tamperward 2.23.11 → 2.23.12

package/dist/cli/index.js

@@ -1026,7 +1026,7 @@ var init_trusted = __esm({
 
 // src/repo-context.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
+import { accessSync, constants as constants2, existsSync as existsSync2, statSync } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve } from "node:path";
 function rev(cwd, flag) {
   try {
@@ -1059,6 +1059,47 @@ function repoContext(cwd) {
 function repoRoot(cwd) {
   return repoContext(cwd)?.root ?? cwd;
 }
+function outsideRepository(cwd) {
+  const key2 = resolve(cwd);
+  let isDir;
+  try {
+    isDir = statSync(key2).isDirectory();
+  } catch (e) {
+    return `cwd ${key2} cannot be read: ${errCode2(e)}`;
+  }
+  if (!isDir) return `cwd ${key2} is not a directory`;
+  try {
+    accessSync(key2, constants2.R_OK | constants2.X_OK);
+  } catch (e) {
+    return `cwd ${key2} cannot be read: ${errCode2(e)}`;
+  }
+  try {
+    execFileSync2("git", ["rev-parse", "--git-dir"], {
+      cwd: key2,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (e) {
+    const detail = errDetail(e);
+    if (/not a git repository/i.test(detail)) return null;
+    return `git could not resolve cwd ${key2}: ${detail || "unknown failure"}`;
+  }
+  return `cwd ${key2} lies in a repository with no working tree the gate can judge`;
+}
+function errCode2(e) {
+  if (typeof e === "object" && e !== null) {
+    const code2 = Reflect.get(e, "code");
+    if (typeof code2 === "string") return code2;
+  }
+  return e instanceof Error ? e.message : String(e);
+}
+function errDetail(e) {
+  if (typeof e === "object" && e !== null) {
+    const stderr = Reflect.get(e, "stderr");
+    if (typeof stderr === "string" && stderr.trim()) return stderr.replace(/\s+/g, " ").trim();
+  }
+  return errCode2(e);
+}
 var cache, CACHE_MAX;
 var init_repo_context = __esm({
   "src/repo-context.ts"() {
@@ -9116,8 +9157,22 @@ var init_deny = __esm({
 });
 
 // src/session.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join10 } from "node:path";
+function writeBaseline(p, sha3) {
+  mkdirSync2(dirname3(p), { recursive: true });
+  const tmp = `${p}.${process.pid}.tmp`;
+  try {
+    writeFileSync2(tmp, sha3);
+    renameSync(tmp, p);
+  } catch (e) {
+    try {
+      rmSync2(tmp, { force: true });
+    } catch {
+    }
+    throw e;
+  }
+}
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
@@ -9125,21 +9180,23 @@ function baselinePath(cwd, sessionId) {
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
+  const p = baselinePath(cwd, sessionId);
+  if (!p) return null;
   try {
-    const p = baselinePath(cwd, sessionId);
-    if (!p) return null;
     if (existsSync7(p)) {
       const v = readFileSync7(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
-    const head = headSha(cwd);
-    if (!head) return null;
-    mkdirSync2(dirname3(p), { recursive: true });
-    writeFileSync2(p, head);
-    return head;
   } catch {
-    return null;
   }
+  const head = headSha(cwd);
+  if (!head) return null;
+  try {
+    writeBaseline(p, head);
+  } catch (e) {
+    throw new BaselineWriteError(p, e);
+  }
+  return head;
 }
 function advanceTurnBaseline(cwd, sessionId) {
   if (!sessionId) return;
@@ -9147,24 +9204,30 @@ function advanceTurnBaseline(cwd, sessionId) {
     const p = baselinePath(cwd, sessionId);
     const head = headSha(cwd);
     if (!p || !head) return;
-    mkdirSync2(dirname3(p), { recursive: true });
-    writeFileSync2(p, head);
+    writeBaseline(p, head);
   } catch {
   }
 }
-var UNSAFE, SHA;
+var UNSAFE, SHA, BaselineWriteError;
 var init_session = __esm({
   "src/session.ts"() {
     "use strict";
     init_build();
     UNSAFE = /[^A-Za-z0-9_-]/g;
-    SHA = /^[0-9a-f]{7,40}$/;
+    SHA = /^[0-9a-f]{40}$/;
+    BaselineWriteError = class extends Error {
+      constructor(path, cause) {
+        const detail = cause instanceof Error ? cause.message : String(cause);
+        super(`turn baseline could not be recorded at ${path}: ${detail}`);
+        this.name = "BaselineWriteError";
+      }
+    };
   }
 });
 
