tamperward 2.39.6 → 2.39.8

package/dist/cli/index.js

@@ -11030,25 +11030,25 @@ function applyLocalSignoffs(findings, cwd, policy, now = Date.now()) {
   return { findings: remaining, cleared };
 }
 function oobToken(want, oob, head) {
+  const supplied = head !== void 0 && head.trim() !== "";
+  const bound = supplied && FULL_OBJECT_ID.test(head.trim()) ? head.trim().toLowerCase() : null;
   for (const raw of oob) {
     const t = raw.trim();
     if (!t) continue;
     if (t.startsWith(COMPACT_OOB_PREFIX)) {
-      const expected = head === void 0 ? null : compactOobToken(want, head);
+      const expected = bound === null ? null : compactOobToken(want, bound);
       if (expected !== null && t === expected) return t;
       continue;
     }
     const at = t.lastIndexOf("@");
     if (at === -1) {
-      if (!head && t === want) return t;
+      if (!supplied && t === want) return t;
       continue;
     }
     const [rule, sha3] = [t.slice(0, at), t.slice(at + 1)];
     if (rule !== want) continue;
-    if (!head) return t;
-    const normalizedHead = head.trim().toLowerCase();
-    const normalizedSha = sha3.trim().toLowerCase();
-    if (/^[0-9a-f]+$/.test(normalizedHead) && normalizedSha === normalizedHead) return t;
+    if (!supplied) return t;
+    if (bound !== null && sha3.trim().toLowerCase() === bound) return t;
   }
   return null;
 }
@@ -11065,7 +11065,12 @@ function applyOobSignoffs(findings, oob, head) {
 }
 function oobHeadFromEnv(env = process.env) {
   const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim().toLowerCase();
-  return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(v) ? v : void 0;
+  return v === "" ? void 0 : v;
+}
+function oobHeadProblem(head) {
+  if (head === void 0 || head.trim() === "" || FULL_OBJECT_ID.test(head.trim())) return null;
+  const shown = head.length > 72 ? `${head.slice(0, 69)}\u2026` : head;
+  return `TAMPERWARD_OOB_HEAD is set to ${JSON.stringify(shown)}, which is not the full 40- or 64-character object id of the head under adjudication; no out-of-band approval is honored against a head the gate cannot identify`;
 }
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
@@ -11459,8 +11464,13 @@ function check(opts) {
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
   let findings = evaluate(changes, policy, void 0, view, { cwd });
   if (view === "worktree") findings = findings.concat(unjudgeableProtected(cwd, policy, changes));
-  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
+  const oob = layer === "ci" ? oobFromEnv() : [];
+  const oobHead = layer === "ci" ? oobHeadFromEnv() : void 0;
+  const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oob, oobHead);
   findings = remaining;
+  const headProblem = oob.length > 0 ? oobHeadProblem(oobHead) : null;
+  if (headProblem) process.stderr.write(`tamperward: ${headProblem}
+`);
   if (cleared.length) {
     const how = layer === "local" ? "local human sign-off (ledger)" : "out-of-band approval";
     process.stderr.write(`tamperward: ${cleared.length} blocking finding(s) cleared by ${how}: ${cleared.map((f) => f.rule + (f.file ? `(${f.file})` : "")).join(", ")}
@@ -15910,8 +15920,10 @@ function surfacePaths(base, cwd, policy) {
   let listing;
   try {
     listing = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd);
-  } catch {
-    return [];
+  } catch (e) {
+    const failure = execFailure(e);
+    const detail = failure.stderr.trim().split("\n")[0] || failure.message.split("\n")[0];
+    throw new Error(`cannot list the protected verification surface at base ${base}: ${detail}`);
   }
   const inputs = policy.verify?.inputs ?? [];
   return listing.split("\0").filter(Boolean).filter((p) => isProtected(p, policy) || matchesAny(p, inputs)).sort();
@@ -16209,6 +16221,7 @@ var init_verification_state = __esm({
     init_trusted();
     init_fingerprint();
     init_policy();
+    init_narrow();
     init_policy_load();
     init_repo_context();
     init_wiring();
@@ -17347,8 +17360,13 @@ function runVerifyImpl(opts) {
     } catch {
     }
   }
-  const signedOff = verdict2 === "MASKED_FAILURE" ? oobToken("verify", oobFromEnv(), oobHeadFromEnv()) : null;
+  const oob = oobFromEnv();
+  const oobHead = oobHeadFromEnv();
+  const signedOff = verdict2 === "MASKED_FAILURE" ? oobToken("verify", oob, oobHead) : null;
   if (signedOff) code2 = 0;
+  const headProblem = verdict2 === "MASKED_FAILURE" && oob.length > 0 ? oobHeadProblem(oobHead) : null;
+  if (headProblem) process.stderr.write(`tamperward: ${headProblem}
+`);
   if (opts.json) {
     out3(
       JSON.stringify({
@@ -24790,7 +24808,12 @@ function ciAdjudicate(cwd, opts) {
     if (check2.reason !== void 0) {
       return { ci: { verdict: "CANNOT_VERIFY", binding, binding_error: check2.reason }, exit: 2 };
     }
-    const signedOff = check2.verdict === "MASKED_FAILURE" && oobToken("verify", oobFromEnv(), oobHeadFromEnv()) !== null;
+    const oob = oobFromEnv();
+    const oobHead = oobHeadFromEnv();
+    const signedOff = check2.verdict === "MASKED_FAILURE" && oobToken("verify", oob, oobHead) !== null;
+    const headProblem = check2.verdict === "MASKED_FAILURE" && oob.length > 0 ? oobHeadProblem(oobHead) : null;
+    if (headProblem) process.stderr.write(`tamperward: ${headProblem}
+`);
     return {
       ci: {
         verdict: check2.verdict,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.6",
+  "version": "2.39.8",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",