tamperward 2.29.12 → 2.29.14

package/dist/cli/index.js

@@ -17883,6 +17883,22 @@ function parseStraceFileAccess(raw) {
   }
   return out3;
 }
+function tracerDenialDiagnostic(stderr) {
+  for (const raw of stderr.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("strace:") && TRACER_DENIAL_RE.test(line)) return line;
+  }
+  return null;
+}
+function classifyTraceRun(r) {
+  if (r.spawnError) return { kind: "tracer-error", diagnostic: `strace could not be launched: ${r.spawnError}` };
+  const denial = tracerDenialDiagnostic(r.stderr);
+  if (denial) return { kind: "tracer-error", diagnostic: denial };
+  if (r.signal) return { kind: "tracer-error", diagnostic: `strace was killed by ${r.signal} before the trace completed` };
+  if (r.traceFileCount === 0) return { kind: "tracer-error", diagnostic: "strace produced no trace files; the tracer did not attach (ptrace may be denied)" };
+  if (r.accessCount === 0) return { kind: "tracer-error", diagnostic: "strace recorded no file syscalls; the tracer attached to nothing (ptrace may be denied)" };
+  return { kind: "ok", exit: r.status ?? 1 };
+}
 function inside3(root, path) {
   const rel = relative6(resolve11(root), resolve11(path));
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep4}`) && !isAbsolute12(rel);
@@ -18009,11 +18025,9 @@ function rewriteTraceRoot(accesses, actualRoot) {
     return { ...item, path: join22(TRACE_ROOT, ...rel.split("/")) };
   });
 }
-function runOneTrace(cwd, base, command, budget) {
-  const root = mkdtempSync5(join22(tmpdir6(), "tw-trace-base-"));
+function straceOnce(root, command, budget) {
   const traceDir = mkdtempSync5(join22(tmpdir6(), "tw-trace-log-"));
   try {
-    materializeBase(base, cwd, root);
     const prefix = join22(traceDir, "trace");
     const traced = spawnSync5(
       "strace",
@@ -18042,21 +18056,40 @@ function runOneTrace(cwd, base, command, budget) {
         maxBuffer: 64 * 1024 * 1024
       }
     );
-    if (traced.error) throw traced.error;
-    const logs = traceFiles(prefix);
-    if (logs.length === 0) {
-      throw new Error("strace produced no trace files");
-    }
+    const logs = traced.error ? [] : traceFiles(prefix);
     const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8")));
-    return {
-      exit: traced.status ?? 1,
-      accesses: rewriteTraceRoot(accesses, root)
+    const raw = {
+      spawnError: traced.error ? traced.error.message : null,
+      status: traced.status,
+      signal: traced.signal ?? null,
+      stderr: String(traced.stderr ?? "").slice(0, 8192),
+      traceFileCount: logs.length,
+      accessCount: accesses.length
     };
+    return { raw, accesses };
   } finally {
-    rmSync9(root, { recursive: true, force: true });
     rmSync9(traceDir, { recursive: true, force: true });
   }
 }
+function runOneTrace(cwd, base, command, budget) {
+  const root = mkdtempSync5(join22(tmpdir6(), "tw-trace-base-"));
+  try {
+    materializeBase(base, cwd, root);
+    const { raw, accesses } = straceOnce(root, command, budget);
+    return { outcome: classifyTraceRun(raw), accesses: rewriteTraceRoot(accesses, root) };
+  } finally {
+    rmSync9(root, { recursive: true, force: true });
+  }
+}
+function tracerPreflight(budget = 10) {
+  const probeRoot = mkdtempSync5(join22(tmpdir6(), "tw-trace-probe-"));
+  try {
+    const { raw } = straceOnce(probeRoot, "true", Math.max(1, Math.min(budget, 10)));
+    return classifyTraceRun(raw);
+  } finally {
+    rmSync9(probeRoot, { recursive: true, force: true });
+  }
+}
 function renderText2(report2) {
   const out3 = (s = "") => void process.stdout.write(s + "\n");
   out3("tamperward trace-verify \u2014 ADVISORY observation, not an enforcement verdict");
@@ -18143,6 +18176,15 @@ function runTraceVerify(opts = {}) {
 `);
     return 2;
   }
+  const preflight = tracerPreflight(budget);
+  if (preflight.kind === "tracer-error") {
+    process.stderr.write(
+      `tamperward trace-verify: the tracer cannot observe in this environment, so no verifier input can be discovered \u2014 ${preflight.diagnostic}.
