tamperward 2.10.7 → 2.10.9

package/dist/cli/index.js

@@ -1651,8 +1651,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve6) {
-  const obj = resolve6(expr);
+function metricsOf(expr, resolve7) {
+  const obj = resolve7(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1666,7 +1666,7 @@ function metricsOf(expr, resolve6) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve6(p.initializer));
+    const n = numericOf(resolve7(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1712,17 +1712,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve6 = resolverFor(sf);
+    const resolve7 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve6(node.initializer);
+          const init = resolve7(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve6);
+            const flat = metricsOf(init, resolve7);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1736,7 +1736,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve6);
+              const m = metricsOf(p.initializer, resolve7);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1769,18 +1769,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve6 = resolverFor(sf);
+    const resolve7 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve6(node.initializer));
+          const { items, opaque } = literals(resolve7(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve6(node.initializer));
+          const { items, opaque } = literals(resolve7(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -7663,7 +7663,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
       # Install the authority before candidate files exist in the job workspace.
@@ -7673,9 +7673,12 @@ jobs:
       - name: Install Tamperward authority
         working-directory: \${{ runner.temp }}
         run: npm install --global --registry=https://registry.npmjs.org/ --node-options=' ' --script-shell= --ignore-scripts --offline=false --prefer-online tamperward@${TW_VERSION}
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0 # the range diff needs both endpoints
+          # Candidate code runs later in this job. Do not leave the checkout
+          # token in .git/config where a verifier command can read/reuse it.
+          persist-credentials: false
       - name: Resolve out-of-band sign-off from PR labels
         id: oob
         env:
@@ -8160,16 +8163,14 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
-import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, realpathSync as realpathSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { createHash as createHash9 } from "node:crypto";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, isAbsolute as isAbsolute9, join as join14, relative as relative4, resolve as resolve4, sep } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute10, join as join14, relative as relative5, resolve as resolve5, sep as sep2 } from "node:path";
 
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
-import { join as join13 } from "node:path";
 function treeFingerprint(cwd, keepIgnored) {
   const listed = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -8192,45 +8193,359 @@ function treeFingerprint(cwd, keepIgnored) {
   }
   return h.digest("hex");
 }
-function depsFingerprint(cwd) {
-  const root = join13(cwd, "node_modules");
-  const h = createHash7("sha256");
-  const walk2 = (dir) => {
+
+// src/dependency-env.ts
+import { createHash as createHash8 } from "node:crypto";
+import {
+  existsSync as existsSync10,
+  lstatSync as lstatSync3,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync13,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync3,
+  statSync as statSync4
+} from "node:fs";
+import {
+  basename as basename3,
+  delimiter,
+  dirname as dirname5,
+  isAbsolute as isAbsolute9,
+  join as join13,
+  relative as relative4,
+  resolve as resolve4,
+  sep
+} from "node:path";
+var Unattestable = class extends Error {
+};
+function inside(root, candidate) {
+  const rel = relative4(resolve4(root), resolve4(candidate));
+  return rel === "" || rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute9(rel);
+}
+function modeKind(path) {
+  const st = lstatSync3(path);
+  if (st.isFile()) return { kind: "file", mode: st.mode };
+  if (st.isDirectory()) return { kind: "dir", mode: st.mode };