 // src/effect.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync8, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join11 } from "node:path";
 function ptreeFrom(value) {
   if (!isRecord(value)) return null;
@@ -9269,14 +9332,14 @@ function saveTree(p, tree) {
     mkdirSync3(join11(p, ".."), { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(tree));
-    renameSync(tmp, p);
+    renameSync2(tmp, p);
   } catch {
   }
 }
 function dropTree(p) {
   if (!p) return;
   try {
-    rmSync2(p, { force: true });
+    rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -9575,7 +9638,7 @@ var init_watch = __esm({
 });
 
 // src/detectors/fs-events.ts
-import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, statSync as statSync2 } from "node:fs";
 function fsEventFrom(line) {
   let value;
   try {
@@ -9595,7 +9658,7 @@ function fsEventFrom(line) {
 function readEvents(log, offset, maxBytes = MAX_EVENT_READ_BYTES, io = DEFAULT_EVENT_READ_IO) {
   let size = 0;
   try {
-    size = statSync(log).size;
+    size = statSync2(log).size;
   } catch {
     return {
       events: [],
@@ -10186,8 +10249,12 @@ function recordObserverHealth(state, reason) {
 function stopVerdict(input, defaultCwd) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
-  if (!isGitRepo(sessionCwd)) return { exitCode: 0, stdout: "" };
-  const cwd = repoRoot(sessionCwd);
+  const ctx = repoContext(sessionCwd);
+  if (!ctx) {
+    const why = outsideRepository(sessionCwd);
+    return why ? failClosed("Stop", why) : { exitCode: 0, stdout: "" };
+  }
+  const cwd = ctx.root;
   let blocks2;
   let commitCursor = () => {
   };
@@ -10377,7 +10444,7 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync3 } from "node:fs";
 import { sep } from "node:path";
@@ -10460,7 +10527,7 @@ function withEnv(env, fn) {
 }
 function removeQuietly(p) {
   try {
-    rmSync3(p, { force: true });
+    rmSync4(p, { force: true });
   } catch {
   }
 }
@@ -10802,7 +10869,7 @@ var init_verifier_limits = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync3 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -11165,7 +11232,7 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync11(path) && !statSync2(path).isFile()) {
+  if (existsSync11(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
   const existing = existsSync11(path) ? readFileSync12(path, "utf8") : null;
@@ -11607,7 +11674,7 @@ import {
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync5,
-  statSync as statSync3
+  statSync as statSync4
 } from "node:fs";
 import {
   basename as basename3,
@@ -11649,7 +11716,7 @@ function fingerprintRoot(root, cwd, h) {
       root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
     );
   }
-  if (!statSync3(root.path).isDirectory()) {
+  if (!statSync4(root.path).isDirectory()) {
     throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
@@ -11659,7 +11726,7 @@ function fingerprintRoot(root, cwd, h) {
   const hashFile = (path, label) => {
     let st;
     try {
-      st = statSync3(path);
+      st = statSync4(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
       h.update(readFileSync13(path));
@@ -11725,7 +11792,7 @@ function fingerprintRoot(root, cwd, h) {
         } catch {
           continue;
         }
-        const followed = statSync3(path);
+        const followed = statSync4(path);
         if (followed.isFile()) {
           hashFile(resolved, "@target:" + rel);
           continue;
@@ -11773,7 +11840,7 @@ function measuredSnapshot(roots, probes, cwd, metrics) {
 }
 function freezeRoot(kind, path) {
   try {
-    if (!statSync3(path).isDirectory()) {
+    if (!statSync4(path).isDirectory()) {
       throw new Error("not a directory");
     }
     return { kind, path: resolve5(path), realPath: realpathSync5(path) };
@@ -11822,7 +11889,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync5(candidate);
+      if (existsSync12(candidate) && statSync4(candidate).isFile()) return realpathSync5(candidate);
     } catch {
     }
   }
@@ -12009,7 +12076,7 @@ var init_dependency_env = __esm({
 
