tamperward 2.39.22 → 2.39.23

package/dist/cli/index.js

@@ -153,7 +153,16 @@ function resolvesToClaudeSettings(path, env = process.env) {
   if (isClaudeSettings(path, env)) return true;
   return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
 }
-var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS;
+function runtimeWiringOf(path) {
+  const p = path.replace(/\\/g, "/");
+  if (CODEX_HOOK_CONFIG.test(p)) return "codex";
+  if (COPILOT_HOOK_CONFIG.test(p)) return "copilot";
+  return null;
+}
+function resolvesToRuntimeWiring(path) {
+  return runtimeWiringOf(path) ?? (isAbsolute(path) ? runtimeWiringOf(canonicalPath(path)) : null);
+}
+var PLAIN_SEMVER, RESOLVED_TW_VERSION, TW_VERSION, GIT_HEAD_RE, TW_COMMIT, PRE_TOOLS, PRE_MATCHER, MARKER, NPX_AUTHORITY, AUTHORITY_FAIL_CLOSED, HOOK_CMD, SWEEP_CMD, PRECOMMIT_CMD, OURS, INIT_SCRIPT, CLAUDE_SETTINGS, CODEX_HOOK_CONFIG, COPILOT_HOOK_CONFIG;
 var init_wiring = __esm({
   "src/wiring.ts"() {
     "use strict";
@@ -174,6 +183,8 @@ var init_wiring = __esm({
     OURS = /^\s*npx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (?:(hook claude|sweep claude) \|\| \(echo tamperward: authority failed to start >&2 && exit 2\)|(check --staged))\s*$/;
     INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? check --staged\n*$/;
     CLAUDE_SETTINGS = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|managed-settings\.json)$/;
+    CODEX_HOOK_CONFIG = /(?:^|\/)\.codex\/config\.toml$/;
+    COPILOT_HOOK_CONFIG = /(?:^|\/)\.github\/hooks\/tamperward\.json$/;
   }
 });
 
