tamperward 2.25.2 → 2.27.0

package/dist/cli/index.js

@@ -500,6 +500,12 @@ function defaultPolicy(version = 1) {
         "**/tsconfig*.json",
         "**/.eslintrc*",
         "**/eslint.config.*",
+        // The lint's own blind-spot list and biome's config: read by
+        // config-weakening (#447) alongside tsconfig and the eslint configs, so a
+        // path added to `.eslintignore` is as visible as one added to `ignores`.
+        "**/.eslintignore",
+        "**/biome.json",
+        "**/biome.jsonc",
         "**/package.json",
         // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
         // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
@@ -594,6 +600,11 @@ function defaultPolicy(version = 1) {
       // harness/fp-study/CAST-GROWTH-CORPUS.md), so it is a review prompt, not a gate.
       "ts-cast-growth": { severity: "warn" },
       "lint-suppression": { severity: "block" },
+      // tsconfig strictness lowered, eslint/biome rules turned off or ignores grown,
+      // a runner setup module loaded from an unprotected file (#447). Ships warn
+      // against a committed corpus (harness/fp-study/CONFIG-WEAKENING-CORPUS.md);
+      // block is a separate decision with its own measurement.
+      "config-weakening": { severity: "warn" },
       "coverage-lowering": { severity: "block" },
       // the per-function form of coverage-lowering: an inline `istanbul ignore` /
       // `c8 ignore` / `v8 ignore` / `node:coverage ignore` / `# pragma: no cover` /
@@ -1079,7 +1090,7 @@ var init_trusted = __esm({
 
 // src/repo-context.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { accessSync, constants as constants2, existsSync as existsSync2, statSync } from "node:fs";
+import { accessSync, constants as constants2, existsSync as existsSync2, realpathSync as realpathSync3, statSync } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve } from "node:path";
 function rev(cwd, flag) {
   try {
@@ -1112,6 +1123,27 @@ function repoContext(cwd) {
 function repoRoot(cwd) {
   return repoContext(cwd)?.root ?? cwd;
 }
+function validateClaimAgainstRoot(claimedCwd, trustedRoot, base) {
+  if (claimedCwd === void 0) return { ok: true, trustedRoot };
+  if (typeof claimedCwd !== "string" || claimedCwd.trim() === "") return { ok: false, rejected: "malformed cwd claim" };
+  const abs = isAbsolute3(claimedCwd) ? claimedCwd : resolve(base, claimedCwd);
+  let realClaim;
+  try {
+    realClaim = realpathSync3(abs);
+  } catch (e) {
+    return { ok: false, rejected: `cwd claim path cannot be resolved (${abs}: ${e instanceof Error ? e.message : String(e)})` };
+  }
+  let realTrusted;
+  try {
+    realTrusted = realpathSync3(trustedRoot);
+  } catch {
+    realTrusted = trustedRoot;
+  }
+  const ctx = repoContext(realClaim);
+  if (!ctx) return { ok: false, rejected: `cwd claim resolves to no repository (${realClaim})` };
+  if (ctx.root !== realTrusted) return { ok: false, rejected: `cwd claim resolves to a different repository (${ctx.root} != trusted ${realTrusted})` };
+  return { ok: true, trustedRoot: realTrusted };
+}
 function outsideRepository(cwd) {
   const key2 = resolve(cwd);
   let isDir;
@@ -4200,24 +4232,24 @@ function topLevelStaticStrings(ctx) {
   }
   return resolved;
 }
-function staticPropertyName(expr, ctx, strings) {
+function staticPropertyName(expr, ctx, strings2) {
   if (ts.isStringLiteralLike(expr)) return { name: expr.text, causes: [] };
-  if (ts.isParenthesizedExpression(expr)) return staticPropertyName(expr.expression, ctx, strings);
+  if (ts.isParenthesizedExpression(expr)) return staticPropertyName(expr.expression, ctx, strings2);
   if (ts.isBinaryExpression(expr) && expr.operatorToken.kind === ts.SyntaxKind.PlusToken) {
-    const left = staticPropertyName(expr.left, ctx, strings);
-    const right = staticPropertyName(expr.right, ctx, strings);
+    const left = staticPropertyName(expr.left, ctx, strings2);
+    const right = staticPropertyName(expr.right, ctx, strings2);
     if (!left || !right) return null;
     return { name: left.name + right.name, causes: [...left.causes, ...right.causes] };
   }
   if (ts.isIdentifier(expr)) {
     const sym = symbolAt(ctx, expr);
     if (!sym) return null;
-    const value = strings.get(sym);
+    const value = strings2.get(sym);
     return value ? { name: value.value, causes: value.causes } : null;
   }
   return null;
 }
-function runnerChain(expr, ctx, binder, strings) {
+function runnerChain(expr, ctx, binder, strings2) {
   const props = [];
   const propNodes = [];
   const causes = [];
@@ -4232,7 +4264,7 @@ function runnerChain(expr, ctx, binder, strings) {
       continue;
     }
     if (!cur.argumentExpression) return null;
-    const property = staticPropertyName(cur.argumentExpression, ctx, strings);
+    const property = staticPropertyName(cur.argumentExpression, ctx, strings2);
     if (!property) return null;
     props.unshift(property.name);
     propNodes.unshift(cur.argumentExpression);
@@ -4286,7 +4318,7 @@ function structuralNodeKey(node, sf) {
   return `${node.kind}(${children.map((child) => structuralNodeKey(child, sf)).join(",")})`;
 }
 function semanticSkipHits(ctx, binder) {
-  const strings = topLevelStaticStrings(ctx);
+  const strings2 = topLevelStaticStrings(ctx);
   const hits = [];
   const unowned = /* @__PURE__ */ new Set();
   const callOrdinals = /* @__PURE__ */ new Map();
@@ -4298,7 +4330,7 @@ function semanticSkipHits(ctx, binder) {
       const ordinal = (callOrdinals.get(callIdentity) ?? 0) + 1;
       callOrdinals.set(callIdentity, ordinal);
       const callKey = `${callIdentity}\0${ordinal}`;
-      const chain = runnerChain(node.expression, ctx, binder, strings);
+      const chain = runnerChain(node.expression, ctx, binder, strings2);
       if (chain === "unknown") {
         const callee = node.expression;
         const first = lineOf(callee.getStart(ctx.sf));
@@ -4336,7 +4368,7 @@ function semanticSkipHits(ctx, binder) {
                 if (ts.isIdentifier(prop.name) || ts.isStringLiteralLike(prop.name)) {
                   name = prop.name.text;
                 } else if (ts.isComputedPropertyName(prop.name)) {
-                  const resolved = staticPropertyName(prop.name.expression, ctx, strings);
+                  const resolved = staticPropertyName(prop.name.expression, ctx, strings2);
                   name = resolved?.name ?? null;
                   propertyCauses = resolved?.causes ?? [];
                 }
@@ -5599,1123 +5631,980 @@ var init_coverage_lowering = __esm({
   }
 });
 
-// src/detectors/coverage-exclusion.ts
-function isText(line, idx, lang) {
-  const opener = LINE_COMMENT[lang];
-  let quote = null;
-  for (let j = 0; j < idx; j++) {
-    const ch = line[j];
-    if (quote) {
-      if (ch === "\\") j++;
-      else if (ch === quote) quote = null;
-      continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
-    else if (opener && opener.test(line.slice(j, j + 2))) return true;
+// src/detectors/suite-config.ts
+function runnerSkips(path) {
+  const parts = path.split("/");
+  if (/\.rs$/.test(path)) {
+    const i = parts.indexOf("tests");
+    if (i < 0 || parts.slice(0, i).includes("src")) return null;
+    const rest = parts.slice(i + 1);
+    if (rest.length === 1 || rest.length === 2 && rest[1] === "main.rs") return null;
+    return "cargo builds only tests/*.rs and tests/*/main.rs as test targets";
   }
-  return quote !== null;
+  if (/\.go$/.test(path)) {
+    const hit = parts.find((p) => p === "testdata" || p.startsWith("_") || p.startsWith("."));
+    if (hit === void 0) return null;
+    return `go test skips ${hit === "testdata" ? "testdata/" : hit.startsWith("_") ? "_*" : ".*"} paths (${JSON.stringify(hit)})`;
+  }
+  if (/\.py$/.test(path)) {
+    const hit = PYTEST_DEFAULT_IGNORE.find((g) => globs2([g])(path));
+    return hit === void 0 ? null : `pytest's default norecursedirs matches it (${JSON.stringify(hit)})`;
+  }
+  if (/\.[cm]?[jt]sx?$/.test(path)) {
+    const hit = JS_UNWALKED.find((g) => globs2([g])(path));
+    return hit === void 0 ? null : `the runner's default exclude matches it (${JSON.stringify(hit)})`;
+  }
+  return null;
 }
-var RULE6, PATTERNS3, OUT_OF_SCOPE_PATH, LINE_COMMENT, coverageExclusion;
-var init_coverage_exclusion = __esm({
-  "src/detectors/coverage-exclusion.ts"() {
-    "use strict";
-    init_select();
-    init_files();
-    init_policy();
-    init_finding();
-    RULE6 = "coverage-exclusion";
-    PATTERNS3 = {
-      js: [
-        { re: /\/\*\s*istanbul\s+ignore\b/, why: "`istanbul ignore` takes the next statement, branch or the whole file out of the coverage measurement" },
-        { re: /\/\*\s*c8\s+ignore\b(?!\s*stop\b)/, why: "`c8 ignore` takes the next statement or the marked range out of the coverage measurement" },
-        { re: /\/\*\s*v8\s+ignore\b(?!\s*stop\b)/, why: "`v8 ignore` takes the next statement or the marked range out of the coverage measurement" },
-        { re: /\/\*\s*node:coverage\s+(?:ignore|disable)\b/, why: "`node:coverage ignore/disable` takes the following code out of the coverage measurement" }
-      ],
-      py: [{ re: /#\s*pragma[:\s]\s*no\s*cover\b/i, why: "`# pragma: no cover` takes the line or block out of the coverage measurement" }],
-      rs: [{ re: /#\s*!?\[[^\]]*\bcoverage\s*\(\s*off\s*\)/, why: "`#[coverage(off)]` takes the item out of the coverage measurement" }],
-      go: [
-        {
-          re: /^\s*\/\/\s*(?:go:build\b|\+build\b)/,
-          why: "a build constraint added to an existing file takes it out of the default build, and out of `go test -cover`",
-          existingOnly: true
-        }
-      ]
-    };
-    OUT_OF_SCOPE_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|out|coverage|generated|__generated__|codegen|examples?|docs?|scripts?|fixtures?|__fixtures__|__mocks__)\/|\.d\.[cm]?ts$|\.(?:generated|gen|pb)\.[^/]*$/;
-    LINE_COMMENT = { js: /^\/\//, go: /^\/\//, rs: /^\/\//, py: /^#/ };
-    coverageExclusion = {
-      id: RULE6,
-      surface: ["file"],
-      certainty: "mechanical",
-      run(changes, policy) {
-        const out3 = [];
-        for (const c of changes) {
-          if (c.kind !== "file" || c.op === "delete") continue;
-          const lang = langOf(c.path);
-          if (!lang) continue;
-          const patterns = PATTERNS3[lang];
-          if (!patterns) continue;
-          const category = protectedCategory(c.path, policy);
-          if (OUT_OF_SCOPE_PATH.test(c.path) || category === "tests" || category === "config") continue;
-          const removed = new Set(removedLines(c).map((l) => l.content.trim()));
-          const before = c.before ?? "";
-          for (const l of addedLines(c)) {
-            const trimmed = l.content.trim();
-            if (removed.has(trimmed)) continue;
-            for (const p of patterns) {
-              const m = p.re.exec(l.content);
-              if (!m || isText(l.content, m.index, lang)) continue;
-              if (p.existingOnly && (c.op === "add" || c.before == null || before.split("\n").some((b) => p.re.test(b)))) continue;
-              out3.push(
-                makeFinding(RULE6, policy, {
