tamperward 2.10.0 → 2.10.1

package/dist/cli/index.js

@@ -4626,6 +4626,61 @@ function repoRelative(path, ctx) {
   const rel = relative(ctx.cwd, path);
   return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
+var HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
+var HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
+var HUSKY_H_KNOWN = [
+  // husky 9.1.x
+  `#!/usr/bin/env sh
+[ "$HUSKY" = "2" ] && set -x
+n=$(basename "$0")
+s=$(dirname "$(dirname "$0")")/$n
+
+[ ! -f "$s" ] && exit 0
+
+if [ -f "$HOME/.huskyrc" ]; then
+	echo "husky - '~/.huskyrc' is DEPRECATED, please move your code to ~/.config/husky/init.sh"
+fi
+i="\${XDG_CONFIG_HOME:-$HOME/.config}/husky/init.sh"
+[ -f "$i" ] && . "$i"
+
+[ "\${HUSKY-}" = "0" ] && exit 0
+
+export PATH="node_modules/.bin:$PATH"
+sh -e "$s" "$@"
+c=$?
+
+[ $c != 0 ] && echo "husky - $n script failed (code $c)"
+[ $c = 127 ] && echo "husky - command not found in PATH=$PATH"
+exit $c
+`
+];
+var HUSKY_DEPRECATION = `echo "husky - DEPRECATED
+
+Please remove the following two lines from $0:
+
+#!/usr/bin/env sh
+. \\"\\$(dirname -- \\"\\$0\\")/_/husky.sh\\"
+
+They WILL FAIL in v10.0.0
+"`;
+var stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
+function huskyRuntimeWrite(path, content, ctx) {
+  const m = path.match(/(?:^|\/)\.husky\/_\/([^/]+)$/);
+  if (!m || content == null) return false;
+  const name = m[1];
+  const body = stripTrailingNl(content);
+  const ok = name === ".gitignore" ? body === "*" : name === "h" ? HUSKY_H_KNOWN.some((t) => stripTrailingNl(t) === body) : name === "husky.sh" ? stripTrailingNl(HUSKY_DEPRECATION) === body : HUSKY_SHIM_NAMES.has(name) && body === HUSKY_SHIM;
+  if (!ok) return false;
+  if (!ctx?.cwd) return false;
+  const root = path.slice(0, path.length - m[0].length + (m[0].startsWith("/") ? 1 : 0));
+  const entry = inspectRel(join3(ctx.cwd, root), ".husky/pre-commit");
+  if (entry.kind !== "file") return false;
+  const gate = textOf(entry);
+  if (gate == null) return false;
+  return invocations(gate.split("\n"), { errexit: true }).some(
+    (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
+  );
+}
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
 var isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
 var hookTampering = {
@@ -4700,6 +4755,7 @@ var hookTampering = {
         } else if ((isLefthook(c.path) || isPreCommitConfig(c.path)) && (semantic = configFindings(c, changes, policy, ctx)) !== null) {
           out2.push(...semantic);
         } else if (!c.path.endsWith(POLICY_FILE)) {
+          if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
           const husky = isHuskyScript(c.path);
           const opts = husky ? { errexit: true } : {};
           const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.0",
+  "version": "2.10.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",