tamperward 2.15.1 → 2.15.2

package/README.md

@@ -167,6 +167,19 @@ observer down deterministically. Observer health remains advisory; transient fin
 remain warnings by default and affect the envelope only when the operator explicitly
 sets `TAMPERWARD_TRANSIENT=block`.
 
+Since **2.15.2**, Stop-sweep event consumption uses the saved cursor as a real byte
+offset: it performs positioned reads of only new JSONL bytes instead of decoding the
+whole historical log on every turn. Each physical read is capped at **4 MiB**, and one
+authority decision drains at most **16 MiB** in bounded chunks. Only complete
+newline-terminated records advance the cursor, so a torn final watcher write is replayed
+after completion instead of being lost. Stop commits the cursor only after the entire
+bounded telemetry tail has been parsed and classified; malformed records, an oversized
+single record, a torn tail, or telemetry beyond the 16 MiB aggregate ceiling blocks Stop
+and retains the previous cursor rather than certifying unjudged bytes. Supervised
+`run --observe-transients` keeps observer evidence advisory by default, but when
+`TAMPERWARD_TRANSIENT=block` is explicitly enabled, any unclassified observer tail
+also fails the envelope closed.
+
 After the runtime exits its exit code is treated as untrusted, and the envelope
 checks that post-agent `HEAD` still descends from the entry commit; the committed
 changes over `entry...HEAD`; staged, unstaged and untracked non-ignored worktree

