tamperward 2.23.15 → 2.23.17

package/dist/cli/index.js

@@ -6756,6 +6756,25 @@ function entryShape(h) {
   }
   return { problems, runs };
 }
+function judgeGateEntry(event, matcher, h) {
+  const cmd = typeof h.command === "string" ? h.command : "";
+  const a = analyseGateCommand(cmd, event);
+  const shape = entryShape(h);
+  const problems = [...a.problems, ...shape.problems];
+  let runs = a.runs && shape.runs;
+  let tools = null;
+  if (event === "PreToolUse") {
+    const sel = matcherSelection(matcher);
+    tools = sel.tools;
+    if (sel.problem) {
+      problems.push(sel.problem);
+    }
+  } else if (matcher !== void 0 && !(typeof matcher === "string" && (matcher === "" || matcher === "*"))) {
+    problems.push(`a \`matcher\` (${JSON.stringify(matcher)}) on the Stop entry`);
+    runs = false;
+  }
+  return { runs, problems, pin: a.pin, tools };
+}
 function gateCandidates(s, event) {
   const out3 = [];
   for (const group of eventEntries(s, event) ?? []) {
@@ -6778,22 +6797,7 @@ function gateCandidates(s, event) {
         continue;
       }
       if (!MENTIONS_GATE.test(cmd)) continue;
-      const a = analyseGateCommand(cmd, event);
-      const shape = entryShape(h);
-      const problems = [...a.problems, ...shape.problems];
-      let runs = a.runs && shape.runs;
-      let tools = null;
-      if (event === "PreToolUse") {
-        const sel = matcherSelection(group.matcher);
-        tools = sel.tools;
-        if (sel.problem) {
-          problems.push(sel.problem);
-        }
-      } else if (group.matcher !== void 0 && !(typeof group.matcher === "string" && (group.matcher === "" || group.matcher === "*"))) {
-        problems.push(`a \`matcher\` (${JSON.stringify(group.matcher)}) on the Stop entry`);
-        runs = false;
-      }
-      out3.push({ key: JSON.stringify({ m: group.matcher, h }), runs, problems, pin: a.pin, tools });
+      out3.push({ key: JSON.stringify({ m: group.matcher, h }), ...judgeGateEntry(event, group.matcher, h) });
     }
   }
   return out3;
@@ -10885,10 +10889,55 @@ var init_verifier_limits = __esm({
   }
 });
 
+// src/safe-write.ts
+import { randomBytes } from "node:crypto";
+import { lstatSync as lstatSync7, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
+function writeTargetKind(path) {
+  let st;
+  try {
+    st = lstatSync7(path, { throwIfNoEntry: false });
+  } catch (e) {
+    if (errnoCode(e) === "ENOTDIR") return "absent";
+    throw e;
+  }
+  if (!st) return "absent";
+  if (st.isSymbolicLink()) return "symlink";
+  return st.isFile() ? "file" : "irregular";
+}
+function refuseNonRegular(path) {
+  switch (writeTargetKind(path)) {
+    case "symlink":
+      return "refusing: symlink \u2014 the target would be written instead of this path; replace the link with a regular file, then re-run";
+    case "irregular":
+      return "refusing: not a regular file \u2014 a directory or special file stands where a file is expected; remove it, then re-run";
+    default:
+      return null;
+  }
+}
+function existingMode(path, fallback) {
+  if (writeTargetKind(path) !== "file") return fallback;
+  return lstatSync7(path).mode & 511;
+}
+function atomicReplaceFile(path, content, mode) {
+  const tmp = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    writeFileSync7(tmp, content, { encoding: "utf8", flag: "wx", mode });
+    renameSync3(tmp, path);
+  } finally {
+    rmSync5(tmp, { force: true });
+  }
+}
+var init_safe_write = __esm({
+  "src/safe-write.ts"() {
+    "use strict";
+    init_narrow();
+  }
+});
+
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4, writeFileSync as writeFileSync7, chmodSync as chmodSync2, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4 } from "node:fs";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -11050,6 +11099,8 @@ function verifierSetupMessage(cwd) {
 }
 function planPolicy(cwd) {
   const path = join14(cwd, POLICY_FILE);
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "policy", path: POLICY_FILE, status: "error", detail: refused };