+  if (st.isSymbolicLink()) return { kind: "symlink", mode: st.mode };
+  return { kind: "special", mode: st.mode };
+}
+function fingerprintRoot(root, cwd, h) {
+  let rootStat;
+  let currentReal;
+  try {
+    rootStat = lstatSync3(root.path);
+    currentReal = realpathSync3(root.path);
+  } catch (e) {
+    throw new Unattestable(
+      root.kind + " root " + JSON.stringify(root.path) + " can no longer be resolved (" + (e instanceof Error ? e.message : String(e)) + ")"
+    );
+  }
+  if (currentReal !== root.realPath) {
+    throw new Unattestable(
+      root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
+    );
+  }
+  if (!statSync4(root.path).isDirectory()) {
+    throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
+  }
+  h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
+  if (rootStat.isSymbolicLink()) h.update(readlinkSync2(root.path) + "\0");
+  const cwdReal = realpathSync3(cwd);
+  const visited = /* @__PURE__ */ new Set();
+  const hashFile = (path, label) => {
+    let st;
+    try {
+      st = statSync4(path);
+      if (!st.isFile()) throw new Error("not a regular file");
+      h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
+      h.update(readFileSync13(path));
+      h.update("\0");
+    } catch (e) {
+      throw new Unattestable(
+        "dependency link target " + JSON.stringify(path) + " is not attestable (" + (e instanceof Error ? e.message : String(e)) + ")"
+      );
+    }
+  };
+  const walk2 = (dir, namespace) => {
+    const realDir = realpathSync3(dir);
+    if (visited.has(realDir)) return;
+    visited.add(realDir);
     let entries;
     try {
       entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
+    } catch (e) {
+      throw new Unattestable(
+        "dependency directory " + JSON.stringify(dir) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+      );
     }
-    for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join13(dir, e.name);
-      if (e.isDirectory()) walk2(p);
-      else if (e.isFile()) {
-        h.update(p);
+    for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join13(dir, entry.name);
+      const rel = namespace ? namespace + "/" + entry.name : entry.name;
+      let ident;
+      try {
+        ident = modeKind(path);
+      } catch (e) {
+        throw new Unattestable(
+          "dependency entry " + JSON.stringify(path) + " disappeared while attesting (" + (e instanceof Error ? e.message : String(e)) + ")"
+        );
+      }
+      h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
+      if (ident.kind === "file") {
         try {
-          h.update(readFileSync13(p));
-          h.update(String(statSync4(p).mode));
-        } catch {
-          h.update("<unreadable>");
+          h.update(readFileSync13(path));
+          h.update("\0");
+        } catch (e) {
+          throw new Unattestable(
+            "dependency file " + JSON.stringify(path) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+          );
+        }
+        continue;
+      }
+      if (ident.kind === "dir") {
+        walk2(path, rel);
+        continue;
+      }
+      if (ident.kind === "symlink") {
+        let target;
+        try {
+          target = readlinkSync2(path);
+        } catch (e) {
+          throw new Unattestable(
+            "dependency symlink " + JSON.stringify(path) + " cannot be read (" + (e instanceof Error ? e.message : String(e)) + ")"
+          );
         }
-      } else if (e.isSymbolicLink()) {
-        h.update(p);
+        h.update(target + "\0");
+        let resolved;
         try {
-          h.update(readlinkSync2(p));
+          resolved = realpathSync3(path);
         } catch {
-          h.update("<unreadable-link>");
+          continue;
+        }
+        const followed = statSync4(path);
+        if (followed.isFile()) {
+          hashFile(resolved, "@target:" + rel);
+          continue;
+        }
+        if (followed.isDirectory()) {
+          if (inside(root.realPath, resolved)) {
+            walk2(resolved, "@target:" + rel);
+            continue;
+          }
+          if (inside(cwdReal, resolved)) {
+            throw new Unattestable(
+              "dependency workspace symlink " + JSON.stringify(path) + " points into the candidate worktree at " + JSON.stringify(resolved) + "; faithful per-copy remapping is not available"