-                  file: c.path,
-                  line: l.newLine ?? void 0,
-                  message: `Coverage exclusion added: ${p.why}.`,
-                  evidence: trimmed,
-                  remediation: "Cover the code with a test instead of excluding it from the measurement; if it is genuinely unreachable, say so in review.",
-                  defaultSeverity: "warn"
-                })
-              );
-              break;
-            }
-          }
-        }
-        return out3;
-      }
-    };
+function keyName2(name) {
+  if (ts.isIdentifier(name) || ts.isStringLiteral(name)) return name.text;
+  return null;
+}
+function literals2(e) {
+  if (isStr(e)) return { items: [e.text], opaque: false };
+  if (!ts.isArrayLiteralExpression(e)) return { items: [], opaque: true };
+  const items = [];
+  let opaque = false;
+  for (const el of e.elements) {
+    if (isStr(el)) items.push(el.text);
+    else if (ts.isSpreadElement(el) && /^(?:configDefaults\.|default)(?:exclude|include)$/i.test(el.expression.getText())) {
+      items.push(.../exclude$/i.test(el.expression.getText()) ? VITEST_DEFAULT_EXCLUDE : VITEST_DEFAULT_INCLUDE);
+    } else opaque = true;
   }
-});
-
-// src/detectors/gh-expression.ts
-function foldExpressions(s) {
-  return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
-    const v = foldConst(e.trim());
-    if (v !== void 0 && v !== TRUTHY) return String(v);
-    return /\b(?:matrix|strategy|inputs)\./.test(e) ? MATRIX_TOKEN : EXPR_TOKEN;
-  });
+  return { items, opaque };
 }
-function lex(src) {
-  const out3 = [];
-  let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    if (/\s/.test(ch)) {
-      i++;
-      continue;
-    }
-    if (ch === "'") {
-      let j = i + 1;
-      let s = "";
-      while (j < src.length) {
-        if (src[j] === "'" && src[j + 1] === "'") {
-          s += "'";
-          j += 2;
-        } else if (src[j] === "'") break;
-        else s += src[j++];
-      }
-      if (j >= src.length) return null;
-      out3.push({ t: "str", v: s });
-      i = j + 1;
-      continue;
-    }
-    const num = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
-    if (num) {
-      out3.push({ t: "num", v: num[0] });
-      i += num[0].length;
-      continue;
-    }
-    const op = src.slice(i).match(/^(?:==|!=|&&|\|\||<=|>=|[!()<>,[\]])/);
-    if (op) {
-      out3.push({ t: "op", v: op[0] });
-      i += op[0].length;
+function ownerKey2(node) {
+  const obj = node.parent;
+  if (!obj || !ts.isObjectLiteralExpression(obj)) return null;
+  let q = obj.parent;
+  while (q && (ts.isParenthesizedExpression(q) || ts.isAsExpression(q) || q.kind === ts.SyntaxKind.SatisfiesExpression)) q = q.parent;
+  return q && ts.isPropertyAssignment(q) ? keyName2(q.name) : null;
+}
+function asExpression2(src) {
+  const t = src.trim();
+  return t.startsWith("{") ? `(${t})` : src;
+}
+function runnerOf(path, content) {
+  const base = path.split("/").pop() ?? path;
+  if (/^jest\.config\./.test(base) || base === "package.json") return "jest";
+  if (/^vitest\.(?:config|workspace)\./.test(base)) return "vitest";
+  if (/^vite\.config\./.test(base) && content != null && /(?:^|[\s,{])["']?test["']?\s*:/m.test(content)) return "vitest";
+  if (base === "pytest.ini" || base === ".pytest.ini") return "pytest";
+  if (content == null) return null;
+  if (base === "tox.ini" && /^\s*\[pytest\]/m.test(content)) return "pytest";
+  if (base === "setup.cfg" && /^\s*\[tool:pytest\]/m.test(content)) return "pytest";
+  if (base === "pyproject.toml" && /^\s*\[tool\.pytest\.ini_options\]/m.test(content)) return "pytest";
+  return null;
+}
+function claimsPytest(name, src) {
+  if (name === "pytest.ini" || name === ".pytest.ini") return true;
+  const section = name === "pyproject.toml" ? /^\s*\[tool\.pytest\.ini_options\]\s*$/m : name === "tox.ini" ? /^\s*\[pytest\]\s*$/m : name === "setup.cfg" ? /^\s*\[tool:pytest\]\s*$/m : null;
+  return section !== null && section.test(src);
+}
+function effectivePytestFile(files) {
+  for (const name of PYTEST_INI_ORDER) {
+    const content = files.get(name);
+    if (content == null) continue;
+    if (claimsPytest(name, content)) return { path: name, content };
+  }
+  return null;
+}
+function effectivePytestConfig(path, ctx) {
+  if (path.includes("/")) return false;
+  const base = path;
+  const rank = PYTEST_INI_ORDER.findIndex((name) => name === base);
+  if (rank < 0) return false;
+  const files = ctx?.trackedFiles;
+  if (!files) return true;
+  const rootNames = new Set(files.filter((f) => !f.includes("/")));
+  return !PYTEST_INI_ORDER.slice(0, rank).some((n) => rootNames.has(n));
+}
+function pytestBlock(src) {
+  const lines = src.split(/\r?\n/);
+  const head = /^\s*\[(pytest|tool:pytest|tool\.pytest\.ini_options)\]\s*$/;
+  let i = lines.findIndex((l) => head.test(l));
+  if (i < 0) return null;
+  const out3 = {};
+  let key2 = null;
+  for (i += 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\s*\[/.test(line)) break;
+    if (/^\s*[#;]/.test(line) || !line.trim()) {
       continue;
     }
-    const id = src.slice(i).match(/^[A-Za-z_][\w.\-*]*/);
-    if (id) {
-      out3.push({ t: "id", v: id[0] });
-      i += id[0].length;
+    const m = line.match(/^(\w[\w.-]*)\s*[=:]\s*(.*)$/);
+    if (m) {
+      key2 = m[1];
+      out3[key2] = m[2].trim();
       continue;
     }
-    return null;
+    if (key2 && /^\s+\S/.test(line)) out3[key2] += " " + line.trim();
   }
   return out3;
 }
-function foldConst(src) {
-  const toks = lex(src);
-  if (!toks) return void 0;
-  let p = 0;
-  const peek = () => toks[p];
-  const eat = (v2) => toks[p]?.t === "op" && toks[p].v === v2 ? (p++, true) : false;
-  const num = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
-  const eq = (a, b) => {
-    if (a === TRUTHY || b === TRUTHY) return void 0;
-    if (typeof a === "string" && typeof b === "string") return a.toLowerCase() === b.toLowerCase();
-    if (a === null && b === null) return true;
-    const x = num(a);
-    const y2 = num(b);
-    return !Number.isNaN(x) && x === y2;
-  };
-  const or = () => {
-    let l = and();
-    while (eat("||")) {
-      const r = and();
-      if (l !== void 0 && truthy(l)) continue;
-      if (l !== void 0) l = r;
-      else l = r !== void 0 && truthy(r) ? TRUTHY : void 0;
-    }
-    return l;
+function pytestTokens(raw) {
+  const v = raw.trim();
+  if (v.startsWith("[")) {
+    return [...v.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
+  }
+  const unq2 = v.replace(/^"([\s\S]*)"$/, "$1").replace(/^'([\s\S]*)'$/, "$1");
+  return [...unq2.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "").filter(Boolean);
+}
+function pytestSelection(src) {
+  const sel = empty();
+  const blk = pytestBlock(src);
+  if (!blk) return sel;
+  sel.present = true;
+  const ignore = blk.norecursedirs !== void 0 ? pytestTokens(blk.norecursedirs).flatMap((d) => pathGlobs(d).map((pattern) => ({ pattern, key: "norecursedirs" }))) : PYTEST_DEFAULT_IGNORE.map((pattern) => ({ pattern, key: "norecursedirs" }));
+  if (blk.testpaths !== void 0) sel.roots = pytestTokens(blk.testpaths).map((t) => t.replace(/^\.\//, ""));
+  if (blk.python_files !== void 0) sel.include = pytestTokens(blk.python_files).map((g) => g.includes("/") ? g : "**/" + g);
+  for (const key2 of ["python_classes", "python_functions"]) {
+    if (blk[key2] !== void 0) ignore.push({ pattern: "\0" + key2, key: key2 });
+  }
+  const opts = blk.addopts !== void 0 ? pytestTokens(blk.addopts) : [];
+  for (let j = 0; j < opts.length; j++) {
+    const o = opts[j];
+    const val = (inline) => o.includes("=") ? o.slice(o.indexOf("=") + 1) : opts[++j] ?? inline;
+    if (o === "--ignore" || o.startsWith("--ignore=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--ignore" });
+    else if (o === "--ignore-glob" || o.startsWith("--ignore-glob=")) {
+      const g = val("");
+      ignore.push({ pattern: g, key: "--ignore-glob" });
+      if (!g.startsWith("**/") && !g.startsWith("/")) ignore.push({ pattern: "**/" + g, key: "--ignore-glob" });
+    } else if (o === "--deselect" || o.startsWith("--deselect=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--deselect" });
+    else if (o === "-k" || o.startsWith("-k=")) {
+      for (const w of (val("").match(/\bnot\s+([A-Za-z_][\w]*)/g) ?? []).map((t) => t.replace(/^not\s+/, "")))
+        ignore.push({ pattern: `**/*${w}*`, key: "-k" });
+    } else if (o === "-m" || o.startsWith("-m=")) {
+      ignore.push({ pattern: "\0-m " + val(""), key: "-m" });
+    } else if (o === "-p" || o.startsWith("-p=") || o.length > 2 && o.startsWith("-p")) {
+      const v = o === "-p" ? opts[++j] ?? "" : o.startsWith("-p=") ? o.slice(3) : o.slice(2);
+      if (v.startsWith("no:")) ignore.push({ pattern: "\0-p " + v, key: "-p" });
+    } else if (o === "--collect-only" || o === "--co") ignore.push({ pattern: "**", key: o });
+  }
+  sel.ignore = ignore;
+  return sel;
+}
+function dirValue(e) {
+  if (!isStr(e)) return { dir: null, opaque: true };
+  const d = stripRootDir(e.text).replace(/^\.\//, "").replace(/\/+$/, "");
+  if (d === "." || d === "" || d.split("/").includes("..")) return { dir: null, opaque: false };
+  return { dir: d, opaque: false };
+}
+function collect(root, runner) {
+  const sel = empty();
+  const seen = /* @__PURE__ */ new Set();
+  const take = (key2, e) => {
+    const { items, opaque } = literals2(e);
+    if (opaque || seen.has(key2)) sel.opaque = true;
+    seen.add(key2);
+    sel.present = true;
+    return items.map(stripRootDir);
   };
-  const and = () => {
-    let l = cmp();
-    while (eat("&&")) {
-      const r = cmp();
-      if (l !== void 0 && !truthy(l)) continue;
-      if (l !== void 0) l = r;
-      else l = r !== void 0 && !truthy(r) ? false : void 0;
-    }
-    return l;
+  const ignores = (key2, e) => {
+    const entries = take(key2, e).map((pattern) => ({ pattern, key: key2 }));
+    sel.ignore = [...sel.ignore ?? [], ...entries];
   };
-  const cmp = () => {
-    let l = unary();
-    for (; ; ) {
-      const t = peek();
-      if (!t || t.t !== "op" || !/^(?:==|!=|<|>|<=|>=)$/.test(t.v)) return l;
-      p++;
-      const r = unary();
-      if (l === void 0 || r === void 0) {
-        l = void 0;
-        continue;
-      }
-      if (t.v === "==" || t.v === "!=") {
-        const e = eq(l, r);
-        l = e === void 0 ? void 0 : t.v === "==" ? e : !e;
-      } else {
-        const x = num(l);
-        const y2 = num(r);
-        if (Number.isNaN(x) || Number.isNaN(y2)) l = void 0;
-        else l = t.v === "<" ? x < y2 : t.v === ">" ? x > y2 : t.v === "<=" ? x <= y2 : x >= y2;
-      }
-    }
+  const namePattern = (e) => {
+    sel.present = true;
+    sel.wide.push({ pattern: "\0testNamePattern " + (isStr(e) ? e.text : e.getText()), key: "testNamePattern" });
   };
-  const unary = () => {
-    if (eat("!")) {
-      const v2 = unary();
-      return v2 === void 0 ? void 0 : !truthy(v2);
-    }
-    return primary();
+  let projectList = null;
+  const projects = (e) => {
+    sel.present = true;
+    projectList = e;
   };
-  const primary = () => {
-    const t = peek();
-    if (!t) return void 0;
