tamperward 2.2.1 → 2.3.0

package/dist/cli/index.js

@@ -3907,18 +3907,62 @@ var VERIFICATION_SURFACE = [
   "**/setup.cfg",
   "**/tox.ini",
   "**/pyproject.toml",
+  "**/setup.py",
+  // a pytest rootdir marker, and what an editable install executes
+  // Interpreter start-up hooks: imported by site.py before pytest exists,
+  // wherever the tree reaches sys.path (PYTHONPATH=., an editable install).
+  "**/sitecustomize.py",
+  "**/usercustomize.py",
   // JavaScript / TypeScript runners and the transforms they load
   "**/jest.config.*",
   "**/jest.setup.*",
   "**/vitest.config.*",
   "**/vitest.workspace.*",
   "**/.mocharc.*",
+  "**/mocha.opts",
   "**/karma.conf.*",
+  "**/ava.config.*",
+  "**/.taprc",
+  "**/spec/support/jasmine.json",
+  "**/playwright.config.*",
+  "**/cypress.config.*",
+  "**/.nycrc*",
+  "**/.c8rc*",
   "**/babel.config.*",
   "**/.babelrc*",
   "**/vite.config.*",
   "**/.swcrc",
   "**/package.json",
+  // Package-manager configuration: read before the runner starts, and able to
+  // choose what the runner is started under (`node-options`), which shell runs
+  // the script (`script-shell`), or which program is run at all (`yarn-path`).
+  "**/.npmrc",
+  "**/.yarnrc",
+  "**/.yarnrc.yml",
+  // pnpm 10 reads its settings (`nodeOptions` among them) from here as well,
+  // and its environment layer does NOT outrank this file (verified, pnpm
+  // 10.33) — so the file list is the only control for it.
+  "**/pnpm-workspace.yaml",
+  "**/.pnpmfile.cjs",
+  // The runner the package manager executes when the project pins one: yarn's
+  // `yarnPath` release and its plugins, and the PnP loader every spawned node
+  // is made to `--require`.
+  "**/.yarn/releases/*",
+  "**/.yarn/plugins/**",
+  "**/.pnp.cjs",
+  "**/.pnp.js",
+  "**/.pnp.loader.mjs",
+  // dotenv files: `node --env-file`, a jest/vitest setup that loads dotenv,
+  // pytest-dotenv. An .env carries NODE_OPTIONS as easily as an .npmrc does.
+  "**/.env",
+  "**/.env.*",
+  // Version-manager pins: which interpreter the shims select for this cwd.
+  "**/.nvmrc",
+  "**/.node-version",
+  "**/.python-version",
+  // What git does to content on its way into and out of the tree — the base's
+  // decision, never the candidate's.
+  "**/.gitattributes",
   // Ruby / PHP / .NET
   "**/.rspec",
   "**/phpunit.xml",
@@ -4064,6 +4108,31 @@ const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
 child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
 child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
 `;
+var DROPPED_ENV = /* @__PURE__ */ new Set([
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "NODE_REPL_EXTERNAL_MODULE",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PYTEST_ADDOPTS",
+  "PYTEST_PLUGINS"
+]);
+var PINNED_NPM = /^npm_config_(node_options|userconfig|globalconfig)$/i;
+function suiteEnv(scratch) {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
+    env[k] = v;
+  }
+  const userRc = join11(scratch, "npmrc-user");
+  const globalRc = join11(scratch, "npmrc-global");
+  for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
+  env.npm_config_userconfig = userRc;
+  env.npm_config_globalconfig = globalRc;
+  env.npm_config_node_options = " ";
+  env.YARN_IGNORE_PATH = "1";
+  return env;
+}
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
   const outDir = mkdtempSync2(join11(tmpdir2(), "tw-verify-run-"));
@@ -4071,6 +4140,7 @@ function runSuite(dir, cmd, budgetSecs) {
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
+      env: suiteEnv(outDir),
       stdio: "ignore",
       timeout: budgetSecs * 1e3 + 3e4,
       // backstop only; the supervisor enforces the budget
@@ -4093,6 +4163,10 @@ function runSuite(dir, cmd, budgetSecs) {
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const out2 = (s) => void process.stdout.write(s + "\n");
+  if (opts.invalid) {
+    out2(`verify: ${opts.invalid} \u2014 failing closed`);
+    return 2;
+  }
   let policy;
   try {
     if (opts.policyOverride) policy = opts.policyOverride;
@@ -4236,15 +4310,32 @@ function runVerify(opts) {
 }
 function parseVerify(args) {
   const o = {};
+  const value = (i, flag) => {
+    const v = args[i + 1];
+    if (v === void 0 || v.startsWith("--")) {
+      o.invalid ??= `${flag} needs a value` + (v === void 0 ? "" : ` (got the flag "${v}")`);
+      return void 0;
+    }
+    return v;
+  };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (a === "--base" && args[i + 1]) o.base = args[++i];
-    else if (a === "--cmd" && args[i + 1]) o.cmd = args[++i];
-    else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
-    else if (a === "--json") o.json = true;
+    if (a === "--json") o.json = true;
     else if (a === "--keep") o.keep = true;
     else if (a === "--require-ancestor") o.requireAncestor = true;
-    else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
+    else if (a === "--base" || a === "--cmd" || a === "--cwd" || a === "--budget") {
+      const v = value(i, a);
+      if (v === void 0) continue;
+      i++;
+      if (a === "--base") o.base = v;
+      else if (a === "--cmd") o.cmd = v;
+      else if (a === "--cwd") o.cwd = v;
+      else {
+        o.budget = Number(v);
+        if (!Number.isFinite(o.budget) || o.budget <= 0)
+          o.invalid ??= `--budget needs a positive number of seconds (got "${v}")`;
+      }
+    }
   }
   return o;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",