tamperward 2.23.10 → 2.23.12

package/dist/cli/index.js

@@ -1026,7 +1026,7 @@ var init_trusted = __esm({
 
 // src/repo-context.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
+import { accessSync, constants as constants2, existsSync as existsSync2, statSync } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve } from "node:path";
 function rev(cwd, flag) {
   try {
@@ -1059,6 +1059,47 @@ function repoContext(cwd) {
 function repoRoot(cwd) {
   return repoContext(cwd)?.root ?? cwd;
 }
+function outsideRepository(cwd) {
+  const key2 = resolve(cwd);
+  let isDir;
+  try {
+    isDir = statSync(key2).isDirectory();
+  } catch (e) {
+    return `cwd ${key2} cannot be read: ${errCode2(e)}`;
+  }
+  if (!isDir) return `cwd ${key2} is not a directory`;
+  try {
+    accessSync(key2, constants2.R_OK | constants2.X_OK);
+  } catch (e) {
+    return `cwd ${key2} cannot be read: ${errCode2(e)}`;
+  }
+  try {
+    execFileSync2("git", ["rev-parse", "--git-dir"], {
+      cwd: key2,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (e) {
+    const detail = errDetail(e);
+    if (/not a git repository/i.test(detail)) return null;
+    return `git could not resolve cwd ${key2}: ${detail || "unknown failure"}`;
+  }
+  return `cwd ${key2} lies in a repository with no working tree the gate can judge`;
+}
+function errCode2(e) {
+  if (typeof e === "object" && e !== null) {
+    const code2 = Reflect.get(e, "code");
+    if (typeof code2 === "string") return code2;
+  }
+  return e instanceof Error ? e.message : String(e);
+}
+function errDetail(e) {
+  if (typeof e === "object" && e !== null) {
+    const stderr = Reflect.get(e, "stderr");
+    if (typeof stderr === "string" && stderr.trim()) return stderr.replace(/\s+/g, " ").trim();
+  }
+  return errCode2(e);
+}
 var cache, CACHE_MAX;
 var init_repo_context = __esm({
   "src/repo-context.ts"() {
@@ -4890,13 +4931,7 @@ var init_hook_wiring = __esm({
   }
 });
 
-// src/detectors/ci-tampering.ts
-function isActiveWorkflow(path) {
-  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
-}
-function commandCore(line) {
-  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
-}
+// src/detectors/gh-expression.ts
 function foldExpressions(s) {
   return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
     const v = foldConst(e.trim());
@@ -4904,90 +4939,6 @@ function foldExpressions(s) {
     return /\b(?:matrix|strategy|inputs)\./.test(e) ? MATRIX_TOKEN : EXPR_TOKEN;
   });
 }
-function canonical(core) {
-  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
-  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
-  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
-  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
-  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
-  s = s.replace(/^exec\s+/, "");
-  return s.replace(/\s+--\s*$/, "").trim();
-}
-function runnerNarrowed(cmd, args) {
-  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
-  return t !== void 0 && t.flags.test(" " + args.trim());
-}
-function coverageFloorLowered(removed, added) {
-  const was = removed.match(COVERAGE_FLOOR);
-  const now = added.match(COVERAGE_FLOOR);
-  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
-}
-function inCommandPosition(core) {
-  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
-}
-function narrowedByPositional(args) {
-  const toks = args.trim().split(/\s+/).filter(Boolean);
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (t === "--" || t.startsWith("-")) continue;
-    const prev = toks[i - 1];
-    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
-    if (/[<>|;&]/.test(t)) continue;
-    if (PATH_SHAPED.test(t)) return true;
-  }
-  return false;
-}
-function checkKind(core) {
-  if (!invokesCheck(core)) return null;
-  const s = canonical(core);
-  if (/\btamperward\b/.test(s)) return "gate";
-  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
-  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
-  return "test";
-}
-function survives(removedCore, isUses, afterCores, addedCores) {
-  if (isUses) {
-    const ref = usesRef(removedCore);
-    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
-  }
-  const r = canonical(removedCore);
-  const kind = checkKind(removedCore);
-  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
-  let neutralised;
-  for (const raw of afterCores) {
-    const a = canonical(raw);
-    if (a === r) return { state: "kept" };
-    if (a.startsWith(r + " ")) {
-      const rest = a.slice(r.length);
-      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
-      else return { state: "kept" };
-    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
-      return { state: "kept" };
-    } else {
-      const w = a.match(TIMEOUT_WRAP);
-      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
-    }
-  }
-  let respelled = false;
-  for (const raw of addedCores) {
-    if (!kind || checkKind(raw) !== kind) continue;
-    const a = canonical(raw);
-    if (a.match(TIMEOUT_WRAP)) {
-      neutralised ??= raw;
-      continue;
-    }
-    if (!inCommandPosition(raw)) continue;
-    if (coverageFloorLowered(r, a)) {
-      neutralised ??= raw;
-      continue;
-    }
-    const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
-    else respelled = true;
