tamperward 2.23.13 → 2.23.15

package/dist/cli/index.js

@@ -1610,7 +1610,30 @@ function loadTs() {
   }
   return loaded;
 }
-var loaded, handler, ts;
+function nestsWithinCeiling(src) {
+  let depth = 0;
+  for (let i = 0; i < src.length; i++) {
+    const c = src.charCodeAt(i);
+    if (c === 40 || c === 91 || c === 123) {
+      if (++depth > MAX_PARSE_DEPTH) return false;
+    } else if (c === 41 || c === 93 || c === 125) {
+      if (depth > 0) depth--;
+    }
+  }
+  return true;
+}
+function parseSource(fileName, src, kind) {
+  if (Buffer.byteLength(src) > MAX_PARSE_BYTES) return null;
+  if (!nestsWithinCeiling(src)) return null;
+  const t = loadTs();
+  try {
+    return t.createSourceFile(fileName, src, t.ScriptTarget.Latest, true, kind ?? t.ScriptKind.TS);
+  } catch (e) {
+    if (e instanceof RangeError) return null;
+    throw e;
+  }
+}
+var loaded, handler, ts, MAX_PARSE_BYTES, MAX_PARSE_DEPTH;
 var init_ts_lazy = __esm({
   "src/ts-lazy.ts"() {
     "use strict";
@@ -1631,6 +1654,8 @@ var init_ts_lazy = __esm({
       }
     };
     ts = new Proxy(/* @__PURE__ */ Object.create(null), handler);
+    MAX_PARSE_BYTES = 4 * 1024 * 1024;
+    MAX_PARSE_DEPTH = 256;
   }
 });
 
