tamperward 2.10.3 → 2.10.5

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/git/build.ts
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 
 // src/disk.ts
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readlinkSync, realpathSync } from "node:fs";
@@ -602,10 +602,62 @@ function addHunks(content) {
   ];
 }
 
+// src/git/trusted.ts
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join as join2 } from "node:path";
+function trustedGitEnv() {
+  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
+}
+function gitDirOf(cwd) {
+  try {
+    const d = execFileSync("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      env: trustedGitEnv()
+    }).trim();
+    if (!d) return null;
+    return isAbsolute(d) ? d : join2(cwd, d);
+  } catch {
+    return null;
+  }
+}
+function objectRewriteState(cwd) {
+  const parts = [];
+  try {
+    parts.push(
+      "replace:" + execFileSync("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: trustedGitEnv()
+      }).trim()
+    );
+  } catch {
+    parts.push("replace:<unreadable>");
+  }
+  const dir = gitDirOf(cwd);
+  for (const rel of ["info/grafts", "shallow"]) {
+    if (dir === null) {
+      parts.push(`${rel}:<no-git-dir>`);
+      continue;
+    }
+    const p = join2(dir, rel);
+    try {
+      parts.push(`${rel}:` + (existsSync(p) ? readFileSync(p, "utf8").trim() : ""));
+    } catch {
+      parts.push(`${rel}:<unreadable>`);
+    }
+  }
+  return createHash("sha256").update(parts.join("\n")).digest("hex");
+}
+
 // src/git/build.ts
 function git(args, cwd) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync2("git", args, {
       cwd,
       encoding: "utf8",
       // 256 MiB, matching the hook adapter. Every diff below runs with `--text`, so a
@@ -614,7 +666,12 @@ function git(args, cwd) {
       // the cap git() throws and the view fails CLOSED (a truncated patch would parse
       // as a smaller change than the one landing), which is the documented stance.
       maxBuffer: 256 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // Every object read in this shared adapter can feed a trust decision:
+      // policy-at-base, merge-base selection, range enrichment, and the HEAD
+      // side of worktree/staged comparisons. A pre-existing replace ref must
+      // never make those callers see an attacker-selected object.
+      env: trustedGitEnv()
     });
   } catch (e) {
     const err2 = e;
@@ -765,6 +822,104 @@ function hiddenTrackedPaths(opts = {}) {
   return out2;
 }
 
+// src/adapters/claude/changes.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute as isAbsolute2, join as join3, relative, resolve } from "node:path";
+function asStr(v) {
+  return typeof v === "string" ? v : "";
+}
+function readDisk(path) {
+  return textOf(inspectResolved(path));
+}
+function abs(path, cwd) {
+  return resolve(cwd, path);
+}
+function relForDisplay(path, cwd) {
+  const rel = relative(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : path;
+}
+function applyEdit(content, oldStr, newStr) {
+  if (content === null) return newStr;
+  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
+  return content.replace(oldStr, () => newStr);
+}
+function synthFileChange(displayPath, before, after) {
+  if (before === after) return [];
+  let op;
+  if (before === null) op = "add";
+  else if (after === null) op = "delete";
+  else op = "modify";
+  const dir = mkdtempSync(join3(tmpdir(), "hf-"));
+  let raw = "";
+  try {
+    const a = join3(dir, "a");
+    const b = join3(dir, "b");
+    writeFileSync(a, before ?? "");
+    writeFileSync(b, after ?? "");
+    try {
+      raw = execFileSync3("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
+        encoding: "utf8",
+        maxBuffer: 256 * 1024 * 1024
+      });
+    } catch (e) {
+      const err2 = e;
+      if (err2.status !== 1) {
+        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
+      }
+      raw = err2.stdout ? String(err2.stdout) : "";
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  const first = parseDiff(raw)[0];
+  const hunks = first && first.kind === "file" ? first.hunks : [];
+  return [{ kind: "file", path: displayPath, oldPath: null, op, before, after, binary: false, hunks }];
+}
+function changesFromClaudeHook(input, cwd) {
+  const ti = input.tool_input ?? {};
+  switch (input.tool_name) {
+    case "Bash": {
+      const raw = asStr(ti.command);
+      return raw ? [{ kind: "command", raw, argv: raw.split(/\s+/) }] : [];
+    }
+    case "Write": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, asStr(ti.content));
+    }
+    case "Edit": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string));
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
+    }
+    case "MultiEdit": {
+      const fp = asStr(ti.file_path);
+      if (!fp) return [];
+      const before = readDisk(abs(fp, cwd));
+      let after = before;
+      const edits = Array.isArray(ti.edits) ? ti.edits : [];
+      for (const raw of edits) {
+        const ed = raw;
+        after = applyEdit(after, ed.old_string ?? "", ed.new_string ?? "");
+      }
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
+    }
+    case "NotebookEdit": {
+      const fp = asStr(ti.notebook_path);
+      const src = asStr(ti.new_source);
+      if (!fp || !src) return [];
+      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), "", src);
+    }
+    default:
+      return [];
+  }
+}
+
 // src/detectors/finding.ts
 function severityOf(rule, policy, fallback = "block") {
   return policy.rules?.[rule]?.severity ?? fallback;
@@ -1230,12 +1385,16 @@ var lintSuppression = {
 
 // src/detectors/test-skip.ts
 var RULE3 = "test-skip";
+var acc = (names) => `(?:\\s*\\.\\s*(?:${names})(?![\\w$])|\\s*\\[\\s*['"\`](?:${names})['"\`]\\s*\\])`;
+var JS_RUNNER = "\\b(?:it|test|describe|suite)";
+var JS_MOD = "concurrent|sequential|shuffle";
 var PATTERNS2 = {
   js: [
-    // vitest chains a concurrency modifier before the marker: it.concurrent.skip.