-  }
-  if (respelled) return { state: "kept" };
-  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
-}
 function lex(src) {
   const out3 = [];
   let i = 0;
@@ -5177,6 +5128,329 @@ function callConst(name, args) {
       return void 0;
   }
 }
+var EXPR_TOKEN, MATRIX_TOKEN, TRUTHY, truthy;
+var init_gh_expression = __esm({
+  "src/detectors/gh-expression.ts"() {
+    "use strict";
+    EXPR_TOKEN = "__expr__";
+    MATRIX_TOKEN = "__matrix__";
+    TRUTHY = Symbol("truthy");
+    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
+  }
+});
+
+// src/detectors/invocation.ts
+function canonical(core) {
+  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
+  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
+  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
+  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
+  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
+  s = s.replace(/^exec\s+/, "");
+  return s.replace(/\s+--\s*$/, "").trim();
+}
+function runnerNarrowed(cmd, args) {
+  return runnerNarrowing(cmd, args) !== null;
+}
+function runnerNarrowing(cmd, args) {
+  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
+  const m = t ? (" " + args.trim()).match(t.flags) : null;
+  return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+}
+function coverageFloorLowered(removed, added) {
+  const was = removed.match(COVERAGE_FLOOR);
+  const now = added.match(COVERAGE_FLOOR);
+  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
+}
+function inCommandPosition(core) {
+  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
+}
+function narrowedByPositional(args) {
+  return positionalOf(args) !== null;
+}
+function positionalOf(args) {
+  const toks = args.trim().split(/\s+/).filter(Boolean);
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (t === "--" || t.startsWith("-")) continue;
+    const prev = toks[i - 1];
+    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
+    if (/[<>|;&]/.test(t)) continue;
+    if (PATH_SHAPED.test(t)) return t;
+  }
+  return null;
+}
+function checkKind(core) {
+  if (!invokesCheck(core)) return null;
+  const s = canonical(core);
+  if (/\btamperward\b/.test(s)) return "gate";
+  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
+  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
+  return "test";
+}
+function survives(removedCore, isUses, afterCores, addedCores) {
+  if (isUses) {
+    const ref = usesRef(removedCore);
+    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
+  }
+  const r = canonical(removedCore);
+  const kind = checkKind(removedCore);
+  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
+  let neutralised;
+  for (const raw of afterCores) {
+    const a = canonical(raw);
+    if (a === r) return { state: "kept" };
+    if (a.startsWith(r + " ")) {
+      const rest = a.slice(r.length);
+      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
+      else return { state: "kept" };
+    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
+      return { state: "kept" };
+    } else {
+      const w = a.match(TIMEOUT_WRAP);
+      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
+    }
+  }
+  let respelled = false;
+  for (const raw of addedCores) {
+    if (!kind || checkKind(raw) !== kind) continue;
+    const a = canonical(raw);
+    if (a.match(TIMEOUT_WRAP)) {
+      neutralised ??= raw;
+      continue;
+    }
+    if (!inCommandPosition(raw)) continue;
+    if (coverageFloorLowered(r, a)) {
+      neutralised ??= raw;
+      continue;
+    }
+    const args = a.slice(a.indexOf(" ") + 1 || a.length);
+    if (a.includes(" ") && (NEUTRALISING_SUFFIX.test(" " + args) || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
+    else respelled = true;
+  }
+  if (respelled) return { state: "kept" };
+  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
+}
+function unwrap(seg) {
+  const s = seg.trim().replace(PYTHON_M, "").replace(NODE_BIN, "$1").replace(BIN_OF, "$1$2");
+  if (invokesCheck(s) || PRINTER.test(s) || /^["']/.test(s)) return s;
+  const toks = s.split(/\s+/);
+  for (let i = 1; i < toks.length && i <= 16; i++) {
+    const rest = toks.slice(i).join(" ");
+    if (invokesCheck(rest)) return rest;
+  }
+  return s;
+}
+function scriptKind3(inner) {
+  const kind = checkKind(inner);
+  if (!kind) return null;
+  const head = canonical(inner).match(/^(tests?|lint|type-?check|coverage)(?=[\s:]|$)/i)?.[1];
+  if (!head) return kind;
+  return /^type/i.test(head) ? "types" : /^lint/i.test(head) ? "lint" : "test";
+}
+function runnerOfSegment(canon) {
+  const m = canon.match(RUNNER_NAME);
+  if (!m) return null;
+  const n = m[1];
+  return n === "jest" || n === "vitest" || n === "mocha" || n === "pytest" || n === "go" || n === "cargo" ? n : "node";
+}
+function statements(raw) {
+  const out3 = [];
+  let single = false;
+  let double = false;
+  let last = 0;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (ch === "\\" && !single) {
+      i++;
+      continue;
+    }
+    if (ch === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (ch === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single || double) continue;
+    const prev = raw[i - 1];
+    const next = raw[i + 1];
+    let op = null;
+    if (ch === "&" && next === "&") op = "&&";
