tamperward 2.10.5 → 2.10.6

package/dist/cli/index.js

@@ -8149,9 +8149,9 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join14, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute9, join as join14, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
@@ -8308,29 +8308,131 @@ function baseIsAncestorOfHead(base, cwd) {
   const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
+function inside(root, path) {
+  const rel = relative4(resolve4(root), resolve4(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute9(rel);
+}
+function linkParts(path) {
+  const parts = sep === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  return parts.filter((part) => part !== "" && part !== ".");
+}
+function linkEscape(label, target) {
+  return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
+}
+function driveRelativeLinkTarget(target) {
+  return sep === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+}
+function rootedLinkTarget(target) {
+  return isAbsolute9(target) || driveRelativeLinkTarget(target);
+}
+function safeSymlink(target, out2, root, label) {
+  if (rootedLinkTarget(target) || !inside(root, resolve4(dirname5(out2), target))) {
+    throw linkEscape(label, target);
+  }
+  rmSync3(out2, { force: true });
+  symlinkSync(target, out2);
+}
+function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
+  let domain = "tree";
+  let stack = linkParts(relative4(root, dirname5(out2)));
+  const pending = linkParts(target);
+  const seen = /* @__PURE__ */ new Set();
+  let hops = 0;
+  while (pending.length) {
+    const part = pending.shift();
+    if (part === "..") {
+      if (!stack.length) throw linkEscape(label, target);
+      stack.pop();
+      continue;
+    }
+    stack.push(part);
+    if (domain === "tree" && dependencyRoot && stack.length === 1 && stack[0] === "node_modules") {
+      domain = "deps";
+      stack = [];
+      continue;
+    }
+    const base = domain === "tree" ? root : dependencyRoot;
+    const current = join14(base, ...stack);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (!st.isSymbolicLink()) continue;
+    if (++hops > 128) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    const key2 = `${domain}:${current}:${pending.join(sep)}`;
+    if (seen.has(key2)) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    seen.add(key2);
+    const next = readlinkSync3(current);
+    stack.pop();
+    if (driveRelativeLinkTarget(next)) {
+      throw linkEscape(label, target);
+    }
+    if (isAbsolute9(next)) {
+      if (domain === "tree" || !dependencyRoot || !inside(dependencyRoot, next)) {
+        throw linkEscape(label, target);
+      }
+      stack = [];
+      pending.unshift(...linkParts(relative4(dependencyRoot, resolve4(next))));
+    } else {
+      pending.unshift(...linkParts(next));
+    }
+  }
+}
+function rejectLinkedParent(cwd, rel) {
+  const parts = rel.split("/").slice(0, -1);
+  let current = cwd;
+  for (const part of parts) {
+    current = join14(current, part);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) {
+      throw new Error(`${rel} has a symlinked parent directory (${relative4(cwd, current)})`);
+    }
+  }
+}
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  const links = [];
   for (const rel of listed) {
     const src = join14(cwd, rel);
+    rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = statSync5(src);
+      st = lstatSync3(src);
     } catch {
       continue;
     }
-    if (!st.isFile()) continue;
     const out2 = join14(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
-    if (lstatSync3(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync14(src));
-    } else {
+    if (st.isSymbolicLink()) {
+      const target = readlinkSync3(src);
+      safeSymlink(target, out2, dest, rel);
+      links.push({ rel, out: out2, target });
+    } else if (st.isFile()) {
       cpSync(src, out2, { dereference: true });
+      chmodSync2(out2, st.mode);
+    } else {
+      throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
-    chmodSync2(out2, st.mode);
   }
   const nm = resolve4(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  let dependencyRoot = null;
+  if (existsSync10(nm)) dependencyRoot = realpathSync3(nm);
+  for (const link of links) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
+  }
+  if (dependencyRoot) symlinkSync(nm, join14(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8382,6 +8484,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const verifierGlobs = policy.verify?.inputs ?? [];
   const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
   const restored = [];
+  const restoredLinks = [];
   const baseProtected = /* @__PURE__ */ new Set();
   for (const e of entries) {
     if (!isOverlay(e.path)) continue;
@@ -8394,7 +8497,9 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
-      symlinkSync(content.toString("utf8"), out2);
+      const target = content.toString("utf8");
+      safeSymlink(target, out2, dest, `the base's ${e.path}`);
+      restoredLinks.push({ path: e.path, out: out2, target });
     } else {
       writeFileSync6(out2, content);
       chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
@@ -8408,6 +8513,11 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     rmSync3(join14(dest, rel), { force: true });
     removed++;
   }
+  const nm = resolve4(cwd, "node_modules");
+  const dependencyRoot = existsSync10(nm) ? realpathSync3(nm) : null;
+  for (const link of restoredLinks) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, `the base's ${link.path}`);
+  }
   return { restored, removed };
 }
 var SUPERVISOR = `
@@ -8666,7 +8776,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync3 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync4 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -8684,7 +8794,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync3(cwd);
+    real = realpathSync4(cwd);
   } catch {
     return out2;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.5",
+  "version": "2.10.6",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",