tamperward 2.1.1 → 2.2.1

package/dist/cli/index.js

@@ -356,31 +356,59 @@ function tokens(seg) {
 function unquote(t) {
   return t.replace(/^['"]+|['"]+$/g, "");
 }
+function words(seg) {
+  return tokens(seg).map(unquote);
+}
+var GIT_OPT_WITH_ARG = /* @__PURE__ */ new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
+function gitSubcommand(toks) {
+  const i = toks.findIndex((t) => t === "git" || t.endsWith("/git"));
+  if (i < 0) return null;
+  for (let j = i + 1; j < toks.length; j++) {
+    const t = toks[j];
+    if (GIT_OPT_WITH_ARG.has(t)) {
+      j++;
+      continue;
+    }
+    if (t.startsWith("-")) continue;
+    return t;
+  }
+  return null;
+}
 
 // src/detectors/no-verify.ts
 var RULE = "no-verify";
-var LITERAL = [
-  { re: /(?:^|\s)--no-verify(?:\s|$)/, why: "--no-verify skips the pre-commit/pre-push hooks" },
-  { re: /(?:^|\s)--no-hooks(?:\s|$)/, why: "--no-hooks disables hook execution" },
-  { re: /(?:^|[\s;&|=])HUSKY=0(?:\s|$)/, why: "HUSKY=0 disables all Husky hooks" },
-  { re: /\bHUSKY_SKIP_HOOKS=1\b/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" },
-  // git-native hook disabling. core.hooksPath is strictly MORE general than the
-  // flags above: it turns off husky, lefthook, plain .git/hooks and pre-commit
-  // alike, and it was reachable in three spellings the literal list missed
-  // (-c, `git config`, and GIT_CONFIG_* env injection). (P1-9, external review.)
+var RAW = [
   { re: /\bcore\.hooksPath\b/i, why: "core.hooksPath redirects git away from the installed hooks" },
-  { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" },
-  { re: /(?:^|[\s;&|=])LEFTHOOK=0(?:\s|$)/, why: "LEFTHOOK=0 disables Lefthook hooks" },
-  { re: /\bSKIP_SIMPLE_GIT_HOOKS=1\b/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
-  { re: /\bPRE_COMMIT_ALLOW_NO_CONFIG=1\b/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
-  // The pre-commit framework's own escape hatch: SKIP=<hook-id>[,…] skips those
-  // hooks for that one invocation. `.pre-commit-config.yaml` is a protected hook,
-  // so its documented bypass has to be one too. `SKIP=` is a plausible variable
-  // name elsewhere, so it counts only in a segment that runs git or pre-commit.
-  { re: /(?:^|[\s;&|])SKIP=\S+/, why: "SKIP=<hook-id> tells the pre-commit framework to skip that hook", when: /\b(?:git|pre-commit)\b/ },
-  { re: /(?:^|[\s;&|])LEFTHOOK_EXCLUDE=\S+/, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
+  { re: /\bGIT_CONFIG_KEY_\d+\s*=\s*["']?core\.hooksPath/i, why: "GIT_CONFIG_* injection sets core.hooksPath" }
+];
+var ENV = [
+  { re: /^HUSKY=0$/, why: "HUSKY=0 disables all Husky hooks" },
+  { re: /^HUSKY_SKIP_HOOKS=1$/, why: "HUSKY_SKIP_HOOKS=1 skips Husky hooks" },
+  { re: /^LEFTHOOK=0$/, why: "LEFTHOOK=0 disables Lefthook hooks" },
+  { re: /^SKIP_SIMPLE_GIT_HOOKS=1$/, why: "SKIP_SIMPLE_GIT_HOOKS=1 skips simple-git-hooks" },
+  { re: /^PRE_COMMIT_ALLOW_NO_CONFIG=1$/, why: "PRE_COMMIT_ALLOW_NO_CONFIG=1 lets pre-commit no-op" },
+  { re: /^LEFTHOOK_EXCLUDE=./, why: "LEFTHOOK_EXCLUDE=<name> skips the named Lefthook commands" }
 ];
+var SKIP = /^SKIP=./;
+var SKIP_WHY = "SKIP=<hook-id> tells the pre-commit framework to skip that hook";
+var ENV_PREFIX = /^(?:export|env|sudo)$/;
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var HOOK_SUBCOMMANDS = /* @__PURE__ */ new Set(["commit", "push", "merge"]);
+var NO_VERIFY = /^--no-veri(?:f|fy)?$/;
+var NO_HOOKS = "--no-hooks";
 var SHORT_N = /^-[a-z]*n[a-z]*$/i;
+var TAKES_VALUE = /* @__PURE__ */ new Set(["-m", "--message", "-F", "--file", "--author", "--date", "--trailer", "-c", "-C", "--reuse-message", "--reedit-message"]);
+function gitArgs(toks, sub) {
+  const out2 = [];
+  for (let j = toks.indexOf(sub) + 1; j < toks.length; j++) {
+    if (TAKES_VALUE.has(toks[j])) {
+      j++;
+      continue;
+    }
+    out2.push(toks[j]);
+  }
+  return out2;
+}
 var noVerify = {
   id: RULE,
   surface: ["command"],
@@ -389,24 +417,53 @@ var noVerify = {
     const out2 = [];
     for (const c of changes) {
       if (c.kind !== "command") continue;
+      let carriedSkip = null;
       for (const seg of segments(c.raw)) {
         let why = null;
-        for (const p of LITERAL) {
-          if (p.re.test(seg) && (!p.when || p.when.test(seg))) {
+        let evidence = seg;
+        for (const p of RAW) {
+          if (p.re.test(seg)) {
             why = p.why;
             break;
           }
         }
-        if (!why && /\bgit\b/.test(seg) && /\bcommit\b/.test(seg)) {
-          if (tokens(seg).some((t) => SHORT_N.test(t))) {
-            why = "git commit -n skips the pre-commit hook";
+        const toks = words(seg);
+        let k = 0;
+        while (k < toks.length && ENV_PREFIX.test(toks[k])) k++;
+        const exported = k > 0 && toks[0] === "export";
+        const assigns = [];
+        while (k < toks.length && ASSIGNMENT.test(toks[k])) assigns.push(toks[k++]);
+        const bareAssignment = k === toks.length && assigns.length > 0;
+        const sub = gitSubcommand(toks);
+        const runsHookTool = sub !== null || toks.includes("pre-commit");
+        if (!why) {
+          for (const a of assigns) {
+            const hit = ENV.find((p) => p.re.test(a));
+            if (hit) {
+              why = hit.why;
+              break;
+            }
+            if (SKIP.test(a)) {
+              if (runsHookTool) why = SKIP_WHY;
+              else if (exported || bareAssignment) carriedSkip = seg;
+            }
           }
         }
+        if (!why && carriedSkip && runsHookTool) {
+          why = `${SKIP_WHY} (set earlier in the same command)`;
+          evidence = `${carriedSkip}; ${seg}`;
+        }
+        if (!why && sub && HOOK_SUBCOMMANDS.has(sub)) {
+          const args = gitArgs(toks, sub);
+          if (args.some((t) => NO_VERIFY.test(t))) why = "--no-verify skips the pre-commit/pre-push hooks";
+          else if (sub === "commit" && args.some((t) => SHORT_N.test(t))) why = "git commit -n skips the pre-commit hook";
+        }
+        if (!why && toks.includes(NO_HOOKS)) why = "--no-hooks disables hook execution";
         if (why) {
           out2.push(
             makeFinding(RULE, policy, {
               message: `Command bypasses git hooks: ${why}.`,
-              evidence: seg,
+              evidence,
               remediation: "Let the hooks run and fix what they catch. Skipping verification is exactly the move this gate blocks \u2014 editing the hook and --no-hooks are blocked too."
