tamperward 2.26.0 → 2.27.0

package/README.md

@@ -98,7 +98,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > Read the round as a pair — the bets before, the outcome after:
 > [How round 4 is built to be hard to fool](./docs/blog/how-round-4-is-built-to-be-hard-to-fool.md)
 > (preregistration, no numbers) →
-> [The prevention bet didn't replicate. No surviving tampering was certified clean.](./docs/blog/round-4-results.md)
+> [The prevention bet didn't replicate. No surviving tampering was certified clean.](./docs/blog/the-prevention-bet-didnt-replicate-no-surviving-tampering-was-certified-clean.md)
 > (results). Round 4.1, a second agent runtime over the same frozen pool, is the
 > next registered step ([SPEC §9.1](./SPEC.md#91-maturity-milestones)).
 

package/dist/cli/index.js

@@ -1090,7 +1090,7 @@ var init_trusted = __esm({
 
 // src/repo-context.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { accessSync, constants as constants2, existsSync as existsSync2, statSync } from "node:fs";
+import { accessSync, constants as constants2, existsSync as existsSync2, realpathSync as realpathSync3, statSync } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve } from "node:path";
 function rev(cwd, flag) {
   try {
@@ -1123,6 +1123,27 @@ function repoContext(cwd) {
 function repoRoot(cwd) {
   return repoContext(cwd)?.root ?? cwd;
 }
+function validateClaimAgainstRoot(claimedCwd, trustedRoot, base) {
+  if (claimedCwd === void 0) return { ok: true, trustedRoot };
+  if (typeof claimedCwd !== "string" || claimedCwd.trim() === "") return { ok: false, rejected: "malformed cwd claim" };
+  const abs = isAbsolute3(claimedCwd) ? claimedCwd : resolve(base, claimedCwd);
+  let realClaim;
+  try {
+    realClaim = realpathSync3(abs);
+  } catch (e) {
+    return { ok: false, rejected: `cwd claim path cannot be resolved (${abs}: ${e instanceof Error ? e.message : String(e)})` };
+  }
+  let realTrusted;
+  try {
+    realTrusted = realpathSync3(trustedRoot);
+  } catch {
+    realTrusted = trustedRoot;
+  }
+  const ctx = repoContext(realClaim);
+  if (!ctx) return { ok: false, rejected: `cwd claim resolves to no repository (${realClaim})` };
+  if (ctx.root !== realTrusted) return { ok: false, rejected: `cwd claim resolves to a different repository (${ctx.root} != trusted ${realTrusted})` };
+  return { ok: true, trustedRoot: realTrusted };
+}
 function outsideRepository(cwd) {
   const key2 = resolve(cwd);
   let isDir;
@@ -11863,10 +11884,7 @@ function failClosed(kind, detail) {
   };
   return verdict([f], kind);
 }
-function verdict(blocks2, kind) {
-  if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
-  recordDenylog(blocks2);
-  const reason = formatDenial(blocks2);
+function denyWire(reason, kind) {
   const payload = kind === "PreToolUse" ? {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
@@ -11874,7 +11892,13 @@ function verdict(blocks2, kind) {
       permissionDecisionReason: reason
     }
   } : { decision: "block", reason };
-  return { exitCode: 0, stdout: JSON.stringify(payload) + "\n" };
+  return JSON.stringify(payload) + "\n";
+}
+function verdict(blocks2, kind) {
+  if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
+  recordDenylog(blocks2);
+  const reason = formatDenial(blocks2);
+  return { exitCode: 0, stdout: denyWire(reason, kind) };
 }
 function fileChanges(changes) {
   return changes.filter((c) => c.kind === "file");
@@ -12052,9 +12076,13 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   }
   if (dirty) savePtree(cwd, sessionId, tree);
 }
-function preToolUseVerdict(input, defaultCwd) {
+function preToolUseVerdict(input, defaultCwd, trustedRoot) {
   try {
     const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
+    if (trustedRoot !== void 0) {
+      const v = validateClaimAgainstRoot(input.cwd, trustedRoot, defaultCwd ?? process.cwd());
+      if (!v.ok) return failClosed("PreToolUse", `repository identity claim rejected: ${v.rejected}`);
+    }
     const cwd = repoRoot(sessionCwd);
     turnBaseline(cwd, input.session_id);
