tamperward 2.23.0 → 2.23.2

package/dist/cli/index.js

@@ -10436,7 +10436,7 @@ function planInit(cwd, opts = {}) {
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const plan = planInit(cwd, { forceWorkflow: opts.forceWorkflow });
-  const w = process.stdout;
+  const w = opts.quiet ? { write: (_text) => true } : process.stdout;
   let applied = 0;
   for (const a of plan) {
     if (!opts.dryRun && a.apply) {
@@ -14621,7 +14621,7 @@ import { execFileSync as execFileSync12 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { lstatSync as lstatSync9, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join22, resolve as resolve10, sep as sep5 } from "node:path";
+import { join as join22, relative as relative7, resolve as resolve10, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
 import { parseDocument } from "yaml";
 function readlineAsker(input, output) {
@@ -14651,6 +14651,23 @@ function readlineAsker(input, output) {
   };
   return ask;
 }
+function paint2(text, code2, on) {
+  return on ? code2 + text + RESET2 : text;
+}
+function terminalText(text) {
+  return stripControl(text).replace(/\s+/g, " ").trim();
+}
+function committableSetupPath(cwd, path) {
+  const rel = relative7(cwd, resolve10(cwd, path));
+  if (!rel || rel === ".." || rel.startsWith(".." + sep5)) return false;
+  return rel !== ".git" && !rel.startsWith(".git" + sep5);
+}
+function platformLabel(platform) {
+  if (platform === "darwin") return "macOS";
+  if (platform === "win32") return "Windows";
+  if (platform === "linux") return "Linux";
+  return platform;
+}
 function git5(cwd, args) {
   try {
     return execFileSync12("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
@@ -14662,27 +14679,13 @@ function explainVerdict(v, code2) {
   const verdict2 = v?.verdict ?? (code2 === 0 ? "VERIFIED" : code2 === 1 ? "SUITE_RED" : "CANNOT_VERIFY");
   switch (verdict2) {
     case "VERIFIED":
-      return [
-        "VERIFIED: your suite passes, and still passes with every protected test, snapshot and",
-        "config file restored from the base. Nothing was masked. Exit 0."
-      ];
+      return "Verification passed \u2014 visible and pristine suites are green.";
     case "SUITE_RED":
-      return [
-        "SUITE_RED: your suite fails as it is. That is not a TamperWard finding \u2014 fix the code",
-        "(or the suite) first; verify exits 1 until the visible run is green."
-      ];
+      return "Your test suite is red. Fix it, then run verification again.";
     case "MASKED_FAILURE":
-      return [
-        "MASKED_FAILURE: your suite passes as it is, but FAILS once the protected files are restored",
-        "from the base. Something weakened the checks; the code does not pass the original suite.",
-        "Exit 1. In CI only a reviewer label (`tamperward:allow:verify@<head-sha>`) clears it."
-      ];
+      return "Verification blocked \u2014 the visible suite passes, but the pristine suite fails.";
     default:
-      return [
-        `CANNOT VERIFY${v?.reason ? ` (${v.reason})` : ""}: TamperWard could not verify this repository and fails closed`,
-        "(exit 2) rather than reporting success. Nothing above is a verdict about your code.",
-        ...v?.detail ? [`  ${v.detail}`] : []
-      ];
+      return `Could not verify${v?.reason ? ` (${v.reason})` : ""} \u2014 TamperWard failed closed${v?.detail ? `: ${v.detail}` : "."}`;
   }
 }
 function atomicReplaceFile(path, content, mode) {
@@ -14724,10 +14727,11 @@ function writeVerifyCommand(cwd, command) {
   }
 }
 async function runOnboard(opts, io = {}) {
-  const cwd = resolve10(opts.cwd ?? process.cwd());
+  const requestedCwd = resolve10(opts.cwd ?? process.cwd());
   const out3 = io.out ?? ((line) => void process.stdout.write(line + "\n"));
-  const err3 = (line) => void process.stderr.write(line + "\n");
+  const rawErr = (line) => void process.stderr.write(terminalText(line) + "\n");
   const platform = io.platform ?? process.platform;
+  const colour = io.colour ?? colourEnabled(process.env, process.stdout);
   const runners = {
     init: runInit,
     verify: runVerify,
@@ -14737,35 +14741,60 @@ async function runOnboard(opts, io = {}) {
   };
   const interactive = io.interactive ?? (Boolean(process.stdin.isTTY) && !process.env.CI && !process.env.GITHUB_ACTIONS);
   const scripted = Boolean(opts.yes);
+  const tone = (kind) => {
+    if (kind === "ok") return GREEN2;
+    if (kind === "warn") return YELLOW2;
+    if (kind === "bad") return RED2;
+    if (kind === "info") return CYAN;
+    return DIM2;
+  };
+  const status = (label, text, kind = "info") => {