-    if (eat("(")) {
-      const v2 = or();
-      return eat(")") ? v2 : void 0;
+  const visit = (node) => {
+    if (ts.isSpreadAssignment(node) && spreadsIntoConfig(node, runner)) {
+      sel.present = true;
+      sel.opaque = true;
     }
-    p++;
-    if (t.t === "str") return t.v;
-    if (t.t === "num") return Number(t.v);
-    if (t.t === "id") {
-      if (/^true$/i.test(t.v)) return true;
-      if (/^false$/i.test(t.v)) return false;
-      if (/^null$/i.test(t.v)) return null;
-      if (eat("(")) {
-        const args = [];
-        if (!eat(")")) {
-          for (; ; ) {
-            args.push(or());
-            if (eat(")")) break;
-            if (!eat(",")) return void 0;
-          }
-        }
-        let indexed = false;
-        while (eat("[")) {
-          or();
-          indexed = true;
-          if (!eat("]")) return void 0;
-        }
-        if (indexed) return void 0;
-        return callConst(t.v, args);
-      }
-      while (eat("[")) {
-        or();
-        if (!eat("]")) return void 0;
+    if (ts.isCallExpression(node) && /^(?:\w+\.)?mergeConfig$/.test(node.expression.getText()) && node.arguments[0] && !ts.isObjectLiteralExpression(unwrapConfigCall(node.arguments[0]))) {
+      sel.present = true;
+      sel.opaque = true;
+    }
+    if (ts.isPropertyAssignment(node)) {
+      const k = keyName2(node.name);
+      if (runner === "jest") {
+        if (k === "testMatch") sel.include = take(k, node.initializer);
+        else if (k === "testRegex") sel.regex = take(k, node.initializer);
+        else if (k === "testPathIgnorePatterns" || k === "modulePathIgnorePatterns") ignores(k, node.initializer);
+        else if (k === "roots") sel.roots = take(k, node.initializer);
+        else if (k === "rootDir") {
+          const { dir, opaque } = dirValue(node.initializer);
+          sel.present = true;
+          if (opaque) sel.opaque = true;
+          else sel.base = dir;
+        } else if (k === "projects") {
+          projects(node.initializer);
+          return;
+        } else if (k === "testNamePattern") namePattern(node.initializer);
+      } else if (ownerKey2(node) === "test") {
+        if (k === "include") sel.include = take(k, node.initializer);
+        else if (k === "exclude") ignores(k, node.initializer);
+        else if (k === "dir" || k === "root") {
+          const { dir, opaque } = dirValue(node.initializer);
+          sel.present = true;
+          if (opaque) sel.opaque = true;
+          else sel.base = dir;
+        } else if (k === "projects") {
+          projects(node.initializer);
+          return;
+        } else if (k === "testNamePattern") namePattern(node.initializer);
       }
-      return void 0;
     }
-    return void 0;
+    ts.forEachChild(node, visit);
   };
-  const v = or();
-  return p === toks.length ? v : void 0;
+  visit(root);
+  if (projectList) sel.projects = readProjects(projectList, sel, runner);
+  if (sel.projects?.some((p) => p.opaque)) sel.opaque = true;
+  return sel;
 }
-function callConst(name, args) {
-  const vals = [];
-  for (const a of args) {
-    if (a === void 0 || a === TRUTHY) return void 0;
-    vals.push(a);
+function unwrapConfigCall(e) {
+  let x = e;
+  while (ts.isParenthesizedExpression(x) || ts.isAsExpression(x) || ts.isSatisfiesExpression(x)) {
+    x = x.expression;
   }
-  const s = (i) => vals[i] == null ? "" : String(vals[i]);
-  switch (name.toLowerCase()) {
-    case "contains":
-      return vals.length === 2 ? s(0).toLowerCase().includes(s(1).toLowerCase()) : void 0;
-    case "startswith":
-      return vals.length === 2 ? s(0).toLowerCase().startsWith(s(1).toLowerCase()) : void 0;
-    case "endswith":
-      return vals.length === 2 ? s(0).toLowerCase().endsWith(s(1).toLowerCase()) : void 0;
-    case "format": {
-      if (vals.length < 1) return void 0;
-      return s(0).replace(/\{\{|\}\}|\{(\d+)\}/g, (m, i) => m === "{{" ? "{" : m === "}}" ? "}" : s(Number(i) + 1));
-    }
-    case "join":
-      return vals.length >= 1 && vals.length <= 2 ? s(0) : void 0;
-    case "tojson":
-      return vals.length === 1 ? JSON.stringify(vals[0]) : void 0;
-    case "fromjson": {
-      if (vals.length !== 1) return void 0;
-      try {
-        const v = JSON.parse(s(0));
-        if (v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean") return v;
-        return TRUTHY;
-      } catch {
-        return void 0;
-      }
-    }
-    default:
-      return void 0;
+  if (ts.isCallExpression(x) && /^(?:\w+\.)?define(?:Config|Project)$/.test(x.expression.getText()) && x.arguments[0]) return unwrapConfigCall(x.arguments[0]);
+  return x;
+}
+function spreadsIntoConfig(node, runner) {
+  const obj = node.parent;
+  if (!ts.isObjectLiteralExpression(obj)) return false;
+  const keys = obj.properties.map((p) => ts.isPropertyAssignment(p) ? keyName2(p.name) : null);
+  if (runner === "vitest") {
+    if (keys.includes("test")) return true;
+    let q = obj.parent;
+    while (q && (ts.isParenthesizedExpression(q) || ts.isAsExpression(q) || q.kind === ts.SyntaxKind.SatisfiesExpression)) q = q.parent;
+    return !!q && ts.isPropertyAssignment(q) && keyName2(q.name) === "test";
   }
+  return keys.some((k) => k !== null && JEST_SELECTION_KEYS.test(k));
 }
-var EXPR_TOKEN, MATRIX_TOKEN, TRUTHY, truthy;
-var init_gh_expression = __esm({
-  "src/detectors/gh-expression.ts"() {
-    "use strict";
-    EXPR_TOKEN = "__expr__";
-    MATRIX_TOKEN = "__matrix__";
-    TRUTHY = /* @__PURE__ */ Symbol("truthy");
-    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
+function extendsOf(el) {
+  for (const p of el.properties) {
+    if (!ts.isPropertyAssignment(p) || keyName2(p.name) !== "extends") continue;
+    if (p.initializer.kind === ts.SyntaxKind.TrueKeyword) return true;
+    if (p.initializer.kind === ts.SyntaxKind.FalseKeyword) return null;
+    return "path";
   }
-});
-
-// src/detectors/invocation.ts
-function canonical(core) {
-  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
-  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
-  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
-  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
-  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
-  s = s.replace(/^exec\s+/, "");
-  return s.replace(/\s+--\s*$/, "").trim();
+  return null;
 }
-function runnerNarrowed(cmd, args) {
-  return runnerNarrowing(cmd, args) !== null;
-}
-function runnerNarrowing(cmd, args) {
-  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
-  const m = t ? (" " + args.trim()).match(t.flags) : null;
-  return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
-}
-function coverageFloorLowered(removed, added) {
-  const was = removed.match(COVERAGE_FLOOR);
-  const now = added.match(COVERAGE_FLOOR);
-  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
-}
-function inCommandPosition(core) {
-  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
+function readProject(el, root, runner) {
+  const p = collect(el, runner);
+  const ext = extendsOf(el);
+  if (ext === "path") p.opaque = true;
+  else if (ext === true && root) {
+    p.include ??= root.include;
+    p.regex ??= root.regex;
+    p.ignore ??= root.ignore;
+    p.roots ??= root.roots;
+    p.base ??= root.base;
+    if (root.opaque) p.opaque = true;
+  }
+  p.present = true;
+  return p;
 }
-function narrowedByPositional(args) {
-  return positionalOf(args) !== null;
+function readProjects(e, root, runner) {
+  if (!ts.isArrayLiteralExpression(e)) {
+    root.opaque = true;
+    return [];
+  }
+  const list3 = [];
+  for (const el of e.elements) {
+    const lit = unwrapConfigCall(el);
+    if (ts.isObjectLiteralExpression(lit)) list3.push(readProject(lit, root, runner));
+    else root.opaque = true;
+  }
+  return list3;
 }
-function positionalOf(args) {
-  const toks = args.trim().split(/\s+/).filter(Boolean);
-  for (let i = 0; i < toks.length; i++) {
-    const t = toks[i];
-    if (t === "--" || t.startsWith("-")) continue;
-    const prev = toks[i - 1];
-    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
-    if (/[<>|;&]/.test(t)) continue;
-    if (PATH_SHAPED.test(t)) return t;
+function workspaceArray(sf) {
+  for (const st of sf.statements) {
+    let e;
+    if (ts.isExportAssignment(st)) e = st.expression;
+    else if (ts.isExpressionStatement(st) && ts.isBinaryExpression(st.expression) && /module\.exports/.test(st.expression.left.getText())) e = st.expression.right;
+    if (!e) continue;
+    while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isSatisfiesExpression(e)) {
+      e = e.expression;
+    }
+    if (ts.isCallExpression(e) && e.arguments.length > 0) e = e.arguments[0];
+    return ts.isArrayLiteralExpression(e) ? e : null;
   }
   return null;
 }
-function checkKind(core) {
-  if (!invokesCheck(core)) return null;
-  const s = canonical(core);
-  if (/\btamperward\b/.test(s)) return "gate";
-  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
-  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
-  return "test";
-}
-function survives(removedCore, isUses, afterCores, addedCores) {
-  if (isUses) {
-    const ref = usesRef(removedCore);
-    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
+function parseSelection(src, runner, path = "") {
+  let sel = empty();
+  if (runner === "pytest") return pytestSelection(src);
+  try {
+    const sf = parseSource("cfg.ts", asExpression2(src));
+    if (!sf) return sel;
+    if (runner === "vitest" && isWorkspaceFile(path)) {
+      const arr = workspaceArray(sf);
+      if (arr) {
+        sel.projects = readProjects(arr, sel, runner);
+        sel.present = true;
+        if (sel.projects.some((p) => p.opaque)) sel.opaque = true;
+      } else if (src.trim()) sel.opaque = true;
+    } else sel = collect(sf, runner);
+  } catch {
   }
-  const r = canonical(removedCore);
-  const kind = checkKind(removedCore);
-  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
-  let neutralised;
-  for (const raw of afterCores) {
-    const a = canonical(raw);
-    if (a === r) return { state: "kept" };
-    if (a.startsWith(r + " ")) {
-      const rest = a.slice(r.length);
-      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
-      else return { state: "kept" };
-    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
-      return { state: "kept" };
-    } else {
-      const w = a.match(TIMEOUT_WRAP);
-      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
-    }
+  return sel;
+}
+function predicate(sel, runner) {
+  if (sel.projects) {
+    const ps = sel.projects.map((p) => predicate(p, runner));
+    const wide = sel.wide[0];
+    return {
+      selects: (p) => wide === void 0 && ps.some((x) => x.selects(p)),
+      why: (p) => wide !== void 0 ? wideWhy(wide) : ps.length ? `no project selects it (${ps[0].why(p)})` : "the projects list is empty"
+    };
   }
-  const maskOf = (args) => (" " + args).match(NEUTRALISING_SUFFIX)?.[0]?.trim() ?? null;
-  const priorMask = r.includes(" ") ? maskOf(r.slice(r.indexOf(" ") + 1)) : null;
-  let respelled = false;
-  for (const raw of addedCores) {
-    if (!kind || checkKind(raw) !== kind) continue;