     const policy = loadPolicy(cwd);
@@ -12161,9 +12189,13 @@ function recordObserverHealth(state, reason) {
   } catch {
   }
 }
-function stopVerdict(input, defaultCwd) {
+function stopVerdict(input, defaultCwd, trustedRoot) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
+  if (trustedRoot !== void 0) {
+    const v = validateClaimAgainstRoot(input.cwd, trustedRoot, defaultCwd ?? process.cwd());
+    if (!v.ok) return failClosed("Stop", `repository identity claim rejected: ${v.rejected}`);
+  }
   const ctx = repoContext(sessionCwd);
   if (!ctx) {
     const why = outsideRepository(sessionCwd);
@@ -12206,16 +12238,16 @@ function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
   return r.exitCode;
 }
-function preToolUseFromRaw(raw, defaultCwd) {
+function preToolUseFromRaw(raw, defaultCwd, trustedRoot) {
   try {
-    return preToolUseVerdict(parseInput(raw), defaultCwd);
+    return preToolUseVerdict(parseInput(raw), defaultCwd, trustedRoot);
   } catch (e) {
     return failClosed("PreToolUse", errText2(e));
   }
 }
-function stopFromRaw(raw, defaultCwd) {
+function stopFromRaw(raw, defaultCwd, trustedRoot) {
   try {
-    return stopVerdict(parseInput(raw), defaultCwd);
+    return stopVerdict(parseInput(raw), defaultCwd, trustedRoot);
   } catch (e) {
     return failClosed("Stop", errText2(e));
   }
@@ -12361,7 +12393,7 @@ var init_ptree_cache = __esm({
 // src/cli/hook-service.ts
 import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
-import { realpathSync as realpathSync3 } from "node:fs";
+import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
 function readServiceState(paths) {
   try {
@@ -12399,7 +12431,7 @@ function listening(socket) {
 function within(root, cwd) {
   let real;
   try {
-    real = realpathSync3(cwd);
+    real = realpathSync4(cwd);
   } catch {
     return false;
   }
@@ -12464,7 +12496,7 @@ async function startHookService(opts) {
   if (uid === void 0) throw new Error("no uid on this platform; refusing to start");
   let root;
   try {
-    root = realpathSync3(repoRoot(realpathSync3(opts.root)));
+    root = realpathSync4(repoRoot(realpathSync4(opts.root)));
   } catch {
     throw new Error(`cannot resolve ${opts.root}`);
   }
@@ -12831,7 +12863,7 @@ var init_safe_write = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync5 } from "node:fs";
 import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -13409,7 +13441,7 @@ function planned(item, path, plan) {
 }
 function sameDir(a, b) {
   try {
-    return realpathSync4(a) === realpathSync4(b);
+    return realpathSync5(a) === realpathSync5(b);
   } catch {
     return false;
   }
@@ -13665,7 +13697,7 @@ import {
   readdirSync as readdirSync3,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   statSync as statSync3
 } from "node:fs";
 import {
@@ -13697,7 +13729,7 @@ function fingerprintRoot(root, cwd, h) {
   let currentReal;
   try {
     rootStat = lstatSync8(root.path);
-    currentReal = realpathSync5(root.path);
+    currentReal = realpathSync6(root.path);
   } catch (e) {
     throw new Unattestable(
       root.kind + " root " + JSON.stringify(root.path) + " can no longer be resolved (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -13713,7 +13745,7 @@ function fingerprintRoot(root, cwd, h) {
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
   if (rootStat.isSymbolicLink()) h.update(readlinkSync2(root.path) + "\0");
-  const cwdReal = realpathSync5(cwd);
+  const cwdReal = realpathSync6(cwd);
   const visited = /* @__PURE__ */ new Set();
   const hashFile = (path, label) => {
     let st;
@@ -13730,7 +13762,7 @@ function fingerprintRoot(root, cwd, h) {
     }
   };
   const walk2 = (dir, namespace) => {
-    const realDir = realpathSync5(dir);
+    const realDir = realpathSync6(dir);
     if (visited.has(realDir)) return;
     visited.add(realDir);
     let entries;
@@ -13780,7 +13812,7 @@ function fingerprintRoot(root, cwd, h) {
         h.update(target + "\0");
         let resolved;
         try {
-          resolved = realpathSync5(path);
+          resolved = realpathSync6(path);
