npm - tamperward - Versions diffs - 1.14.6 → 2.0.0 - Mend

tamperward 1.14.6 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -43,7 +43,7 @@ Earlier controlled experiments → **[the research series](./docs/blog/index.md)
 > **Scope.** The rows above are one model, one pressure prompt, one JS/TS
 > ecosystem — evidence for that setting, not a universal claim. Round 2 tested
-> the v1.9.0 stack; the current **v1.14.3** adds post-study envelope hardening
+> the v1.9.0 stack; the current **v2.0.0** adds post-study envelope hardening
 > (externally reviewed, with findings tracked individually as REPRO or AUDIT in
 > [SECURITY-ENVELOPE.md](./SECURITY-ENVELOPE.md) and closed with regression and
 > mutation checks — see [CHANGELOG](./CHANGELOG.md)). Rounds 3 and 3.1 are
@@ -148,15 +148,28 @@ semantic correctness nor a substitute for independent held-out tests.
 ### CI authority
-Pre-commit is an early backstop; protected CI is the merge authority. CI runs, independently:
+Pre-commit is an early backstop; protected CI is the merge authority. Two workflows
+are involved here, and they are not the same thing.
-1. `check --diff base...head`, with policy from the trusted merge-base; and
+**The shipped workflow** — the one `tamperward init` writes into your repository as
+`.github/workflows/tamperward.yml` — runs, independently:
+1. `check --diff base.sha...head.sha`, with policy from the trusted merge-base; and
 2. `verify --require-ancestor --base <base-sha>`, which since **1.14.3** also reads
    its policy, verification surface and verifier command and budget from that same
-   trusted base — so neither job's verdict is governed by the candidate.
+   trusted base — so neither step's verdict is governed by the candidate.
+Legitimate exceptions are out-of-band PR labels, `tamperward:allow:<rule>@<head-sha>`.
+The workflow passes the head SHA to the gate through `TAMPERWARD_OOB_HEAD`, so an
+approval is bound to the exact commit it was granted for and a new push invalidates it.
-Legitimate exceptions are out-of-band PR labels bound to the exact head SHA; a new
-push invalidates the approval.
+**This repository's own self-gate** — the `gate` job in `.github/workflows/ci.yml` —
+runs the built CLI's `check --diff` over the pull-request range, cleared only by the
+same label channel, but does **not** run `verify` on itself. This repo's test
+expectations legitimately change whenever a rule changes, and standalone `verify` has
+no out-of-band sign-off channel, so a pristine re-execution of its own suite would fail
+closed on exactly the pull requests that improve the gate. The self-gate is a
+diff-time gate.
 This guarantee depends on a protected and immutable base, required status checks, a
 pinned Tamperward version, and label permissions restricted to trusted humans.
@@ -218,9 +231,50 @@ npx tamperward verify --base main            # pristine-suite re-execution
 npx tamperward run -- <agent command...>     # the outer envelope around an agent
 ```
+### CLI reference
+Every flag below is what the command's parser actually reads (`src/cli/index.ts`,
+`parseVerify`, `parseRun`). `check` reports an unknown flag on stderr; the other
+commands ignore what they do not know.
+| command | flags |
+| --- | --- |
+| `check` | one view — `--staged` · `--worktree` · `--diff <base>...<head>` — plus `--format text\|json\|github\|auto` (default `auto`) · `--json` (alias for `--format json`) · `--cwd <dir>` |
+| `verify` | `--base <rev>` (default `HEAD`) · `--cmd <suite command>` · `--budget <seconds>` · `--json` · `--keep` (keep the two materialised copies and report their paths) · `--require-ancestor` (refuse a base that is not an ancestor of `HEAD`) · `--cwd <dir>` |
+| `run` | `--base <rev>` · `--cmd <suite command>` · `--budget <seconds>` · `--allow-dirty` · `--settle <seconds>` (wait before the final quiescence check) · `--allow-dep-drift` · `--cwd <dir>` · then `-- <agent command...>` |
+| `allow` | `<rule>` · `--file <path>` · `--reason "<why>"` (required) · `--cwd <dir>` |
+| `init` | `--cwd <dir>` · `--dry-run` · `--force-workflow` |
+| `watch` | `--dir <dir>` · `--log <file>` — a daemon; it runs until signalled |
+| `hook claude` / `sweep claude` | none — the Claude Code payload arrives on stdin |
+**Exit codes** — part of the public surface:
+| command | 0 | 1 | 2 |
+| --- | --- | --- | --- |
+| `check` | no blocking finding | at least one blocking finding | cannot evaluate: policy parse error, malformed `--diff` range, or no view given |
+| `verify` | `VERIFIED` — visible and pristine both green | `MASKED_FAILURE` (visible green, pristine red) or `SUITE_RED` | cannot verify, failing closed: no suite command, unresolvable base, `--require-ancestor` refused, budget exceeded, or the working or dependency tree moved during the run |
+| `run` | enforcement clean and the agent exited 0 — a non-zero agent exit is passed through unchanged | any blocking finding or masked failure, whatever the agent returned | cannot adjudicate: dirty start, policy error, verify cannot run |
+| `hook claude` / `sweep claude` | always — a deny is JSON on stdout at exit 0, never exit 2 | — | only for an unsupported agent name |
+| `allow` | sign-off recorded | — | no rule or `--reason`, not a git repo, or no current blocking finding to sign off |
