tamperward 2.30.1 → 2.30.3

package/dist/cli/index.js

@@ -866,10 +866,10 @@ function headerPaths(line) {
         first = rest.slice(0, mid);
         rest = rest.slice(mid + 1);
       } else {
-        const m = rest.match(/^(.*) (b\/.*)$/);
-        if (!m) return [null, null];
-        first = m[1];
-        rest = m[2];
+        const at = rest.lastIndexOf(" b/");
+        if (at < 0) return [null, null];
+        first = rest.slice(0, at);
+        rest = rest.slice(at + 1);
       }
     }
   }
@@ -2874,7 +2874,6 @@ function expandShellPath(t, env = process.env) {
 function hookTests(policy, ctx) {
   const cwd = ctx?.cwd;
   const diskCwd = cwd !== void 0 && existsSync3(cwd) ? cwd : void 0;
-  const onDisk = diskCwd !== void 0;
   const root = diskCwd !== void 0 ? canonicalPath(diskCwd) : cwd;
   const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
@@ -2938,7 +2937,7 @@ function shellHookTarget(seg, toks, policy, ctx) {
   return null;
 }
 function shellWritesHook(seg, toks, policy, ctx) {
-  const { rel, hook, whole, holds, hookish } = hookTests(policy, ctx);
+  const { hook, whole, holds, hookish } = hookTests(policy, ctx);
   for (const m of seg.matchAll(REDIRECT_TARGET)) {
     if (hook(m[1])) return "a redirect empties or rewrites a protected hook";
   }
@@ -2947,7 +2946,6 @@ function shellWritesHook(seg, toks, policy, ctx) {
   const cmd = (toks[at] ?? "").replace(/^.*\//, "");
   const args = toks.slice(at + 1);
   const positional = args.filter((a) => a !== "--" && !a.startsWith("-"));
-  const last = positional[positional.length - 1] ?? "";
   const anyHook = args.some(hook);
   const inPlace = args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a));
   const scripts = args.filter((_, i) => i > 0 && INLINE_FLAG.test(args[i - 1]));
@@ -9837,7 +9835,8 @@ var init_test_deletion = __esm({
               fed.push(...toks);
               const testToks = source.filter((t) => expand(t).some(specPath));
               const dirToks = source.filter((t) => !t.startsWith("-") && !testToks.includes(t) && expand(t).some(dirPath));
-              if (testToks.length === 0 && dirToks.length === 0) continue;
+              const gitResetHard = toks.some((t) => t === "git" || t.endsWith("/git")) && toks.some((t) => t === "--hard" || t === "--merge" || t === "--keep");
+              if (testToks.length === 0 && dirToks.length === 0 && !(gitResetHard && rootHasProtected())) continue;
               const named = [...testToks, ...dirToks];
               let at = 0;
               while (at < toks.length && WRAPPERS.test(toks[at])) at++;
@@ -9856,9 +9855,19 @@ var init_test_deletion = __esm({
               const gitSub = cmd === "git" ? gitSubcommand(cmdToks) : null;
               const gitRestoresOld = (gitSub === "checkout" || gitSub === "restore") && (() => {
                 const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
+                const stagedRequested = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                const worktreeRequested = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                const stagedOnly = stagedRequested && !worktreeRequested;
+                if (stagedOnly) return false;
                 const revIdx = cmdToks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
                 const rev2 = src ?? (revIdx >= 0 ? cmdToks[revIdx] : void 0);
-                if (!rev2 || rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true) return false;
+                if (rev2 && (rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true)) return false;
+                if (!rev2) {
+                  const stagedRequested2 = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                  const worktreeRequested2 = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                  const stagedOnly2 = stagedRequested2 && !worktreeRequested2;
+                  return !stagedOnly2 && gitSub === "restore";
+                }
                 if (src || seg.includes(" -- ")) return true;
                 return revIdx >= 0 && cmdToks.some((t, i) => i > revIdx && named.includes(t));
               })();
@@ -9894,6 +9903,8 @@ var init_test_deletion = __esm({
                 why = "find -delete removes test files";
               } else if (gitRestoresOld) {
                 why = "git checkout <rev> replaces a test file with an older version";
+              } else if (gitSub === "reset" && gitResetHard) {
+                why = "git reset can discard changes to a test file";
               } else if (cmd === "mv") {
                 const dest = positional[positional.length - 1];
                 if (dest && testToks.length > 0 && !isSpec(dest)) {
@@ -11144,7 +11155,7 @@ function annotations(findings) {
   });
 }
 function cell(s) {
-  return stripControl(s).replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
+  return stripControl(s).replace(/\s+/g, " ").replace(/\\/g, "\\\\").replace(/\|/g, "\\|").trim();
 }
 function mdCode(s) {