   if (existsSync11(path)) {
     try {
       loadPolicy(cwd);
@@ -11063,7 +11114,7 @@ function planPolicy(cwd) {
     path: POLICY_FILE,
     status: "create",
     detail: "baseline policy with commented overrides",
-    apply: () => writeFileSync7(path, POLICY_CONTENT)
+    apply: () => atomicReplaceFile(path, POLICY_CONTENT, 420)
   };
 }
 function planGitignore(cwd) {
@@ -11071,23 +11122,15 @@ function planGitignore(cwd) {
   const path = join14(cwd, rel);
   if (!existsSync11(join14(cwd, "node_modules"))) return null;
   let existing = "";
-  if (existsSync11(path)) {
-    let st;
-    try {
-      st = lstatSync7(path);
-    } catch (e) {
-      return { item: "gitignore", path: rel, status: "error", detail: "cannot inspect \u2014 " + errText3(e) };
-    }
-    if (!st.isFile()) {
-      return {
-        item: "gitignore",
-        path: rel,
-        status: "error",
-        detail: st.isSymbolicLink() ? "is a symbolic link \u2014 refusing to follow it" : "exists but is not a regular file \u2014 refusing to write"
-      };
-    }
-    existing = readFileSync12(path, "utf8");
+  let kind;
+  try {
+    kind = writeTargetKind(path);
+  } catch (e) {
+    return { item: "gitignore", path: rel, status: "error", detail: "cannot inspect \u2014 " + errText3(e) };
   }
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "gitignore", path: rel, status: "error", detail: refused };
+  if (kind === "file") existing = readFileSync12(path, "utf8");
   try {
     const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
       cwd,
@@ -11120,14 +11163,27 @@ function planGitignore(cwd) {
   return {
     item: "gitignore",
     path: rel,
-    status: existsSync11(path) ? "update" : "create",
+    status: kind === "file" ? "update" : "create",
     detail: "exclude installed Node dependencies from repository diffs",
-    apply: () => writeFileSync7(path, next)
+    apply: () => atomicReplaceFile(path, next, existingMode(path, 420))
   };
 }
+function gateVerdicts(event, groups, needle) {
+  const out3 = [];
+  for (const group of groups) {
+    for (const h of group.hooks ?? []) {
+      if (!needle.test(String(h.command ?? ""))) continue;
+      const { runs, problems } = judgeGateEntry(event, group.matcher, h);
+      out3.push({ event, group, h, runs, problems });
+    }
+  }
+  return out3;
+}
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
   const path = join14(cwd, rel);
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "agent", path: rel, status: "error", detail: refused };
   let settings = {};
   if (existsSync11(path)) {
     let parsed;
@@ -11156,10 +11212,24 @@ function planClaudeHooks(cwd) {
   const needPre = preEntries.length === 0;
   const stopEntries = entriesWith(hooks.Stop, SWEEP_RE);
   const needStop = stopEntries.length === 0;
+  const neutralised = [
+    ...gateVerdicts("PreToolUse", preEntries, HOOK_RE),
+    ...gateVerdicts("Stop", stopEntries, SWEEP_RE)
+  ].filter((v) => !v.runs);
+  const foreign = neutralised.filter((v) => ours(String(v.h.command ?? "")) === null);
+  if (foreign.length > 0) {
+    return {
+      item: "agent",
+      path: rel,
+      status: "error",
+      detail: `${foreign.map((v) => `the ${v.event} gate entry is neutralised (${v.problems.join("; ")})`).join("; ")} \u2014 the runtime would not run the gate through it; remove the entry, then re-run init (refusing to rewrite a hand-written entry)`
+    };
+  }
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
-  const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
+  const restoring = new Set(neutralised.map((v) => v.h));
+  const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => !restoring.has(h) && stalePin(String(h.command ?? "")));
   const needDisableFalse = settings.disableAllHooks !== false;
-  if (!needPre && !needStop && stale.length === 0 && repin.length === 0 && !needDisableFalse) {
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0 && neutralised.length === 0 && !needDisableFalse) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
