tamperward 2.23.1 → 2.23.3

package/dist/cli/index.js

@@ -9934,7 +9934,7 @@ var init_verifier_limits = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync10, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve3 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -10112,6 +10112,65 @@ function planPolicy(cwd) {
     apply: () => writeFileSync7(path, POLICY_CONTENT)
   };
 }
+function planGitignore(cwd) {
+  const rel = ".gitignore";
+  const path = join14(cwd, rel);
+  if (!existsSync10(join14(cwd, "node_modules"))) return null;
+  let existing = "";
+  if (existsSync10(path)) {
+    let st;
+    try {
+      st = lstatSync7(path);
+    } catch (e) {
+      return { item: "gitignore", path: rel, status: "error", detail: "cannot inspect \u2014 " + errText3(e) };
+    }
+    if (!st.isFile()) {
+      return {
+        item: "gitignore",
+        path: rel,
+        status: "error",
+        detail: st.isSymbolicLink() ? "is a symbolic link \u2014 refusing to follow it" : "exists but is not a regular file \u2014 refusing to write"
+      };
+    }
+    existing = readFileSync12(path, "utf8");
+  }
+  try {
+    const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (tracked) {
+      return {
+        item: "gitignore",
+        path: rel,
+        status: "skip",
+        detail: "node_modules is already tracked/staged \u2014 left unchanged; TamperWard will scan it as repository content"
+      };
+    }
+  } catch {
+  }
+  const meaningful = existing.split(/\r?\n/).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
+  if (meaningful.some((line) => line.startsWith("!") && line.includes("node_modules"))) {
+    return {
+      item: "gitignore",
+      path: rel,
+      status: "skip",
+      detail: "contains an explicit node_modules negation \u2014 left untouched; review the repository ignore policy before committing dependencies"
+    };
+  }
+  if (meaningful.some((line) => /^(?:\/|\*\*\/)?node_modules\/?$/.test(line))) {
+    return { item: "gitignore", path: rel, status: "ok", detail: "node_modules is already ignored by the repository" };
+  }
+  const next = existing.length === 0 ? "node_modules/\n" : existing.replace(/\n?$/, "\n") + "node_modules/\n";
+  return {
+    item: "gitignore",
+    path: rel,
+    status: existsSync10(path) ? "update" : "create",
+    detail: "exclude installed Node dependencies from repository diffs",
+    apply: () => writeFileSync7(path, next)
+  };
+}
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
   const path = join14(cwd, rel);
@@ -10425,8 +10484,10 @@ function planned(item, path, plan) {
 }
 function planInit(cwd, opts = {}) {
   requireShippedVersion();
+  const gitignore = planGitignore(cwd);
   return [
     planned("policy", POLICY_FILE, () => planPolicy(cwd)),
+    ...gitignore ? [gitignore] : [],
     planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
     planned("pre-commit", "(hooks)", () => planPreCommit(cwd)),
     planned("ci", ".github/workflows/tamperward.yml", () => planWorkflow(cwd, opts.forceWorkflow ?? false)),
@@ -10660,7 +10721,7 @@ var init_fingerprint = __esm({
 import { createHash as createHash8 } from "node:crypto";
 import {
   existsSync as existsSync11,
-  lstatSync as lstatSync7,
+  lstatSync as lstatSync8,
   readdirSync as readdirSync3,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
@@ -10685,7 +10746,7 @@ function inside(root, candidate) {
   return rel === "" || rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute9(rel);
 }
 function modeKind(path) {
-  const st = lstatSync7(path);
+  const st = lstatSync8(path);
   if (st.isFile()) return { kind: "file", mode: st.mode };
   if (st.isDirectory()) return { kind: "dir", mode: st.mode };
   if (st.isSymbolicLink()) return { kind: "symlink", mode: st.mode };
@@ -10695,7 +10756,7 @@ function fingerprintRoot(root, cwd, h) {
   let rootStat;
   let currentReal;
   try {
-    rootStat = lstatSync7(root.path);
+    rootStat = lstatSync8(root.path);
     currentReal = realpathSync4(root.path);
   } catch (e) {
     throw new Unattestable(
@@ -11865,7 +11926,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync8, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve6, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -11938,7 +11999,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