+This is a tracing/tooling limitation (e.g. ptrace denied by seccomp or Yama), not a verifier result.
+`
+    );
+    return 2;
+  }
   const atBase = trackedAt(base, cwd);
   const tracked = new Set(atBase);
   const covered = verifierCoveredInputs(command, atBase, policy);
@@ -18150,9 +18192,16 @@ function runTraceVerify(opts = {}) {
   const runExits = [];
   try {
     for (let i = 0; i < runs; i++) {
-      const result = runOneTrace(cwd, base, command, budget);
-      observed.push(result.accesses);
-      runExits.push(result.exit);
+      const { outcome, accesses } = runOneTrace(cwd, base, command, budget);
+      if (outcome.kind === "tracer-error") {
+        process.stderr.write(
+          `tamperward trace-verify: tracing failed during run ${i + 1}/${runs} \u2014 ${outcome.diagnostic}. No advisory report emitted.
+`
+        );
+        return 2;
+      }
+      observed.push(accesses);
+      runExits.push(outcome.exit);
     }
   } catch (e) {
     process.stderr.write(`tamperward trace-verify: tracing failed (${e instanceof Error ? e.message : String(e)}).
@@ -18199,7 +18248,7 @@ function parseTraceVerify(args) {
   }
   return out3;
 }
-var TRACE_ROOT, CONFIG_BASENAMES;
+var TRACE_ROOT, TRACER_DENIAL_RE, CONFIG_BASENAMES;
 var init_trace_verify = __esm({
   "src/cli/trace-verify.ts"() {
     "use strict";
@@ -18209,6 +18258,7 @@ var init_trace_verify = __esm({
     init_policy_load();
     init_verify();
     TRACE_ROOT = "/__tamperward_trusted_base__";
+    TRACER_DENIAL_RE = /\b(?:PTRACE_[A-Z_]+|ptrace|seccomp|no[-_ ]new[-_ ]privs|yama)\b|Operation not permitted|Permission denied/i;
     CONFIG_BASENAMES = /* @__PURE__ */ new Set([
       "package.json",
       "pytest.ini",
@@ -18237,18 +18287,69 @@ var init_trace_verify = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync17 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
 import { join as join23 } from "node:path";
+function isRecord4(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+function hooksBeyondTamperward(hooks) {
+  if (!isRecord4(hooks)) return hooks != null;
+  for (const entries of Object.values(hooks)) {
+    if (!Array.isArray(entries)) {
+      if (entries != null) return true;
+      continue;
+    }
+    for (const entry of entries) {
+      const hs = isRecord4(entry) ? entry.hooks : null;
+      if (!Array.isArray(hs)) {
+        if (hs != null) return true;
+        continue;
+      }
+      for (const h of hs) {
+        const cmd = isRecord4(h) ? String(h.command ?? "") : "";
+        if (!/tamperward/.test(cmd)) return true;
+      }
+    }
+  }
+  return false;
+}
+function claudeSettingsBeyondTamperward(cwd) {
+  const path = join23(cwd, ".claude", "settings.json");
+  let raw;
+  try {
+    if (!existsSync17(path)) return false;
+    raw = readFileSync21(path, "utf8");
+  } catch {
+    return false;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return raw.trim().length > 0;
+  }
+  if (!isRecord4(parsed)) return raw.trim().length > 0;
+  for (const [key2, value] of Object.entries(parsed)) {
+    if (key2 === "disableAllHooks") continue;
+    if (key2 === "hooks") {
+      if (hooksBeyondTamperward(value)) return true;
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
 function detectRuntimes(cwd) {
   const found = [];
   for (const rt of KNOWN_RUNTIMES) {
-    const matchedMarker = rt.markers.find((m) => {
+    const marker = rt.markers.find((m) => {
       try {
         return existsSync17(join23(cwd, m));
       } catch {
         return false;
       }
     });
+    const matchedMarker = marker ?? rt.detectExtra?.(cwd) ?? void 0;
     if (matchedMarker !== void 0) found.push({ ...rt, matchedMarker });
   }
   return found;
@@ -18268,10 +18369,14 @@ function detectionHeadline(detected) {
   return `Detected ${detected.length} agent runtimes: ${parts.join(", ")}.`;
 }
 function neutralOnlyCaveat(detected) {
-  if (detected.length === 0 || hasInLoopRuntime(detected)) return null;
-  const names = detected.map((r) => r.label).join(", ");
-  const tracking = [...new Set(detected.map((r) => r.adapterTracking).filter(Boolean))].join(", ");