   return s.replace(/`/g, "'").replace(/[\r\n]/g, " ");
@@ -14512,7 +14523,7 @@ function freezeRoot(kind, path) {
   }
 }
 function shellTokens(command) {
-  const matches = command.match(/(?:[^\s"'\\]+|"(?:\\.|[^"])*"|'[^']*')+/g) ?? [];
+  const matches = command.match(/(?:[^\s"'\\]|"[^"\\]*(?:\\.[^"\\]*)*"|'[^']*')+/g) ?? [];
   return matches.map((token) => {
     if (token.startsWith("'") && token.endsWith("'") || token.startsWith('"') && token.endsWith('"')) return token.slice(1, -1);
     return token;
@@ -15079,7 +15090,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash11, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync16, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve7 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -15124,7 +15135,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash11("sha256").update(readFileSync16(path)).digest("hex");
+  return createHash11("sha256").update(readFileSync15(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -15558,7 +15569,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname8, isAbsolute as isAbsolute11, join as join19, relative as relative5, resolve as resolve8, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -15779,7 +15790,7 @@ function overlayDigest(dest, paths) {
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync17(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {
       h.update("<gone>");
     }
@@ -16493,7 +16504,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync18, readlinkSync as readlinkSync4, realpathSync as realpathSync9, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname9, join as join20, resolve as resolve9 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -16548,7 +16559,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   }
   for (const candidate of candidates) {
     try {
-      const real = realpathSync9(candidate);
+      const real = realpathSync8(candidate);
       const st = statSync5(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
@@ -16647,7 +16658,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync18(resultFile, "utf8"));
+      state = JSON.parse(readFileSync17(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -16691,7 +16702,7 @@ function observerExited(pid) {
   if (!pidAlive3(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -16813,7 +16824,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync18("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -16822,7 +16833,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out3 = [];
   let real;
   try {
-    real = realpathSync9(cwd);
+    real = realpathSync8(cwd);
   } catch {
     return out3;
   }
@@ -16836,7 +16847,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -17408,7 +17419,7 @@ raise SystemExit(0)
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync5 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
 import { join as join21, resolve as resolve10 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
@@ -17467,7 +17478,7 @@ function pinsInFile(path) {
   if (!existsSync15(path)) return [];
   let src = "";
   try {
-    src = readFileSync19(path, "utf8");
+    src = readFileSync18(path, "utf8");
   } catch {
     return [];
   }
@@ -17494,7 +17505,7 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync19(path, "utf8"));
+      doc = yaml.parse(readFileSync18(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -17918,7 +17929,7 @@ function diagnose(opts = {}) {
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync19(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync18(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -18097,9 +18108,9 @@ import { execFileSync as execFileSync11, spawnSync as spawnSync5 } from "node:ch
 import {
   existsSync as existsSync16,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync6,
-  realpathSync as realpathSync10,
+  realpathSync as realpathSync9,
   rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "node:fs";
@@ -18116,7 +18127,7 @@ function parseStraceFileAccess(raw) {
     const call = line.match(/\b(execveat|execve|openat2|openat|open|newfstatat|fstatat|statx|lstat|stat|access|readlinkat|readlink)\s*\(/);
     if (!call) continue;
     const afterCall = line.slice((call.index ?? 0) + call[0].length);
-    const quoted = afterCall.match(/"((?:\\.|[^"])*)"/);
+    const quoted = afterCall.match(/"([^"\\]*(?:\\.[^"\\]*)*)"/);
     if (!quoted) continue;
     const path = unescapeStraceString(quoted[1]);
     if (!path) continue;
@@ -18263,7 +18274,7 @@ function rewriteTraceRoot(accesses, actualRoot) {
     if (!inside3(actualRoot, abs)) return { ...item, path: abs };
     const rel = relative6(actualRoot, abs).split(sep4).join("/");
     try {
-      const real = resolve11(realpathSync10(abs));
+      const real = resolve11(realpathSync9(abs));
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
@@ -18302,7 +18313,7 @@ function straceOnce(root, command, budget) {
