tamperward 1.11.1 → 1.13.0

package/dist/cli/index.js

@@ -463,7 +463,20 @@ function defaultPolicy(version = 1) {
       // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
       // live there as .cjs and were rewritten unseen (PHASE3.md §4).
       snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
-      hooks: [".husky/**", "**/lefthook.*", ".tamperward.yml", "**/.tamperward.yml"]
+      // The wiring IS the enforcement: settings.json carries the PreToolUse and
+      // Stop hooks, and a pre-commit config carries the commit-time gate. These
+      // were installed by `init` and protected by nothing, so editing them out
+      // fired no rule at all. (.git/hooks/** is outside every git view and so
+      // cannot be covered here — noted in SECURITY-ENVELOPE.md.) (P1-4, review.)
+      hooks: [
+        ".husky/**",
+        "**/lefthook.*",
+        ".tamperward.yml",
+        "**/.tamperward.yml",
+        ".claude/settings.json",
+        ".claude/settings.local.json",
+        "**/.pre-commit-config.yaml"
+      ]
     },
     rules: {
       "test-deletion": { severity: "block" },
@@ -1516,8 +1529,18 @@ function evaluate(changes, policy, detectors = allDetectors, view) {
     try {
       out2.push(...d.run(active, policy, view));
     } catch (e) {
-      process.stderr.write(`tamperward: detector "${d.id}" errored and was skipped: ${String(e)}
+      process.stderr.write(`tamperward: detector "${d.id}" errored: ${String(e)}
 `);
+      if (view === "staged" || view === "worktree" || view === "range") {
+        out2.push({
+          rule: "detector-error",
+          severity: "block",
+          message: `Detector "${d.id}" failed to run; the verdict is incomplete.`,
+          evidence: String(e).slice(0, 200),
+          remediation: "A rule that cannot run is not a rule that passed. Fix the input or the detector; do not read this as clean.",
+          signoff: { required: true, command: `tamperward allow detector-error --reason "..."` }
+        });
+      }
     }
   }
   const seen = /* @__PURE__ */ new Set();
@@ -1637,17 +1660,28 @@ function applyLocalSignoffs(findings, cwd, policy, now = Date.now()) {
   }
   return { findings: remaining, cleared };
 }
-function applyOobSignoffs(findings, oob) {
-  const set = new Set(oob.map((s) => s.trim()).filter(Boolean));
+function applyOobSignoffs(findings, oob, head) {
+  const tokens2 = oob.map((s) => s.trim()).filter(Boolean);
+  const matches = (want) => tokens2.some((t) => {
+    const at = t.lastIndexOf("@");
+    if (at === -1) return head ? false : t === want;
+    const [rule, sha2] = [t.slice(0, at), t.slice(at + 1)];
+    if (rule !== want) return false;
+    return head ? head.startsWith(sha2) && sha2.length >= 7 : true;
+  });
   const cleared = [];
   const remaining = [];
   for (const f of findings) {
-    const ok = f.severity === "block" && (set.has(f.rule) || (f.file ? set.has(`${f.rule}:${f.file}`) : false));
+    const ok = f.severity === "block" && (matches(f.rule) || (f.file ? matches(`${f.rule}:${f.file}`) : false));
     if (ok) cleared.push(f);
     else remaining.push(f);
   }
   return { findings: remaining, cleared };
 }
+function oobHeadFromEnv(env = process.env) {
+  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim();
+  return v.length >= 7 ? v : void 0;
+}
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 }
@@ -1915,7 +1949,7 @@ function check(opts) {
   }
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
   let findings = evaluate(changes, policy, void 0, view);
-  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv());
+  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
   findings = remaining;
   if (cleared.length) {
     const how = layer === "local" ? "local human sign-off (ledger)" : "out-of-band approval";
@@ -2599,6 +2633,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
+import { fileURLToPath } from "node:url";
 var HOOK_CMD = "npx --yes tamperward hook claude";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
@@ -2617,6 +2652,21 @@ version: 1
 #   snapshot-rewrite: { severity: block }
 # ignore: []            # visible blind spots \u2014 the count is always reported
 `;
+function shippedVersion() {
+  try {
+    const here = dirname3(fileURLToPath(import.meta.url));
+    for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
+      try {
+        const pkg = JSON.parse(readFileSync10(join8(here, rel), "utf8"));
+        if (pkg.name === "tamperward" && pkg.version) return pkg.version;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return "latest";
+}
+var TW_VERSION = shippedVersion();
 var WORKFLOW_CONTENT = `name: tamperward
 