-    { re: /\b(?:it|test|describe|suite)(?:\.(?:concurrent|sequential|shuffle))?\.(?:skip|only|todo)\b/, why: "a .skip/.only/.todo marker" },
-    { re: /\b(?:it|test|describe|suite)\.(?:skipIf|runIf)\s*\(/, why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
-    { re: /\b(?:it|test)\.(?:fails|failing)\s*\(/, why: "a .fails/.failing marker (the test now passes by failing)" },
+    // The skip/only/todo family on a runner, by dot-or-bracket access, with one optional
+    // vitest concurrency modifier hop: test.skip, test . skip, test['skip'], it.concurrent.skip.
+    { re: new RegExp(JS_RUNNER + acc(JS_MOD) + "?" + acc("skip|only|todo")), why: "a .skip/.only/.todo marker" },
+    { re: new RegExp(JS_RUNNER + acc("skipIf|runIf") + "\\s*\\("), why: "a .skipIf()/.runIf() condition (the test runs only when the condition allows)" },
+    { re: new RegExp(JS_RUNNER + acc("fails|failing") + "\\s*\\("), why: "a .fails/.failing marker (the test now passes by failing)" },
     { re: /\b(?:it|test|describe)\.each\s*\(\s*\[\s*\]\s*\)/, why: "an empty .each table (no case ever runs)" },
     { re: /\b(?:xit|xtest|xdescribe)\s*\(/, why: "an x-prefixed disabled test" },
     { re: /\b(?:fit|ftest|fdescribe)\s*\(/, why: "an f-prefixed focused test (narrows the suite)" },
@@ -1249,7 +1408,7 @@ var PATTERNS2 = {
     { re: /\b(?:it|test|describe|suite)\s*\(\s*(['"`])(?:(?!\1).)*\1\s*,\s*\{[^}]*?\bskip:(?!\s*(?:false|0)\b)/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\bskip:\s*(?:true|['"`])/, why: "a { skip: ... } option disabling the test (node:test options form)" },
     { re: /\btodo:\s*(?:true|['"`])/, why: "a { todo: ... } option (the test no longer fails the run)" },
-    { re: /\b(?:t|ctx|context|this)\.skip\(/, why: "a runtime t.skip()/this.skip() call" }
+    { re: new RegExp("\\b(?:t|ctx|context|this)" + acc("skip") + "\\s*\\("), why: "a runtime t.skip()/this.skip() call" }
   ],
   py: [
     // `import pytest as pt` makes the decorator `@pt.mark.skip`; the module alias is free.
@@ -1306,6 +1465,17 @@ var PATTERNS2 = {
     { re: /\bAssert\.Inconclusive\(/, why: "an Assert.Inconclusive() call (the test ends without a verdict)" }
   ]
 };
+function matchesOutsideString(p, content, lang) {
+  if (p.comment) return p.re.test(content);
+  const re = p.re.global ? p.re : new RegExp(p.re.source, p.re.flags + "g");
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    if (!insideStringLiteral(content, m.index, lang)) return true;
+    if (m.index === re.lastIndex) re.lastIndex++;
+  }
+  return false;
+}
 var testSkip = {
   id: RULE3,
   surface: ["file"],
@@ -1321,7 +1491,7 @@ var testSkip = {
         const comment = isCommentLine(l.content.trim(), lang);
         for (const p of patterns) {
           if (comment && !p.comment) continue;
-          if (p.re.test(l.content)) {
+          if (matchesOutsideString(p, l.content, lang)) {
             out2.push(
               makeFinding(RULE3, policy, {
                 file: c.path,
@@ -1345,9 +1515,9 @@ import picomatch2 from "picomatch";
 import ts2 from "typescript";
 
 // src/detectors/repo.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
 var cache = /* @__PURE__ */ new Map();
 function trackedFiles(ctx) {
   if (!ctx) return null;
@@ -1357,7 +1527,7 @@ function trackedFiles(ctx) {
   if (hit !== void 0) return hit;
   let files = null;
   try {
-    files = execFileSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+    files = execFileSync4("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
@@ -1379,7 +1549,7 @@ function trackedContent(path, ctx) {
   if (hit !== void 0) return hit;
   let src = null;
   try {
-    src = readFileSync(join2(ctx.cwd, path), "utf8");
+    src = readFileSync2(join4(ctx.cwd, path), "utf8");
   } catch {
     src = null;
   }
@@ -1394,7 +1564,7 @@ function branchRefs(ctx) {
   if (hit !== void 0) return hit;
   let refs = null;
   try {
-    const out2 = execFileSync2("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
+    const out2 = execFileSync4("git", ["for-each-ref", "--format=%(refname:short)", "refs/heads", "refs/remotes"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -1417,7 +1587,7 @@ function revIsHead(rev, ctx) {
   if (!ctx?.cwd || rev.startsWith("-")) return null;
   const parse3 = (r) => {
     try {
-      return execFileSync2("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
+      return execFileSync4("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${r}^{commit}`], {
         cwd: ctx.cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
@@ -1437,7 +1607,7 @@ function defaultBranch(ctx) {
   if (hit !== void 0) return hit;
   let name = null;
   try {
-    const ref = execFileSync2("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
+    const ref = execFileSync4("git", ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"], {
       cwd: ctx.cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -2691,20 +2861,20 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join4, relative } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join6, relative as relative2 } from "node:path";
 
 // src/wiring.ts
-import { readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join as join3, posix } from "node:path";
+import { basename, dirname, isAbsolute as isAbsolute3, join as join5, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync2(join3(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync3(join5(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -2717,10 +2887,12 @@ var TW_VERSION = shippedVersion();
 var PRE_TOOLS = ["Bash", "Edit", "Write", "MultiEdit", "NotebookEdit"];
 var PRE_MATCHER = PRE_TOOLS.join("|");
 var MARKER = "# tamperward: block agent shortcuts before they land";
-var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
