tamperward 2.10.0 → 2.10.2

package/dist/cli/index.js

@@ -153,6 +153,18 @@ function defaultPolicy(version = 1) {
         // as a strengthening). pyproject.toml carries [tool.coverage.report].
         "**/.coveragerc",
         "**/pyproject.toml",
+        // pytest's selection configuration. These decide WHICH TESTS RUN, so a
+        // narrowing in them removes a test as surely as deleting the file. The
+        // pristine boundary already refused to inherit them (verify's
+        // VERIFICATION_SURFACE, 1.14.2); this is the in-loop half, so the gate can
+        // say so at the tool call instead of only at adjudication. `tox.ini` and
+        // `setup.cfg` are shared files — the suite-config detector only treats them
+        // as pytest configs when they carry the section pytest reads, so ordinary
+        // packaging edits are untouched.
+        "**/pytest.ini",
+        "**/.pytest.ini",
+        "**/tox.ini",
+        "**/setup.cfg",
         "**/.nycrc",
         "**/.nycrc.*",
         "**/nyc.config.*",
@@ -1334,6 +1346,8 @@ import ts2 from "typescript";
 
 // src/detectors/repo.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join as join2 } from "node:path";
 var cache = /* @__PURE__ */ new Map();
 function trackedFiles(ctx) {
   if (!ctx) return null;
@@ -1355,6 +1369,23 @@ function trackedFiles(ctx) {
   cache.set(ctx.cwd, files);
   return files;
 }
+var contentCache = /* @__PURE__ */ new Map();
+function trackedContent(path, ctx) {
+  if (!ctx) return null;
+  if (ctx.trackedContents) return ctx.trackedContents[path] ?? null;
+  if (!ctx.cwd) return null;
+  const key2 = ctx.cwd + "\0" + path;
+  const hit = contentCache.get(key2);
+  if (hit !== void 0) return hit;
+  let src = null;
+  try {
+    src = readFileSync(join2(ctx.cwd, path), "utf8");
+  } catch {
+    src = null;
+  }
+  contentCache.set(key2, src);
+  return src;
+}
 var branchCache = /* @__PURE__ */ new Map();
 var refsCache = /* @__PURE__ */ new Map();
 function branchRefs(ctx) {
@@ -2660,20 +2691,20 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join3, relative } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join4, relative } from "node:path";
 
 // src/wiring.ts
-import { readFileSync, realpathSync as realpathSync2 } from "node:fs";
+import { readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join as join2, posix } from "node:path";
+import { basename, dirname, isAbsolute, join as join3, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync(join2(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync2(join3(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4551,8 +4582,8 @@ function lefthookBase(c, changes, ctx) {
   if (!ctx?.cwd) return null;
   for (const n of names) {
     try {
-      const p = join3(ctx.cwd, n);
-      if (existsSync2(p)) return parseDoc(readFileSync2(p, "utf8"));
+      const p = join4(ctx.cwd, n);
+      if (existsSync2(p)) return parseDoc(readFileSync3(p, "utf8"));
     } catch {
     }
   }
@@ -4626,6 +4657,61 @@ function repoRelative(path, ctx) {
   const rel = relative(ctx.cwd, path);
   return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
+var HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
+var HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
+var HUSKY_H_KNOWN = [
+  // husky 9.1.x
+  `#!/usr/bin/env sh
+[ "$HUSKY" = "2" ] && set -x
+n=$(basename "$0")
+s=$(dirname "$(dirname "$0")")/$n
+
+[ ! -f "$s" ] && exit 0
+
+if [ -f "$HOME/.huskyrc" ]; then
+	echo "husky - '~/.huskyrc' is DEPRECATED, please move your code to ~/.config/husky/init.sh"
+fi
+i="\${XDG_CONFIG_HOME:-$HOME/.config}/husky/init.sh"
+[ -f "$i" ] && . "$i"
+
+[ "\${HUSKY-}" = "0" ] && exit 0
+
+export PATH="node_modules/.bin:$PATH"
+sh -e "$s" "$@"
+c=$?