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8")));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync19(path, "utf8")));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -18532,7 +18543,7 @@ var init_trace_verify = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
 import { join as join23 } from "node:path";
 function isRecord4(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
@@ -18563,7 +18574,7 @@ function claudeSettingsBeyondTamperward(cwd) {
   let raw;
   try {
     if (!existsSync17(path)) return false;
-    raw = readFileSync21(path, "utf8");
+    raw = readFileSync20(path, "utf8");
   } catch {
     return false;
   }
@@ -18670,7 +18681,7 @@ var init_runtimes = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync22, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join24, relative as relative7, resolve as resolve12, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -18743,7 +18754,7 @@ function writeVerifyCommand(cwd, command) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -18803,7 +18814,7 @@ async function runOnboard(opts, io = {}) {
   const cwd = resolve12(rootText);
   let sameRoot = cwd === requestedCwd;
   try {
-    sameRoot = realpathSync11(cwd) === realpathSync11(requestedCwd);
+    sameRoot = realpathSync10(cwd) === realpathSync10(requestedCwd);
   } catch {
   }
   if (!sameRoot) {
@@ -19143,8 +19154,8 @@ function runDemo(cwd, head, runners, out3) {
     let worktreeRoot;
     let realTarget;
     try {
-      worktreeRoot = realpathSync11(wt);
-      realTarget = realpathSync11(targetPath);
+      worktreeRoot = realpathSync10(wt);
+      realTarget = realpathSync10(targetPath);
     } catch {
       out3("Demo skipped: the selected test could not be resolved safely inside the disposable worktree.");
       return;
@@ -19328,8 +19339,8 @@ var init_capture = __esm({
 });
 
 // src/research/manifest.ts
-import { createHash as createHash14 } from "node:crypto";
-import { readFileSync as readFileSync23 } from "node:fs";
+import { createHash as createHash13 } from "node:crypto";
+import { readFileSync as readFileSync22 } from "node:fs";
 import { dirname as dirname10, resolve as resolve14 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
@@ -19363,7 +19374,7 @@ function readManifest(path) {
   const abs = resolve14(path);
   let bytes;
   try {
-    bytes = readFileSync23(abs);
+    bytes = readFileSync22(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -19386,7 +19397,7 @@ function readManifest(path) {
     if (seen.has(t.id)) throw new ResearchError(`task manifest ${abs}: duplicate task id "${t.id}"`);
     seen.add(t.id);
   }
-  return { path: abs, sha256: createHash14("sha256").update(bytes).digest("hex"), tasks };
+  return { path: abs, sha256: createHash13("sha256").update(bytes).digest("hex"), tasks };
 }
 var MANIFEST_VERSION;
 var init_manifest = __esm({
@@ -19575,7 +19586,7 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join25, resolve as resolve15 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -19586,7 +19597,7 @@ function pairRecordPath(ledger, task, pair) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync24(path, "utf8"));
+    raw = JSON.parse(readFileSync23(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -19626,12 +19637,15 @@ function writeRecordAtomically(path, text) {
   writeFileSync11(tmp, text);
   renameSync4(tmp, path);
 }
+function cloneArgs(repo, ws3) {
+  return ["-c", "protocol.ext.allow=never", "clone", "-q", "--no-hardlinks", "--", repo, ws3];
+}
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
   const ws3 = join25(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
   rmSync11(ws3, { recursive: true, force: true });
   mkdirSync9(join25(ledger, "workspaces"), { recursive: true });
   try {
-    execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws3], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync13("git", cloneArgs(task.repo, ws3), { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (e) {
     throw new ResearchError(`task "${task.id}": cannot clone ${task.repo}: ${errorMessage(e).split("\n")[0]}`);
   }
@@ -20009,7 +20023,7 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync25 } from "node:fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
 import { join as join26, resolve as resolve16 } from "node:path";
 function readLedger2(dir) {
   const pairsDir = join26(resolve16(dir), "pairs");
@@ -20024,7 +20038,7 @@ function readLedger2(dir) {
     const path = join26(pairsDir, n);
     let raw;
     try {
-      raw = JSON.parse(readFileSync25(path, "utf8"));
+      raw = JSON.parse(readFileSync24(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -20731,7 +20745,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -20744,7 +20758,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync26(0, "utf8");
+      raw = readFileSync25(0, "utf8");
     } catch {
       raw = null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.30.1",
+  "version": "2.30.3",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",