /\bcore\.hooksPath\b/i, why: "core.hooksPath redirects git away from the installed hooks" },
+  { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" },
+  { re: /(?:^|[\s;&|=])LEFTHOOK=0(?:\s|$)/, why: "LEFTHOOK=0 disables Lefthook hooks" },
+  { re: /\bSKIP_SIMPLE_GIT_HOOKS=1\b/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
+  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" }
 ];
 var SHORT_N = /^-[a-z]*n[a-z]*$/i;
 var noVerify = {
@@ -880,6 +889,9 @@ var CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|play
 var YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
 var INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward)\b/;
 var INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
+function isActiveWorkflow(path) {
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+}
 var invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
 function commandCore(line) {
   return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
@@ -910,6 +922,17 @@ var ciTampering = {
     const out2 = [];
     for (const c of changes) {
       if (c.kind !== "file") continue;
+      if (c.op === "rename" && c.oldPath && isActiveWorkflow(c.oldPath) && !isActiveWorkflow(c.path)) {
+        out2.push(
+          makeFinding(RULE5, policy, {
+            file: c.path,
+            message: `A CI workflow was renamed so it no longer runs (${c.oldPath} \u2192 ${c.path}).`,
+            evidence: `${c.oldPath} \u2192 ${c.path}`,
+            remediation: "Restore the path and extension. GitHub runs only *.yml/*.yaml directly under .github/workflows \u2014 renaming outside that disables the checks as surely as deleting them."
+          })
+        );
+        continue;
+      }
       if (!isProtected(c.path, policy, "ci")) continue;
       for (const l of addedLines(c)) {
         const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
@@ -1260,7 +1283,7 @@ var testDeletion = {
               remediation: "Restoring the path. Renaming a spec out of the glob silently removes it from the suite."
             })
           );
-        } else if (c.op === "modify" && isTest && c.before != null && c.after != null) {
+        } else if ((c.op === "modify" || c.op === "rename") && isTest && c.before != null && c.after != null) {
           const before = countTestBlocks(c.before);
           const after = countTestBlocks(c.after);
           if (after < before) {
@@ -1339,7 +1362,7 @@ var testContentRemoval = {
       }
     }
     for (const c of changes) {
-      if (c.kind !== "file" || c.op !== "modify" || c.before == null || c.after == null) continue;
+      if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
       if (!isProtected(c.path, policy, "tests")) continue;
       if (isProtected(c.path, policy, "snapshots")) continue;
       if (countTestBlocks(c.after) < countTestBlocks(c.before)) continue;
@@ -1665,8 +1688,17 @@ function wrap(text, width) {
   if (cur) out2.push(cur);
   return out2.length ? out2 : [""];
 }
+function stripControl(v) {
+  let outStr = "";
+  for (const ch of v) {
+    const cp = ch.codePointAt(0) ?? 0;
+    const control = cp < 32 && cp !== 9 && cp !== 10 && cp !== 13 || cp === 127 || cp >= 128 && cp <= 159;
+    outStr += control ? "\uFFFD" : ch;
+  }
+  return outStr;
+}
 function clip(s, max) {
-  const one = s.replace(/\s+/g, " ").trim();
+  const one = stripControl(s).replace(/\s+/g, " ").trim();
   return one.length > max ? one.slice(0, Math.max(1, max - 1)) + "\u2026" : one;
 }
 function orderFindings(findings) {
@@ -2107,18 +2139,13 @@ function snapshotProtected(cwd, policy, prev) {
       }
       if (st.isDirectory()) walk(r);
       else if (st.isFile() && isProtected(r, policy)) {
-        const p = prev?.[r];
-        if (p && p.mtimeMs === st.mtimeMs && p.size === st.size && p.mode === st.mode) {
-          out2[r] = p;
-        } else {
-          let hash = "";
-          try {
-            hash = sha(readFileSync6(join6(cwd, r)));
-          } catch {
-            hash = "unreadable";
-          }
-          out2[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
+        let hash = "";
+        try {
+          hash = sha(readFileSync6(join6(cwd, r)));
+        } catch {
+          hash = "unreadable";
         }
+        out2[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
       }
     }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.10.2",
+  "version": "1.10.4",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",