tamperward 2.23.2 → 2.23.3

package/dist/cli/index.js

@@ -9934,7 +9934,7 @@ var init_verifier_limits = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync10, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve3 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -10112,6 +10112,65 @@ function planPolicy(cwd) {
     apply: () => writeFileSync7(path, POLICY_CONTENT)
   };
 }
+function planGitignore(cwd) {
+  const rel = ".gitignore";
+  const path = join14(cwd, rel);
+  if (!existsSync10(join14(cwd, "node_modules"))) return null;
+  let existing = "";
+  if (existsSync10(path)) {
+    let st;
+    try {
+      st = lstatSync7(path);
+    } catch (e) {
+      return { item: "gitignore", path: rel, status: "error", detail: "cannot inspect \u2014 " + errText3(e) };
+    }
+    if (!st.isFile()) {
+      return {
+        item: "gitignore",
+        path: rel,
+        status: "error",
+        detail: st.isSymbolicLink() ? "is a symbolic link \u2014 refusing to follow it" : "exists but is not a regular file \u2014 refusing to write"
+      };
+    }
+    existing = readFileSync12(path, "utf8");
+  }
+  try {
+    const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (tracked) {
+      return {
+        item: "gitignore",
+        path: rel,
+        status: "skip",
+        detail: "node_modules is already tracked/staged \u2014 left unchanged; TamperWard will scan it as repository content"
+      };
+    }
+  } catch {
+  }
+  const meaningful = existing.split(/\r?\n/).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
+  if (meaningful.some((line) => line.startsWith("!") && line.includes("node_modules"))) {
+    return {
+      item: "gitignore",
+      path: rel,
+      status: "skip",
+      detail: "contains an explicit node_modules negation \u2014 left untouched; review the repository ignore policy before committing dependencies"
+    };
+  }
+  if (meaningful.some((line) => /^(?:\/|\*\*\/)?node_modules\/?$/.test(line))) {
+    return { item: "gitignore", path: rel, status: "ok", detail: "node_modules is already ignored by the repository" };
+  }
+  const next = existing.length === 0 ? "node_modules/\n" : existing.replace(/\n?$/, "\n") + "node_modules/\n";
+  return {
+    item: "gitignore",
+    path: rel,
+    status: existsSync10(path) ? "update" : "create",
+    detail: "exclude installed Node dependencies from repository diffs",
+    apply: () => writeFileSync7(path, next)
+  };
+}
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
   const path = join14(cwd, rel);
@@ -10425,8 +10484,10 @@ function planned(item, path, plan) {
 }
 function planInit(cwd, opts = {}) {
   requireShippedVersion();
+  const gitignore = planGitignore(cwd);
   return [
     planned("policy", POLICY_FILE, () => planPolicy(cwd)),
+    ...gitignore ? [gitignore] : [],
     planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
     planned("pre-commit", "(hooks)", () => planPreCommit(cwd)),
     planned("ci", ".github/workflows/tamperward.yml", () => planWorkflow(cwd, opts.forceWorkflow ?? false)),
@@ -10660,7 +10721,7 @@ var init_fingerprint = __esm({
 import { createHash as createHash8 } from "node:crypto";
 import {
   existsSync as existsSync11,
-  lstatSync as lstatSync7,
+  lstatSync as lstatSync8,
   readdirSync as readdirSync3,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
@@ -10685,7 +10746,7 @@ function inside(root, candidate) {
   return rel === "" || rel !== ".." && !rel.startsWith(".." + sep2) && !isAbsolute9(rel);
 }
 function modeKind(path) {
-  const st = lstatSync7(path);
+  const st = lstatSync8(path);
   if (st.isFile()) return { kind: "file", mode: st.mode };
   if (st.isDirectory()) return { kind: "dir", mode: st.mode };
   if (st.isSymbolicLink()) return { kind: "symlink", mode: st.mode };
@@ -10695,7 +10756,7 @@ function fingerprintRoot(root, cwd, h) {
   let rootStat;
   let currentReal;
   try {
-    rootStat = lstatSync7(root.path);
+    rootStat = lstatSync8(root.path);
     currentReal = realpathSync4(root.path);
   } catch (e) {
     throw new Unattestable(
@@ -11865,7 +11926,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync8, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve6, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -11938,7 +11999,7 @@ function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
     const current = join18(base, ...stack);
     let st;
     try {
-      st = lstatSync8(current);
+      st = lstatSync9(current);
     } catch {
       continue;
     }
@@ -11974,7 +12035,7 @@ function rejectLinkedParent(cwd, rel) {
     current = join18(current, part);
     let st;
     try {
-      st = lstatSync8(current);
+      st = lstatSync9(current);
     } catch {
       continue;
     }
@@ -11991,7 +12052,7 @@ function materialize(cwd, dest, dependencyRoot) {
     rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = lstatSync8(src);
+      st = lstatSync9(src);
     } catch {
       continue;
     }
@@ -12016,7 +12077,7 @@ function materialize(cwd, dest, dependencyRoot) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync8(p).isSymbolicLink()) rmSync5(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync5(p, { force: true });
   } catch {
   }
 }
@@ -12058,7 +12119,7 @@ function overlayDigest(dest, paths) {
     h.update("\0");
     const p = join18(dest, rel);
     try {
-      const st = lstatSync8(p);
+      const st = lstatSync9(p);
       h.update(String(st.mode));
       h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {
@@ -14619,7 +14680,7 @@ var init_trace_verify = __esm({
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync9, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve10, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -14699,7 +14760,7 @@ function atomicReplaceFile(path, content, mode) {
 }
 function writeVerifyCommand(cwd, command) {
   const path = join22(cwd, POLICY_FILE);
-  const st = lstatSync9(path, { throwIfNoEntry: false });
+  const st = lstatSync10(path, { throwIfNoEntry: false });
   if (st && (!st.isFile() || st.isSymbolicLink())) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
@@ -14846,6 +14907,7 @@ async function runOnboard(opts, io = {}) {
     const plan = planInit(cwd);
     const names = {
       policy: "Policy",
+      gitignore: "Git ignore",
       agent: "Claude hooks",
       "pre-commit": "Pre-commit",
       ci: "CI workflow",
@@ -15090,7 +15152,7 @@ function runDemo(cwd, head, runners, out3) {
       return;
     }
     const targetPath = join22(wt, target.path);
-    const targetStat = lstatSync9(targetPath, { throwIfNoEntry: false });
+    const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
     if (!targetStat || !targetStat.isFile() || targetStat.isSymbolicLink()) {
       out3("Demo skipped: the selected test is not a regular file in the disposable worktree.");
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.2",
+  "version": "2.23.3",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",