-    const a = canonical(raw);
-    if (a.match(TIMEOUT_WRAP)) {
-      neutralised ??= raw;
-      continue;
-    }
-    if (!inCommandPosition(raw)) continue;
-    if (coverageFloorLowered(r, a)) {
-      neutralised ??= raw;
-      continue;
+  const includeList = sel.include ?? (runner === "jest" ? sel.regex ? null : JEST_DEFAULT_MATCH : runner === "pytest" ? PYTEST_DEFAULT_INCLUDE : VITEST_DEFAULT_INCLUDE);
+  const ignoreList = sel.ignore ?? (runner === "jest" ? JEST_DEFAULT_IGNORE : runner === "pytest" ? PYTEST_DEFAULT_IGNORE : VITEST_DEFAULT_EXCLUDE).map((pattern) => ({
+    pattern,
+    key: runner === "jest" ? "testPathIgnorePatterns" : runner === "pytest" ? "norecursedirs" : "test.exclude"
+  }));
+  const blockWide = [...ignoreList.filter((e) => e.pattern.startsWith("\0")), ...sel.wide];
+  const included = includeList ? globList2(includeList) : sel.regex ? regexes(sel.regex) : () => true;
+  const ignoredBy = (p) => blockWide[0] ?? ignoreList.filter((e) => !e.pattern.startsWith("\0")).find((e) => (runner === "jest" ? regexes([e.pattern]) : globs2([e.pattern]))(p));
+  const roots = sel.roots?.map((r) => r.replace(/^\.\//, "").replace(/\/+$/, "")).map((r) => r === "." ? "" : r) ?? null;
+  const rebase = (p) => sel.base === null ? p : underDir(p, sel.base) ? p.slice(sel.base.length + 1) : null;
+  const inRoots = (p) => roots === null || roots.some((r) => underDir(p, r));
+  return {
+    selects: (p) => {
+      const r = rebase(p);
+      return r !== null && inRoots(r) && included(r) && !ignoredBy(r);
+    },
+    why: (p) => {
+      const r = rebase(p);
+      const baseKey = runner === "jest" ? "rootDir" : "test.dir";
+      if (r === null) return `${baseKey} no longer covers it (${JSON.stringify(sel.base)})`;
+      if (!inRoots(r)) return `roots no longer covers it (${JSON.stringify(sel.roots)})`;
+      const hit = ignoredBy(r);
+      if (hit) {
+        if (hit.pattern.startsWith("\0")) return wideWhy(hit);
+        return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(hit.pattern)})`;
+      }
+      const key2 = runner === "jest" ? sel.include ? "testMatch" : sel.regex ? "testRegex" : "testMatch (default)" : sel.include ? "test.include" : "test.include (default)";
+      return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? includeList ?? [])})`;
     }
-    const args = a.slice(a.indexOf(" ") + 1 || a.length);
-    const mask = maskOf(args);
-    const newMask = mask !== null && mask !== priorMask;
-    if (a.includes(" ") && (newMask || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
-    else respelled = true;
-  }
-  if (respelled) return { state: "kept" };
-  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
+  };
 }
-function unwrap(seg) {
-  const s = seg.trim().replace(PYTHON_M, "").replace(NODE_BIN, "$1").replace(BIN_OF, "$1$2");
-  if (invokesCheck(s) || PRINTER.test(s) || /^["']/.test(s)) return s;
-  const toks = s.split(/\s+/);
-  for (let i = 1; i < toks.length && i <= 16; i++) {
-    const rest = toks.slice(i).join(" ");
-    if (invokesCheck(rest)) return rest;
+function suiteNarrowings(before, after, path, samples) {
+  const runner = runnerOf(path, after) ?? runnerOf(path, before);
+  if (!runner) return [];
+  const b = parseSelection(before ?? "", runner, path);
+  const a = parseSelection(after, runner, path);
+  if (!a.present || a.opaque) return [];
+  const pb = predicate(b, runner);
+  const pa = predicate(a, runner);
+  const out3 = [];
+  for (const s of samples) {
+    if (pb.selects(s) && !pa.selects(s)) out3.push({ path: s, reason: pa.why(s) });
   }
-  return s;
-}
-function scriptKind3(inner) {
-  const kind = checkKind(inner);
-  if (!kind) return null;
-  const head = canonical(inner).match(/^(tests?|lint|type-?check|coverage)(?=[\s:]|$)/i)?.[1];
-  if (!head) return kind;
-  return /^type/i.test(head) ? "types" : /^lint/i.test(head) ? "lint" : "test";
+  return out3;
 }
-function runnerOfSegment(canon) {
-  const m = canon.match(RUNNER_NAME);
-  if (!m) return null;
-  const n = m[1];
-  return n === "jest" || n === "vitest" || n === "mocha" || n === "pytest" || n === "go" || n === "cargo" ? n : "node";
+function requiredPath(e) {
+  let x = e;
+  while (ts.isParenthesizedExpression(x) || ts.isAsExpression(x) || ts.isSatisfiesExpression(x) || ts.isAwaitExpression(x)) x = x.expression;
+  if (ts.isCallExpression(x) && x.arguments.length > 0 && isStr(x.arguments[0])) {
+    const callee = x.expression;
+    if (ts.isIdentifier(callee) && callee.text === "require" || callee.kind === ts.SyntaxKind.ImportKeyword) return x.arguments[0].text;
+  }
+  return null;
 }
-function statements(raw) {
+function delegationsIn(src, runner) {
   const out3 = [];
-  let single = false;
-  let double = false;
-  let last = 0;
-  for (let i = 0; i < raw.length; i++) {
-    const ch = raw[i];
-    if (ch === "\\" && !single) {
-      i++;
-      continue;
-    }
-    if (ch === "'" && !double) {
-      single = !single;
-      continue;
+  const seen = /* @__PURE__ */ new Set();
+  const add = (target, how, local = true) => {
+    if (local && !isLocalPath(target) || hasGlob(target) || seen.has(target)) return;
+    seen.add(target);
+    out3.push({ target, how });
+  };
+  let sf = null;
+  try {
+    sf = parseSource("cfg.ts", asExpression2(src));
+  } catch {
+    return out3;
+  }
+  if (!sf) return out3;
+  const bound = /* @__PURE__ */ new Map();
+  const bindNames = (name, spec2) => {
+    if (ts.isIdentifier(name)) bound.set(name.text, spec2);
+    else for (const el of name.elements) if (ts.isBindingElement(el)) bindNames(el.name, spec2);
+  };
+  for (const st of sf.statements) {
+    if (ts.isImportDeclaration(st) && isStr(st.moduleSpecifier) && isLocalPath(st.moduleSpecifier.text) && st.importClause) {
+      const spec2 = st.moduleSpecifier.text;
+      if (st.importClause.name) bound.set(st.importClause.name.text, spec2);
+      const nb = st.importClause.namedBindings;
+      if (nb && ts.isNamespaceImport(nb)) bound.set(nb.name.text, spec2);
+      else if (nb) for (const el of nb.elements) bound.set(el.name.text, spec2);
+    } else if (ts.isVariableStatement(st)) {
+      for (const d of st.declarationList.declarations) {
+        const spec2 = d.initializer ? requiredPath(d.initializer) : null;
+        if (spec2 !== null && isLocalPath(spec2)) bindNames(d.name, spec2);
+      }
     }
-    if (ch === '"' && !single) {
-      double = !double;
-      continue;
+  }
+  const moduleOf = (e) => {
+    let x = e;
+    while (ts.isParenthesizedExpression(x) || ts.isAsExpression(x) || ts.isSatisfiesExpression(x) || ts.isAwaitExpression(x) || ts.isPropertyAccessExpression(x) || ts.isNonNullExpression(x))
+      x = x.expression;
+    if (ts.isIdentifier(x)) return bound.get(x.text) ?? null;
+    return requiredPath(x);
+  };
+  const exported = (e, how) => {
+    const m = moduleOf(unwrapConfigCall(e));
+    if (m !== null) add(m, how);
+  };
+  const visit = (node) => {
+    if (ts.isExportDeclaration(node) && node.moduleSpecifier && isStr(node.moduleSpecifier)) {
+      const clause = node.exportClause;
+      const whole = !clause || ts.isNamedExports(clause) && clause.elements.some((el) => el.name.text === "default");
+      if (whole) add(node.moduleSpecifier.text, oneLine(node));
+    } else if (ts.isExportAssignment(node)) {
+      exported(node.expression, oneLine(node));
+    } else if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken && /^(?:module\.)?exports(?:\.default)?$/.test(node.left.getText())) {
+      exported(node.right, oneLine(node));
+    } else if (ts.isSpreadAssignment(node)) {
+      const m = moduleOf(node.expression);
+      if (m !== null) add(m, `...${oneLine(node.expression)}`);
+    } else if (ts.isCallExpression(node) && /^(?:\w+\.)?mergeConfig$/.test(node.expression.getText()) && node.arguments[0]) {
+      const m = moduleOf(node.arguments[0]);
+      if (m !== null) add(m, `${oneLine(node.expression)}(${oneLine(node.arguments[0])}, \u2026)`);
+    } else if (ts.isPropertyAssignment(node)) {
+      const k = keyName2(node.name);
+      const v = node.initializer;
+      if (runner === "vitest" && k === "extends" && isStr(v)) add(v.text, `extends: ${JSON.stringify(v.text)}`);
+      else if (runner === "jest" && k === "preset" && isStr(v)) add(v.text, `preset: ${JSON.stringify(v.text)}`);
+      else if (k === "projects" && ts.isArrayLiteralExpression(v) && (runner === "jest" || ownerKey2(node) === "test")) {
+        for (const el of v.elements) if (isStr(el)) add(el.text, `projects: [${JSON.stringify(el.text)}]`, false);
+      }
     }
-    if (single || double) continue;
-    const prev = raw[i - 1];
-    const next = raw[i + 1];
-    let op = null;
-    if (ch === "&" && next === "&") op = "&&";
-    else if (ch === "|" && next === "|") op = "||";
-    else if (ch === "|" && next === "&") op = "|&";
-    else if (ch === ";" || ch === "\n") op = ";";
-    else if (ch === "|" && prev !== ">") op = "|";
-    else if (ch === "&" && prev !== ">" && next !== ">") op = "&";
-    if (!op) continue;
-    out3.push({ seg: raw.slice(last, i).trim(), op });
-    i += op.length - 1;
-    last = i + 1;
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return out3;
+}
+function suiteDelegations(before, after, path) {
+  const runner = runnerOf(path, after) ?? runnerOf(path, before);
+  if (!runner || runner === "pytest") return [];
+  const was = new Set(delegationsIn(before ?? "", runner).map((d) => d.target));
+  return delegationsIn(after, runner).filter((d) => !was.has(d.target));
+}
+function targetCandidates(configPath, target) {
+  const dir = configPath.includes("/") ? configPath.slice(0, configPath.lastIndexOf("/")) : "";
+  const rel = target.replace(/^<rootDir>\/?/, "./");
+  const parts = rel.startsWith("/") || !dir ? [] : dir.split("/");
+  for (const seg of rel.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") parts.pop();
+    else parts.push(seg);
   }
-  out3.push({ seg: raw.slice(last).trim(), op: null });
-  return out3.filter((s) => s.seg !== "");
+  const base = parts.join("/");
+  if (!base) return [];
+  const exts = [".js", ".cjs", ".mjs", ".ts", ".cts", ".mts", ".json"];
+  return [base, ...exts.map((e) => base + e), ...exts.map((e) => `${base}/index${e}`)];
 }
-function descriptors(cmd, runner, opts) {
+function setupEntriesIn(src, runner, path) {
   const out3 = [];
-  const stmts = statements(cmd);
-  for (let i = 0; i < stmts.length; i++) {
-    const { seg, op } = stmts[i];
-    const wrapped = seg.match(TIMEOUT_WRAP);
-    const inner = unwrap(wrapped ? wrapped[1] : seg);
-    if (!invokesCheck(inner)) continue;
-    const kind = scriptKind3(inner);
-    const canon = canonical(inner);
-    const rn = runner ?? runnerOfSegment(canon);
-    const args = canon.includes(" ") ? " " + canon.slice(canon.indexOf(" ") + 1) : " ";
-    if (wrapped) out3.push({ key: "timeout", what: "a timeout wrapper", direction: "added" });
-    const following = stmts[i + 1]?.seg ?? "";
-    if (op === "||" || op === "|" || op === "&" || op === ";" && !invokesCheck(unwrap(following))) {
-      out3.push({ key: `op:${op}`, what: `${op} ${following.split(/\s+/).slice(0, 2).join(" ")}`.trim(), direction: "added" });