+    else if (ch === "|" && next === "|") op = "||";
+    else if (ch === "|" && next === "&") op = "|&";
+    else if (ch === ";" || ch === "\n") op = ";";
+    else if (ch === "|" && prev !== ">") op = "|";
+    else if (ch === "&" && prev !== ">" && next !== ">") op = "&";
+    if (!op) continue;
+    out3.push({ seg: raw.slice(last, i).trim(), op });
+    i += op.length - 1;
+    last = i + 1;
+  }
+  out3.push({ seg: raw.slice(last).trim(), op: null });
+  return out3.filter((s) => s.seg !== "");
+}
+function descriptors(cmd, runner, opts) {
+  const out3 = [];
+  const stmts = statements(cmd);
+  for (let i = 0; i < stmts.length; i++) {
+    const { seg, op } = stmts[i];
+    const wrapped = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(wrapped ? wrapped[1] : seg);
+    if (!invokesCheck(inner)) continue;
+    const kind = scriptKind3(inner);
+    const canon = canonical(inner);
+    const rn = runner ?? runnerOfSegment(canon);
+    const args = canon.includes(" ") ? " " + canon.slice(canon.indexOf(" ") + 1) : " ";
+    if (wrapped) out3.push({ key: "timeout", what: "a timeout wrapper", direction: "added" });
+    const following = stmts[i + 1]?.seg ?? "";
+    if (op === "||" || op === "|" || op === "&" || op === ";" && !invokesCheck(unwrap(following))) {
+      out3.push({ key: `op:${op}`, what: `${op} ${following.split(/\s+/).slice(0, 2).join(" ")}`.trim(), direction: "added" });
+    }
+    for (const re of MASKING_FLAGS) {
+      const f = spelled(re, args);
+      if (f) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    for (const re of GATE_FLAGS) {
+      const f = spelled(re, " " + seg);
+      if (f) out3.push({ key: `gate:${f}`, what: f, direction: "removed" });
+    }
+    if (kind !== "test" || opts.sliceByDesign || opts.extended?.has(kind)) continue;
+    const flags = [SUITE_NARROWING_FLAGS, ...NARROWING_BY_RUNNER["*"], ...rn ? NARROWING_BY_RUNNER[rn] : []];
+    for (const re of flags) {
+      const f = spelled(re, args);
+      if (f && !opts.excuseFlag?.(f, canon)) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    if (rn === "cargo" && CARGO_SKIP.test(args)) out3.push({ key: "flag:-- --skip", what: "-- --skip", direction: "added" });
+    const shared = runnerNarrowing(canon, args);
+    if (shared && !opts.excuseFlag?.(shared, canon)) out3.push({ key: `flag:${shared}`, what: shared, direction: "added" });
+    if (opts.fresh) continue;
+    const cfg = args.match(CONFIG_FLAG);
+    if (cfg && !opts.configReviewed?.(cfg[3])) out3.push({ key: `config:${cfg[3]}`, what: `${cfg[1]} ${cfg[3]}`, direction: "added" });
+    const pos = positionalOf(args);
+    if (pos) out3.push({ key: "positional", what: `a path positional (${pos})`, direction: "added" });
+  }
+  return out3;
+}
+function checkStatements(cmd) {
+  const out3 = [];
+  for (const seg of segments(cmd)) {
+    const w = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(w ? w[1] : seg);
+    const kind = scriptKind3(inner);
+    if (kind) out3.push({ kind, canon: canonical(inner) });
+  }
+  return out3;
+}
+function checkKinds(cmd) {
+  return new Set(checkStatements(cmd).map((s) => s.kind));
+}
+function failsLoudly(cmd) {
+  const last = segments(cmd).pop();
+  return last !== void 0 && FAILS_LOUDLY.test(last.trim());
+}
+function invocationWeakening(before, after, runner, opts = {}) {
+  const was = checkKinds(before);
+  const now = checkKinds(after);
+  if (now.size === 0 && failsLoudly(after)) return { state: "kept" };
+  for (const k of was) {
+    if (now.has(k) || opts.relocated?.(k)) continue;
+    const instead = [...now].filter((x) => !was.has(x));
+    return { state: "removed", kind: k, what: instead.length ? `runs a ${instead.join("/")} check instead` : now.size ? "the check is gone" : "no check is run" };
+  }
+  const survived = new Set(checkStatements(before).map((s) => s.canon));
+  const extended = new Set(checkStatements(after).filter((s) => survived.has(s.canon)).map((s) => s.kind));
+  const read = { ...opts, fresh: was.size === 0, extended };
+  const beforeDs = descriptors(before, runner, read);
+  const afterDs = descriptors(after, runner, read);
+  const seenBefore = new Set(beforeDs.map((d) => d.key));
+  const added = afterDs.find((d) => d.direction === "added" && !seenBefore.has(d.key));
+  if (added) return { state: "neutralised", what: added.what, direction: "added" };
+  if (coverageFloorLowered(before, after)) return { state: "neutralised", what: "a lowered --cov-fail-under", direction: "added" };
+  const seenAfter = new Set(afterDs.map((d) => d.key));
+  const dropped = beforeDs.find((d) => d.direction === "removed" && !seenAfter.has(d.key));
+  if (dropped) return { state: "neutralised", what: dropped.what, direction: "removed" };
+  return { state: "kept" };
+}
+var INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, NARROWING_BY_RUNNER, CARGO_SKIP, MASKING_FLAGS, GATE_FLAGS, CONFIG_FLAG, PRINTER, PYTHON_M, NODE_BIN, BIN_OF, RUNNER_NAME, spelled, FAILS_LOUDLY;
+var init_invocation = __esm({
+  "src/detectors/invocation.ts"() {
+    "use strict";
+    init_gh_expression();
+    init_command();
+    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
+    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
