tamperward 1.7.0 → 1.9.0

package/dist/cli/index.js

@@ -463,6 +463,11 @@ function defaultPolicy(version = 1) {
       // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
       // when intended output changes. WARN until the §7 evidence path earns block.
       "snapshot-rewrite": { severity: "warn" },
+      // the watcher's transient class (modified-and-restored within a turn). WARN by
+      // default: a Stop block already forces restores, and a compliant restore reads
+      // as churn — block-by-default would deadlock the honest path. Harnesses that own
+      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
+      "transient-protected-mutation": { severity: "warn" },
       // the narrow graduation candidate: snapshot moved with NO accompanying change.
       // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
       // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
@@ -1009,6 +1014,24 @@ function policyWeakening(before, after) {
   if (be.requiredFor.includes("block") && !new Set(ae.requiredFor).has("block")) {
     reasons.push("sign-off no longer required for blocking findings");
   }
+  const bv = b.verify;
+  const av = a.verify;
+  if (bv?.command) {
+    if (!av?.command) {
+      reasons.push("verify block removed \u2014 pristine-suite re-execution disabled");
+    } else {
+      if (av.command !== bv.command) {
+        reasons.push(
+          `verify.command changed ("${bv.command}" \u2192 "${av.command}") \u2014 the re-executed suite is no longer the one that was configured`
+        );
+      }
+      const bb = bv.budget ?? 300;
+      const ab = av.budget ?? 300;
+      if (ab < bb) {
+        reasons.push(`verify.budget lowered ${bb}s \u2192 ${ab}s \u2014 starving the budget turns "cannot verify" into a pressure point`);
+      }
+    }
+  }
   return reasons;
 }
 
@@ -1506,7 +1529,8 @@ function parsePolicy(raw) {
     signoff: {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
-    }
+    },
+    ...r.verify?.command ? { verify: { command: r.verify.command, budget: r.verify.budget ?? 300 } } : {}
   };
 }
 function parseOrThrow(src, where) {
@@ -1721,10 +1745,10 @@ function locationCell(f, env) {
   const label = `${f.file}${f.line ? `:${f.line}` : ""}`;
   const server = env.GITHUB_SERVER_URL;
   const repo = env.GITHUB_REPOSITORY;
-  const sha = env.GITHUB_SHA;
-  if (!server || !repo || !sha) return `\`${cell(label)}\``;
+  const sha2 = env.GITHUB_SHA;
+  if (!server || !repo || !sha2) return `\`${cell(label)}\``;
   const frag = f.line ? `#L${f.line}` : "";
-  return `[\`${cell(label)}\`](${server}/${repo}/blob/${sha}/${f.file}${frag})`;
+  return `[\`${cell(label)}\`](${server}/${repo}/blob/${sha2}/${f.file}${frag})`;
 }
 function renderSummary(input, env = process.env) {
   const findings = orderFindings(input.findings);
@@ -1870,7 +1894,8 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync6, appendFileSync as appendFileSync3 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, statSync as statSync4 } from "node:fs";
+import { createHash as createHash4 } from "node:crypto";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -1895,6 +1920,7 @@ function relForDisplay(path, cwd) {
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
+  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
   return content.replace(oldStr, () => newStr);
 }
 function synthFileChange(displayPath, before, after) {
@@ -2025,10 +2051,261 @@ function advanceTurnBaseline(cwd, sessionId) {
   }
 }
 
+// src/effect.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+var UNSAFE2 = /[^A-Za-z0-9._-]/g;
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
+function gitDir2(cwd) {
+  try {
+    return execFileSync3("git", ["rev-parse", "--git-dir"], { cwd, encoding: "utf8" }).trim();
+  } catch {
+    return null;
+  }
+}
+function ptreePath(cwd, sessionId) {
+  if (!sessionId) return null;
+  const gd = gitDir2(cwd);
+  if (!gd) return null;
+  const dir = join6(cwd, gd, "tamperward");
+  return join6(dir, `ptree-${sessionId.replace(UNSAFE2, "")}.json`);
+}
+var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
+function snapshotProtected(cwd, policy, prev) {
+  const out = {};