-    }
-    for (const re of MASKING_FLAGS) {
-      const f = spelled(re, args);
-      if (f) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
-    }
-    for (const re of GATE_FLAGS) {
-      const f = spelled(re, " " + seg);
-      if (f) out3.push({ key: `gate:${f}`, what: f, direction: "removed" });
+  let sf = null;
+  try {
+    sf = parseSource("cfg.ts", asExpression2(src));
+  } catch {
+    return out3;
+  }
+  if (!sf) return out3;
+  const inPackageJson = (path.split("/").pop() ?? path) === "package.json";
+  const underJestKey = (node) => {
+    for (let q = node.parent; q; q = q.parent) {
+      if (ts.isPropertyAssignment(q) && keyName2(q.name) === "jest") return true;
     }
-    if (kind !== "test" || opts.sliceByDesign || opts.extended?.has(kind)) continue;
-    const flags = [SUITE_NARROWING_FLAGS, ...NARROWING_BY_RUNNER["*"], ...rn ? NARROWING_BY_RUNNER[rn] : []];
-    for (const re of flags) {
-      const f = spelled(re, args);
-      if (f && !opts.excuseFlag?.(f, canon)) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    return false;
+  };
+  const values = (e) => {
+    if (isStr(e)) return [e.text];
+    if (!ts.isArrayLiteralExpression(e)) return [];
+    const vs = [];
+    for (const el of e.elements) {
+      if (isStr(el)) vs.push(el.text);
+      else if (ts.isArrayLiteralExpression(el) && el.elements[0] && isStr(el.elements[0])) vs.push(el.elements[0].text);
+    }
+    return vs;
+  };
+  const visit = (node) => {
+    if (ts.isPropertyAssignment(node)) {
+      const k = keyName2(node.name);
+      const applies = k !== null && (runner === "jest" ? JEST_SETUP_KEYS.test(k) && (!inPackageJson || underJestKey(node)) : VITEST_SETUP_KEYS.test(k) && ownerKey2(node) === "test");
+      if (applies && k !== null) {
+        for (const v of values(node.initializer)) if (namesFile(v)) out3.push({ key: k, target: v });
+      }
     }
-    if (rn === "cargo" && CARGO_SKIP.test(args)) out3.push({ key: "flag:-- --skip", what: "-- --skip", direction: "added" });
-    const shared = runnerNarrowing(canon, args);
-    if (shared && !opts.excuseFlag?.(shared, canon)) out3.push({ key: `flag:${shared}`, what: shared, direction: "added" });
-    if (opts.fresh) continue;
-    const cfg = args.match(CONFIG_FLAG);
-    if (cfg && !opts.configReviewed?.(cfg[3])) out3.push({ key: `config:${cfg[3]}`, what: `${cfg[1]} ${cfg[3]}`, direction: "added" });
-    const pos = positionalOf(args);
-    if (pos) out3.push({ key: "positional", what: `a path positional (${pos})`, direction: "added" });
-  }
-  return out3;
-}
-function checkStatements(cmd) {
-  const out3 = [];
-  for (const seg of segments(cmd)) {
-    const w = seg.match(TIMEOUT_WRAP);
-    const inner = unwrap(w ? w[1] : seg);
-    const kind = scriptKind3(inner);
-    if (kind) out3.push({ kind, canon: canonical(inner) });
-  }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
   return out3;
 }
-function checkKinds(cmd) {
-  return new Set(checkStatements(cmd).map((s) => s.kind));
-}
-function failsLoudly(cmd) {
-  const last = segments(cmd).pop();
-  return last !== void 0 && FAILS_LOUDLY.test(last.trim());
-}
-function invocationWeakening(before, after, runner, opts = {}) {
-  const was = checkKinds(before);
-  const now = checkKinds(after);
-  if (now.size === 0 && failsLoudly(after)) return { state: "kept" };
-  for (const k of was) {
-    if (now.has(k) || opts.relocated?.(k)) continue;
-    const instead = [...now].filter((x) => !was.has(x));
-    return { state: "removed", kind: k, what: instead.length ? `runs a ${instead.join("/")} check instead` : now.size ? "the check is gone" : "no check is run" };
-  }
-  const survived = new Set(checkStatements(before).map((s) => s.canon));
-  const extended = new Set(checkStatements(after).filter((s) => survived.has(s.canon)).map((s) => s.kind));
-  const read = { ...opts, fresh: was.size === 0, extended };
-  const beforeDs = descriptors(before, runner, read);
-  const afterDs = descriptors(after, runner, read);
-  const seenBefore = new Set(beforeDs.map((d) => d.key));
-  const added = afterDs.find((d) => d.direction === "added" && !seenBefore.has(d.key));
-  if (added) return { state: "neutralised", what: added.what, direction: "added" };
-  if (coverageFloorLowered(before, after)) return { state: "neutralised", what: "a lowered --cov-fail-under", direction: "added" };
-  const seenAfter = new Set(afterDs.map((d) => d.key));
-  const dropped = beforeDs.find((d) => d.direction === "removed" && !seenAfter.has(d.key));
-  if (dropped) return { state: "neutralised", what: dropped.what, direction: "removed" };
-  return { state: "kept" };
+function newSetupEntries(before, after, path) {
+  const runner = runnerOf(path, after) ?? runnerOf(path, before);
+  if (!runner || runner === "pytest") return [];
+  const was = new Set(setupEntriesIn(before ?? "", runner, path).map((e) => `${e.key} ${e.target}`));
+  return setupEntriesIn(after, runner, path).filter((e) => !was.has(`${e.key} ${e.target}`));
 }
-var INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, NARROWING_BY_RUNNER, CARGO_SKIP, MASKING_FLAGS, GATE_FLAGS, CONFIG_FLAG, PRINTER, PYTHON_M, NODE_BIN, BIN_OF, RUNNER_NAME, spelled, FAILS_LOUDLY;
-var init_invocation = __esm({
-  "src/detectors/invocation.ts"() {
+var JEST_DEFAULT_MATCH, JEST_DEFAULT_IGNORE, VITEST_DEFAULT_INCLUDE, PYTEST_DEFAULT_INCLUDE, PYTEST_DEFAULT_IGNORE, VITEST_DEFAULT_EXCLUDE, JS_UNWALKED, CANONICAL_SAMPLES, PYTEST_CANONICAL_SAMPLES, isStr, PYTEST_INI_ORDER, pathGlobs, isWorkspaceFile, empty, stripRootDir, JEST_SELECTION_KEYS, globs2, globList2, regexes, wideWhy, underDir, isLocalPath, hasGlob, oneLine, JEST_SETUP_KEYS, VITEST_SETUP_KEYS, namesFile;
+var init_suite_config = __esm({
+  "src/detectors/suite-config.ts"() {
     "use strict";
-    init_gh_expression();
-    init_command();
-    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
-    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
-    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
-    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
-    usesRef = (core) => core.replace(/@.*$/, "");
-    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
-    NEUTRALISING_SUFFIX = new RegExp(
-      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
-    );
-    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
-    RUNNER_NARROWINGS = [
-      {
-        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
-        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
-        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
-        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
-      },
-      {
-        runner: /^(?:jest|vitest)\b/,
-        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
-      },
-      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
-      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
-      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
-      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
-      {
-        // `-p no:<plugin>` disables collection when the plugin is the collector
-        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
-        runner: /^pytest\b/,
-        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
-      },
-      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
-      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
+    init_lazy_deps();
+    init_ts_lazy();
+    JEST_DEFAULT_MATCH = ["**/__tests__/**/*.[jt]s?(x)", "**/?(*.)+(spec|test).[jt]s?(x)"];
+    JEST_DEFAULT_IGNORE = ["/node_modules/"];
+    VITEST_DEFAULT_INCLUDE = ["**/*.{test,spec}.?(c|m)[jt]s?(x)"];
+    PYTEST_DEFAULT_INCLUDE = ["**/test_*.py", "**/*_test.py"];
+    PYTEST_DEFAULT_IGNORE = ["**/build/**", "**/dist/**", "**/node_modules/**", "**/venv/**", "**/.*/**"];
+    VITEST_DEFAULT_EXCLUDE = [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/cypress/**",
+      "**/.{idea,git,cache,output,temp}/**",
+      "**/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build,eslint,prettier}.config.*"
     ];
-    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
-    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
-    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
-    PATH_SHAPED = /\/|\.(?:test|spec)\./;
-    NARROWING_BY_RUNNER = {
-      "*": [/--shard\b/],
-      jest: [/--root\b/, /--rootDir\b/, /--testMatch\b/, /--testRegex\b/, /--modulePathIgnorePatterns\b/, /--selectProjects\b/, /--ignoreProjects\b/, /--filter\b/],
-      vitest: [/--grep\b/],
-      mocha: [/--grep\b/, /(?:^|\s)-g(?:\s|=)/, /--ignore\b/, /(?:^|\s)-f(?:\s|=)/, /--fgrep\b/],
-      pytest: [/(?:^|\s)-k(?:\s|=)/, /(?:^|\s)-m(?:\s|=)/, /--deselect\b/, /--ignore\b/, /--ignore-glob\b/, /--last-failed\b/, /(?:^|\s)--lf(?:\s|$)/, /--collect-only\b/, /(?:^|\s)--co(?:\s|$)/],
-      go: [/(?:^|\s)-run(?:\s|=)/, /(?:^|\s)-skip(?:\s|=)/],
-      cargo: [],
-      node: [/--test-name-pattern\b/, /--test-skip-pattern\b/]
+    JS_UNWALKED = [...VITEST_DEFAULT_EXCLUDE, "**/.*/**"];
+    CANONICAL_SAMPLES = [
+      "src/a.test.ts",
+      "src/a.spec.ts",
+      "test/a.test.ts",
+      "tests/a.test.js",
+      "src/__tests__/a.ts",
+      "a.test.tsx",
+      "a.spec.js",
+      "test/a.test.mjs"
+    ];
+    PYTEST_CANONICAL_SAMPLES = [
+      "tests/test_a.py",
+      "tests/a_test.py",
+      "test_a.py",
+      "src/tests/test_a.py",
+      "tests/conftest.py"
+    ];
+    isStr = (e) => ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e);
+    PYTEST_INI_ORDER = ["pytest.ini", ".pytest.ini", "pyproject.toml", "tox.ini", "setup.cfg"];
+    pathGlobs = (p) => {
+      const clean = p.replace(/^\.\//, "").replace(/::.*$/, "").replace(/\/+$/, "");
+      return clean ? [clean, clean + "/**"] : [];
     };
-    CARGO_SKIP = /\s--\s+(?:\S+\s+)*--skip\b/;
-    MASKING_FLAGS = [/--passWithNoTests\b/, /--coverage=false\b/, /--coverageThreshold\b/, /--if-present\b/];
-    GATE_FLAGS = [/--check-coverage\b/];
-    CONFIG_FLAG = /(?:^|\s)(--config|-c)(?:=|\s+)(['"]?)([^\s'"]+)\2(?=\s|$)/;
-    PRINTER = /^(?:echo|printf|true|false|:|cat|exit|return|sleep|test|\[|node|git|curl|wget)(?=\s|$)/;
-    PYTHON_M = /^python\d?(?:\.\d+)?\s+-m\s+(?=pytest\b)/;
-    NODE_BIN = /^node(?:\s+-\S+)*\s+\S*node_modules\/(?:\.bin\/)?(jest|vitest|mocha|ava)\b\S*/;
-    BIN_OF = /\$\((?:yarn|npm|pnpm)\s+bin\s+(\w+)\)|\$\((?:yarn|npm|pnpm)\s+bin\)\/(\w+)/g;
-    RUNNER_NAME = /^(jest|vitest|mocha|pytest|go|cargo|node)\b/;
-    spelled = (re, s) => {
-      const m = s.match(re);
-      return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+    isWorkspaceFile = (path) => /^vitest\.workspace\./.test(path.split("/").pop() ?? path);
+    empty = () => ({ include: null, regex: null, ignore: null, roots: null, base: null, projects: null, wide: [], opaque: false, present: false });
+    stripRootDir = (g) => g.replace(/^<rootDir>\/?/, "");
+    JEST_SELECTION_KEYS = /^(?:testMatch|testRegex|testPathIgnorePatterns|modulePathIgnorePatterns|roots|rootDir|projects)$/;
+    globs2 = (patterns) => {
+      const ms = patterns.map((g) => {
+        try {