             })
           );
@@ -443,6 +500,16 @@ function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
   }
   return out2;
 }
+function normalizeGlob(glob) {
+  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
+}
+function mergeRules(base, user) {
+  const out2 = { ...base };
+  for (const [name, cfg] of Object.entries(user ?? {})) {
+    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
+  }
+  return out2;
+}
 var cache = /* @__PURE__ */ new Map();
 function matcher(glob) {
   let m = cache.get(glob);
@@ -452,12 +519,12 @@ function matcher(glob) {
   }
   return m;
 }
-function matchesAny(path, globs) {
-  return !!globs && globs.some((g) => matcher(g)(path));
+function matchesAny(path, globs2) {
+  return !!globs2 && globs2.some((g) => matcher(g)(path));
 }
 function protectedCategory(path, policy) {
-  for (const [cat, globs] of Object.entries(policy.protected ?? {})) {
-    if (matchesAny(path, globs)) return cat;
+  for (const [cat, globs2] of Object.entries(policy.protected ?? {})) {
+    if (matchesAny(path, globs2)) return cat;
   }
   return null;
 }
@@ -473,9 +540,9 @@ function isIgnored(path, policy) {
 }
 function mergeProtected(base, user) {
   const out2 = { ...base };
-  for (const [cat, globs] of Object.entries(user ?? {})) {
+  for (const [cat, globs2] of Object.entries(user ?? {})) {
     const have = new Set(out2[cat] ?? []);
-    out2[cat] = [...out2[cat] ?? [], ...(globs ?? []).filter((g) => !have.has(g))];
+    out2[cat] = [...out2[cat] ?? [], ...(globs2 ?? []).filter((g) => !have.has(g))];
   }
   return out2;
 }
@@ -635,12 +702,38 @@ function isSignificantLine(trimmed, lang) {
   if (HASH_COMMENT.has(l) && trimmed.startsWith("#")) return false;
   return true;
 }
+var SLASH_COMMENT = /^(?:\/\/|\/\*|\*(?:\s|\/|$))/;
+var HASH_COMMENT_LANGS = /* @__PURE__ */ new Set(["py", "rb", "php"]);
+function isCommentLine(trimmed, lang) {
+  const l = lang ?? "js";
+  if (HASH_COMMENT_LANGS.has(l) && trimmed.startsWith("#") && !trimmed.startsWith("#[")) return true;
+  if (l === "py" || l === "rb") return false;
+  return SLASH_COMMENT.test(trimmed);
+}
+function insideStringLiteral(line, idx, lang) {
+  const hash = HASH_COMMENT_LANGS.has(lang ?? "js");
+  let quote = null;
+  for (let j = 0; j < idx; j++) {
+    const ch = line[j];
+    if (quote) {
+      if (ch === "\\") j++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (ch === "/" && (line[j + 1] === "/" || line[j + 1] === "*")) return false;
+    else if (hash && ch === "#") return false;
+  }
+  return quote !== null;
+}
 
 // src/detectors/ts-any-cast.ts
 var BLOCK_RULE = "ts-any-cast";
 var WARN_RULE = "ts-any-launder";
 var DOUBLE_CAST = /\bas\s+unknown\s+as\b/g;
 var SUPPRESS = /@ts-(?:ignore|expect-error|nocheck)\b/g;
+var JSDOC_ANY_CAST = /\/\*\*\s*@type\s*\{\s*any\s*\}\s*\*\/\s*\(/g;
+var JS_FILE = /\.(?:js|jsx|mjs|cjs)$/;
 var countMatches = (s, re) => (s.match(re) || []).length;
 function countAny(src) {
   const r = { cast: 0, broad: 0 };
@@ -648,8 +741,13 @@ function countAny(src) {
     const sf = ts.createSourceFile("f.ts", src, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
     const visit = (node) => {
       if (node.kind === ts.SyntaxKind.AnyKeyword) {
-        const p = node.parent;
-        const isCast = p && ts.isAsExpression(p) && p.type === node || p && ts.isTypeAssertionExpression(p) && p.type === node;
+        let target = node;
+        let p = target.parent;
+        while (p && ts.isParenthesizedTypeNode(p)) {
+          target = p;
+          p = p.parent;
+        }
+        const isCast = p && ts.isAsExpression(p) && p.type === target || p && ts.isTypeAssertionExpression(p) && p.type === target;
         if (isCast) r.cast++;
         else r.broad++;
       }
@@ -660,7 +758,7 @@ function countAny(src) {
   }
   return r;
 }
-var NARROW_LINE = /\bas\s+any\b|<\s*any\s*>|\bas\s+unknown\s+as\b|@ts-(?:ignore|expect-error|nocheck)\b/;
+var NARROW_LINE = /\bas\s+\(*\s*any\b|<\s*any\s*>|\bas\s+unknown\s+as\b|@ts-(?:ignore|expect-error|nocheck)\b/;
 var BROAD_LINE = /:\s*any\b|<[^<>]*\bany\b[^<>]*>/;
 var BLOCK_REMEDIATION = "Fix the underlying type instead of silencing the checker; do not cast to `any`.";
 var WARN_REMEDIATION = "Prefer a precise type or `unknown` + a guard over `any` here \u2014 flagged for review.";
@@ -681,10 +779,12 @@ var tsAnyCast = {
         const dBroad = a.broad - b.broad;
         const dDouble = countMatches(c.after, DOUBLE_CAST) - countMatches(before, DOUBLE_CAST);
         const dSuppr = countMatches(c.after, SUPPRESS) - countMatches(before, SUPPRESS);
+        const dJsdoc = JS_FILE.test(c.path) ? countMatches(c.after, JSDOC_ANY_CAST) - countMatches(before, JSDOC_ANY_CAST) : 0;
         const blockReasons = [];
         if (dCast > 0) blockReasons.push("`as any` cast");
         if (dDouble > 0) blockReasons.push("`as unknown as` double cast");
         if (dSuppr > 0) blockReasons.push("@ts-ignore/@ts-expect-error/@ts-nocheck suppression");
+        if (dJsdoc > 0) blockReasons.push("JSDoc `@type {any}` cast");
         if (blockReasons.length) {
           out2.push(
             makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
@@ -709,8 +809,9 @@ var tsAnyCast = {
         }
         continue;
       }
+      const jsdocCast = JS_FILE.test(c.path) ? new RegExp(JSDOC_ANY_CAST.source) : null;
       for (const l of addedLines(c)) {
-        if (NARROW_LINE.test(l.content)) {
+        if (NARROW_LINE.test(l.content) || jsdocCast && jsdocCast.test(l.content)) {
           out2.push(
             makeFinding(inTest ? WARN_RULE : BLOCK_RULE, policy, {
               file: c.path,
@@ -744,30 +845,47 @@ var RULE2 = "lint-suppression";
 var PATTERNS = {
   js: [
     { re: /eslint-disable(?:-next-line|-line)?\b/, why: "eslint-disable suppresses lint rules" },
+    // Inline config is the other spelling of the same directive: `/* eslint rule: off */`,
+    // `: "off"`, `: 0`, `: [0, …]`. `/* eslint-env */` and `/* eslint rule: "error" */` are not.
