tamperward 2.29.16 → 2.29.18

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/logo.svg" width="76" height="76" alt="">
+  <img src="assets/logo.png" width="76" height="76" alt="">
 </p>
 
 <h1 align="center">Tamperward</h1>

package/dist/cli/index.js

@@ -10747,6 +10747,9 @@ function validate(r, where) {
     const v = r.verify;
     const { command, budget, inputs, backend, image } = v;
     if (command !== void 0 && typeof command !== "string") bad2(`verify.command must be a string, got ${show(command)}`);
+    if (typeof command !== "string" || command.trim() === "") {
+      bad2(`verify.command is required and must be a non-empty command when a verify block is present, got ${show(command)}`);
+    }
     if (budget !== void 0 && !(typeof budget === "number" && Number.isFinite(budget) && budget > 0)) {
       bad2(`verify.budget must be a positive number of seconds, got ${show(budget)}`);
     }
@@ -14903,17 +14906,29 @@ function finish(extra) {
   done = true;
   if (descendantTracker) clearInterval(descendantTracker);
   if (drainTimer) clearTimeout(drainTimer);
+  // fd 1 is the reserved result channel (suite streams are separate pipes).
+  // Write synchronously: process.stdout.write is async on a POSIX pipe, so an
+  // immediate process.exit(0) can truncate the result before it flushes.
+  const buf = Buffer.from(JSON.stringify({
+    ...exitInfo,
+    timedOut,
+    ...extra,
+    stdout: diag(stdout),
+    stderr: diag(stderr),
+  }), 'utf8');
+  let offset = 0;
   try {
-    // stdout is reserved for the trusted supervisor result. Candidate suite
-    // stdout/stderr are separate pipes and are never inherited here.
-    process.stdout.write(JSON.stringify({
-      ...exitInfo,
-      timedOut,
-      ...extra,
-      stdout: diag(stdout),
-      stderr: diag(stderr),
-    }));
-  } catch {}
+    while (offset < buf.length) {
+      try {
+        offset += fs.writeSync(1, buf, offset, buf.length - offset);
+      } catch (e) {
+        if (e && e.code === 'EAGAIN') continue;
+        throw e;
+      }
+    }
+  } catch {
+    process.exit(1);
+  }
   process.exit(0);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.16",
+  "version": "2.29.18",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",