+    out3(paint2(label.padEnd(8), (kind === "bad" ? BOLD2 : "") + tone(kind), colour) + " " + terminalText(text));
+  };
+  const fail = (text) => rawErr(paint2("ERROR   ", BOLD2 + RED2, colour) + " " + text);
   if (!interactive && !scripted) {
-    err3("tamperward onboard: stdin is not interactive (or a CI environment was detected), so the guided");
-    err3("setup cannot ask questions. Re-run with --yes for the scripted mode (add --verify-command");
-    err3('"<suite command>" to configure verification; a detected command is never written unscripted),');
-    err3("or run the deterministic primitive directly: tamperward init.");
+    fail("onboard needs an interactive terminal.");
+    rawErr('Use `tamperward onboard --yes --verify-command "<suite command>"` for scripted setup,');
+    rawErr("or run `tamperward init` for the deterministic wiring step only.");
     return 2;
   }
-  if (!isGitRepo(cwd)) {
-    err3(`tamperward onboard: ${cwd} is not inside a git repository \u2014 run \`git init\` first; every enforcement point is git-anchored`);
+  const rootText = git5(requestedCwd, ["rev-parse", "--show-toplevel"])?.trim() ?? "";
+  if (!rootText) {
+    fail(requestedCwd + " is not inside a Git repository. Run `git init` first.");
+    return 2;
+  }
+  const cwd = resolve10(rootText);
+  let sameRoot = cwd === requestedCwd;
+  try {
+    sameRoot = realpathSync9(cwd) === realpathSync9(requestedCwd);
+  } catch {
+  }
+  if (!sameRoot) {
+    fail("current directory is not the Git repository root.");
+    rawErr("Current: " + requestedCwd);
+    rawErr("Git root: " + cwd);
+    rawErr("TamperWard installs repository-wide hooks and CI, so it will not mix a child directory with its parent repository.");
+    rawErr("Run from the Git root, or run `git init` in the child directory if it should be a separate repository.");
     return 2;
   }
   const prompt = { asker: null };
   const rawAsk = io.ask ?? ((q) => (prompt.asker ??= readlineAsker(process.stdin, process.stdout))(q));
   const ask = async (question) => {
-    const answer = await rawAsk(question);
+    const answer = await rawAsk(terminalText(question) + (question.endsWith(" ") ? " " : ""));
     if (answer === null) throw new Aborted();
     return answer.trim();
   };
   const confirm = async (question, fallback, scriptedAnswer) => {
     if (scripted) return scriptedAnswer;
-    const a = (await ask(`${question} ${fallback ? "[Y/n]" : "[y/N]"} `)).toLowerCase();
+    const a = (await ask(question + " " + (fallback ? "[Y/n]" : "[y/N]") + " ")).toLowerCase();
     if (a === "") return fallback;
     return a === "y" || a === "yes";
   };
-  let step = 0;
-  const header = (n) => {
-    step = n;
+  let sectionNo = 0;
+  const section = (n) => {
+    sectionNo = n;
     out3("");
-    out3(`== ${n}/${STEPS.length} ${STEPS[n - 1]} ==`);
+    out3(paint2(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD2 + CYAN, colour));
   };
   const wrote = [];
   let verifyCommand;
@@ -14775,188 +14804,180 @@ async function runOnboard(opts, io = {}) {
   let declined = false;
   let doctorOutcome = null;
   try {
-    header(1);
-    out3(`TamperWard ${TW_VERSION} on Node ${process.versions.node} (${platform}/${process.arch}), repository ${cwd}`);
+    out3(paint2("TamperWard onboarding", BOLD2, colour));
+    out3(paint2("v" + TW_VERSION + " \xB7 Node " + process.versions.node + " \xB7 " + platformLabel(platform) + "/" + process.arch, DIM2, colour));
+    out3(paint2(terminalText(cwd), DIM2, colour));
+    section(1);
     const lifecycle = lifecyclePlatformCheck(platform);
-    out3(`platform: [${lifecycle.state}] ${lifecycle.detail}`);
     const localVerifySupported = localVerifierShell(platform, "true") !== null;
-    if (!localVerifySupported) {
-      out3("platform: checkpointed-local verify is unsupported here; only a digest-pinned container verifier");
-      out3("  (verify.backend: container) can verify on this platform, exactly as the support contract states.");
+    if (platform === "linux" && lifecycle.state === "OK") {
+      status("OK", "Full check / verify / run support is available.", "ok");
+    } else if (localVerifySupported) {
+      status("LIMITED", platformLabel(platform) + ": check + verify work here; `tamperward run` requires Linux in this release.", "warn");
+    } else {
+      status("LIMITED", platformLabel(platform) + ": check works here; local verify and `run` are unavailable. Use the container verifier for final verification.", "warn");
     }
     const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
+    const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