+
+[ $c != 0 ] && echo "husky - $n script failed (code $c)"
+[ $c = 127 ] && echo "husky - command not found in PATH=$PATH"
+exit $c
+`
+];
+var HUSKY_DEPRECATION = `echo "husky - DEPRECATED
+
+Please remove the following two lines from $0:
+
+#!/usr/bin/env sh
+. \\"\\$(dirname -- \\"\\$0\\")/_/husky.sh\\"
+
+They WILL FAIL in v10.0.0
+"`;
+var stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
+function huskyRuntimeWrite(path, content, ctx) {
+  const m = path.match(/(?:^|\/)\.husky\/_\/([^/]+)$/);
+  if (!m || content == null) return false;
+  const name = m[1];
+  const body = stripTrailingNl(content);
+  const ok = name === ".gitignore" ? body === "*" : name === "h" ? HUSKY_H_KNOWN.some((t) => stripTrailingNl(t) === body) : name === "husky.sh" ? stripTrailingNl(HUSKY_DEPRECATION) === body : HUSKY_SHIM_NAMES.has(name) && body === HUSKY_SHIM;
+  if (!ok) return false;
+  if (!ctx?.cwd) return false;
+  const root = path.slice(0, path.length - m[0].length + (m[0].startsWith("/") ? 1 : 0));
+  const entry = inspectRel(join4(ctx.cwd, root), ".husky/pre-commit");
+  if (entry.kind !== "file") return false;
+  const gate = textOf(entry);
+  if (gate == null) return false;
+  return invocations(gate.split("\n"), { errexit: true }).some(
+    (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
+  );
+}
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
 var isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
 var hookTampering = {
@@ -4700,6 +4786,7 @@ var hookTampering = {
         } else if ((isLefthook(c.path) || isPreCommitConfig(c.path)) && (semantic = configFindings(c, changes, policy, ctx)) !== null) {
           out2.push(...semantic);
         } else if (!c.path.endsWith(POLICY_FILE)) {
+          if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
           const husky = isHuskyScript(c.path);
           const opts = husky ? { errexit: true } : {};
           const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;
@@ -4897,6 +4984,8 @@ import ts3 from "typescript";
 var JEST_DEFAULT_MATCH = ["**/__tests__/**/*.[jt]s?(x)", "**/?(*.)+(spec|test).[jt]s?(x)"];
 var JEST_DEFAULT_IGNORE = ["/node_modules/"];
 var VITEST_DEFAULT_INCLUDE = ["**/*.{test,spec}.?(c|m)[jt]s?(x)"];
+var PYTEST_DEFAULT_INCLUDE = ["**/test_*.py", "**/*_test.py"];
+var PYTEST_DEFAULT_IGNORE = ["**/build/**", "**/dist/**", "**/node_modules/**", "**/venv/**", "**/.*/**"];
 var VITEST_DEFAULT_EXCLUDE = [
   "**/node_modules/**",
   "**/dist/**",
@@ -4914,6 +5003,13 @@ var CANONICAL_SAMPLES = [
   "a.spec.js",
   "test/a.test.mjs"
 ];
+var PYTEST_CANONICAL_SAMPLES = [
+  "tests/test_a.py",
+  "tests/a_test.py",
+  "test_a.py",
+  "src/tests/test_a.py",
+  "tests/conftest.py"
+];
 function keyName2(name) {
   if (ts3.isIdentifier(name) || ts3.isStringLiteral(name)) return name.text;
   return null;
@@ -4948,8 +5044,104 @@ function runnerOf(path, content) {
   if (/^jest\.config\./.test(base) || base === "package.json") return "jest";
   if (/^vitest\.(?:config|workspace)\./.test(base)) return "vitest";
   if (/^vite\.config\./.test(base) && content != null && /(?:^|[\s,{])["']?test["']?\s*:/m.test(content)) return "vitest";
+  if (base === "pytest.ini" || base === ".pytest.ini") return "pytest";
+  if (content == null) return null;
+  if (base === "tox.ini" && /^\s*\[pytest\]/m.test(content)) return "pytest";
+  if (base === "setup.cfg" && /^\s*\[tool:pytest\]/m.test(content)) return "pytest";
+  if (base === "pyproject.toml" && /^\s*\[tool\.pytest\.ini_options\]/m.test(content)) return "pytest";
+  return null;
+}
+var PYTEST_INI_ORDER = ["pytest.ini", ".pytest.ini", "pyproject.toml", "tox.ini", "setup.cfg"];