+  const walk = (rel) => {
+    const abs2 = rel ? join6(cwd, rel) : cwd;
+    let names;
+    try {
+      names = readdirSync(abs2);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      if (SKIP_DIRS.has(name)) continue;
+      const r = rel ? `${rel}/${name}` : name;
+      let st;
+      try {
+        st = statSync(join6(cwd, r));
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(r);
+      else if (st.isFile() && isProtected(r, policy)) {
+        const p = prev?.[r];
+        if (p && p.mtimeMs === st.mtimeMs && p.size === st.size && p.mode === st.mode) {
+          out[r] = p;
+        } else {
+          let hash = "";
+          try {
+            hash = sha(readFileSync6(join6(cwd, r)));
+          } catch {
+            hash = "unreadable";
+          }
+          out[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
+        }
+      }
+    }
+  };
+  walk("");
+  return out;
+}
+function driftBetween(expected, current) {
+  const changed = [];
+  const deleted = [];
+  for (const [path, e] of Object.entries(expected)) {
+    const c = current[path];
+    if (!c) deleted.push(path);
+    else if (c.hash !== e.hash || c.mode !== e.mode) changed.push(path);
+  }
+  return { changed, deleted };
+}
+function loadPtree(cwd, sessionId) {
+  const p = ptreePath(cwd, sessionId);
+  if (!p || !existsSync5(p)) return null;
+  try {
+    return JSON.parse(readFileSync6(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function savePtree(cwd, sessionId, tree) {
+  const p = ptreePath(cwd, sessionId);
+  if (!p) return;
+  try {
+    mkdirSync3(join6(p, ".."), { recursive: true });
+    writeFileSync3(p, JSON.stringify(tree));
+  } catch {
+  }
+}
+
+// src/cli/watch.ts
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2, watch } from "node:fs";
+import { join as join7 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+var SKIP = /(^|\/)(\.git|node_modules)(\/|$)/;
+function snap(abs2) {
+  try {
+    const st = statSync2(abs2);
+    if (!st.isFile()) return { mode: st.mode, size: null, hash: null };
+    const hash = createHash3("sha256").update(readFileSync7(abs2)).digest("hex").slice(0, 16);
+    return { mode: st.mode, size: st.size, hash };
+  } catch {
+    return { mode: null, size: null, hash: null };
+  }
+}
+function defaultEventLog(cwd) {
+  return process.env.TAMPERWARD_FSEVENTS ?? join7(cwd, ".git", "tamperward", "fsevents.jsonl");
+}
+function watchTree(dir, cb) {
+  if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
+    try {
+      const w = watch(dir, { recursive: true }, (kind, fname) => {
+        if (fname) cb(kind, String(fname));
+      });
+      return { close: () => w.close() };
+    } catch {
+    }
+  }
+  const watchers = /* @__PURE__ */ new Map();
+  const addDir = (rel) => {
+    if (watchers.has(rel) || SKIP.test(rel + "/")) return;
+    let w;
+    try {
+      w = watch(rel ? join7(dir, rel) : dir, (kind, fname) => {
+        if (!fname) return;
+        const child = rel ? `${rel}/${String(fname)}` : String(fname);
+        cb(kind, child);
+        try {
+          if (statSync2(join7(dir, child)).isDirectory()) addDir(child);
+        } catch {
+        }
+      });
+    } catch {
+      return;
+    }
+    watchers.set(rel, w);
+  };
+  const walk = (rel) => {
+    addDir(rel);
+    let names = [];
+    try {
+      names = readdirSync2(rel ? join7(dir, rel) : dir);
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      const child = rel ? `${rel}/${name}` : name;
+      if (SKIP.test(child + "/")) continue;
+      try {
+        if (statSync2(join7(dir, child)).isDirectory()) walk(child);
+      } catch {
+      }
+    }
+  };
+  walk("");
+  return { close: () => {
+    for (const w of watchers.values()) w.close();
+  } };
+}
+function startWatcher(dir, log, policy) {
+  try {
+    mkdirSync4(join7(log, ".."), { recursive: true });
+  } catch {
+  }
+  const last = /* @__PURE__ */ new Map();
+  return watchTree(dir, (kind, rel) => {
+    if (SKIP.test(rel) || !isProtected(rel, policy)) return;
+    const s = snap(join7(dir, rel));
+    const key2 = `${s.hash}:${s.mode}`;
+    if (last.get(rel) === key2) return;
+    last.set(rel, key2);