-var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
-var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
-var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
+var NPX_AUTHORITY = "npx --yes --global --userconfig=/dev/null --globalconfig=/dev/null/npmrc-global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online";
+var AUTHORITY_FAIL_CLOSED = " || (echo tamperward: authority failed to start >&2 && exit 2)";
+var HOOK_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} hook claude${AUTHORITY_FAIL_CLOSED}`;
+var SWEEP_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} sweep claude${AUTHORITY_FAIL_CLOSED}`;
+var PRECOMMIT_CMD = `${NPX_AUTHORITY} tamperward@${TW_VERSION} check --staged`;
+var OURS = /^\s*npx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (?:(hook claude|sweep claude) \|\| \(echo tamperward: authority failed to start >&2 && exit 2\)|(check --staged))\s*$/;
 var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
@@ -2734,7 +2906,7 @@ function pinNotBelow(now, floor) {
   const c = compareVersions(now, floor);
   return c !== null && c >= 0;
 }
-var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n*$/;
+var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes --global --userconfig=\/dev\/null --globalconfig=\/dev\/null\/npmrc-global --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? check --staged\n*$/;
 function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
@@ -2772,7 +2944,7 @@ function canonicalPath(path) {
 }
 function resolvesToClaudeSettings(path, env = process.env) {
   if (isClaudeSettings(path, env)) return true;
-  return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
+  return isAbsolute3(path) && isClaudeSettings(canonicalPath(path), env);
 }
 
 // src/detectors/policy-diff.ts
@@ -2900,8 +3072,8 @@ function policyAddWeakening(after) {
 }
 
 // src/detectors/hook-wiring.ts
-import { existsSync } from "node:fs";
-import { isAbsolute as isAbsolute2, resolve } from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { isAbsolute as isAbsolute4, resolve as resolve2 } from "node:path";
 import { parse as parseYaml } from "yaml";
 function stripComment(line) {
   let single = false;
@@ -4015,16 +4187,16 @@ function expandShellPath(t, env = process.env) {
 }
 function hookTests(policy, ctx) {
   const cwd = ctx?.cwd;
-  const onDisk = cwd !== void 0 && existsSync(cwd);
+  const onDisk = cwd !== void 0 && existsSync2(cwd);
   const root = onDisk ? canonicalPath(cwd) : cwd;
   const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
     const hit = memo.get(t);
     if (hit !== void 0) return hit;
     let p = expandShellPath(t.replace(/^["']|["']$/g, ""));
-    const pathy = isAbsolute2(p) || p.includes("/") && !/^[-:]/.test(p);
-    if (pathy && (isAbsolute2(p) || onDisk)) {
-      p = canonicalPath(isAbsolute2(p) ? p : resolve(cwd, p));
+    const pathy = isAbsolute4(p) || p.includes("/") && !/^[-:]/.test(p);
+    if (pathy && (isAbsolute4(p) || onDisk)) {
+      p = canonicalPath(isAbsolute4(p) ? p : resolve2(cwd, p));
       if (root !== void 0) {
         if (p === root) p = ".";
         else if (p.startsWith(root + "/")) p = p.slice(root.length + 1);
@@ -4211,7 +4383,6 @@ var declares = (s, event) => eventEntries(s, event) !== null;
 var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout", "statusMessage"]);
 var HOOK_TYPES = /* @__PURE__ */ new Set(["command", "prompt", "agent", "http"]);
 var SIBLING_KEYS = GATE_KEYS;
-var CANONICAL_CMD = /^npx --yes tamperward@(\S+) (hook|sweep) claude$/;
 var MENTIONS_GATE = /\btamperward\b.*\b(?:hook|sweep)\b/;
 var FORGERY = /hookSpecificOutput|permissionDecision|updatedInput|"decision"|"continue"/;
 var ENV_MECHANISM = [
@@ -4229,10 +4400,11 @@ function analyseGateCommand(cmd, event) {
   const want = event === "PreToolUse" ? "hook" : "sweep";
   const problems = [];
   let runs = true;
-  const canonical2 = cmd.match(CANONICAL_CMD);
+  const canonical2 = cmd.match(OURS);
   if (canonical2) {
-    if (canonical2[2] !== want) {
-      problems.push(`runs \`${canonical2[2]} claude\` under ${event}`);
+    const kind = canonical2[2];
+    if (kind !== `${want} claude`) {
+      problems.push(`runs \`${kind}\` under ${event}`);
       runs = false;
     }
     if (!PLAIN_SEMVER.test(canonical2[1])) {
@@ -4582,8 +4754,8 @@ function lefthookBase(c, changes, ctx) {
   if (!ctx?.cwd) return null;
   for (const n of names) {
     try {
-      const p = join4(ctx.cwd, n);
-      if (existsSync2(p)) return parseDoc(readFileSync3(p, "utf8"));
+      const p = join6(ctx.cwd, n);
+      if (existsSync3(p)) return parseDoc(readFileSync4(p, "utf8"));
     } catch {
     }
   }
@@ -4653,9 +4825,9 @@ function updateIndexHiding(toks, policy) {
   return null;
 }
 function repoRelative(path, ctx) {
-  if (!ctx?.cwd || !isAbsolute3(path)) return path;
-  const rel = relative(ctx.cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
+  if (!ctx?.cwd || !isAbsolute5(path)) return path;
+  const rel = relative2(ctx.cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 var HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
 var HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
@@ -4704,7 +4876,7 @@ function huskyRuntimeWrite(path, content, ctx) {
   if (!ok) return false;
   if (!ctx?.cwd) return false;
   const root = path.slice(0, path.length - m[0].length + (m[0].startsWith("/") ? 1 : 0));
-  const entry = inspectRel(join4(ctx.cwd, root), ".husky/pre-commit");
+  const entry = inspectRel(join6(ctx.cwd, root), ".husky/pre-commit");
   if (entry.kind !== "file") return false;
   const gate = textOf(entry);
   if (gate == null) return false;
@@ -4957,7 +5129,7 @@ var hookTampering = {
           if (why) {