+            );
+          }
+          throw new Unattestable(
+            "dependency directory symlink " + JSON.stringify(path) + " escapes the bounded root to " + JSON.stringify(resolved)
+          );
         }
+        throw new Unattestable("dependency symlink " + JSON.stringify(path) + " resolves to a special file");
       }
+      throw new Unattestable("dependency entry " + JSON.stringify(path) + " is a special file");
     }
   };
-  try {
-    if (!statSync4(root).isDirectory()) return "none";
-  } catch {
-    return "none";
+  walk2(root.realPath, "");
+}
+function snapshot(roots, probes, cwd) {
+  const h = createHash8("sha256");
+  for (const probe of probes) {
+    h.update(
+      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync10(probe.path) ? "present" : "absent") + "\0"
+    );
   }
-  walk2(root);
+  for (const root of roots) fingerprintRoot(root, cwd, h);
   return h.digest("hex");
 }
+function freezeRoot(kind, path) {
+  try {
+    if (!statSync4(path).isDirectory()) {
+      throw new Error("not a directory");
+    }
+    return { kind, path: resolve4(path), realPath: realpathSync3(path) };
+  } catch (e) {
+    throw new Unattestable(
+      kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
+    );
+  }
+}
+function shellTokens(command) {
+  const matches = command.match(/(?:[^\s"'\\]+|"(?:\\.|[^"])*"|'[^']*')+/g) ?? [];
+  return matches.map((token) => {
+    if (token.startsWith("'") && token.endsWith("'") || token.startsWith('"') && token.endsWith('"')) return token.slice(1, -1);
+    return token;
+  });
+}
+function firstExecutable(command) {
+  const tokens2 = shellTokens(command);
+  let i = 0;
+  while (i < tokens2.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[i])) i++;
+  if (tokens2[i] === "env") {
+    i++;
+    while (i < tokens2.length && (tokens2[i].startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens2[i]))) i++;
+  }
+  if (tokens2[i] === "command") {
+    i++;
+    while (i < tokens2.length && tokens2[i].startsWith("-")) i++;
+  }
+  if (tokens2[i] === "timeout") {
+    i++;
+    while (i < tokens2.length && tokens2[i].startsWith("-")) i++;
+    if (i < tokens2.length) i++;
+  }
+  return tokens2[i] ?? null;
+}
+function resolveExecutable(token, cwd, env) {
+  if (!token) return null;
+  if (token.includes("/") || token.includes("\\")) {
+    const path = isAbsolute9(token) ? token : resolve4(cwd, token);
+    try {
+      return existsSync10(path) ? realpathSync3(path) : null;
+    } catch {
+      return null;
+    }
+  }
+  for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    const candidate = resolve4(entry, token);
+    try {
+      if (existsSync10(candidate) && statSync4(candidate).isFile()) return realpathSync3(candidate);
+    } catch {
+    }
+  }
+  return null;
+}
+function pythonName(name) {
+  return /^(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)$/.test(name.toLowerCase());
+}
+function looksPython(command, executable, token) {
+  const exe = executable ? basename3(executable) : "";
+  const raw = token ? basename3(token) : "";
+  if (pythonName(exe) || pythonName(raw)) return true;
+  return /(?:^|[\s;&|()])(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)(?=$|[\s;&|()])/.test(command);
+}
+function inferredVenvFromToken(token, cwd) {
+  if (!token || !token.includes("/") && !token.includes("\\")) return null;
+  const path = isAbsolute9(token) ? token : resolve4(cwd, token);
+  if (!pythonName(basename3(path))) return null;
+  const parent = dirname5(path);
+  const parentName = basename3(parent).toLowerCase();
+  if (parentName !== "bin" && parentName !== "scripts") return null;
+  const root = dirname5(parent);
+  return existsSync10(join13(root, "pyvenv.cfg")) ? root : null;
+}
+function unsupportedEcosystem(command, token) {
+  const name = token ? basename3(token).toLowerCase() : "";
+  const raw = command.toLowerCase();
+  if (["ruby", "bundle", "bundler", "rspec", "rake"].includes(name) || /(?:^|[\s;&|()])(?:bundle\s+exec|ruby|rspec|rake)(?=$|[\s;&|()])/.test(raw)) return "Ruby dependency environment discovery is not yet attestable";
+  if (["mvn", "mvnw", "gradle", "gradlew", "java"].includes(name) || /(?:^|[\s;&|()])(?:mvn|mvnw|gradle|gradlew|java)(?=$|[\s;&|()])/.test(raw)) return "JVM dependency environment discovery is not yet attestable";