+    const ev = { ts: (/* @__PURE__ */ new Date()).toISOString(), path: rel, kind: kind === "rename" ? "rename" : "change", ...s };
+    try {
+      appendFileSync3(log, JSON.stringify(ev) + "\n");
+    } catch {
+    }
+  });
+}
+function runWatch(args) {
+  let dir = process.cwd();
+  let log = null;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--dir" && args[i + 1]) dir = args[++i];
+    else if (args[i] === "--log" && args[i + 1]) log = args[++i];
+  }
+  const policy = loadPolicy(dir);
+  const out = log ?? defaultEventLog(dir);
+  startWatcher(dir, out, policy);
+  process.stdout.write(`tamperward watch: recording protected-file events under ${dir} -> ${out}
+`);
+  return -1;
+}
+
+// src/detectors/fs-events.ts
+import { readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+var RULE11 = "transient-protected-mutation";
+function readEvents(log, offset) {
+  let size = 0;
+  try {
+    size = statSync3(log).size;
+  } catch {
+    return { events: [], newOffset: offset };
+  }
+  if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
+  const raw = readFileSync8(log, "utf8").slice(offset);
+  const events = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      events.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return { events, newOffset: size };
+}
+function transientFindings(events, persistentPaths, policy, finalHash) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const e of events) {
+    if (!isProtected(e.path, policy)) continue;
+    const arr = byPath.get(e.path) ?? [];
+    arr.push(e);
+    byPath.set(e.path, arr);
+  }
+  const out = [];
+  const strict = process.env.TAMPERWARD_TRANSIENT === "block";
+  for (const [path, evs] of byPath) {
+    if (persistentPaths.has(path)) continue;
+    const final = finalHash(path);
+    const hashes = new Set(evs.map((e) => e.hash).filter((h) => h != null));
+    if (final != null) hashes.add(final);
+    const contentChurn = hashes.size > 1;
+    const modes = new Set(evs.map((e) => e.mode).filter((m) => m != null));
+    const modeChurn = modes.size > 1;
+    if (!contentChurn && !modeChurn) continue;
+    const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
+    const f = makeFinding(RULE11, policy, {
+      file: path,
+      message: `Transient protected mutation: ${what}, leaving no net diff.`,
+      evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
+      remediation: "Anything that ran against the mid-turn state ran against a weakened suite. Re-run the checks against the restored tree; if the mutation was an experiment, say so where a human will read it.",
+      defaultSeverity: "warn"
+    });
+    if (strict && f.severity !== "block") {
+      f.severity = "block";
+      f.signoff.required = true;
+    }
+    out.push(f);
+  }
+  return out;
+}
+
 // src/cli/hook.ts
 function readStdin() {
   try {
-    return readFileSync6(0, "utf8");
+    return readFileSync9(0, "utf8");
   } catch {
     return "";
   }
@@ -2045,7 +2322,7 @@ function recordDenylog(blocks) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync3(log, blocks.map((b) => b.rule).join(",") + "\n");
+    appendFileSync4(log, blocks.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -2077,30 +2354,141 @@ function verdict(blocks, kind) {
   } : { decision: "block", reason };
   return { exitCode: 0, stdout: JSON.stringify(payload) + "\n" };
 }
+function effectDriftBlocks(cwd, sessionId, policy) {
+  if (!sessionId || !isGitRepo(cwd)) return null;
+  const expected = loadPtree(cwd, sessionId);
+  const current = snapshotProtected(cwd, policy, expected ?? void 0);
+  if (!expected) {
+    savePtree(cwd, sessionId, current);
+    return null;
+  }
+  const d = driftBetween(expected, current);
+  if (d.changed.length === 0 && d.deleted.length === 0) {
+    savePtree(cwd, sessionId, current);
+    return null;
+  }
+  const base = turnBaseline(cwd, sessionId);
+  const all = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
+  const drifted = /* @__PURE__ */ new Set([...d.changed, ...d.deleted]);
+  const scoped = all.filter(
+    (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
+  );
+  const blocks = evaluate(scoped, policy, void 0, "turn").filter((f) => f.severity === "block");