             const target = shellHookTarget(seg, toks, policy, ctx) ?? shellHookTarget("", fed, policy, ctx);
             const file = target ? repoRelative(target, ctx) : void 0;
-            const outside = file !== void 0 && (isAbsolute3(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
+            const outside = file !== void 0 && (isAbsolute5(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
             out2.push(
               makeFinding(RULE6, policy, {
                 ...file !== void 0 ? { file } : {},
@@ -6084,8 +6256,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join5, posix as posix2 } from "node:path";
+import { readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join7, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -6102,7 +6274,7 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute4(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  if (!ledger.trim() || isAbsolute6(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
   const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
@@ -6209,9 +6381,9 @@ function parseOrThrow(src, where) {
   return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
-  const path = join5(cwd, POLICY_FILE);
-  if (!existsSync3(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync4(path, "utf8"), POLICY_FILE);
+  const path = join7(cwd, POLICY_FILE);
+  if (!existsSync4(path)) return defaultPolicy();
+  return parseOrThrow(readFileSync5(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -6220,12 +6392,12 @@ function loadPolicyAt(rev, cwd) {
 }
 
 // src/signoff.ts
-import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync5, existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname2, join as join6 } from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync6, existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname2, join as join8 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
-  return createHash("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
+  return createHash2("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
 }
 var fingerprintOf = (f) => fingerprint(f.rule, f.file, f.evidence);
 function ledgerPath(cwd, policy) {
@@ -6233,13 +6405,13 @@ function ledgerPath(cwd, policy) {
   if (!ledgerInsideRepo(rel)) {
     throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
   }
-  return join6(cwd, rel);
+  return join8(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync4(p)) return [];
+  if (!existsSync5(p)) return [];
   const out2 = [];
-  for (const line of readFileSync5(p, "utf8").split("\n")) {
+  for (const line of readFileSync6(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -6279,7 +6451,9 @@ function oobToken(want, oob, head) {
     }
     const [rule, sha2] = [t.slice(0, at), t.slice(at + 1)];
     if (rule !== want) continue;
-    if (!head || sha2.length >= 7 && head.startsWith(sha2)) return t;
+    const normalizedHead = head?.trim().toLowerCase();
+    const normalizedSha = sha2.trim().toLowerCase();
+    if (!head || /^[0-9a-f]+$/.test(normalizedHead) && normalizedSha === normalizedHead) return t;
   }
   return null;
 }
@@ -6295,8 +6469,8 @@ function applyOobSignoffs(findings, oob, head) {
   return { findings: remaining, cleared };
 }
 function oobHeadFromEnv(env = process.env) {
-  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim();
-  return v.length >= 7 ? v : void 0;
+  const v = (env.TAMPERWARD_OOB_HEAD ?? "").trim().toLowerCase();
+  return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(v) ? v : void 0;
 }
 function oobFromEnv(env = process.env) {
   return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
@@ -6558,6 +6732,11 @@ function check(opts) {
   } else if (opts.worktree) {
     const p = policy;
     changes = opts.includeUntracked ? diffWorktreeWithUntracked({ cwd: opts.cwd }, (rel) => isProtected(rel, p)) : diffWorktree({ cwd: opts.cwd });
+    const seen = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
+    for (const rel of hiddenTrackedPaths({ cwd: opts.cwd })) {
+      if (seen.has(rel) || !isProtected(rel, p)) continue;
+      changes.push(...synthFileChange(rel, fileAt("HEAD", rel, { cwd: opts.cwd }), fileOnDisk(rel, { cwd: opts.cwd })));
+    }
     layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
@@ -6609,106 +6788,8 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
-
-// src/adapters/claude/changes.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, join as join7, relative as relative2, resolve as resolve2 } from "node:path";
-function asStr(v) {
-  return typeof v === "string" ? v : "";
-}
-function readDisk(path) {
-  return textOf(inspectResolved(path));
-}
-function abs(path, cwd) {
-  return resolve2(cwd, path);
-}
-function relForDisplay(path, cwd) {
-  const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
-}
-function applyEdit(content, oldStr, newStr) {
-  if (content === null) return newStr;
-  if (oldStr !== "" && !content.includes(oldStr)) return content + "\n" + newStr;
-  return content.replace(oldStr, () => newStr);
-}
-function synthFileChange(displayPath, before, after) {
-  if (before === after) return [];
-  let op;
-  if (before === null) op = "add";
-  else if (after === null) op = "delete";
-  else op = "modify";
-  const dir = mkdtempSync(join7(tmpdir(), "hf-"));
-  let raw = "";
-  try {
-    const a = join7(dir, "a");
-    const b = join7(dir, "b");
-    writeFileSync(a, before ?? "");
-    writeFileSync(b, after ?? "");
-    try {
-      raw = execFileSync3("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
-        encoding: "utf8",
-        maxBuffer: 256 * 1024 * 1024
-      });
-    } catch (e) {
-      const err2 = e;
-      if (err2.status !== 1) {
-        throw new Error(`cannot diff the incoming edit to ${displayPath}: ${err2.code ?? err2.message ?? String(e)}`);
-      }