+  if (name === "dotnet" || /(?:^|[\s;&|()])dotnet(?=$|[\s;&|()])/.test(raw)) return ".NET dependency environment discovery is not yet attestable";
+  return null;
+}
+function inferredVenv(executable) {
+  if (!executable) return null;
+  const parent = dirname5(executable);
+  const parentName = basename3(parent).toLowerCase();
+  if (parentName !== "bin" && parentName !== "scripts") return null;
+  const root = dirname5(parent);
+  return existsSync10(join13(root, "pyvenv.cfg")) ? root : null;
+}
+function venvProblem(root) {
+  const cfg = join13(root, "pyvenv.cfg");
+  if (!existsSync10(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
+  try {
+    const body = readFileSync13(cfg, "utf8");
+    if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
+      return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
+    }
+  } catch (e) {
+    return "cannot read " + JSON.stringify(cfg) + " (" + (e instanceof Error ? e.message : String(e)) + ")";
+  }
+  return null;
+}
+function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
+  const cwd = resolve4(cwdInput);
+  const roots = [];
+  const probes = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addRoot = (kind, path) => {
+    const root = freezeRoot(kind, path);
+    const key2 = kind + ":" + root.path;
+    if (!seen.has(key2)) {
+      roots.push(root);
+      seen.add(key2);
+    }
+  };
+  try {
+    const nodeModules = join13(cwd, "node_modules");
+    if (existsSync10(nodeModules)) addRoot("node_modules", nodeModules);
+    else probes.push({ kind: "node_modules", path: nodeModules });
+    const token = firstExecutable(command);
+    const executable = resolveExecutable(token, cwd, env);
+    let venv = null;
+    if (env.VIRTUAL_ENV?.trim()) {
+      if (!isAbsolute9(env.VIRTUAL_ENV)) {
+        throw new Unattestable("VIRTUAL_ENV is relative (" + JSON.stringify(env.VIRTUAL_ENV) + ")");
+      }
+      venv = resolve4(env.VIRTUAL_ENV);
+    } else {
+      venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
+      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync10(join13(cwd, ".venv", "pyvenv.cfg"))) {
+        venv = join13(cwd, ".venv");
+      }
+    }
+    if (venv) {
+      const problem = venvProblem(venv);
+      if (problem) throw new Unattestable(problem);
+      addRoot("python-venv", venv);
+    } else if (looksPython(command, executable, token)) {
+      throw new Unattestable(
+        "Python verifier selected without an identifiable virtual environment; global/user site-packages are not bounded"
+      );
+    }
+    const unsupported = unsupportedEcosystem(command, token);
+    if (unsupported) throw new Unattestable(unsupported);
+    const status = roots.length ? "attested" : "none";
+    const fingerprint2 = snapshot(roots, probes, cwd);
+    return { status, command, roots, probes, fingerprint: fingerprint2 };
+  } catch (e) {
+    return {
+      status: "unattestable",
+      command,
+      roots,
+      probes,
+      reason: e instanceof Error ? e.message : String(e)
+    };
+  }
+}
+function checkDependencyEnvironment(cwdInput, descriptor) {
+  if (descriptor.status === "unattestable") {
+    return { ok: false, reason: descriptor.reason ?? "dependency environment is not attestable" };
+  }
+  try {
+    const fingerprint2 = snapshot(descriptor.roots, descriptor.probes, resolve4(cwdInput));
+    if (fingerprint2 !== descriptor.fingerprint) {
+      return { ok: false, fingerprint: fingerprint2, reason: "dependency environment fingerprint changed" };
+    }
+    return { ok: true, fingerprint: fingerprint2 };
+  } catch (e) {
+    return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+function dependencyEnvironmentReport(descriptor) {
+  return {
+    status: descriptor.status,
+    roots: descriptor.roots.map((root) => ({ kind: root.kind, path: root.path })),
+    ...descriptor.fingerprint ? { fingerprint: descriptor.fingerprint } : {},
+    ...descriptor.reason ? { reason: descriptor.reason } : {}
+  };
+}
+function dependencyEnvironmentSummary(descriptor) {
+  if (descriptor.status === "unattestable") {
+    return "unattestable - " + (descriptor.reason ?? "unknown dependency environment");
+  }
