tamperward 2.39.13 → 2.39.15

package/dist/cli/index.js

@@ -20173,15 +20173,15 @@ function immutableRuntimeCapabilities(caps) {
 function immutableRuntimeAdapter(adapter) {
   return Object.freeze(adapter);
 }
-function unknownToolFinding(toolName) {
+function unknownToolFinding(runtime, toolName) {
   const name = toolName.length > 80 ? toolName.slice(0, 77) + "..." : toolName;
-  const detail = 'Copilot tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
+  const detail = runtime + ' tool "' + name + `" is not in TamperWard's explicit operation vocabulary`;
   return {
     rule: "unknown-tool",
     severity: "block",
     message: "TamperWard cannot safely classify " + detail + "; it is denied rather than treated as a no-op.",
     evidence: detail,
-    remediation: "Confirm the tool is non-mutating and add it to the Copilot adapter allowlist, or obtain an explicit sign-off before retrying.",
+    remediation: "Confirm the tool is non-mutating and add it to the " + runtime + " adapter allowlist, or obtain an explicit sign-off before retrying.",
     signoff: { required: true, command: 'tamperward allow --reason "..."' }
   };
 }
@@ -20592,7 +20592,8 @@ function codexOperationKind(toolName) {
   if (FILE_EDIT_TOOLS.has(toolName)) return "file-edit";
   if (toolName.startsWith(MCP_PREFIX)) return "mcp";
   if (FILE_READ_TOOLS.has(toolName)) return "file-read";
-  return "other";
+  if (NON_MUTATING_TOOLS.has(toolName)) return "other";
+  return "unknown";
 }
 function inputFrom(parsed) {
   return {
@@ -20625,7 +20626,7 @@ function normalizeCodexEvent(raw, phase) {
   }
   return eventFrom2(inputFrom(parsed), phase);
 }
-var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, MCP_PREFIX;
+var SHELL_TOOLS, FILE_EDIT_TOOLS, FILE_READ_TOOLS, NON_MUTATING_TOOLS, MCP_PREFIX;
 var init_schema = __esm({
   "src/adapters/codex/schema.ts"() {
     "use strict";
@@ -20633,6 +20634,7 @@ var init_schema = __esm({
     SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
     FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Write", "Edit"]);
     FILE_READ_TOOLS = /* @__PURE__ */ new Set(["view_image"]);
+    NON_MUTATING_TOOLS = /* @__PURE__ */ new Set(["update_plan", "web_search"]);
     MCP_PREFIX = "mcp__";
   }
 });
@@ -20728,6 +20730,12 @@ var init_adapter2 = __esm({
           const findings = swept.findings ? [...swept.findings] : [];
           return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
+        if (parsed.operation.kind === "unknown") {
+          const detail = `unrecognized Codex tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
+          const findings = [unknownToolFinding("Codex", parsed.operation.name)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());
           const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
@@ -20865,7 +20873,7 @@ function copilotOperationKind(toolName) {
   if (FILE_EDIT_TOOLS2.has(name)) return "file-edit";
   if (name.startsWith(MCP_PREFIX2)) return "mcp";
   if (FILE_READ_TOOLS2.has(name)) return "file-read";
-  if (NON_MUTATING_TOOLS.has(name)) return "other";
+  if (NON_MUTATING_TOOLS2.has(name)) return "other";
   return "unknown";
 }
 function argsFrom(parsed) {
@@ -20929,7 +20937,7 @@ function copilotStopInput(raw) {
     ...input.stop_hook_active !== void 0 ? { stop_hook_active: input.stop_hook_active } : {}
   });
 }
-var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, NON_MUTATING_TOOLS, MCP_PREFIX2;
+var SHELL_TOOLS2, FILE_EDIT_TOOLS2, FILE_READ_TOOLS2, NON_MUTATING_TOOLS2, MCP_PREFIX2;
 var init_schema2 = __esm({
   "src/adapters/copilot/schema.ts"() {
     "use strict";
@@ -20937,7 +20945,7 @@ var init_schema2 = __esm({
     SHELL_TOOLS2 = /* @__PURE__ */ new Set(["bash", "powershell", "write_bash", "write_powershell"]);
     FILE_EDIT_TOOLS2 = /* @__PURE__ */ new Set(["create", "edit", "write", "multiedit", "apply_patch", "str_replace_editor"]);
     FILE_READ_TOOLS2 = /* @__PURE__ */ new Set(["view", "read", "grep", "rg", "glob"]);
-    NON_MUTATING_TOOLS = /* @__PURE__ */ new Set([
+    NON_MUTATING_TOOLS2 = /* @__PURE__ */ new Set([
       "read_bash",
       "read_powershell",
       "stop_bash",
@@ -21074,7 +21082,7 @@ var init_adapter3 = __esm({
         }
         if (parsed.operation.kind === "unknown") {
           const detail = `unrecognized Copilot tool ${parsed.operation.name}; refusing to evaluate it as a no-op`;
-          const findings = [unknownToolFinding(parsed.operation.name)];
+          const findings = [unknownToolFinding("Copilot", parsed.operation.name)];
           const wire = this.denyPayload(findings, "pre-action");
           return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
         }
@@ -21332,8 +21340,13 @@ function copilotSdkOperationKind(kind) {
       return "file-read";
     case "mcp":
       return "mcp";
-    default:
+    case "":
+    case "url":
+    case "memory":
+    case "hook":
       return "other";
+    default:
+      return "unknown";
   }
 }
 function str2(v) {
@@ -21371,8 +21384,13 @@ function argsFor(req2) {
   }
   return {};
 }
+function operationFrom(req2) {
+  const kind = copilotSdkOperationKind(req2.kind);
+  const name = kind === "unknown" ? req2.toolName || req2.kind || "" : req2.toolName ?? "";
+  return { kind, name, args: argsFor(req2) };
+}
 function eventFrom4(req2, phase) {
-  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotSdkOperationKind(req2.kind), name: req2.toolName ?? "", args: argsFor(req2) };
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : operationFrom(req2);
   const identity2 = { claimedCwd: req2.cwd, sessionId: req2.sessionId };
   return { phase, operation, identity: identity2 };
 }
@@ -21480,7 +21498,8 @@ var init_adapter4 = __esm({
        *     `onAgentStop` `{decision:"block",reason}` shape.
        *  5. `pre-action` + shell → the SAME `evaluate` engine over the reconstructed command.
        *  6. `pre-action` + file-edit → `unsupported` (content not surfaced; sweep is authority).
-       *  7. `pre-action` + read/mcp/other → no Change → allow.
+       *  7. `pre-action` + an unmodelled permission kind → an `unknown-tool` deny.
+       *  8. `pre-action` + read/mcp/other → no Change → allow.
        */
       decide(raw, phase, defaultCwd) {
         if (phase === "post-action") {
@@ -21509,6 +21528,12 @@ var init_adapter4 = __esm({
           const findings = swept.findings ? [...swept.findings] : [];
           return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
+        if (parsed.operation.kind === "unknown") {
+          const detail = `unrecognized Copilot SDK permission request ${parsed.operation.name}; refusing to evaluate it as a no-op`;
+          const findings = [unknownToolFinding("Copilot SDK", parsed.operation.name)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
         let stage = "repo-context";
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.13",
+  "version": "2.39.15",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",