+function claimsPytest(name, src) {
+  if (name === "pytest.ini" || name === ".pytest.ini") return true;
+  const section = name === "pyproject.toml" ? /^\s*\[tool\.pytest\.ini_options\]\s*$/m : name === "tox.ini" ? /^\s*\[pytest\]\s*$/m : name === "setup.cfg" ? /^\s*\[tool:pytest\]\s*$/m : null;
+  return section !== null && section.test(src);
+}
+function effectivePytestFile(files) {
+  for (const name of PYTEST_INI_ORDER) {
+    const content = files.get(name);
+    if (content == null) continue;
+    if (claimsPytest(name, content)) return { path: name, content };
+  }
   return null;
 }
+function effectivePytestConfig(path, ctx) {
+  if (path.includes("/")) return false;
+  const base = path;
+  const ORDER = PYTEST_INI_ORDER;
+  const rank = ORDER.indexOf(base);
+  if (rank < 0) return false;
+  const files = ctx?.trackedFiles;
+  if (!files) return true;
+  const rootNames = new Set(files.filter((f) => !f.includes("/")));
+  return !ORDER.slice(0, rank).some((n) => rootNames.has(n));
+}
+function pytestBlock(src) {
+  const lines = src.split(/\r?\n/);
+  const head = /^\s*\[(pytest|tool:pytest|tool\.pytest\.ini_options)\]\s*$/;
+  let i = lines.findIndex((l) => head.test(l));
+  if (i < 0) return null;
+  const out2 = {};
+  let key2 = null;
+  for (i += 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\s*\[/.test(line)) break;
+    if (/^\s*[#;]/.test(line) || !line.trim()) {
+      continue;
+    }
+    const m = line.match(/^(\w[\w.-]*)\s*[=:]\s*(.*)$/);
+    if (m) {
+      key2 = m[1];
+      out2[key2] = m[2].trim();
+      continue;
+    }
+    if (key2 && /^\s+\S/.test(line)) out2[key2] += " " + line.trim();
+  }
+  return out2;
+}
+function pytestTokens(raw) {
+  const v = raw.trim();
+  if (v.startsWith("[")) {
+    return [...v.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+  }
+  const unq2 = v.replace(/^"([\s\S]*)"$/, "$1").replace(/^'([\s\S]*)'$/, "$1");
+  return [...unq2.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "").filter(Boolean);
+}
+var pathGlobs = (p) => {
+  const clean = p.replace(/^\.\//, "").replace(/::.*$/, "").replace(/\/+$/, "");
+  return clean ? [clean, clean + "/**"] : [];
+};
+function pytestSelection(src) {
+  const sel = empty();
+  const blk = pytestBlock(src);
+  if (!blk) return sel;
+  sel.present = true;
+  const ignore = blk.norecursedirs !== void 0 ? pytestTokens(blk.norecursedirs).flatMap((d) => pathGlobs(d).map((pattern) => ({ pattern, key: "norecursedirs" }))) : PYTEST_DEFAULT_IGNORE.map((pattern) => ({ pattern, key: "norecursedirs" }));
+  if (blk.testpaths !== void 0) sel.roots = pytestTokens(blk.testpaths).map((t) => t.replace(/^\.\//, ""));
+  if (blk.python_files !== void 0) sel.include = pytestTokens(blk.python_files).map((g) => g.includes("/") ? g : "**/" + g);
+  for (const key2 of ["python_classes", "python_functions"]) {
+    if (blk[key2] !== void 0) ignore.push({ pattern: "\0" + key2, key: key2 });
+  }
+  const opts = blk.addopts !== void 0 ? pytestTokens(blk.addopts) : [];
+  for (let j = 0; j < opts.length; j++) {
+    const o = opts[j];
+    const val = (inline) => o.includes("=") ? o.slice(o.indexOf("=") + 1) : opts[++j] ?? inline;
+    if (o === "--ignore" || o.startsWith("--ignore=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--ignore" });
+    else if (o === "--ignore-glob" || o.startsWith("--ignore-glob=")) {
+      const g = val("");
+      ignore.push({ pattern: g, key: "--ignore-glob" });
+      if (!g.startsWith("**/") && !g.startsWith("/")) ignore.push({ pattern: "**/" + g, key: "--ignore-glob" });
+    } else if (o === "--deselect" || o.startsWith("--deselect=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--deselect" });
