tamperward 2.24.4 → 2.24.5

package/dist/cli/index.js

@@ -1536,11 +1536,86 @@ function gitSubcommand(toks) {
   }
   return null;
 }
-var GIT_OPT_WITH_ARG;
+function shellWord(t) {
+  let out3 = "";
+  let single = false;
+  let double = false;
+  for (let i = 0; i < t.length; i++) {
+    const ch = t[i];
+    if (single) {
+      if (ch === "'") single = false;
+      else out3 += ch;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < t.length && (!double || /["\\$`]/.test(t[i + 1]))) {
+      out3 += t[++i];
+      continue;
+    }
+    if (ch === "'" && !double) {
+      single = true;
+      continue;
+    }
+    if (ch === '"') {
+      double = !double;
+      continue;
+    }
+    out3 += ch;
+  }
+  return out3;
+}
+function expandBraces(t) {
+  const m = t.match(/^([^{]*)\{([^{}]*)\}(.*)$/);
+  if (!m) return [t];
+  return m[2].split(",").flatMap((alt) => expandBraces(`${m[1]}${alt}${m[3]}`));
+}
+function globToRegExp(pattern) {
+  const classes = [];
+  const src = pattern.replace(/^\.\//, "").replace(/\[([^\][]*)\]/g, (_, body) => {
+    classes.push(`[${body.replace(/^!/, "^").replace(/\\/g, "\\\\")}]`);
+    return "
";
+  }).replace(/[.+^${}()|\\[\]]/g, "\\$&").replace(/\*\*\/?/g, "\0").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\0/g, "(?:.*/)?").replace(/
/g, () => classes.shift() ?? "");
+  return new RegExp(`^(?:\\./)?${src}/?$`);
+}
+function expandGlob(t, listing) {
+  const alts = expandBraces(t);
+  if (!alts.some((a) => GLOB_CHARS.test(a))) return alts;
+  const out3 = /* @__PURE__ */ new Set();
+  for (const alt of alts) {
+    if (!GLOB_CHARS.test(alt)) {
+      out3.add(alt);
+      continue;
+    }
+    let re;
+    try {
+      re = globToRegExp(alt);
+    } catch {
+      out3.add(alt);
+      continue;
+    }
+    const depth = alt.replace(/^\.\//, "").replace(/\/+$/, "").split("/").length;
+    for (const f of listing) {
+      if (re.test(f)) {
+        out3.add(f);
+        continue;
+      }
+      const parts = f.split("/");
+      if (parts.length > depth && !alt.includes("**")) {
+        const dir = parts.slice(0, depth).join("/");
+        if (re.test(dir)) out3.add(dir);
+      }
+    }
+  }
+  return [...out3];
+}
+function isGlob(t) {
+  return GLOB_CHARS.test(t) || /\{[^{}]*\}/.test(t);
+}
+var GIT_OPT_WITH_ARG, GLOB_CHARS;
 var init_command = __esm({
   "src/detectors/command.ts"() {
     "use strict";
     GIT_OPT_WITH_ARG = /* @__PURE__ */ new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+    GLOB_CHARS = /[*?[]/;
   }
 });
 
@@ -2850,16 +2925,20 @@ function shellWritesHook(seg, toks, policy, ctx) {
       return null;
   }
 }
-function xargsWritesHook(toks, fed, policy, ctx) {
+function xargsCommand(toks) {
   const at = toks.findIndex((t) => t === "xargs" || t.endsWith("/xargs"));
   if (at === -1) return null;
+  let i = at + 1;
+  while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
+  return { cmd: (toks[i] ?? "").replace(/^.*\//, ""), args: toks.slice(i + 1), at: i };
+}
+function xargsWritesHook(toks, fed, policy, ctx) {
+  const run = xargsCommand(toks);
+  if (run === null) return null;
   const { hookish } = hookTests(policy, ctx);
   const fedHook = fed.some(hookish);
   if (!fedHook) return null;
-  let i = at + 1;
-  while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
-  const cmd = (toks[i] ?? "").replace(/^.*\//, "");
-  const args = toks.slice(i + 1);
+  const { cmd, args, at: i } = run;
   if (["rm", "unlink", "shred", "truncate", "mv", "tee", "sponge"].includes(cmd)) return `xargs ${cmd} rewrites or removes a protected hook named earlier in the line`;
   if (cmd === "chmod" && chmodDropsExec(toks.slice(i))) return "xargs chmod removes execute permission from a hook named earlier in the line";
   if ((cmd === "sed" || cmd === "perl") && args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a))) return `xargs ${cmd} -i rewrites a protected hook named earlier in the line`;
@@ -8547,6 +8626,7 @@ var init_test_deletion = __esm({
     init_policy();
     init_finding();
     init_command();
+    init_hook_wiring();
     init_files();
     init_repo();
     init_suite_config();
@@ -8683,16 +8763,31 @@ var init_test_deletion = __esm({
             }
           } else {
             let root = "";
+            const fed = [];
             for (const seg of segments(c.raw)) {
-              const toks = tokens(seg).map(unquote);
+              const toks = tokens(seg).map(shellWord);
               const cdTo = toks[0] === "cd" ? toks[1] : null;
               if (cdTo !== null) {
                 root = cdTo === void 0 || /^[/~$]/.test(cdTo) || root === null ? null : joinRoot(root, cdTo);
+                fed.push(...toks);
                 continue;
               }
               const inRepo = (t) => root ? `${root}/${t}` : t;
               const listing = trackedFiles(ctx);
-              const testToks = toks.filter((t) => {
