tamperward 2.29.21 → 2.30.2

package/dist/cli/index.js

@@ -9837,7 +9837,8 @@ var init_test_deletion = __esm({
               fed.push(...toks);
               const testToks = source.filter((t) => expand(t).some(specPath));
               const dirToks = source.filter((t) => !t.startsWith("-") && !testToks.includes(t) && expand(t).some(dirPath));
-              if (testToks.length === 0 && dirToks.length === 0) continue;
+              const gitResetHard = toks.some((t) => t === "git" || t.endsWith("/git")) && toks.some((t) => t === "--hard" || t === "--merge" || t === "--keep");
+              if (testToks.length === 0 && dirToks.length === 0 && !(gitResetHard && rootHasProtected())) continue;
               const named = [...testToks, ...dirToks];
               let at = 0;
               while (at < toks.length && WRAPPERS.test(toks[at])) at++;
@@ -9856,9 +9857,19 @@ var init_test_deletion = __esm({
               const gitSub = cmd === "git" ? gitSubcommand(cmdToks) : null;
               const gitRestoresOld = (gitSub === "checkout" || gitSub === "restore") && (() => {
                 const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
+                const stagedRequested = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                const worktreeRequested = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                const stagedOnly = stagedRequested && !worktreeRequested;
+                if (stagedOnly) return false;
                 const revIdx = cmdToks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
                 const rev2 = src ?? (revIdx >= 0 ? cmdToks[revIdx] : void 0);
-                if (!rev2 || rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true) return false;
+                if (rev2 && (rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true)) return false;
+                if (!rev2) {
+                  const stagedRequested2 = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                  const worktreeRequested2 = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                  const stagedOnly2 = stagedRequested2 && !worktreeRequested2;
+                  return !stagedOnly2 && gitSub === "restore";
+                }
                 if (src || seg.includes(" -- ")) return true;
                 return revIdx >= 0 && cmdToks.some((t, i) => i > revIdx && named.includes(t));
               })();
@@ -9894,6 +9905,8 @@ var init_test_deletion = __esm({
                 why = "find -delete removes test files";
               } else if (gitRestoresOld) {
                 why = "git checkout <rev> replaces a test file with an older version";
+              } else if (gitSub === "reset" && gitResetHard) {
+                why = "git reset can discard changes to a test file";
               } else if (cmd === "mv") {
                 const dest = positional[positional.length - 1];
                 if (dest && testToks.length > 0 && !isSpec(dest)) {
@@ -10980,6 +10993,41 @@ var init_machine_output = __esm({
   }
 });
 
+// src/cli/render/status.ts
+function paint(s, code2, on) {
+  return on ? code2 + s + RESET : s;
+}
+function severityColour(sev) {
+  return TONE[sev].colour;
+}
+function statusLine(severity, label, text, colour) {
+  const t = TONE[severity];
+  const painted = paint(label.padEnd(STATUS_LABEL_WIDTH), (t.bold ? BOLD : "") + t.colour, colour);
+  return `${painted} ${text}`;
+}
+var ESC, RESET, BOLD, DIM, truecolour, RED, YELLOW, GREEN, CYAN, TONE, STATUS_LABEL_WIDTH;
+var init_status = __esm({
+  "src/cli/render/status.ts"() {
+    "use strict";
+    ESC = "\x1B";
+    RESET = `${ESC}[0m`;
+    BOLD = `${ESC}[1m`;
+    DIM = `${ESC}[2m`;
+    truecolour = (r, g, b) => `${ESC}[38;2;${r};${g};${b}m`;
+    RED = truecolour(255, 107, 107);
+    YELLOW = truecolour(227, 179, 65);
+    GREEN = truecolour(63, 185, 80);
+    CYAN = truecolour(86, 212, 221);
+    TONE = {
+      ok: { colour: GREEN, bold: false },
+      warn: { colour: YELLOW, bold: false },
+      bad: { colour: RED, bold: true },
+      info: { colour: CYAN, bold: false }
+    };
+    STATUS_LABEL_WIDTH = 8;
+  }
+});
+
 // src/cli/render/text.ts
 function colourEnabled(env = process.env, stream = process.stdout) {
   if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