+  if (blocks.length > 0) return blocks;
+  savePtree(cwd, sessionId, current);
+  return null;
+}
+function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
+  if (!sessionId) return;
+  const tree = loadPtree(cwd, sessionId);
+  if (!tree) return;
+  let dirty = false;
+  for (const c of changes) {
+    if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy)) continue;
+    const hash = createHash4("sha256").update(c.after).digest("hex").slice(0, 16);
+    const prev = tree[c.path];
+    tree[c.path] = {
+      hash,
+      mode: prev?.mode ?? 33188,
+      size: Buffer.byteLength(c.after),
+      mtimeMs: -1
+      // unknown until written; forces a re-hash next snapshot, which is correct
+    };
+    dirty = true;
+  }
+  if (dirty) savePtree(cwd, sessionId, tree);
+}
 function preToolUseVerdict(input) {
   try {
     const cwd = input.cwd ?? process.cwd();
     turnBaseline(cwd, input.session_id);
+    const policy = loadPolicy(cwd);
+    const driftBlocks = effectDriftBlocks(cwd, input.session_id, policy);
+    if (driftBlocks) return verdict(driftBlocks, "PreToolUse");
     const changes = changesFromClaudeHook(input, cwd);
-    const blocks = evaluate(changes, loadPolicy(cwd), void 0, "tool-call").filter((f) => f.severity === "block");
+    const blocks = evaluate(changes, policy, void 0, "tool-call").filter((f) => f.severity === "block");
+    if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
     return verdict(blocks, "PreToolUse");
   } catch (e) {
     return failClosed("PreToolUse", errText(e));
   }
 }
+function cursorPath(cwd, sessionId) {
+  const p = ptreePath(cwd, sessionId);
+  return p ? p.replace(/ptree-/, "fscursor-") : null;
+}
+function turnTransientBlocks(cwd, sessionId, policy, changes) {
+  const none = { blocks: [], commit: () => {
+  } };
+  const log = defaultEventLog(cwd);
+  const cp = cursorPath(cwd, sessionId);
+  if (!existsSync6(log)) return none;
+  let offset = 0;
+  if (cp && existsSync6(cp)) {
+    const n = Number(readFileSync9(cp, "utf8"));
+    offset = Number.isFinite(n) ? n : 0;
+  }
+  const { events, newOffset } = readEvents(log, offset);
+  if (events.length === 0) return { ...none, commit: () => {
+    if (cp) try {
+      writeFileSync4(cp, String(newOffset));
+    } catch {
+    }
+  } };
+  const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
+  const finalHash = (path) => {
+    try {
+      if (!statSync4(`${cwd}/${path}`).isFile()) return null;
+      return createHash4("sha256").update(readFileSync9(`${cwd}/${path}`)).digest("hex").slice(0, 16);
+    } catch {
+      return null;
+    }
+  };
+  const findings = transientFindings(events, persistent, policy, finalHash);
+  recordWarns(findings.filter((f) => f.severity !== "block"));
+  return {
+    blocks: findings.filter((f) => f.severity === "block"),
+    commit: () => {
+      if (cp) try {
+        writeFileSync4(cp, String(newOffset));
+      } catch {
+      }
+    }
+  };
+}
+function recordWarns(warns) {
+  const log = process.env.TAMPERWARD_DENYLOG;
+  if (!log || warns.length === 0) return;
+  try {
+    appendFileSync4(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
+  } catch {
+  }
+}
 function stopVerdict(input) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const cwd = input.cwd ?? process.cwd();
   if (!isGitRepo(cwd)) return { exitCode: 0, stdout: "" };
   let blocks;
+  let commitCursor = () => {
+  };
   try {
+    const policy = loadPolicy(cwd);
     const base = turnBaseline(cwd, input.session_id);
     const changes = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
-    blocks = evaluate(changes, loadPolicy(cwd), void 0, "turn").filter((f) => f.severity === "block");
+    blocks = evaluate(changes, policy, void 0, "turn").filter((f) => f.severity === "block");
+    const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
+    blocks = blocks.concat(transient.blocks);
+    commitCursor = transient.commit;
+    if (blocks.length === 0 && input.session_id) {
+      savePtree(cwd, input.session_id, snapshotProtected(cwd, policy, loadPtree(cwd, input.session_id) ?? void 0));
+    }
   } catch (e) {
     return failClosed("Stop", errText(e));