+              const whole = (t) => /^(?:\.|\.\/|\*|\.\/\*)$/.test(t);
+              const expand = (raw) => {
+                const t = raw.replace(/^(?:of|if)=/, "");
+                if (!isGlob(t) || whole(t)) return [t];
+                if (listing && root !== null) return expandGlob(inRepo(t), listing).map((p) => root ? p.slice(root.length + 1) : p);
+                return expandBraces(t).flatMap((alt) => {
+                  if (!isGlob(alt)) return [alt];
+                  const base = alt.split("/").pop() ?? "";
+                  if (/test|spec/i.test(base.replace(/[*?]|\[[^\]]*\]/g, ""))) return [alt.replace(/\*\*\//g, "").replace(/\*/g, "a").replace(/\?/g, "t")];
+                  const dir = alt.includes("/") ? alt.replace(/\/[^/]*$/, "") : "";
+                  return dir && !isGlob(dir) && containsProtected(dir, policy, "tests", ctx, "snapshots") ? [dir] : [];
+                });
+              };
+              const specPath = (t) => {
                 const resolved = root !== null && /(?:^|\/)\.{1,2}(?:\/|$)/.test(t) ? joinRoot(root, t) : null;
                 const probe = resolved ?? t;
                 if (!isSpec(probe)) return false;
@@ -8700,56 +8795,82 @@ var init_test_deletion = __esm({
                 const looksLikeFile = /\.[A-Za-z0-9]+$/.test(probe.split("/").pop() ?? "");
                 if (looksLikeFile || listing.includes(resolved ?? inRepo(t))) return true;
                 return containsProtected(resolved ?? inRepo(t), policy, "tests", ctx, "snapshots");
-              });
+              };
               const rootHasProtected = () => listing ? listing.some(isSpec) : true;
-              const dirToks = toks.filter((t) => {
-                if (t.startsWith("-") || testToks.includes(t)) return false;
-                const whole = /^(?:\.|\.\/|\*|\.\/\*)$/.test(t);
-                if (!whole && /[*?{}[\]]/.test(t)) return false;
-                if (root === null) return whole ? false : containsProtected(t, policy, "tests", ctx, "snapshots");
-                const dir = whole ? root : joinRoot(root, t);
+              const dirPath = (t) => {
+                if (t.startsWith("-")) return false;
+                const isWhole = whole(t);
+                if (!isWhole && isGlob(t)) return false;
+                if (root === null) return isWhole ? false : containsProtected(t, policy, "tests", ctx, "snapshots");
+                const dir = isWhole ? root : joinRoot(root, t);
                 if (dir === null) return false;
                 if (dir === "") return rootHasProtected();
                 return containsProtected(dir, policy, "tests", ctx, "snapshots");
-              });
+              };
+              const xargs = xargsCommand(toks);
+              const source = xargs ? [...fed, ...toks] : toks;
+              fed.push(...toks);
+              const testToks = source.filter((t) => expand(t).some(specPath));
+              const dirToks = source.filter((t) => !t.startsWith("-") && !testToks.includes(t) && expand(t).some(dirPath));
               if (testToks.length === 0 && dirToks.length === 0) continue;
               const named = [...testToks, ...dirToks];
-              const cmd = toks[0] ?? "";
+              let at = 0;
+              while (at < toks.length && WRAPPERS.test(toks[at])) at++;
+              const cmdToks = toks.slice(at);
+              const cmd = xargs ? xargs.cmd : (cmdToks[0] ?? "").replace(/^.*\//, "");
+              const args = xargs ? xargs.args : cmdToks.slice(1);
+              const inPlace = (a) => /^-[A-Za-z]*i|^--in-place/.test(a);
+              const isDir = (p) => listing ? listing.some((f) => f.startsWith(inRepo(p).replace(/\/+$/, "") + "/")) : /\/$/.test(p);
+              const exists = (p) => !listing || root === null || listing.includes(inRepo(p.replace(/^\.\//, "")));
+              const ARG_TAKING = /^-(?:t|m|o|g|S|e)$|^--(?:target-directory|mode|owner|group|suffix|rsh|exclude|include|files-from)$/;
+              const positional = args.filter((a, i) => a !== "--" && !a.startsWith("-") && !ARG_TAKING.test(args[i - 1] ?? ""));
               let why = null;
               let evidence = seg;
-              const redirectTarget = seg.match(/>\s*(\S+)/)?.[1];
-              const redirectsOntoTest = redirectTarget ? isSpec(unquote(redirectTarget)) : false;
+              const redirectsOntoTest = [...seg.matchAll(REDIRECT_TARGET)].some((m) => isSpec(shellWord(m[1])));
               const findDeletes = cmd === "find" && /\s(?:-delete\b|-exec\s+(?:rm|unlink)\b|-execdir\s+(?:rm|unlink)\b)/.test(seg);
-              const gitRestoresOld = cmd === "git" && /^git\s+(?:checkout|restore)\b/.test(seg) && (() => {
+              const gitSub = cmd === "git" ? gitSubcommand(cmdToks) : null;
+              const gitRestoresOld = (gitSub === "checkout" || gitSub === "restore") && (() => {
