tamperward 2.29.3 → 2.29.5

package/dist/cli/index.js

@@ -10801,14 +10801,14 @@ function renderText(input, opts) {
     const isBlock = f.severity === "block";
     const mark = paint(isBlock ? "BLOCK" : "warn ", isBlock ? BOLD + RED : YELLOW, c);
     const loc = f.file ? `${stripControl(escapeControl(f.file))}${f.line ? `:${f.line}` : ""}` : "(command)";
-    out3.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, DIM, c)}`);
+    out3.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, CYAN, c)}`);
     for (const l of wrap(f.message, opts.width - 4)) out3.push(`    ${l}`);
     const row = (key2, lines) => {
       lines.forEach((l, i) => out3.push(`    ${paint(pad(i === 0 ? key2 : ""), DIM, c)}  ${l}`));
     };
     row("evidence", [paint(clip(f.evidence, body), DIM, c)]);
     row("instead", wrap(f.remediation, body));
-    if (f.signoff.required) row("sign-off", [stripControl(f.signoff.command)]);
+    if (f.signoff.required) row("sign-off", [paint(stripControl(f.signoff.command), YELLOW, c)]);
     out3.push("");
   }
   if (blocks2.length > 0) {
@@ -10818,7 +10818,7 @@ function renderText(input, opts) {
   }
   return out3.join("\n").replace(/\n+$/, "") + "\n";
 }
-var ESC, RESET, BOLD, DIM, RED, YELLOW, GREEN, SIGNOFF_NOTE;
+var ESC, RESET, BOLD, DIM, truecolour, RED, YELLOW, GREEN, CYAN, SIGNOFF_NOTE;
 var init_text = __esm({
   "src/cli/render/text.ts"() {
     "use strict";
@@ -10827,9 +10827,11 @@ var init_text = __esm({
     RESET = `${ESC}[0m`;
     BOLD = `${ESC}[1m`;
     DIM = `${ESC}[2m`;
-    RED = `${ESC}[31m`;
-    YELLOW = `${ESC}[33m`;
-    GREEN = `${ESC}[32m`;
+    truecolour = (r, g, b) => `${ESC}[38;2;${r};${g};${b}m`;
+    RED = truecolour(255, 107, 107);
+    YELLOW = truecolour(227, 179, 65);
+    GREEN = truecolour(63, 185, 80);
+    CYAN = truecolour(86, 212, 221);
     SIGNOFF_NOTE = "A blocking finding clears only with a human sign-off. In CI that sign-off is out-of-band \u2014 a PR label applied by a reviewer \u2014 never a file committed on the branch under review. See SPEC \xA75.4.";
   }
 });
@@ -12759,6 +12761,7 @@ async function startHookService(opts) {
   removeQuietly(paths.state);
   const cache3 = opts.cache ?? new SnapshotCache();
   let served = 0;
+  let inFlight = false;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const respond = (sock, body) => {
     try {
@@ -12789,19 +12792,27 @@ async function startHookService(opts) {
     if (!within(root, req2.cwd)) return respond(sock, { refused: "cwd outside the bound repository" });
     const named = payloadCwd(req2.raw);
     if (named !== null && !within(root, named)) return respond(sock, { refused: "payload cwd outside the bound repository" });
-    sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n", () => {
-      let result;
+    if (inFlight) return respond(sock, { refused: "another request is in flight" });
+    inFlight = true;
+    sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n");
+    setImmediate(() => {
       try {
-        result = withEnv(req2.env, () => req2.kind === "PreToolUse" ? preToolUseFromRaw(req2.raw, req2.cwd) : stopFromRaw(req2.raw, req2.cwd));
-      } catch (e) {
-        const detail = e instanceof Error ? e.message : String(e);
-        const reason = `Tamperward's hook service could not complete the accepted evaluation (${detail}), so it is denied rather than retried concurrently.`;
-        const stdout = req2.kind === "PreToolUse" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }) + "\n" : JSON.stringify({ decision: "block", reason }) + "\n";
+        if (sock.destroyed || sock.writableEnded) return;
+        let result;
+        try {
+          result = withEnv(req2.env, () => req2.kind === "PreToolUse" ? preToolUseFromRaw(req2.raw, req2.cwd) : stopFromRaw(req2.raw, req2.cwd));
+        } catch (e) {
+          const detail = e instanceof Error ? e.message : String(e);
+          const reason = `Tamperward's hook service could not complete the accepted evaluation (${detail}), so it is denied rather than retried concurrently.`;
+          const stdout = req2.kind === "PreToolUse" ? JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } }) + "\n" : JSON.stringify({ decision: "block", reason }) + "\n";
+          served++;
+          return respond(sock, { exitCode: 0, stdout });
+        }
         served++;
-        return respond(sock, { exitCode: 0, stdout });
+        respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