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
@@ -2652,10 +2702,24 @@ jobs:
         run: |
           RULES="$(printf '%s' "$LABELS" | jq -r '.[] | select(startswith("tamperward:allow:")) | sub("^tamperward:allow:"; "")' | paste -sd, -)"
           echo "rules=$RULES" >> "$GITHUB_OUTPUT"
-      - name: Tamperward gate
+      - name: Tamperward gate (diff-time)
         env:
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
-        run: npx --yes tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
+          # Binds each approval to the commit it was granted for: labels persist
+          # across pushes, so an unbound one would clear every later finding on
+          # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
+          TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
+        run: npx --yes tamperward@${TW_VERSION} check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
+      # Diff-time detection is spelling-dependent by nature; pristine
+      # re-execution is not, and it was the layer nothing got past in the
+      # taskbench sweeps. Shipping a CI template WITHOUT it meant every
+      # masked-failure class was adjudicated only at the local layer \u2014 the
+      # layer an agent shares a filesystem with. (P1-5, external review.)
+      #
+      # Requires a \`verify:\` block in .tamperward.yml naming the suite command;
+      # without one this step fails closed (exit 2) rather than passing quietly.
+      - name: Tamperward verify (pristine re-execution)
+        run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
@@ -2789,7 +2853,7 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 
 // src/cli/verify.ts
 import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
-import { chmodSync as chmodSync2, cpSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync11, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname4, join as join9, resolve } from "node:path";
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
@@ -2804,6 +2868,10 @@ function resolveBase(base, cwd) {
     return rev;
   }
 }
+function baseIsAncestorOfHead(base, cwd) {
+  const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd });
+  return r.status === 0;
+}
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
@@ -2817,12 +2885,23 @@ function materialize(cwd, dest) {
     if (!st.isFile()) continue;
     const out2 = join9(dest, rel);
     mkdirSync6(dirname4(out2), { recursive: true });
-    cpSync(src, out2);
+    dropSymlink(out2);
+    if (lstatSync(src).isSymbolicLink()) {
+      writeFileSync6(out2, readFileSync11(src));
+    } else {
+      cpSync(src, out2, { dereference: true });
+    }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve(cwd, "node_modules");
   if (existsSync8(nm)) symlinkSync(nm, join9(dest, "node_modules"), "dir");
 }
+function dropSymlink(p) {
+  try {
+    if (lstatSync(p).isSymbolicLink()) rmSync2(p, { force: true });
+  } catch {
+  }
+}
 function overlayPristine(cwd, base, dest, policy) {
   const atBase = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd).split("\0").filter(Boolean);
   const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c));
@@ -2834,6 +2913,7 @@ function overlayPristine(cwd, base, dest, policy) {
     const content = execFileSync4("git", ["show", `${base}:${rel}`], { cwd, maxBuffer: 1 << 28 });
     const out2 = join9(dest, rel);
     mkdirSync6(dirname4(out2), { recursive: true });
+    dropSymlink(out2);
     writeFileSync6(out2, content);
     restored++;
   }
@@ -2865,6 +2945,15 @@ function runVerify(opts) {
     out2(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
     return 2;
   }
+  if (opts.requireAncestor) {
+    const requested = git2(["rev-parse", "--verify", `${opts.base ?? "HEAD"}^{commit}`], cwd).trim();
+    if (!baseIsAncestorOfHead(requested, cwd)) {
+      out2(
+        `verify: --require-ancestor: ${requested.slice(0, 10)} is not an ancestor of HEAD \u2014 the anchor would silently resolve to an older commit. Failing closed.`
+      );
+      return 2;
+    }
+  }
   const cmd = opts.cmd ?? policy.verify?.command;
   if (!cmd) {
     out2("verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd");
@@ -2947,6 +3036,7 @@ function parseVerify(args) {
     else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
     else if (a === "--json") o.json = true;
     else if (a === "--keep") o.keep = true;
+    else if (a === "--require-ancestor") o.requireAncestor = true;
     else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
   }
   return o;
@@ -2955,7 +3045,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync11, readlinkSync, realpathSync, statSync as statSync6 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, realpathSync, statSync as statSync6 } from "node:fs";
 import { join as join10, resolve as resolve2 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -2969,7 +3059,7 @@ function treeFingerprint(cwd) {
     h.update(rel);
     h.update("\0");
     try {
-      h.update(readFileSync11(join10(cwd, rel)));
+      h.update(readFileSync12(join10(cwd, rel)));
     } catch {
       h.update("<unreadable>");
     }
@@ -2993,7 +3083,7 @@ function depsFingerprint(cwd) {
       else if (e.isFile()) {
         h.update(p);
         try {
-          h.update(readFileSync11(p));
+          h.update(readFileSync12(p));
           h.update(String(statSync6(p).mode));
         } catch {
           h.update("<unreadable>");
@@ -3018,7 +3108,7 @@ function depsFingerprint(cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync11("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync12("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -3048,7 +3138,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync11(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync12(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.11.1",
+  "version": "1.13.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",