     const current = join18(base, ...stack);
     let st;
     try {
-      st = lstatSync8(current);
+      st = lstatSync9(current);
     } catch {
       continue;
     }
@@ -11974,7 +12035,7 @@ function rejectLinkedParent(cwd, rel) {
     current = join18(current, part);
     let st;
     try {
-      st = lstatSync8(current);
+      st = lstatSync9(current);
     } catch {
       continue;
     }
@@ -11991,7 +12052,7 @@ function materialize(cwd, dest, dependencyRoot) {
     rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = lstatSync8(src);
+      st = lstatSync9(src);
     } catch {
       continue;
     }
@@ -12016,7 +12077,7 @@ function materialize(cwd, dest, dependencyRoot) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync8(p).isSymbolicLink()) rmSync5(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync5(p, { force: true });
   } catch {
   }
 }
@@ -12058,7 +12119,7 @@ function overlayDigest(dest, paths) {
     h.update("\0");
     const p = join18(dest, rel);
     try {
-      const st = lstatSync8(p);
+      const st = lstatSync9(p);
       h.update(String(st.mode));
       h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {
@@ -14619,7 +14680,7 @@ var init_trace_verify = __esm({
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync9, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve10, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -14699,7 +14760,7 @@ function atomicReplaceFile(path, content, mode) {
 }
 function writeVerifyCommand(cwd, command) {
   const path = join22(cwd, POLICY_FILE);
-  const st = lstatSync9(path, { throwIfNoEntry: false });
+  const st = lstatSync10(path, { throwIfNoEntry: false });
   if (st && (!st.isFile() || st.isSymbolicLink())) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
@@ -14818,26 +14879,35 @@ async function runOnboard(opts, io = {}) {
       status("LIMITED", platformLabel(platform) + ": check works here; local verify and `run` are unavailable. Use the container verifier for final verification.", "warn");
     }
     const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
-    if (!head) status("ACTION", "No commit yet. Commit once before pristine verification or the safe demo.", "warn");
     const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
     const dirty = treeStatus.split("\n").filter(Boolean).map((line) => line.slice(3).split(" -> ").at(-1) ?? "");
-    const owned = new Set(planInit(cwd).map((a) => a.path));
-    const foreign = dirty.filter((p) => !owned.has(p));
-    if (dirty.length === 0) {
-      status("OK", "Working tree is clean.", "ok");
-    } else if (foreign.length === 0) {
-      status("ACTION", dirty.length + " uncommitted setup file(s) from TamperWard; commit them when setup is complete.", "warn");
+    if (!head) {
+      const count = dirty.length;
+      status(
+        "ACTION",
+        count ? "No first commit yet; " + count + " path(s) are not part of a committed baseline. Create the initial commit before pristine verification or the safe demo." : "No first commit yet. Create the initial commit before pristine verification or the safe demo.",
+        "warn"
+      );
     } else {
-      status("ACTION", dirty.length + " existing changed/untracked path(s). TamperWard will not stash or reset them.", "warn");
-      if (!await confirm("Continue with the existing working-tree changes?", false, true)) {
-        status("STOPPED", "Commit or stash your work, then re-run `tamperward onboard`.", "warn");
-        return 2;
+      const owned = new Set(planInit(cwd).map((a) => a.path));
+      const foreign = dirty.filter((p) => !owned.has(p));
+      if (dirty.length === 0) {
+        status("OK", "Working tree is clean.", "ok");
+      } else if (foreign.length === 0) {
+        status("ACTION", dirty.length + " uncommitted setup file(s) from TamperWard; commit them when setup is complete.", "warn");
+      } else {
+        status("ACTION", dirty.length + " existing changed/untracked path(s). TamperWard will not stash or reset them.", "warn");
+        if (!await confirm("Continue with the existing working-tree changes?", false, true)) {
+          status("STOPPED", "Commit or stash your work, then re-run `tamperward onboard`.", "warn");
+          return 2;
+        }
       }
     }