+      } finally {
+        inFlight = false;
       }
-      served++;
-      respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
     });
   };
   const server = createServer((sock) => {
@@ -12860,36 +12871,44 @@ async function startHookService(opts) {
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+async function probeSocket(paths) {
+  if (socketRefusal(paths) !== null) return { answered: false, status: null };
+  const req2 = { v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, kind: "status", raw: "", cwd: process.cwd(), env: {} };
+  const res = await exchange(paths, req2, 1e3);
+  if (res === null) return { answered: false, status: null };
+  if (isRecord(res) && res.v === HOOK_SERVICE_PROTOCOL && typeof res.pid === "number" && typeof res.root === "string" && typeof res.version === "string") {
+    return { answered: true, status: { pid: res.pid, root: res.root, version: res.version } };
+  }
+  return { answered: true, status: null };
+}
+function describeStateFile(state) {
+  return state ? `records pid ${state.pid}, root ${state.root}, tamperward@${state.version}` : "is absent or unreadable";
+}
 async function stopHookService(paths) {
+  const probe = await probeSocket(paths);
   const state = readServiceState(paths);
-  let outcome = "not-running";
-  let confirmed = false;
-  if (state && state.pid !== process.pid && pidAlive2(state.pid) && state.version === TW_VERSION && socketRefusal(paths) === null) {
-    const req2 = {
-      v: HOOK_SERVICE_PROTOCOL,
-      version: TW_VERSION,
-      kind: "status",
-      raw: "",
-      cwd: process.cwd(),
-      env: {}
-    };
-    const res = await exchange(paths, req2, 1e3);
-    confirmed = isRecord(res) && res.v === HOOK_SERVICE_PROTOCOL && res.version === TW_VERSION && res.pid === state.pid && res.root === state.root;
-  }
-  if (state && confirmed) {
-    try {
-      process.kill(state.pid, "SIGTERM");
-    } catch {
+  if (probe.answered) {
+    const st = probe.status;
+    const agrees = st !== null && state !== null && state.pid === st.pid && state.root === st.root && state.version === st.version;
+    if (agrees && st.pid !== process.pid) {
+      try {
+        process.kill(st.pid, "SIGTERM");
+      } catch {
+      }
+      const gone = () => !pidAlive2(st.pid) || !existsSync11(paths.socket);
+      const until = Date.now() + STOP_WAIT_MS;
+      while (!gone() && Date.now() < until) sleepSync(50);
+      if (!gone()) throw new Error(`hook service pid ${st.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
+      removeQuietly(paths.socket);
+      removeQuietly(paths.state);
+      return { outcome: "stopped", pid: st.pid };
     }
-    const gone = () => !pidAlive2(state.pid) || !existsSync11(paths.socket);
-    const until = Date.now() + STOP_WAIT_MS;
-    while (!gone() && Date.now() < until) sleepSync(50);
-    if (!gone()) throw new Error(`hook service pid ${state.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
-    outcome = "stopped";
+    const detail = st ? `a listener answered on ${paths.socket} (pid ${st.pid}, root ${st.root}, tamperward@${st.version}) but the state file ${describeStateFile(state)}` : `a listener answered on ${paths.socket} but did not report a readable status (possibly a different tamperward version); the state file ${describeStateFile(state)}`;
+    return { outcome: "mismatch", pid: st?.pid ?? state?.pid, root: st?.root ?? state?.root, detail };
   }
   removeQuietly(paths.socket);
   removeQuietly(paths.state);
-  return outcome;
+  return { outcome: "not-running" };
 }
 function parseStart(args) {
   let dir = process.cwd();
@@ -12928,8 +12947,21 @@ function runHookService(args) {
     return -1;
   }
   if (sub === "stop") {
-    return stopHookService(paths).then((outcome) => {
-      process.stdout.write(`tamperward hook-service: ${outcome === "stopped" ? "stopped" : "not running"}; ${paths.socket} removed
+    return stopHookService(paths).then((res) => {
+      if (res.outcome === "stopped") {
+        process.stdout.write(`tamperward hook-service: stopped (pid ${res.pid}); ${paths.socket} removed
+`);
+        return 0;
+      }
+      if (res.outcome === "mismatch") {
+        process.stderr.write(
+          `tamperward hook-service: NOT stopped \u2014 ${res.detail}. The socket was left intact; a live listener is never orphaned. ` + (res.pid ? `If you mean to stop it, signal it directly: kill ${res.pid}.
+` : `Inspect the process holding ${paths.socket} to stop it.