+    const dirty = treeStatus.split("\n").filter(Boolean).map((line) => line.slice(3).split(" -> ").at(-1) ?? "");
     if (!head) {
-      out3("history: no commit yet. Verification and the demonstration need a committed base; the wiring can still be written.");
-    }
-    const status = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
-    const dirty = status.split("\n").filter(Boolean).map((line) => line.slice(3).split(" -> ").at(-1) ?? "");
-    const owned = new Set(planInit(cwd).map((a) => a.path));
-    const foreign = dirty.filter((p) => !owned.has(p));
-    if (dirty.length && foreign.length === 0) {
-      out3(`working tree: ${dirty.length} uncommitted path(s), all written by init \u2014 commit them so the gate travels with the repository.`);
-    } else if (dirty.length) {
-      out3(`working tree is not clean: ${dirty.length} changed or untracked path(s). Onboarding never stashes,`);
-      out3("resets or edits your changes, but a clean tree makes the first verification easier to read:");
-      out3("commit or stash your work first for the cleanest result.");
-      if (!await confirm("Continue with a dirty working tree?", false, true)) {
-        out3("Stopped before writing anything. Commit or stash your work, then re-run: tamperward onboard");
-        return 2;
-      }
+      const count = dirty.length;
+      status(
+        "ACTION",
+        count ? "No first commit yet; " + count + " path(s) are not part of a committed baseline. Create the initial commit before pristine verification or the safe demo." : "No first commit yet. Create the initial commit before pristine verification or the safe demo.",
+        "warn"
+      );
     } else {
-      out3("working tree: clean");
+      const owned = new Set(planInit(cwd).map((a) => a.path));
+      const foreign = dirty.filter((p) => !owned.has(p));
+      if (dirty.length === 0) {
+        status("OK", "Working tree is clean.", "ok");
+      } else if (foreign.length === 0) {
+        status("ACTION", dirty.length + " uncommitted setup file(s) from TamperWard; commit them when setup is complete.", "warn");
+      } else {
+        status("ACTION", dirty.length + " existing changed/untracked path(s). TamperWard will not stash or reset them.", "warn");
+        if (!await confirm("Continue with the existing working-tree changes?", false, true)) {
+          status("STOPPED", "Commit or stash your work, then re-run `tamperward onboard`.", "warn");
+          return 2;
+        }
+      }
     }
-    header(2);
-    out3("This is the plan `tamperward init` would apply (the same planner as `init --dry-run`):");
-    out3("");
-    runners.init({ cwd, dryRun: true });
-    out3("");
-    out3("What each item is for:");
-    out3(`  policy      \u2014 ${POLICY_FILE} holds your overrides; the baseline rules apply even without it.`);
-    out3("  agent hooks \u2014 Claude Code PreToolUse deny + Stop sweep: the steering layer, judged in the loop.");
-    out3("  pre-commit  \u2014 the same engine over the staged diff, so a shortcut cannot be committed quietly.");
-    out3("  CI          \u2014 the authority for the protected branch: check --diff over the PR range plus");
-    out3("                pristine verify; cleared only by a reviewer label bound to the head SHA.");
-    out3("  CODEOWNERS  \u2014 a human requirement on the paths that decide whether the gate runs at all.");
+    section(2);
     const plan = planInit(cwd);
+    const names = {
+      policy: "Policy",
+      agent: "Claude hooks",
+      "pre-commit": "Pre-commit",
+      ci: "CI workflow",
+      codeowners: "CODEOWNERS"
+    };
+    const renderPlan = (a) => {
+      const name = (names[a.item] ?? a.item).padEnd(13);
+      if (a.status === "ok") status("OK", name + " " + a.path, "ok");
+      else if (a.status === "create") status("ADD", name + " " + a.path, "info");
+      else if (a.status === "update") status("UPDATE", name + " " + a.path, "info");
+      else if (a.status === "skip") status("ACTION", name + " " + a.path + " \u2014 " + a.detail, "warn");
+      else status("ERROR", name + " " + a.path + " \u2014 " + a.detail, "bad");
+      if (a.warning) status("ACTION", a.warning, "warn");
+    };
+    plan.forEach(renderPlan);
     const pending = plan.filter((a) => a.apply).length;
-    const errors = plan.filter((a) => a.status === "error").length;
+    const planAttention = plan.filter((a) => a.status === "error" || a.status === "skip").length;
     if (pending === 0) {
-      out3("");
-      out3(errors ? "Nothing to write, but item(s) above need your attention." : "Everything is already wired \u2014 nothing to write.");
-    } else {
-      out3("");