+    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
+    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
+    usesRef = (core) => core.replace(/@.*$/, "");
+    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
+    NEUTRALISING_SUFFIX = new RegExp(
+      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
+    );
+    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
+    RUNNER_NARROWINGS = [
+      {
+        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
+        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
+        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
+        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
+      },
+      {
+        runner: /^(?:jest|vitest)\b/,
+        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
+      },
+      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
+      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
+      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
+      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
+      {
+        // `-p no:<plugin>` disables collection when the plugin is the collector
+        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
+        runner: /^pytest\b/,
+        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
+      },
+      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
+      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
+    ];
+    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
+    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
+    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
+    PATH_SHAPED = /\/|\.(?:test|spec)\./;
+    NARROWING_BY_RUNNER = {
+      "*": [/--shard\b/],
+      jest: [/--root\b/, /--rootDir\b/, /--testMatch\b/, /--testRegex\b/, /--modulePathIgnorePatterns\b/, /--selectProjects\b/, /--ignoreProjects\b/, /--filter\b/],
+      vitest: [/--grep\b/],
+      mocha: [/--grep\b/, /(?:^|\s)-g(?:\s|=)/, /--ignore\b/, /(?:^|\s)-f(?:\s|=)/, /--fgrep\b/],
+      pytest: [/(?:^|\s)-k(?:\s|=)/, /(?:^|\s)-m(?:\s|=)/, /--deselect\b/, /--ignore\b/, /--ignore-glob\b/, /--last-failed\b/, /(?:^|\s)--lf(?:\s|$)/, /--collect-only\b/, /(?:^|\s)--co(?:\s|$)/],
+      go: [/(?:^|\s)-run(?:\s|=)/, /(?:^|\s)-skip(?:\s|=)/],
+      cargo: [],
+      node: [/--test-name-pattern\b/, /--test-skip-pattern\b/]
+    };
+    CARGO_SKIP = /\s--\s+(?:\S+\s+)*--skip\b/;
+    MASKING_FLAGS = [/--passWithNoTests\b/, /--coverage=false\b/, /--coverageThreshold\b/, /--if-present\b/];
+    GATE_FLAGS = [/--check-coverage\b/];
+    CONFIG_FLAG = /(?:^|\s)(--config|-c)(?:=|\s+)(['"]?)([^\s'"]+)\2(?=\s|$)/;
+    PRINTER = /^(?:echo|printf|true|false|:|cat|exit|return|sleep|test|\[|node|git|curl|wget)(?=\s|$)/;
+    PYTHON_M = /^python\d?(?:\.\d+)?\s+-m\s+(?=pytest\b)/;
+    NODE_BIN = /^node(?:\s+-\S+)*\s+\S*node_modules\/(?:\.bin\/)?(jest|vitest|mocha|ava)\b\S*/;
+    BIN_OF = /\$\((?:yarn|npm|pnpm)\s+bin\s+(\w+)\)|\$\((?:yarn|npm|pnpm)\s+bin\)\/(\w+)/g;
+    RUNNER_NAME = /^(jest|vitest|mocha|pytest|go|cargo|node)\b/;
+    spelled = (re, s) => {
+      const m = s.match(re);
+      return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+    };
+    FAILS_LOUDLY = /^(?:exit\s+(?:[1-9]\d*)|false)\s*$/;
+  }
+});
+
+// src/detectors/ci-tampering.ts
+function isActiveWorkflow(path) {
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+}
+function commandCore(line) {
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
+}
 function expressionOf(raw) {
   const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
   const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
@@ -5425,7 +5699,7 @@ function ancestorOf(lines, i) {
   while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
   return h >= 0 ? h : null;
 }
-var RULE6, USES, CHECK, YAML_KEY, INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, EXPR_TOKEN, MATRIX_TOKEN, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, uncommented, TRUTHY, truthy, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var RULE6, USES, CHECK, YAML_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
 var init_ci_tampering = __esm({
   "src/detectors/ci-tampering.ts"() {
     "use strict";
@@ -5435,60 +5709,22 @@ var init_ci_tampering = __esm({
     init_files();
     init_hook_wiring();
     init_repo();
+    init_gh_expression();
+    init_invocation();
+    init_invocation();
     RULE6 = "ci-tampering";
     USES = /^\s*-\s*uses:/;
     CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
     YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
-    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
-    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
-    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line) || INVOKES_TOOL.test(commandCore(line));
-    EXPR_TOKEN = "__expr__";
-    MATRIX_TOKEN = "__matrix__";
-    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
-    usesRef = (core) => core.replace(/@.*$/, "");
-    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
-    NEUTRALISING_SUFFIX = new RegExp(
-      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
-    );
-    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
-    RUNNER_NARROWINGS = [
-      {
-        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