+  if (descriptor.status === "none") return "none detected (candidate node_modules remains absent)";
+  const kinds = [...new Set(descriptor.roots.map((root) => root.kind))].join(", ");
+  return "attested " + kinds + " (sha256 " + (descriptor.fingerprint?.slice(0, 12) ?? "unknown") + "...)";
+}
 
 // src/cli/verify.ts
 var OVERLAY_CLASSES = ["tests", "snapshots", "config"];
@@ -8320,25 +8635,25 @@ function baseIsAncestorOfHead(base, cwd) {
   const r = spawnSync("git", ["merge-base", "--is-ancestor", base, "HEAD"], { cwd, env: trustedGitEnv() });
   return r.status === 0;
 }
-function inside(root, path) {
-  const rel = relative4(resolve4(root), resolve4(path));
-  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute9(rel);
+function inside2(root, path) {
+  const rel = relative5(resolve5(root), resolve5(path));
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute10(rel);
 }
 function linkParts(path) {
-  const parts = sep === "\\" ? path.split(/[\\/]+/) : path.split("/");
+  const parts = sep2 === "\\" ? path.split(/[\\/]+/) : path.split("/");
   return parts.filter((part) => part !== "" && part !== ".");
 }
 function linkEscape(label, target) {
   return new Error(`${label} is a symlink that escapes the materialised tree (${JSON.stringify(target)})`);
 }
 function driveRelativeLinkTarget(target) {
-  return sep === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
+  return sep2 === "\\" && /^[A-Za-z]:(?![\\/])/.test(target);
 }
 function rootedLinkTarget(target) {
-  return isAbsolute9(target) || driveRelativeLinkTarget(target);
+  return isAbsolute10(target) || driveRelativeLinkTarget(target);
 }
 function safeSymlink(target, out2, root, label) {
-  if (rootedLinkTarget(target) || !inside(root, resolve4(dirname5(out2), target))) {
+  if (rootedLinkTarget(target) || !inside2(root, resolve5(dirname6(out2), target))) {
     throw linkEscape(label, target);
   }
   rmSync3(out2, { force: true });
@@ -8346,7 +8661,7 @@ function safeSymlink(target, out2, root, label) {
 }
 function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
   let domain = "tree";
-  let stack = linkParts(relative4(root, dirname5(out2)));
+  let stack = linkParts(relative5(root, dirname6(out2)));
   const pending = linkParts(target);
   const seen = /* @__PURE__ */ new Set();
   let hops = 0;
@@ -8367,7 +8682,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     const current = join14(base, ...stack);
     let st;
     try {
-      st = lstatSync3(current);
+      st = lstatSync4(current);
     } catch {
       continue;
     }
@@ -8375,7 +8690,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     if (++hops > 128) {
       throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
     }
-    const key2 = `${domain}:${current}:${pending.join(sep)}`;
+    const key2 = `${domain}:${current}:${pending.join(sep2)}`;
     if (seen.has(key2)) {
       throw new Error(`${label} contains a symlink cycle while materialising (${JSON.stringify(target)})`);
     }
@@ -8385,12 +8700,12 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     if (driveRelativeLinkTarget(next)) {
       throw linkEscape(label, target);
     }
-    if (isAbsolute9(next)) {
-      if (domain === "tree" || !dependencyRoot || !inside(dependencyRoot, next)) {
+    if (isAbsolute10(next)) {
+      if (domain === "tree" || !dependencyRoot || !inside2(dependencyRoot, next)) {
         throw linkEscape(label, target);
       }
       stack = [];
-      pending.unshift(...linkParts(relative4(dependencyRoot, resolve4(next))));
+      pending.unshift(...linkParts(relative5(dependencyRoot, resolve5(next))));
     } else {
       pending.unshift(...linkParts(next));
     }
@@ -8403,16 +8718,16 @@ function rejectLinkedParent(cwd, rel) {
     current = join14(current, part);
     let st;
     try {
-      st = lstatSync3(current);
+      st = lstatSync4(current);
     } catch {
       continue;
     }
     if (st.isSymbolicLink()) {
-      throw new Error(`${rel} has a symlinked parent directory (${relative4(cwd, current)})`);
+      throw new Error(`${rel} has a symlinked parent directory (${relative5(cwd, current)})`);
     }
   }
 }
-function materialize(cwd, dest) {
+function materialize(cwd, dest, dependencyRoot) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   const links = [];