-      raw = err2.stdout ? String(err2.stdout) : "";
-    }
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-  const first = parseDiff(raw)[0];
-  const hunks = first && first.kind === "file" ? first.hunks : [];
-  return [{ kind: "file", path: displayPath, oldPath: null, op, before, after, binary: false, hunks }];
-}
-function changesFromClaudeHook(input, cwd) {
-  const ti = input.tool_input ?? {};
-  switch (input.tool_name) {
-    case "Bash": {
-      const raw = asStr(ti.command);
-      return raw ? [{ kind: "command", raw, argv: raw.split(/\s+/) }] : [];
-    }
-    case "Write": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, asStr(ti.content));
-    }
-    case "Edit": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      const after = applyEdit(before, asStr(ti.old_string), asStr(ti.new_string));
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
-    }
-    case "MultiEdit": {
-      const fp = asStr(ti.file_path);
-      if (!fp) return [];
-      const before = readDisk(abs(fp, cwd));
-      let after = before;
-      const edits = Array.isArray(ti.edits) ? ti.edits : [];
-      for (const raw of edits) {
-        const ed = raw;
-        after = applyEdit(after, ed.old_string ?? "", ed.new_string ?? "");
-      }
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), before, after);
-    }
-    case "NotebookEdit": {
-      const fp = asStr(ti.notebook_path);
-      const src = asStr(ti.new_source);
-      if (!fp || !src) return [];
-      return synthFileChange(relForDisplay(abs(fp, cwd), cwd), "", src);
-    }
-    default:
-      return [];
-  }
-}
+import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync8 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
 function formatDenial(blocks) {
@@ -6730,22 +6811,22 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join8 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join9 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
-  return join8(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
+  return join9(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync5(p)) {
-      const v = readFileSync6(p, "utf8").trim();
+    if (existsSync6(p)) {
+      const v = readFileSync7(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -6770,21 +6851,21 @@ function advanceTurnBaseline(cwd, sessionId) {
 }
 
 // src/effect.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join9 } from "node:path";
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute7, join as join10 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
 function gitDir2(cwd) {
   try {
-    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync5("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join9(cwd, d);
+    return isAbsolute7(d) ? d : join10(cwd, d);
   } catch {
     return null;
   }
@@ -6793,8 +6874,8 @@ function statePath(cwd, sessionId, kind) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join9(gd, "tamperward");
-  return join9(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
+  const dir = join10(gd, "tamperward");
+  return join10(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 function ptreePath(cwd, sessionId) {
   return statePath(cwd, sessionId, "ptree");
@@ -6802,7 +6883,7 @@ function ptreePath(cwd, sessionId) {
 function turnTreePath(cwd, sessionId) {
   return statePath(cwd, sessionId, "turntree");
 }
-var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
+var sha = (buf) => createHash3("sha256").update(buf).digest("hex").slice(0, 16);
 function contentHash(content) {
   return sha(Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"));
 }
@@ -6823,7 +6904,7 @@ function snapshotProtected(cwd, policy, prev) {
   } catch {
   }
   const walk2 = (rel) => {
-    const abs2 = rel ? join9(cwd, rel) : cwd;
+    const abs2 = rel ? join10(cwd, rel) : cwd;
     let names;
     try {
       names = readdirSync(abs2);
@@ -6836,7 +6917,7 @@ function snapshotProtected(cwd, policy, prev) {
       if (pruned.has(r)) continue;
       let st;
       try {
-        st = lstatSync2(join9(cwd, r));
+        st = lstatSync2(join10(cwd, r));
       } catch {
         continue;
       }
@@ -6863,9 +6944,9 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync6(p)) return null;
+  if (!p || !existsSync7(p)) return null;
   try {
-    return JSON.parse(readFileSync7(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -6873,7 +6954,7 @@ function loadTree(p) {
 function saveTree(p, tree) {
   if (!p) return;
   try {
-    mkdirSync3(join9(p, ".."), { recursive: true });
+    mkdirSync3(join10(p, ".."), { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(tree));
     renameSync(tmp, p);
@@ -6905,19 +6986,19 @@ function dropTurnTree(cwd, sessionId) {
 
 // src/cli/watch.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
-import { join as join10 } from "node:path";
-import { createHash as createHash3 } from "node:crypto";
+import { join as join11 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
   const e = inspectPath(abs2);
   if (e.kind === "absent" || e.kind === "unreadable") return { mode: null, size: null, hash: null };
   if (e.kind !== "file" || e.content == null) return { mode: e.mode, size: null, hash: null };
-  const hash = createHash3("sha256").update(e.content).digest("hex").slice(0, 16);
+  const hash = createHash4("sha256").update(e.content).digest("hex").slice(0, 16);
   return { mode: e.mode, size: e.size, hash };
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
-  return join10(gitDir(cwd) ?? join10(cwd, ".git"), "tamperward", "fsevents.jsonl");
+  return join11(gitDir(cwd) ?? join11(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -6934,12 +7015,12 @@ function watchTree(dir, cb) {
     if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