-        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
-        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
-        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
-      },
-      {
-        runner: /^(?:jest|vitest)\b/,
-        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
-      },
-      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
-      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
-      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
-      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
-      {
-        // `-p no:<plugin>` disables collection when the plugin is the collector
-        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
-        runner: /^pytest\b/,
-        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
-      },
-      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
-      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
-    ];
-    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
-    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
-    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
-    PATH_SHAPED = /\/|\.(?:test|spec)\./;
+    invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
     uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
-    TRUTHY = Symbol("truthy");
-    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
     SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
     indentOf = (l) => l.length - l.trimStart().length;
     STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
     REPORTER_ACTION = /^\s*-?\s*uses:\s*\S*?(?:[\w-]*-reporter|[\w-]*-results?[\w-]*|upload-[\w-]*|codecov[\w-]*|coveralls[\w-]*)(?:@|\s|$)/i;
     usesCheck = (l) => USES.test(l) && CHECK.test(l) && !REPORTER_ACTION.test(l);
-    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l));
-    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
+    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l));
+    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
     NEUTRALISERS = [
       { re: /^\s*set\s+\+e\b/, what: "set +e \u2014 a failing check no longer fails the step" },
       { re: /^\s*exit\s+0\s*(?:$|[;#])/, what: "exit 0 \u2014 the step ends green whatever the check did" },
@@ -5574,7 +5810,7 @@ var init_ci_tampering = __esm({
           }
           if (afterLines) {
             for (const b of runBlocks(afterLines)) {
-              if (!b.body.some(invokesCheck)) continue;
+              if (!b.body.some(invokesCheck2)) continue;
               const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
               for (let k = 0; k < b.body.length; k++) {
                 const idx = b.start + 1 + k;
@@ -5621,7 +5857,7 @@ var init_ci_tampering = __esm({
                   const d = defaultsOf(afterLines, i);
                   if (d === null) continue;
                   const job = jobOf(afterLines, d);
-                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck(x) || usesCheck(x))) continue;
+                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck2(x) || usesCheck(x))) continue;
                 }
                 out3.push(
                   makeFinding(RULE6, policy, {
@@ -5678,7 +5914,7 @@ var init_ci_tampering = __esm({
           for (const l of removedLines(c)) {
             if (/^\s*#/.test(l.content)) continue;
             const isUsesLine = usesCheck(l.content);
-            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
+            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck2(l.content);
             if (!isUsesLine && !isCheckCommand) continue;
             const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
             if (s.state === "kept") continue;
@@ -7324,33 +7560,43 @@ function excludesOtherRunner(flag, cmd) {
   const values = [...cmd.matchAll(/--exclude(?:=|\s+)(['"]?)(\S+?)\1(?=\s|$)/g)].map((m) => m[2]);
   return values.length > 0 && values.every((v) => OTHER_RUNNER_DIR.test(v.replace(/^\.\//, "").replace(/(?:\/\*+)*\/?$/, "") + "/"));
 }
-function scriptNarrowings(before, after, path) {
+function scriptsOf(src) {
+  try {
+    const pkg = JSON.parse(src ?? "{}");
+    const s = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts : {};
+    return Object.fromEntries(Object.entries(s).filter((e) => typeof e[1] === "string"));
+  } catch {
+    return {};
+  }
+}
+function scriptWeakenings(before, after, path, policy, addedPaths) {
   if ((path.split("/").pop() ?? path) !== "package.json") return [];
-  const scriptsOf = (src) => {
-    try {
-      const pkg = JSON.parse(src ?? "{}");
-      const s = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts : {};
-      return Object.fromEntries(Object.entries(s).filter((e) => typeof e[1] === "string"));
-    } catch {
-      return {};
-    }
-  };
   const was = scriptsOf(before);
   const now = scriptsOf(after);
+  const dir = path.includes("/") ? path.slice(0, path.lastIndexOf("/") + 1) : "";
+  const configReviewed = (file) => {
+    const f = dir + file.replace(/^\.\//, "");
+    return isProtected(f, policy, "config") && !addedPaths.has(f);
+  };
+  const relocated = (kind) => Object.keys(now).some((n) => !(n in was) && checkKinds(now[n]).has(kind));
   const out3 = [];