+    { re: /\/\*\s*eslint\s+(?!-)(?:[^*]*?[\s,])?[\w@/.-]+\s*:\s*\[?\s*(?:["']off["']|off\b|0\b)/, why: "an inline eslint config turns a rule off" },
     { re: /\bprettier-ignore\b/, why: "prettier-ignore suppresses formatting checks" },
     { re: /\bbiome-ignore\b/, why: "biome-ignore suppresses Biome diagnostics" }
   ],
   py: [
     { re: /#\s*noqa\b/, why: "# noqa suppresses flake8/ruff findings" },
+    { re: /#\s*(?:ruff|flake8):\s*noqa\b/, why: "# ruff: noqa / # flake8: noqa suppresses every finding in the file" },
     { re: /#\s*type:\s*ignore\b/, why: "# type: ignore suppresses the type checker" },
+    { re: /#\s*mypy:\s*ignore-errors\b/, why: "# mypy: ignore-errors suppresses the type checker for the file" },
     { re: /#\s*pyright:\s*ignore\b/, why: "# pyright: ignore suppresses the type checker" },
     { re: /#\s*pylint:\s*disable\b/, why: "# pylint: disable suppresses lint rules" },
+    { re: /#\s*pylint:\s*skip-file\b/, why: "# pylint: skip-file suppresses lint for the file" },
     { re: /#\s*nosec\b/, why: "# nosec suppresses bandit security findings" },
     { re: /#\s*fmt:\s*(?:off|skip)\b/, why: "# fmt: off/skip suppresses formatting checks" }
   ],
-  go: [{ re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" }],
+  go: [
+    { re: /\/\/\s*nolint\b/, why: "//nolint suppresses golangci-lint findings" },
+    { re: /\/\/\s*lint:ignore\b/, why: "//lint:ignore suppresses staticcheck findings" }
+  ],
   rs: [],
   rb: [{ re: /#\s*rubocop:\s*(?:disable|todo)\b/, why: "# rubocop:disable suppresses lint rules" }],
-  java: [{ re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" }],
-  kt: [{ re: /@Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" }],
+  java: [
+    { re: /@SuppressWarnings\s*\(/, why: "@SuppressWarnings suppresses compiler and lint warnings" },
+    { re: /\/\/\s*NOSONAR\b/, why: "// NOSONAR suppresses SonarQube findings" }
+  ],
+  kt: [
+    { re: /@(?:file:)?Suppress(?:Warnings)?\s*\(/, why: "@Suppress suppresses compiler and lint warnings" },
+    { re: /\/\/\s*NOSONAR\b/, why: "// NOSONAR suppresses SonarQube findings" }
+  ],
   php: [
     { re: /\bphpcs:(?:ignore|disable)\b/, why: "phpcs:ignore/disable suppresses coding-standard checks" },
+    { re: /@codingStandardsIgnore(?:Line|Start|File)\b/, why: "@codingStandardsIgnore* suppresses coding-standard checks" },
     { re: /@phpstan-ignore\b/, why: "@phpstan-ignore suppresses static-analysis findings" },
     { re: /@psalm-suppress\b/, why: "@psalm-suppress suppresses static-analysis findings" }
   ],
   cs: [
     { re: /#pragma\s+warning\s+disable\b/, why: "#pragma warning disable suppresses compiler warnings" },
-    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" }
+    { re: /\[SuppressMessage\s*\(/, why: "[SuppressMessage] suppresses analyzer findings" },
+    { re: /\/\/\s*ReSharper\s+disable\b/, why: "// ReSharper disable suppresses inspections" }
   ]
 };
 var lintSuppression = {
@@ -784,18 +902,18 @@ var lintSuppression = {
       if (patterns.length === 0) continue;
       for (const l of addedLines(c)) {
         for (const p of patterns) {
-          if (p.re.test(l.content)) {
-            out2.push(
-              makeFinding(RULE2, policy, {
-                file: c.path,
-                line: l.newLine ?? void 0,
-                message: `Lint suppression added: ${p.why}.`,
-                evidence: l.content.trim(),
-                remediation: "Resolve the finding rather than suppressing the rule."
-              })
-            );
-            break;
-          }
+          const m = p.re.exec(l.content);
+          if (!m || insideStringLiteral(l.content, m.index, lang)) continue;
+          out2.push(
+            makeFinding(RULE2, policy, {
+              file: c.path,
+              line: l.newLine ?? void 0,
+              message: `Lint suppression added: ${p.why}.`,
+              evidence: l.content.trim(),
+              remediation: "Resolve the finding rather than suppressing the rule."
+            })
+          );
+          break;
         }
       }
     }
@@ -807,40 +925,66 @@ var lintSuppression = {
 var RULE3 = "test-skip";
 var PATTERNS2 = {
   js: [
-    { re: /\b(?:it|test|describe)\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-    { re: /\b(?:xit|xtest|xdescribe)\b/, why: "an x-prefixed disabled test" },
-    { re: /\b(?:fit|ftest|fdescribe)\b/, why: "an f-prefixed focused test (narrows the suite)" },
+    // vitest chains a concurrency modifier before the marker: it.concurrent.skip.
+    { re: /\b(?:it|test|describe|suite)(?:\.(?:concurrent|sequential|shuffle))?\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
+    { re: /\b(?:it|test|describe|suite)\.(?:skipIf|runIf)\s*\(/, why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
+    { re: /\b(?:it|test)\.(?:fails|failing)\s*\(/, why: "a .fails/.failing marker (the test now passes by failing)" },
+    { re: /\b(?:it|test|describe)\.each\s*\(\s*\[\s*\]\s*\)/, why: "an empty .each table (no case ever runs)" },
+    { re: /\b(?:xit|xtest|xdescribe)\s*\(/, why: "an x-prefixed disabled test" },
+    { re: /\b(?:fit|ftest|fdescribe)\s*\(/, why: "an f-prefixed focused test (narrows the suite)" },
     { re: /\bpending\(\s*\)/, why: "a pending() marker" },
     // node:test spells the same class as options — `test('x', { skip: true }, ...)` — and as
     // a runtime call. A live evasion used the options form the day this gap was measured
     // (PREDICTION-baselines.md): denied the rm, the agent skipped by option instead.
-    { re: /\bskip:\s*(?:true|1|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    // In options position (right after the title) ANY value but false/0 skips — a
+    // non-literal `{ skip: process.env.CI }` included. Elsewhere on a line only the
+    // literal forms count: `list({ skip: 1, take: 5 })` is pagination.
+    { re: /\b(?:it|test|describe|suite)\s*\(\s*(['"`])(?:(?!\1).)*\1\s*,\s*\{[^}]*?\bskip:(?!\s*(?:false|0)\b)/, why: "a { skip: ... } option disabling the test (node:test options form)" },
+    { re: /\bskip:\s*(?:true|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-    { re: /\b(?:t|ctx|context)\.skip\(/, why: "a runtime t.skip() call" }
+    { re: /\b(?:t|ctx|context|this)\.skip\(/, why: "a runtime t.skip()/this.skip() call" }
   ],
   py: [
-    { re: /@pytest\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    // `import pytest as pt` makes the decorator `@pt.mark.skip`; the module alias is free.
+    { re: /@\w+\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    { re: /\bpytestmark\s*=.*\.mark\.(?:skip|skipif|xfail)\b/, why: "a module-level pytestmark skip (every test in the file is skipped)" },
     { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail() call" },
-    { re: /@unittest\.(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
+    // `from unittest import skip` makes the decorator bare `@skip`.