-      out3("init never overwrites a file you wrote: it creates what is absent and merges what is shared.");
-      if (!await confirm(`Write these ${pending} change(s) now?`, false, true)) {
-        declined = true;
-        out3("Declined: nothing was written. Re-run `tamperward onboard` when ready, or apply the plan");
-        out3("yourself with `tamperward init` (`--dry-run` prints it again).");
+      status(
+        planAttention ? "ACTION" : "OK",
+        planAttention ? "Local protection still needs the item(s) above." : "Local protection is already wired.",
+        planAttention ? "warn" : "ok"
+      );
+    } else if (await confirm("Apply " + pending + " setup change(s)?", true, true)) {
+      const code2 = runners.init({ cwd, quiet: true });
+      const afterPlan = planInit(cwd);
+      const remainingItems = new Set(afterPlan.filter((a) => a.status !== "ok").map((a) => a.item));
+      wrote.push(
+        ...plan.filter((a) => a.apply && !remainingItems.has(a.item)).map((a) => a.path)
+      );
+      const remaining = afterPlan.filter((a) => a.status !== "ok");
+      if (code2 === 0 && remaining.length === 0) {
+        status("OK", "Applied " + pending + " setup change(s).", "ok");
+      } else {
+        status("ACTION", "Applied what was safe; some setup items still need attention.", "warn");
+        remaining.forEach(renderPlan);
       }
+    } else {
+      declined = true;
+      status("SKIP", "No setup files were changed.", "dim");
     }
-    if (!declined && pending > 0) {
-      header(3);
-      const code2 = runners.init({ cwd });
-      wrote.push(...plan.filter((a) => a.apply).map((a) => a.path));
-      if (code2 !== 0) out3("init reported item(s) that need your attention (above); onboarding continues so you can see the rest.");
-    }
-    if (!declined) {
-      header(4);
-      let configured;
-      try {
-        configured = loadPolicy(cwd).verify?.command?.trim() || void 0;
-      } catch (e) {
-        out3(`${POLICY_FILE} does not load (${errorMessage(e)}); fix it, then re-run. verify.command was not configured.`);
-      }
-      if (configured) {
-        out3(`verification configured \u2014 ${configured}`);
-        verifyCommand = configured;
-      } else {
-        out3("The verifier command is part of the trust anchor: `verify` re-runs it against a pristine copy of");
-        out3("your suite, and CI fails closed without it. TamperWard never chooses it for you.");
-        const candidates = verifierCandidates(cwd);
-        let chosen;
-        if (scripted) {
-          if (opts.verifyCommand?.trim()) {
-            chosen = opts.verifyCommand.trim();
-          } else {
-            out3(candidates.length ? `Detected candidate(s): ${candidates.join(", ")}.` : "No suite command was detected.");
-            out3('Scripted mode: verify.command was not written. Pass --verify-command "<suite command>" to set it explicitly.');
-          }
-        } else if (candidates.length === 1) {
-          out3(`Detected one high-confidence suite command: ${candidates[0]}`);
-          if (await confirm(`Use \`${candidates[0]}\` as verify.command?`, false, false)) chosen = candidates[0];
-          else chosen = await ask("Enter the suite command to trust (empty to skip): ") || void 0;
-        } else if (candidates.length > 1) {
-          out3("Several suite commands were detected; choose the one that defines merge authority:");
-          candidates.forEach((c, i) => out3(`  ${i + 1}. ${c}`));
-          const a = await ask(`Choose 1-${candidates.length} (${candidates.join(" / ")}), type a command, or press Enter to skip: `);
-          const n = Number(a);
-          chosen = a === "" ? void 0 : Number.isInteger(n) && n >= 1 && n <= candidates.length ? candidates[n - 1] : a;
+    section(3);
+    let configured;
+    try {
+      configured = loadPolicy(cwd).verify?.command?.trim() || void 0;
+    } catch (e) {
+      status("ERROR", POLICY_FILE + " does not load \u2014 " + errorMessage(e), "bad");
+    }
+    if (configured) {
+      verifyCommand = configured;
+      status("OK", "Trusted test command: " + configured, "ok");
+    } else if (!declined) {
+      const candidates = verifierCandidates(cwd);
+      let chosen;
+      if (scripted) {
+        if (opts.verifyCommand?.trim()) {
+          chosen = opts.verifyCommand.trim();
         } else {
-          out3("No suite command was detected (no test script, pytest/tox config, Cargo or Go module root).");
-          chosen = await ask("Enter the suite command to trust (empty to skip): ") || void 0;
+          status("ACTION", 'No trusted test command configured. Pass --verify-command "<suite command>".', "warn");