     section(2);
     const plan = planInit(cwd);
     const names = {
       policy: "Policy",
+      gitignore: "Git ignore",
       agent: "Claude hooks",
       "pre-commit": "Pre-commit",
       ci: "CI workflow",
@@ -14950,11 +15020,11 @@ async function runOnboard(opts, io = {}) {
       status("SKIP", "Verification skipped. Run `tamperward verify` when ready.", "dim");
     }
     if (!opts.skipDemo) {
-      const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
-      if (wanted && head) {
-        runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
-      } else if (wanted) {
-        status("SKIP", "Demo needs at least one commit.", "dim");
+      if (!head) {
+        status("SKIP", "Safe demo becomes available after the first commit.", "dim");
+      } else {
+        const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
+        if (wanted) runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
       }
     }
     section(4);
@@ -14982,8 +15052,10 @@ async function runOnboard(opts, io = {}) {
       if (check2.state === "OK" || check2.id === "observer") continue;
       seenFailure.add(check2.id);
       if (check2.id === "platform" && platform !== "linux") {
-        const detail = localVerifySupported ? platformLabel(platform) + ": `tamperward run` requires Linux; check + verify remain available." : platformLabel(platform) + ": `tamperward run` and local verify are unavailable; check remains available.";
-        status("LIMITED", detail, "warn");
+        continue;
+      }
+      if (check2.id === "verifier" && !verifyCommand && check2.state === "BROKEN") {
+        status("ACTION", "Verification is not configured; choose the trusted test command.", "warn");
       } else {
         renderCheck(check2, out3, colour);
       }
@@ -14998,15 +15070,24 @@ async function runOnboard(opts, io = {}) {
     else status("BLOCKED", "Fix the broken item(s) above before relying on the gate.", "bad");
     if (doctorOutcome.github) {
       status("OK", "GitHub authority enforced for " + doctorOutcome.github.repo + "#" + doctorOutcome.github.branch + ".", "ok");
+    } else if (!repo) {
+      status("ACTION", "GitHub authority is not configured for this repository.", "warn");
+      out3(paint2("         If GitHub will provide repository authority, run: " + terminalText(doctorCommand), DIM2, colour));
+      out3(paint2("         If this repository will use GitHub CI authority, configure:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
     } else {
       status("ACTION", "GitHub authority is not verified yet.", "warn");
       out3(paint2("         " + terminalText(doctorCommand), DIM2, colour));
-      for (const line of MANUAL_CONTROLS) out3(paint2("         " + line, DIM2, colour));
+      out3(paint2("         GitHub authority requires all three controls:", DIM2, colour));
+      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
     }
     const commitPaths = [...new Set(wrote)].filter((path) => committableSetupPath(cwd, path));
     if (commitPaths.length) {
       status("NEXT", "Commit repository setup files: " + commitPaths.join(", "), "info");
     }
+    if (!head) {
+      status("NEXT", "Create the initial repository commit before verify or the safe demo.", "info");
+    }
     if (!verifyCommand) {
       status("NEXT", "Choose the test command TamperWard should trust for verification.", "info");
     }
@@ -15071,7 +15152,7 @@ function runDemo(cwd, head, runners, out3) {
       return;
     }
     const targetPath = join22(wt, target.path);
-    const targetStat = lstatSync9(targetPath, { throwIfNoEntry: false });
+    const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
       return;
@@ -15136,10 +15217,9 @@ var init_onboard = __esm({
       "Summary"
     ];
     MANUAL_CONTROLS = [
-      "GitHub still needs three repository controls:",
-      "  required check: tamperward",
-      "  Code Owner review",
-      "  dismiss stale approvals when new commits are pushed"
+      "required check: tamperward",
+      "Code Owner review",
+      "dismiss stale approvals when new commits are pushed"
     ];
     ESC2 = "\x1B";
     RESET2 = `${ESC2}[0m`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.1",
+  "version": "2.23.3",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",