tamperward 2.39.5 → 2.39.7

package/dist/cli/index.js

@@ -1239,11 +1239,26 @@ function git(args, cwd) {
     throw new Error(detail ? `git ${args[0]}: ${detail}` : failure.message || `git ${args[0]} failed`);
   }
 }
+function entryKindAt(rev2, path, cwd) {
+  const listing = rev2 === "" ? git(["ls-files", "-s", "-z", "--", `:(literal)${path}`], cwd) : git(["ls-tree", "-z", rev2, "--", `:(literal)${path}`], cwd);
+  for (const record of listing.split("\0")) {
+    const tab = record.indexOf("	");
+    if (tab === -1 || record.slice(tab + 1) !== path) continue;
+    const meta2 = record.slice(0, tab).split(" ");
+    const mode = meta2[0] ?? "";
+    const isBlob = rev2 === "" ? mode !== "160000" && !mode.startsWith("04") : meta2[1] === "blob";
+    return isBlob ? "blob" : "other";
+  }
+  return "absent";
+}
 function blobAt(rev2, path, cwd) {
   try {
     return git(["show", `${rev2}:${path}`], cwd);
-  } catch {
-    return null;
+  } catch (e) {
+    if (entryKindAt(rev2, path, cwd) !== "blob") return null;
+    const detail = (e instanceof Error ? e.message : String(e)).split("\n")[0];
+    const where = rev2 === "" ? "the index entry " : `${rev2}:`;
+    throw new Error(`cannot read ${where}${path} although the tree lists it as a blob (${detail}); refusing to judge it as absent`);
   }
 }
 function fromDisk(path, cwd) {
@@ -15895,8 +15910,10 @@ function surfacePaths(base, cwd, policy) {
   let listing;
   try {
     listing = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd);
-  } catch {
-    return [];
+  } catch (e) {
+    const failure = execFailure(e);
+    const detail = failure.stderr.trim().split("\n")[0] || failure.message.split("\n")[0];
+    throw new Error(`cannot list the protected verification surface at base ${base}: ${detail}`);
   }
   const inputs = policy.verify?.inputs ?? [];
   return listing.split("\0").filter(Boolean).filter((p) => isProtected(p, policy) || matchesAny(p, inputs)).sort();
@@ -16194,6 +16211,7 @@ var init_verification_state = __esm({
     init_trusted();
     init_fingerprint();
     init_policy();
+    init_narrow();
     init_policy_load();
     init_repo_context();
     init_wiring();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.5",
+  "version": "2.39.7",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",