+    else if (o === "-k" || o.startsWith("-k=")) {
+      for (const w of (val("").match(/\bnot\s+([A-Za-z_][\w]*)/g) ?? []).map((t) => t.replace(/^not\s+/, "")))
+        ignore.push({ pattern: `**/*${w}*`, key: "-k" });
+    } else if (o === "-m" || o.startsWith("-m=")) {
+      ignore.push({ pattern: "\0-m " + val(""), key: "-m" });
+    } else if (o === "--collect-only" || o === "--co") ignore.push({ pattern: "**", key: o });
+  }
+  sel.ignore = ignore;
+  return sel;
+}
 var isWorkspaceFile = (path) => /^vitest\.workspace\./.test(path.split("/").pop() ?? path);
 var empty = () => ({ include: null, regex: null, ignore: null, roots: null, base: null, projects: null, opaque: false, present: false });
 var stripRootDir = (g) => g.replace(/^<rootDir>\/?/, "");
@@ -5098,6 +5290,7 @@ function workspaceArray(sf) {
 }
 function parseSelection(src, runner, path = "") {
   let sel = empty();
+  if (runner === "pytest") return pytestSelection(src);
   try {
     const sf = ts3.createSourceFile("cfg.ts", asExpression2(src), ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TS);
     if (runner === "vitest" && isWorkspaceFile(path)) {
@@ -5146,10 +5339,14 @@ function predicate(sel, runner) {
       why: (p) => ps.length ? `no project selects it (${ps[0].why(p)})` : "the projects list is empty"
     };
   }
-  const includeList = sel.include ?? (runner === "jest" ? sel.regex ? null : JEST_DEFAULT_MATCH : VITEST_DEFAULT_INCLUDE);
-  const ignoreList = sel.ignore ?? (runner === "jest" ? JEST_DEFAULT_IGNORE : VITEST_DEFAULT_EXCLUDE).map((pattern) => ({ pattern, key: runner === "jest" ? "testPathIgnorePatterns" : "test.exclude" }));
+  const includeList = sel.include ?? (runner === "jest" ? sel.regex ? null : JEST_DEFAULT_MATCH : runner === "pytest" ? PYTEST_DEFAULT_INCLUDE : VITEST_DEFAULT_INCLUDE);
+  const ignoreList = sel.ignore ?? (runner === "jest" ? JEST_DEFAULT_IGNORE : runner === "pytest" ? PYTEST_DEFAULT_IGNORE : VITEST_DEFAULT_EXCLUDE).map((pattern) => ({
+    pattern,
+    key: runner === "jest" ? "testPathIgnorePatterns" : runner === "pytest" ? "norecursedirs" : "test.exclude"
+  }));
+  const blockWide = ignoreList.filter((e) => e.pattern.startsWith("\0"));
   const included = includeList ? globList2(includeList) : sel.regex ? regexes(sel.regex) : () => true;
-  const ignoredBy = (p) => ignoreList.find((e) => (runner === "jest" ? regexes([e.pattern]) : globs3([e.pattern]))(p));
+  const ignoredBy = (p) => blockWide[0] ?? ignoreList.filter((e) => !e.pattern.startsWith("\0")).find((e) => (runner === "jest" ? regexes([e.pattern]) : globs3([e.pattern]))(p));
   const roots = sel.roots?.map((r) => r.replace(/^\.\//, "").replace(/\/+$/, "")).map((r) => r === "." ? "" : r) ?? null;
   const rebase = (p) => sel.base === null ? p : underDir(p, sel.base) ? p.slice(sel.base.length + 1) : null;
   const inRoots = (p) => roots === null || roots.some((r) => underDir(p, r));
@@ -5164,7 +5361,10 @@ function predicate(sel, runner) {
       if (r === null) return `${baseKey} no longer covers it (${JSON.stringify(sel.base)})`;
       if (!inRoots(r)) return `roots no longer covers it (${JSON.stringify(sel.roots)})`;
       const hit = ignoredBy(r);
-      if (hit) return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(hit.pattern)})`;
+      if (hit) {
+        const pat = hit.pattern.startsWith("\0") ? hit.pattern.slice(1) : hit.pattern;
+        return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(pat)})`;
+      }
       const key2 = runner === "jest" ? sel.include ? "testMatch" : sel.regex ? "testRegex" : "testMatch (default)" : sel.include ? "test.include" : "test.include (default)";