+| `init` | wired, or already wired | — | an item needs attention |
+| no or unknown command | help printed (no command) | — | unknown command, help printed |
+### Environment variables
+| variable | who sets it | what it does |
+| --- | --- | --- |
+| `TAMPERWARD_OOB_SIGNOFF` | the CI workflow, from PR labels | comma-separated out-of-band approvals — `<rule>` or `<rule>:<file>`, optionally `@<head-sha>` — honoured by `check --diff` only; never the committed ledger |
+| `TAMPERWARD_OOB_HEAD` | the CI workflow (`github.event.pull_request.head.sha`) | the head SHA under adjudication; once set, an approval clears a finding only if it names that commit (`@<sha>`, at least 7 characters), so a new push re-blocks |
+| `TAMPERWARD_DENYLOG` | a harness or operator | a file to which `hook claude` and `sweep claude` append the rule ids of every deny, one line per verdict, best effort |
+| `TAMPERWARD_FSEVENTS` | operator or harness | overrides the `tamperward watch` event-log path (default `.git/tamperward/fsevents.jsonl`); the Stop sweep reads the same variable |
+| `TAMPERWARD_WATCH_NO_RECURSIVE` | CI and tests (`=1`) | forces `tamperward watch` onto its per-directory fallback instead of recursive `fs.watch`, so the fallback is exercised on every platform |
+| `TAMPERWARD_TRANSIENT` | a harness that owns restore semantics (`=block`) | raises `transient-protected-mutation` from warn to block; it can never lower a severity |
+| `NO_COLOR` / `FORCE_COLOR` | the user's shell | any non-empty `NO_COLOR` disables colour in the text renderer; a non-empty, non-`0` `FORCE_COLOR` enables it |
+| `GITHUB_ACTIONS` | GitHub Actions (`=true`) | `--format auto` selects the `github` renderer — an inline annotation per finding plus a job summary |
 ### The rules
-Sixteen rules are specified and fourteen ship (see the table in
+Seventeen rules are specified and fifteen ship (see the table in
 [SPEC.md](./SPEC.md)). The families: test protection (`test-deletion`,
 `test-skip`, `test-content-removal`), verification-signal protection
 (`coverage-lowering`, `snapshot-rewrite`, `snapshot-only-rewrite`), suppression
@@ -308,12 +362,14 @@ via npm trusted publishing with SLSA provenance. Full rule:
 ```bash
 npm install && npm run build    # bundles the CLI to dist/cli/index.js
-npm test                        # 368 tests at v1.14.3 — parser, detectors, engine, policy, renderers
+npm test                        # 520+ tests at 2.0.0 — parser, detectors, engine, policy, renderers
 npm run typecheck
 ```
-Tamperward gates its own repo in CI with the same engine it ships — including, on more
-than one occasion, blocking its own author's commits. See **[SPEC.md](./SPEC.md)** for
+Tamperward's own CI runs the engine it ships over every pull request — `check --diff`
+over the PR range, cleared only by an out-of-band label; see [CI authority](#ci-authority)
+for why the self-gate runs no `verify` on itself — and has, on more than one occasion,
+blocked its own author's commits. See **[SPEC.md](./SPEC.md)** for
 the build spec, the detector table, the enforcement-point wiring, and the proof-harness
 design; the `harness/` directory holds the seeds, oracles, transcripts tooling, and
 every pre-registered prediction with its outcome.

package/dist/cli/index.js CHANGED Viewed

@@ -90,6 +90,8 @@ function parseDiff(diff) {
     let renameTo = null;
     let minusPath = null;
     let plusPath = null;
+    let oldMode;
+    let newMode;
     const hunks = [];
     while (i < lines.length && !lines[i].startsWith("diff --git ")) {
       const l = lines[i];
@@ -103,8 +105,14 @@ function parseDiff(diff) {
         i++;
         continue;
       }
-      if (l.startsWith("new file mode")) op = "add";
-      else if (l.startsWith("deleted file mode")) op = "delete";
+      if (l.startsWith("new file mode ")) {
+        op = "add";
+        newMode = l.slice(14).trim();
+      } else if (l.startsWith("deleted file mode ")) {
+        op = "delete";
+        oldMode = l.slice(18).trim();
+      } else if (l.startsWith("old mode ")) oldMode = l.slice(9).trim();
+      else if (l.startsWith("new mode ")) newMode = l.slice(9).trim();
       else if (l.startsWith("rename from ")) {
         renameFrom = unquotePath(l.slice(12));
         op = "rename";
@@ -140,7 +148,9 @@ function parseDiff(diff) {
       before: null,
       after: null,
       binary,
-      hunks
+      hunks,
+      ...oldMode !== void 0 ? { oldMode } : {},
+      ...newMode !== void 0 ? { newMode } : {}
     };
     changes.push(change);
   }
@@ -344,7 +354,13 @@ var LITERAL = [
   { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" },
   { re: /(?:^|[\s;&|=])LEFTHOOK=0(?:\s|$)/, why: "LEFTHOOK=0 disables Lefthook hooks" },
   { re: /\bSKIP_SIMPLE_GIT_HOOKS=1\b/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
-  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" }
+  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
+  // The pre-commit framework's own escape hatch: SKIP=<hook-id>[,…] skips those
+  // hooks for that one invocation. `.pre-commit-config.yaml` is a protected hook,
+  // so its documented bypass has to be one too. `SKIP=` is a plausible variable
+  // name elsewhere, so it counts only in a segment that runs git or pre-commit.