package/dist/cli/index.js

@@ -6829,7 +6829,7 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
 
 // src/adapters/claude/deny.ts
@@ -7253,26 +7253,200 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
 var RULE11 = "transient-protected-mutation";
-function readEvents(log, offset) {
+var MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
+var MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
+var DEFAULT_EVENT_READ_IO = {
+  read: (fd, buffer, bufferOffset, length, position) => readSync2(fd, buffer, bufferOffset, length, position)
+};
+function readEvents(log, offset, maxBytes = MAX_EVENT_READ_BYTES, io = DEFAULT_EVENT_READ_IO) {
   let size = 0;
   try {
     size = statSync(log).size;
   } catch {
-    return { events: [], newOffset: offset };
+    return {
+      events: [],
+      newOffset: Math.max(0, Number.isFinite(offset) ? Math.floor(offset) : 0),
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  let start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  if (start > size) start = 0;
+  if (size <= start) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: false,
+      malformedLines: 0,
+      incompleteTail: false
+    };
+  }
+  const cap = Number.isFinite(maxBytes) && maxBytes > 0 ? Math.max(1, Math.floor(maxBytes)) : MAX_EVENT_READ_BYTES;
+  const available = size - start;
+  const requested = Math.min(available, cap);
+  const buffer = Buffer.allocUnsafe(requested);
+  const fd = openSync2(log, "r");
+  let bytesRead = 0;
+  try {
+    bytesRead = io.read(fd, buffer, 0, requested, start);
+  } finally {
+    closeSync2(fd);
+  }
+  if (bytesRead <= 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead: 0,
+      limitReached: available > 0,
+      malformedLines: 0,
+      incompleteTail: available > 0
+    };
+  }
+  const chunk = buffer.subarray(0, bytesRead);
+  const lastNewline = chunk.lastIndexOf(10);
+  const limitReached = start + bytesRead < size;
+  if (lastNewline < 0) {
+    return {
+      events: [],
+      newOffset: start,
+      bytesRead,
+      limitReached,
+      malformedLines: 0,
+      incompleteTail: true
+    };
   }
-  if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync10(log, "utf8").slice(offset);
   const events = [];
-  for (const line of raw.split("\n")) {
+  let malformedLines = 0;
+  const complete = chunk.subarray(0, lastNewline + 1).toString("utf8");
+  for (const line of complete.split("\n")) {
     if (!line.trim()) continue;
     try {
       events.push(JSON.parse(line));
     } catch {
+      malformedLines++;
     }
   }
-  return { events, newOffset: size };
+  const newOffset = start + lastNewline + 1;
+  return {
+    events,
+    newOffset,
+    bytesRead,
+    limitReached,
+    malformedLines,
+    incompleteTail: newOffset < start + bytesRead
+  };
+}
+function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DEFAULT_EVENT_READ_IO) {
+  const start = Number.isFinite(offset) ? Math.max(0, Math.floor(offset)) : 0;
+  const aggregateCap = Number.isFinite(maxTotalBytes) && maxTotalBytes > 0 ? Math.max(1, Math.floor(maxTotalBytes)) : MAX_EVENT_SWEEP_BYTES;
+  const events = [];
+  let cursor = start;
+  let bytesRead = 0;
+  let batches = 0;
+  let malformedLines = 0;
+  while (bytesRead < aggregateCap) {
+    const remainingBudget = aggregateCap - bytesRead;
+    const batch = readEvents(
+      log,
+      cursor,
+      Math.min(MAX_EVENT_READ_BYTES, remainingBudget),
+      io
+    );
+    batches++;
+    bytesRead += batch.bytesRead;
+    malformedLines += batch.malformedLines;
+    events.push(...batch.events);
+    if (batch.malformedLines > 0) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "malformed-record"
+      };
+    }
+    if (batch.bytesRead === 0) {
+      if (batch.limitReached || batch.incompleteTail) {
+        return {
+          events,
+          newOffset: cursor,
+          bytesRead,
+          batches,
+          malformedLines,
+          complete: false,
+          issue: "read-stalled"
+        };
+      }
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (batch.limitReached && batch.newOffset === cursor) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "oversized-record"
+      };
+    }
+    if (!batch.limitReached && batch.incompleteTail) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "incomplete-record"
+      };
+    }
+    cursor = batch.newOffset;
+    if (!batch.limitReached) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: true
+      };
+    }
+    if (bytesRead >= aggregateCap) {
+      return {
+        events,
+        newOffset: cursor,
+        bytesRead,
+        batches,
+        malformedLines,
+        complete: false,
+        issue: "aggregate-limit"
+      };
+    }
+  }
+  return {
+    events,
+    newOffset: cursor,
+    bytesRead,
+    batches,
+    malformedLines,
+    complete: false,
+    issue: "aggregate-limit"
+  };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
   if (!isEnabled(RULE11, policy)) return [];
@@ -7316,7 +7490,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -7564,6 +7738,17 @@ function cursorPath(cwd, sessionId) {
   const p = ptreePath(cwd, sessionId);
   return p ? p.replace(/ptree-/, "fscursor-") : null;
 }
+function observerIntegrityBlock(issue, bytesRead, malformedLines) {
+  const detail = issue === "malformed-record" ? `${malformedLines} malformed complete JSONL record(s)` : issue === "oversized-record" ? `one event record exceeded the ${MAX_EVENT_READ_BYTES}-byte per-record/read ceiling` : issue === "incomplete-record" ? "the event log ended with an incomplete JSONL record" : issue === "aggregate-limit" ? `more than ${MAX_EVENT_SWEEP_BYTES} observer bytes required classification in one Stop sweep` : "the positioned event-log read made no safe progress";
+  return {
+    rule: "tamperward-unavailable",
+    severity: "block",
+    message: `TamperWard could not fully classify transient observer telemetry (${detail}), so Stop is blocked rather than certifying an unjudged tail.`,
+    evidence: `observer_issue=${issue}; bytes_read=${bytesRead}; malformed_lines=${malformedLines}`,
+    remediation: "Let the watcher finish its current record or repair/rotate the malformed observer log, then retry Stop. Do not delete the cursor/log to bypass unjudged telemetry.",
+    signoff: { required: true, command: 'tamperward allow --reason "..."' }
+  };
+}
 function turnTransientBlocks(cwd, sessionId, policy, changes) {
   const none = { blocks: [], commit: () => {
   } };
@@ -7576,16 +7761,34 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync8(log)) return none;
   let offset = 0;
   if (cp && existsSync8(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
+    const n = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
-  const { events, newOffset } = readEvents(log, offset);
-  if (events.length === 0) return { ...none, commit: () => {
-    if (cp) try {
-      writeFileSync5(cp, String(newOffset));
-    } catch {
-    }
-  } };
+  const drained = drainEvents(log, offset);
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    recordObserverHealth(
+      "degraded",
+      `event telemetry was not fully classified (${issue}); Stop retained the prior cursor`
+    );
+    return {
+      blocks: [observerIntegrityBlock(issue, drained.bytesRead, drained.malformedLines)],
+      commit: () => {
+      }
+    };
+  }
+  const { events, newOffset } = drained;
+  if (events.length === 0) {
+    return {
+      ...none,
+      commit: () => {
+        if (cp) try {
+          writeFileSync5(cp, String(newOffset));
+        } catch {
+        }
+      }
+    };
+  }
   const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -7742,7 +7945,7 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6, chmodSync, statSync as statSync2 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join12, relative as relative3, resolve as resolve3 } from "node:path";
 
