tamperward 2.23.1 → 2.23.2

package/dist/cli/index.js

@@ -14818,20 +14818,28 @@ async function runOnboard(opts, io = {}) {
       status("LIMITED", platformLabel(platform) + ": check works here; local verify and `run` are unavailable. Use the container verifier for final verification.", "warn");
     }
     const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
-    if (!head) status("ACTION", "No commit yet. Commit once before pristine verification or the safe demo.", "warn");
     const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
     const dirty = treeStatus.split("\n").filter(Boolean).map((line) => line.slice(3).split(" -> ").at(-1) ?? "");
-    const owned = new Set(planInit(cwd).map((a) => a.path));
-    const foreign = dirty.filter((p) => !owned.has(p));
-    if (dirty.length === 0) {
-      status("OK", "Working tree is clean.", "ok");
-    } else if (foreign.length === 0) {
-      status("ACTION", dirty.length + " uncommitted setup file(s) from TamperWard; commit them when setup is complete.", "warn");
+    if (!head) {
+      const count = dirty.length;
+      status(
+        "ACTION",
+        count ? "No first commit yet; " + count + " path(s) are not part of a committed baseline. Create the initial commit before pristine verification or the safe demo." : "No first commit yet. Create the initial commit before pristine verification or the safe demo.",
+        "warn"
+      );
     } else {
-      status("ACTION", dirty.length + " existing changed/untracked path(s). TamperWard will not stash or reset them.", "warn");
-      if (!await confirm("Continue with the existing working-tree changes?", false, true)) {
-        status("STOPPED", "Commit or stash your work, then re-run `tamperward onboard`.", "warn");
-        return 2;
+      const owned = new Set(planInit(cwd).map((a) => a.path));
+      const foreign = dirty.filter((p) => !owned.has(p));
+      if (dirty.length === 0) {
+        status("OK", "Working tree is clean.", "ok");
+      } else if (foreign.length === 0) {
+        status("ACTION", dirty.length + " uncommitted setup file(s) from TamperWard; commit them when setup is complete.", "warn");
+      } else {
+        status("ACTION", dirty.length + " existing changed/untracked path(s). TamperWard will not stash or reset them.", "warn");
+        if (!await confirm("Continue with the existing working-tree changes?", false, true)) {
+          status("STOPPED", "Commit or stash your work, then re-run `tamperward onboard`.", "warn");
+          return 2;
+        }
       }
     }
     section(2);
@@ -14950,11 +14958,11 @@ async function runOnboard(opts, io = {}) {
       status("SKIP", "Verification skipped. Run `tamperward verify` when ready.", "dim");
     }
     if (!opts.skipDemo) {
-      const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
-      if (wanted && head) {
-        runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
-      } else if (wanted) {
-        status("SKIP", "Demo needs at least one commit.", "dim");
+      if (!head) {
+        status("SKIP", "Safe demo becomes available after the first commit.", "dim");
+      } else {
+        const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
+        if (wanted) runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
       }
     }
     section(4);
@@ -14982,8 +14990,10 @@ async function runOnboard(opts, io = {}) {
       if (check2.state === "OK" || check2.id === "observer") continue;
       seenFailure.add(check2.id);
       if (check2.id === "platform" && platform !== "linux") {
-        const detail = localVerifySupported ? platformLabel(platform) + ": `tamperward run` requires Linux; check + verify remain available." : platformLabel(platform) + ": `tamperward run` and local verify are unavailable; check remains available.";
-        status("LIMITED", detail, "warn");
+        continue;
+      }
+      if (check2.id === "verifier" && !verifyCommand && check2.state === "BROKEN") {
+        status("ACTION", "Verification is not configured; choose the trusted test command.", "warn");
       } else {
         renderCheck(check2, out3, colour);
       }
@@ -14998,15 +15008,24 @@ async function runOnboard(opts, io = {}) {
     else status("BLOCKED", "Fix the broken item(s) above before relying on the gate.", "bad");
     if (doctorOutcome.github) {
       status("OK", "GitHub authority enforced for " + doctorOutcome.github.repo + "#" + doctorOutcome.github.branch + ".", "ok");
+    } else if (!repo) {
+      status("ACTION", "GitHub authority is not configured for this repository.", "warn");
+      out3(paint2("         If GitHub will provide repository authority, run: " + terminalText(doctorCommand), DIM2, colour));
+      out3(paint2("         If this repository will use GitHub CI authority, configure:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
     } else {
       status("ACTION", "GitHub authority is not verified yet.", "warn");
       out3(paint2("         " + terminalText(doctorCommand), DIM2, colour));
-      for (const line of MANUAL_CONTROLS) out3(paint2("         " + line, DIM2, colour));
+      out3(paint2("         GitHub authority requires all three controls:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
     }
     const commitPaths = [...new Set(wrote)].filter((path) => committableSetupPath(cwd, path));
     if (commitPaths.length) {
       status("NEXT", "Commit repository setup files: " + commitPaths.join(", "), "info");
     }
+    if (!head) {
+      status("NEXT", "Create the initial repository commit before verify or the safe demo.", "info");
+    }
     if (!verifyCommand) {
       status("NEXT", "Choose the test command TamperWard should trust for verification.", "info");
     }
@@ -15136,10 +15155,9 @@ var init_onboard = __esm({
       "Summary"
     ];
     MANUAL_CONTROLS = [
-      "GitHub still needs three repository controls:",
-      "  required check: tamperward",
-      "  Code Owner review",
-      "  dismiss stale approvals when new commits are pushed"
+      "required check: tamperward",
+      "Code Owner review",
+      "dismiss stale approvals when new commits are pushed"
     ];
     ESC2 = "\x1B";
     RESET2 = `${ESC2}[0m`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.1",
+  "version": "2.23.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",