+  { re: /(?:^|[\s;&|])SKIP=\S+/, why: "SKIP=<hook-id> tells the pre-commit framework to skip that hook", when: /\b(?:git|pre-commit)\b/ },
+  { re: /(?:^|[\s;&|])LEFTHOOK_EXCLUDE=\S+/, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
 ];
 var SHORT_N = /^-[a-z]*n[a-z]*$/i;
 var noVerify = {
@@ -358,7 +374,7 @@ var noVerify = {
       for (const seg of segments(c.raw)) {
         let why = null;
         for (const p of LITERAL) {
-          if (p.re.test(seg)) {
+          if (p.re.test(seg) && (!p.when || p.when.test(seg))) {
             why = p.why;
             break;
           }
@@ -565,6 +581,42 @@ var CODE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
 function isCodeFile(path) {
   return CODE.test(path);
 }
+var EXT = [
+  [CODE, "js"],
+  [/\.pyw?$/, "py"],
+  [/\.go$/, "go"],
+  [/\.rs$/, "rs"],
+  [/\.rb$/, "rb"],
+  [/\.java$/, "java"],
+  [/\.kts?$/, "kt"],
+  [/\.php$/, "php"],
+  [/\.cs$/, "cs"]
+];
+function langOf(path) {
+  for (const [re, lang] of EXT) if (re.test(path)) return lang;
+  return null;
+}
+var COMMON = /^(export\s|\/\/|\*|\/\*|}\)?;?$)/;
+var IMPORTS = {
+  js: /^import\b/,
+  py: /^(?:import\b|from\s+\S+\s+import\b)/,
+  go: /^(?:import\b|package\b)/,
+  rs: /^(?:use\b|extern\s+crate\b|mod\b)/,
+  rb: /^(?:require(?:_relative)?\b|include\b)/,
+  java: /^(?:import\b|package\b)/,
+  kt: /^(?:import\b|package\b)/,
+  php: /^(?:use\b|namespace\b|require(?:_once)?\b|include(?:_once)?\b)/,
+  cs: /^(?:using\b|namespace\b)/
+};
+var HASH_COMMENT = /* @__PURE__ */ new Set(["py", "rb"]);
+function isSignificantLine(trimmed, lang) {
+  if (trimmed.length < 10) return false;
+  if (COMMON.test(trimmed)) return false;
+  const l = lang ?? "js";
+  if (IMPORTS[l].test(trimmed)) return false;
+  if (HASH_COMMENT.has(l) && trimmed.startsWith("#")) return false;
+  return true;
+}
 // src/detectors/ts-any-cast.ts
 var BLOCK_RULE = "ts-any-cast";
@@ -671,11 +723,35 @@ var tsAnyCast = {
 // src/detectors/lint-suppression.ts
 var RULE2 = "lint-suppression";
-var PATTERNS = [
-  { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
-  { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
-  { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
-];
+var PATTERNS = {
+  js: [
+    { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
+    { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
+    { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
+  ],
+  py: [
+    { re: /#\s*noqa\b/, why: "# noqa suppresses flake8/ruff findings" },
+    { re: /#\s*type:\s*ignore\b/, why: "# type: ignore suppresses the type checker" },
+    { re: /#\s*pyright:\s*ignore\b/, why: "# pyright: ignore suppresses the type checker" },
+    { re: /#\s*pylint:\s*disable\b/, why: "# pylint: disable suppresses lint rules" },
+    { re: /#\s*nosec\b/, why: "# nosec suppresses bandit security findings" },
+    { re: /#\s*fmt:\s*(?:off|skip)\b/, why: "# fmt: off/skip suppresses formatting checks" }
+  ],
+  go: [{ re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" }],
+  rs: [],
+  rb: [{ re: /#\s*rubocop:\s*(?:disable|todo)\b/, why: "# rubocop:disable suppresses lint rules" }],
+  java: [{ re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" }],
+  kt: [{ re: /@Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" }],
+  php: [
+    { re: /\bphpcs:(?:ignore|disable)\b/, why: "phpcs:ignore/disable suppresses coding-standard checks" },
+    { re: /@phpstan-ignore\b/, why: "@phpstan-ignore suppresses static-analysis findings" },
+    { re: /@psalm-suppress\b/, why: "@psalm-suppress suppresses static-analysis findings" }
+  ],
+  cs: [
+    { re: /#pragma\s+warning\s+disable\b/, why: "#pragma warning disable suppresses compiler warnings" },
+    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" }
+  ]
+};
 var lintSuppression = {
   id: RULE2,
   surface: ["file"],
@@ -683,9 +759,13 @@ var lintSuppression = {
   run(changes, policy) {
     const out2 = [];
     for (const c of changes) {
-      if (c.kind !== "file" || !isCodeFile(c.path)) continue;
+      if (c.kind !== "file") continue;
+      const lang = langOf(c.path);
+      if (!lang) continue;
+      const patterns = PATTERNS[lang];
+      if (patterns.length === 0) continue;
       for (const l of addedLines(c)) {
-        for (const p of PATTERNS) {
+        for (const p of patterns) {
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE2, policy, {
@@ -707,18 +787,44 @@ var lintSuppression = {
 // src/detectors/test-skip.ts
 var RULE3 = "test-skip";
-var PATTERNS2 = [
-  { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-  { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
-  { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
-  { re: /\bpending\(\s*\)/, why: "a pending() marker" },
-  // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
-  // a runtime call. A live evasion used the options form the day this gap was measured
-  // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
-  { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
-  { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-  { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
-];
+var PATTERNS2 = {
+  js: [