-  return `In-loop steering (deny-before-execute) ships for Claude Code only today, so on ${names} your live protection is the agent-neutral layers: pre-commit and CI. The Claude hook wiring is still written and is inert unless Claude Code runs in this repository.${tracking ? ` A native in-loop adapter is tracked in ${tracking}.` : ""}`;
+  const neutral = detected.filter((r) => r.steering === "neutral");
+  if (neutral.length === 0) return null;
+  const names = neutral.map((r) => r.label).join(", ");
+  const tracking = [...new Set(neutral.map((r) => r.adapterTracking).filter(Boolean))].join(", ");
+  const claudeAlso = hasInLoopRuntime(detected);
+  const lead = claudeAlso ? `In-loop steering (deny-before-execute) ships for Claude Code only today: Claude Code here gets it, but on ${names} your live protection is ` : `In-loop steering (deny-before-execute) ships for Claude Code only today, so on ${names} your live protection is `;
+  const tail = claudeAlso ? "" : " The Claude hook wiring is still written and is inert unless Claude Code runs in this repository.";
+  return `${lead}the agent-neutral layers: pre-commit and CI.${tail}${tracking ? ` A native in-loop adapter is tracked in ${tracking}.` : ""}`;
 }
 var KNOWN_RUNTIMES;
 var init_runtimes = __esm({
@@ -18280,8 +18385,13 @@ var init_runtimes = __esm({
     KNOWN_RUNTIMES = [
       {
         id: "claude-code",
+        // Markers are Claude Code files `init` never writes, so detection never mistakes
+        // TamperWard's own generated `.claude/settings.json` for evidence a human runs
+        // Claude here (#526). `detectExtra` looks at that generated file's CONTENT for
+        // real use (configuration beyond the two hooks init merges in).
         label: "Claude Code",
-        markers: [".claude/settings.json", ".claude"],
+        markers: ["CLAUDE.md", ".claude/settings.local.json", ".claude/commands", ".claude/agents"],
+        detectExtra: (cwd) => claudeSettingsBeyondTamperward(cwd) ? ".claude/settings.json" : null,
         steering: "in-loop",
         note: "native in-loop steering (PreToolUse deny + Stop sweep) plus the agent-neutral layers."
       },
@@ -18315,7 +18425,7 @@ var init_runtimes = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync22, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -18391,7 +18501,7 @@ function writeVerifyCommand(cwd, command) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -18992,7 +19102,7 @@ var init_capture = __esm({
 
 // src/research/manifest.ts
 import { createHash as createHash13 } from "node:crypto";
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 import { dirname as dirname10, resolve as resolve14 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
@@ -19026,7 +19136,7 @@ function readManifest(path) {
   const abs = resolve14(path);
   let bytes;
   try {
-    bytes = readFileSync22(abs);
+    bytes = readFileSync23(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -19238,7 +19348,7 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join25, resolve as resolve15 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -19249,7 +19359,7 @@ function pairRecordPath(ledger, task, pair) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync23(path, "utf8"));
+    raw = JSON.parse(readFileSync24(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -19672,7 +19782,7 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync25 } from "node:fs";
 import { join as join26, resolve as resolve16 } from "node:path";
 function readLedger2(dir) {
   const pairsDir = join26(resolve16(dir), "pairs");
@@ -19687,7 +19797,7 @@ function readLedger2(dir) {
     const path = join26(pairsDir, n);
     let raw;
     try {
-      raw = JSON.parse(readFileSync24(path, "utf8"));
+      raw = JSON.parse(readFileSync25(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -20394,7 +20504,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -20407,7 +20517,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync25(0, "utf8");
+      raw = readFileSync26(0, "utf8");
     } catch {
       raw = null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.12",
+  "version": "2.29.14",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",