tamperward 2.10.5 → 2.10.7

package/dist/cli/index.js

@@ -2869,21 +2869,33 @@ import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "no
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute as isAbsolute3, join as join5, posix } from "node:path";
 import { fileURLToPath } from "node:url";
+var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
         const pkg = JSON.parse(readFileSync3(join5(here, rel), "utf8"));
-        if (pkg.name === "tamperward" && pkg.version) return pkg.version;
+        if (pkg.name === "tamperward" && typeof pkg.version === "string" && PLAIN_SEMVER.test(pkg.version)) {
+          return pkg.version;
+        }
       } catch {
       }
     }
   } catch {
   }
-  return "latest";
+  return null;
+}
+var RESOLVED_TW_VERSION = shippedVersion();
+var TW_VERSION = RESOLVED_TW_VERSION ?? "0.0.0-unresolved";
+function requireShippedVersion() {
+  if (RESOLVED_TW_VERSION === null) {
+    throw new Error(
+      "cannot resolve a plain TamperWard release version from package.json; refusing to generate canonical wiring"
+    );
+  }
+  return RESOLVED_TW_VERSION;
 }
-var TW_VERSION = shippedVersion();
 var PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
 var PRE_MATCHER = PRE_TOOLS.join("|");
 var MARKER = "# tamperward: block agent shortcuts before they land";
@@ -2893,7 +2905,6 @@ var HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook claude${AUTHORITY
 var SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep claude${AUTHORITY_FAIL_CLOSED}`;
 var PRECOMMIT_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} check --staged`;
 var OURS = /^\s*npx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (?:(hook claude|sweep claude) \|\| \(echo tamperward: authority failed to start >&2 && exit 2\)|(check --staged))\s*$/;
-var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
   const pa = a.split(".").map(Number);
@@ -8092,6 +8103,7 @@ function planned(item, path, plan) {
   }
 }
 function planInit(cwd, opts = {}) {
+  requireShippedVersion();
   return [
     planned("policy", POLICY_FILE, () => planPolicy(cwd)),
     planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
@@ -8149,9 +8161,9 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join14, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute9, join as join14, relative as relative4, resolve as resolve4, sep } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
@@ -8308,29 +8320,131 @@ function baseIsAncestorOfHead(base, cwd) {
   const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
+function inside(root, path) {
+  const rel = relative4(resolve4(root), resolve4(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute9(rel);
+}
+function linkParts(path) {
+  const parts = sep === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  return parts.filter((part) => part !== "" && part !== ".");
+}
+function linkEscape(label, target) {
+  return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
+}
+function driveRelativeLinkTarget(target) {
+  return sep === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+}
+function rootedLinkTarget(target) {
+  return isAbsolute9(target) || driveRelativeLinkTarget(target);
+}
+function safeSymlink(target, out2, root, label) {
+  if (rootedLinkTarget(target) || !inside(root, resolve4(dirname5(out2), target))) {
+    throw linkEscape(label, target);
+  }
+  rmSync3(out2, { force: true });
+  symlinkSync(target, out2);
+}
+function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
+  let domain = "tree";
+  let stack = linkParts(relative4(root, dirname5(out2)));
+  const pending = linkParts(target);
+  const seen = /* @__PURE__ */ new Set();
+  let hops = 0;
+  while (pending.length) {
+    const part = pending.shift();
+    if (part === "..") {
+      if (!stack.length) throw linkEscape(label, target);
+      stack.pop();
+      continue;
+    }
+    stack.push(part);
+    if (domain === "tree" && dependencyRoot && stack.length === 1 && stack[0] === "node_modules") {
+      domain = "deps";
+      stack = [];
+      continue;
+    }
+    const base = domain === "tree" ? root : dependencyRoot;
+    const current = join14(base, ...stack);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (!st.isSymbolicLink()) continue;
+    if (++hops > 128) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    const key2 = `${domain}:${current}:${pending.join(sep)}`;
+    if (seen.has(key2)) {
+      throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
+    }
+    seen.add(key2);
+    const next = readlinkSync3(current);
+    stack.pop();
+    if (driveRelativeLinkTarget(next)) {
+      throw linkEscape(label, target);
+    }
+    if (isAbsolute9(next)) {
+      if (domain === "tree" || !dependencyRoot || !inside(dependencyRoot, next)) {
+        throw linkEscape(label, target);
+      }
+      stack = [];
+      pending.unshift(...linkParts(relative4(dependencyRoot, resolve4(next))));
+    } else {
+      pending.unshift(...linkParts(next));
+    }
+  }
+}
+function rejectLinkedParent(cwd, rel) {
+  const parts = rel.split("/").slice(0, -1);
+  let current = cwd;
+  for (const part of parts) {
+    current = join14(current, part);
+    let st;
+    try {
+      st = lstatSync3(current);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) {
+      throw new Error(`${rel} has a symlinked parent directory (${relative4(cwd, current)})`);
+    }
+  }
+}
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  const links = [];
   for (const rel of listed) {
     const src = join14(cwd, rel);
+    rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = statSync5(src);
+      st = lstatSync3(src);
     } catch {
       continue;
     }
-    if (!st.isFile()) continue;
     const out2 = join14(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
-    if (lstatSync3(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync14(src));
-    } else {
+    if (st.isSymbolicLink()) {
+      const target = readlinkSync3(src);
+      safeSymlink(target, out2, dest, rel);
+      links.push({ rel, out: out2, target });
+    } else if (st.isFile()) {
       cpSync(src, out2, { dereference: true });
+      chmodSync2(out2, st.mode);
+    } else {
+      throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
-    chmodSync2(out2, st.mode);
   }
   const nm = resolve4(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  let dependencyRoot = null;
+  if (existsSync10(nm)) dependencyRoot = realpathSync3(nm);
+  for (const link of links) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
+  }
+  if (dependencyRoot) symlinkSync(nm, join14(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8382,6 +8496,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const verifierGlobs = policy.verify?.inputs ?? [];
   const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c)) || matchesAny(p, VERIFICATION_SURFACE) || verifierOwned.has(p) || verifierGlobs.length > 0 && matchesAny(p, verifierGlobs);
   const restored = [];
+  const restoredLinks = [];
   const baseProtected = /* @__PURE__ */ new Set();
   for (const e of entries) {
     if (!isOverlay(e.path)) continue;
@@ -8394,7 +8509,9 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
-      symlinkSync(content.toString("utf8"), out2);
+      const target = content.toString("utf8");
+      safeSymlink(target, out2, dest, `the base's ${e.path}`);
+      restoredLinks.push({ path: e.path, out: out2, target });
     } else {
       writeFileSync6(out2, content);
       chmodSync2(out2, parseInt(e.mode.slice(-4), 8) & 511);
@@ -8408,6 +8525,11 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     rmSync3(join14(dest, rel), { force: true });
     removed++;
   }
+  const nm = resolve4(cwd, "node_modules");
+  const dependencyRoot = existsSync10(nm) ? realpathSync3(nm) : null;
+  for (const link of restoredLinks) {
+    validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, `the base's ${link.path}`);
+  }
   return { restored, removed };
 }
 var SUPERVISOR = `
@@ -8666,7 +8788,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync3 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync4 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -8684,7 +8806,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync3(cwd);
+    real = realpathSync4(cwd);
   } catch {
     return out2;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.5",
+  "version": "2.10.7",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",