-  for (const [name, cmd] of Object.entries(now)) {
-    if (!WHOLE_SUITE_SCRIPT.test(name) || !/\b(?:jest|vitest)\b/.test(cmd)) continue;
-    const prev = was[name] ?? "";
-    const flags = new RegExp(SUITE_NARROWING_FLAGS.source, "g");
-    for (const m of cmd.matchAll(flags)) {
-      const flag = m[0].trim();
-      if (!flag) continue;
-      const one = new RegExp(SUITE_NARROWING_FLAGS.source);
-      if (one.test(prev) && prev.includes(flag)) continue;
-      if (excludesOtherRunner(flag, cmd)) continue;
-      out3.push({ script: name, flag, before: prev, after: cmd });
-      break;
+  for (const name of /* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])) {
+    const whole = WHOLE_SUITE_SCRIPT.test(name);
+    if (!whole && !SLICE_SCRIPT.test(name)) continue;
+    const prev = was[name];
+    const cmd = now[name];
+    if (prev === cmd) continue;
+    if (prev === void 0 && !whole) continue;
+    if (cmd === void 0) {
+      if (name !== "pretest" || prev === void 0) continue;
+      const gone = [...checkKinds(prev)].filter((k) => !relocated(k));
+      if (gone.length === 0) continue;
+      out3.push({ script: name, weakening: { state: "removed", kind: gone[0], what: "the script is gone" }, before: prev, after: "" });
+      continue;
     }
+    const w = invocationWeakening(prev ?? "", cmd, void 0, { configReviewed, excuseFlag: excludesOtherRunner, sliceByDesign: !whole, relocated });
+    if (w.state === "kept") continue;
+    out3.push({ script: name, weakening: w, before: prev ?? "", after: cmd });
   }
   return out3;
 }
@@ -7412,7 +7658,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
     })
   );
 }
-var RULE8, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SED_INPLACE, testDeletion;
+var RULE8, JVM_TEST, TEST_DEFS, TABLE_METHOD, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
 var init_test_deletion = __esm({
   "src/detectors/test-deletion.ts"() {
     "use strict";
@@ -7423,7 +7669,7 @@ var init_test_deletion = __esm({
     init_files();
     init_repo();
     init_suite_config();
-    init_ci_tampering();
+    init_invocation();
     init_narrow();
     RULE8 = "test-deletion";
     JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
@@ -7441,7 +7687,8 @@ var init_test_deletion = __esm({
     isEachOf = (expr) => ts.isPropertyAccessExpression(expr) && ts.isIdentifier(expr.expression) && (expr.expression.text === "it" || expr.expression.text === "test") && TABLE_METHOD.test(expr.name.text);
     isDescribeEach = (expr) => ts.isPropertyAccessExpression(expr) && ts.isIdentifier(expr.expression) && expr.expression.text === "describe" && TABLE_METHOD.test(expr.name.text);
     OTHER_RUNNER_DIR = /(?:^|\/)(?:e2e|cypress|playwright|fixtures|__fixtures__|__mocks__)\//;
-    WHOLE_SUITE_SCRIPT = /^test(?::ci)?$/;
+    WHOLE_SUITE_SCRIPT = /^(?:test|test:ci|check|pretest)$/;
+    SLICE_SCRIPT = /^test:(?:unit|integration)$/;
     SED_INPLACE = /(?:^|\s)(?:-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b)/;
     testDeletion = {
       id: RULE8,
@@ -7450,6 +7697,7 @@ var init_test_deletion = __esm({
       run(changes, policy, _view, ctx) {
         const out3 = [];
         const isSpec = (p) => isProtected(p, policy, "tests") && !isProtected(p, policy, "snapshots");
+        const addedPaths = new Set(changes.filter((c) => c.kind === "file" && c.op === "add").map((c) => c.path));
         const addedTestLines = /* @__PURE__ */ new Set();
         let addedTestBlocks = 0;
         for (const c of changes) {
@@ -7529,13 +7777,20 @@ var init_test_deletion = __esm({
                   })
                 );
               }
-              for (const n of scriptNarrowings(c.before, c.after, c.path)) {
+              for (const n of scriptWeakenings(c.before, c.after, c.path, policy, addedPaths)) {
+                const w = n.weakening;
+                const evidence = `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${n.after === "" ? "deleted" : JSON.stringify(n.after)}`;
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  w.state === "removed" ? makeFinding(RULE8, policy, {
+                    file: c.path,
+                    message: `The test script no longer runs the ${w.kind} check: scripts.${n.script} ${w.what}.`,
+                    evidence,
+                    remediation: "Keep the script running its check. Replacing the runner in package.json removes every test from every `npm test` while the workflow line stays untouched."
+                  }) : makeFinding(RULE8, policy, {
                     file: c.path,
-                    message: `The test script now narrows the suite: ${n.flag} added to scripts.${n.script}.`,
-                    evidence: `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${JSON.stringify(n.after)}`,
-                    remediation: "Keep the test script running the whole suite; a runner flag that selects fewer specs removes the rest from every run."
+                    message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n.script}.`,
+                    evidence,
+                    remediation: "Keep the test script running the whole suite and letting it decide; a masked status, a cut-short run or a runner flag that selects fewer specs removes the rest from every run."