       return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? includeList ?? [])})`;
     }
@@ -5314,12 +5514,14 @@ function significantLines(src, path) {
   return out2;
 }
 var OTHER_RUNNER_DIR = /(?:^|\/)(?:e2e|cypress|playwright|fixtures|__fixtures__|__mocks__)\//;
-function runnerSamples(configPath, policy, ctx) {
+function runnerSamples(configPath, policy, ctx, runner) {
+  const lang = runner === "pytest" ? "py" : "js";
+  const fallback = runner === "pytest" ? PYTEST_CANONICAL_SAMPLES : CANONICAL_SAMPLES;
   const files = trackedFiles(ctx);
-  if (!files) return CANONICAL_SAMPLES;
+  if (!files) return fallback;
   const root = configPath.includes("/") ? configPath.slice(0, configPath.lastIndexOf("/") + 1) : "";
-  const own = files.filter((f) => f.startsWith(root) && langOf(f) === "js" && isProtected(f, policy, "tests") && !OTHER_RUNNER_DIR.test(f)).map((f) => f.slice(root.length));
-  return own.length ? own : CANONICAL_SAMPLES;
+  const own = files.filter((f) => f.startsWith(root) && langOf(f) === lang && isProtected(f, policy, "tests") && (lang !== "js" || !OTHER_RUNNER_DIR.test(f))).map((f) => f.slice(root.length));
+  return own.length ? own : fallback;
 }
 var WHOLE_SUITE_SCRIPT = /^test(?::ci)?$/;
 function excludesOtherRunner(flag, cmd) {
@@ -5440,7 +5642,9 @@ var testDeletion = {
             );
           }
         } else if (c.op !== "delete" && c.after != null && !isTest && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
-          for (const n of suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx))) {
+          const rn = runnerOf(c.path, c.after);
+          const readable = rn !== "pytest" || effectivePytestConfig(c.path, ctx);
+          for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
             out2.push(
               makeFinding(RULE7, policy, {
                 file: c.path,
@@ -5550,9 +5754,48 @@ var testDeletion = {
         }
       }
     }
+    out2.push(...pytestPrecedenceFindings(changes, policy, ctx));
     return out2;
   }
 };
+function pytestPrecedenceFindings(changes, policy, ctx) {
+  const order = PYTEST_INI_ORDER;
+  const touched = /* @__PURE__ */ new Map();
+  for (const c of changes) {
+    if (c.kind !== "file" || c.oldPath) continue;
+    if (order.includes(c.path)) touched.set(c.path, c);
+  }
+  if (touched.size === 0) return [];
+  const listing = trackedFiles(ctx);
+  if (!listing) return [];
+  const rootNames = new Set(listing.filter((f) => !f.includes("/")));
+  const base = /* @__PURE__ */ new Map();
+  const head = /* @__PURE__ */ new Map();
+  for (const name of order) {
+    const c = touched.get(name);
+    if (c) {
+      base.set(name, c.before);
+      head.set(name, c.after);
+      continue;
+    }
+    if (!rootNames.has(name)) continue;
+    const src = trackedContent(name, ctx);
+    base.set(name, src);
+    head.set(name, src);
+  }
+  const was = effectivePytestFile(base);
+  const now = effectivePytestFile(head);
+  if (!was || !now || was.path === now.path) return [];
+  const samples = runnerSamples(now.path, policy, ctx, "pytest");
+  return suiteNarrowings(was.content, now.content, now.path, samples).map(
+    (n) => makeFinding(RULE7, policy, {
+      file: now.path,
+      message: `The effective pytest config moved from ${was.path} to ${now.path}, and ${n.path} is no longer selected: ${n.reason}.`,
+      evidence: `inifile precedence ${was.path} \u2192 ${now.path} drops ${n.path} from the suite`,
+      remediation: "pytest reads ONE config file. Adding a higher-precedence one, or deleting the one in force, changes which settings apply \u2014 keep the effective configuration selecting the whole suite."
