tamperward 2.39.14 → 2.39.16

package/dist/cli/index.js

@@ -21006,6 +21006,7 @@ var init_adapter3 = __esm({
         unsupported: [
           "pre-action deny enforcement not yet proven on a pinned Copilot CLI build (see probe:copilot-runtime)",
           "COMMAND preToolUse hook timeout fails OPEN on Copilot CLI: a timed-out hook lets the tool call proceed (crash / non-zero exit / exit 2 fail closed); an HTTP preToolUse hook fails OPEN on network error / timeout / non-2xx, so only the local command/exec transport is a qualification candidate",
+          "a COMMAND preToolUse hook that exits 0 with empty or malformed stdout fails OPEN on Copilot CLI: no decision is read, so the default permission lets the tool call proceed",
           "preToolUse is the only PRE-EXECUTION tool veto; agentStop can only block turn completion and force continuation (a lifecycle control, not a filesystem veto), and Copilot overrides the hook after 8 consecutive blocks (stop_hook_active lifecycle); postToolUse observation is not yet consumed by this adapter",
           "apply_patch / str_replace_editor exact hook payloads are modelled from the published contract but not yet confirmed against a pinned real-run fixture (str_replace_editor sub-ops other than str_replace/create fail closed); a PascalCase Edit carrying a patch-style payload fails closed unless a fixture proves the Edit-field rewrite",
           "shell-session write tools (write_bash / write_powershell) are classified as mutation-capable shell ops; their exact hook payload is not yet confirmed against a pinned fixture, so an event carrying no reconstructable command/input fails closed",
@@ -21340,8 +21341,13 @@ function copilotSdkOperationKind(kind) {
       return "file-read";
     case "mcp":
       return "mcp";
-    default:
+    case "":
+    case "url":
+    case "memory":
+    case "hook":
       return "other";
+    default:
+      return "unknown";
   }
 }
 function str2(v) {
@@ -21379,8 +21385,13 @@ function argsFor(req2) {
   }
   return {};
 }
+function operationFrom(req2) {
+  const kind = copilotSdkOperationKind(req2.kind);
+  const name = kind === "unknown" ? req2.toolName || req2.kind || "" : req2.toolName ?? "";
+  return { kind, name, args: argsFor(req2) };
+}
 function eventFrom4(req2, phase) {
-  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : { kind: copilotSdkOperationKind(req2.kind), name: req2.toolName ?? "", args: argsFor(req2) };
+  const operation = phase === "end-of-turn" ? { kind: "other", name: "stop", args: {} } : operationFrom(req2);
   const identity2 = { claimedCwd: req2.cwd, sessionId: req2.sessionId };
   return { phase, operation, identity: identity2 };
 }
@@ -21488,7 +21499,8 @@ var init_adapter4 = __esm({
        *     `onAgentStop` `{decision:"block",reason}` shape.
        *  5. `pre-action` + shell → the SAME `evaluate` engine over the reconstructed command.
        *  6. `pre-action` + file-edit → `unsupported` (content not surfaced; sweep is authority).
-       *  7. `pre-action` + read/mcp/other → no Change → allow.
+       *  7. `pre-action` + an unmodelled permission kind → an `unknown-tool` deny.
+       *  8. `pre-action` + read/mcp/other → no Change → allow.
        */
       decide(raw, phase, defaultCwd) {
         if (phase === "post-action") {
@@ -21517,6 +21529,12 @@ var init_adapter4 = __esm({
           const findings = swept.findings ? [...swept.findings] : [];
           return { outcome: "ok", wire: swept.stdout, decision: { verdict: swept.stdout ? "deny" : "allow", findings, reason: swept.stdout || void 0 } };
         }
+        if (parsed.operation.kind === "unknown") {
+          const detail = `unrecognized Copilot SDK permission request ${parsed.operation.name}; refusing to evaluate it as a no-op`;
+          const findings = [unknownToolFinding("Copilot SDK", parsed.operation.name)];
+          const wire = this.denyPayload(findings, "pre-action");
+          return { outcome: "ok", wire, detail, decision: { verdict: "deny", findings, reason: wire } };
+        }
         let stage = "repo-context";
         try {
           const root = idv.trustedRoot ?? repoRoot(defaultCwd ?? process.cwd());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.14",
+  "version": "2.39.16",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",