+          return picomatch(g, { dot: true });
+        } catch {
+          return () => false;
+        }
+      });
+      return (path) => ms.some((m) => m(path));
     };
-    FAILS_LOUDLY = /^(?:exit\s+(?:[1-9]\d*)|false)\s*$/;
+    globList2 = (patterns) => {
+      const pos = globs2(patterns.filter((g) => !g.startsWith("!")));
+      const neg = globs2(patterns.filter((g) => g.startsWith("!")).map((g) => g.slice(1)));
+      return (path) => pos(path) && !neg(path);
+    };
+    regexes = (patterns) => {
+      const rs = patterns.flatMap((p) => {
+        try {
+          return [new RegExp(p.replace(/<rootDir>/g, ""))];
+        } catch {
+          return [];
+        }
+      });
+      return (path) => rs.some((r) => r.test("/" + path));
+    };
+    wideWhy = (hit) => `${hit.key} narrows the whole run (${JSON.stringify(hit.pattern.slice(1).replace(/^testNamePattern /, ""))})`;
+    underDir = (path, dir) => dir === "" || path.startsWith(dir + "/");
+    isLocalPath = (s) => /^(?:\.\.?\/|\/|<rootDir>)/.test(s);
+    hasGlob = (s) => /[*?[\]{}]/.test(s);
+    oneLine = (node) => node.getText().replace(/\s+/g, " ").slice(0, 120);
+    JEST_SETUP_KEYS = /^(?:setupFiles|setupFilesAfterEnv|setupFilesAfterEach|globalSetup|globalTeardown|runner|testRunner|testEnvironment|reporters|testResultsProcessor|testSequencer|snapshotResolver|resolver)$/;
+    VITEST_SETUP_KEYS = /^(?:setupFiles|setupFilesAfterEach|globalSetup|environment|runner|reporters)$/;
+    namesFile = (s) => isLocalPath(s) || /\.[cm]?[jt]sx?$/.test(s) && !s.startsWith("@");
   }
 });
 
-// src/detectors/ci-tampering.ts
-function isActiveWorkflow(path) {
-  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+// src/detectors/config-weakening.ts
+function parseJsonc(path, text) {
+  try {
+    const r = ts.parseConfigFileTextToJson(path, text);
+    if (r.error) return null;
+    const cfg = r.config;
+    return cfg;
+  } catch {
+    return null;
+  }
 }
-function commandCore(line) {
-  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses|script|command|before_script|after_script|sh|bash|pwsh|powershell):\s*/, "").replace(/\s+/g, " ").trim();
+function parseYaml(text) {
+  try {
+    const v = yaml.parse(text);
+    return v;
+  } catch {
+    return null;
+  }
 }
-function expressionOf(raw) {
-  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
-  const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
-  return m ? m[1] : v;
+function corePattern(p) {
+  return p.trim().replace(/^!/, "").replace(/^(?:\.\/|\/)+/, "").replace(/^(?:\*\*\/)+/, "").replace(/(?:\/\*\*?)+\/?$/, "").replace(/\/+$/, "");
 }
-function isAlwaysFalse(raw) {
-  const e = expressionOf(raw);
-  if (e === "") return false;
-  const v = foldConst(e);
-  return v !== void 0 && !truthy(v);
+function housekeepingByName(p) {
+  const core = corePattern(p);
+  if (core === "" || core === "**" || core === "*") return false;
+  const first = core.split("/")[0];
+  return HOUSEKEEPING_DIR.test(first) || HOUSEKEEPING_FILE.test(core);
 }
-function isTruthy(raw) {
-  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
-  if (/^(?:true|yes|on|1)$/i.test(v)) return true;
-  const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
-  if (!m) return false;
-  const f = foldConst(m[1]);
-  return f !== void 0 && truthy(f);
+function ignoreGlobs(p) {
+  const core = corePattern(p);
+  if (!core) return [];
+  const anchored = p.trim().replace(/^!/, "").startsWith("/") || core.includes("/");
+  const heads = anchored ? [core] : [core, `**/${core}`];
+  return heads.flatMap((h) => [h, `${h}/**`]);
 }
-function stepOf(lines, i) {
-  const ind = indentOf(lines[i]);
-  let s = i - 1;
-  while (s >= 0 && (lines[s].trim() === "" || indentOf(lines[s]) >= ind)) s--;
-  if (s < 0 || !STEP_START.test(lines[s])) return null;
-  const stepInd = indentOf(lines[s]);
-  let e = i + 1;
-  while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > stepInd)) e++;
-  return [s, e];
+function hidesSource(pattern, dir, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return housekeepingByName(pattern) ? null : pattern;
+  const m = matcher(ignoreGlobs(pattern));
+  const hit = files.find((f) => {
+    if (dir && !f.startsWith(dir)) return false;
+    const rel = f.slice(dir.length);
+    if (!CODE_FILE.test(rel) || HOUSEKEEPING_FILE.test(rel)) return false;
+    if (rel.split("/").slice(0, -1).some((seg) => HOUSEKEEPING_DIR.test(seg))) return false;
+    return m(rel);
+  });
+  return hit === void 0 ? null : hit;
 }
-function jobOf(lines, i) {
-  const ind = indentOf(lines[i]);
-  let h = i - 1;
-  while (h >= 0 && (lines[h].trim() === "" || indentOf(lines[h]) >= ind)) h--;
-  if (h < 0 || !/^\s+[\w-]+:\s*(?:#.*)?$/.test(lines[h])) return null;
-  let t = h - 1;
-  while (t >= 0 && (lines[t].trim() === "" || indentOf(lines[t]) > 0)) t--;
-  if (t < 0 || !/^jobs:/.test(lines[t])) return null;
-  const hi = indentOf(lines[h]);
-  let e = i + 1;
-  while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > hi)) e++;
-  return [h, e];
+function grown(before, after) {
+  const was = new Set(before.map(corePattern));
+  return after.filter((e) => !was.has(corePattern(e)));
 }
-function runBlocks(lines) {
-  const out3 = [];
-  for (let i = 0; i < lines.length; i++) {
-    if (!/^\s*-?\s*run:\s*[|>][-+]?\s*$/.test(lines[i])) continue;
-    const ind = indentOf(lines[i].replace(/^(\s*)-\s+/, "$1  "));
-    let e = i + 1;
-    while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > ind)) e++;
-    out3.push({ start: i, end: e, body: lines.slice(i + 1, e) });
-  }
-  return out3;
+function tsconfigFacts(path, text) {
+  if (text === null) return null;
+  const cfg = parseJsonc(path, text);
+  if (!isRecord(cfg)) return null;
+  return {
+    options: isRecord(cfg.compilerOptions) ? cfg.compilerOptions : {},
+    exclude: strings(cfg.exclude),
+    extends: strings(cfg.extends)
+  };
 }
-function commandLines(lines) {
-  const out3 = lines.slice();
-  for (const b of runBlocks(lines)) {
-    if (/^\s*-?\s*run:\s*>/.test(lines[b.start])) {
-      out3[b.start + 1] = b.body.map((l) => l.trim()).filter(Boolean).join(" ");
-      for (let k = b.start + 2; k < b.end; k++) out3[k] = "";
-      continue;
-    }
-    const indents = b.body.filter((l) => l.trim() !== "").map(indentOf);
-    const ind = indents.length ? Math.min(...indents) : 0;
-    const dedented = b.body.map((l) => l.slice(Math.min(ind, indentOf(l))));
-    const kept = stripHeredocs(dedented);
-    let j = 0;
-    for (let k = 0; k < dedented.length; k++) {
-      if (j < kept.length && kept[j] === dedented[k]) j++;
-      else out3[b.start + 1 + k] = "";
-    }
+function effective(f, flag) {
+  if (!f) return false;
+  const v = f.options[flag];
+  if (typeof v === "boolean") return v;
+  return STRICT_FAMILY.has(flag) && f.options.strict === true;
+}
+function tsconfigWeakenings(c, all, policy, addedPaths, ctx, out3) {
+  if (c.before === null || c.after === null) return;
+  const b = tsconfigFacts(c.path, c.before);
+  const a = tsconfigFacts(c.path, c.after);
+  if (!b || !a) return;
+  const others = all.filter((o) => o !== c && o.after !== null && isTsconfig(o.path)).map((o) => ({ b: tsconfigFacts(o.path, o.before), a: tsconfigFacts(o.path, o.after) }));
+  const movedTo = (flag) => others.find((o) => effective(o.a, flag) && !effective(o.b, flag));
+  const push = (message, evidence, remediation) => out3.push(makeFinding(RULE6, policy, { file: c.path, message, evidence, remediation, defaultSeverity: "warn" }));
+  const strictLowered = effective(b, "strict") && !effective(a, "strict");
+  for (const flag of TRUE_IS_STRICT) {
+    if (!effective(b, flag) || effective(a, flag)) continue;
+    if (flag !== "strict" && STRICT_FAMILY.has(flag) && strictLowered && a.options[flag] === void 0) continue;
+    if (movedTo(flag)) continue;
+    const was = typeof b.options[flag] === "boolean" ? String(b.options[flag]) : "implied by strict";
+    const now = a.options[flag] === void 0 ? "removed" : String(a.options[flag]);
+    push(
+      `tsconfig strictness lowered: compilerOptions.${flag} ${was} \u2192 ${now}.`,
+      `${c.path}: ${flag} ${was} \u2192 ${now}`,
+      `Keep ${flag} on and fix the code it reports. Lowering the compiler's strictness hides the errors it was finding, in every file at once.`
+    );
   }
-  return out3;
-}
-function flowList(v) {
-  const m = v.trim().match(/^\[(.*)\]$/);
-  if (!m) return null;
-  return m[1].split(",").map((s) => s.trim().replace(/^(['"])(.*)\1$/, "$2")).filter(Boolean);
-}
-function parseTriggers(src) {
-  const t = {
-    events: /* @__PURE__ */ new Set(),
-    branches: /* @__PURE__ */ new Map(),
-    branchesIgnore: /* @__PURE__ */ new Map(),
-    pathsIgnore: /* @__PURE__ */ new Map(),
-    paths: /* @__PURE__ */ new Map(),
-    types: /* @__PURE__ */ new Map(),
-    tags: /* @__PURE__ */ new Map(),
-    present: false
-  };
-  const lines = src.split("\n");
-  const i = lines.findIndex((l) => /^(?:on|"on"|'on'|true):/.test(l));
-  if (i < 0) return t;
-  t.present = true;
-  const head = lines[i].replace(/^(?:on|"on"|'on'|true):\s*/, "");
-  const inline = uncommented(head);
-  if (inline) {
-    const list3 = flowList(inline);
-    for (const e of list3 ?? [inline]) t.events.add(e);
-    return t;
+  for (const flag of TRUE_IS_WEAK) {
+    if (b.options[flag] === true || a.options[flag] !== true) continue;
+    push(
+      `tsconfig check loosened: compilerOptions.${flag}: true added${flag === "skipLibCheck" ? " (declaration files are no longer type-checked)" : ""}.`,
+      `${c.path}: ${flag}: true`,
+      `Leave ${flag} off and fix what the compiler reports; a check switched off here is off for every build.`
+    );
   }
-  let event = null;
-  let listKey = null;
-  let listInd = -1;
-  for (let j = i + 1; j < lines.length; j++) {
-    const l = lines[j];
-    if (l.trim() === "" || /^\s*#/.test(l)) continue;
-    const ind = indentOf(l);
-    if (ind === 0) break;
-    const body = uncommented(l);
-    const item = body.match(/^\s*-\s+(.+)$/);
-    if (item && listKey && event && ind > listInd) {
-      const target = t[listKey].get(event) ?? [];
-      target.push(item[1].replace(/^(['"])(.*)\1$/, "$2"));
-      t[listKey].set(event, target);
-      continue;
-    }
-    const kv = body.match(/^\s*([\w-]+):\s*(.*)$/);
-    if (!kv) continue;
-    if (ind === 2 || event === null && ind < 4) {
-      event = kv[1];
-      t.events.add(event);
-      listKey = null;
-      continue;
-    }
-    const key2 = LIST_KEYS[kv[1]];
-    if (event && key2) {
-      listKey = key2;
-      listInd = ind;
-      const list3 = flowList(kv[2]);
-      t[listKey].set(event, list3 ?? []);
-    } else listKey = null;
+  const dir = dirOf2(c.path);
+  for (const e of grown(b.exclude, a.exclude)) {
+    const hit = hidesSource(e, dir, ctx);
+    if (hit === null) continue;
+    push(
+      `tsconfig exclude grown: ${JSON.stringify(e)} now hides ${hit === e ? "source" : hit} from the compiler.`,
+      `${c.path}: exclude += ${JSON.stringify(e)}`,
+      "Keep the compiler pointed at the whole source. A file excluded from tsconfig is not type-checked anywhere."