   for (const rel of listed) {
@@ -8420,12 +8735,12 @@ function materialize(cwd, dest) {
     rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = lstatSync3(src);
+      st = lstatSync4(src);
     } catch {
       continue;
     }
     const out2 = join14(dest, rel);
-    mkdirSync6(dirname5(out2), { recursive: true });
+    mkdirSync6(dirname6(out2), { recursive: true });
     dropSymlink(out2);
     if (st.isSymbolicLink()) {
       const target = readlinkSync3(src);
@@ -8438,17 +8753,14 @@ function materialize(cwd, dest) {
       throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
   }
-  const nm = resolve4(cwd, "node_modules");
-  let dependencyRoot = null;
-  if (existsSync10(nm)) dependencyRoot = realpathSync3(nm);
   for (const link of links) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, link.rel);
   }
-  if (dependencyRoot) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  if (dependencyRoot) symlinkSync(dependencyRoot, join14(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync3(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync4(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -8473,13 +8785,13 @@ function baseEntries(base, cwd) {
   });
 }
 function overlayDigest(dest, paths) {
-  const h = createHash8("sha256");
+  const h = createHash9("sha256");
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
     const p = join14(dest, rel);
     try {
-      const st = lstatSync3(p);
+      const st = lstatSync4(p);
       h.update(String(st.mode));
       h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync14(p));
     } catch {
@@ -8489,7 +8801,7 @@ function overlayDigest(dest, paths) {
   }
   return h.digest("hex");
 }
-function overlayPristine(cwd, base, dest, policy, cmd) {
+function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot) {
   const entries = baseEntries(base, cwd);
   const atBase = entries.map((e) => e.path);
   const verifierOwned = verifierInputs(cmd, atBase, policy);
@@ -8506,7 +8818,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out2 = join14(dest, e.path);
-    mkdirSync6(dirname5(out2), { recursive: true });
+    mkdirSync6(dirname6(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
@@ -8525,8 +8837,6 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     rmSync3(join14(dest, rel), { force: true });
     removed++;
   }
-  const nm = resolve4(cwd, "node_modules");
-  const dependencyRoot = existsSync10(nm) ? realpathSync3(nm) : null;
   for (const link of restoredLinks) {
     validateSymlinkGraph(link.target, link.out, dest, dependencyRoot, `the base's ${link.path}`);
   }
@@ -8638,6 +8948,22 @@ function runVerify(opts) {
     return 2;
   }
   const budget = opts.budget ?? policy.verify?.budget ?? 300;
+  const dependencyEnvironment = opts.dependencyEnvironment ?? discoverDependencyEnvironment(cwd, cmd);
+  const dependencyReport = () => dependencyEnvironmentReport(dependencyEnvironment);
+  if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
+    if (opts.json) {
+      out2(JSON.stringify({
+        verdict: "CANNOT_VERIFY",
+        reason: "DEPENDENCY_ENVIRONMENT_UNATTESTABLE",
+        dependency_environment: dependencyReport()
+      }));
+    } else {
+      out2("verify: dependency environment is not attestable \u2014 failing closed");
+      out2("verify: " + (dependencyEnvironment.reason ?? "unknown dependency environment"));
+    }
+    return 2;
+  }
+  const frozenNodeModules = dependencyEnvironment.roots.find((root) => root.kind === "node_modules")?.realPath ?? null;
   let base;
   try {
     base = resolveBase(opts.base ?? "HEAD", cwd);
@@ -8653,10 +8979,16 @@ function runVerify(opts) {
   };
   const protectedIgnored = (rel) => isProtected(rel, policy);
   const treeBefore = treeFingerprint(cwd, protectedIgnored);
-  const depsBefore = depsFingerprint(cwd);
+  const dependencyAtEntry = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  if (!dependencyAtEntry.ok && !opts.allowDepDrift) {
+    cleanup([visRoot]);
+    out2("verify: the frozen dependency environment changed before the visible suite ran \u2014");
+    out2((dependencyAtEntry.reason ?? "dependency identity changed") + ". Failing closed, not open.");
+    return 2;
+  }
   try {
     mkdirSync6(visDir);
-    materialize(cwd, visDir);
