tamperward 2.39.0 → 2.39.1

package/dist/cli/index.js

@@ -19963,18 +19963,13 @@ var init_adapter = __esm({
     init_contract();
     ClaudeRuntimeAdapter = class {
       name = "claude-code";
-      /**
-       * Claude Code's live PreToolUse fires for EVERY tool and can synchronously deny it —
-       * shell, file edit, file read, MCP, and anything else — even under
-       * `--dangerously-skip-permissions`. The end-of-turn Stop sweep is live too. There is no
-       * live per-tool PostToolUse veto (Stop is the post-turn reconciliation), so `postObserve`
-       * is empty and `unsupported` names that gap explicitly rather than implying it.
-       */
       capabilities = {
-        preDeny: OPERATION_KINDS,
+        preDeny: OPERATION_KINDS.filter((kind) => kind !== "mcp" && kind !== "other"),
         postObserve: [],
         endOfTurn: true,
         unsupported: [
+          "MCP pre-deny is not declared because Claude MCP calls are not reconstructed into Change[] before evaluation",
+          "catch-all other-tool pre-deny is not declared because unmodelled Claude tools are not reconstructed into Change[] before evaluation",
           "per-operation post-action veto (end-of-turn Stop sweep is the post-turn reconciliation)",
           "network-egress control",
           "identity / authentication"
@@ -20041,26 +20036,28 @@ var init_adapter = __esm({
         const parsed = this.parseEvent(raw, phase);
         if ("failure" in parsed) {
           const live2 = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd) : preToolUseFromRaw(raw, defaultCwd);
+          const findings2 = live2.findings ? [...live2.findings] : [];
           return {
             outcome: "parse-failure",
             detail: parsed.detail,
             wire: live2.stdout,
-            decision: { verdict: "deny", findings: [], reason: live2.stdout }
+            decision: { verdict: "deny", findings: findings2, reason: live2.stdout }
           };
         }
         const idv = this.validateIdentity(parsed.identity, defaultCwd);
         if (!idv.ok) {
-          const findings = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
-          const wire2 = this.denyPayload(findings, phase);
-          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire2 } };
+          const findings2 = [steeringUnavailableFinding(`repository identity claim rejected: ${idv.rejected}`)];
+          const wire2 = this.denyPayload(findings2, phase);
+          return { outcome: "ok", wire: wire2, detail: idv.rejected, decision: { verdict: "deny", findings: findings2, reason: wire2 } };
         }
         const live = phase === "end-of-turn" ? stopFromRaw(raw, defaultCwd, idv.trustedRoot) : preToolUseFromRaw(raw, defaultCwd, idv.trustedRoot);
         const wire = live.stdout;
         const denied = wire.length > 0;
+        const findings = live.findings ? [...live.findings] : [];
         return {
           outcome: "ok",
           wire,
-          decision: { verdict: denied ? "deny" : "allow", findings: [], reason: denied ? wire : void 0 }
+          decision: { verdict: denied ? "deny" : "allow", findings, reason: denied ? wire : void 0 }
         };
       }
       /**
@@ -20439,8 +20436,9 @@ var init_adapter2 = __esm({
           return { outcome: "ok", wire, detail: idv.rejected, decision: { verdict: "deny", findings, reason: wire } };
         }
         if (phase === "end-of-turn") {
-          const wire = stopFromRaw(raw, defaultCwd, idv.trustedRoot).stdout;
-          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+          const swept = stopFromRaw(raw, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
@@ -20778,12 +20776,13 @@ var init_adapter3 = __esm({
         if (phase === "end-of-turn") {
           const stopInput = copilotStopInput(raw);
           if (typeof stopInput !== "string") {
-            const findings = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
-            const wire2 = this.denyPayload(findings, "end-of-turn");
-            return { outcome: "parse-failure", detail: stopInput.detail, wire: wire2, decision: { verdict: "deny", findings, reason: wire2 } };
+            const findings2 = [steeringUnavailableFinding(`unparseable Copilot event: ${stopInput.detail}`)];
+            const wire = this.denyPayload(findings2, "end-of-turn");
+            return { outcome: "parse-failure", detail: stopInput.detail, wire, decision: { verdict: "deny", findings: findings2, reason: wire } };
           }
-          const wire = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot).stdout;
-          return { outcome: "ok", wire, decision: { verdict: wire ? "deny" : "allow", findings: [], reason: wire || void 0 } };
+          const swept = stopFromRaw(stopInput, defaultCwd, idv.trustedRoot);
+          const findings = swept.findings ? [...swept.findings] : [];
+          return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
         if (parsed.operation.kind === "unknown") {
           const detail = `unrecognized Copilot tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
@@ -21985,7 +21984,8 @@ function storedQualification(adapter, cwd, opts = {}) {
   const validated = validateStoredReport(raw);
   if ("reason" in validated) return { state: "rejected", reason: validated.reason };
   const stored = validated.report;
-  const { binding: current } = buildQualification(adapter, opts, cwd);
+  const currentQualification = buildQualification(adapter, opts, cwd);
+  const current = currentQualification.binding;
   const storedBinding = {
     runtime: stored.runtime,
     tamperward: stored.tamperward,
@@ -21999,6 +21999,12 @@ function storedQualification(adapter, cwd, opts = {}) {
     evidence_id: stored.evidence_id
   };
   const staleness = qualificationStaleness(storedBinding, current);
+  if (!staleness.stale && (stored.evidence_id !== current.evidence_id || JSON.stringify(stored.capabilities) !== JSON.stringify(currentQualification.assessments))) {
+    return {
+      state: "rejected",
+      reason: "stored qualification posture does not match retained evidence for the current binding"
+    };
+  }
   return { state: "recorded", report: stored, stale: staleness.stale, changed_inputs: staleness.changed };
 }
 function runRuntime(sub, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.0",
+  "version": "2.39.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",