@@ -588,6 +599,12 @@ function defaultPolicy(version = 1) {
         "**/.tamperward.yml",
         ".claude/settings.json",
         ".claude/settings.local.json",
+        // The project hook wiring of the experimental runtimes: where Codex reads
+        // project hooks and where the Copilot CLI reads repository hooks. Each is
+        // the interception for its runtime; removing or weakening it before a
+        // protected edit is the tamper, and the gate must see the wiring change.
+        ".codex/config.toml",
+        ".github/hooks/tamperward.json",
         "**/.pre-commit-config.yaml",
         // CODEOWNERS is enforcement wiring, not documentation: it is the only
         // thing that can require a human on a change to the workflow that
@@ -2736,6 +2753,45 @@ function codeownersWeakening(before, after, extra = []) {
   }
   return out3;
 }
+function codexHooksTables(toml) {
+  const out3 = [];
+  let inHooks = false;
+  for (const raw of toml.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const table = line.match(TOML_TABLE);
+    if (table) inHooks = isHooksTable(table[1].replace(/["']/g, ""));
+    if (inHooks) out3.push(line);
+  }
+  return out3.join("\n");
+}
+function codexHooksWeakening(before, after) {
+  const was = codexHooksTables(before);
+  if (!was) return [];
+  const now = codexHooksTables(after);
+  if (now === was) return [];
+  if (GATE.test(was) && !GATE.test(now)) return ["the tamperward hook entries were removed from the [hooks] tables \u2014 Codex no longer runs the gate"];
+  return ["the [hooks] tables changed \u2014 the PreToolUse and Stop wiring Codex reads is no longer what it was"];
+}
+function hooksMember(src) {
+  let doc;
+  try {
+    doc = JSON.parse(src);
+  } catch {
+    return null;
+  }
+  if (!isDoc(doc)) return { hooks: null };
+  return { hooks: doc.hooks === void 0 ? null : JSON.stringify(doc.hooks) };
+}
+function copilotHooksWeakening(before, after) {
+  const was = hooksMember(before);
+  if (was === null || was.hooks === null) return [];
+  const now = hooksMember(after);
+  if (now === null) return ["the file no longer parses as JSON \u2014 the Copilot CLI loads no hook from it"];
+  if (now.hooks === was.hooks) return [];
+  if (GATE.test(was.hooks) && !GATE.test(now.hooks ?? "")) return ['the tamperward hook entries were removed from "hooks" \u2014 the Copilot CLI no longer runs the gate'];
+  return ['the "hooks" entries changed \u2014 the preToolUse and agentStop wiring the Copilot CLI reads is no longer what it was'];
+}
 function parseDoc(src) {
   try {
     const v = yaml.parse(src);
@@ -3184,7 +3240,7 @@ function xargsWritesHook(toks, fed, policy, ctx) {
   if ((cmd === "sed" || cmd === "perl") && args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a))) return `xargs ${cmd} -i rewrites a protected hook named earlier in the line`;
   return null;
 }
-var isComment, RUNNER, TOOL, SCRIPT, SUBCOMMAND_TOOLS, PREFIX, MODE, CWD, unq, alwaysTrue, EXIT_ZERO, EXIT_ANY, FN_DEF, SENSITIVE_ENV, assignedNames, WAIT_PID, TRANSPARENT, strip, baseIdentity, isCodeowners, GATE_CRITICAL, isDoc, isLefthook, isLefthookLocal, isPreCommitConfig, isPackageJson, GATE, str, list, redirectingEnv, off, STAGE_ALIAS, GATE_STAGES, ALL_STAGES, normStage, INSTALL_SCRIPTS, GIT_HOOKS, ownerExec, SYMBOLIC, WRAPPERS, INTERPRETERS, INLINE_FLAG, EDITORS, SCRIPT_WORD, HOOK_BASENAMES, REDIRECT_TARGET;
+var isComment, RUNNER, TOOL, SCRIPT, SUBCOMMAND_TOOLS, PREFIX, MODE, CWD, unq, alwaysTrue, EXIT_ZERO, EXIT_ANY, FN_DEF, SENSITIVE_ENV, assignedNames, WAIT_PID, TRANSPARENT, strip, baseIdentity, isCodeowners, GATE_CRITICAL, TOML_TABLE, isHooksTable, isDoc, isLefthook, isLefthookLocal, isPreCommitConfig, isPackageJson, GATE, str, list, redirectingEnv, off, STAGE_ALIAS, GATE_STAGES, ALL_STAGES, normStage, INSTALL_SCRIPTS, GIT_HOOKS, ownerExec, SYMBOLIC, WRAPPERS, INTERPRETERS, INLINE_FLAG, EDITORS, SCRIPT_WORD, HOOK_BASENAMES, REDIRECT_TARGET;
 var init_hook_wiring = __esm({
   "src/detectors/hook-wiring.ts"() {
     "use strict";
@@ -3244,6 +3300,8 @@ var init_hook_wiring = __esm({
       "/lefthook.yml",
       "/lefthook.yaml"
     ];
+    TOML_TABLE = /^\s*\[\[?\s*([^\]]*?)\s*\]\]?/;
+    isHooksTable = (name) => name === "hooks" || name.startsWith("hooks.");
     isDoc = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
     isLefthook = (path) => /(?:^|\/)\.?lefthook(?:-local)?\.(?:ya?ml|toml|json)$/.test(path);
     isLefthookLocal = (path) => /(?:^|\/)\.?lefthook-local\.(?:ya?ml|toml|json)$/.test(path);
@@ -8879,7 +8937,22 @@ function huskyRuntimeWrite(path, content, ctx) {
     (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
   );
 }
-var RULE9, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
+function runtimeWiringFindings(c, wiring, policy) {
+  const finding = (reason) => makeFinding(RULE9, policy, {
+    file: c.path,
+    message: `The ${RUNTIME_WIRING_LABEL[wiring]} hook wiring was weakened: ${reason}.`,
+    evidence: reason,
+    remediation: "Leave the hook entries that run tamperward as they were. Editing the wiring is editing the gate: restore it, or sign off."
+  });
+  if (c.after != null) {
+    if (c.before == null) return [];
+    const weaken = wiring === "codex" ? codexHooksWeakening : copilotHooksWeakening;
+    return weaken(c.before, c.after).map(finding);
+  }
+  const lost = removedLines(c).find((l) => /\btamperward\b/.test(l.content));
+  return lost ? [finding(`a line running tamperward was removed (\`${lost.content.trim()}\`)`)] : [];
+}
+var RULE9, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, RUNTIME_WIRING_LABEL, hookTampering;
 var init_hook_tampering = __esm({
   "src/detectors/hook-tampering.ts"() {
     "use strict";
@@ -8959,6 +9032,7 @@ They WILL FAIL in v10.0.0
     stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
     isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
     isHookNote = (path) => !/(?:^|\/)\.husky\/_\//.test(path) && /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
+    RUNTIME_WIRING_LABEL = { codex: "Codex", copilot: "Copilot CLI" };
     hookTampering = {
       id: RULE9,
       surface: ["file", "command"],
@@ -8967,8 +9041,9 @@ They WILL FAIL in v10.0.0
         const out3 = [];
         for (const c of changes) {
           let semantic;
+          let wiring;
           if (c.kind === "file") {
-            const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || resolvesToClaudeSettings(c.path);
+            const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || resolvesToClaudeSettings(c.path) || resolvesToRuntimeWiring(c.path) !== null;
             if (!targetsHook) {
               if (isPackageJson(c.path) && c.before != null && c.after != null) {
                 for (const reason of packageJsonWeakening(c.before, c.after)) {
@@ -9015,6 +9090,8 @@ They WILL FAIL in v10.0.0
             } else if ((c.path.endsWith(POLICY_FILE) || resolvesToClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy, ctx) : claudeSettingsFindings(c, policy)) !== null) {
               out3.push(...semantic);
             } else if (c.op === "rename") {
+            } else if ((wiring = resolvesToRuntimeWiring(c.path)) !== null) {
+              out3.push(...runtimeWiringFindings(c, wiring, policy));
             } else if (isCodeowners(c.path)) {
               if (c.before != null && c.after != null) {
                 for (const reason of codeownersWeakening(c.before, c.after, [...repoGateFiles(ctx), c.path])) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.22",
+  "version": "2.39.23",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",