tamperward 2.29.17 → 2.29.19

package/dist/cli/index.js

@@ -10747,6 +10747,9 @@ function validate(r, where) {
     const v = r.verify;
     const { command, budget, inputs, backend, image } = v;
     if (command !== void 0 && typeof command !== "string") bad2(`verify.command must be a string, got ${show(command)}`);
+    if (typeof command !== "string" || command.trim() === "") {
+      bad2(`verify.command is required and must be a non-empty command when a verify block is present, got ${show(command)}`);
+    }
     if (budget !== void 0 && !(typeof budget === "number" && Number.isFinite(budget) && budget > 0)) {
       bad2(`verify.budget must be a positive number of seconds, got ${show(budget)}`);
     }
@@ -13021,6 +13024,8 @@ async function startHookService(opts) {
   const cache3 = opts.cache ?? new SnapshotCache();
   let served = 0;
   let inFlight = false;
+  const sockets = /* @__PURE__ */ new Set();
+  let acceptedSocket = null;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const respond = (sock, body) => {
     try {
@@ -13053,6 +13058,7 @@ async function startHookService(opts) {
     if (named !== null && !within(root, named)) return respond(sock, { refused: "payload cwd outside the bound repository" });
     if (inFlight) return respond(sock, { refused: "another request is in flight" });
     inFlight = true;
+    acceptedSocket = sock;
     sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n");
     setImmediate(() => {
       try {
@@ -13071,24 +13077,38 @@ async function startHookService(opts) {
         respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
       } finally {
         inFlight = false;
+        acceptedSocket = null;
       }
     });
   };
   const server = createServer((sock) => {
+    sockets.add(sock);
     let buf = "";
     let answered = false;
     sock.setEncoding("utf8");
+    const deadline = setTimeout(() => {
+      if (answered) return;
+      answered = true;
+      respond(sock, { refused: "request deadline exceeded" });
+    }, REQUEST_DEADLINE_MS);
+    deadline.unref?.();
     sock.on("error", () => sock.destroy());
+    sock.on("close", () => {
+      clearTimeout(deadline);
+      sockets.delete(sock);
+    });
     sock.on("data", (chunk) => {
       if (answered) return;
       buf += chunk;
       if (buf.length > MAX_REQUEST_BYTES) {
         answered = true;
+        clearTimeout(deadline);
         return respond(sock, { refused: "request too large" });
       }
       const nl = buf.indexOf("\n");
       if (nl < 0) return;
       answered = true;
+      clearTimeout(deadline);
       handle(sock, buf.slice(0, nl));
     });
   });
@@ -13119,11 +13139,22 @@ async function startHookService(opts) {
       if (closed) return resolve17();
       closed = true;
       setSnapshotCache(null);
-      server.close(() => {
+      let settled = false;
+      let drain;
+      const finalize = () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(drain);
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
         resolve17();
-      });
+      };
+      server.close(finalize);
+      for (const sock of sockets) if (sock !== acceptedSocket) sock.destroy();
+      drain = setTimeout(() => {
+        for (const sock of sockets) sock.destroy();
+      }, SHUTDOWN_DRAIN_MS);
+      drain.unref?.();
     })
   };
 }
@@ -13261,7 +13292,7 @@ function runHookService(args) {
   });
   return -1;
 }
-var MAX_REQUEST_BYTES, STOP_WAIT_MS;
+var MAX_REQUEST_BYTES, STOP_WAIT_MS, REQUEST_DEADLINE_MS, SHUTDOWN_DRAIN_MS;
 var init_hook_service = __esm({
   "src/cli/hook-service.ts"() {
     "use strict";
@@ -13274,6 +13305,8 @@ var init_hook_service = __esm({
     init_hook_client();
     MAX_REQUEST_BYTES = 64 * 1024 * 1024;
     STOP_WAIT_MS = 1e4;
+    REQUEST_DEADLINE_MS = 3e4;
+    SHUTDOWN_DRAIN_MS = 5e3;
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.17",
+  "version": "2.29.19",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",