+    { re: /@(?:unittest\.)?(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
     { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
-    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" }
+    { re: /\braise\s+(?:unittest\.)?SkipTest\b/, why: "a raised SkipTest" },
+    { re: /\b__test__\s*=\s*False\b/, why: "__test__ = False hides the test from collection" }
   ],
   go: [
-    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" }
+    { re: /\b[tb]\.Skip(?:f|Now)?\(/, why: "a runtime t.Skip()/Skipf()/SkipNow() call" },
+    { re: /\bif\s+testing\.Short\(\)/, why: "a testing.Short() guard (the body is skipped under -short)" },
+    { re: /^\s*\/\/\s*(?:go:build|\+build)\s+ignore\b/, why: "a build-ignore constraint (the file is excluded from the test run)", comment: true }
+  ],
+  rs: [
+    { re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" },
+    { re: /#\[cfg_attr\(.*\bignore\b/, why: "a cfg_attr(\u2026, ignore) attribute (the test is ignored under that configuration)" }
   ],
-  rs: [{ re: /#\[ignore\b/, why: "an #[ignore] attribute (the test no longer runs by default)" }],
   rb: [
-    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*$)/, why: "a skip/pending call" },
-    { re: /\bx(?:it|describe|context|specify|example)\b/, why: "an x-prefixed disabled example" },
-    { re: /\b(?:fit|fdescribe|fcontext)\b/, why: "an f-prefixed focused example (narrows the suite)" },
-    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip:/pending: metadata flag" }
+    { re: /(?:^|[\s;{(])(?:skip|pending)(?:\s*\(|\s+['"]|\s+(?:if|unless)\b|\s*\}|\s*$)/, why: "a skip/pending call" },
+    { re: /(?:^|[\s;{(])x(?:it|describe|context|specify|example)\s*[('"]/, why: "an x-prefixed disabled example" },
+    { re: /(?:^|[\s;{(])f(?:it|describe|context)\s*[('"]/, why: "an f-prefixed focused example (narrows the suite)" },
+    { re: /\b(?:skip|pending):\s*(?:true|['"])/, why: "a skip/pending metadata flag" },
+    { re: /^\s*(?:it|specify|example)\s+(['"])(?:(?!\1).)*\1\s*$/, why: "an example with no block (RSpec reports it as pending)" }
+  ],
+  java: [
+    { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+    { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
+  ],
+  kt: [
+    { re: /@(?:[\w.]+\.)?(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" },
+    { re: /\bassume(?:True\(\s*false|False\(\s*true)\s*[,)]/, why: "an assumption that never holds (the test aborts as skipped)" }
   ],
-  java: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
-  kt: [{ re: /@(?:Ignore|Disabled)\b/, why: "an @Ignore/@Disabled annotation" }],
   php: [{ re: /\bmarkTest(?:Skipped|Incomplete)\(/, why: "a markTestSkipped()/markTestIncomplete() call" }],
   cs: [
     { re: /\[Ignore\b/, why: "an [Ignore] attribute" },
-    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' }
+    { re: /\bSkip\s*=\s*"/, why: 'a Skip = "..." attribute argument' },
+    { re: /(?:\[|,)\s*Explicit\b/, why: "an [Explicit] attribute (the test runs only when selected by name)" },
+    { re: /\bAssert\.Inconclusive\(/, why: "an Assert.Inconclusive() call (the test ends without a verdict)" }
   ]
 };
 var testSkip = {
@@ -852,9 +996,12 @@ var testSkip = {
     for (const c of changes) {
       if (c.kind !== "file") continue;
       if (!isProtected(c.path, policy, "tests")) continue;
-      const patterns = PATTERNS2[langOf(c.path) ?? "js"];
+      const lang = langOf(c.path);
+      const patterns = PATTERNS2[lang ?? "js"];
       for (const l of addedLines(c)) {
+        const comment = isCommentLine(l.content.trim(), lang);
         for (const p of patterns) {
+          if (comment && !p.comment) continue;
           if (p.re.test(l.content)) {
             out2.push(
               makeFinding(RULE3, policy, {
@@ -1164,6 +1311,7 @@ var ciTampering = {
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
+var globs = (list) => Array.isArray(list) ? list.filter((g) => typeof g === "string").map(normalizeGlob) : [];
 function safeParse(src) {
   try {
     const v = parse(src);
@@ -1177,12 +1325,19 @@ function effective(raw) {
   const v = raw.version;
   const version = typeof v === "number" && Number.isInteger(v) && v >= 1 ? v : 1;
   const base = defaultPolicy(version);
+  const rules = { ...base.rules };
+  for (const [name, cfg] of Object.entries(raw.rules ?? {})) {
+    const over = cfg && typeof cfg === "object" && !Array.isArray(cfg) ? cfg : {};
+    rules[name] = { ...rules[name] ?? {}, ...over, ...over.exclude ? { exclude: globs(over.exclude) } : {} };
+  }
+  const userProtected = raw.protected && typeof raw.protected === "object" ? Object.fromEntries(Object.entries(raw.protected).map(([cat, list]) => [cat, globs(list)])) : void 0;
   return {
     version,
-    rules: { ...base.rules, ...raw.rules ?? {} },
-    ignore: raw.ignore ?? base.ignore ?? [],
-    protected: mergeProtected(base.protected, raw.protected),
-    requiredFor: raw.signoff?.required_for ?? raw.signoff?.requiredFor ?? base.signoff.requiredFor
+    rules,
+    ignore: raw.ignore ? globs(raw.ignore) : base.ignore ?? [],
+    protected: mergeProtected(base.protected, userProtected),
+    requiredFor: raw.signoff?.required_for ?? raw.signoff?.requiredFor ?? base.signoff.requiredFor,
+    ledger: typeof raw.signoff?.ledger === "string" ? raw.signoff.ledger : base.signoff.ledger
   };
 }
 function policyWeakening(before, after) {
@@ -1234,6 +1389,9 @@ function policyWeakening(before, after) {
   if (be.requiredFor.includes("block") && !new Set(ae.requiredFor).has("block")) {
     reasons.push("sign-off no longer required for blocking findings");
   }
+  if (ae.ledger !== be.ledger) {
+    reasons.push(`sign-off ledger moved (${be.ledger} \u2192 ${ae.ledger}) \u2014 the local layer would trust a different file`);
+  }
   const bv = b.verify;
   const av = a.verify;
   if (bv?.command) {
@@ -1633,10 +1791,13 @@ var testContentRemoval = {
 // src/detectors/snapshot-rewrite.ts
 var RULE9 = "snapshot-rewrite";
 var RUNNER = /\b(?:jest|vitest|playwright|ava)\b/;
-var UPDATE_ANY = /--update-?[sS]napshots?\b/;
+var PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
+var UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
 var UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
+var INSTA_ACCEPT = /\bcargo\s+insta\s+(?:accept\b|.*\s--accept\b)/;
+var UPDATE_EXPECT = /(?:^|\s)UPDATE_EXPECT=\S+/;
 var REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
-var MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}/;
+var MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}|\bfind\b.*\s-(?:delete\b|exec\s+rm\b)|\bgit\s+(?:checkout|restore)\b/;
 function namesProtectedSnapshot(seg, policy) {
   for (const t of tokens(seg)) {
     const path = unquote(t).replace(/^>{1,2}/, "");
@@ -1656,7 +1817,9 @@ var snapshotRewrite = {
         for (const seg of segments(c.raw)) {
           let why = null;
           if (UPDATE_ANY.test(seg)) why = "the snapshot-update flag rewrites every failing snapshot to match current output";
-          else if (RUNNER.test(seg) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if ((RUNNER.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if (INSTA_ACCEPT.test(seg)) why = "cargo insta accept rewrites every pending snapshot to match current output";
+          else if (UPDATE_EXPECT.test(seg)) why = "UPDATE_EXPECT=1 rewrites every expect-test expectation to match current output";
           else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
           else {
             const path = MUTATE.test(seg) ? namesProtectedSnapshot(seg, policy) : null;