+    { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
+    { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
+    { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
+    { re: /\bpending\(\s*\)/, why: "a pending() marker" },
+    // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
+    // a runtime call. A live evasion used the options form the day this gap was measured
+    // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
+    { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
+    { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
+  ],
+  py: [
+    { re: /@pytest\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail() call" },
+    { re: /@unittest\.(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
+    { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
+    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" }
+  ],
+  go: [
+    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" }
+  ],
+  rs: [{ re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" }],
+  rb: [
+    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*$)/, why: "a skip/pending call" },
+    { re: /\bx(?:it|describe|context|specify|example)\b/, why: "an x-prefixed disabled example" },
+    { re: /\b(?:fit|fdescribe|fcontext)\b/, why: "an f-prefixed focused example (narrows the suite)" },
+    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip:/pending: metadata flag" }
+  ],
+  java: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
+  kt: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
+  php: [{ re: /\bmarkTest(?:Skipped|Incomplete)\(/, why: "a markTestSkipped()/markTestIncomplete() call" }],
+  cs: [
+    { re: /\[Ignore\b/, why: "an [Ignore] attribute" },
+    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' }
+  ]
+};
 var testSkip = {
   id: RULE3,
   surface: ["file"],
@@ -728,8 +834,9 @@ var testSkip = {
     for (const c of changes) {
       if (c.kind !== "file") continue;
       if (!isProtected(c.path, policy, "tests")) continue;
+      const patterns = PATTERNS2[langOf(c.path) ?? "js"];
       for (const l of addedLines(c)) {
-        for (const p of PATTERNS2) {
+        for (const p of patterns) {
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE3, policy, {
@@ -1018,6 +1125,7 @@ var ciTampering = {
         (c.after != null ? c.after.split("\n") : addedLines(c).map((l) => l.content)).map(commandCore)
       );
       for (const l of removedLines(c)) {
+        if (/^\s*#/.test(l.content)) continue;
         const isUsesLine = USES.test(l.content) && CHECK.test(l.content);
         const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
         if (!isUsesLine && !isCheckCommand) continue;
@@ -1080,8 +1188,11 @@ function policyWeakening(before, after) {
       reasons.push(`rule "${name}" removed from policy`);
       continue;
     }
-    if (br.severity === "block" && ar.severity === "warn") {
-      reasons.push(`rule "${name}" lowered block \u2192 warn`);
+    if (br.severity === "block" && ar.severity !== "block") {
+      const to = typeof ar.severity === "string" ? ar.severity : JSON.stringify(ar.severity);
+      reasons.push(
+        ar.severity === "warn" ? `rule "${name}" lowered block \u2192 warn` : `rule "${name}" lowered block \u2192 ${to} (not a valid severity; the rule would no longer block)`
+      );
     }
     if (ar.enabled === false && br.enabled !== false) {
       reasons.push(`rule "${name}" disabled (enabled: false)`);
@@ -1137,6 +1248,27 @@ function policyWeakening(before, after) {
 var RULE6 = "hook-tampering";
 var HOOK_INVOCATION = /\b(tamperward|npx|npm|pnpm|yarn|bun|jest|vitest|eslint|tsc|lefthook|husky|lint-staged|make|cargo|pytest)\b/;
 var isShellComment = (s) => /^\s*#/.test(s);
+var ownerExec = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
+var SYMBOLIC = /^[ugoa]*([-+=])([rwxXst]*)$/;
+function chmodTouchesExec(seg) {
+  const toks = tokens(seg).map(unquote);
+  const at = toks.findIndex((t) => /^chmod$/.test(t));
+  if (at === -1) return false;
+  for (const tok of toks.slice(at + 1)) {
+    if (/^[0-7]{3,4}$/.test(tok)) {
+      if (!ownerExec(tok)) return true;
+      continue;
+    }
+    for (const clause of tok.split(",")) {
+      const m = clause.match(SYMBOLIC);
+      if (!m) continue;
+      const [, op, perms] = m;
+      const namesExec = /[xX]/.test(perms);
+      if (op === "=" ? !namesExec : namesExec) return true;
+    }
+  }
+  return false;
+}
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
@@ -1147,6 +1279,16 @@ var hookTampering = {
       if (c.kind === "file") {
         const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false);
         if (!targetsHook) continue;
+        if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec(c.oldMode) && !ownerExec(c.newMode)) {
+          out2.push(
+            makeFinding(RULE6, policy, {
+              file: c.path,
+              message: `Execute permission was removed from a protected hook (${c.oldMode} \u2192 ${c.newMode}) \u2014 git will skip it.`,
+              evidence: `${c.path}: mode ${c.oldMode} \u2192 ${c.newMode}`,
+              remediation: "Restore the execute bit (chmod +x). A hook git cannot run is a disabled hook."