@@ -11173,9 +11243,16 @@ function planClaudeHooks(cwd) {
       needStop && "wire Stop sweep",
       repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
       repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`,
+      ...neutralised.map((v) => `restore the ${v.event} gate entry to the shape init writes \u2014 it is neutralised (${v.problems.join("; ")})`),
       needDisableFalse && (settings.disableAllHooks === void 0 ? "declare disableAllHooks: false so the user settings file cannot switch the hooks off" : `set disableAllHooks: false (was ${JSON.stringify(settings.disableAllHooks)})`)
     ].filter(Boolean).join(" + "),
     apply: () => {
+      for (const v of neutralised) {
+        for (const k of Object.keys(v.h)) delete v.h[k];
+        v.h.type = "command";
+        v.h.command = v.event === "PreToolUse" ? HOOK_CMD : SWEEP_CMD;
+        if (v.event === "Stop") delete v.group.matcher;
+      }
       for (const h of repin) {
         const kind = ours(String(h.command ?? ""))?.[2];
         h.command = kind === "hook claude" ? HOOK_CMD : kind === "sweep claude" ? SWEEP_CMD : h.command;
@@ -11194,7 +11271,7 @@ function planClaudeHooks(cwd) {
       }
       if (needDisableFalse) settings.disableAllHooks = false;
       mkdirSync6(dirname4(path), { recursive: true });
-      writeFileSync7(path, JSON.stringify(settings, null, 2) + "\n");
+      atomicReplaceFile(path, JSON.stringify(settings, null, 2) + "\n", existingMode(path, 420));
     }
   };
 }
@@ -11251,10 +11328,10 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync11(path) && !statSync3(path).isFile()) {
-    return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
-  }
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "pre-commit", path: rel, status: "error", detail: refused };
   const existing = existsSync11(path) ? readFileSync12(path, "utf8") : null;
+  const hookMode = () => existingMode(path, 493) | 73;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -11263,10 +11340,9 @@ function planPreCommit(cwd) {
       detail: `create via ${note}`,
       apply: () => {
         mkdirSync6(dirname4(path), { recursive: true });
-        writeFileSync7(path, `#!/bin/sh
+        atomicReplaceFile(path, `#!/bin/sh
 ${block.join("\n")}
-`);
-        chmodSync2(path, 493);
+`, hookMode());
       }
     };
   }
@@ -11276,11 +11352,8 @@ ${block.join("\n")}
   }
   const lines = existing.split("\n");
   const dead = unconditionalExitAt(lines);
-  const at = lines.findIndex((l) => PRECOMMIT_RE.test(l));
-  const write = (out3) => {
-    writeFileSync7(path, out3.join("\n"));
-    chmodSync2(path, 493);
-  };
+  const at = lines.findIndex((l) => !/^\s*#/.test(l) && PRECOMMIT_RE.test(l));
+  const write = (out3) => atomicReplaceFile(path, out3.join("\n"), hookMode());
   if (at !== -1 && (dead === -1 || at < dead)) {
     if (!stalePin(lines[at])) {
       return { item: "pre-commit", path: rel, status: "ok", detail: "already runs the staged check" };
@@ -11343,9 +11416,11 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync11(join14(cwd, r))
+    (r) => writeTargetKind(join14(cwd, r)) !== "absent"
   );
   const path = join14(cwd, existingRel ?? rel);
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "codeowners", path: existingRel ?? rel, status: "error", detail: refused };
   const existing = existingRel ? readFileSync12(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (existingRel !== void 0 && missing.length === 0) {
@@ -11373,7 +11448,7 @@ ${CODEOWNERS_MARK}
     } : {},
     apply: () => {
       mkdirSync6(dirname4(path), { recursive: true });
-      writeFileSync7(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block);
+      atomicReplaceFile(path, existing === null ? block.replace(/^\n/, "") : existing.replace(/\n?$/, "\n") + block, existingMode(path, 420));
     }
   };
 }
@@ -11382,8 +11457,10 @@ function planWorkflow(cwd, force) {
   const path = join14(cwd, rel);
   const write = () => {
