tamperward 2.39.13 → 2.39.14

package/dist/cli/index.js

@@ -20173,15 +20173,15 @@ function immutableRuntimeCapabilities(caps) {
 function immutableRuntimeAdapter(adapter) {
   return Object.freeze(adapter);
 }
-function unknownToolFinding(toolName) {
+function unknownToolFinding(runtime, toolName) {
   const name = toolName.length > 80 ? toolName.slice(0, 77) + "..." : toolName;
-  const detail = 'Copilot tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
+  const detail = runtime + ' tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
   return {
     rule: "unknown-tool",
     severity: "block",
     message: "TamperWard cannot safely classify " + detail + "; it is denied rather than treated as a no-op.",
     evidence: detail,
-    remediation: "Confirm the tool is non-mutating and add it to the Copilot adapter allowlist, or obtain an explicit sign-off before retrying.",
+    remediation: "Confirm the tool is non-mutating and add it to the " + runtime + " adapter allowlist, or obtain an explicit sign-off before retrying.",
     signoff: { required: true, command: 'tamperward allow --reason "..."' }
   };
 }
@@ -20592,7 +20592,8 @@ function codexOperationKind(toolName) {
   if (FILE_EDIT_TOOLS.has(toolName)) return "file-edit";
   if (toolName.startsWith(MCP_PREFIX)) return "mcp";
   if (FILE_READ_TOOLS.has(toolName)) return "file-read";
-  return "other";
+  if (NON_MUTATING_TOOLS.has(toolName)) return "other";
+  return "unknown";
 }
 function inputFrom(parsed) {
   return {
@@ -20625,7 +20626,7 @@ function normalizeCodexEvent(raw, phase) {
   }
   return eventFrom2(inputFrom(parsed), phase);
 }
-var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, MCP_PREFIX;
+var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, NON_MUTATING_TOOLS, MCP_PREFIX;
 var init_schema = __esm({
   "src/adapters/codex/schema.ts"() {
     "use strict";
@@ -20633,6 +20634,7 @@ var init_schema = __esm({
     SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
     FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Write", "Edit"]);
     FILE_READ_TOOLS = /* @__PURE__ */ new Set(["view_image"]);
+    NON_MUTATING_TOOLS = /* @__PURE__ */ new Set(["update_plan", "web_search"]);
     MCP_PREFIX = "mcp__";
   }
 });
@@ -20728,6 +20730,12 @@ var init_adapter2 = __esm({
           const findings = swept.findings ? [...swept.findings] : [];
           return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
+        if (parsed.operation.kind === "unknown") {
+          const detail = `unrecognized Codex tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
+          const findings = [unknownToolFinding("Codex", parsed.operation.name)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
           const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
@@ -20865,7 +20873,7 @@ function copilotOperationKind(toolName) {
   if (FILE_EDIT_TOOLS2.has(name)) return "file-edit";
   if (name.startsWith(MCP_PREFIX2)) return "mcp";
   if (FILE_READ_TOOLS2.has(name)) return "file-read";
-  if (NON_MUTATING_TOOLS.has(name)) return "other";
+  if (NON_MUTATING_TOOLS2.has(name)) return "other";
   return "unknown";
 }
 function argsFrom(parsed) {
@@ -20929,7 +20937,7 @@ function copilotStopInput(raw) {
     ...input.stop_hook_active !== void 0 ? { stop_hook_active: input.stop_hook_active } : {}
   });
 }
-var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, NON_MUTATING_TOOLS, MCP_PREFIX2;
+var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, NON_MUTATING_TOOLS2, MCP_PREFIX2;
 var init_schema2 = __esm({
   "src/adapters/copilot/schema.ts"() {
     "use strict";
@@ -20937,7 +20945,7 @@ var init_schema2 = __esm({
     SHELL_TOOLS2 = /* @__PURE__ */ new Set(["bash", "powershell", "write_bash", "write_powershell"]);
     FILE_EDIT_TOOLS2 = /* @__PURE__ */ new Set(["create", "edit", "write", "multiedit", "apply_patch", "str_replace_editor"]);
     FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read", "grep", "rg", "glob"]);
-    NON_MUTATING_TOOLS = /* @__PURE__ */ new Set([
+    NON_MUTATING_TOOLS2 = /* @__PURE__ */ new Set([
       "read_bash",
       "read_powershell",
       "stop_bash",
@@ -21074,7 +21082,7 @@ var init_adapter3 = __esm({
         }
         if (parsed.operation.kind === "unknown") {
           const detail = `unrecognized Copilot tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
-          const findings = [unknownToolFinding(parsed.operation.name)];
+          const findings = [unknownToolFinding("Copilot", parsed.operation.name)];
           const wire = this.denyPayload(findings, "pre-action");
           return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.13",
+  "version": "2.39.14",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",