         }
-        if (chosen) {
-          const problem = writeVerifyCommand(cwd, chosen);
-          if (problem) {
-            out3(`verify.command was not written: ${problem}`);
-          } else {
-            out3(`Wrote verify.command: ${chosen} (budget 300s) to ${POLICY_FILE}. Commit it: with a --base, verify reads`);
-            out3("the policy from that commit, so an uncommitted command is invisible to CI.");
-            verifyCommand = chosen;
-            wrote.push(POLICY_FILE);
-          }
+      } else if (candidates.length === 1) {
+        status("FOUND", candidates[0], "info");
+        if (await confirm("Trust `" + candidates[0] + "` as the verifier command?", false, false)) {
+          chosen = candidates[0];
+        } else {
+          chosen = await ask("Test command to trust (Enter to skip): ") || void 0;
+        }
+      } else if (candidates.length > 1) {
+        status("ACTION", "Choose the command that decides whether this repository passes:", "warn");
+        candidates.forEach((candidate, i) => out3("  " + (i + 1) + ". " + terminalText(candidate)));
+        const a = await ask("Choose 1-" + candidates.length + ", type a command, or press Enter to skip: ");
+        const n = Number(a);
+        chosen = a === "" ? void 0 : Number.isInteger(n) && n >= 1 && n <= candidates.length ? candidates[n - 1] : a;
+      } else {
+        status("ACTION", "No test command was detected automatically.", "warn");
+        chosen = await ask("Test command to trust (Enter to skip): ") || void 0;
+      }
+      if (chosen) {
+        const problem = writeVerifyCommand(cwd, chosen);
+        if (problem) {
+          status("ERROR", "verify.command was not written \u2014 " + problem, "bad");
         } else {
-          out3("verify.command was not configured. CI will fail closed (exit 2) until it is; add it to");
-          out3(`${POLICY_FILE} under verify: and re-run \`tamperward doctor\`.`);
+          verifyCommand = chosen;
+          wrote.push(POLICY_FILE);
+          status("OK", "Saved verify.command: " + chosen + " (budget 300s).", "ok");
         }
       }
     }
-    if (!declined) {
-      header(5);
-      out3("`verify` runs your suite twice: as-is (visible), and with every protected test/snapshot/config");
-      out3("file restored from the trusted base (pristine). The pair is what no diff rule can fake.");
-      if (!verifyCommand) {
-        out3("Skipped: no verify.command. Standalone `tamperward verify` would report CANNOT_VERIFY");
-        out3("(exit 2) here \u2014 it fails closed rather than pretending to verify.");
-      } else if (!localVerifySupported) {
-        out3(`Skipped: checkpointed-local verify is unsupported on ${platform}; \`tamperward verify\` fails closed`);
-        out3("(exit 2) before running anything. Configure a digest-pinned container verifier for this platform.");
-      } else if (!head) {
-        out3("Skipped: no commit to anchor the pristine copy to. Commit, then run: tamperward verify");
-      } else if (await confirm(`Run the first verification now (${verifyCommand}, twice)?`, true, true)) {
-        let summary = null;
-        const verifyOpts = { cwd, onVerdict: (v) => {
+    if (!verifyCommand) {
+      status("ACTION", "Verification is not configured; CI will fail closed until it is.", "warn");
+      out3(paint2('         Set it later with: tamperward onboard --verify-command "<suite command>"', DIM2, colour));
+    } else if (!localVerifySupported) {
+      status("LIMITED", "Local verification is unavailable on " + platformLabel(platform) + "; use a digest-pinned container verifier.", "warn");
+    } else if (!head) {
+      status("ACTION", "Commit once, then run `tamperward verify`.", "warn");
+    } else if (await confirm("Run the first verification now? (the suite runs twice)", true, true)) {
+      let summary = null;
+      const verifyOpts = {
+        cwd,
+        silent: true,
+        onVerdict: (v) => {
           summary = v;
-        } };
-        if (opts.base) verifyOpts.base = opts.base;
-        const code2 = runners.verify(verifyOpts);
-        verifyResult = { code: code2, summary };
-        out3("");
-        for (const line of explainVerdict(summary, code2)) out3(line);
-        out3(`(verify exited ${code2}; onboarding reports it and changes nothing about it.)`);
-      } else {
-        out3(`Skipped. Run it any time: tamperward verify${opts.base ? ` --base ${opts.base}` : ""}`);
-      }
+        }
+      };
+      if (opts.base) verifyOpts.base = opts.base;
+      const code2 = runners.verify(verifyOpts);