@@ -10992,9 +11040,6 @@ function terminalWidth(stream = process.stdout) {
   if (!c || c < 40) return 80;
   return Math.min(c, 100);
 }
-function paint(s, code2, on) {
-  return on ? code2 + s + RESET : s;
-}
 function wrap(text, width) {
   const out3 = [];
   let cur = "";
@@ -11080,20 +11125,12 @@ function renderText(input, opts) {
   }
   return out3.join("\n").replace(/\n+$/, "") + "\n";
 }
-var ESC, RESET, BOLD, DIM, truecolour, RED, YELLOW, GREEN, CYAN, SIGNOFF_NOTE;
+var SIGNOFF_NOTE;
 var init_text = __esm({
   "src/cli/render/text.ts"() {
     "use strict";
     init_policy();
-    ESC = "\x1B";
-    RESET = `${ESC}[0m`;
-    BOLD = `${ESC}[1m`;
-    DIM = `${ESC}[2m`;
-    truecolour = (r, g, b) => `${ESC}[38;2;${r};${g};${b}m`;
-    RED = truecolour(255, 107, 107);
-    YELLOW = truecolour(227, 179, 65);
-    GREEN = truecolour(63, 185, 80);
-    CYAN = truecolour(86, 212, 221);
+    init_status();
     SIGNOFF_NOTE = "A blocking finding clears only with a human sign-off. In CI that sign-off is out-of-band \u2014 a PR label applied by a reviewer \u2014 never a file committed on the branch under review. See SPEC \xA75.4.";
   }
 });
@@ -15940,8 +15977,14 @@ function verifyVerdictLine(verdict2, ctx) {
 }
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  const colour = opts.silent ? false : colourEnabled(process.env, process.stdout);
+  const paintVerify = (s) => {
+    if (!s.startsWith("verify:")) return s;
+    const sev = /failing closed/i.test(s) ? "bad" : "info";
+    return paint("verify:", (sev === "bad" ? BOLD : "") + severityColour(sev), colour) + s.slice("verify:".length);
+  };
   const out3 = opts.silent ? (_s) => {
-  } : (s) => void process.stdout.write(s + "\n");
+  } : (s) => void process.stdout.write(paintVerify(s) + "\n");
   let filesystemCaseSensitive;
   const caseReport = () => filesystemCaseSensitive === void 0 ? {} : { filesystem_case_sensitive: filesystemCaseSensitive };
   const cannotVerify = (reason, detail, extra = {}) => {
@@ -16374,6 +16417,8 @@ var init_verify = __esm({
     init_machine_output();
     init_signoff();
     init_suite_diagnostics();
+    init_text();
+    init_status();
     OVERLAY_CLASSES = ["tests", "snapshots", "config"];
     VERIFICATION_SURFACE = [
       // Python / pytest — read from the rootdir, and conftest at any depth
@@ -17626,12 +17671,15 @@ function emitReport(opts, checks, authoritative) {
     process.stdout.write(JSON.stringify(report2) + "\n");
     return;
   }
+  const colour = colourEnabled(process.env, process.stdout);
   for (const check2 of checks) {
     if (check2.id === "observer") {
       process.stdout.write(`tamperward doctor: transient observer: ${check2.detail}
 `);
     } else {
-      process.stdout.write(`tamperward doctor: [${check2.state}] ${check2.id} \u2014 ${check2.detail}
+      const sev = check2.state === "OK" ? "ok" : check2.state === "WARN" ? "warn" : check2.state === "BROKEN" ? "bad" : "info";
+      const tag = paint(`[${check2.state}]`, (sev === "bad" ? BOLD : "") + severityColour(sev), colour);
+      process.stdout.write(`tamperward doctor: ${tag} ${check2.id} \u2014 ${check2.detail}
 `);
     }
   }
@@ -18021,6 +18069,8 @@ var init_doctor = __esm({
     init_machine_output();
     init_narrow();
     init_repo_context();
+    init_text();
+    init_status();
     VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
     REPOSITORY_REQUIRED_CHECKS = [
       "typecheck",
@@ -18665,9 +18715,6 @@ function readlineAsker(input, output) {
   };
   return ask;
 }
-function paint2(text, code2, on) {
-  return on ? code2 + text + RESET2 : text;
-}
 function terminalText(text) {
   return stripControl(text).replace(/\s+/g, " ").trim();
 }
@@ -18733,9 +18780,9 @@ function writeVerifyCommand(cwd, command) {
 }
 async function runOnboard(opts, io = {}) {
   const requestedCwd = resolve12(opts.cwd ?? process.cwd());
-  const out3 = io.out ?? ((line) => void process.stdout.write(line + "\n"));
-  const errLine = (line) => void process.stderr.write(line + "\n");
-  const rawErr = (line) => errLine(terminalText(line));
+  const out3 = io.out ?? ((line2) => void process.stdout.write(line2 + "\n"));
+  const errLine = (line2) => void process.stderr.write(line2 + "\n");
+  const rawErr = (line2) => errLine(terminalText(line2));
   const platform = io.platform ?? process.platform;