@@ -1789,7 +1952,7 @@ function hasBlocking(findings) {
 
 // src/policy-load.ts
 import { readFileSync as readFileSync2, existsSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2, posix } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -1804,11 +1967,21 @@ var SEVERITIES = ["block", "warn"];
 var isSeverity = (v) => SEVERITIES.includes(v);
 var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "string");
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
+function ledgerInsideRepo(ledger) {
+  if (!ledger.trim() || isAbsolute(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
+  return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
+}
 function validate(r, where) {
   function bad(msg) {
     throw new PolicyError(`${where}: ${msg}`);
   }
   const show = (v) => JSON.stringify(v) ?? String(v);
+  const unknown = Object.keys(r).filter((k) => !TOP_LEVEL_KEYS.has(k));
+  if (unknown.length) {
+    bad(`unknown top-level key${unknown.length === 1 ? "" : "s"} ${unknown.map((k) => JSON.stringify(k)).join(", ")} (expected one of ${[...TOP_LEVEL_KEYS].join(", ")})`);
+  }
   if (r.rules !== void 0) {
     if (!isMapping(r.rules)) bad(`rules must be a mapping of rule name to { severity, enabled, exclude }, got ${show(r.rules)}`);
     for (const [name, cfg] of Object.entries(r.rules)) {
@@ -1827,8 +2000,8 @@ function validate(r, where) {
   if (r.ignore !== void 0 && !isStringList(r.ignore)) bad(`ignore must be a list of globs, got ${show(r.ignore)}`);
   if (r.protected !== void 0) {
     if (!isMapping(r.protected)) bad(`protected must be a mapping of category to a list of globs, got ${show(r.protected)}`);
-    for (const [cat, globs] of Object.entries(r.protected)) {
-      if (!isStringList(globs)) bad(`protected.${cat} must be a list of globs, got ${show(globs)}`);
+    for (const [cat, globs2] of Object.entries(r.protected)) {
+      if (!isStringList(globs2)) bad(`protected.${cat} must be a list of globs, got ${show(globs2)}`);
     }
   }
   if (r.signoff !== void 0) {
@@ -1841,6 +2014,9 @@ function validate(r, where) {
     }
     const ledger = r.signoff.ledger;
     if (ledger !== void 0 && typeof ledger !== "string") bad(`signoff.ledger must be a path, got ${show(ledger)}`);
+    if (typeof ledger === "string" && !ledgerInsideRepo(ledger)) {
+      bad(`signoff.ledger must be a relative path inside the repository, got ${show(ledger)}`);
+    }
   }
   if (r.verify !== void 0) {
     if (!isMapping(r.verify)) bad(`verify must be a mapping like { command: "npm test" }, got ${show(r.verify)}`);
@@ -1857,14 +2033,20 @@ function parsePolicy(raw, where = POLICY_FILE) {
   const version = normalizeVersion(r.version, where);
   validate(r, where);
   const base = defaultPolicy(version);
+  const globs2 = (list) => list?.map(normalizeGlob);
+  const userProtected = r.protected ? Object.fromEntries(Object.entries(r.protected).map(([cat, list]) => [cat, globs2(list) ?? []])) : void 0;
+  const userRules = r.rules ? Object.fromEntries(
+    Object.entries(r.rules).map(([name, cfg]) => [name, cfg?.exclude ? { ...cfg, exclude: globs2(cfg.exclude) } : cfg])
+  ) : void 0;
   return {
     version,
     // Merge with the baseline, never replace. For an integrity tool, a config that sets
     // one rule's severity must NOT silently drop the other nine — nor may naming one
-    // protected glob wipe out the rest of its category (see mergeProtected).
-    protected: mergeProtected(base.protected, r.protected),
-    rules: { ...base.rules, ...r.rules ?? {} },
-    ignore: r.ignore ?? base.ignore,
+    // protected glob wipe out the rest of its category (see mergeProtected), nor may
+    // an `exclude`-only override drop the rule's baseline severity (see mergeRules).
+    protected: mergeProtected(base.protected, userProtected),
+    rules: mergeRules(base.rules, userRules),
+    ignore: globs2(r.ignore) ?? base.ignore,
     signoff: {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
@@ -1914,7 +2096,11 @@ function fingerprint(rule, file, evidence) {
 }
 var fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
 function ledgerPath(cwd, policy) {
-  return join3(cwd, policy.signoff?.ledger ?? ".tamperward/ledger.jsonl");
+  const rel = policy.signoff?.ledger ?? ".tamperward/ledger.jsonl";
+  if (!ledgerInsideRepo(rel)) {
+    throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
+  }
+  return join3(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
@@ -2008,7 +2194,7 @@ function paint(s, code, on) {
 function wrap(text, width) {
   const out2 = [];
   let cur = "";
-  for (const w of text.split(/\s+/).filter(Boolean)) {
+  for (const w of stripControl(text).split(/\s+/).filter(Boolean)) {
     if (cur === "") cur = w;
     else if (cur.length + 1 + w.length <= width) cur += " " + w;
     else {
@@ -2073,15 +2259,15 @@ function renderText(input, opts) {
   for (const f of findings) {
     const isBlock = f.severity === "block";
     const mark = paint(isBlock ? "BLOCK" : "warn ", isBlock ? BOLD + RED : YELLOW, c);
-    const loc = f.file ? `${f.file}${f.line ? `:${f.line}` : ""}` : "(command)";
-    out2.push(`  ${mark}  ${paint(f.rule, BOLD, c)}  ${paint(loc, DIM, c)}`);
+    const loc = f.file ? `${stripControl(f.file)}${f.line ? `:${f.line}` : ""}` : "(command)";
+    out2.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, DIM, c)}`);
     for (const l of wrap(f.message, opts.width - 4)) out2.push(`    ${l}`);
     const row = (key2, lines) => {
       lines.forEach((l, i) => out2.push(`    ${paint(pad(i === 0 ? key2 : ""), DIM, c)}  ${l}`));
     };
     row("evidence", [paint(clip(f.evidence, body), DIM, c)]);
     row("instead", wrap(f.remediation, body));
-    if (f.signoff.required) row("sign-off", [f.signoff.command]);
+    if (f.signoff.required) row("sign-off", [stripControl(f.signoff.command)]);
     out2.push("");
   }
   if (blocks.length > 0) {
@@ -2095,7 +2281,7 @@ function renderText(input, opts) {
 // src/cli/render/github.ts
 import { appendFileSync as appendFileSync2 } from "node:fs";
 function escData(s) {
-  return s.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+  return stripControl(s).replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
 }
 function escProp(s) {
   return escData(s).replace(/:/g, "%3A").replace(/,/g, "%2C");
@@ -2114,7 +2300,7 @@ function annotations(findings) {
   });
 }
 function cell(s) {
-  return s.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
+  return stripControl(s).replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
 }
 function mdCode(s) {
   return s.replace(/`/g, "'").replace(/[\r\n]/g, " ");
@@ -2222,8 +2408,13 @@ function report(input) {
 
 // src/cli/check.ts
 function check(opts) {
-  let policy = opts.policyOverride ?? loadPolicy(opts.cwd);
   const cwd = opts.cwd ?? process.cwd();
+  if (!isGitRepo(cwd)) {
+    process.stderr.write(`tamperward: ${cwd} is not inside a git repository \u2014 nothing to check
+`);
+    return 2;
+  }
+  let policy = opts.policyOverride ?? loadPolicy(opts.cwd);
   let changes;
   let layer;
   let view;
@@ -2236,13 +2427,20 @@ function check(opts) {
     layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
-    const [base, head] = opts.diff.split(/\.{2,3}/);
-    if (!base || !head) {
+    const m = opts.diff.match(/^(.+?)\.{2,3}(.+)$/);
+    const [base, head] = m ? [m[1], m[2]] : ["", ""];
+    if (!base || !head || base.endsWith(".") || head.startsWith(".")) {
       process.stderr.write(`tamperward: invalid --diff range "${opts.diff}" (expected <base>...<head>)
 `);
       return 2;
     }
     changes = diffRange(base, head, { cwd: opts.cwd });