@@ -1750,12 +1775,8 @@ function isDoubleCast(node) {
   return (ts.isAsExpression(inner) || ts.isTypeAssertionExpression(inner)) && assertedType(inner).kind === ts.SyntaxKind.UnknownKeyword;
 }
 function surfaceOf(path, src) {
-  let sf;
-  try {
-    sf = ts.createSourceFile(path, src, ts.ScriptTarget.Latest, true, scriptKind(path));
-  } catch {
-    return null;
-  }
+  const sf = parseSource(path, src, scriptKind(path));
+  if (!sf) return null;
   const diagnostics = "parseDiagnostics" in sf && Array.isArray(sf.parseDiagnostics) ? sf.parseDiagnostics : [];
   if (diagnostics.length > 0) return null;
   const surface = { type: 0, nonNull: 0, assertions: [] };
@@ -1866,7 +1887,8 @@ var init_ts_cast_growth = __esm({
 function countAny(src) {
   const r = { cast: 0, broad: 0, double: 0 };
   try {
-    const sf = ts.createSourceFile("f.ts", src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const sf = parseSource("f.ts", src);
+    if (!sf) return r;
     const visit = (node) => {
       if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) && isDoubleCast(node)) r.double++;
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
@@ -1888,12 +1910,8 @@ function countAny(src) {
   return r;
 }
 function lineHasDoubleCast(line) {
-  let sf;
-  try {
-    sf = ts.createSourceFile("line.ts", line, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
-  } catch {
-    return false;
-  }
+  const sf = parseSource("line.ts", line);
+  if (!sf) return false;
   let found = false;
   const visit = (n) => {
     if (found) return;
@@ -2261,13 +2279,8 @@ function requiredModule(expr) {
 }
 function astContext(path, source) {
   const rootName = path.startsWith("/") ? path : "/tamperward/" + path;
-  const sf = ts.createSourceFile(
-    rootName,
-    source,
-    ts.ScriptTarget.Latest,
-    true,
-    scriptKind2(path)
-  );
+  const sf = parseSource(rootName, source, scriptKind2(path));
+  if (!sf) return null;
   const diagnostics = "parseDiagnostics" in sf && Array.isArray(sf.parseDiagnostics) ? sf.parseDiagnostics : [];
   if (diagnostics.length > 0) return null;
   const options = {
@@ -3035,7 +3048,7 @@ function asExpression(src) {
   return t.startsWith("{") ? `(${t})` : src;
 }
 function sourceOf(src) {
-  return ts.createSourceFile("cfg.ts", asExpression(src), ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+  return parseSource("cfg.ts", asExpression(src));
 }
 function resolverFor(sf) {
   const consts = /* @__PURE__ */ new Map();
@@ -3057,6 +3070,7 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
+    if (!sf) return res;
     const resolve16 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
@@ -3114,6 +3128,7 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
+    if (!sf) return res;
     const resolve16 = resolverFor(sf);
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
@@ -3141,6 +3156,7 @@ function parseSwitches(src) {
   const res = {};
   try {
     const sf = sourceOf(src);
+    if (!sf) return res;
     const bool2 = (e) => e.kind === ts.SyntaxKind.TrueKeyword ? true : e.kind === ts.SyntaxKind.FalseKeyword ? false : void 0;
     const visit = (node) => {
       if (ts.isPropertyAssignment(node)) {
@@ -3159,6 +3175,7 @@ function parseSwitches(src) {
 function sectionText(src, key2) {
   try {
     const sf = sourceOf(src);
+    if (!sf) return "";
     let out3 = "";
     const visit = (node) => {
       if (out3) return;
@@ -6244,7 +6261,8 @@ function parseSelection(src, runner, path = "") {
   let sel = empty();
   if (runner === "pytest") return pytestSelection(src);
   try {
-    const sf = ts.createSourceFile("cfg.ts", asExpression2(src), ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const sf = parseSource("cfg.ts", asExpression2(src));
+    if (!sf) return sel;
     if (runner === "vitest" && isWorkspaceFile(path)) {
       const arr = workspaceArray(sf);
       if (arr) {
@@ -7486,7 +7504,8 @@ function countTests(src, path = "spec.ts", substantiveOnly = false) {
     for (const line of src.split("\n")) if (re.test(line)) n2++;
     return { min: n2, open: false };
   }
-  const sf = ts.createSourceFile("spec.ts", src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+  const sf = parseSource("spec.ts", src);
+  if (!sf) return { min: 0, open: true };
   let n = 0;
   let open = false;
   const visit = (node, mult) => {
@@ -7900,7 +7919,8 @@ function eachTables(src, path) {
   let open = false;
   if (langOf(path) !== "js" && langOf(path) !== null) return { rows, open };
   try {
-    const sf = ts.createSourceFile("spec.ts", src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const sf = parseSource("spec.ts", src);
+    if (!sf) return { rows, open };
     const visit = (node) => {
       if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && /^(?:each|for)$/.test(node.expression.name.text) && ts.isIdentifier(node.expression.expression) && /^(?:it|test|describe)$/.test(node.expression.expression.text)) {
         const arg = node.arguments[0];
@@ -8204,7 +8224,8 @@ function blocks(src, path) {
   const out3 = /* @__PURE__ */ new Map();
   if (langOf(path) !== "js") return out3;
   try {
-    const sf = ts.createSourceFile(path, src, ts.ScriptTarget.Latest, true, scriptKindForPath(path));
+    const sf = parseSource(path, src, scriptKindForPath(path));
+    if (!sf) return out3;
     const visit = (node, suites) => {
       if (ts.isCallExpression(node)) {
         const call = simpleCallName(node);
@@ -8408,17 +8429,15 @@ function evaluate(changes, policy, detectors = allDetectors, view, ctx) {
     } catch (e) {
       process.stderr.write(`tamperward: detector "${d.id}" errored: ${String(e)}
 `);
-      if (view === "staged" || view === "worktree" || view === "range") {
-        const failed2 = {
-          rule: "detector-error",
-          severity: "block",
-          message: `Detector "${d.id}" failed to run; the verdict is incomplete.`,
-          evidence: String(e).slice(0, 200),
-          remediation: "A rule that cannot run is not a rule that passed. Fix the input or the detector; do not read this as clean.",
-          signoff: { required: true, command: `tamperward allow detector-error --reason "..."` }
-        };
-        out3.push(failed2);
-      }
+      const failed2 = {
+        rule: "detector-error",
+        severity: "block",
+        message: `Detector "${d.id}" failed to run; the verdict is incomplete.`,
+        evidence: String(e).slice(0, 200),
+        remediation: "A rule that cannot run is not a rule that passed. Fix the input or the detector; do not read this as clean.",
+        signoff: { required: true, command: `tamperward allow detector-error --reason "..."` }
+      };
+      out3.push(failed2);
     }
   }
   const seen = /* @__PURE__ */ new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.13",
+  "version": "2.23.15",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",