+            })
+          );
+        }
         if (c.op === "delete") {
           out2.push(
             makeFinding(RULE6, policy, {
@@ -1243,10 +1385,8 @@ var hookTampering = {
         for (const seg of segments(c.raw)) {
           const hitsHook = tokens(seg).map(unquote).some((t) => isProtected(t, policy, "hooks"));
           if (!hitsHook) continue;
-          const octal = seg.match(/\bchmod\b[^|;&]*?(?:^|\s)([0-7]{3,4})(?:\s|$)/);
-          const octalDropsExec = octal ? (Number(octal[1].slice(-3)[0]) & 1) === 0 : false;
           let why = null;
-          if (/\bchmod\b/.test(seg) && (/(?:^|\s)[-+=]?[a-z]*x/i.test(seg) || octalDropsExec)) {
+          if (chmodTouchesExec(seg)) {
             why = "chmod alters execute permission on a hook, which can disable it";
           } else if (/\brm\b/.test(seg)) {
             why = "rm deletes a protected hook";
@@ -1274,6 +1414,16 @@ var hookTampering = {
 // src/detectors/test-deletion.ts
 import ts3 from "typescript";
 var RULE7 = "test-deletion";
+var TEST_DEFS = {
+  py: /^\s*(?:async\s+)?def\s+test\w*\s*\(/,
+  go: /^func\s+(?:Test|Example|Fuzz)\w*\s*\(/,
+  rs: /^\s*#\[[\w:]*test[\w:]*(?:\(|\])/,
+  rb: /^\s*(?:(?:it|specify|test|scenario|example)\s*(?:\(\s*)?['"]|def\s+test_\w+)/,
+  java: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
+  kt: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
+  php: /^\s*(?:(?:public\s+)?function\s+test\w*\s*\(|#\[Test\]|\*\s*@test\b)/,
+  cs: /^\s*\[(?:Fact|Theory|Test|TestMethod|TestCase|DataTestMethod)\b/
+};
 function calleeName(expr) {
   if (ts3.isIdentifier(expr)) return expr.text;
   if (ts3.isPropertyAccessExpression(expr) && ts3.isIdentifier(expr.expression)) {
@@ -1281,7 +1431,14 @@ function calleeName(expr) {
   }
   return null;
 }
-function countTestBlocks(src) {
+function countTestBlocks(src, path = "spec.ts") {
+  const lang = langOf(path);
+  if (lang && lang !== "js") {
+    const re = TEST_DEFS[lang];
+    let n2 = 0;
+    for (const line of src.split("\n")) if (re.test(line)) n2++;
+    return n2;
+  }
   const sf = ts3.createSourceFile("spec.ts", src, ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TS);
   let n = 0;
   const visit = (node) => {
@@ -1294,11 +1451,12 @@ function countTestBlocks(src) {
   visit(sf);
   return n;
 }
-function significantLines(src) {
+function significantLines(src, path) {
   const out2 = /* @__PURE__ */ new Set();
+  const lang = langOf(path);
   for (const raw of src.split("\n")) {
     const l = raw.trim();
-    if (l.length >= 10 && !/^(import\b|export\s|\/\/|\*|\/\*|}\)?;?$)/.test(l)) out2.add(l);
+    if (isSignificantLine(l, lang)) out2.add(l);
   }
   return out2;
 }
@@ -1312,22 +1470,22 @@ var testDeletion = {
     let addedTestBlocks = 0;
     for (const c of changes) {
       if (c.kind === "file" && c.op === "add" && c.after != null && isProtected(c.path, policy, "tests")) {
-        for (const l of significantLines(c.after)) addedTestLines.add(l);
-        addedTestBlocks += countTestBlocks(c.after);
+        for (const l of significantLines(c.after, c.path)) addedTestLines.add(l);
+        addedTestBlocks += countTestBlocks(c.after, c.path);
       }
     }
-    const isRelocation = (before) => {
-      const sig = significantLines(before);
+    const isRelocation = (before, path) => {
+      const sig = significantLines(before, path);
       if (sig.size === 0 || addedTestLines.size === 0) return false;
       let hit = 0;
       for (const l of sig) if (addedTestLines.has(l)) hit++;
-      return hit / sig.size >= 0.6 && addedTestBlocks >= countTestBlocks(before);
+      return hit / sig.size >= 0.6 && addedTestBlocks >= countTestBlocks(before, path);
     };
     for (const c of changes) {
       if (c.kind === "file") {
         const isTest = isProtected(c.path, policy, "tests");
         if (c.op === "delete" && isTest) {
-          if (c.before != null && isRelocation(c.before)) continue;
+          if (c.before != null && isRelocation(c.before, c.path)) continue;
           out2.push(
             makeFinding(RULE7, policy, {
               file: c.path,
@@ -1346,8 +1504,8 @@ var testDeletion = {
             })
           );
         } else if ((c.op === "modify" || c.op === "rename") && isTest && c.before != null && c.after != null) {
-          const before = countTestBlocks(c.before);
-          const after = countTestBlocks(c.after);
+          const before = countTestBlocks(c.before, c.path);
+          const after = countTestBlocks(c.after, c.path);
           if (after < before) {
             out2.push(
               makeFinding(RULE7, policy, {
@@ -1403,11 +1561,12 @@ var testDeletion = {
 var RULE8 = "test-content-removal";
 var MIN_REMOVED_LINES = 3;
 var ws = (s) => s.replace(/\s+/g, "");
-function significantLinesOrdered(src) {
+function significantLinesOrdered(src, path) {
   const out2 = [];
+  const lang = langOf(path);
   for (const raw of src.split("\n")) {
     const l = raw.trim();
-    if (l.length >= 10 && !/^(import\b|export\s|\/\/|\*|\/\*|}\)?;?$)/.test(l)) out2.push(l);
+    if (isSignificantLine(l, lang)) out2.push(l);
   }
   return out2;
 }
@@ -1420,16 +1579,16 @@ var testContentRemoval = {
     let keptPool = "";