+    if (changes.length === 0) {
+      process.stderr.write(
+        `tamperward: note: the range ${base}...${head} contains no changes \u2014 if this is not an empty pull request, check that the range resolves to the intended commits
+`
+      );
+    }
     layer = "ci";
     view = "range";
     policy = opts.policyOverride ?? loadPolicyAt(mergeBaseOf(base, head, { cwd: opts.cwd }), opts.cwd) ?? defaultPolicy();
@@ -2283,7 +2481,7 @@ import { createHash as createHash4 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync4, existsSync as existsSync3, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute, join as join4, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, relative, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -2299,7 +2497,7 @@ function abs(path, cwd) {
 }
 function relForDisplay(path, cwd) {
   const rel = relative(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -2443,7 +2641,7 @@ function advanceTurnBaseline(cwd, sessionId) {
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join6 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -2455,7 +2653,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute2(d) ? d : join6(cwd, d);
+    return isAbsolute3(d) ? d : join6(cwd, d);
   } catch {
     return null;
   }
@@ -2535,7 +2733,7 @@ function savePtree(cwd, sessionId, tree) {
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2, watch } from "node:fs";
 import { join as join7 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
-var SKIP = /(^|\/)(\.git|node_modules)(\/|$)/;
+var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
   try {
     const st = statSync2(abs2);
@@ -2562,7 +2760,7 @@ function watchTree(dir, cb) {
   }
   const watchers = /* @__PURE__ */ new Map();
   const addDir = (rel) => {
-    if (watchers.has(rel) || SKIP.test(rel + "/")) return;
+    if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
       w = watch(rel ? join7(dir, rel) : dir, (kind, fname) => {
@@ -2589,7 +2787,7 @@ function watchTree(dir, cb) {
     }
     for (const name of names) {
       const child = rel ? `${rel}/${name}` : name;
-      if (SKIP.test(child + "/")) continue;
+      if (SKIP2.test(child + "/")) continue;
       try {
         if (statSync2(join7(dir, child)).isDirectory()) walk(child);
       } catch {
@@ -2608,7 +2806,7 @@ function startWatcher(dir, log, policy) {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
-    if (SKIP.test(rel) || !isProtected(rel, policy)) return;
+    if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
     const s = snap(join7(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
@@ -2972,9 +3170,18 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute4, join as join8, relative as relative2, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
+var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function gitConfig(cwd, key2) {
+  try {
+    return execFileSync4("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+  } catch {
+    return null;
+  }
+}
 var PRE_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit";
 var MARKER = "# tamperward: block agent shortcuts before they land";
 var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
@@ -2987,25 +3194,28 @@ function coveredBy(existing, critical) {
   for (const line of existing.split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#")) continue;
-    const pattern = t.split(/\s+/)[0];
-    if (!t.slice(pattern.length).trim()) continue;
-    if (pattern === "*" || pattern === critical) return true;
-    if (pattern.endsWith("/") && critical.startsWith(pattern)) return true;
+    const raw = t.split(/\s+/)[0];
+    if (!t.slice(raw.length).trim()) continue;
+    if (raw === "*" || raw === "**") return true;
+    const pattern = raw.replace(/\/\*{1,2}$/, "/");
+    if (pattern.includes("*")) continue;
+    const anchored = pattern.startsWith("/") ? pattern : "/" + pattern;
+    if (anchored === critical) return true;
+    if (anchored.endsWith("/") && critical.startsWith(anchored)) return true;
+    if (!pattern.startsWith("/")) {
+      if (critical.endsWith("/" + pattern)) return true;
+      if (pattern.endsWith("/") && critical.includes("/" + pattern)) return true;
+    }
   }
   return false;
 }
 function inferOwner(cwd) {
-  try {
-    const url = execFileSync4("git", ["remote", "get-url", "origin"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    const m = url.match(/github\.com[:/]+([^/]+)\//);
-    return m ? `@${m[1]}` : null;
-  } catch {
-    return null;
-  }
+  const url = gitConfig(cwd, "remote.origin.url");
+  const m = url?.match(/github\.com[:/]+([^/]+)\//);
+  if (!m) return null;
+  const segment = m[1];
+  const self = [gitConfig(cwd, "github.user"), gitConfig(cwd, "user.name")].filter((v) => v !== null);
+  return { owner: `@${segment}`, confirmed: self.some((v) => v.toLowerCase() === segment.toLowerCase()) };
 }
 var POLICY_CONTENT = `# Tamperward policy. The BASELINE (all rules, standard protected globs) applies even
 # without this file \u2014 everything here is an override, so an empty file changes nothing.
@@ -3143,9 +3353,31 @@ function missingTools(matcher2) {
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
+function hooksShapeError(hooks) {
+  if (hooks === void 0 || hooks === null) return null;
+  if (!isPlainObject(hooks)) return "hooks is not an object";
+  for (const [event, arr] of Object.entries(hooks)) {
+    if (arr === void 0 || arr === null) continue;
+    if (!Array.isArray(arr)) return `hooks.${event} is not a list`;
+    for (const m of arr) {
+      if (!isPlainObject(m)) return `hooks.${event} contains an entry that is not an object`;
+      if (m.hooks !== void 0 && m.hooks !== null && !(Array.isArray(m.hooks) && m.hooks.every(isPlainObject))) {
+        return `hooks.${event} has a "hooks" value that is not a list of { type, command }`;
+      }
+    }
+  }
+  return null;
+}
 function planPolicy(cwd) {
   const path = join8(cwd, POLICY_FILE);
-  if (existsSync7(path)) return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present \u2014 left untouched" };
+  if (existsSync7(path)) {
+    try {
+      loadPolicy(cwd);
+    } catch (e) {
+      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText2(e)}; fix it, then re-run init (left untouched)` };
+    }
+    return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present and loads \u2014 left untouched" };
+  }
   return {
     item: "policy",
     path: POLICY_FILE,
@@ -3175,6 +3407,10 @@ function planClaudeHooks(cwd) {
     }
     settings = parsed;
   }
+  const shapeError = hooksShapeError(settings.hooks);
+  if (shapeError) {
+    return { item: "agent", path: rel, status: "error", detail: `${shapeError} \u2014 fix it, then re-run init (refusing to overwrite)` };
+  }
   const hooks = settings.hooks ??= {};
   const entriesWith = (arr, needle) => (arr ?? []).filter((m) => (m.hooks ?? []).some((h) => needle.test(String(h.command ?? ""))));
   const preEntries = entriesWith(hooks.PreToolUse, HOOK_RE);
@@ -3220,47 +3456,170 @@ function planClaudeHooks(cwd) {
     }
   };
 }
+var MANAGED_HOOKS = [
+  {
+    name: "lefthook",
+    configs: ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml", "lefthook-local.yml", "lefthook-local.yaml"],
+    hookRe: /\blefthook\b/i,
+    hint: `add this under \`pre-commit:\` \u2192 \`commands:\` in lefthook.yml:
+        tamperward:
+          run: ${PRECOMMIT_CMD}`
+  },
+  {
+    name: "pre-commit",
+    configs: [".pre-commit-config.yaml", ".pre-commit-config.yml"],
+    hookRe: /pre-commit\.com|File generated by pre-commit/i,
