tamperward 1.13.0 → 1.14.0

package/dist/cli/index.js

@@ -215,9 +215,13 @@ function enrich(c, beforeReader, afterReader) {
   const after = c.op !== "delete" ? afterReader(c.path) : null;
   return { ...c, before, after };
 }
+function assertRev(rev) {
+  if (rev.startsWith("-")) throw new Error(`refusing a revision that git would read as an option: ${rev}`);
+  return rev;
+}
 function mergeBaseOf(base, head, opts = {}) {
   try {
-    return git(["merge-base", base, head], opts.cwd).trim() || base;
+    return git(["merge-base", assertRev(base), assertRev(head)], opts.cwd).trim() || base;
   } catch {
     return base;
   }
@@ -254,6 +258,8 @@ function diffSince(rev, opts = {}) {
   );
 }
 function diffRange(base, head, opts = {}) {
+  assertRev(base);
+  assertRev(head);
   const raw = git(["diff", "--no-color", "-M", `${base}...${head}`], opts.cwd);
   const mergeBase = mergeBaseOf(base, head, opts);
   return parseDiff(raw).map(
@@ -447,7 +453,36 @@ function defaultPolicy(version = 1) {
       // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
       // instead of warning. Kept ADDITIVE (originals + new extensions) so the policy-diff sees a
       // strengthening, not a narrowing. picomatch expands the brace.
-      tests: ["**/*.test.ts", "**/*.spec.ts", "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}", "**/__tests__/**"],
+      // test-skip, test-deletion and test-content-removal all gate on this
+      // class, so a repo it does not match gets rules that can NEVER fire —
+      // protection that is silently absent rather than visibly off. The JS/TS
+      // list shipped alone; these are the conventional layouts of the other
+      // ecosystems `init` is run in. (P2-13, external review.)
+      tests: [
+        // JavaScript / TypeScript
+        "**/*.test.ts",
+        "**/*.spec.ts",
+        "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}",
+        "**/__tests__/**",
+        // Python (pytest / unittest layouts)
+        "**/test_*.py",
+        "**/*_test.py",
+        "**/conftest.py",
+        // Go
+        "**/*_test.go",
+        // Rust (integration tests live in tests/, unit tests inline)
+        "**/tests/**/*.rs",
+        // Ruby (RSpec / minitest)
+        "**/*_spec.rb",
+        "**/*_test.rb",
+        // Java / Kotlin / Scala (Maven & Gradle convention)
+        "**/src/test/**",
+        // PHP (PHPUnit)
+        "**/*Test.php",
+        // C# (.NET)
+        "**/*Tests.cs",
+        "**/*Test.cs"
+      ],
       config: [
         "**/jest.config.*",
         "**/vitest.config.*",
@@ -1819,15 +1854,21 @@ function annotations(findings) {
 function cell(s) {
   return s.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
 }
+function mdCode(s) {
+  return s.replace(/`/g, "'").replace(/[\r\n]/g, " ");
+}
+function mdUrl(s) {
+  return s.replace(/[()<> \r\n"'`\\]/g, (c) => "%" + c.charCodeAt(0).toString(16).padStart(2, "0").toUpperCase());
+}
 function locationCell(f, env) {
   if (!f.file) return "`(command)`";
   const label = `${f.file}${f.line ? `:${f.line}` : ""}`;
   const server = env.GITHUB_SERVER_URL;
   const repo = env.GITHUB_REPOSITORY;
   const sha2 = env.GITHUB_SHA;
-  if (!server || !repo || !sha2) return `\`${cell(label)}\``;
+  if (!server || !repo || !sha2) return `\`${cell(mdCode(label))}\``;
   const frag = f.line ? `#L${f.line}` : "";
-  return `[\`${cell(label)}\`](${server}/${repo}/blob/${sha2}/${f.file}${frag})`;
+  return `[\`${cell(mdCode(label))}\`](${server}/${repo}/blob/${sha2}/${mdUrl(f.file)}${frag})`;
 }
 function renderSummary(input, env = process.env) {
   const findings = orderFindings(input.findings);
@@ -2766,7 +2807,9 @@ function planClaudeHooks(cwd) {
     apply: () => {
       if (needPre) {
         (hooks.PreToolUse ??= []).push({
-          matcher: "Bash|Edit|Write|MultiEdit",
+          // NotebookEdit is modelled by the adapter but was absent here, so
+          // that branch was unreachable in the wiring we install. (P2-12.)
+          matcher: "Bash|Edit|Write|MultiEdit|NotebookEdit",
           hooks: [{ type: "command", command: HOOK_CMD }]
         });
       }
@@ -2861,6 +2904,7 @@ function git2(args, cwd) {
   return execFileSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
 }
 function resolveBase(base, cwd) {
+  assertRev(base);
   const rev = git2(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
   try {
     return git2(["merge-base", rev, "HEAD"], cwd).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",