tamperward 1.8.0 → 1.9.0

package/dist/cli/index.js

@@ -1014,6 +1014,24 @@ function policyWeakening(before, after) {
   if (be.requiredFor.includes("block") && !new Set(ae.requiredFor).has("block")) {
     reasons.push("sign-off no longer required for blocking findings");
   }
+  const bv = b.verify;
+  const av = a.verify;
+  if (bv?.command) {
+    if (!av?.command) {
+      reasons.push("verify block removed \u2014 pristine-suite re-execution disabled");
+    } else {
+      if (av.command !== bv.command) {
+        reasons.push(
+          `verify.command changed ("${bv.command}" \u2192 "${av.command}") \u2014 the re-executed suite is no longer the one that was configured`
+        );
+      }
+      const bb = bv.budget ?? 300;
+      const ab = av.budget ?? 300;
+      if (ab < bb) {
+        reasons.push(`verify.budget lowered ${bb}s \u2192 ${ab}s \u2014 starving the budget turns "cannot verify" into a pressure point`);
+      }
+    }
+  }
   return reasons;
 }
 
@@ -1511,7 +1529,8 @@ function parsePolicy(raw) {
     signoff: {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
-    }
+    },
+    ...r.verify?.command ? { verify: { command: r.verify.command, budget: r.verify.budget ?? 300 } } : {}
   };
 }
 function parseOrThrow(src, where) {
@@ -2728,6 +2747,171 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
   return 0;
 }
 