+    materialize(cwd, visDir, frozenNodeModules);
   } catch (e) {
     cleanup([visRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
@@ -8669,10 +9001,11 @@ function runVerify(opts) {
     out2("would be materialised from a tree the candidate just edited. Failing closed, not open.");
     return 2;
   }
-  if (depsFingerprint(cwd) !== depsBefore) {
+  const dependencyAfterVisible = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  if (!dependencyAfterVisible.ok && !opts.allowDepDrift) {
     cleanup([visRoot]);
-    out2("verify: the installed dependency tree changed while the visible suite was running \u2014 the");
-    out2("pristine run executes through it too. Failing closed, not open.");
+    out2("verify: the frozen dependency environment changed while the visible suite was running \u2014");
+    out2((dependencyAfterVisible.reason ?? "dependency identity changed") + ". Failing closed, not open.");
     return 2;
   }
   const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
@@ -8681,8 +9014,15 @@ function runVerify(opts) {
   let removedAdded = 0;
   try {
     mkdirSync6(priDir);
-    materialize(cwd, priDir);
-    ({ restored, removed: removedAdded } = overlayPristine(cwd, base, priDir, policy, cmd));
+    materialize(cwd, priDir, frozenNodeModules);
+    ({ restored, removed: removedAdded } = overlayPristine(
+      cwd,
+      base,
+      priDir,
+      policy,
+      cmd,
+      frozenNodeModules
+    ));
   } catch (e) {
     cleanup([visRoot, priRoot]);
     out2(`verify: could not materialize (${e instanceof Error ? e.message : String(e)}) \u2014 failing closed`);
@@ -8692,11 +9032,12 @@ function runVerify(opts) {
   const pristine = runSuite(priDir, cmd, budget);
   const overlayMoved = overlayDigest(priDir, restored) !== overlayBefore;
   const treeMoved = treeFingerprint(cwd, protectedIgnored) !== treeBefore;
-  const depsMoved = depsFingerprint(cwd) !== depsBefore;
+  const dependencyAfterPristine = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const depsMoved = !dependencyAfterPristine.ok && !opts.allowDepDrift;
   cleanup([visRoot, priRoot]);
   if (overlayMoved || treeMoved || depsMoved) {
     out2(
-      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the installed dependency tree changed while the pristine suite was running") + " \u2014"
+      "verify: " + (overlayMoved ? "a restored file in the pristine copy changed while the pristine suite was running" : treeMoved ? "the working tree changed while the pristine suite was running" : "the frozen dependency environment changed while the pristine suite was running") + " \u2014"
     );
     out2("the verdict would describe something other than what ran. Failing closed, not open.");
     out2("(A suite that rewrites its own snapshots or test files in place will trip this; run it in");
@@ -8731,6 +9072,7 @@ function runVerify(opts) {
         pristine: { exit: pristine.exit, secs: pristine.secs },
         protected_restored: restored.length,
         added_protected_removed: removedAdded,
+        dependency_environment: dependencyReport(),
         ...signedOff ? { oob_signoff: signedOff } : {},
         ...opts.keep ? { visible_dir: visDir, pristine_dir: priDir } : {}
       })
@@ -8743,6 +9085,7 @@ function runVerify(opts) {
       BUDGET_EXCEEDED: `budget exceeded (${budget}s): could not verify \u2014 failing closed, not open.`
     };
     out2(`tamperward verify \u2014 ${lines[verdict2]}`);
+    out2(`dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}` + (opts.allowDepDrift && dependencyEnvironment.status === "unattestable" ? " (operator override)" : ""));
     if (signedOff)
       out2(
         `masked failure cleared by out-of-band approval (tamperward:allow:${signedOff}): a reviewer accepted that the original suite no longer applies to this change. Exit 0.`
@@ -8788,8 +9131,8 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync4 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, readlinkSync as readlinkSync4, realpathSync as realpathSync5 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -8806,7 +9149,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync4(cwd);
+    real = realpathSync5(cwd);
   } catch {
     return out2;
   }
@@ -8835,7 +9178,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     for (const link of procLinks) {