     for (const c of changes) {
       if (c.kind === "file" && c.after != null && isProtected(c.path, policy, "tests")) {
-        keptPool += ws(significantLinesOrdered(c.after).join("\n"));
+        keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
       }
     }
     for (const c of changes) {
       if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
       if (!isProtected(c.path, policy, "tests")) continue;
       if (isProtected(c.path, policy, "snapshots")) continue;
-      if (countTestBlocks(c.after) < countTestBlocks(c.before)) continue;
-      const beforeSig = significantLinesOrdered(c.before);
-      const afterSig = significantLinesOrdered(c.after);
+      if (countTestBlocks(c.after, c.path) < countTestBlocks(c.before, c.path)) continue;
+      const beforeSig = significantLinesOrdered(c.before, c.path);
+      const afterSig = significantLinesOrdered(c.after, c.path);
       const netDrop = beforeSig.length - afterSig.length;
       const afterSet = new Set(afterSig);
       const gone = [];
@@ -1600,6 +1759,7 @@ function evaluate(changes, policy, detectors = allDetectors, view) {
     return true;
   });
   return deduped.filter((f) => {
+    if (f.rule !== "detector-error" && !isEnabled(f.rule, policy)) return false;
     const ex = policy.rules[f.rule]?.exclude;
     if (!ex?.length || !f.file || isPolicyFile(f.file)) return true;
     return !matchesAny(f.file, ex);
@@ -1622,9 +1782,62 @@ function normalizeVersion(v, where = POLICY_FILE) {
   }
   return v;
 }
-function parsePolicy(raw) {
+var SEVERITIES = ["block", "warn"];
+var isSeverity = (v) => SEVERITIES.includes(v);
+var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
+var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validate(r, where) {
+  function bad(msg) {
+    throw new PolicyError(`${where}: ${msg}`);
+  }
+  const show = (v) => JSON.stringify(v) ?? String(v);
+  if (r.rules !== void 0) {
+    if (!isMapping(r.rules)) bad(`rules must be a mapping of rule name to { severity, enabled, exclude }, got ${show(r.rules)}`);
+    for (const [name, cfg] of Object.entries(r.rules)) {
+      if (!isMapping(cfg)) bad(`rules.${name} must be a mapping like { severity: block }, got ${show(cfg)}`);
+      if (cfg.severity !== void 0 && !isSeverity(cfg.severity)) {
+        bad(`rules.${name}.severity must be "block" or "warn", got ${show(cfg.severity)}`);
+      }
+      if (cfg.enabled !== void 0 && typeof cfg.enabled !== "boolean") {
+        bad(`rules.${name}.enabled must be true or false, got ${show(cfg.enabled)}`);
+      }
+      if (cfg.exclude !== void 0 && !isStringList(cfg.exclude)) {
+        bad(`rules.${name}.exclude must be a list of globs, got ${show(cfg.exclude)}`);
+      }
+    }
+  }
+  if (r.ignore !== void 0 && !isStringList(r.ignore)) bad(`ignore must be a list of globs, got ${show(r.ignore)}`);
+  if (r.protected !== void 0) {
+    if (!isMapping(r.protected)) bad(`protected must be a mapping of category to a list of globs, got ${show(r.protected)}`);
+    for (const [cat, globs] of Object.entries(r.protected)) {
+      if (!isStringList(globs)) bad(`protected.${cat} must be a list of globs, got ${show(globs)}`);
+    }
+  }
+  if (r.signoff !== void 0) {
+    if (!isMapping(r.signoff)) bad(`signoff must be a mapping, got ${show(r.signoff)}`);
+    for (const key2 of ["required_for", "requiredFor"]) {
+      const v = r.signoff[key2];
+      if (v !== void 0 && !(Array.isArray(v) && v.every(isSeverity))) {
+        bad(`signoff.${key2} must be a list of "block" / "warn", got ${show(v)}`);
+      }
+    }
+    const ledger = r.signoff.ledger;
+    if (ledger !== void 0 && typeof ledger !== "string") bad(`signoff.ledger must be a path, got ${show(ledger)}`);
+  }
+  if (r.verify !== void 0) {
+    if (!isMapping(r.verify)) bad(`verify must be a mapping like { command: "npm test" }, got ${show(r.verify)}`);
+    const v = r.verify;
+    if (v.command !== void 0 && typeof v.command !== "string") bad(`verify.command must be a string, got ${show(v.command)}`);
+    if (v.budget !== void 0 && !(typeof v.budget === "number" && Number.isFinite(v.budget) && v.budget > 0)) {
+      bad(`verify.budget must be a positive number of seconds, got ${show(v.budget)}`);
+    }
+    if (v.inputs !== void 0 && !isStringList(v.inputs)) bad(`verify.inputs must be a list of globs, got ${show(v.inputs)}`);
+  }
+}
+function parsePolicy(raw, where = POLICY_FILE) {
   const r = raw ?? {};
-  const version = normalizeVersion(r.version);
+  const version = normalizeVersion(r.version, where);
+  validate(r, where);
   const base = defaultPolicy(version);
   return {
     version,
@@ -1660,7 +1873,7 @@ function parseOrThrow(src, where) {
   if (raw !== null && raw !== void 0 && (typeof raw !== "object" || Array.isArray(raw))) {
     throw new PolicyError(`${where} is not a policy mapping`);
   }
-  return parsePolicy(raw);
+  return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
   const path = join2(cwd, POLICY_FILE);
@@ -2044,7 +2257,7 @@ import { createHash as createHash4 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync4, existsSync as existsSync3, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join4, isAbsolute } from "node:path";