                 const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
-                const revIdx = toks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
-                const rev2 = src ?? (revIdx >= 0 ? toks[revIdx] : void 0);
+                const revIdx = cmdToks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
+                const rev2 = src ?? (revIdx >= 0 ? cmdToks[revIdx] : void 0);
                 if (!rev2 || rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true) return false;
                 if (src || seg.includes(" -- ")) return true;
-                return revIdx >= 0 && toks.some((t, i) => i > revIdx && named.includes(t));
+                return revIdx >= 0 && cmdToks.some((t, i) => i > revIdx && named.includes(t));
               })();
-              if (/\brm\b/.test(seg) && !/^(?:git|npm|yarn|pnpm|bun)\b/.test(seg)) {
-                why = "rm deletes a test file";
-              } else if (cmd === "git" && /^git\s+rm\b/.test(seg)) {
+              const dests = cmd === "cp" || cmd === "install" || cmd === "rsync" || cmd === "ln" || cmd === "mv" ? destinations(cmd, args, isDir) : [];
+              const overwrites = dests.some((d) => isSpec(d) && exists(d)) && positional.some((p) => !dests.includes(p) && !isSpec(p));
+              if (xargs) {
+                if (cmd === "rm" || cmd === "unlink" || cmd === "shred") why = `xargs ${cmd} deletes a test file named earlier in the line`;
+                else if (cmd === "truncate") why = "xargs truncate empties a test file named earlier in the line";
+                else if (cmd === "mv") why = "xargs mv moves a test file named earlier in the line";
+                else if (cmd === "tee" || cmd === "sponge") why = `xargs ${cmd} rewrites a test file named earlier in the line`;
+                else if ((cmd === "sed" || cmd === "perl") && args.some(inPlace)) why = `xargs ${cmd} -i rewrites a test file named earlier in the line`;
+              } else if (cmd === "rm" || cmd === "unlink" || cmd === "shred") {
+                why = `${cmd} deletes a test file`;
+              } else if (gitSub === "rm") {
                 why = "git rm deletes a test file";
               } else if (cmd === "sed" && SED_INPLACE.test(seg)) {
                 why = "sed -i rewrites a test file in place";
               } else if (cmd === "perl" && /(?:^|\s)-[a-zA-Z]*i\b|\s-i\S*/.test(seg)) {
                 why = "perl -i rewrites a test file in place";
-              } else if (/\btruncate\b/.test(seg)) {
+              } else if (cmd === "truncate") {
                 why = "truncate empties a test file";
               } else if (redirectsOntoTest) {
                 why = "a redirect overwrites/empties a test file";
-              } else if (cmd === "cp" && testToks.length > 0 && isSpec(toks[toks.length - 1] ?? "") && !isSpec(toks[toks.length - 2] ?? "")) {
-                why = "cp overwrites a test file with something else";
-              } else if (cmd === "tee" && !toks.includes("-a") && !toks.includes("--append")) {
+              } else if (cmd !== "mv" && overwrites) {
+                why = `${cmd} overwrites a test file with something else`;
+              } else if (cmd === "tee" && !args.includes("-a") && !args.includes("--append")) {
                 why = "tee overwrites a test file";
+              } else if (cmd === "sponge" && !args.includes("-a")) {
+                why = "sponge rewrites a test file in place";
+              } else if (cmd === "dd" && args.some((a) => a.startsWith("of=") && isSpec(a.slice(3)))) {
+                why = "dd rewrites a test file";
               } else if (findDeletes) {
                 why = "find -delete removes test files";
               } else if (gitRestoresOld) {
                 why = "git checkout <rev> replaces a test file with an older version";
-              } else if (/\bmv\b/.test(seg)) {
-                const dest = toks[toks.length - 1];
+              } else if (cmd === "mv") {
+                const dest = positional[positional.length - 1];
                 if (dest && testToks.length > 0 && !isSpec(dest)) {
                   why = "mv renames a test file out of the test glob";
                   evidence = `${testToks[0]} \u2192 ${dest}`;
@@ -8759,6 +8880,8 @@ var init_test_deletion = __esm({
                 } else if (dest && testToks.length === 0 && dirToks[0] !== dest && leavesGlob(dirToks[0] ?? "", dest, policy, ctx)) {
                   why = "mv renames a test directory so its specs leave the test glob";
                   evidence = `${dirToks[0]} \u2192 ${dest}`;
+                } else if (overwrites) {
+                  why = "mv overwrites a test file with something else";
                 }
               }
               if (why) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.24.4",
+  "version": "2.24.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",