       try {
         const raw = readlinkSync4(link).replace(/ \(deleted\)$/, "");
-        const held = raw.startsWith("/") ? resolve5(raw) : raw;
+        const held = raw.startsWith("/") ? resolve6(raw) : raw;
         if (held === real || held.startsWith(real + "/")) {
           holds = true;
           break;
@@ -8848,7 +9191,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve5(opts.cwd ?? process.cwd());
+  const cwd = resolve6(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;
@@ -8884,8 +9227,15 @@ function runEnvelope(opts) {
       return 2;
     }
   }
+  const dependencyEnvironment = discoverDependencyEnvironment(cwd, frozenCmd);
   out(`tamperward run \u2014 trusted base ${base.slice(0, 10)}; agent exit is untrusted.`);
-  const depsBefore = depsFingerprint(cwd);
+  out(`tamperward run \u2014 dependency environment: ${dependencyEnvironmentSummary(dependencyEnvironment)}`);
+  if (dependencyEnvironment.status === "unattestable" && !opts.allowDepDrift) {
+    err("tamperward run: the verifier dependency environment cannot be attested \u2014");
+    err(`${dependencyEnvironment.reason ?? "unknown dependency environment"}. Failing closed before the agent starts.`);
+    err("(Pass --allow-dep-drift only if you explicitly own this dependency-integrity risk.)");
+    return 2;
+  }
   const rewritesBefore = objectRewriteState(cwd);
   const spawnTicks = nowTicks();
   const agent = spawnSync2(opts.argv[0], opts.argv.slice(1), { cwd, stdio: "inherit" });
@@ -8898,9 +9248,10 @@ function runEnvelope(opts) {
 tamperward run \u2014 agent exit ${agentExit}; OBJECT_REWRITE \u2192 ENFORCEMENT_FAILED`);
     return 1;
   }
-  if (depsFingerprint(cwd) !== depsBefore) {
-    err("tamperward run: the installed dependency tree changed before adjudication began \u2014 the program");
-    err("that runs the suite is not the one we started with, and both verification runs execute it.");
+  const dependencyBeforeAdjudication = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  if (!dependencyBeforeAdjudication.ok) {
+    err("tamperward run: the frozen dependency environment changed before adjudication began \u2014");
+    err(`${dependencyBeforeAdjudication.reason ?? "dependency identity changed"}.`);
     if (!opts.allowDepDrift) {
       out(`
 tamperward run \u2014 agent exit ${agentExit}; DEPENDENCY_DRIFT \u2192 ENFORCEMENT_FAILED`);
@@ -8928,7 +9279,15 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   out("\n[envelope] policy check over the working tree (frozen policy, untracked included, no local ledger):");
   const workCode = runCheck({ worktree: true, cwd, policyOverride: frozenPolicy, includeUntracked: true, ciLayer: true });
   out("\n[envelope] pristine verification against the trusted base:");
-  const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
+  const verifyCode = runVerify({
+    cwd,
+    base,
+    cmd: frozenCmd,
+    budget: frozenBudget,
+    policyOverride: frozenPolicy,
+    dependencyEnvironment,
+    allowDepDrift: opts.allowDepDrift
+  });
   if (opts.settle && opts.settle > 0) {
     try {
       execFileSync9("sleep", [String(opts.settle)]);
@@ -8940,10 +9299,11 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
     err("tamperward run: the working tree changed while it was being adjudicated \u2014");
     err("the verdict below would describe a tree that no longer exists.");
   }
-  const depsDrifted = !opts.allowDepDrift && depsFingerprint(cwd) !== depsBefore;
+  const dependencyAfter = checkDependencyEnvironment(cwd, dependencyEnvironment);
+  const depsDrifted = !opts.allowDepDrift && !dependencyAfter.ok;
   if (depsDrifted) {
-    err("tamperward run: the installed dependency tree changed during this run \u2014 the program that");
-    err("runs the suite is not the one we started with. Both verification runs execute it.");
+    err("tamperward run: the frozen dependency environment changed during this run \u2014");
+    err(`${dependencyAfter.reason ?? "dependency identity changed"}. Both verification runs depend on it.`);
   }
   const rewrote = objectRewriteState(cwd) !== rewritesBefore;
   if (rewrote) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.10.7",
+  "version": "2.10.9",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",