   }
-  if (blocks.length === 0) advanceTurnBaseline(cwd, input.session_id);
+  if (blocks.length === 0) {
+    advanceTurnBaseline(cwd, input.session_id);
+    commitCursor();
+  }
   return verdict(blocks, "Stop");
 }
 function emit(r) {
@@ -2169,8 +2557,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3, chmodSync } from "node:fs";
-import { dirname as dirname3, join as join6 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
 var HOOK_CMD = "npx --yes tamperward hook claude";
 var SWEEP_CMD = "npx --yes tamperward sweep claude";
 var PRECOMMIT_CMD = "npx --yes tamperward check --staged";
@@ -2230,24 +2618,24 @@ jobs:
         run: npx --yes tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
 `;
 function planPolicy(cwd) {
-  const path = join6(cwd, POLICY_FILE);
-  if (existsSync5(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
+  const path = join8(cwd, POLICY_FILE);
+  if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
   return {
     item: "policy",
     path: POLICY_FILE,
     status: "create",
     detail: "baseline policy with commented overrides",
-    apply: () => writeFileSync3(path, POLICY_CONTENT)
+    apply: () => writeFileSync5(path, POLICY_CONTENT)
   };
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join6(cwd, rel);
+  const path = join8(cwd, rel);
   let settings = {};
-  if (existsSync5(path)) {
+  if (existsSync7(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync7(path, "utf8"));
+      parsed = JSON.parse(readFileSync10(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -2269,7 +2657,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync5(path) ? "update" : "create",
+    status: existsSync7(path) ? "update" : "create",
     detail: `wire ${[needPre && "PreToolUse deny", needStop && "Stop sweep"].filter(Boolean).join(" + ")}`,
     apply: () => {
       if (needPre) {
@@ -2281,8 +2669,8 @@ function planClaudeHooks(cwd) {
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, JSON.stringify(settings, null, 2) + "\n");
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n");
     }
   };
 }
@@ -2290,12 +2678,12 @@ function planPreCommit(cwd) {
   const line = `${MARKER}
 ${PRECOMMIT_CMD}
 `;
-  const husky = join6(cwd, ".husky");
-  const gitDir2 = join6(cwd, ".git");
-  const target = existsSync5(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync5(gitDir2) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
+  const husky = join8(cwd, ".husky");
+  const gitDir3 = join8(cwd, ".git");
+  const target = existsSync7(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync7(gitDir3) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
   if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
-  const path = join6(cwd, target.rel);
-  const existing = existsSync5(path) ? readFileSync7(path, "utf8") : null;
+  const path = join8(cwd, target.rel);
+  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
   if (existing?.includes("tamperward check --staged")) {
     return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
   }
@@ -2305,26 +2693,26 @@ ${PRECOMMIT_CMD}
     status: existing === null ? "create" : "update",
     detail: existing === null ? `create via ${target.note}` : `append the staged check (${target.note})`,
     apply: () => {
-      mkdirSync3(dirname3(path), { recursive: true });
+      mkdirSync5(dirname3(path), { recursive: true });
       const content = existing === null ? `#!/bin/sh
 ${line}` : existing.replace(/\n?$/, "\n") + line;
-      writeFileSync3(path, content);
+      writeFileSync5(path, content);
       chmodSync(path, 493);
     }
   };
 }
 function planWorkflow(cwd) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join6(cwd, rel);
-  if (existsSync5(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
+  const path = join8(cwd, rel);
+  if (existsSync7(path)) return { item: "ci", path: rel, status: "ok", detail: "workflow already present \u2014 left untouched" };
   return {
     item: "ci",
     path: rel,
     status: "create",
     detail: "PR gate with out-of-band label sign-off (re-runs on labeled/unlabeled)",
     apply: () => {
-      mkdirSync3(dirname3(path), { recursive: true });
