tamperward 2.30.3 → 2.30.5

package/dist/cli/index.js

@@ -14882,7 +14882,7 @@ function runCapturedProcessSync(executable, args, opts) {
     rmSync6(stateDir, { recursive: true, force: true });
   }
 }
-var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CAPTURE_SUPERVISOR;
+var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CLEANUP_HELPERS_SRC, CAPTURE_SUPERVISOR;
 var init_suite_diagnostics = __esm({
   "src/suite-diagnostics.ts"() {
     "use strict";
@@ -14894,40 +14894,32 @@ var init_suite_diagnostics = __esm({
       truncated: false,
       tail: ""
     };
-    CAPTURE_SUPERVISOR = String.raw`
-const cp = require('node:child_process');
-const fs = require('node:fs');
-
-const [configFile] = process.argv.slice(1);
-const cfg = JSON.parse(fs.readFileSync(configFile, 'utf8'));
-const CAP = Number(cfg.captureBytes);
-
-const fresh = () => ({ total: 0, tail: Buffer.alloc(0) });
-const stdout = fresh();
-const stderr = fresh();
-
-// Linux ordinary-exit hardening (#371): process-group ownership alone misses a
-// descendant that calls setsid(). Track the real descendant tree while the
-// suite is alive so a reparented session escape is still known when the main
-// child exits. This supplements, rather than replaces, group termination.
-const trackedDescendants = new Set();
+    CLEANUP_HELPERS_SRC = String.raw`
+function readStat(pid) {
+  try {
+    const stat = fs.readFileSync('/proc/' + pid + '/stat', 'utf8');
+    const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    const ppid = Number(fields[1]);
+    const starttime = fields[19];
+    if (!Number.isFinite(ppid) || starttime === undefined) return null;
+    return { ppid: ppid, starttime: starttime };
+  } catch (e) { return null; }
+}
 
 function linuxDescendants(rootPid) {
   if (process.platform !== 'linux' || !rootPid) return [];
   const byParent = new Map();
+  const startById = new Map();
   let names = [];
-  try { names = fs.readdirSync('/proc').filter((x) => /^\d+$/.test(x)); } catch { return []; }
+  try { names = fs.readdirSync('/proc').filter((x) => /^\d+$/.test(x)); } catch (e) { return []; }
   for (const name of names) {
     const pid = Number(name);
-    try {
-      const stat = fs.readFileSync('/proc/' + name + '/stat', 'utf8');
-      const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
-      const ppid = Number(fields[1]);
-      if (!Number.isFinite(ppid)) continue;
-      const kids = byParent.get(ppid) || [];
-      kids.push(pid);
-      byParent.set(ppid, kids);
-    } catch {}
+    const st = readStat(pid);
+    if (!st) continue;
+    startById.set(pid, st.starttime);
+    const kids = byParent.get(st.ppid) || [];
+    kids.push(pid);
+    byParent.set(st.ppid, kids);
   }
   const out = [];
   const seen = new Set([rootPid]);
@@ -14937,16 +14929,56 @@ function linuxDescendants(rootPid) {
     for (const pid of (byParent.get(parent) || [])) {
       if (seen.has(pid)) continue;
       seen.add(pid);
-      out.push(pid);
+      out.push({ pid: pid, starttime: startById.get(pid) });
       stack.push(pid);
     }
   }
   return out;
 }
 
+function killableDescendants(tracked) {
+  const out = [];
+  for (const entry of tracked) {
+    const pid = entry[0];
+    const starttime = entry[1];
+    const st = readStat(pid);
+    if (st && st.starttime === starttime) out.push(pid);
+  }
+  return out;
+}
+
+function cleanupPlan(child, cfg, platform, killable) {
+  const live = !!child && child.exitCode === null && child.signalCode === null;
+  return {
+    signalGroup: !!(live && cfg.detached && platform !== 'win32'),
+    signalMainChild: live,
+    descendants: platform === 'linux' ? killable() : [],
+  };
+}
+`;
+    CAPTURE_SUPERVISOR = String.raw`
+const cp = require('node:child_process');
+const fs = require('node:fs');
+
+const [configFile] = process.argv.slice(1);
+const cfg = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+const CAP = Number(cfg.captureBytes);
+
+const fresh = () => ({ total: 0, tail: Buffer.alloc(0) });
+const stdout = fresh();
+const stderr = fresh();
+
+// Linux ordinary-exit hardening (#371): process-group ownership alone misses a
+// descendant that calls setsid(). Track the real descendant tree while the
+// suite is alive so a reparented session escape is still known when the main
+// child exits. This supplements, rather than replaces, group termination.
+// pid -> the /proc start-time observed for that pid, so cleanup can re-check
+// identity before signalling (a bare pid alone can be reused — #545).
+const trackedDescendants = new Map();
+${CLEANUP_HELPERS_SRC}
 function trackDescendants() {
   if (!child || !child.pid || process.platform !== 'linux') return;
-  for (const pid of linuxDescendants(child.pid)) trackedDescendants.add(pid);
+  for (const d of linuxDescendants(child.pid)) trackedDescendants.set(d.pid, d.starttime);
 }
 
 function append(state, chunk) {
@@ -14981,17 +15013,17 @@ let drainTimer = null;
 function killOwned() {
   if (!child || !child.pid) return;
   trackDescendants();
-  if (cfg.detached && process.platform !== 'win32') {
-    try { process.kill(-child.pid, 'SIGKILL'); } catch {}
-  }
-  try { child.kill('SIGKILL'); } catch {}
-  if (process.platform === 'linux') {
-    // Deepest-first is friendlier to short-lived process trees. PIDs are still
-    // rechecked by kill(2); races with natural exit are harmless.
-    for (const pid of Array.from(trackedDescendants).reverse()) {
-      try { process.kill(pid, 'SIGKILL'); } catch {}
-    }
-  }
+  // The main child and its detached group are signalled only while the child is
+  // still reported live: after its exit event the pid can be reused, and both
+  // child.kill() and kill(-pid) resolve the current bearer of that number (#545).
+  // Descendants are the independently identity-checked set (deepest-first, which
+  // is friendlier to short-lived process trees).
+  const plan = cleanupPlan(child, cfg, process.platform, function () {
+    return killableDescendants(Array.from(trackedDescendants).reverse());
+  });
+  if (plan.signalGroup) { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }
+  if (plan.signalMainChild) { try { child.kill('SIGKILL'); } catch {} }
+  for (const pid of plan.descendants) { try { process.kill(pid, 'SIGKILL'); } catch {} }
 }
 
 function finish(extra) {
@@ -15974,7 +16006,7 @@ function verifyVerdictLine(verdict2, ctx) {
   }
 }
 function runVerify(opts) {
-  const cwd = opts.cwd ?? process.cwd();
+  const cwd = repoRoot(opts.cwd ?? process.cwd());
   const colour = opts.silent ? false : colourEnabled(process.env, process.stdout);
   const paintVerify = (s) => {
     if (!s.startsWith("verify:")) return s;
@@ -16406,6 +16438,7 @@ var init_verify = __esm({
   "src/cli/verify.ts"() {
     "use strict";
     init_policy_load();
+    init_repo_context();
     init_build();
     init_trusted();
     init_fingerprint();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.30.3",
+  "version": "2.30.5",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",