   const colour = io.colour ?? colourEnabled(process.env, process.stdout);
   const runners = {
@@ -18747,18 +18794,12 @@ async function runOnboard(opts, io = {}) {
   };
   const interactive = io.interactive ?? (Boolean(process.stdin.isTTY) && !process.env.CI && !process.env.GITHUB_ACTIONS);
   const scripted = Boolean(opts.yes);
-  const tone = (kind) => {
-    if (kind === "ok") return GREEN2;
-    if (kind === "warn") return YELLOW2;
-    if (kind === "bad") return RED2;
-    if (kind === "info") return CYAN2;
-    return DIM2;
-  };
+  const line = (label, text, kind) => kind === "dim" ? paint(label.padEnd(8), DIM, colour) + " " + terminalText(text) : statusLine(kind, label, terminalText(text), colour);
   const status = (label, text, kind = "info") => {
-    out3(paint2(label.padEnd(8), (kind === "bad" ? BOLD2 : "") + tone(kind), colour) + " " + terminalText(text));
+    out3(line(label, text, kind));
   };
   const errStatus = (label, text, kind = "info") => {
-    errLine(paint2(label.padEnd(8), (kind === "bad" ? BOLD2 : "") + tone(kind), colour) + " " + terminalText(text));
+    errLine(line(label, text, kind));
   };
   const fail = (text) => errStatus("ERROR", text, "bad");
   if (!interactive && !scripted) {
@@ -18808,7 +18849,7 @@ async function runOnboard(opts, io = {}) {
   const section = (n) => {
     sectionNo = n;
     out3("");
-    out3(paint2(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD2 + CYAN2, colour));
+    out3(paint(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD + CYAN, colour));
   };
   const wrote = [];
   let verifyCommand;
@@ -18818,9 +18859,9 @@ async function runOnboard(opts, io = {}) {
   let declined = false;
   let doctorOutcome = null;
   try {
-    out3(paint2("TamperWard onboarding", BOLD2, colour));
-    out3(paint2("v" + TW_VERSION + " \xB7 Node " + process.versions.node + " \xB7 " + platformLabel(platform) + "/" + process.arch, DIM2, colour));
-    out3(paint2(terminalText(cwd), DIM2, colour));
+    out3(paint("TamperWard onboarding", BOLD, colour));
+    out3(paint("v" + TW_VERSION + " \xB7 Node " + process.versions.node + " \xB7 " + platformLabel(platform) + "/" + process.arch, DIM, colour));
+    out3(paint(terminalText(cwd), DIM, colour));
     section(1);
     const lifecycle = lifecyclePlatformCheck(platform);
     const localVerifySupported = localVerifierShell(platform, "true") !== null;
@@ -18833,7 +18874,7 @@ async function runOnboard(opts, io = {}) {
     }
     const head = git5(cwd, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"])?.trim() ?? null;
     const treeStatus = git5(cwd, ["status", "--porcelain", "--untracked-files=all"]) ?? "";
-    const dirty = treeStatus.split("\n").filter(Boolean).map((line) => line.slice(3).split(" -> ").at(-1) ?? "");
+    const dirty = treeStatus.split("\n").filter(Boolean).map((line2) => line2.slice(3).split(" -> ").at(-1) ?? "");
     if (!head) {
       const count = dirty.length;
       status(
@@ -18955,7 +18996,7 @@ async function runOnboard(opts, io = {}) {
     }
     if (!verifyCommand) {
       status("ACTION", "Verification is not configured; CI will fail closed until it is.", "warn");
-      out3(paint2('         Set it later with: tamperward onboard --verify-command "<suite command>"', DIM2, colour));
+      out3(paint('         Set it later with: tamperward onboard --verify-command "<suite command>"', DIM, colour));
     } else if (!localVerifySupported) {
       status("LIMITED", "Local verification is unavailable on " + platformLabel(platform) + "; use a digest-pinned container verifier.", "warn");
     } else if (!head) {
@@ -18981,7 +19022,7 @@ async function runOnboard(opts, io = {}) {
         status("SKIP", "Safe demo becomes available after the first commit.", "dim");
       } else {
         const wanted = scripted ? Boolean(opts.demo) : opts.demo ? true : await confirm("Run the optional safe tamper demo? (temporary worktree only)", false, false);
-        if (wanted) runDemo(cwd, head, runners, (line) => out3(terminalText(line)));
+        if (wanted) runDemo(cwd, head, runners, (line2) => out3(terminalText(line2)));
       }
     }
     section(4);
@@ -19029,14 +19070,14 @@ async function runOnboard(opts, io = {}) {
       status("OK", "GitHub authority enforced for " + doctorOutcome.github.repo + "#" + doctorOutcome.github.branch + ".", "ok");