+    hint: `add this under \`repos:\` in .pre-commit-config.yaml:
+        - repo: local
+          hooks:
+            - id: tamperward
+              name: tamperward
+              entry: ${PRECOMMIT_CMD}
+              language: system
+              pass_filenames: false
+              always_run: true`
+  }
+];
+function hooksDir(cwd) {
+  try {
+    const out2 = execFileSync4("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    if (out2) return resolve2(cwd, out2);
+  } catch {
+  }
+  return existsSync7(join8(cwd, ".git")) ? join8(cwd, ".git", "hooks") : null;
+}
+function display(cwd, path) {
+  const rel = relative2(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : path;
+}
+function unconditionalExitAt(lines) {
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (!t || t.startsWith("#")) continue;
+    if (depth === 0) {
+      if (/^exit(\s|$|;)/.test(t)) return i;
+      const exec = t.match(/^exec(?:\s+(.*))?$/);
+      if (exec && exec[1] && !/^(\d*[<>]|&>)/.test(exec[1])) return i;
+    }
+    const opens = (t.match(/(?:^|[;(]\s*|&&\s*|\|\|\s*)(?:if|case|for|while|until)\s/g) ?? []).length + (/(?:^|\s)\{\s*$/.test(t) ? 1 : 0);
+    const closes = (t.match(/(?:^|[;]\s*)(?:fi|esac|done)(?:\s|;|$)/g) ?? []).length + (/^\}/.test(t) ? 1 : 0);
+    depth = Math.max(0, depth + opens - closes);
+  }
+  return -1;
+}
 function planPreCommit(cwd) {
-  const line = `${MARKER}
-${PRECOMMIT_CMD}
-`;
-  const husky = join8(cwd, ".husky");
-  const gitDir3 = join8(cwd, ".git");
-  const target = existsSync7(husky) ? { rel: ".husky/pre-commit", note: "husky" } : existsSync7(gitDir3) ? { rel: ".git/hooks/pre-commit", note: "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" } : null;
-  if (!target) return { item: "pre-commit", path: "(none)", status: "skip", detail: "not a git repo and no .husky/ \u2014 nothing to wire" };
-  const path = join8(cwd, target.rel);
+  const block = [MARKER, PRECOMMIT_CMD];
+  const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
+  let path;
+  let note;
+  if (existsSync7(join8(cwd, ".husky"))) {
+    path = join8(cwd, ".husky", "pre-commit");
+    note = "husky";
+  } else {
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join8(cwd, c))));
+    if (managed) {
+      return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
+    }
+    const dir = hooksDir(cwd);
+    if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
+    if (basename(dir) === "_" && basename(dirname3(dir)) === ".husky") {
+      path = join8(dirname3(dir), "pre-commit");
+      note = "husky";
+    } else {
+      path = join8(dir, "pre-commit");
+      const rel2 = display(cwd, dir);
+      note = rel2 === join8(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+    }
+  }
+  const rel = display(cwd, path);
+  if (existsSync7(path) && !statSync5(path).isFile()) {
+    return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
+  }
   const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
-  if (existing !== null && PRECOMMIT_RE.test(existing)) {
-    const lines = existing.split("\n");
-    const staleAt = lines.findIndex((l) => PRECOMMIT_RE.test(l) && stalePin(l));
-    if (staleAt === -1) {
-      return { item: "pre-commit", path: target.rel, status: "ok", detail: "already runs the staged check" };
+  if (existing === null) {
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "create",
+      detail: `create via ${note}`,
+      apply: () => {
+        mkdirSync5(dirname3(path), { recursive: true });
+        writeFileSync5(path, `#!/bin/sh
+${block.join("\n")}
+`);
+        chmodSync(path, 493);
+      }
+    };
+  }
+  const owner = MANAGED_HOOKS.find((m) => m.hookRe.test(existing));
+  if (owner) {
+    return { item: "pre-commit", path: rel, status: "skip", detail: `generated by ${owner.name}, which overwrites it on install \u2014 ${owner.hint}` };
+  }
+  const lines = existing.split("\n");
+  const dead = unconditionalExitAt(lines);
+  const at = lines.findIndex((l) => PRECOMMIT_RE.test(l));
+  const write = (out2) => {
+    writeFileSync5(path, out2.join("\n"));
+    chmodSync(path, 493);
+  };
+  if (at !== -1 && (dead === -1 || at < dead)) {
+    if (!stalePin(lines[at])) {
+      return { item: "pre-commit", path: rel, status: "ok", detail: "already runs the staged check" };
     }
-    const was = pinOf(lines[staleAt]) || "unpinned";
+    const was = pinOf(lines[at]) || "unpinned";
     return {
       item: "pre-commit",
-      path: target.rel,
+      path: rel,
       status: "update",
       detail: `re-pin the staged check to tamperward@${TW_VERSION} (was ${was})`,
       apply: () => {
-        lines[staleAt] = PRECOMMIT_CMD;
-        writeFileSync5(path, lines.join("\n"));
-        chmodSync(path, 493);
+        lines[at] = PRECOMMIT_CMD;
+        write(lines);
+      }
+    };
+  }
+  if (at !== -1) {
+    const ours = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
+    if (!ours) {
+      return {
+        item: "pre-commit",
+        path: rel,
+        status: "error",
+        detail: `the staged check on line ${at + 1} never runs: line ${dead + 1} (\`${lines[dead].trim()}\`) ends the script first \u2014 move the tamperward line above it`
+      };
+    }
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "update",
+      detail: `move the staged check above line ${dead + 1} (\`${lines[dead].trim()}\`), which ended the script before it ran`,
+      apply: () => {
+        const out2 = lines.filter((_, i) => i !== at && i !== at - 1);
+        out2.splice(dead, 0, ...block);
+        write(out2);
+      }
+    };
+  }
+  if (dead !== -1) {
+    return {
+      item: "pre-commit",
+      path: rel,
+      status: "update",
+      detail: `insert the staged check above line ${dead + 1} (\`${lines[dead].trim()}\`), which ends the script \u2014 ${note}`,
+      apply: () => {
+        const out2 = [...lines];
+        out2.splice(dead, 0, ...block);
+        write(out2);
       }
     };
   }
   return {
     item: "pre-commit",
-    path: target.rel,
-    status: existing === null ? "create" : "update",
-    detail: existing === null ? `create via ${target.note}` : `append the staged check (${target.note})`,
-    apply: () => {
-      mkdirSync5(dirname3(path), { recursive: true });
-      const content = existing === null ? `#!/bin/sh
-${line}` : existing.replace(/\n?$/, "\n") + line;
-      writeFileSync5(path, content);
-      chmodSync(path, 493);
-    }
+    path: rel,
+    status: "update",
+    detail: `append the staged check (${note})`,
+    apply: () => write([...existing.replace(/\n?$/, "\n").split("\n").slice(0, -1), ...block, ""])
   };
 }
 function planCodeowners(cwd) {
@@ -3274,18 +3633,26 @@ function planCodeowners(cwd) {
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
   }
-  const owner = inferOwner(cwd);
+  const inferred = inferOwner(cwd);
+  const owner = inferred?.owner ?? null;
+  const unconfirmed = inferred !== null && !inferred.confirmed;
   const block = `
 ${CODEOWNERS_MARK}
 # A pull request that rewrites the workflow can keep the job name, replace the
 # gate with \`true\`, and still report a green required check. Only a human
 # requirement on these paths prevents that.
-` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
+` + (owner === null ? "# REPLACE @OWNER BELOW with a real user or team \u2014 an unresolvable owner protects nothing.\n" : unconfirmed ? `# TODO: replace ${owner} with ${owner}/<team> if "${owner.slice(1)}" is an organisation. GitHub
+# rejects a bare organisation as an owner, and a rule with an invalid owner protects
+# nothing. A user login is fine as written.