+    })
+  );
+}
 
 // src/detectors/test-content-removal.ts
 import ts5 from "typescript";
@@ -5838,8 +6081,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join4, posix as posix2 } from "node:path";
+import { readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join5, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -5963,9 +6206,9 @@ function parseOrThrow(src, where) {
   return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
-  const path = join4(cwd, POLICY_FILE);
+  const path = join5(cwd, POLICY_FILE);
   if (!existsSync3(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
+  return parseOrThrow(readFileSync4(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -5975,8 +6218,8 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
+import { dirname as dirname2, join as join6 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
   return createHash("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
@@ -5987,13 +6230,13 @@ function ledgerPath(cwd, policy) {
   if (!ledgerInsideRepo(rel)) {
     throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
   }
-  return join5(cwd, rel);
+  return join6(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
   if (!existsSync4(p)) return [];
   const out2 = [];
-  for (const line of readFileSync4(p, "utf8").split("\n")) {
+  for (const line of readFileSync5(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -6363,14 +6606,14 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, join as join6, relative as relative2, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute5, join as join7, relative as relative2, resolve as resolve2 } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -6395,11 +6638,11 @@ function synthFileChange(displayPath, before, after) {
   if (before === null) op = "add";
   else if (after === null) op = "delete";
   else op = "modify";
-  const dir = mkdtempSync(join6(tmpdir(), "hf-"));
+  const dir = mkdtempSync(join7(tmpdir(), "hf-"));
   let raw = "";
   try {
-    const a = join6(dir, "a");
-    const b = join6(dir, "b");
+    const a = join7(dir, "a");
+    const b = join7(dir, "b");
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
@@ -6484,14 +6727,14 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join8 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
-  return join7(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
+  return join8(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
@@ -6499,7 +6742,7 @@ function turnBaseline(cwd, sessionId) {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
     if (existsSync5(p)) {
-      const v = readFileSync5(p, "utf8").trim();
+      const v = readFileSync6(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -6525,8 +6768,8 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join8 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join9 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -6538,7 +6781,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join8(cwd, d);
+    return isAbsolute6(d) ? d : join9(cwd, d);
   } catch {
     return null;
   }
@@ -6547,8 +6790,8 @@ function statePath(cwd, sessionId, kind) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join8(gd, "tamperward");
-  return join8(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
+  const dir = join9(gd, "tamperward");
+  return join9(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 function ptreePath(cwd, sessionId) {
   return statePath(cwd, sessionId, "ptree");
@@ -6577,7 +6820,7 @@ function snapshotProtected(cwd, policy, prev) {
   } catch {
   }
   const walk2 = (rel) => {
-    const abs2 = rel ? join8(cwd, rel) : cwd;
+    const abs2 = rel ? join9(cwd, rel) : cwd;
     let names;
     try {
       names = readdirSync(abs2);
@@ -6590,7 +6833,7 @@ function snapshotProtected(cwd, policy, prev) {
       if (pruned.has(r)) continue;
       let st;
       try {
-        st = lstatSync2(join8(cwd, r));
+        st = lstatSync2(join9(cwd, r));
       } catch {
         continue;
       }
@@ -6619,7 +6862,7 @@ function driftBetween(expected, current) {
 function loadTree(p) {
   if (!p || !existsSync6(p)) return null;
   try {
-    return JSON.parse(readFileSync6(p, "utf8"));
+    return JSON.parse(readFileSync7(p, "utf8"));
   } catch {
     return null;
   }
@@ -6627,7 +6870,7 @@ function loadTree(p) {
 function saveTree(p, tree) {
   if (!p) return;
   try {
-    mkdirSync3(join8(p, ".."), { recursive: true });
+    mkdirSync3(join9(p, ".."), { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(tree));
     renameSync(tmp, p);
@@ -6659,7 +6902,7 @@ function dropTurnTree(cwd, sessionId) {
 
 // src/cli/watch.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
@@ -6671,7 +6914,7 @@ function snap(abs2) {
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
-  return join9(gitDir(cwd) ?? join9(cwd, ".git"), "tamperward", "fsevents.jsonl");
+  return join10(gitDir(cwd) ?? join10(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -6688,12 +6931,12 @@ function watchTree(dir, cb) {