 // src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join16 } from "node:path";
 function emptySuiteDiagnostics() {
@@ -12138,7 +12205,7 @@ function runCapturedProcessSync(executable, args, opts) {
     }
     return parsed;
   } finally {
-    rmSync4(stateDir, { recursive: true, force: true });
+    rmSync5(stateDir, { recursive: true, force: true });
   }
 }
 var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CAPTURE_SUPERVISOR;
@@ -12328,7 +12395,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync, constants as constants2, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync5 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -12337,7 +12404,7 @@ function identity() {
 }
 function writableByCaller(path) {
   try {
-    const st = statSync4(path);
+    const st = statSync5(path);
     const { uid, groups } = identity();
     if (uid === 0) return true;
     if ((st.mode & 2) !== 0) return true;
@@ -12365,7 +12432,7 @@ function findExecutable(name) {
     if (!raw) continue;
     const candidate = join17(raw, name);
     try {
-      accessSync(candidate, constants2.X_OK);
+      accessSync2(candidate, constants3.X_OK);
       return realpathSync6(candidate);
     } catch {
     }
@@ -12807,7 +12874,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync5, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
+import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync6, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve7, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -12855,7 +12922,7 @@ function safeSymlink(target, out3, root, label) {
   if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync5(out3, { force: true });
+  rmSync6(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
@@ -12966,7 +13033,7 @@ function probeFilesystemCaseSensitivity(dir) {
     writeFileSync9(upper, "", { flag: "wx" });
     return !existsSync13(lower);
   } finally {
-    rmSync5(upper, { force: true });
+    rmSync6(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -12984,7 +13051,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync5(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync6(p, { force: true });
   } catch {
   }
 }
@@ -13060,7 +13127,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out3 = join18(dest, e.path);
     mkdirSync7(dirname7(out3), { recursive: true });
-    rmSync5(out3, { force: true });
+    rmSync6(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
@@ -13075,7 +13142,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync5(join18(dest, rel), { force: true });
+    rmSync6(join18(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -13162,7 +13229,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
     }
     return { exit: r.exit, secs, diagnostics: r.diagnostics };
   } finally {
-    rmSync5(scratch, { recursive: true, force: true });
+    rmSync6(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -13315,7 +13382,7 @@ function runVerify(opts) {
   const visDir = join18(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync5(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync6(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
@@ -13682,7 +13749,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { accessSync as accessSync2, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync6, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync7, statSync as statSync6, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -13717,7 +13784,7 @@ function writableByCaller2(path) {
   let cur = path;
   for (; ; ) {
     try {
-      accessSync2(cur, fsConstants.W_OK);
+      accessSync3(cur, fsConstants.W_OK);
       return true;
     } catch {
     }
@@ -13738,7 +13805,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   for (const candidate of candidates) {
     try {
       const real = realpathSync8(candidate);
-      const st = statSync5(real);
+      const st = statSync6(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
         real,
@@ -13861,7 +13928,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync6(stateDir, { recursive: true, force: true });
+    rmSync7(stateDir, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
@@ -15234,7 +15301,7 @@ import {
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
@@ -15432,8 +15499,8 @@ function runOneTrace(cwd, base, command, budget) {
       accesses: rewriteTraceRoot(accesses, root)
     };
   } finally {
-    rmSync7(root, { recursive: true, force: true });
-    rmSync7(traceDir, { recursive: true, force: true });
+    rmSync8(root, { recursive: true, force: true });
+    rmSync8(traceDir, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -15618,7 +15685,7 @@ var init_trace_verify = __esm({
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, renameSync as renameSync2, rmSync as rmSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, renameSync as renameSync3, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -15691,9 +15758,9 @@ function atomicReplaceFile(path, content, mode) {
   const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
   try {
     writeFileSync11(tmp, content, { encoding: "utf8", flag: "wx", mode });
-    renameSync2(tmp, path);
+    renameSync3(tmp, path);
   } finally {
-    rmSync8(tmp, { force: true });
+    rmSync9(tmp, { force: true });
   }
 }
 function writeVerifyCommand(cwd, command) {
@@ -15720,7 +15787,7 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync8(path, { force: true });
+    if (original === null) rmSync9(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
@@ -16120,7 +16187,7 @@ function runDemo(cwd, head, runners, out3) {
   } finally {
     git5(cwd, ["worktree", "remove", "--force", wt]);
     git5(cwd, ["worktree", "prune"]);
-    rmSync8(wt, { recursive: true, force: true });
+    rmSync9(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -16535,7 +16602,7 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync3, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join23, resolve as resolve14 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -16584,11 +16651,11 @@ function resumableRecord(path, expected) {
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync12(tmp, text);
-  renameSync3(tmp, path);
+  renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
   const ws2 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync9(ws2, { recursive: true, force: true });
+  rmSync10(ws2, { recursive: true, force: true });
   mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
   try {
     execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws2], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.11",
+  "version": "2.23.12",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",