+` : "") + missing.map((p) => `${p.padEnd(24)} ${owner ?? "@OWNER"}`).join("\n") + "\n";
   return {
     item: "codeowners",
     path: existingRel ?? rel,
     status: existing === null ? "create" : "update",
-    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner})`),
+    detail: (existing === null ? "require a code owner on " : "add missing code-owner rules for ") + missing.join(", ") + (owner === null ? " \u2014 OWNER UNKNOWN, edit @OWNER before this does anything" : ` (${owner}${unconfirmed ? ", unconfirmed \u2014 see warning below" : ""})`),
+    ...inferred && unconfirmed ? {
+      warning: `${inferred.owner} was inferred from the origin remote and is not confirmed to be a user. If "${inferred.owner.slice(1)}" is an organisation, replace it with ${inferred.owner}/<team> in CODEOWNERS: GitHub rejects a bare organisation as an owner, and a rule with an invalid owner protects nothing.`
+    } : {},
     apply: () => {
       mkdirSync5(dirname3(path), { recursive: true });
       writeFileSync5(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block);
@@ -3344,21 +3711,49 @@ function planWorkflow(cwd, force) {
     detail: (mark ? `edited since tamperward v${mark.version} generated it` : "present but not generated by tamperward") + ` \u2014 left untouched. Compare it against the v${TW_VERSION} template (an older one may lack the pristine-verify step) and re-run with --force-workflow to replace it.`
   };
 }
+function planned(item, path, plan) {
+  try {
+    return plan();
+  } catch (e) {
+    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText2(e)}` };
+  }
+}
 function planInit(cwd, opts = {}) {
-  return [planPolicy(cwd), planClaudeHooks(cwd), planPreCommit(cwd), planWorkflow(cwd, opts.forceWorkflow ?? false), planCodeowners(cwd)];
+  return [
+    planned("policy", POLICY_FILE, () => planPolicy(cwd)),
+    planned("agent", ".claude/settings.json", () => planClaudeHooks(cwd)),
+    planned("pre-commit", "(hooks)", () => planPreCommit(cwd)),
+    planned("ci", ".github/workflows/tamperward.yml", () => planWorkflow(cwd, opts.forceWorkflow ?? false)),
+    planned("codeowners", ".github/CODEOWNERS", () => planCodeowners(cwd))
+  ];
 }
 function runInit(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const plan = planInit(cwd, { forceWorkflow: opts.forceWorkflow });
   const w = process.stdout;
+  let applied = 0;
   for (const a of plan) {
+    if (!opts.dryRun && a.apply) {
+      try {
+        a.apply();
+        applied++;
+      } catch (e) {
+        a.status = "error";
+        a.detail = `could not be written \u2014 ${errText2(e)}`;
+        a.apply = void 0;
+      }
+    }
     const verb = opts.dryRun && (a.status === "create" || a.status === "update") ? `would ${a.status}` : a.status;
     w.write(`  ${a.item.padEnd(10)} ${verb.padEnd(12)} ${a.path}  \u2014 ${a.detail}
 `);
-    if (!opts.dryRun && a.apply) a.apply();
+  }
+  for (const a of plan) {
+    if (a.warning) w.write(`
+WARNING (${a.item}): ${a.warning}
+`);
   }
   const errors = plan.filter((a) => a.status === "error");
-  const changed = plan.filter((a) => a.apply).length;
+  const changed = opts.dryRun ? plan.filter((a) => a.apply).length : applied;
   if (errors.length) {
     w.write(`
 tamperward init: ${errors.length} item(s) need your attention above; the rest ${opts.dryRun ? "are planned" : "were applied"}.
@@ -3381,15 +3776,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync6, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join11, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, join as join11, resolve as resolve3 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join9 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join9 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -3402,7 +3797,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute3(d) ? d : join9(cwd, d);
+    return isAbsolute5(d) ? d : join9(cwd, d);
   } catch {
     return null;
   }
@@ -3440,7 +3835,7 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync5 } from "node:fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync6 } from "node:fs";
 import { join as join10 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
@@ -3479,7 +3874,7 @@ function depsFingerprint(cwd) {
         h.update(p);
         try {
           h.update(readFileSync12(p));
-          h.update(String(statSync5(p).mode));
+          h.update(String(statSync6(p).mode));
         } catch {
           h.update("<unreadable>");
         }
@@ -3494,7 +3889,7 @@ function depsFingerprint(cwd) {
     }
   };
   try {
-    if (!statSync5(root).isDirectory()) return "none";
+    if (!statSync6(root).isDirectory()) return "none";
   } catch {
     return "none";
   }
@@ -3552,7 +3947,7 @@ function materialize(cwd, dest) {
     const src = join11(cwd, rel);
     let st;
     try {
-      st = statSync6(src);
+      st = statSync7(src);
     } catch {
       continue;
     }
@@ -3567,7 +3962,7 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve2(cwd, "node_modules");
+  const nm = resolve3(cwd, "node_modules");
   if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
@@ -3583,9 +3978,9 @@ function verifierInputs(cmd, atBase, policy) {
     const tok = raw.replace(/^['"]|['"]$/g, "").replace(/^\.\//, "");
     if (tok && baseFiles.has(tok)) picked.add(tok);
   }
-  const globs = policy.verify?.inputs;
-  if (globs && globs.length) {
-    for (const rel of atBase) if (matchesAny(rel, globs)) picked.add(rel);
+  const globs2 = policy.verify?.inputs;
+  if (globs2 && globs2.length) {
+    for (const rel of atBase) if (matchesAny(rel, globs2)) picked.add(rel);
   }
   return picked;
 }
@@ -3857,7 +4252,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -3904,7 +4299,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const cwd = resolve4(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -4041,7 +4436,7 @@ function parseRun(args) {
   return o;
 }
 
-// src/cli/index.ts
+// src/cli/main.ts
 function parseAllow(args) {
   const o = {};
   for (let i = 0; i < args.length; i++) {
@@ -4149,9 +4544,11 @@ Formats:
 Exit codes: 0 clean \xB7 1 a blocking finding (check), MASKED_FAILURE or SUITE_RED
             (verify), any blocking finding or masked failure (run) \xB7 2 cannot
             evaluate, failing closed: policy error, bad --diff range, no view,
-            unresolvable base, --require-ancestor refused, budget exceeded.
-            hook/sweep \u2192 0 with a deny emitted as JSON on stdout (exit 2 would make
-            Claude Code ignore the JSON); 2 only for an unsupported agent name.
+            not a git repository, unresolvable base or revision, --require-ancestor
+            refused, budget exceeded \u2014 always one line on stderr, never a stack
+            trace. hook/sweep \u2192 0 with a deny emitted as JSON on stdout (exit 2
+            would make Claude Code ignore the JSON); 2 only for an unsupported
+            agent name.
 `);
 }
 function main(argv2) {
@@ -4183,9 +4580,21 @@ function main(argv2) {
       return 2;
   }
 }
+function guardedMain(argv2, stderr = process.stderr) {
+  try {
+    return main(argv2);
+  } catch (e) {
+    const first = (e instanceof Error ? e.message : String(e)).split("\n").map((l) => l.trim()).find(Boolean) ?? "";
+    stderr.write(`tamperward: ${first || "unexpected failure"}
+`);
+    return 2;
+  }
+}
+
+// src/cli/index.ts
 var argv = process.argv.slice(2);
 if (argv[0] === "watch") {
   runWatch(argv.slice(1));
 } else {
-  process.exit(main(argv));
+  process.exit(guardedMain(argv));
 }