+// src/cli/verify.ts
+import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
+import { chmodSync as chmodSync2, cpSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname4, join as join9 } from "node:path";
+var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
+function git2(args, cwd) {
+  return execFileSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
+}
+function resolveBase(base, cwd) {
+  const rev = git2(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
+  try {
+    return git2(["merge-base", rev, "HEAD"], cwd).trim();
+  } catch {
+    return rev;
+  }
+}
+function materialize(cwd, dest) {
+  const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  for (const rel of listed) {
+    const src = join9(cwd, rel);
+    let st;
+    try {
+      st = statSync5(src);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    const out = join9(dest, rel);
+    mkdirSync6(dirname4(out), { recursive: true });
+    cpSync(src, out);
+    chmodSync2(out, st.mode);
+  }
+  const nm = join9(cwd, "node_modules");
+  if (existsSync8(nm)) symlinkSync(nm, join9(dest, "node_modules"), "dir");
+}
+function overlayPristine(cwd, base, dest, policy) {
+  const atBase = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd).split("\0").filter(Boolean);
+  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c));
+  let restored = 0;
+  const baseProtected = /* @__PURE__ */ new Set();
+  for (const rel of atBase) {
+    if (!isOverlay(rel)) continue;
+    baseProtected.add(rel);
+    const content = execFileSync4("git", ["show", `${base}:${rel}`], { cwd, maxBuffer: 1 << 28 });
+    const out = join9(dest, rel);
+    mkdirSync6(dirname4(out), { recursive: true });
+    writeFileSync6(out, content);
+    restored++;
+  }
+  let kept = 0;
+  const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  for (const rel of inCopy) if (isOverlay(rel) && !baseProtected.has(rel)) kept++;
+  return [restored, kept];
+}
+function runSuite(dir, cmd, budgetSecs) {
+  const t0 = Date.now();
+  const r = spawnSync("sh", ["-c", cmd], {
+    cwd: dir,
+    stdio: "ignore",
+    timeout: budgetSecs * 1e3,
+    killSignal: "SIGKILL"
+  });
+  const secs = Math.round((Date.now() - t0) / 1e3);
+  if (r.error && r.error.code === "ETIMEDOUT") return { exit: null, secs };
+  if (r.status === null && r.signal) return { exit: null, secs };
+  return { exit: r.status ?? 2, secs };
+}
+function runVerify(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const out = (s) => void process.stdout.write(s + "\n");
+  let policy;
+  try {
+    policy = loadPolicy(cwd);
+  } catch (e) {
+    out(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const cmd = opts.cmd ?? policy.verify?.command;
+  if (!cmd) {
+    out("verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd");
+    return 2;
+  }
+  const budget = opts.budget ?? policy.verify?.budget ?? 300;
+  let base;
+  try {
+    base = resolveBase(opts.base ?? "HEAD", cwd);
+  } catch {
+    out(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
+    return 2;
+  }
+  const work = mkdtempSync2(join9(tmpdir2(), "tw-verify-"));
+  const visDir = join9(work, "visible");
+  const priDir = join9(work, "pristine");
+  let restored = 0;
+  let kept = 0;
+  try {
+    mkdirSync6(visDir);
+    mkdirSync6(priDir);
+    materialize(cwd, visDir);
+    materialize(cwd, priDir);
+    [restored, kept] = overlayPristine(cwd, base, priDir, policy);
+  } catch (e) {
+    if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+    out(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const visible = runSuite(visDir, cmd, budget);
+  const pristine = runSuite(priDir, cmd, budget);
+  if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+  let verdict2;
+  let code;
+  if (visible.exit === null || pristine.exit === null) {
+    verdict2 = "BUDGET_EXCEEDED";
+    code = 2;
+  } else if (visible.exit === 0 && pristine.exit === 0) {
+    verdict2 = "VERIFIED";
+    code = 0;
+  } else if (visible.exit === 0) {
+    verdict2 = "MASKED_FAILURE";
+    code = 1;
+  } else {
+    verdict2 = "SUITE_RED";
+    code = 1;
+  }
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        verdict: verdict2,
+        base,
+        command: cmd,
+        budget_secs: budget,
+        visible: { exit: visible.exit, secs: visible.secs },
+        pristine: { exit: pristine.exit, secs: pristine.secs },
+        protected_restored: restored,
+        added_protected_kept: kept,
+        ...opts.keep ? { workdir: work } : {}
+      })
+    );
+  } else {
+    const lines = {
+      VERIFIED: `verified: the suite passes, and still passes with all ${restored} protected files restored from ${base.slice(0, 10)}.`,
+      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
+      SUITE_RED: `suite red: the visible suite fails (exit ${visible.exit}) \u2014 fix the code first (pristine exit ${pristine.exit}).`,
+      BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
+    };
+    out(`tamperward verify \u2014 ${lines[verdict2]}`);
+    if (kept > 0) out(`(${kept} protected file(s) added since ${base.slice(0, 10)} were kept in the pristine run.)`);
+  }
+  return code;
+}
+function parseVerify(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--base" && args[i + 1]) o.base = args[++i];
+    else if (a === "--cmd" && args[i + 1]) o.cmd = args[++i];
+    else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
+    else if (a === "--json") o.json = true;
+    else if (a === "--keep") o.keep = true;
+    else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
+  }
+  return o;
+}
+
 // src/cli/index.ts
 function parseAllow(args) {
   const o = {};
@@ -2803,6 +2987,11 @@ Formats:
   tamperward watch [--dir D] [--log F]      filesystem-event observer daemon: records
                                             protected-file events so the sweep can
                                             observe supported transient effects
+  tamperward verify [--base R] [--cmd C]    pristine-suite re-execution: run the suite
+             [--budget S] [--json] [--keep] as-is AND with protected files restored
+                                            from the trusted base; a visible-green /
+                                            pristine-red result is a MASKED FAILURE
+                                            (exit 1); cannot-verify fails closed (2)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
   tamperward init [--dry-run]               wire the policy file plus every
                                             enforcement point: Claude Code hooks,
@@ -2826,6 +3015,8 @@ function main(argv2) {
       return runAllow(parseAllow(rest));
     case "init":
       return runInit(parseInit(rest));
+    case "verify":
+      return runVerify(parseVerify(rest));
     case void 0:
     case "-h":
     case "--help":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",