+      verifyResult = { code: code2, summary };
+      status(code2 === 0 ? "OK" : code2 === 1 ? "ACTION" : "ERROR", explainVerdict(summary, code2), code2 === 0 ? "ok" : code2 === 1 ? "warn" : "bad");
+    } else {
+      status("SKIP", "Verification skipped. Run `tamperward verify` when ready.", "dim");
     }
-    if (!declined && !opts.skipDemo) {
-      header(6);
-      out3("Optional: see a finding without risking anything. TamperWard creates a detached temporary");
-      out3("worktree of HEAD, adds `.skip` to one test block THERE, runs `check --worktree` on it, then");
-      out3("removes the worktree. Your working tree is not touched; its fingerprint is shown before and after.");
-      const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the demonstration?", false, false);
-      if (!wanted) {
-        out3("Demo skipped.");
-      } else if (!head) {
-        out3("Demo skipped: no commit to build disposable state from.");
+    if (!opts.skipDemo) {
+      if (!head) {
+        status("SKIP", "Safe demo becomes available after the first commit.", "dim");
       } else {
-        runDemo(cwd, head, runners, out3);
+        const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
+        if (wanted) runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
       }
     }
-    header(7);
-    out3("Local wiring steers the agent and gates commits; only the repository can make CI binding.");
+    section(4);
     repo = opts.repo ?? inferGitHubRepo(cwd);
-    const doctorCommand = `tamperward doctor --github --repo ${repo ?? "OWNER/REPO"} --branch ${opts.branch ?? "<default-branch>"}`;
+    const doctorCommand = "tamperward doctor --github --repo " + (repo ?? "OWNER/REPO") + " --branch " + (opts.branch ?? "<default-branch>");
     if (opts.noGithub) {
-      out3("--no-github: the GitHub API is not consulted, so nothing below is reported as enforced.");
-      for (const line of MANUAL_CONTROLS) out3(line);
-      out3(`Then verify it with: ${doctorCommand}`);
+      status("SKIP", "GitHub repository controls were not checked.", "dim");
     } else if (!repo) {
-      out3("No GitHub repository could be determined (no github.com origin; pass --repo OWNER/REPO).");
-      for (const line of MANUAL_CONTROLS) out3(line);
-      out3(`Then verify it with: ${doctorCommand}`);
+      status("ACTION", "No github.com origin detected. Pass --repo OWNER/REPO to check repository protection.", "warn");
     } else {
-      out3(`Repository: ${repo}${opts.branch ? `, branch ${opts.branch}` : ""}.`);
-      githubChecked = await confirm(
-        "Check the live GitHub controls now with `doctor --github`? (reads the GitHub API; set GH_TOKEN/GITHUB_TOKEN if needed)",
-        true,
-        true
-      );
-      if (!githubChecked) {
-        for (const line of MANUAL_CONTROLS) out3(line);
-        out3(`Then verify it with: ${doctorCommand}`);
-      }
+      status("INFO", repo + (opts.branch ? "#" + opts.branch : ""), "info");
+      githubChecked = await confirm("Check GitHub branch protection now?", true, true);
+      if (!githubChecked) status("SKIP", "GitHub repository controls were not checked.", "dim");
     }
-    header(8);
+    section(5);
     const doctorOpts = { cwd };
     if (githubChecked && repo) {
       doctorOpts.github = true;
@@ -14964,48 +14985,62 @@ async function runOnboard(opts, io = {}) {
       if (opts.branch) doctorOpts.branch = opts.branch;
     }
     doctorOutcome = runners.doctor(doctorOpts);
-    for (const line of doctorOutcome.summary) out3(line);
-    if (doctorOutcome.failure) out3(`tamperward doctor: ${doctorOutcome.failure.message}`);
-    for (const check2 of doctorOutcome.checks) renderCheck(check2, out3);
+    const seenFailure = /* @__PURE__ */ new Set();
+    for (const check2 of doctorOutcome.checks) {
+      if (check2.state === "OK" || check2.id === "observer") continue;
+      seenFailure.add(check2.id);
+      if (check2.id === "platform" && platform !== "linux") {
+        continue;
+      }
+      if (check2.id === "verifier" && !verifyCommand && check2.state === "BROKEN") {
+        status("ACTION", "Verification is not configured; choose the trusted test command.", "warn");
+      } else {
+        renderCheck(check2, out3, colour);
+      }
+    }
+    if (doctorOutcome.failure && !seenFailure.has(doctorOutcome.failure.id)) {
+      status("ACTION", doctorOutcome.failure.message, "warn");
+    }
     const posture = postureOf(doctorOutcome);
-    const warnings = doctorOutcome.checks.filter((c) => c.state === "WARN").length;
-    const broken = doctorOutcome.checks.filter((c) => c.state === "BROKEN");
-    out3("");
-    out3(