-      w = watch(rel ? join10(dir, rel) : dir, (kind, fname) => {
+      w = watch(rel ? join11(dir, rel) : dir, (kind, fname) => {
         if (!fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync(join10(dir, child)).isDirectory()) addDir(child);
+          if (statSync(join11(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -6952,7 +7033,7 @@ function watchTree(dir, cb) {
     addDir(rel);
     let names = [];
     try {
-      names = readdirSync2(rel ? join10(dir, rel) : dir);
+      names = readdirSync2(rel ? join11(dir, rel) : dir);
     } catch {
       return;
     }
@@ -6960,7 +7041,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync(join10(dir, child)).isDirectory()) walk2(child);
+        if (statSync(join11(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -6972,13 +7053,13 @@ function watchTree(dir, cb) {
 }
 function startWatcher(dir, log, policy) {
   try {
-    mkdirSync4(join10(log, ".."), { recursive: true });
+    mkdirSync4(join11(log, ".."), { recursive: true });
   } catch {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
     if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
-    const s = snap(join10(dir, rel));
+    const s = snap(join11(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
     last.set(rel, key2);
@@ -7005,7 +7086,7 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync9, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync10, statSync as statSync2 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
@@ -7015,7 +7096,7 @@ function readEvents(log, offset) {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync9(log, "utf8").slice(offset);
+  const raw = readFileSync10(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -7068,7 +7149,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync10(0, "utf8");
+    return readFileSync11(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7284,7 +7365,7 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   let dirty = false;
   for (const c of changes) {
     if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy)) continue;
-    const hash = createHash4("sha256").update(c.after).digest("hex").slice(0, 16);
+    const hash = createHash5("sha256").update(c.after).digest("hex").slice(0, 16);
     const prev = tree[c.path];
     tree[c.path] = {
       hash,
@@ -7321,10 +7402,10 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync7(log)) return none;
+  if (!existsSync8(log)) return none;
   let offset = 0;
-  if (cp && existsSync7(cp)) {
-    const n = Number(readFileSync10(cp, "utf8"));
+  if (cp && existsSync8(cp)) {
+    const n = Number(readFileSync11(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -7475,15 +7556,15 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join11, relative as relative3, resolve as resolve3 } from "node:path";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { createHash as createHash6 } from "node:crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
   try {
-    return execFileSync5("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+    return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
   } catch {
     return null;
   }
@@ -7491,6 +7572,8 @@ function gitConfig(cwd, key2) {
 var HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
 var SWEEP_RE = /\btamperward(?:@\S+)?\s+sweep\s+claude\b/;
 var PRECOMMIT_RE = /\btamperward(?:@\S+)?\s+check\s+--staged\b/;
+var LEGACY_OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
+var PRE_GLOBAL_OURS = /^\s*npx --yes --registry=https:\/\/registry\.npmjs\.org\/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward(?:@(\S+))? (hook claude|sweep claude|check --staged)\s*$/;
 var CODEOWNERS_MARK = "# tamperward: the gate cannot guard the file that defines it";
 var CODEOWNERS_PATHS = ["/.github/workflows/", "/.tamperward.yml", "/.github/CODEOWNERS"];
 function coveredBy(existing, critical) {
@@ -7535,12 +7618,16 @@ version: 1
 # ignore: []            # visible blind spots \u2014 the count is always reported
 `;
 function pinOf(command) {
-  const m = command.match(OURS);
+  const m = ours(command);
   return m ? m[1] ?? "" : null;
 }
+function ours(command) {
+  const previous = command.replace(" --global", "").replace(" || (echo tamperward: authority failed to start >&2 && exit 2)", "");
+  return command.match(OURS) ?? previous.match(PRE_GLOBAL_OURS) ?? command.match(LEGACY_OURS);
+}
 function stalePin(command) {
   const pin = pinOf(command);
-  return pin !== null && pin !== TW_VERSION;
+  return pin !== null && (pin !== TW_VERSION || !OURS.test(command));
 }
 var WORKFLOW_CONTENT = `name: tamperward
 
@@ -7564,22 +7651,20 @@ jobs:
   tamperward:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    # The gate is fetched from the registry AT GATE TIME, from inside the
-    # checked-out pull request \u2014 and \`npm\` reads \`.npmrc\` from the working
-    # directory. A PR that commits one line, \`registry=https://\u2026\`, chooses where
-    # the authority judging it is downloaded from; the version pin below pins the
-    # STRING, not the SOURCE. An environment variable outranks a project
-    # \`.npmrc\` in npm's config precedence, so this is what makes the pin mean
-    # something.
-    env:
-      NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
     steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0 # the range diff needs both endpoints
       - uses: actions/setup-node@v6
         with:
           node-version: 22
+      # Install the authority before candidate files exist in the job workspace.
+      # npm therefore cannot discover a pull-request .npmrc, and every security-
+      # relevant npm setting is fixed on the command line. Later steps invoke the
+      # installed binary directly: npm/npx never starts from candidate-controlled cwd.