-      writeFileSync3(path, WORKFLOW_CONTENT);
+      mkdirSync5(dirname3(path), { recursive: true });
+      writeFileSync5(path, WORKFLOW_CONTENT);
     }
   };
 }
@@ -2359,6 +2747,171 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
   return 0;
 }
 
+// src/cli/verify.ts
+import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
+import { chmodSync as chmodSync2, cpSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname4, join as join9 } from "node:path";
+var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
+function git2(args, cwd) {
+  return execFileSync4("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28 });
+}
+function resolveBase(base, cwd) {
+  const rev = git2(["rev-parse", "--verify", `${base}^{commit}`], cwd).trim();
+  try {
+    return git2(["merge-base", rev, "HEAD"], cwd).trim();
+  } catch {
+    return rev;
+  }
+}
+function materialize(cwd, dest) {
+  const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  for (const rel of listed) {
+    const src = join9(cwd, rel);
+    let st;
+    try {
+      st = statSync5(src);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    const out = join9(dest, rel);
+    mkdirSync6(dirname4(out), { recursive: true });
+    cpSync(src, out);
+    chmodSync2(out, st.mode);
+  }
+  const nm = join9(cwd, "node_modules");
+  if (existsSync8(nm)) symlinkSync(nm, join9(dest, "node_modules"), "dir");
+}
+function overlayPristine(cwd, base, dest, policy) {
+  const atBase = git2(["ls-tree", "-r", "--name-only", "-z", base], cwd).split("\0").filter(Boolean);
+  const isOverlay = (p) => OVERLAY_CLASSES.some((c) => isProtected(p, policy, c));
+  let restored = 0;
+  const baseProtected = /* @__PURE__ */ new Set();
+  for (const rel of atBase) {
+    if (!isOverlay(rel)) continue;
+    baseProtected.add(rel);
+    const content = execFileSync4("git", ["show", `${base}:${rel}`], { cwd, maxBuffer: 1 << 28 });
+    const out = join9(dest, rel);
+    mkdirSync6(dirname4(out), { recursive: true });
+    writeFileSync6(out, content);
+    restored++;
+  }
+  let kept = 0;
+  const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
+  for (const rel of inCopy) if (isOverlay(rel) && !baseProtected.has(rel)) kept++;
+  return [restored, kept];
+}
+function runSuite(dir, cmd, budgetSecs) {
+  const t0 = Date.now();
+  const r = spawnSync("sh", ["-c", cmd], {
+    cwd: dir,
+    stdio: "ignore",
+    timeout: budgetSecs * 1e3,
+    killSignal: "SIGKILL"
+  });
+  const secs = Math.round((Date.now() - t0) / 1e3);
+  if (r.error && r.error.code === "ETIMEDOUT") return { exit: null, secs };
+  if (r.status === null && r.signal) return { exit: null, secs };
+  return { exit: r.status ?? 2, secs };
+}
+function runVerify(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const out = (s) => void process.stdout.write(s + "\n");
+  let policy;
+  try {
+    policy = loadPolicy(cwd);
+  } catch (e) {
+    out(`verify: cannot load policy (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const cmd = opts.cmd ?? policy.verify?.command;
+  if (!cmd) {
+    out("verify: no suite command \u2014 set policy `verify: { command: ... }` or pass --cmd");
+    return 2;
+  }
+  const budget = opts.budget ?? policy.verify?.budget ?? 300;
+  let base;
+  try {
+    base = resolveBase(opts.base ?? "HEAD", cwd);
+  } catch {
+    out(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
+    return 2;
+  }
+  const work = mkdtempSync2(join9(tmpdir2(), "tw-verify-"));
+  const visDir = join9(work, "visible");
+  const priDir = join9(work, "pristine");
+  let restored = 0;
+  let kept = 0;
+  try {
+    mkdirSync6(visDir);
+    mkdirSync6(priDir);
+    materialize(cwd, visDir);
+    materialize(cwd, priDir);
+    [restored, kept] = overlayPristine(cwd, base, priDir, policy);
+  } catch (e) {
+    if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+    out(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
+    return 2;
+  }
+  const visible = runSuite(visDir, cmd, budget);
+  const pristine = runSuite(priDir, cmd, budget);
+  if (!opts.keep) rmSync2(work, { recursive: true, force: true });
+  let verdict2;
+  let code;
+  if (visible.exit === null || pristine.exit === null) {
+    verdict2 = "BUDGET_EXCEEDED";