+`)
+        );
+        return 1;
+      }
+      process.stdout.write(`tamperward hook-service: not running; ${paths.socket} removed
 `);
       return 0;
     });
@@ -12937,22 +12969,33 @@ function runHookService(args) {
   const state = readServiceState(paths);
   const refusal = socketRefusal(paths);
   const optIn = hookServiceEnabled() ? `${HOOK_SERVICE_ENV}=1 (hooks consult the service)` : `${HOOK_SERVICE_ENV} unset (hooks run in-process)`;
-  if (!state || !pidAlive2(state.pid) || refusal !== null) {
-    process.stdout.write(`tamperward hook-service: not running (${refusal ?? "no live pid"}); ${optIn}
+  if (refusal !== null) {
+    process.stdout.write(`tamperward hook-service: not running (${refusal}); ${optIn}
 `);
     return 0;
   }
   const req2 = { v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, kind: "status", raw: "", cwd: process.cwd(), env: {} };
   void exchange(paths, req2, 5e3).then((res) => {
-    if (!isRecord(res) || typeof res.served !== "number") {
-      process.stdout.write(`tamperward hook-service: not running (pid ${state.pid} did not answer, or is another version); ${optIn}
+    if (res === null) {
+      process.stdout.write(`tamperward hook-service: not running (socket did not connect); ${optIn}
 `);
       exitAfterFlush(0);
       return;
     }
+    if (!isRecord(res) || typeof res.served !== "number" || typeof res.pid !== "number" || typeof res.root !== "string" || typeof res.version !== "string") {
+      process.stdout.write(
+        `tamperward hook-service: a listener answered on ${paths.socket} but did not report a readable status (possibly a different tamperward version); the state file ${state ? `records pid ${state.pid}, tamperward@${state.version}` : "is absent or unreadable"}; ${optIn}
+`
+      );
+      exitAfterFlush(0);
+      return;
+    }
     const cache3 = isRecord(res.cache) ? res.cache : {};
+    const startedAt = typeof res.started_at === "string" ? res.started_at : state?.started_at ?? "unknown";
+    const disagrees = !state || state.pid !== res.pid || state.root !== res.root || state.version !== res.version;
+    const warn = disagrees ? `WARNING: the state file ${describeStateFile(state)}, which disagrees with the live listener; ` : "";
     process.stdout.write(
-      `tamperward hook-service: running (pid ${state.pid}, tamperward@${state.version}, root ${state.root}, since ${state.started_at}); served: ${res.served}; snapshot cache hits/misses/entries: ${String(cache3.hits ?? 0)}/${String(cache3.misses ?? 0)}/${String(cache3.size ?? 0)}; ${optIn}
+      `tamperward hook-service: running (pid ${res.pid}, tamperward@${res.version}, root ${res.root}, since ${startedAt}); served: ${res.served}; snapshot cache hits/misses/entries: ${String(cache3.hits ?? 0)}/${String(cache3.misses ?? 0)}/${String(cache3.size ?? 0)}; ${warn}${optIn}
 `
     );
     exitAfterFlush(0);
@@ -18153,7 +18196,7 @@ async function runOnboard(opts, io = {}) {
     if (kind === "ok") return GREEN2;
     if (kind === "warn") return YELLOW2;
     if (kind === "bad") return RED2;
-    if (kind === "info") return CYAN;
+    if (kind === "info") return CYAN2;
     return DIM2;
   };
   const status = (label, text, kind = "info") => {
@@ -18210,7 +18253,7 @@ async function runOnboard(opts, io = {}) {
   const section = (n) => {
     sectionNo = n;
     out3("");
-    out3(paint2(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD2 + CYAN, colour));
+    out3(paint2(n + "/" + SECTIONS.length + "  " + SECTIONS[n - 1], BOLD2 + CYAN2, colour));
   };
   const wrote = [];
   let verifyCommand;
@@ -18552,7 +18595,7 @@ function runDemo(cwd, head, runners, out3) {
     out3("changed it while the demo ran; inspect with `git status`.");
   }
 }
-var Aborted, SECTIONS, MANUAL_CONTROLS, ESC2, RESET2, BOLD2, DIM2, RED2, YELLOW2, GREEN2, CYAN, JS_TEST_PATH, JS_TEST_BLOCK;
+var Aborted, SECTIONS, MANUAL_CONTROLS, ESC2, RESET2, BOLD2, DIM2, RED2, YELLOW2, GREEN2, CYAN2, JS_TEST_PATH, JS_TEST_BLOCK;
 var init_onboard = __esm({
   "src/cli/onboard.ts"() {
     "use strict";
@@ -18589,7 +18632,7 @@ var init_onboard = __esm({
     RED2 = `${ESC2}[31m`;
     YELLOW2 = `${ESC2}[33m`;
     GREEN2 = `${ESC2}[32m`;
-    CYAN = `${ESC2}[36m`;
+    CYAN2 = `${ESC2}[36m`;
     JS_TEST_PATH = /(?:^|\/)(?:[^/]+\.(?:test|spec)\.[cm]?[jt]sx?|__tests__\/[^/]+\.[cm]?[jt]sx?)$/;
     JS_TEST_BLOCK = /^(\s*)(it|test|describe)(\s*\()/m;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.3",
+  "version": "2.29.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",