tamperward 2.13.1 → 2.13.2

package/dist/cli/index.js

@@ -7025,7 +7025,7 @@ function dropTurnTree(cwd, sessionId) {
 }
 
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
+import { appendFileSync as appendFileSync3, lstatSync as lstatSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, watch } from "node:fs";
 import { join as join11 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
@@ -7060,7 +7060,7 @@ function watchTree(dir, cb) {
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync(join11(dir, child)).isDirectory()) addDir(child);
+          if (lstatSync3(join11(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -7081,7 +7081,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync(join11(dir, child)).isDirectory()) walk2(child);
+        if (lstatSync3(join11(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -7126,12 +7126,12 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync10, statSync } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
   try {
-    size = statSync2(log).size;
+    size = statSync(log).size;
   } catch {
     return { events: [], newOffset: offset };
   }
@@ -7598,7 +7598,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 
 // src/verifier-limits.ts
@@ -7985,7 +7985,7 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync9(path) && !statSync3(path).isFile()) {
+  if (existsSync9(path) && !statSync2(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
   const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
@@ -8535,7 +8535,7 @@ function runDoctor(opts = {}) {
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join16, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
 
@@ -8569,12 +8569,12 @@ function treeFingerprint(cwd, keepIgnored) {
 import { createHash as createHash8 } from "node:crypto";
 import {
   existsSync as existsSync11,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   readdirSync as readdirSync4,
   readFileSync as readFileSync14,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
-  statSync as statSync4
+  statSync as statSync3
 } from "node:fs";
 import {
   basename as basename3,
@@ -8593,7 +8593,7 @@ function inside(root, candidate) {
   return rel === "" || rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute9(rel);
 }
 function modeKind(path) {
-  const st = lstatSync3(path);
+  const st = lstatSync4(path);
   if (st.isFile()) return { kind: "file", mode: st.mode };
   if (st.isDirectory()) return { kind: "dir", mode: st.mode };
   if (st.isSymbolicLink()) return { kind: "symlink", mode: st.mode };
@@ -8603,7 +8603,7 @@ function fingerprintRoot(root, cwd, h) {
   let rootStat;
   let currentReal;
   try {
-    rootStat = lstatSync3(root.path);
+    rootStat = lstatSync4(root.path);
     currentReal = realpathSync3(root.path);
   } catch (e) {
     throw new Unattestable(
@@ -8615,7 +8615,7 @@ function fingerprintRoot(root, cwd, h) {
       root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
     );
   }
-  if (!statSync4(root.path).isDirectory()) {
+  if (!statSync3(root.path).isDirectory()) {
     throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
@@ -8625,7 +8625,7 @@ function fingerprintRoot(root, cwd, h) {
   const hashFile = (path, label) => {
     let st;
     try {
-      st = statSync4(path);
+      st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
       h.update(readFileSync14(path));
@@ -8691,7 +8691,7 @@ function fingerprintRoot(root, cwd, h) {
         } catch {
           continue;
         }
-        const followed = statSync4(path);
+        const followed = statSync3(path);
         if (followed.isFile()) {
           hashFile(resolved, "@target:" + rel);
           continue;
@@ -8729,7 +8729,7 @@ function snapshot(roots, probes, cwd) {
 }
 function freezeRoot(kind, path) {
   try {
-    if (!statSync4(path).isDirectory()) {
+    if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
     return { kind, path: resolve5(path), realPath: realpathSync3(path) };
@@ -8778,7 +8778,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync11(candidate) && statSync4(candidate).isFile()) return realpathSync3(candidate);
+      if (existsSync11(candidate) && statSync3(candidate).isFile()) return realpathSync3(candidate);
     } catch {
     }
   }
@@ -8921,7 +8921,7 @@ function dependencyEnvironmentSummary(descriptor) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync5 } from "node:fs";
+import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join15, resolve as resolve6 } from "node:path";
 var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
   memoryBytes: 2 * 1024 * 1024 * 1024,
@@ -8939,7 +8939,7 @@ function identity() {
 }
 function writableByCaller(path) {
   try {
-    const st = statSync5(path);
+    const st = statSync4(path);
     const { uid, groups } = identity();
     if (uid === 0) return true;
     if ((st.mode & 2) !== 0) return true;
@@ -9512,7 +9512,7 @@ function validateSymlinkGraph(target, out2, root, dependencyRoot, label) {
     const current = join16(base, ...stack);
     let st;
     try {
-      st = lstatSync4(current);
+      st = lstatSync5(current);
     } catch {
       continue;
     }
@@ -9548,7 +9548,7 @@ function rejectLinkedParent(cwd, rel) {
     current = join16(current, part);
     let st;
     try {
-      st = lstatSync4(current);
+      st = lstatSync5(current);
     } catch {
       continue;
     }
@@ -9565,7 +9565,7 @@ function materialize(cwd, dest, dependencyRoot) {
     rejectLinkedParent(cwd, rel);
     let st;
     try {
-      st = lstatSync4(src);
+      st = lstatSync5(src);
     } catch {
       continue;
     }
@@ -9590,7 +9590,7 @@ function materialize(cwd, dest, dependencyRoot) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync4(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync5(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -9621,7 +9621,7 @@ function overlayDigest(dest, paths) {
     h.update("\0");
     const p = join16(dest, rel);
     try {
-      const st = lstatSync4(p);
+      const st = lstatSync5(p);
       h.update(String(st.mode));
       h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.13.1",
+  "version": "2.13.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",