tamperward 2.24.0 → 2.24.1

package/dist/cli/index.js

@@ -7365,6 +7365,50 @@ function syntheticBase(over) {
   }
   return base;
 }
+function freshLefthookBase(after) {
+  const base = {};
+  for (const [section, v] of Object.entries(after)) {
+    if (!isObj(v)) continue;
+    for (const group of ["commands", "scripts"]) {
+      const g = v[group];
+      if (!isObj(g)) continue;
+      for (const [name, cfg] of Object.entries(g)) {
+        if (!isObj(cfg)) continue;
+        const run = cfg.run ?? cfg.runner;
+        if (!namesGate(name) && !namesGate(run)) continue;
+        const sec = base[section] ??= {};
+        const grp = sec[group] ??= {};
+        grp[name] = { run: typeof run === "string" ? liveOrCanonical(run) : CANONICAL_GATE };
+      }
+    }
+  }
+  return base;
+}
+function freshPreCommitBase(after) {
+  const stagesOf = (v) => Array.isArray(v) && v.map(String).some((s) => COMMIT_STAGES.has(s)) ? v.map(String) : null;
+  const defaults = stagesOf(after.default_stages);
+  const repos = [];
+  for (const repo of Array.isArray(after.repos) ? after.repos : []) {
+    if (!isObj(repo)) continue;
+    const hooks = [];
+    for (const h of Array.isArray(repo.hooks) ? repo.hooks : []) {
+      if (!isObj(h)) continue;
+      if (![repo.repo, h.id, h.entry, h.name].some(namesGate)) continue;
+      const fresh = { id: h.id, name: h.name };
+      if (h.entry !== void 0) {
+        const args = Array.isArray(h.args) ? h.args.map(String).join(" ") : "";
+        fresh.entry = liveOrCanonical(`${typeof h.entry === "string" ? h.entry : ""} ${args}`.trim());
+      }
+      const stages = stagesOf(h.stages);
+      if (stages) fresh.stages = stages;
+      hooks.push(fresh);
+    }
+    repos.push({ repo: repo.repo, hooks });
+  }
+  const base = { repos };
+  if (defaults) base.default_stages = defaults;
+  return base;
+}
 function configFindings(c, changes, policy, ctx) {
   if (c.after == null) return null;
   let reasons;
@@ -7374,8 +7418,11 @@ function configFindings(c, changes, policy, ctx) {
     if (overBefore === null) return null;
     const base = lefthookBase(c, changes, ctx) ?? syntheticBase(overAfter ?? {});
     reasons = overAfter === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : lefthookWeakening(mergeDocs(base, overBefore), mergeDocs(base, overAfter));
+  } else if (c.before == null) {
+    const after = parseDoc(c.after);
+    if (after === null) return [];
+    reasons = isLefthook(c.path) ? lefthookWeakening(freshLefthookBase(after), after) : preCommitWeakening(freshPreCommitBase(after), after);
   } else {
-    if (c.before == null) return null;
     const before = parseDoc(c.before);
     const after = parseDoc(c.after);
     if (before === null) return null;
@@ -7433,7 +7480,7 @@ function huskyRuntimeWrite(path, content, ctx) {
     (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
   );
 }
-var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
+var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
 var init_hook_tampering = __esm({
   "src/detectors/hook-tampering.ts"() {
     "use strict";
@@ -7469,6 +7516,10 @@ var init_hook_tampering = __esm({
     envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
     mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
     carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
+    CANONICAL_GATE = "npx tamperward check --staged";
+    COMMIT_STAGES = /* @__PURE__ */ new Set(["pre-commit", "pre-push", "commit", "push"]);
+    namesGate = (v) => typeof v === "string" && /\btamperward\b/.test(v);
+    liveOrCanonical = (cmd) => gateOf(cmd) !== null ? cmd : CANONICAL_GATE;
     HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
     HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
     HUSKY_H_KNOWN = [
@@ -7508,7 +7559,7 @@ They WILL FAIL in v10.0.0
 "`;
     stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
     isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
-    isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
+    isHookNote = (path) => !/(?:^|\/)\.husky\/_\//.test(path) && /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
     hookTampering = {
       id: RULE8,
       surface: ["file", "command"],
@@ -7582,6 +7633,7 @@ They WILL FAIL in v10.0.0
               out3.push(...semantic);
             } else if (!c.path.endsWith(POLICY_FILE)) {
               if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
+              if (isHookNote(c.path)) continue;
               const husky = isHuskyScript(c.path);
               const opts = husky ? { errexit: true } : {};
               const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.0",
+  "version": "2.24.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",