tamperward 2.39.23 → 2.39.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/cli/index.js +20 -0
  2. package/package.json +1 -1
package/dist/cli/index.js CHANGED
@@ -20815,8 +20815,14 @@ var init_adapter2 = __esm({
20815
20815
  const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
20816
20816
  turnBaseline(root, parsed.identity.sessionId);
20817
20817
  const policy = loadPolicy(root);
20818
+ const drift = effectDriftBlocks(root, parsed.identity.sessionId, policy);
20819
+ if (drift) {
20820
+ const wire2 = this.denyPayload(drift, "pre-action");
20821
+ return { outcome: "ok", wire: wire2, decision: { verdict: "deny", findings: drift, reason: wire2 } };
20822
+ }
20818
20823
  const changes = changesFromCodex(parsed.operation, root, sessionCwd);
20819
20824
  const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
20825
+ if (findings.length === 0) sanctionPredictedWrites(root, parsed.identity.sessionId, policy, changes);
20820
20826
  const wire = this.denyPayload(findings, "pre-action");
20821
20827
  return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
20822
20828
  } catch (e) {
@@ -21166,8 +21172,14 @@ var init_adapter3 = __esm({
21166
21172
  const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
21167
21173
  turnBaseline(root, parsed.identity.sessionId);
21168
21174
  const policy = loadPolicy(root);
21175
+ const drift = effectDriftBlocks(root, parsed.identity.sessionId, policy);
21176
+ if (drift) {
21177
+ const wire2 = this.denyPayload(drift, "pre-action");
21178
+ return { outcome: "ok", wire: wire2, decision: { verdict: "deny", findings: drift, reason: wire2 } };
21179
+ }
21169
21180
  const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
21170
21181
  const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
21182
+ if (findings.length === 0) sanctionPredictedWrites(root, parsed.identity.sessionId, policy, changes);
21171
21183
  const wire = this.denyPayload(findings, "pre-action");
21172
21184
  return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
21173
21185
  } catch (e) {
@@ -21623,12 +21635,19 @@ var init_adapter4 = __esm({
21623
21635
  const sessionCwd = parsed.identity.claimedCwd ?? defaultCwd ?? process.cwd();
21624
21636
  stage = "policy-load";
21625
21637
  const policy = loadPolicy(root);
21638
+ stage = "evaluate";
21639
+ const drift = effectDriftBlocks(root, parsed.identity.sessionId, policy);
21640
+ if (drift) {
21641
+ const wire2 = this.denyPayload(drift, "pre-action");
21642
+ return { outcome: "ok", wire: wire2, decision: { verdict: "deny", findings: drift, reason: wire2 } };
21643
+ }
21626
21644
  if (parsed.operation.kind === "file-edit") {
21627
21645
  stage = "reconstruction";
21628
21646
  const changes2 = sdkFileEditChanges(parsed.operation.args, root, sessionCwd);
21629
21647
  if (changes2 === null) return { outcome: "unsupported", detail: FILE_EDIT_NO_CONTENT_DETAIL };
21630
21648
  stage = "evaluate";
21631
21649
  const findings2 = evaluate(changes2, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
21650
+ if (findings2.length === 0) sanctionPredictedWrites(root, parsed.identity.sessionId, policy, changes2);
21632
21651
  const wire2 = this.denyPayload(findings2, "pre-action");
21633
21652
  return { outcome: "ok", wire: wire2, decision: { verdict: findings2.length ? "deny" : "allow", findings: findings2, reason: wire2 || void 0 } };
21634
21653
  }
@@ -21636,6 +21655,7 @@ var init_adapter4 = __esm({
21636
21655
  const changes = changesFromCopilot(parsed.operation, root, sessionCwd);
21637
21656
  stage = "evaluate";
21638
21657
  const findings = evaluate(changes, policy, void 0, "tool-call", { cwd: root }).filter((f) => f.severity === "block");
21658
+ if (findings.length === 0) sanctionPredictedWrites(root, parsed.identity.sessionId, policy, changes);
21639
21659
  const wire = this.denyPayload(findings, "pre-action");
21640
21660
  return { outcome: "ok", wire, decision: { verdict: findings.length ? "deny" : "allow", findings, reason: wire || void 0 } };
21641
21661
  } catch (e) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "tamperward",
3
- "version": "2.39.23",
3
+ "version": "2.39.24",
4
4
  "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "hexrift",