tamperward 2.29.2 → 2.29.4

package/dist/cli/index.js

@@ -1391,10 +1391,10 @@ function relForDisplay(path, cwd) {
   const rel = relative(cwd, path);
   return rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : path;
 }
-function applyEdit(content, oldStr, newStr) {
+function applyEdit(content, oldStr, newStr, replaceAll = false) {
   if (content === null) return newStr;
   if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
-  return content.replace(oldStr, () => newStr);
+  return replaceAll ? content.replaceAll(oldStr, () => newStr) : content.replace(oldStr, () => newStr);
 }
 function synthFileChange(displayPath, before, after) {
   if (before === after) return [];
@@ -1446,7 +1446,7 @@ function changesFromClaudeHook(input, cwd, base = cwd) {
       const fp = asStr(ti.file_path);
       if (!fp) return [];
       const before = readDisk(abs(fp));
-      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string));
+      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string), ti.replace_all === true);
       return synthFileChange(relForDisplay(abs(fp), cwd), before, after);
     }
     case "MultiEdit": {
@@ -1457,7 +1457,7 @@ function changesFromClaudeHook(input, cwd, base = cwd) {
       const edits = Array.isArray(ti.edits) ? ti.edits : [];
       for (const raw of edits) {
         const ed = isRecord(raw) ? raw : {};
-        after = applyEdit(after, asStr(ed.old_string), asStr(ed.new_string));
+        after = applyEdit(after, asStr(ed.old_string), asStr(ed.new_string), ed.replace_all === true);
       }
       return synthFileChange(relForDisplay(abs(fp), cwd), before, after);
     }
@@ -12759,6 +12759,7 @@ async function startHookService(opts) {
   removeQuietly(paths.state);
   const cache3 = opts.cache ?? new SnapshotCache();
   let served = 0;
+  let inFlight = false;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const respond = (sock, body) => {
     try {
@@ -12789,19 +12790,27 @@ async function startHookService(opts) {
     if (!within(root, req2.cwd)) return respond(sock, { refused: "cwd outside the bound repository" });
     const named = payloadCwd(req2.raw);
     if (named !== null && !within(root, named)) return respond(sock, { refused: "payload cwd outside the bound repository" });
-    sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n", () => {
-      let result;
+    if (inFlight) return respond(sock, { refused: "another request is in flight" });
+    inFlight = true;
+    sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n");
+    setImmediate(() => {
       try {
-        result = withEnv(req2.env, () => req2.kind === "PreToolUse" ? preToolUseFromRaw(req2.raw, req2.cwd) : stopFromRaw(req2.raw, req2.cwd));
-      } catch (e) {
-        const detail = e instanceof Error ? e.message : String(e);
-        const reason = `Tamperward's hook service could not complete the accepted evaluation (${detail}), so it is denied rather than retried concurrently.`;
-        const stdout = req2.kind === "PreToolUse" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }) + "\n" : JSON.stringify({ decision: "block", reason }) + "\n";
+        if (sock.destroyed || sock.writableEnded) return;
+        let result;
+        try {
+          result = withEnv(req2.env, () => req2.kind === "PreToolUse" ? preToolUseFromRaw(req2.raw, req2.cwd) : stopFromRaw(req2.raw, req2.cwd));
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const reason = `Tamperward's hook service could not complete the accepted evaluation (${detail}), so it is denied rather than retried concurrently.`;
+          const stdout = req2.kind === "PreToolUse" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }) + "\n" : JSON.stringify({ decision: "block", reason }) + "\n";
+          served++;
+          return respond(sock, { exitCode: 0, stdout });
+        }
         served++;
-        return respond(sock, { exitCode: 0, stdout });
+        respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
+      } finally {
+        inFlight = false;
       }
-      served++;
-      respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
     });
   };
   const server = createServer((sock) => {
@@ -12860,36 +12869,44 @@ async function startHookService(opts) {
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+async function probeSocket(paths) {
+  if (socketRefusal(paths) !== null) return { answered: false, status: null };
+  const req2 = { v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, kind: "status", raw: "", cwd: process.cwd(), env: {} };
+  const res = await exchange(paths, req2, 1e3);
+  if (res === null) return { answered: false, status: null };
+  if (isRecord(res) && res.v === HOOK_SERVICE_PROTOCOL && typeof res.pid === "number" && typeof res.root === "string" && typeof res.version === "string") {
+    return { answered: true, status: { pid: res.pid, root: res.root, version: res.version } };
+  }
+  return { answered: true, status: null };
+}
+function describeStateFile(state) {
+  return state ? `records pid ${state.pid}, root ${state.root}, tamperward@${state.version}` : "is absent or unreadable";
+}
 async function stopHookService(paths) {
+  const probe = await probeSocket(paths);
   const state = readServiceState(paths);
-  let outcome = "not-running";
-  let confirmed = false;
-  if (state && state.pid !== process.pid && pidAlive2(state.pid) && state.version === TW_VERSION && socketRefusal(paths) === null) {
-    const req2 = {
-      v: HOOK_SERVICE_PROTOCOL,
-      version: TW_VERSION,
-      kind: "status",
-      raw: "",
-      cwd: process.cwd(),
-      env: {}
-    };
-    const res = await exchange(paths, req2, 1e3);
-    confirmed = isRecord(res) && res.v === HOOK_SERVICE_PROTOCOL && res.version === TW_VERSION && res.pid === state.pid && res.root === state.root;