+import { isAbsolute, join as join4, relative, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -2056,10 +2269,11 @@ function readDisk(path) {
   }
 }
 function abs(path, cwd) {
-  return isAbsolute(path) ? path : join4(cwd, path);
+  return resolve(cwd, path);
 }
 function relForDisplay(path, cwd) {
-  return path.startsWith(cwd + "/") ? path.slice(cwd.length + 1) : path;
+  const rel = relative(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -2080,9 +2294,15 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], { encoding: "utf8" });
+      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", a, b], {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024
+      });
     } catch (e) {
       const err2 = e;
+      if (err2.status !== 1) {
+        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
+      }
       raw = err2.stdout ? String(err2.stdout) : "";
     }
   } finally {
@@ -2197,13 +2417,19 @@ function advanceTurnBaseline(cwd, sessionId) {
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join6 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join6 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
 function gitDir2(cwd) {
   try {
-    return execFileSync3("git", ["rev-parse", "--git-dir"], { cwd, encoding: "utf8" }).trim();
+    const d = execFileSync3("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    if (!d) return null;
+    return isAbsolute2(d) ? d : join6(cwd, d);
   } catch {
     return null;
   }
@@ -2212,7 +2438,7 @@ function ptreePath(cwd, sessionId) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join6(cwd, gd, "tamperward");
+  const dir = join6(gd, "tamperward");
   return join6(dir, `ptree-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
@@ -2295,7 +2521,8 @@ function snap(abs2) {
   }
 }
 function defaultEventLog(cwd) {
-  return process.env.TAMPERWARD_FSEVENTS ?? join7(cwd, ".git", "tamperward", "fsevents.jsonl");
+  if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
+  return join7(gitDir(cwd) ?? join7(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -2405,6 +2632,7 @@ function readEvents(log, offset) {
   return { events, newOffset: size };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
+  if (!isEnabled(RULE11, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -2721,11 +2949,12 @@ import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
 import { dirname as dirname3, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
-var HOOK_CMD = "npx --yes tamperward hook claude";
 var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
-var SWEEP_CMD = "npx --yes tamperward sweep claude";
-var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
 var MARKER = "# tamperward: block agent shortcuts before they land";
+var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
+var SWEEP_RE = /\btamperward(?:@\S+)?\s+sweep\s+claude\b/;
+var PRECOMMIT_RE = /\btamperward(?:@\S+)?\s+check\s+--staged\b/;
+var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
 var CODEOWNERS_MARK = "# tamperward: the gate cannot guard the file that defines it";
 var CODEOWNERS_PATHS = ["/.github/workflows/", "/.tamperward.yml", "/.github/CODEOWNERS"];
 function coveredBy(existing, critical) {
@@ -2781,6 +3010,17 @@ function shippedVersion() {
   return "latest";
 }
 var TW_VERSION = shippedVersion();
+var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
+var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
+var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
+function pinOf(command) {
+  const m = command.match(OURS);
+  return m ? m[1] ?? "" : null;
+}
+function stalePin(command) {
+  const pin = pinOf(command);
+  return pin !== null && pin !== TW_VERSION;
+}
 var WORKFLOW_CONTENT = `name: tamperward
 # The CI authority for main: the same engine as the agent hook and pre-commit, run over
@@ -2901,15 +3141,18 @@ function planClaudeHooks(cwd) {
     settings = parsed;
   }
   const hooks = settings.hooks ??= {};
-  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => String(h.command ?? "").includes(needle)));
-  const preEntries = entriesWith(hooks.PreToolUse, "tamperward hook claude");
+  const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => needle.test(String(h.command ?? ""))));
+  const preEntries = entriesWith(hooks.PreToolUse, HOOK_RE);
   const needPre = preEntries.length === 0;
-  const needStop = entriesWith(hooks.Stop, "tamperward sweep claude").length === 0;
+  const stopEntries = entriesWith(hooks.Stop, SWEEP_RE);
+  const needStop = stopEntries.length === 0;
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
-  if (!needPre && !needStop && stale.length === 0) {
+  const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
+  const pins = [...new Set(repin.map((h) => pinOf(String(h.command ?? "")) || "unpinned"))];
   return {
     item: "agent",
     path: rel,
@@ -2917,9 +3160,14 @@ function planClaudeHooks(cwd) {
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
-      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`
+      repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
+      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`
     ].filter(Boolean).join(" + "),
     apply: () => {
+      for (const h of repin) {