         } catch {
           continue;
         }
@@ -13835,7 +13867,7 @@ function freezeRoot(kind, path) {
     if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
-    return { kind, path: resolve5(path), realPath: realpathSync5(path) };
+    return { kind, path: resolve5(path), realPath: realpathSync6(path) };
   } catch (e) {
     throw new Unattestable(
       kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -13873,7 +13905,7 @@ function resolveExecutable(token, cwd, env) {
   if (token.includes("/") || token.includes("\\")) {
     const path = isAbsolute9(token) ? token : resolve5(cwd, token);
     try {
-      return existsSync12(path) ? realpathSync5(path) : null;
+      return existsSync12(path) ? realpathSync6(path) : null;
     } catch {
       return null;
     }
@@ -13881,7 +13913,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync5(candidate);
+      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
     } catch {
     }
   }
@@ -14387,7 +14419,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -14425,7 +14457,7 @@ function findExecutable(name) {
     const candidate = join17(raw, name);
     try {
       accessSync2(candidate, constants3.X_OK);
-      return realpathSync6(candidate);
+      return realpathSync7(candidate);
     } catch {
     }
   }
@@ -14500,7 +14532,7 @@ function inspectImageMetadata(enginePath, host, image) {
 function engineStable(backend) {
   if (!backend.enginePath || !backend.engineSha256) return false;
   try {
-    if (realpathSync6(backend.enginePath) !== backend.enginePath) return false;
+    if (realpathSync7(backend.enginePath) !== backend.enginePath) return false;
     if (replaceableByCaller(backend.enginePath)) return false;
     return fileSha256(backend.enginePath) === backend.engineSha256;
   } catch {
@@ -15741,7 +15773,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync9, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -15796,7 +15828,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   }
   for (const candidate of candidates) {
     try {
-      const real = realpathSync8(candidate);
+      const real = realpathSync9(candidate);
       const st = statSync5(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
@@ -16070,7 +16102,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out3 = [];
   let real;
   try {
-    real = realpathSync8(cwd);
+    real = realpathSync9(cwd);
   } catch {
     return out3;
   }
@@ -17292,7 +17324,7 @@ import {
   mkdtempSync as mkdtempSync5,
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
-  realpathSync as realpathSync9,
+  realpathSync as realpathSync10,
   rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "node:fs";
@@ -17440,7 +17472,7 @@ function rewriteTraceRoot(accesses, actualRoot) {
     if (!inside3(actualRoot, abs)) return { ...item, path: abs };
     const rel = relative6(actualRoot, abs).split(sep4).join("/");
     try {
-      const real = resolve10(realpathSync9(abs));
+      const real = resolve10(realpathSync10(abs));
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
@@ -17676,7 +17708,7 @@ var init_trace_verify = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -17818,7 +17850,7 @@ async function runOnboard(opts, io = {}) {
   const cwd = resolve11(rootText);
   let sameRoot = cwd === requestedCwd;
   try {
-    sameRoot = realpathSync10(cwd) === realpathSync10(requestedCwd);
+    sameRoot = realpathSync11(cwd) === realpathSync11(requestedCwd);
   } catch {
   }
   if (!sameRoot) {
@@ -18156,8 +18188,8 @@ function runDemo(cwd, head, runners, out3) {
     let worktreeRoot;
     let realTarget;
     try {
-      worktreeRoot = realpathSync10(wt);
-      realTarget = realpathSync10(targetPath);
+      worktreeRoot = realpathSync11(wt);
+      realTarget = realpathSync11(targetPath);
     } catch {
       out3("Demo skipped: the selected test could not be resolved safely inside the disposable worktree.");
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.26.0",
+  "version": "2.27.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",