-      `POSTURE: ${posture}` + (posture === "READY WITH WARNINGS" ? ` \u2014 ${warnings} warning(s) above` : "") + (posture === "BROKEN" ? ` \u2014 ${broken.map((c) => c.id).join(", ")}` : "") + (posture === "INCOMPLETE" && doctorOutcome.failure ? ` \u2014 doctor could not certify: ${doctorOutcome.failure.id}` : "")
-    );
+    if (posture === "READY") status("READY", "TamperWard is configured for this repository.", "ok");
+    else if (posture === "READY WITH WARNINGS") status("READY", "Configured with the limitation(s) above.", "warn");
+    else if (posture === "INCOMPLETE") status("INCOMPLETE", "Setup needs the action(s) above.", "warn");
+    else status("BLOCKED", "Fix the broken item(s) above before relying on the gate.", "bad");
     if (doctorOutcome.github) {
-      out3(`GitHub repository authority: ENFORCED \u2014 doctor --github verified ${doctorOutcome.github.repo}#${doctorOutcome.github.branch}`);
-      out3("  requires the tamperward check, Code Owner review, and stale-approval dismissal.");
+      status("OK", "GitHub authority enforced for " + doctorOutcome.github.repo + "#" + doctorOutcome.github.branch + ".", "ok");
+    } else if (!repo) {
+      status("ACTION", "GitHub authority is not configured for this repository.", "warn");
+      out3(paint2("         If GitHub will provide repository authority, run: " + terminalText(doctorCommand), DIM2, colour));
+      out3(paint2("         If this repository will use GitHub CI authority, configure:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
     } else {
-      out3("GitHub repository authority: NOT VERIFIED \u2014 locally configured only. Until doctor --github");
-      out3(`  confirms the three controls, CI is advisory. Run: ${doctorCommand}`);
-      if (githubChecked && doctorOutcome.failure?.id === "github-authority") {
-        for (const line of MANUAL_CONTROLS) out3(line);
-      }
+      status("ACTION", "GitHub authority is not verified yet.", "warn");
+      out3(paint2("         " + terminalText(doctorCommand), DIM2, colour));
+      out3(paint2("         GitHub authority requires all three controls:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
+    }
+    const commitPaths = [...new Set(wrote)].filter((path) => committableSetupPath(cwd, path));
+    if (commitPaths.length) {
+      status("NEXT", "Commit repository setup files: " + commitPaths.join(", "), "info");
     }
-    if (declined) out3("Nothing was written this run; the posture above describes the repository as it was.");
-    if (verifyResult) out3(`First verification: ${verifyResult.summary?.verdict ?? `exit ${verifyResult.code}`}.`);
-    header(9);
-    out3("Day to day:");
-    out3("  tamperward check --worktree              the stop-sweep view of everything changed since HEAD");
-    out3(`  tamperward verify --base ${opts.base ?? "<base>"}${opts.base ? "" : "          "}pristine re-execution against a base the agent cannot rewrite`);
-    out3(`  tamperward run --base ${opts.base ?? "<base>"} -- <agent...>  the enforcement envelope (Linux; fails closed elsewhere)`);
-    out3(`  ${doctorCommand}`);
-    out3("When the final verification matters most \u2014 a release, a merge into the protected branch \u2014 prefer");
-    out3("the digest-pinned container verifier (verify.backend: container, image: <ref>@sha256:<digest>):");
-    out3("it owns the runtime and dependencies, mounts the tree read-only and disables the network, so the");
-    out3("candidate cannot reach the verifier from the same host. `run` deliberately does not offer it.");
-    if (wrote.length) out3(`Commit what onboarding wrote (${[...new Set(wrote)].join(", ")}) so the gate travels with the repository.`);
+    if (!head) {
+      status("NEXT", "Create the initial repository commit before verify or the safe demo.", "info");
+    }
+    if (!verifyCommand) {
+      status("NEXT", "Choose the test command TamperWard should trust for verification.", "info");
+    }
+    if (verifyResult) {
+      status("VERIFY", verifyResult.summary?.verdict ?? "exit " + verifyResult.code, verifyResult.code === 0 ? "ok" : "warn");
+    }
+    out3(paint2("         Daily: tamperward check --worktree \xB7 tamperward verify --base <base>", DIM2, colour));
     return posture === "READY" || posture === "READY WITH WARNINGS" ? 0 : 1;
   } catch (e) {
     if (e instanceof Aborted) {
       out3("");
-      out3(`tamperward onboard: aborted during step ${step} (${STEPS[step - 1]}).`);
-      out3(
-        wrote.length ? `Written so far: ${[...new Set(wrote)].join(", ")} \u2014 all through init, all idempotent; nothing is half-applied.` : "Nothing was written."