+        const kind = String(h.command ?? "").match(OURS)?.[2];
+        h.command = kind === "hook claude" ? HOOK_CMD : kind === "sweep claude" ? SWEEP_CMD : h.command;
+      }
       if (needPre) {
         (hooks.PreToolUse ??= []).push({
           matcher: PRE_MATCHER,
@@ -2947,8 +3195,24 @@ ${PRECOMMIT_CMD}
   if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
   const path = join8(cwd, target.rel);
   const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
-  if (existing?.includes("tamperward check --staged")) {
-    return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+  if (existing !== null && PRECOMMIT_RE.test(existing)) {
+    const lines = existing.split("\n");
+    const staleAt = lines.findIndex((l) => PRECOMMIT_RE.test(l) && stalePin(l));
+    if (staleAt === -1) {
+      return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+    }
+    const was = pinOf(lines[staleAt]) || "unpinned";
+    return {
+      item: "pre-commit",
+      path: target.rel,
+      status: "update",
+      detail: `re-pin the staged check to tamperward@${TW_VERSION} (was ${was})`,
+      apply: () => {
+        lines[staleAt] = PRECOMMIT_CMD;
+        writeFileSync5(path, lines.join("\n"));
+        chmodSync(path, 493);
+      }
+    };
   }
   return {
     item: "pre-commit",
@@ -3084,13 +3348,13 @@ import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join11, resolve } from "node:path";
+import { dirname as dirname4, join as join11, resolve as resolve2 } from "node:path";
 // src/git/trusted.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join9 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join9 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -3103,7 +3367,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute2(d) ? d : join9(cwd, d);
+    return isAbsolute3(d) ? d : join9(cwd, d);
   } catch {
     return null;
   }
@@ -3268,7 +3532,7 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve(cwd, "node_modules");
+  const nm = resolve2(cwd, "node_modules");
   if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
@@ -3349,18 +3613,52 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   }
   return { restored, removed };
 }
+var SUPERVISOR = `
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const [cmd, budgetMs, outFile] = process.argv.slice(1);
+const child = cp.spawn('sh', ['-c', cmd], { stdio: 'ignore', detached: process.platform !== 'win32' });
+const killGroup = () => {
+  try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+  try { child.kill('SIGKILL'); } catch {}
+};
+let done = false;
+const finish = (r) => {
+  if (done) return;
+  done = true;
+  killGroup();
+  fs.writeFileSync(outFile, JSON.stringify(r));
+  process.exit(0);
+};
+const timer = setTimeout(() => finish({ timedOut: true }), Number(budgetMs));
+child.on('error', (e) => { clearTimeout(timer); finish({ error: String(e) }); });
+child.on('exit', (code, signal) => { clearTimeout(timer); finish({ exit: code, signal }); });
+`;
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const r = spawnSync("sh", ["-c", cmd], {
-    cwd: dir,
-    stdio: "ignore",
-    timeout: budgetSecs * 1e3,
-    killSignal: "SIGKILL"
-  });
-  const secs = Math.round((Date.now() - t0) / 1e3);
-  if (r.error && r.error.code === "ETIMEDOUT") return { exit: null, secs };
-  if (r.status === null && r.signal) return { exit: null, secs };
-  return { exit: r.status ?? 2, secs };
+  const outDir = mkdtempSync2(join11(tmpdir2(), "tw-verify-run-"));
+  const outFile = join11(outDir, "result.json");
+  try {
+    spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
+      cwd: dir,
+      stdio: "ignore",
+      timeout: budgetSecs * 1e3 + 3e4,
+      // backstop only; the supervisor enforces the budget
+      killSignal: "SIGKILL"
+    });
+    const secs = Math.round((Date.now() - t0) / 1e3);
+    let r;
+    try {
+      r = JSON.parse(readFileSync13(outFile, "utf8"));
+    } catch {
+      return { exit: null, secs };
+    }
+    if (r.timedOut || r.error) return { exit: null, secs };
+    if (r.exit === null || r.exit === void 0) return { exit: null, secs };
+    return { exit: r.exit, secs };
+  } finally {
+    rmSync2(outDir, { recursive: true, force: true });
+  }
 }
 function runVerify(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -3517,7 +3815,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -3564,7 +3862,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve2(opts.cwd ?? process.cwd());
+  const cwd = resolve3(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.14.6",
+  "version": "2.0.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",
@@ -37,7 +37,7 @@
     "NOTICE"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=20.19"
   },
   "scripts": {
     "build": "esbuild src/cli/index.ts --bundle --platform=node --format=esm --packages=external --outfile=dist/cli/index.js",
@@ -53,10 +53,10 @@
     "yaml": "^2.6.1"
   },
   "devDependencies": {
-    "@types/node": "^20.14.0",
+    "@types/node": "^22.20.1",
     "@types/picomatch": "^3.0.1",
-    "esbuild": "^0.24.0",
-    "vitepress": "^1.6.4",
-    "vitest": "^2.1.8"
+    "esbuild": "^0.25.12",
+    "vitepress": "^2.0.0-alpha.19",
+    "vitest": "^4.1.11"
   }
 }