     } else if (!repo) {
       status("ACTION", "GitHub authority is not configured for this repository.", "warn");
-      out3(paint2("         If GitHub will provide repository authority, run: " + terminalText(doctorCommand), DIM2, colour));
-      out3(paint2("         If this repository will use GitHub CI authority, configure:", DIM2, colour));
-      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
+      out3(paint("         If GitHub will provide repository authority, run: " + terminalText(doctorCommand), DIM, colour));
+      out3(paint("         If this repository will use GitHub CI authority, configure:", DIM, colour));
+      for (const line2 of MANUAL_CONTROLS) out3(paint("           " + line2, DIM, colour));
     } else {
       status("ACTION", "GitHub authority is not verified yet.", "warn");
-      out3(paint2("         " + terminalText(doctorCommand), DIM2, colour));
-      out3(paint2("         GitHub authority requires all three controls:", DIM2, colour));
-      for (const line of MANUAL_CONTROLS) out3(paint2("           " + line, DIM2, colour));
+      out3(paint("         " + terminalText(doctorCommand), DIM, colour));
+      out3(paint("         GitHub authority requires all three controls:", DIM, colour));
+      for (const line2 of MANUAL_CONTROLS) out3(paint("           " + line2, DIM, colour));
     }
     const commitPaths = [...new Set(wrote)].filter((path) => committableSetupPath(cwd, path));
     if (commitPaths.length) {
@@ -19051,7 +19092,7 @@ async function runOnboard(opts, io = {}) {
     if (verifyResult) {
       status("VERIFY", verifyResult.summary?.verdict ?? "exit " + verifyResult.code, verifyResult.code === 0 ? "ok" : "warn");
     }
-    out3(paint2("         Daily: tamperward check --worktree \xB7 tamperward verify --base <base>", DIM2, colour));
+    out3(paint("         Daily: tamperward check --worktree \xB7 tamperward verify --base <base>", DIM, colour));
     return posture === "READY" || posture === "READY WITH WARNINGS" ? 0 : 1;
   } catch (e) {
     if (e instanceof Aborted) {
@@ -19069,9 +19110,7 @@ async function runOnboard(opts, io = {}) {
 }
 function renderCheck(check2, out3, colour) {
   const broken = check2.state === "BROKEN";
-  const label = broken ? "ERROR" : "WARN";
-  const code2 = broken ? BOLD2 + RED2 : YELLOW2;
-  out3(paint2(label.padEnd(8), code2, colour) + " " + terminalText(check2.id + " \u2014 " + check2.detail));
+  out3(statusLine(broken ? "bad" : "warn", broken ? "ERROR" : "WARN", terminalText(check2.id + " \u2014 " + check2.detail), colour));
 }
 function postureOf(outcome) {
   if (outcome.failure) return "INCOMPLETE";
@@ -19150,7 +19189,7 @@ function runDemo(cwd, head, runners, out3) {
     out3("changed it while the demo ran; inspect with `git status`.");
   }
 }
-var Aborted, SECTIONS, MANUAL_CONTROLS, ESC2, RESET2, BOLD2, DIM2, RED2, YELLOW2, GREEN2, CYAN2, JS_TEST_PATH, JS_TEST_BLOCK;
+var Aborted, SECTIONS, MANUAL_CONTROLS, JS_TEST_PATH, JS_TEST_BLOCK;
 var init_onboard = __esm({
   "src/cli/onboard.ts"() {
     "use strict";
@@ -19159,6 +19198,7 @@ var init_onboard = __esm({
     init_doctor();
     init_check();
     init_text();
+    init_status();
     init_fingerprint();
     init_policy();
     init_policy_load();
@@ -19180,14 +19220,6 @@ var init_onboard = __esm({
       "Code Owner review",
       "dismiss stale approvals when new commits are pushed"
     ];
-    ESC2 = "\x1B";
-    RESET2 = `${ESC2}[0m`;
-    BOLD2 = `${ESC2}[1m`;
-    DIM2 = `${ESC2}[2m`;
-    RED2 = `${ESC2}[31m`;
-    YELLOW2 = `${ESC2}[33m`;
-    GREEN2 = `${ESC2}[32m`;
-    CYAN2 = `${ESC2}[36m`;
     JS_TEST_PATH = /(?:^|\/)(?:[^/]+\.(?:test|spec)\.[cm]?[jt]sx?|__tests__\/[^/]+\.[cm]?[jt]sx?)$/;
     JS_TEST_BLOCK = /^(\s*)(it|test|describe)(\s*\()/m;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.21",
+  "version": "2.30.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -47,7 +47,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:perf-smoke": "vitest run --config vitest.perf-smoke.config.ts --no-file-parallelism",
-    "check": "node dist/cli/index.js check"
+    "check": "node dist/cli/index.js check",
+    "probe:codex-runtime": "node harness/adapters/codex-probe.mjs"
   },
   "dependencies": {
     "picomatch": "^4.0.2",