     mkdirSync6(dirname4(path), { recursive: true });
-    writeFileSync7(path, workflowFile(WORKFLOW_CONTENT));
+    atomicReplaceFile(path, workflowFile(WORKFLOW_CONTENT), existingMode(path, 420));
   };
+  const refused = refuseNonRegular(path);
+  if (refused) return { item: "ci", path: rel, status: "error", detail: refused };
   if (!existsSync11(path)) {
     return {
       item: "ci",
@@ -11518,7 +11595,9 @@ var init_init = __esm({
     init_verifier_limits();
     init_wiring();
     init_narrow();
+    init_hook_tampering();
     init_repo_context();
+    init_safe_write();
     errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
     isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     HOOK_RE = /\btamperward(?:@\S+)?\s+hook\s+claude\b/;
@@ -11693,7 +11772,7 @@ import {
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync5,
-  statSync as statSync4
+  statSync as statSync3
 } from "node:fs";
 import {
   basename as basename3,
@@ -11735,7 +11814,7 @@ function fingerprintRoot(root, cwd, h) {
       root.kind + " root moved from " + JSON.stringify(root.realPath) + " to " + JSON.stringify(currentReal)
     );
   }
-  if (!statSync4(root.path).isDirectory()) {
+  if (!statSync3(root.path).isDirectory()) {
     throw new Unattestable(root.kind + " root " + JSON.stringify(root.path) + " is not a directory");
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
@@ -11745,7 +11824,7 @@ function fingerprintRoot(root, cwd, h) {
   const hashFile = (path, label) => {
     let st;
     try {
-      st = statSync4(path);
+      st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
       h.update(readFileSync13(path));
@@ -11811,7 +11890,7 @@ function fingerprintRoot(root, cwd, h) {
         } catch {
           continue;
         }
-        const followed = statSync4(path);
+        const followed = statSync3(path);
         if (followed.isFile()) {
           hashFile(resolved, "@target:" + rel);
           continue;
@@ -11859,7 +11938,7 @@ function measuredSnapshot(roots, probes, cwd, metrics) {
 }
 function freezeRoot(kind, path) {
   try {
-    if (!statSync4(path).isDirectory()) {
+    if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
     return { kind, path: resolve5(path), realPath: realpathSync5(path) };
@@ -11908,7 +11987,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync12(candidate) && statSync4(candidate).isFile()) return realpathSync5(candidate);
+      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync5(candidate);
     } catch {
     }
   }
@@ -12095,7 +12174,7 @@ var init_dependency_env = __esm({
 
 // src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join16 } from "node:path";
 function emptySuiteDiagnostics() {
@@ -12224,7 +12303,7 @@ function runCapturedProcessSync(executable, args, opts) {
     }
     return parsed;
   } finally {
-    rmSync5(stateDir, { recursive: true, force: true });
+    rmSync6(stateDir, { recursive: true, force: true });
   }
 }
 var DIAGNOSTIC_TAIL_BYTES, EMPTY_STREAM, CAPTURE_SUPERVISOR;
@@ -12414,7 +12493,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync5 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -12423,7 +12502,7 @@ function identity() {
 }
 function writableByCaller(path) {
   try {
-    const st = statSync5(path);
+    const st = statSync4(path);
     const { uid, groups } = identity();
     if (uid === 0) return true;
     if ((st.mode & 2) !== 0) return true;
@@ -12893,7 +12972,7 @@ var init_verifier_backend = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash10 } from "node:crypto";
-import { chmodSync as chmodSync3, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync6, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync7, symlinkSync, writeFileSync as writeFileSync9, existsSync as existsSync13 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname7, isAbsolute as isAbsolute10, join as join18, relative as relative5, resolve as resolve7, sep as sep3 } from "node:path";
 function oracleAssuranceReport() {
@@ -12941,7 +13020,7 @@ function safeSymlink(target, out3, root, label) {