-  }
-  if (state && confirmed) {
-    try {
-      process.kill(state.pid, "SIGTERM");
-    } catch {
+  if (probe.answered) {
+    const st = probe.status;
+    const agrees = st !== null && state !== null && state.pid === st.pid && state.root === st.root && state.version === st.version;
+    if (agrees && st.pid !== process.pid) {
+      try {
+        process.kill(st.pid, "SIGTERM");
+      } catch {
+      }
+      const gone = () => !pidAlive2(st.pid) || !existsSync11(paths.socket);
+      const until = Date.now() + STOP_WAIT_MS;
+      while (!gone() && Date.now() < until) sleepSync(50);
+      if (!gone()) throw new Error(`hook service pid ${st.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
+      removeQuietly(paths.socket);
+      removeQuietly(paths.state);
+      return { outcome: "stopped", pid: st.pid };
     }
-    const gone = () => !pidAlive2(state.pid) || !existsSync11(paths.socket);
-    const until = Date.now() + STOP_WAIT_MS;
-    while (!gone() && Date.now() < until) sleepSync(50);
-    if (!gone()) throw new Error(`hook service pid ${state.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
-    outcome = "stopped";
+    const detail = st ? `a listener answered on ${paths.socket} (pid ${st.pid}, root ${st.root}, tamperward@${st.version}) but the state file ${describeStateFile(state)}` : `a listener answered on ${paths.socket} but did not report a readable status (possibly a different tamperward version); the state file ${describeStateFile(state)}`;
+    return { outcome: "mismatch", pid: st?.pid ?? state?.pid, root: st?.root ?? state?.root, detail };
   }
   removeQuietly(paths.socket);
   removeQuietly(paths.state);
-  return outcome;
+  return { outcome: "not-running" };
 }
 function parseStart(args) {
   let dir = process.cwd();
@@ -12928,8 +12945,21 @@ function runHookService(args) {
     return -1;
   }
   if (sub === "stop") {
-    return stopHookService(paths).then((outcome) => {
-      process.stdout.write(`tamperward hook-service: ${outcome === "stopped" ? "stopped" : "not running"}; ${paths.socket} removed
+    return stopHookService(paths).then((res) => {
+      if (res.outcome === "stopped") {
+        process.stdout.write(`tamperward hook-service: stopped (pid ${res.pid}); ${paths.socket} removed
+`);
+        return 0;
+      }
+      if (res.outcome === "mismatch") {
+        process.stderr.write(
+          `tamperward hook-service: NOT stopped \u2014 ${res.detail}. The socket was left intact; a live listener is never orphaned. ` + (res.pid ? `If you mean to stop it, signal it directly: kill ${res.pid}.
+` : `Inspect the process holding ${paths.socket} to stop it.
+`)
+        );
+        return 1;
+      }
+      process.stdout.write(`tamperward hook-service: not running; ${paths.socket} removed
 `);
       return 0;
     });
@@ -12937,22 +12967,33 @@ function runHookService(args) {
   const state = readServiceState(paths);
   const refusal = socketRefusal(paths);
   const optIn = hookServiceEnabled() ? `${HOOK_SERVICE_ENV}=1 (hooks consult the service)` : `${HOOK_SERVICE_ENV} unset (hooks run in-process)`;
-  if (!state || !pidAlive2(state.pid) || refusal !== null) {
-    process.stdout.write(`tamperward hook-service: not running (${refusal ?? "no live pid"}); ${optIn}
+  if (refusal !== null) {
+    process.stdout.write(`tamperward hook-service: not running (${refusal}); ${optIn}
 `);
     return 0;
   }
   const req2 = { v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, kind: "status", raw: "", cwd: process.cwd(), env: {} };
   void exchange(paths, req2, 5e3).then((res) => {
-    if (!isRecord(res) || typeof res.served !== "number") {
-      process.stdout.write(`tamperward hook-service: not running (pid ${state.pid} did not answer, or is another version); ${optIn}
+    if (res === null) {
+      process.stdout.write(`tamperward hook-service: not running (socket did not connect); ${optIn}
 `);
       exitAfterFlush(0);
       return;
     }
+    if (!isRecord(res) || typeof res.served !== "number" || typeof res.pid !== "number" || typeof res.root !== "string" || typeof res.version !== "string") {
+      process.stdout.write(
+        `tamperward hook-service: a listener answered on ${paths.socket} but did not report a readable status (possibly a different tamperward version); the state file ${state ? `records pid ${state.pid}, tamperward@${state.version}` : "is absent or unreadable"}; ${optIn}
+`
+      );
+      exitAfterFlush(0);
+      return;
+    }
     const cache3 = isRecord(res.cache) ? res.cache : {};
+    const startedAt = typeof res.started_at === "string" ? res.started_at : state?.started_at ?? "unknown";
+    const disagrees = !state || state.pid !== res.pid || state.root !== res.root || state.version !== res.version;
+    const warn = disagrees ? `WARNING: the state file ${describeStateFile(state)}, which disagrees with the live listener; ` : "";
     process.stdout.write(
-      `tamperward hook-service: running (pid ${state.pid}, tamperward@${state.version}, root ${state.root}, since ${state.started_at}); served: ${res.served}; snapshot cache hits/misses/entries: ${String(cache3.hits ?? 0)}/${String(cache3.misses ?? 0)}/${String(cache3.size ?? 0)}; ${optIn}
+      `tamperward hook-service: running (pid ${res.pid}, tamperward@${res.version}, root ${res.root}, since ${startedAt}); served: ${res.served}; snapshot cache hits/misses/entries: ${String(cache3.hits ?? 0)}/${String(cache3.misses ?? 0)}/${String(cache3.size ?? 0)}; ${warn}${optIn}
 `
     );
     exitAfterFlush(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.2",
+  "version": "2.29.4",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",