tamperward 2.10.6 → 2.10.8

package/dist/cli/index.js

@@ -2869,21 +2869,33 @@ import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "no
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute as isAbsolute3, join as join5, posix } from "node:path";
 import { fileURLToPath } from "node:url";
+var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
         const pkg = JSON.parse(readFileSync3(join5(here, rel), "utf8"));
-        if (pkg.name === "tamperward" && pkg.version) return pkg.version;
+        if (pkg.name === "tamperward" && typeof pkg.version === "string" && PLAIN_SEMVER.test(pkg.version)) {
+          return pkg.version;
+        }
       } catch {
       }
     }
   } catch {
   }
-  return "latest";
+  return null;
+}
+var RESOLVED_TW_VERSION = shippedVersion();
+var TW_VERSION = RESOLVED_TW_VERSION ?? "0.0.0-unresolved";
+function requireShippedVersion() {
+  if (RESOLVED_TW_VERSION === null) {
+    throw new Error(
+      "cannot resolve a plain TamperWard release version from package.json; refusing to generate canonical wiring"
+    );
+  }
+  return RESOLVED_TW_VERSION;
 }
-var TW_VERSION = shippedVersion();
 var PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
 var PRE_MATCHER = PRE_TOOLS.join("|");
 var MARKER = "# tamperward: block agent shortcuts before they land";
@@ -2893,7 +2905,6 @@ var HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook claude${AUTHORITY
 var SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep claude${AUTHORITY_FAIL_CLOSED}`;
 var PRECOMMIT_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} check --staged`;
 var OURS = /^\s*npx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (?:(hook claude|sweep claude) \|\| \(echo tamperward: authority failed to start >&2 && exit 2\)|(check --staged))\s*$/;
-var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
   const pa = a.split(".").map(Number);
@@ -7652,7 +7663,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
       # Install the authority before candidate files exist in the job workspace.
@@ -7662,9 +7673,12 @@ jobs:
       - name: Install Tamperward authority
         working-directory: \${{ runner.temp }}
         run: npm install --global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward@${TW_VERSION}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0 # the range diff needs both endpoints
+          # Candidate code runs later in this job. Do not leave the checkout
+          # token in .git/config where a verifier command can read/reuse it.
+          persist-credentials: false
       - name: Resolve out-of-band sign-off from PR labels
         id: oob
         env:
@@ -8092,6 +8106,7 @@ function planned(item, path, plan) {
   }
 }
 function planInit(cwd, opts = {}) {
+  requireShippedVersion();
   return [
     planned("policy", POLICY_FILE, () => planPolicy(cwd)),
     planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.6",
+  "version": "2.10.8",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",