                   })
                 );
               }
@@ -8902,8 +9157,22 @@ var init_deny = __esm({
 });
 
 // src/session.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join10 } from "node:path";
+function writeBaseline(p, sha3) {
+  mkdirSync2(dirname3(p), { recursive: true });
+  const tmp = `${p}.${process.pid}.tmp`;
+  try {
+    writeFileSync2(tmp, sha3);
+    renameSync(tmp, p);
+  } catch (e) {
+    try {
+      rmSync2(tmp, { force: true });
+    } catch {
+    }
+    throw e;
+  }
+}
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
@@ -8911,21 +9180,23 @@ function baselinePath(cwd, sessionId) {
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
+  const p = baselinePath(cwd, sessionId);
+  if (!p) return null;
   try {
-    const p = baselinePath(cwd, sessionId);
-    if (!p) return null;
     if (existsSync7(p)) {
       const v = readFileSync7(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
-    const head = headSha(cwd);
-    if (!head) return null;
-    mkdirSync2(dirname3(p), { recursive: true });
-    writeFileSync2(p, head);
-    return head;
   } catch {
-    return null;
   }
+  const head = headSha(cwd);
+  if (!head) return null;
+  try {
+    writeBaseline(p, head);
+  } catch (e) {
+    throw new BaselineWriteError(p, e);
+  }
+  return head;
 }
 function advanceTurnBaseline(cwd, sessionId) {
   if (!sessionId) return;
@@ -8933,24 +9204,30 @@ function advanceTurnBaseline(cwd, sessionId) {
     const p = baselinePath(cwd, sessionId);
     const head = headSha(cwd);
     if (!p || !head) return;
-    mkdirSync2(dirname3(p), { recursive: true });
-    writeFileSync2(p, head);
+    writeBaseline(p, head);
   } catch {
   }
 }
-var UNSAFE, SHA;
+var UNSAFE, SHA, BaselineWriteError;
 var init_session = __esm({
   "src/session.ts"() {
     "use strict";
     init_build();
     UNSAFE = /[^A-Za-z0-9_-]/g;
-    SHA = /^[0-9a-f]{7,40}$/;
+    SHA = /^[0-9a-f]{40}$/;
+    BaselineWriteError = class extends Error {
+      constructor(path, cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause);
+        super(`turn baseline could not be recorded at ${path}: ${detail}`);
+        this.name = "BaselineWriteError";
+      }
+    };
   }
 });
 
 // src/effect.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join11 } from "node:path";
 function ptreeFrom(value) {
   if (!isRecord(value)) return null;
@@ -9055,14 +9332,14 @@ function saveTree(p, tree) {
     mkdirSync3(join11(p, ".."), { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(tree));
-    renameSync(tmp, p);
+    renameSync2(tmp, p);
   } catch {
   }
 }
 function dropTree(p) {
   if (!p) return;
   try {
-    rmSync2(p, { force: true });
+    rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -9361,7 +9638,7 @@ var init_watch = __esm({
 });
 
 // src/detectors/fs-events.ts
-import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync as statSync2 } from "node:fs";
 function fsEventFrom(line) {
   let value;
   try {
@@ -9381,7 +9658,7 @@ function fsEventFrom(line) {
 function readEvents(log, offset, maxBytes = MAX_EVENT_READ_BYTES, io = DEFAULT_EVENT_READ_IO) {
   let size = 0;
   try {
-    size = statSync(log).size;
+    size = statSync2(log).size;
   } catch {
     return {
       events: [],
@@ -9972,8 +10249,12 @@ function recordObserverHealth(state, reason) {
 function stopVerdict(input, defaultCwd) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
-  if (!isGitRepo(sessionCwd)) return { exitCode: 0, stdout: "" };
-  const cwd = repoRoot(sessionCwd);
+  const ctx = repoContext(sessionCwd);
+  if (!ctx) {
+    const why = outsideRepository(sessionCwd);
+    return why ? failClosed("Stop", why) : { exitCode: 0, stdout: "" };
+  }
+  const cwd = ctx.root;
   let blocks2;
   let commitCursor = () => {
   };
@@ -10163,7 +10444,7 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync3 } from "node:fs";
 import { sep } from "node:path";
@@ -10246,7 +10527,7 @@ function withEnv(env, fn) {
 }
 function removeQuietly(p) {
   try {
-    rmSync3(p, { force: true });
+    rmSync4(p, { force: true });
   } catch {
   }
 }
@@ -10588,7 +10869,7 @@ var init_verifier_limits = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync3 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -10951,7 +11232,7 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync11(path) && !statSync2(path).isFile()) {
+  if (existsSync11(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
   const existing = existsSync11(path) ? readFileSync12(path, "utf8") : null;
@@ -11393,7 +11674,7 @@ import {
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync5,
-  statSync as statSync3
+  statSync as statSync4
 } from "node:fs";
 import {
   basename as basename3,
@@ -11435,7 +11716,7 @@ function fingerprintRoot(root, cwd, h) {
       root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
     );
   }
-  if (!statSync3(root.path).isDirectory()) {
+  if (!statSync4(root.path).isDirectory()) {
     throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
@@ -11445,7 +11726,7 @@ function fingerprintRoot(root, cwd, h) {
   const hashFile = (path, label) => {
     let st;
     try {
-      st = statSync3(path);
+      st = statSync4(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
       h.update(readFileSync13(path));
@@ -11511,7 +11792,7 @@ function fingerprintRoot(root, cwd, h) {
         } catch {
           continue;
         }
-        const followed = statSync3(path);
+        const followed = statSync4(path);
         if (followed.isFile()) {
           hashFile(resolved, "@target:" + rel);
           continue;
@@ -11559,7 +11840,7 @@ function measuredSnapshot(roots, probes, cwd, metrics) {
 }
 function freezeRoot(kind, path) {
   try {
-    if (!statSync3(path).isDirectory()) {
+    if (!statSync4(path).isDirectory()) {
       throw new Error("not a directory");
     }
     return { kind, path: resolve5(path), realPath: realpathSync5(path) };
@@ -11608,7 +11889,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync5(candidate);
+      if (existsSync12(candidate) && statSync4(candidate).isFile()) return realpathSync5(candidate);
     } catch {
     }
   }
@@ -11795,7 +12076,7 @@ var init_dependency_env = __esm({
 
 // src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join16 } from "node:path";