+      - name: Install Tamperward authority
+        working-directory: \${{ runner.temp }}
+        run: npm install --global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward@${TW_VERSION}
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # the range diff needs both endpoints
       - name: Resolve out-of-band sign-off from PR labels
         id: oob
         env:
@@ -7594,7 +7679,7 @@ jobs:
           # across pushes, so an unbound one would clear every later finding on
           # the same PR. Labels must read tamperward:allow:<rule>@<head-sha>.
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
-        run: npx --yes tamperward@${TW_VERSION} check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
+        run: tamperward check --diff "\${{ github.event.pull_request.base.sha }}...\${{ github.event.pull_request.head.sha }}"
       # Diff-time detection is spelling-dependent by nature; pristine
       # re-execution is not, and it was the layer nothing got past in the
       # taskbench sweeps. Shipping a CI template WITHOUT it meant every
@@ -7612,12 +7697,12 @@ jobs:
           # stays red whatever the labels say.
           TAMPERWARD_OOB_SIGNOFF: \${{ steps.oob.outputs.rules }}
           TAMPERWARD_OOB_HEAD: \${{ github.event.pull_request.head.sha }}
-        run: npx --yes tamperward@${TW_VERSION} verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
+        run: tamperward verify --require-ancestor --base "\${{ github.event.pull_request.base.sha }}"
 `;
 var WORKFLOW_MARK = "# tamperward:generated";
 var WORKFLOW_MARK_RE = /^# tamperward:generated v(\S+) sha256:([0-9a-f]+)\n/m;
 function bodyHash(body) {
-  return createHash5("sha256").update(body).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(body).digest("hex").slice(0, 16);
 }
 function workflowFile(body) {
   return `${WORKFLOW_MARK} v${TW_VERSION} sha256:${bodyHash(body)}
@@ -7654,8 +7739,8 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join11(cwd, POLICY_FILE);
-  if (existsSync8(path)) {
+  const path = join12(cwd, POLICY_FILE);
+  if (existsSync9(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -7673,12 +7758,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join11(cwd, rel);
+  const path = join12(cwd, rel);
   let settings = {};
-  if (existsSync8(path)) {
+  if (existsSync9(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(path, "utf8"));
+      parsed = JSON.parse(readFileSync12(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -7713,7 +7798,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync8(path) ? "update" : "create",
+    status: existsSync9(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -7723,7 +7808,7 @@ function planClaudeHooks(cwd) {
     ].filter(Boolean).join(" + "),
     apply: () => {
       for (const h of repin) {
-        const kind = String(h.command ?? "").match(OURS)?.[2];
+        const kind = ours(String(h.command ?? ""))?.[2];
         h.command = kind === "hook claude" ? HOOK_CMD : kind === "sweep claude" ? SWEEP_CMD : h.command;
       }
       if (needPre) {
@@ -7770,15 +7855,15 @@ var MANAGED_HOOKS = [
 ];
 function hooksDir(cwd) {
   try {
-    const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const out2 = execFileSync6("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync8(join11(cwd, ".git")) ? join11(cwd, ".git", "hooks") : null;
+  return existsSync9(join12(cwd, ".git")) ? join12(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute8(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -7801,30 +7886,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync8(join11(cwd, ".husky"))) {
-    path = join11(cwd, ".husky", "pre-commit");
+  if (existsSync9(join12(cwd, ".husky"))) {
+    path = join12(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join11(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync9(join12(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
-      path = join11(dirname4(dir), "pre-commit");
+      path = join12(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join11(dir, "pre-commit");
+      path = join12(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join11(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join12(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
-  if (existsSync8(path) && !statSync3(path).isFile()) {
+  if (existsSync9(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync8(path) ? readFileSync11(path, "utf8") : null;
+  const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7868,8 +7953,8 @@ ${block.join("\n")}
     };
   }
   if (at !== -1) {
-    const ours = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
-    if (!ours) {
+    const ours2 = pinOf(lines[at]) !== null && lines[at - 1]?.trim() === MARKER;
+    if (!ours2) {
       return {
         item: "pre-commit",
         path: rel,
@@ -7913,10 +7998,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync8(join11(cwd, r))
+    (r) => existsSync9(join12(cwd, r))
   );
-  const path = join11(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync11(path, "utf8") : null;
+  const path = join12(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync12(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -7949,12 +8034,12 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join11(cwd, rel);
+  const path = join12(cwd, rel);
   const write = () => {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync8(path)) {
+  if (!existsSync9(path)) {
     return {
       item: "ci",
       path: rel,
@@ -7965,7 +8050,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync11(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -8068,75 +8153,29 @@ import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname5, join as join14, resolve as resolve4 } from "node:path";
 
-// src/git/trusted.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
-import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync12 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join12 } from "node:path";
-function trustedGitEnv() {
-  return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
-}
-function gitDirOf(cwd) {
-  try {
-    const d = execFileSync6("git", ["rev-parse", "--git-dir"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      env: trustedGitEnv()
-    }).trim();
-    if (!d) return null;
-    return isAbsolute8(d) ? d : join12(cwd, d);
-  } catch {
-    return null;
-  }
-}
-function objectRewriteState(cwd) {
-  const parts = [];
