tamperward 2.29.14 → 2.29.15

package/dist/cli/index.js

@@ -14640,6 +14640,7 @@ function parseCapturedSupervisorResult(stdoutText) {
     signal: typeof raw.signal === "string" ? raw.signal : null,
     timedOut: Boolean(raw.timedOut),
     ...typeof raw.error === "string" && raw.error ? { error: raw.error } : {},
+    ...raw.pipeHeldOpen === true ? { pipeHeldOpen: true } : {},
     diagnostics
   };
 }
@@ -14657,6 +14658,7 @@ function runCapturedProcessSync(executable, args, opts) {
         timeoutMs: opts.timeoutMs,
         detached: Boolean(opts.detached),
         killGroupOnFinish: Boolean(opts.killGroupOnFinish),
+        drainMs: opts.drainMs ?? 1e3,
         captureBytes: DIAGNOSTIC_TAIL_BYTES
       }),
       { mode: 384 }
@@ -14789,6 +14791,7 @@ let done = false;
 let timedOut = false;
 let exitInfo = { exit: null, signal: null };
 let descendantTracker = null;
+let drainTimer = null;
 
 function killOwned() {
   if (!child || !child.pid) return;
@@ -14810,6 +14813,7 @@ function finish(extra) {
   if (done) return;
   done = true;
   if (descendantTracker) clearInterval(descendantTracker);
+  if (drainTimer) clearTimeout(drainTimer);
   try {
     // stdout is reserved for the trusted supervisor result. Candidate suite
     // stdout/stderr are separate pipes and are never inherited here.
@@ -14864,12 +14868,19 @@ if (child) {
       signal: signal == null ? null : String(signal),
     };
     if (cfg.killGroupOnFinish) killOwned();
+    // A leaked descendant can hold a pipe open so 'close' never fires; finish off
+    // exit after a bounded drain instead of hanging. 'close' still wins if first.
+    if (!drainTimer) {
+      drainTimer = setTimeout(() => finish({ pipeHeldOpen: true }), Number(cfg.drainMs));
+      drainTimer.unref();
+    }
   });
 
   // close fires after the stdio pipes close, so the retained tails include all
   // output that was drained before owned descendants were terminated.
   child.on('close', (code, signal) => {
     clearTimeout(timer);
+    if (drainTimer) clearTimeout(drainTimer);
     if (exitInfo.exit === null && code != null) exitInfo.exit = Number(code);
     if (exitInfo.signal === null && signal != null) exitInfo.signal = String(signal);
     finish({});
@@ -15714,7 +15725,12 @@ function runLocalSuite(dir, cmd, budgetSecs) {
         diagnostics: r.diagnostics
       };
     }
-    return { exit: r.exit, secs, diagnostics: r.diagnostics };
+    return {
+      exit: r.exit,
+      secs,
+      ...r.pipeHeldOpen ? { pipeHeldOpen: true } : {},
+      diagnostics: r.diagnostics
+    };
   } finally {
     rmSync7(scratch, { recursive: true, force: true });
   }
@@ -15873,7 +15889,29 @@ function runVerify(opts) {
   }
   const frozenNodeModules = dependencyEnvironment ? dependencyEnvironment.roots.find((root) => root.kind === "node_modules")?.realPath ?? null : null;
   const checkDeps = () => dependencyEnvironment ? checkDependencyEnvironment(cwd, dependencyEnvironment) : { ok: true };
-  const runStage = (dir) => isolated ? runContainerStage(verifierBackend, dir, cmd, budget) : runLocalSuite(dir, cmd, budget);
+  const runStage = opts.runStage ?? ((dir) => isolated ? runContainerStage(verifierBackend, dir, cmd, budget) : runLocalSuite(dir, cmd, budget));
+  const notQuiescent = (stage, r) => {
+    const detail = `the ${stage} suite exited (code ${r.exit ?? "unknown"}) but left a process holding stdout open after termination was attempted; the stage is not quiescent, so the run cannot be certified`;
+    opts.onVerdict?.({ verdict: "CANNOT_VERIFY", reason: "VERIFIER_BACKEND_RUNTIME_FAILURE", detail });
+    if (opts.json) {
+      out3(JSON.stringify({
+        schema_version: MACHINE_SCHEMA_VERSION,
+        verdict: "CANNOT_VERIFY",
+        reason: "VERIFIER_BACKEND_RUNTIME_FAILURE",
+        stage,
+        ...caseReport(),
+        detail,
+        diagnostics: diagnosticsJson(r.diagnostics, true),
+        verifier_backend: backendReport(),
+        oracle_assurance: oracleAssuranceReport()
+      }));
+    } else {
+      out3(`verify: the ${stage} suite exited but left a process holding stdout open \u2014 the stage is not quiescent, failing closed`);
+      out3("verify: " + detail);
+      renderStageDiagnostics(out3, stage, r);
+    }
+    return 2;
+  };
   let base;
   try {
     base = resolveBase(opts.base ?? "HEAD", cwd);
@@ -15933,6 +15971,10 @@ function runVerify(opts) {
     );
   }
   const visible = runStage(visDir);
+  if (visible.pipeHeldOpen) {
+    cleanup([visRoot]);
+    return notQuiescent("visible", visible);
+  }
   if (visible.failure === "backend" || visible.failure === "resource") {
     cleanup([visRoot]);
     const exhausted = visible.failure === "resource";
@@ -16002,6 +16044,10 @@ function runVerify(opts) {
   }
   const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runStage(priDir);
+  if (pristine.pipeHeldOpen) {
+    cleanup([visRoot, priRoot]);
+    return notQuiescent("pristine", pristine);
+  }
   if (pristine.failure === "backend" || pristine.failure === "resource") {
     cleanup([visRoot, priRoot]);
     const exhausted = pristine.failure === "resource";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.14",
+  "version": "2.29.15",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",