npm - tamperward - Versions diffs - 1.2.0 → 1.3.0 - Mend

tamperward 1.2.0 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -102,7 +102,7 @@ with the same engine it ships.
 - `src/engine.ts` — runs the enabled rules over `Change[]`; honours `policy.ignore`.
 - `src/cli/` — `tamperward check --staged | --worktree | --diff <base>...<head>`,
   exit 1 on any blocking finding.
-- `test/` — 226 tests, including the AST-vs-regex, self-hosting precision, and
+- `test/` — 248 tests, including the AST-vs-regex, self-hosting precision, and
   pre-go-live audit regression cases, and the renderer accessibility contract.
 - `src/adapters/claude/` + `src/cli/hook.ts` — the agent layer: `tamperward hook claude`

package/dist/cli/index.js CHANGED Viewed

@@ -371,6 +371,16 @@ function removedLines(c) {
 // src/policy.ts
 import picomatch from "picomatch";
 var POLICY_FILE = ".tamperward.yml";
+var BLOCK_SINCE = {};
+function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
+  const out = { ...rules };
+  for (const [rule, since] of Object.entries(gates)) {
+    if (since > version && out[rule]?.severity === "block") {
+      out[rule] = { ...out[rule], severity: "warn" };
+    }
+  }
+  return out;
+}
 var cache = /* @__PURE__ */ new Map();
 function matcher(glob) {
   let m = cache.get(glob);
@@ -407,9 +417,9 @@ function mergeProtected(base, user) {
   }
   return out;
 }
-function defaultPolicy() {
-  return {
-    version: 1,
+function defaultPolicy(version = 1) {
+  const p = {
+    version,
     protected: {
       // Cover every JS/TS test extension, not just .test.ts — the multi-repo FP study found
       // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
@@ -454,6 +464,8 @@ function defaultPolicy() {
     ignore: [],
     signoff: { requiredFor: ["block"], ledger: ".tamperward/ledger.jsonl" }
   };
+  p.rules = applyVersionGates(p.rules, version);
+  return p;
 }
 // src/detectors/files.ts
@@ -829,10 +841,15 @@ var coverageLowering = {
 // src/detectors/ci-tampering.ts
 var RULE5 = "ci-tampering";
-var STEP = /^\s*-?\s*(?:run|uses):/;
+var USES = /^\s*-\s*uses:/;
 var CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
 var YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
-var RUNNER = /\b(npm|npx|pnpm|yarn|bun|make|cargo|pytest|python|jest|vitest|eslint|tsc|playwright|tamperward|gradle|mvn|dotnet)\b/;
+var INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward)\b/;
+var INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
+var invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
+function commandCore(line) {
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
+}
 var uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
 function isAlwaysFalse(raw) {
   const v = uncommented(raw);
@@ -885,16 +902,18 @@ var ciTampering = {
           );
         }
       }
-      const stillPresent = new Set(addedLines(c).map((l) => l.content.trim()));
+      const afterCores = new Set(
+        (c.after != null ? c.after.split("\n") : addedLines(c).map((l) => l.content)).map(commandCore)
+      );
       for (const l of removedLines(c)) {
-        if (stillPresent.has(l.content.trim())) continue;
-        const isStepLine = STEP.test(l.content) && CHECK.test(l.content);
-        const isRunBodyLine = !YAML_KEY.test(l.content) && RUNNER.test(l.content) && CHECK.test(l.content);
-        if (!isStepLine && !isRunBodyLine) continue;
+        const isUsesLine = USES.test(l.content) && CHECK.test(l.content);
+        const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
+        if (!isUsesLine && !isCheckCommand) continue;
+        if (afterCores.has(commandCore(l.content))) continue;
         out.push(
           makeFinding(RULE5, policy, {
             file: c.path,
-            message: isStepLine ? "A CI check step (test/lint/typecheck) was removed." : "A CI check command was removed from a run block.",
+            message: isUsesLine ? "A CI check step (test/lint/typecheck) was removed." : "A CI check command was removed from a run block.",
             evidence: l.content.trim(),
             remediation: "Restore the step. Removing the check that protects main is itself the tamper."
           })
@@ -917,8 +936,11 @@ function safeParse(src) {
   }
 }
 function effective(raw) {
-  const base = defaultPolicy();
+  const v = raw.version;
+  const version = typeof v === "number" && Number.isInteger(v) && v >= 1 ? v : 1;
+  const base = defaultPolicy(version);
   return {
+    version,
     rules: { ...base.rules, ...raw.rules ?? {} },
     ignore: raw.ignore ?? base.ignore ?? [],
     protected: mergeProtected(base.protected, raw.protected),
@@ -933,6 +955,11 @@ function policyWeakening(before, after) {
   const be = effective(b);
   const ae = effective(a);
   const reasons = [];
+  if (ae.version < be.version) {
+    reasons.push(
+      `policy version lowered ${be.version} \u2192 ${ae.version} \u2014 un-opts this repo from rule graduations gated above ${ae.version}`
+    );
+  }
   for (const name of /* @__PURE__ */ new Set([...Object.keys(be.rules), ...Object.keys(ae.rules)])) {
     const br = be.rules[name];
     const ar = ae.rules[name];
@@ -1232,7 +1259,7 @@ var testDeletion = {
 // src/detectors/snapshot-rewrite.ts
 var RULE8 = "snapshot-rewrite";
-var RUNNER2 = /\b(?:jest|vitest|playwright|ava)\b/;
+var RUNNER = /\b(?:jest|vitest|playwright|ava)\b/;
 var UPDATE_ANY = /--update-?[sS]napshots?\b/;
 var UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
 var REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
@@ -1256,7 +1283,7 @@ var snapshotRewrite = {
         for (const seg of segments(c.raw)) {
           let why = null;
           if (UPDATE_ANY.test(seg)) why = "the snapshot-update flag rewrites every failing snapshot to match current output";
-          else if (RUNNER2.test(seg) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if (RUNNER.test(seg) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
           else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
           else {
             const path = MUTATE.test(seg) ? namesProtectedSnapshot(seg, policy) : null;
@@ -1342,11 +1369,19 @@ import { join as join2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
+function normalizeVersion(v, where = POLICY_FILE) {
+  if (v === void 0 || v === null) return 1;
+  if (typeof v !== "number" || !Number.isInteger(v) || v < 1) {
+    throw new PolicyError(`${where}: version must be a positive integer, got ${JSON.stringify(v)}`);
+  }
+  return v;
+}
 function parsePolicy(raw) {
-  const base = defaultPolicy();
   const r = raw ?? {};
+  const version = normalizeVersion(r.version);
+  const base = defaultPolicy(version);
   return {
-    version: 1,
+    version,
     // Merge with the baseline, never replace. For an integrity tool, a config that sets
     // one rule's severity must NOT silently drop the other nine — nor may naming one
     // protected glob wipe out the rest of its category (see mergeProtected).

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",