-  try {
-    parts.push(
-      "replace:" + execFileSync6("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
-        cwd,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"],
-        env: trustedGitEnv()
-      }).trim()
-    );
-  } catch {
-    parts.push("replace:<unreadable>");
-  }
-  const dir = gitDirOf(cwd);
-  for (const rel of ["info/grafts", "shallow"]) {
-    if (dir === null) {
-      parts.push(`${rel}:<no-git-dir>`);
-      continue;
-    }
-    const p = join12(dir, rel);
-    try {
-      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync12(p, "utf8").trim() : ""));
-    } catch {
-      parts.push(`${rel}:<unreadable>`);
-    }
-  }
-  return createHash6("sha256").update(parts.join("\n")).digest("hex");
-}
-
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
 import { join as join13 } from "node:path";
-function treeFingerprint(cwd) {
-  const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+function treeFingerprint(cwd, keepIgnored) {
+  const listed = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 1 << 28,
     env: trustedGitEnv()
-  }).split("\0").filter(Boolean).sort();
+  }).split("\0").filter(Boolean);
+  const files = [.../* @__PURE__ */ new Set([...listed, ...keepIgnored ? ignoredPaths({ cwd }, keepIgnored) : []])].sort();
   const h = createHash7("sha256");
   for (const rel of files) {
     h.update(rel);
     h.update("\0");
-    h.update(inspectRel(cwd, rel).content ?? "<unreadable>");
+    const entry = inspectRel(cwd, rel);
+    h.update(entry.kind);
+    h.update("\0");
+    h.update(String(entry.mode));
+    h.update("\0");
+    h.update(entry.content ?? `<${entry.kind}:${entry.detail}>`);
     h.update("\0");
   }
   return h.digest("hex");
@@ -8490,7 +8529,8 @@ function runVerify(opts) {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
   };
-  const treeBefore = treeFingerprint(cwd);
+  const protectedIgnored = (rel) => isProtected(rel, policy);
+  const treeBefore = treeFingerprint(cwd, protectedIgnored);
   const depsBefore = depsFingerprint(cwd);
   try {
     mkdirSync6(visDir);
@@ -8501,7 +8541,7 @@ function runVerify(opts) {
     return 2;
   }
   const visible = runSuite(visDir, cmd, budget);
-  if (treeFingerprint(cwd) !== treeBefore) {
+  if (treeFingerprint(cwd, protectedIgnored) !== treeBefore) {
     cleanup([visRoot]);
     out2("verify: the working tree changed while the visible suite was running \u2014 the pristine copy");
     out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
@@ -8529,7 +8569,7 @@ function runVerify(opts) {
   const overlayBefore = overlayDigest(priDir, restored);
   const pristine = runSuite(priDir, cmd, budget);
   const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
-  const treeMoved = treeFingerprint(cwd) !== treeBefore;
+  const treeMoved = treeFingerprint(cwd, protectedIgnored) !== treeBefore;
   const depsMoved = depsFingerprint(cwd) !== depsBefore;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
@@ -8626,7 +8666,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync as realpathSync3 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync3 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -8657,19 +8697,31 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   for (const pid of pids) {
     const n = Number(pid);
     if (n === process.pid) continue;
-    let held;
     try {
-      held = realpathSync3(`/proc/${pid}/cwd`);
+      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
+      const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
+      if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
       continue;
     }
-    if (held !== real && !held.startsWith(real + "/")) continue;
+    const procLinks = [`/proc/${pid}/cwd`, `/proc/${pid}/exe`];
     try {
-      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
-      const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
-      if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
+      for (const fd of readdirSync4(`/proc/${pid}/fd`)) procLinks.push(`/proc/${pid}/fd/${fd}`);
     } catch {
     }
+    let holds = false;
+    for (const link of procLinks) {
+      try {
+        const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
+        const held = raw.startsWith("/") ? resolve5(raw) : raw;
+        if (held === real || held.startsWith(real + "/")) {
+          holds = true;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (holds) out2.push(n);
   }
   return out2;
 }
@@ -8743,7 +8795,8 @@ tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEME
 tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMENT_FAILED`);
     return 1;
   }
-  const fpBefore = treeFingerprint(cwd);
+  const protectedIgnored = (rel) => isProtected(rel, frozenPolicy);
+  const fpBefore = treeFingerprint(cwd, protectedIgnored);
   let diffCode = 0;
   if (head !== base) {
     out(`
@@ -8760,7 +8813,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     } catch {
     }
   }
-  const mutatedDuringAdjudication = treeFingerprint(cwd) !== fpBefore;
+  const mutatedDuringAdjudication = treeFingerprint(cwd, protectedIgnored) !== fpBefore;
   if (mutatedDuringAdjudication) {
     err("tamperward run: the working tree changed while it was being adjudicated \u2014");
     err("the verdict below would describe a tree that no longer exists.");
@@ -8781,7 +8834,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err(`working tree (pid ${survivors.join(", ")}). A verdict cannot outlive the tree it describes.`);
   }
   const notQuiescent = mutatedDuringAdjudication || survivors.length > 0 || depsDrifted || rewrote;
-  const cannot = diffCode === 2 || workCode === 2 || verifyCode === 2;
+  const cannot = !notQuiescent && (diffCode === 2 || workCode === 2 || verifyCode === 2);
   const blocked = diffCode === 1 || workCode === 1 || verifyCode === 1 || notQuiescent;
   const enforcement = cannot ? 2 : blocked ? 1 : 0;
   const verdict2 = enforcement === 2 ? "CANNOT_ADJUDICATE (fail closed)" : rewrote ? "OBJECT_REWRITE \u2014 the base the checks read is not the base we anchored to" : depsDrifted ? "DEPENDENCY_DRIFT \u2014 the suite runner changed under the envelope" : notQuiescent ? "NOT_QUIESCENT \u2014 the tree moved, or something still holds it" : enforcement === 1 ? "ENFORCEMENT_FAILED \u2014 the tree the runtime released does not stand" : agentExit !== 0 ? `agent exited ${agentExit} (enforcement clean)` : "GREEN MEANS GREEN";