+    );
   }
-  return t;
-}
-function ghGlob(g) {
-  const re = g.split("**").map((part) => part.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")).join(".*");
-  try {
-    const r = new RegExp(`^${re}$`);
-    return (p) => r.test(p);
-  } catch {
-    return () => false;
+  if (b.extends.length && a.extends.length === 0) {
+    push(
+      `tsconfig no longer extends ${b.extends.map((x) => JSON.stringify(x)).join(", ")}: the strictness the base carried is gone with it.`,
+      `${c.path}: extends removed`,
+      "Keep the base config, or carry its compiler options over explicitly so the check stays as strict as it was."
+    );
   }
-}
-function admits(globs4, name) {
-  let on = false;
-  for (const g of globs4) {
-    const neg = g.startsWith("!");
-    if (ghGlob(neg ? g.slice(1) : g)(name)) on = !neg;
+  for (const target of a.extends.filter((t) => !b.extends.includes(t) && isLocalTarget(t))) {
+    const cands = targetCandidates(c.path, target);
+    const added = cands.find((f) => addedPaths.has(f));
+    if (added === void 0 && cands.some((f) => isProtected(f, policy, "config"))) continue;
+    push(
+      `tsconfig now extends ${JSON.stringify(target)}, ${added !== void 0 ? `a file this change adds (${added})` : "a file no protected glob covers"}.`,
+      `${c.path}: extends ${JSON.stringify(target)}`,
+      "Extend a protected config, or protect the base (protected.config in .tamperward.yml); the strictness now lives where the gate cannot read it."
+    );
   }
-  return on;
 }
-function sourceProbes(ctx) {
-  const files = trackedFiles(ctx);
-  if (!files) return CODE_PROBES;
-  const code2 = files.filter((f) => langOf(f) !== null);
-  return code2.length ? code2 : CODE_PROBES;
+function levelOf(v) {
+  const head = Array.isArray(v) ? v[0] : v;
+  if (head === "off" || head === 0) return "off";
+  if (head === "warn" || head === "error" || head === 1 || head === 2) return "on";
+  return null;
 }
-function triggerNarrowings(before, after, opts) {
-  const out3 = [];
-  if (!before.present || !after.present) return out3;
-  const isDefault = (b) => opts.defaultBranch ? b === opts.defaultBranch : DEFAULT_BRANCH.test(b);
-  const candidates = opts.defaultBranch ? [opts.defaultBranch] : ["main", "master"];
-  const namesDefault = (l) => candidates.some((b) => admits(l, b));
-  for (const e of CODE_EVENTS) {
-    if (before.events.has(e) && !after.events.has(e)) out3.push(`the ${e} trigger was removed \u2014 the workflow no longer runs on it`);
+function eslintObjectFacts(v, f, key2 = null) {
+  if (Array.isArray(v)) {
+    for (const el of v) eslintObjectFacts(el, f, null);
+    return;
   }
-  for (const [e, list3] of after.pathsIgnore) {
-    const had = before.pathsIgnore.get(e) ?? [];
-    if (list3.some((g) => ALL(g) && !had.includes(g))) {
-      out3.push(`on.${e}.paths-ignore now ignores every path \u2014 the workflow never runs on ${e}`);
-      continue;
+  if (!isRecord(v)) return;
+  if (key2 === "rules") {
+    for (const [rule, level] of Object.entries(v)) {
+      const l = levelOf(level);
+      if (l === "off") f.off.set(rule, `${rule}: ${JSON.stringify(level)}`);
+      else if (l === "on") f.on.add(rule);
     }
-    if (!CODE_EVENTS.includes(e) || !after.events.has(e)) continue;
-    if (had.length && ignoresEverySource(had, opts.sources)) continue;
-    if (ignoresEverySource(list3, opts.sources)) out3.push(`on.${e}.paths-ignore now ignores every source file (now [${list3.join(", ")}]) \u2014 the workflow never runs on code`);
-  }
-  for (const [e, list3] of after.paths) {
-    if (!CODE_EVENTS.includes(e) || !after.events.has(e)) continue;
-    const had = before.paths.get(e);
-    if (had && !pathsMatchSource(had, opts.sources)) continue;
-    if (!pathsMatchSource(list3, opts.sources)) out3.push(`on.${e}.paths matches no source file (now [${list3.join(", ")}]) \u2014 the workflow never runs on code`);
+    return;
   }
-  for (const [e, list3] of after.types) {
-    if (!/^pull_request(?:_target)?$/.test(e) || !after.events.has(e)) continue;
-    const had = before.types.get(e);
-    if (had && !had.some((t) => PR_CODE_TYPES.test(t))) continue;
-    if (!list3.some((t) => PR_CODE_TYPES.test(t))) out3.push(`on.${e}.types no longer includes opened/synchronize (now [${list3.join(", ")}]) \u2014 the workflow does not run on the pull request's code`);
+  for (const [k, val] of Object.entries(v)) {
+    if (k === "ignores" || k === "ignorePatterns") f.ignores.push(...strings(val));
+    else eslintObjectFacts(val, f, k);
   }
-  for (const [e, list3] of after.branchesIgnore) {
-    const had = before.branchesIgnore.get(e) ?? [];
-    if (list3.some((g) => (ALL(g) || isDefault(g)) && !had.includes(g))) out3.push(`on.${e}.branches-ignore now covers the default branch`);
+}
+function eslintAstFacts(text, f) {
+  let sf = null;
+  try {
+    sf = parseSource("eslint.config.ts", text);
+  } catch {
+    return;
   }
-  const events = /* @__PURE__ */ new Set([...before.branches.keys(), ...CODE_EVENTS.filter((e) => before.events.has(e))]);
-  for (const e of events) {
-    const was = before.branches.get(e) ?? (before.tags.has(e) ? null : ["**"]);
-    if (!was || !after.events.has(e)) continue;
-    const now = after.branches.get(e);
-    if (!now) {
-      const tags = after.tags.get(e);
-      if (tags && namesDefault(was)) out3.push(`on.${e} now filters on tags only (tags: [${tags.join(", ")}]) \u2014 no push to the default branch runs the workflow`);
-      continue;
+  if (!sf) return;
+  const isStr2 = (e) => ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e);
+  const keyText = (n) => ts.isIdentifier(n) || isStr2(n) || ts.isNumericLiteral(n) ? n.text : null;
+  const literal2 = (e) => {
+    if (isStr2(e)) return e.text;
+    if (ts.isNumericLiteral(e)) return Number(e.text);
+    if (ts.isArrayLiteralExpression(e)) return e.elements.map(literal2);
+    return void 0;
+  };
+  const arrayStrings = (e) => ts.isArrayLiteralExpression(e) ? e.elements.filter(isStr2).map((s) => s.text) : isStr2(e) ? [e.text] : [];
+  const visit = (node) => {
+    if (ts.isPropertyAssignment(node)) {
+      const k = keyText(node.name);
+      if (k === "rules" && ts.isObjectLiteralExpression(node.initializer)) {
+        for (const p of node.initializer.properties) {
+          if (!ts.isPropertyAssignment(p)) continue;
+          const rule = keyText(p.name);
+          if (rule === null) continue;
+          const l = levelOf(literal2(p.initializer));
+          if (l === "off") f.off.set(rule, `${rule}: ${p.initializer.getText().replace(/\s+/g, " ").slice(0, 60)}`);
+          else if (l === "on") f.on.add(rule);
+        }
+      } else if (k === "ignores" || k === "ignorePatterns") f.ignores.push(...arrayStrings(node.initializer));
+    } else if (ts.isCallExpression(node) && /^(?:\w+\.)?globalIgnores$/.test(node.expression.getText()) && node.arguments[0]) {
+      f.ignores.push(...arrayStrings(node.arguments[0]));
     }
-    const renamed = (b) => DEFAULT_BRANCH.test(b) && now.includes(b) && admits(now, b) && opts.hasBranch(b) !== false;
-    const lost = candidates.filter((b) => admits(was, b) && !admits(now, b));
-    const lostDefault = lost.length > 0 && !["main", "master"].some(renamed);
-    const replaced = !namesDefault(was) && !namesDefault(now) && was.length > 0 && !was.some((b) => now.includes(b));
-    if (!lostDefault && !replaced) continue;
-    const dropped = was.filter((b) => !now.includes(b) && !ALL(b));
-    out3.push(
-      dropped.length ? `on.${e}.branches no longer names ${dropped.join(", ")} (now [${now.join(", ")}])` : `on.${e}.branches now filters to [${now.join(", ")}], which does not admit the default branch`
-    );
-  }
-  return out3;
-}
-function localUses(line) {
-  const wf = line.match(REUSED_WORKFLOW)?.[1];
-  if (wf) return [wf];
-  const action = line.match(LOCAL_ACTION)?.[1];
-  return action ? [`${action}/action.yml`, `${action}/action.yaml`] : [];
-}
-function literalValue(raw) {
-  const v = foldExpressions(uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim());
-  return v.includes(EXPR_TOKEN) || v.includes(MATRIX_TOKEN) ? null : v;
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
 }
-function dirRunsNothing(dir, ctx) {
-  const files = trackedFiles(ctx);
-  if (!files) return true;
-  const d = dir.replace(/^\.\//, "").replace(/\/+$/, "");
-  if (d === "" || d === ".") return false;
-  return !files.some((f) => f.startsWith(d + "/") && (langOf(f) !== null || MANIFEST.test(f)));
+function eslintFacts(path, text) {
+  const f = emptyFacts();
+  if (text === null) return f;
+  const base = basename2(path);
+  if (isEslintIgnore(path)) {
+    f.ignores.push(...text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith("!")));
+    return f;
+  }
+  if (/\.(?:[cm]?[jt]s)$/.test(base)) eslintAstFacts(text, f);
+  else if (/\.ya?ml$/.test(base)) eslintObjectFacts(parseYaml(text), f);
+  else if (base === "package.json") {
+    const pkg = parseJsonc(path, text);
+    if (isRecord(pkg)) eslintObjectFacts(pkg.eslintConfig, f);
+  } else {
+    const j = parseJsonc(path, text);
+    eslintObjectFacts(j !== null ? j : base === ".eslintrc" ? parseYaml(text) : null, f);
+  }
+  return f;
+}
+function biomeFacts(path, text) {
+  const f = emptyFacts();
+  if (text === null) return f;
+  const cfg = parseJsonc(path, text);
+  if (!isRecord(cfg)) return f;
+  const readLinter = (linter) => {
+    if (!isRecord(linter)) return;
+    if (linter.enabled === false) f.linterOff = true;
+    f.ignores.push(...strings(linter.ignore));
+    const rules = linter.rules;
+    if (!isRecord(rules)) return;
+    if (rules.recommended === false) f.off.set("recommended", "rules.recommended: false");
+    for (const [group, body] of Object.entries(rules)) {
+      if (!isRecord(body)) continue;
+      if (body.recommended === false) f.off.set(`${group}/recommended`, `${group}.recommended: false`);
+      for (const [rule, level] of Object.entries(body)) {
+        const l = level === "off" || isRecord(level) && level.level === "off" ? "off" : typeof level === "string" || isRecord(level) ? "on" : null;
+        if (l === "off") f.off.set(`${group}/${rule}`, `${group}.${rule}: off`);
+        else if (l === "on") f.on.add(`${group}/${rule}`);
+      }
+    }
+  };
+  readLinter(cfg.linter);
+  if (Array.isArray(cfg.overrides)) {
+    for (const o of cfg.overrides) if (isRecord(o)) readLinter(o.linter);
+  }
+  if (isRecord(cfg.files)) {
+    f.ignores.push(...strings(cfg.files.ignore));
+    f.ignores.push(...strings(cfg.files.includes).filter((p) => p.startsWith("!")));
+  }
+  return f;
 }
-function defaultsOf(lines, i) {
-  const run = ancestorOf(lines, i);
-  if (run === null || !/^\s*run:\s*$/.test(lines[run])) return null;
-  const d = ancestorOf(lines, run);
-  return d !== null && /^\s*defaults:\s*$/.test(lines[d]) ? d : null;
+function replacedByVariant(rule, on) {
+  if (rule.includes("/")) return false;
+  for (const r of on) if (r.endsWith(`/${rule}`)) return true;
+  return false;
 }
-function enclosingStep(lines, i) {
-  let h = i;
-  while ((h = ancestorOf(lines, h)) !== null) {
-    if (!STEP_START.test(lines[h])) continue;
-    const ind = indentOf(lines[h]);
-    let e = i + 1;
-    while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > ind)) e++;
-    return [h, e];
+function lintWeakenings(c, facts, priorAll, policy, ctx, out3) {
+  if (c.after === null) return;
+  const a = facts(c.path, c.after);
+  const tool = isBiome(c.path) ? "biome" : "eslint";
+  const push = (message, evidence, remediation) => out3.push(makeFinding(RULE6, policy, { file: c.path, message, evidence, remediation, defaultSeverity: "warn" }));
+  if (a.linterOff && !priorAll.linterOff) {
+    push(`${tool} linter switched off: linter.enabled: false.`, `${c.path}: linter.enabled: false`, "Keep the linter on and fix what it reports.");
+  }
+  for (const [rule, how] of a.off) {
+    if (priorAll.off.has(rule) || replacedByVariant(rule, a.on)) continue;
+    push(
+      `${tool} rule turned off: ${rule}.`,
+      `${c.path}: ${how}`,
+      `Keep ${rule} on and fix what it reports, or scope a justified exception with a reason. A rule turned off in the config is off for every file at once.`
+    );
+  }
+  const dir = dirOf2(c.path);
+  for (const e of grown(priorAll.ignores, a.ignores)) {
+    const hit = hidesSource(e, dir, ctx);
+    if (hit === null) continue;
+    const key2 = isEslintIgnore(c.path) ? ".eslintignore" : tool === "biome" ? "files.ignore" : /\.eslintrc/.test(basename2(c.path)) ? "ignorePatterns" : "ignores";
+    push(
+      `${tool} ${key2} grown: ${JSON.stringify(e)} now hides ${hit === e ? "source" : hit} from the lint.`,
+      `${c.path}: ${key2} += ${JSON.stringify(e)}`,
+      "Keep the lint pointed at the whole source. A path ignored here is never linted, whatever the rules say."
