tamperward 2.38.3 → 2.38.4

package/dist/cli/index.js

@@ -19896,6 +19896,18 @@ var init_runtimes = __esm({
 });
 
 // src/adapters/contract.ts
+function unknownToolFinding(toolName) {
+  const name = toolName.length > 80 ? toolName.slice(0, 77) + "..." : toolName;
+  const detail = 'Copilot tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
+  return {
+    rule: "unknown-tool",
+    severity: "block",
+    message: "TamperWard cannot safely classify " + detail + "; it is denied rather than treated as a no-op.",
+    evidence: detail,
+    remediation: "Confirm the tool is non-mutating and add it to the Copilot adapter allowlist, or obtain an explicit sign-off before retrying.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
+}
 function steeringUnavailableFinding(detail) {
   return {
     rule: "tamperward-unavailable",
@@ -20567,7 +20579,8 @@ function copilotOperationKind(toolName) {
   if (FILE_EDIT_TOOLS2.has(name)) return "file-edit";
   if (name.startsWith(MCP_PREFIX2)) return "mcp";
   if (FILE_READ_TOOLS2.has(name)) return "file-read";
-  return "other";
+  if (NON_MUTATING_TOOLS.has(name)) return "other";
+  return "unknown";
 }
 function argsFrom(parsed) {
   if (isRecord(parsed.tool_input)) return parsed.tool_input;
@@ -20630,14 +20643,38 @@ function copilotStopInput(raw) {
     ...input.stop_hook_active !== void 0 ? { stop_hook_active: input.stop_hook_active } : {}
   });
 }
-var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, MCP_PREFIX2;
+var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, NON_MUTATING_TOOLS, MCP_PREFIX2;
 var init_schema2 = __esm({
   "src/adapters/copilot/schema.ts"() {
     "use strict";
     init_narrow();
     SHELL_TOOLS2 = /* @__PURE__ */ new Set(["bash", "powershell", "write_bash", "write_powershell"]);
     FILE_EDIT_TOOLS2 = /* @__PURE__ */ new Set(["create", "edit", "write", "multiedit", "apply_patch", "str_replace_editor"]);
-    FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read"]);
+    FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read", "grep", "rg", "glob"]);
+    NON_MUTATING_TOOLS = /* @__PURE__ */ new Set([
+      "read_bash",
+      "read_powershell",
+      "stop_bash",
+      "stop_powershell",
+      "list_bash",
+      "list_powershell",
+      "web_fetch",
+      "webfetch",
+      "web_search",
+      "websearch",
+      "ask_user",
+      "askuserquestion",
+      "report_intent",
+      "task",
+      "agent",
+      "skill",
+      "update_todo",
+      "todowrite",
+      "todo",
+      "list_agents",
+      "read_agent",
+      "write_agent"
+    ]);
     MCP_PREFIX2 = "mcp__";
   }
 });
@@ -20678,6 +20715,7 @@ var init_adapter3 = __esm({
           "preToolUse is the only PRE-EXECUTION tool veto; agentStop can only block turn completion and force continuation (a lifecycle control, not a filesystem veto), and Copilot overrides the hook after 8 consecutive blocks (stop_hook_active lifecycle); postToolUse observation is not yet consumed by this adapter",
           "apply_patch / str_replace_editor exact hook payloads are modelled from the published contract but not yet confirmed against a pinned real-run fixture (str_replace_editor sub-ops other than str_replace/create fail closed); a PascalCase Edit carrying a patch-style payload fails closed unless a fixture proves the Edit-field rewrite",
           "shell-session write tools (write_bash / write_powershell) are classified as mutation-capable shell ops; their exact hook payload is not yet confirmed against a pinned fixture, so an event carrying no reconstructable command/input fails closed",
+          "MCP names are recognized by prefix but are not reconstructed into pre-action changes here; until MCP payload modelling is proven, the end-of-turn sweep remains the authority for their effects",
           "network-egress control",
           "identity / authentication"
         ]
@@ -20747,6 +20785,12 @@ var init_adapter3 = __esm({
           const wire = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot).stdout;
           return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
         }
+        if (parsed.operation.kind === "unknown") {
+          const detail = `unrecognized Copilot tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
+          const findings = [unknownToolFinding(parsed.operation.name)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
           const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.38.3",
+  "version": "2.38.4",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",