 // src/verifier-limits.ts
@@ -7986,7 +8189,7 @@ function planClaudeHooks(cwd) {
   if (existsSync9(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -8132,7 +8335,7 @@ function planPreCommit(cwd) {
   if (existsSync9(path) && !statSync2(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync9(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync9(path) ? readFileSync11(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -8224,7 +8427,7 @@ function planCodeowners(cwd) {
     (r) => existsSync9(join12(cwd, r))
   );
   const path = join12(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const existing = existingRel ? readFileSync11(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -8273,7 +8476,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync11(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -8372,7 +8575,7 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync13, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync12, readdirSync as readdirSync3 } from "node:fs";
 import { join as join13, resolve as resolve4 } from "node:path";
 import { parse as parse3 } from "yaml";
 var VERIFY_COMMAND = /\btamperward(?:@\S+)?\s+verify\b/;
@@ -8410,7 +8613,7 @@ function pinsInFile(path) {
   if (!existsSync10(path)) return [];
   let src = "";
   try {
-    src = readFileSync13(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return [];
   }
@@ -8437,7 +8640,7 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
     }
     let doc;
     try {
-      doc = parse3(readFileSync13(path, "utf8"));
+      doc = parse3(readFileSync12(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -8843,7 +9046,7 @@ function runDoctor(opts = {}) {
     }
     let doc;
     try {
-      doc = parse3(readFileSync13(workflowPath, "utf8"));
+      doc = parse3(readFileSync12(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -8951,7 +9154,7 @@ function runDoctor(opts = {}) {
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync3, symlinkSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join16, relative as relative5, resolve as resolve7, sep as sep2 } from "node:path";
 
@@ -8987,7 +9190,7 @@ import {
   existsSync as existsSync11,
   lstatSync as lstatSync4,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
   statSync as statSync3
@@ -9044,7 +9247,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync14(path));
+      h.update(readFileSync13(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -9078,7 +9281,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync14(path));
+          h.update(readFileSync13(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -9239,7 +9442,7 @@ function venvProblem(root) {
   const cfg = join14(root, "pyvenv.cfg");
   if (!existsSync11(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync14(cfg, "utf8");
+    const body = readFileSync13(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -9337,7 +9540,7 @@ function dependencyEnvironmentSummary(descriptor) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { accessSync, constants as constants2, readFileSync as readFileSync14, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join15, resolve as resolve6 } from "node:path";
 var DEFAULT_CONTAINER_RESOURCE_LIMITS = Object.freeze({
   memoryBytes: 2 * 1024 * 1024 * 1024,
@@ -9391,7 +9594,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash9("sha256").update(readFileSync15(path)).digest("hex");
+  return createHash9("sha256").update(readFileSync14(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -10039,7 +10242,7 @@ function overlayDigest(dest, paths) {
     try {
       const st = lstatSync5(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
     } catch {
       h.update("<gone>");
     }
@@ -10150,7 +10353,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync16(outFile, "utf8"));
+      r = JSON.parse(readFileSync15(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -10453,7 +10656,7 @@ function parseVerify(args) {
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync3 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync6, rmSync as rmSync4 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join17, resolve as resolve8 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
@@ -10575,7 +10778,7 @@ function linuxDescendantPids(rootPid) {
   for (const name of names) {
     const pid = Number(name);
     try {
-      const stat = readFileSync17(`/proc/${name}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${name}/stat`, "utf8");
       const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
       const ppid = Number(fields[1]);
       if (!Number.isFinite(ppid)) continue;
@@ -10644,7 +10847,7 @@ function runAgentWithBudget(argv2, cwd, budgetSecs) {
     supervisorTimedOut = Boolean(supervisor.error) && supervisor.error.code === "ETIMEDOUT";
     let state = {};
     try {
-      state = JSON.parse(readFileSync17(resultFile, "utf8"));
+      state = JSON.parse(readFileSync16(resultFile, "utf8"));
     } catch {
     }
     if (supervisorTimedOut || state.timedOut) {
@@ -10758,7 +10961,16 @@ function observerSummary(observer, telemetry) {
 }
 function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
   observerSummary(observer, telemetry);
-  const { events } = readEvents(observer.log, 0);
+  const strict = process.env.TAMPERWARD_TRANSIENT === "block";
+  const drained = drainEvents(observer.log, 0);
+  const { events } = drained;
+  if (!drained.complete) {
+    const issue = drained.issue ?? "read-stalled";
+    out(
+      `tamperward run \u2014 transient observer: telemetry was not fully classified (${issue}; ${drained.bytesRead}/${MAX_EVENT_SWEEP_BYTES} bytes read). ` + (strict ? "Strict transient policy fails closed." : "Observer telemetry remains advisory, so this degrades evidence but does not independently fail the envelope.")
+    );
+    if (strict) return { blocking: true };
+  }
   if (events.length === 0) return { blocking: false };
   let persistent = /* @__PURE__ */ new Set();
   try {
@@ -10771,9 +10983,9 @@ function collectObserverFindings(observer, telemetry, cwd, base, head, policy) {
     );
   } catch (e) {
     out(
-      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).`
+      `tamperward run \u2014 transient observer: recorded ${events.length} event(s), but could not classify them against the final diff (${e instanceof Error ? e.message : String(e)}).` + (strict ? " Strict transient policy fails closed." : "")
     );
-    return { blocking: false };
+    return { blocking: strict };
   }
   const finalHash = (path) => {
     const e = inspectRel(cwd, path);
@@ -10797,7 +11009,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -10820,7 +11032,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n = Number(pid);
     if (n === process.pid) continue;
     try {
-      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.15.1",
+  "version": "2.15.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",