   if (rootedLinkTarget(target) || !inside2(root, resolve7(dirname7(out3), target))) {
     throw linkEscape(label, target);
   }
-  rmSync6(out3, { force: true });
+  rmSync7(out3, { force: true });
   symlinkSync(target, out3);
 }
 function validateSymlinkGraph(target, out3, root, dependencyRoot, label) {
@@ -13032,7 +13111,7 @@ function materialize(cwd, dest, dependencyRoot) {
       links.push({ rel, out: out3, target });
     } else if (st.isFile()) {
       cpSync(src, out3, { dereference: true });
-      chmodSync3(out3, st.mode);
+      chmodSync2(out3, st.mode);
     } else {
       throw new Error(`${rel} is ${st.isDirectory() ? "a directory" : "a special file"} where git expects a file`);
     }
@@ -13052,7 +13131,7 @@ function probeFilesystemCaseSensitivity(dir) {
     writeFileSync9(upper, "", { flag: "wx" });
     return !existsSync13(lower);
   } finally {
-    rmSync6(upper, { force: true });
+    rmSync7(upper, { force: true });
   }
 }
 function foldCase(p) {
@@ -13070,7 +13149,7 @@ function caseFoldCollision(paths) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync9(p).isSymbolicLink()) rmSync6(p, { force: true });
+    if (lstatSync9(p).isSymbolicLink()) rmSync7(p, { force: true });
   } catch {
   }
 }
@@ -13146,14 +13225,14 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out3 = join18(dest, e.path);
     mkdirSync7(dirname7(out3), { recursive: true });
-    rmSync6(out3, { force: true });
+    rmSync7(out3, { force: true });
     if (e.mode === "120000") {
       const target = content.toString("utf8");
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
       writeFileSync9(out3, content);
-      chmodSync3(out3, parseInt(e.mode.slice(-4), 8) & 511);
+      chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
   }
@@ -13161,7 +13240,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
   const inCopy = workingTreePaths(cwd);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(fold(rel))) continue;
-    rmSync6(join18(dest, rel), { force: true });
+    rmSync7(join18(dest, rel), { force: true });
     removed++;
   }
   for (const link of restoredLinks) {
@@ -13248,7 +13327,7 @@ function runLocalSuite(dir, cmd, budgetSecs) {
     }
     return { exit: r.exit, secs, diagnostics: r.diagnostics };
   } finally {
-    rmSync6(scratch, { recursive: true, force: true });
+    rmSync7(scratch, { recursive: true, force: true });
   }
 }
 function diagnosticsJson(diagnostics, includeTail) {
@@ -13401,7 +13480,7 @@ function runVerify(opts) {
   const visDir = join18(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync6(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync7(d, { recursive: true, force: true });
   };
   filesystemCaseSensitive = (opts.probeCaseSensitivity ?? probeFilesystemCaseSensitivity)(visRoot);
   if (!filesystemCaseSensitive) {
@@ -13767,8 +13846,8 @@ var init_verify = __esm({
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync7, statSync as statSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -13824,7 +13903,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   for (const candidate of candidates) {
     try {
       const real = realpathSync8(candidate);
-      const st = statSync6(real);
+      const st = statSync5(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
         real,
@@ -13947,7 +14026,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
       ...state.failure ? { failure: state.failure } : {}
     };
   } finally {
-    rmSync7(stateDir, { recursive: true, force: true });
+    rmSync8(stateDir, { recursive: true, force: true });
   }
 }
 function waitMs(ms) {
@@ -13978,7 +14057,7 @@ function supervisedObserverLog(cwd) {
   return join19(
     gd,
     "tamperward",
-    `run-observer-${process.pid}-${Date.now()}-${randomBytes(4).toString("hex")}.jsonl`
+    `run-observer-${process.pid}-${Date.now()}-${randomBytes2(4).toString("hex")}.jsonl`
   );
 }
 function startSupervisedObserver(cwd, base, entry) {
@@ -15320,7 +15399,7 @@ import {