     if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
-      w = watch(rel ? join9(dir, rel) : dir, (kind, fname) => {
+      w = watch(rel ? join10(dir, rel) : dir, (kind, fname) => {
         if (!fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync(join9(dir, child)).isDirectory()) addDir(child);
+          if (statSync(join10(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -6706,7 +6949,7 @@ function watchTree(dir, cb) {
     addDir(rel);
     let names = [];
     try {
-      names = readdirSync2(rel ? join9(dir, rel) : dir);
+      names = readdirSync2(rel ? join10(dir, rel) : dir);
     } catch {
       return;
     }
@@ -6714,7 +6957,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync(join9(dir, child)).isDirectory()) walk2(child);
+        if (statSync(join10(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -6726,13 +6969,13 @@ function watchTree(dir, cb) {
 }
 function startWatcher(dir, log, policy) {
   try {
-    mkdirSync4(join9(log, ".."), { recursive: true });
+    mkdirSync4(join10(log, ".."), { recursive: true });
   } catch {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
     if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
-    const s = snap(join9(dir, rel));
+    const s = snap(join10(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
     last.set(rel, key2);
@@ -6759,7 +7002,7 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync9, statSync as statSync2 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
@@ -6769,7 +7012,7 @@ function readEvents(log, offset) {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync8(log, "utf8").slice(offset);
+  const raw = readFileSync9(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -6822,7 +7065,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync9(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7078,7 +7321,7 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync7(log)) return none;
   let offset = 0;
   if (cp && existsSync7(cp)) {
-    const n = Number(readFileSync9(cp, "utf8"));
+    const n = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -7231,8 +7474,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join10, relative as relative3, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join11, relative as relative3, resolve as resolve3 } from "node:path";
 var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
@@ -7408,7 +7651,7 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join10(cwd, POLICY_FILE);
+  const path = join11(cwd, POLICY_FILE);
   if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
@@ -7427,12 +7670,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join10(cwd, rel);
+  const path = join11(cwd, rel);
   let settings = {};
   if (existsSync8(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync10(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -7528,7 +7771,7 @@ function hooksDir(cwd) {
     if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
+  return existsSync8(join11(cwd, ".git")) ? join11(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
@@ -7555,30 +7798,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync8(join10(cwd, ".husky"))) {
-    path = join10(cwd, ".husky", "pre-commit");
+  if (existsSync8(join11(cwd, ".husky"))) {
+    path = join11(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join10(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join11(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
-      path = join10(dirname4(dir), "pre-commit");
+      path = join11(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join10(dir, "pre-commit");
+      path = join11(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join10(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join11(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
   if (existsSync8(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync8(path) ? readFileSync10(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync11(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7667,10 +7910,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync8(join10(cwd, r))
+    (r) => existsSync8(join11(cwd, r))
   );
-  const path = join10(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync10(path, "utf8") : null;
+  const path = join11(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync11(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -7703,7 +7946,7 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join10(cwd, rel);
+  const path = join11(cwd, rel);
   const write = () => {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
@@ -7719,7 +7962,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync10(path, "utf8");