-      );
-      out3("Re-run `tamperward onboard` to continue from the same place, or `tamperward doctor` to see the current posture.");
+      status("STOPPED", "Onboarding was cancelled during " + (SECTIONS[sectionNo - 1] ?? "setup") + ".", "warn");
+      if (wrote.length) status("INFO", "Already written: " + [...new Set(wrote)].join(", ") + ". Re-running is safe.", "dim");
+      else status("INFO", "Nothing was written.", "dim");
+      status("NEXT", "Re-run `tamperward onboard` to continue, or `tamperward doctor` to inspect the current setup.", "info");
       return 2;
     }
     throw e;
@@ -15013,14 +15048,18 @@ async function runOnboard(opts, io = {}) {
     prompt.asker?.close();
   }
 }
-function renderCheck(check2, out3) {
-  if (check2.id === "observer") out3(`tamperward doctor: transient observer: ${check2.detail}`);
-  else out3(`tamperward doctor: [${check2.state}] ${check2.id} \u2014 ${check2.detail}`);
+function renderCheck(check2, out3, colour) {
+  const broken = check2.state === "BROKEN";
+  const label = broken ? "ERROR" : "WARN";
+  const code2 = broken ? BOLD2 + RED2 : YELLOW2;
+  out3(paint2(label.padEnd(8), code2, colour) + " " + terminalText(check2.id + " \u2014 " + check2.detail));
 }
 function postureOf(outcome) {
   if (outcome.failure) return "INCOMPLETE";
-  if (outcome.checks.some((c) => c.state === "BROKEN")) return "BROKEN";
-  if (outcome.checks.some((c) => c.state === "WARN")) return "READY WITH WARNINGS";
+  if (outcome.checks.some((c) => c.state === "BROKEN" && c.id !== "platform")) return "BROKEN";
+  if (outcome.checks.some((c) => c.state === "WARN" || c.state === "BROKEN" && c.id === "platform")) {
+    return "READY WITH WARNINGS";
+  }
   return "READY";
 }
 function runDemo(cwd, head, runners, out3) {
@@ -15092,7 +15131,7 @@ function runDemo(cwd, head, runners, out3) {
     out3("changed it while the demo ran; inspect with `git status`.");
   }
 }
-var Aborted, STEPS, MANUAL_CONTROLS, JS_TEST_PATH, JS_TEST_BLOCK;
+var Aborted, SECTIONS, MANUAL_CONTROLS, ESC2, RESET2, BOLD2, DIM2, RED2, YELLOW2, GREEN2, CYAN, JS_TEST_PATH, JS_TEST_BLOCK;
 var init_onboard = __esm({
   "src/cli/onboard.ts"() {
     "use strict";
@@ -15100,7 +15139,7 @@ var init_onboard = __esm({
     init_verify();
     init_doctor();
     init_check();
-    init_build();
+    init_text();
     init_fingerprint();
     init_policy();
     init_policy_load();
@@ -15108,26 +15147,26 @@ var init_onboard = __esm({
     init_wiring();
     Aborted = class extends Error {
     };
-    STEPS = [
-      "Preflight",
-      "Preview the installation",
-      "Initialize",
-      "Configure verification",
-      "First verification",
-      "Safe demonstration",
-      "GitHub repository authority",
-      "Posture",
-      "Next steps"
+    SECTIONS = [
+      "Environment",
+      "Local protection",
+      "Verification",
+      "GitHub protection",
+      "Summary"
     ];
     MANUAL_CONTROLS = [
-      "In the branch-protection or ruleset settings of the protected branch, configure ALL THREE:",
-      "  1. require the `tamperward` status check;",
-      '  2. enable "Require review from Code Owners";',
-      '  3. enable "Dismiss stale pull request approvals when new commits are pushed".',
-      "Until all three are enforced the generated CI gate is advisory: a pull request runs the",
-      "workflow from its own head and a required check is matched by job name, so it could keep",
-      "the job called `tamperward`, replace the gate with `true`, and report green."
+      "required check: tamperward",
+      "Code Owner review",
+      "dismiss stale approvals when new commits are pushed"
     ];
+    ESC2 = "\x1B";
+    RESET2 = `${ESC2}[0m`;
+    BOLD2 = `${ESC2}[1m`;
+    DIM2 = `${ESC2}[2m`;
+    RED2 = `${ESC2}[31m`;
+    YELLOW2 = `${ESC2}[33m`;
+    GREEN2 = `${ESC2}[32m`;
+    CYAN = `${ESC2}[36m`;
     JS_TEST_PATH = /(?:^|\/)(?:[^/]+\.(?:test|spec)\.[cm]?[jt]sx?|__tests__\/[^/]+\.[cm]?[jt]sx?)$/;
     JS_TEST_BLOCK = /^(\s*)(it|test|describe)(\s*\()/m;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.0",
+  "version": "2.23.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",