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
-  rmSync as rmSync8,
+  rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
@@ -15518,8 +15597,8 @@ function runOneTrace(cwd, base, command, budget) {
       accesses: rewriteTraceRoot(accesses, root)
     };
   } finally {
-    rmSync8(root, { recursive: true, force: true });
-    rmSync8(traceDir, { recursive: true, force: true });
+    rmSync9(root, { recursive: true, force: true });
+    rmSync9(traceDir, { recursive: true, force: true });
   }
 }
 function renderText2(report2) {
@@ -15703,8 +15782,7 @@ var init_trace_verify = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, renameSync as renameSync3, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -15773,23 +15851,14 @@ function explainVerdict(v, code2) {
       return `Could not verify${v?.reason ? ` (${v.reason})` : ""} \u2014 TamperWard failed closed${v?.detail ? `: ${v.detail}` : "."}`;
   }
 }
-function atomicReplaceFile(path, content, mode) {
-  const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
-  try {
-    writeFileSync11(tmp, content, { encoding: "utf8", flag: "wx", mode });
-    renameSync3(tmp, path);
-  } finally {
-    rmSync9(tmp, { force: true });
-  }
-}
 function writeVerifyCommand(cwd, command) {
   const path = join22(cwd, POLICY_FILE);
-  const st = lstatSync10(path, { throwIfNoEntry: false });
-  if (st && (!st.isFile() || st.isSymbolicLink())) {
+  const kind = writeTargetKind(path);
+  if (kind === "symlink" || kind === "irregular") {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
-  const mode = st ? st.mode & 511 : 420;
-  const original = st ? readFileSync20(path, "utf8") : null;
+  const mode = existingMode(path, 420);
+  const original = kind === "file" ? readFileSync20(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -15806,7 +15875,7 @@ function writeVerifyCommand(cwd, command) {
     if (loaded2.verify?.command !== command) throw new Error("verify.command did not round-trip");
     return null;
   } catch (e) {
-    if (original === null) rmSync9(path, { force: true });
+    if (original === null) rmSync10(path, { force: true });
     else atomicReplaceFile(path, original, mode);
     return `the updated ${POLICY_FILE} does not load (${errorMessage(e)}); restored the previous file`;
   }
@@ -16206,7 +16275,7 @@ function runDemo(cwd, head, runners, out3) {
   } finally {
     git5(cwd, ["worktree", "remove", "--force", wt]);
     git5(cwd, ["worktree", "prune"]);
-    rmSync9(wt, { recursive: true, force: true });
+    rmSync10(wt, { recursive: true, force: true });
   }
   const after = treeFingerprint(cwd);
   out3(`working tree fingerprint after:  ${after.slice(0, 16)}`);
@@ -16231,6 +16300,7 @@ var init_onboard = __esm({
     init_policy_load();
     init_narrow();
     init_wiring();
+    init_safe_write();
     Aborted = class extends Error {
     };
     SECTIONS = [
@@ -16621,7 +16691,7 @@ var init_record = __esm({
 
 // src/research/run.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync10, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync22, renameSync as renameSync4, rmSync as rmSync11, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join23, resolve as resolve14 } from "node:path";
 function git6(args, cwd) {
   return execFileSync13("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -16669,12 +16739,12 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync12(tmp, text);
+  writeFileSync11(tmp, text);
   renameSync4(tmp, path);
 }
 function freshWorkspace(ledger, task, pair, arm, sourceBase) {
   const ws2 = join23(ledger, "workspaces", `${task.id}--${pair}--${arm}`);
-  rmSync10(ws2, { recursive: true, force: true });
+  rmSync11(ws2, { recursive: true, force: true });
   mkdirSync8(join23(ledger, "workspaces"), { recursive: true });
   try {
     execFileSync13("git", ["clone", "-q", "--no-hardlinks", task.repo, ws2], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.23.15",
+  "version": "2.23.17",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",