+    src = readFileSync11(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -7818,15 +8061,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join13, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, join as join14, resolve as resolve4 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join11 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync12 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join12 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -7839,7 +8082,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute8(d) ? d : join11(cwd, d);
+    return isAbsolute8(d) ? d : join12(cwd, d);
   } catch {
     return null;
   }
@@ -7864,9 +8107,9 @@ function objectRewriteState(cwd) {
       parts.push(`${rel}:<no-git-dir>`);
       continue;
     }
-    const p = join11(dir, rel);
+    const p = join12(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync11(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync12(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -7877,8 +8120,8 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
+import { join as join13 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -7896,7 +8139,7 @@ function treeFingerprint(cwd) {
   return h.digest("hex");
 }
 function depsFingerprint(cwd) {
-  const root = join12(cwd, "node_modules");
+  const root = join13(cwd, "node_modules");
   const h = createHash7("sha256");
   const walk2 = (dir) => {
     let entries;
@@ -7906,12 +8149,12 @@ function depsFingerprint(cwd) {
       return;
     }
     for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join12(dir, e.name);
+      const p = join13(dir, e.name);
       if (e.isDirectory()) walk2(p);
       else if (e.isFile()) {
         h.update(p);
         try {
-          h.update(readFileSync12(p));
+          h.update(readFileSync13(p));
           h.update(String(statSync4(p).mode));
         } catch {
           h.update("<unreadable>");
@@ -8026,7 +8269,7 @@ function baseIsAncestorOfHead(base, cwd) {
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join13(cwd, rel);
+    const src = join14(cwd, rel);
     let st;
     try {
       st = statSync5(src);
@@ -8034,18 +8277,18 @@ function materialize(cwd, dest) {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join13(dest, rel);
+    const out2 = join14(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
     if (lstatSync3(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync13(src));
+      writeFileSync6(out2, readFileSync14(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve4(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
+  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8078,11 +8321,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join13(dest, rel);
+    const p = join14(dest, rel);
     try {
       const st = lstatSync3(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync13(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync14(p));
     } catch {
       h.update("<gone>");
     }
@@ -8105,7 +8348,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join13(dest, e.path);
+    const out2 = join14(dest, e.path);
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
@@ -8120,7 +8363,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join13(dest, rel), { force: true });
+    rmSync3(join14(dest, rel), { force: true });
     removed++;
   }
   return { restored, removed };
@@ -8162,8 +8405,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join13(scratch, "npmrc-user");
-  const globalRc = join13(scratch, "npmrc-global");
+  const userRc = join14(scratch, "npmrc-user");
+  const globalRc = join14(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -8173,8 +8416,8 @@ function suiteEnv(scratch) {
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join13(tmpdir2(), "tw-verify-run-"));
-  const outFile = join13(outDir, "result.json");
+  const outDir = mkdtempSync2(join14(tmpdir2(), "tw-verify-run-"));
+  const outFile = join14(outDir, "result.json");
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
@@ -8187,7 +8430,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync13(outFile, "utf8"));
+      r = JSON.parse(readFileSync14(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -8238,8 +8481,8 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join13(visRoot, "t");
+  const visRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join14(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
@@ -8267,8 +8510,8 @@ function runVerify(opts) {
     out2("pristine run executes through it too. Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join13(priRoot, "t");
+  const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join14(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -8380,7 +8623,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync3 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync as realpathSync3 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -8389,7 +8632,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync15("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -8419,7 +8662,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.0",
+  "version": "2.10.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",