+    code = 2;
+  } else if (visible.exit === 0 && pristine.exit === 0) {
+    verdict2 = "VERIFIED";
+    code = 0;
+  } else if (visible.exit === 0) {
+    verdict2 = "MASKED_FAILURE";
+    code = 1;
+  } else {
+    verdict2 = "SUITE_RED";
+    code = 1;
+  }
+  if (opts.json) {
+    out(
+      JSON.stringify({
+        verdict: verdict2,
+        base,
+        command: cmd,
+        budget_secs: budget,
+        visible: { exit: visible.exit, secs: visible.secs },
+        pristine: { exit: pristine.exit, secs: pristine.secs },
+        protected_restored: restored,
+        added_protected_kept: kept,
+        ...opts.keep ? { workdir: work } : {}
+      })
+    );
+  } else {
+    const lines = {
+      VERIFIED: `verified: the suite passes, and still passes with all ${restored} protected files restored from ${base.slice(0, 10)}.`,
+      MASKED_FAILURE: `MASKED FAILURE: the visible suite passes, but with the ${restored} protected files restored from ${base.slice(0, 10)} it FAILS (exit ${pristine.exit}). Something weakened the checks; the code does not pass the original suite.`,
+      SUITE_RED: `suite red: the visible suite fails (exit ${visible.exit}) \u2014 fix the code first (pristine exit ${pristine.exit}).`,
+      BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
+    };
+    out(`tamperward verify \u2014 ${lines[verdict2]}`);
+    if (kept > 0) out(`(${kept} protected file(s) added since ${base.slice(0, 10)} were kept in the pristine run.)`);
+  }
+  return code;
+}
+function parseVerify(args) {
+  const o = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--base" && args[i + 1]) o.base = args[++i];
+    else if (a === "--cmd" && args[i + 1]) o.cmd = args[++i];
+    else if (a === "--budget" && args[i + 1]) o.budget = Number(args[++i]);
+    else if (a === "--json") o.json = true;
+    else if (a === "--keep") o.keep = true;
+    else if (a === "--cwd" && args[i + 1]) o.cwd = args[++i];
+  }
+  return o;
+}
+
 // src/cli/index.ts
 function parseAllow(args) {
   const o = {};
@@ -2431,6 +2984,14 @@ Formats:
   auto    github when GITHUB_ACTIONS=true, otherwise text.
   tamperward hook claude                    PreToolUse gate (reads hook JSON on stdin)
   tamperward sweep claude                   Stop sweep (re-scan the turn's working tree)
+  tamperward watch [--dir D] [--log F]      filesystem-event observer daemon: records
+                                            protected-file events so the sweep can
+                                            observe supported transient effects
+  tamperward verify [--base R] [--cmd C]    pristine-suite re-execution: run the suite
+             [--budget S] [--json] [--keep] as-is AND with protected files restored
+                                            from the trusted base; a visible-green /
+                                            pristine-red result is a MASKED FAILURE
+                                            (exit 1); cannot-verify fails closed (2)
   tamperward allow <rule> --reason "..."    record a human sign-off (local audit ledger)
   tamperward init [--dry-run]               wire the policy file plus every
                                             enforcement point: Claude Code hooks,
@@ -2441,8 +3002,8 @@ Exit code: check \u2192 1 if any blocking finding. hook/sweep \u2192 always 0; a
            emitted as JSON on stdout (exit 2 makes Claude Code ignore the JSON).
 `);
 }
-function main(argv) {
-  const [cmd, ...rest] = argv;
+function main(argv2) {
+  const [cmd, ...rest] = argv2;
   switch (cmd) {
     case "check":
       return runCheck(parseCheck(rest));
@@ -2454,6 +3015,8 @@ function main(argv) {
       return runAllow(parseAllow(rest));
     case "init":
       return runInit(parseInit(rest));
+    case "verify":
+      return runVerify(parseVerify(rest));
     case void 0:
     case "-h":
     case "--help":
@@ -2466,4 +3029,9 @@ function main(argv) {
       return 2;
   }
 }
-process.exit(main(process.argv.slice(2)));
+var argv = process.argv.slice(2);
+if (argv[0] === "watch") {
+  runWatch(argv.slice(1));
+} else {
+  process.exit(main(argv));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",