 function emptySuiteDiagnostics() {
@@ -11924,7 +12205,7 @@ function runCapturedProcessSync(executable, args, opts) {
     }
     return parsed;
   } finally {
-    rmSync4(stateDir, { recursive: true, force: true });
+    rmSync5(stateDir, { recursive: true, force: true });
   }
 }
 var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CAPTURE_SUPERVISOR;
@@ -12114,7 +12395,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync5 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -12123,7 +12404,7 @@ function identity() {
 }
 function writableByCaller(path) {
   try {
-    const st = statSync4(path);
+    const st = statSync5(path);
     const { uid, groups } = identity();
     if (uid === 0) return true;
     if ((st.mode & 2) !== 0) return true;
@@ -12151,7 +12432,7 @@ function findExecutable(name) {
     if (!raw) continue;
     const candidate = join17(raw, name);
     try {
-      accessSync(candidate, constants2.X_OK);
+      accessSync2(candidate, constants3.X_OK);
       return realpathSync6(candidate);
     } catch {
     }
@@ -12593,7 +12874,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
+import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync6, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve7, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -12641,7 +12922,7 @@ function safeSymlink(target, out3, root, label) {
   if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync5(out3, { force: true });
+  rmSync6(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
@@ -12752,7 +13033,7 @@ function probeFilesystemCaseSensitivity(dir) {
     writeFileSync9(upper, "", { flag: "wx" });
     return !existsSync13(lower);
   } finally {
-    rmSync5(upper, { force: true });
+    rmSync6(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -12770,7 +13051,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync5(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync6(p, { force: true });
   } catch {
   }
 }
@@ -12846,7 +13127,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out3 = join18(dest, e.path);
     mkdirSync7(dirname7(out3), { recursive: true });
-    rmSync5(out3, { force: true });
+    rmSync6(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
@@ -12861,7 +13142,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync5(join18(dest, rel), { force: true });
+    rmSync6(join18(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -12948,7 +13229,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
     }
     return { exit: r.exit, secs, diagnostics: r.diagnostics };
   } finally {
-    rmSync5(scratch, { recursive: true, force: true });
+    rmSync6(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -13101,7 +13382,7 @@ function runVerify(opts) {
   const visDir = join18(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync5(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync6(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
@@ -13468,7 +13749,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { accessSync as accessSync2, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync7, statSync as statSync6, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -13503,7 +13784,7 @@ function writableByCaller2(path) {
   let cur = path;
   for (; ; ) {
     try {
-      accessSync2(cur, fsConstants.W_OK);
+      accessSync3(cur, fsConstants.W_OK);
       return true;
     } catch {
     }
@@ -13524,7 +13805,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   for (const candidate of candidates) {
     try {
       const real = realpathSync8(candidate);
-      const st = statSync5(real);
+      const st = statSync6(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
         real,
@@ -13647,7 +13928,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync6(stateDir, { recursive: true, force: true });
+    rmSync7(stateDir, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
@@ -15020,7 +15301,7 @@ import {
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
@@ -15218,8 +15499,8 @@ function runOneTrace(cwd, base, command, budget) {
       accesses: rewriteTraceRoot(accesses, root)
     };
   } finally {
-    rmSync7(root, { recursive: true, force: true });
-    rmSync7(traceDir, { recursive: true, force: true });
+    rmSync8(root, { recursive: true, force: true });
+    rmSync8(traceDir, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -15404,7 +15685,7 @@ var init_trace_verify = __esm({
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, renameSync as renameSync3, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -15477,9 +15758,9 @@ function atomicReplaceFile(path, content, mode) {
   const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
   try {
     writeFileSync11(tmp, content, { encoding: "utf8", flag: "wx", mode });
-    renameSync2(tmp, path);
+    renameSync3(tmp, path);
   } finally {
-    rmSync8(tmp, { force: true });
+    rmSync9(tmp, { force: true });
   }
 }
 function writeVerifyCommand(cwd, command) {
@@ -15506,7 +15787,7 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync8(path, { force: true });
+    if (original === null) rmSync9(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
@@ -15906,7 +16187,7 @@ function runDemo(cwd, head, runners, out3) {
   } finally {
     git5(cwd, ["worktree", "remove", "--force", wt]);
     git5(cwd, ["worktree", "prune"]);
-    rmSync8(wt, { recursive: true, force: true });
+    rmSync9(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -16321,7 +16602,7 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync3, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join23, resolve as resolve14 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -16370,11 +16651,11 @@ function resumableRecord(path, expected) {
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync12(tmp, text);
-  renameSync3(tmp, path);
+  renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
   const ws2 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync9(ws2, { recursive: true, force: true });
+  rmSync10(ws2, { recursive: true, force: true });
   mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
   try {
     execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws2], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.10",
+  "version": "2.23.12",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",