+    );
   }
-  return null;
-}
-function ancestorOf(lines, i) {
-  const ind = indentOf(lines[i]);
-  let h = i - 1;
-  while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
-  return h >= 0 ? h : null;
 }
-var RULE7, USES, CHECK, YAML_KEY, isCompositeAction, isGithubFile, GH_RUN_KEY, GENERIC_RUN_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, LOCAL_ACTION, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
-var init_ci_tampering = __esm({
-  "src/detectors/ci-tampering.ts"() {
+var RULE6, basename2, isTsconfig, isEslintConfig, isEslintIgnore, isBiome, CODE_FILE, HOUSEKEEPING_DIR, HOUSEKEEPING_FILE, matcher, dirOf2, strings, STRICT_FAMILY, TRUE_IS_STRICT, TRUE_IS_WEAK, isLocalTarget, emptyFacts, configWeakening;
+var init_config_weakening = __esm({
+  "src/detectors/config-weakening.ts"() {
     "use strict";
-    init_select();
+    init_lazy_deps();
+    init_ts_lazy();
     init_policy();
+    init_narrow();
     init_finding();
-    init_files();
-    init_hook_wiring();
     init_repo();
-    init_gh_expression();
-    init_invocation();
-    init_invocation();
-    RULE7 = "ci-tampering";
-    USES = /^\s*-\s*uses:/;
-    CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
-    YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
-    isCompositeAction = (path) => /(^|\/)\.github\/actions\/.+\/action\.ya?ml$/.test(path);
-    isGithubFile = (path) => /(^|\/)\.github\//.test(path);
-    GH_RUN_KEY = /^\s*-?\s*run:/;
-    GENERIC_RUN_KEY = /^\s*-?\s*(?:run|script|command|before_script|after_script|sh|bash|pwsh|powershell):/;
-    invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
-    uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
-    SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
-    indentOf = (l) => l.length - l.trimStart().length;
-    STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
-    REPORTER_ACTION = /^\s*-?\s*uses:\s*\S*?(?:[\w-]*-reporter|[\w-]*-results?[\w-]*|upload-[\w-]*|codecov[\w-]*|coveralls[\w-]*)(?:@|\s|$)/i;
-    usesCheck = (l) => USES.test(l) && CHECK.test(l) && !REPORTER_ACTION.test(l);
-    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l));
-    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
-    NEUTRALISERS = [
-      { re: /^\s*set\s+\+e\b/, what: "set +e \u2014 a failing check no longer fails the step" },
-      { re: /^\s*exit\s+0\s*(?:$|[;#])/, what: "exit 0 \u2014 the step ends green whatever the check did" },
-      { re: /^\s*if\s+false\s*;?\s*then\b/, what: "if false; then \u2014 the check is never run" },
-      { re: /^\s*:\s*<<\s*['"]?\w+/, what: "a heredoc fed to `:` \u2014 the check is commented out" }
-    ];
-    LIST_KEYS = {
-      branches: "branches",
-      "branches-ignore": "branchesIgnore",
-      "paths-ignore": "pathsIgnore",
-      paths: "paths",
-      types: "types",
-      tags: "tags"
+    init_suite_config();
+    RULE6 = "config-weakening";
+    basename2 = (path) => path.split("/").pop() ?? path;
+    isTsconfig = (path) => /^tsconfig.*\.json$/.test(basename2(path));
+    isEslintConfig = (path) => /^(?:\.eslintrc(?:\..*)?|eslint\.config\..*)$/.test(basename2(path));
+    isEslintIgnore = (path) => basename2(path) === ".eslintignore";
+    isBiome = (path) => /^biome\.jsonc?$/.test(basename2(path));
+    CODE_FILE = /\.(?:[cm]?[jt]sx?|vue|svelte)$/;
+    HOUSEKEEPING_DIR = /^(?:node_modules|dist|build|out|output|coverage|lib|esm|cjs|umd|target|tmp|temp|vendor|generated|__generated__|public|static|storybook-static|\..+)$/;
+    HOUSEKEEPING_FILE = /(?:\.(?:min\.[cm]?js|d\.[cm]?ts|snap|map|json|jsonc|md|mdx|lock|ya?ml|toml|html?|css|scss|svg|png|jpe?g|gif|txt)|(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|CHANGELOG\.md))$/i;
+    matcher = (patterns) => {
+      const ms = patterns.map((g) => {
+        try {
+          return picomatch(g, { dot: true });
+        } catch {
+          return () => false;
+        }
+      });
+      return (path) => ms.some((m) => m(path));
     };
-    DEFAULT_BRANCH = /^(?:main|master)$/;
-    ALL = (g) => /^\*\*?$|^\*\*\/\*$/.test(g);
-    CODE_EVENTS = ["push", "pull_request", "pull_request_target"];
-    PR_CODE_TYPES = /^(?:opened|synchronize|reopened)$/;
-    pathsMatchSource = (globs4, sources) => sources.some((s) => admits(globs4, s));
-    ignoresEverySource = (globs4, sources) => sources.length > 0 && sources.every((s) => admits(globs4, s));
-    CODE_PROBES = ["src/index.ts", "src/index.js", "lib/index.js", "index.ts", "main.go", "src/main.py", "src/lib.rs", "packages/a/src/index.ts", "test/a.test.ts"];
-    REUSED_WORKFLOW = /^\s*-?\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
-    LOCAL_ACTION = /^\s*-?\s*uses:\s*\.\/(\.github\/actions\/[^\s@]+?)\/?\s*(?:#.*)?$/;
-    MANIFEST = /(?:^|\/)(?:package\.json|pyproject\.toml|setup\.py|setup\.cfg|Cargo\.toml|go\.mod|Makefile|build\.gradle(?:\.kts)?|pom\.xml|Gemfile|deno\.jsonc?)$/;
-    WORKDIR_LINE = /^\s*-?\s*working-directory:\s*(.+?)\s*$/;
-    REF_LINE = /^\s*ref:\s*(.+?)\s*$/;
-    CHECKOUT = /^\s*-?\s*uses:\s*actions\/checkout(?:@|\s|$)/;
-    ciTampering = {
-      id: RULE7,
+    dirOf2 = (path) => path.includes("/") ? path.slice(0, path.lastIndexOf("/") + 1) : "";
+    strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : typeof v === "string" ? [v] : [];
+    STRICT_FAMILY = /* @__PURE__ */ new Set([
+      "noImplicitAny",
+      "strictNullChecks",
+      "strictFunctionTypes",
+      "strictBindCallApply",
+      "strictPropertyInitialization",
+      "noImplicitThis",
+      "alwaysStrict",
+      "useUnknownInCatchVariables",
+      "strictBuiltinIteratorReturn"
+    ]);
+    TRUE_IS_STRICT = [
+      "strict",
+      ...STRICT_FAMILY,
+      "noUnusedLocals",
+      "noUnusedParameters",
+      "noImplicitReturns",
+      "noFallthroughCasesInSwitch",
+      "noUncheckedIndexedAccess",
+      "noImplicitOverride",
+      "noPropertyAccessFromIndexSignature",
+      "exactOptionalPropertyTypes",
+      "checkJs",
+      "forceConsistentCasingInFileNames"
+    ];
+    TRUE_IS_WEAK = ["skipLibCheck", "allowUnreachableCode", "allowUnusedLabels", "suppressImplicitAnyIndexErrors", "suppressExcessPropertyErrors", "noStrictGenericChecks"];
+    isLocalTarget = (s) => /^(?:\.\.?\/|\/)/.test(s);
+    emptyFacts = () => ({ off: /* @__PURE__ */ new Map(), on: /* @__PURE__ */ new Set(), ignores: [], linterOff: false });
+    configWeakening = {
+      id: RULE6,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
         const out3 = [];
-        const afterByPath = /* @__PURE__ */ new Map();
-        for (const c of changes) if (c.kind === "file" && c.after != null) afterByPath.set(c.path, c.after);
-        let triggerOpts = null;
-        for (const c of changes) {
-          if (c.kind !== "file") continue;
-          if (c.op === "rename" && c.oldPath && isActiveWorkflow(c.oldPath) && !isActiveWorkflow(c.path)) {
-            out3.push(
-              makeFinding(RULE7, policy, {
-                file: c.path,
-                message: `A CI workflow was renamed so it no longer runs (${c.oldPath} \u2192 ${c.path}).`,
-                evidence: `${c.oldPath} \u2192 ${c.path}`,
-                remediation: "Restore the path and extension. GitHub runs only *.yml/*.yaml directly under .github/workflows \u2014 renaming outside that disables the checks as surely as deleting them."
-              })
-            );
-            continue;
-          }
-          if (!isProtected(c.path, policy, "ci")) continue;
-          const afterLines = c.after != null ? c.after.split("\n") : null;
-          const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
-          const github = isGithubFile(c.path);
-          for (const l of github ? addedLines(c) : []) {
-            const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
-            const cond = l.content.match(/^\s*-?\s*if:\s*(.+?)\s*$/);
-            if (!coe && !cond) continue;
-            const step = afterLines && l.newLine != null ? stepOf(afterLines, l.newLine - 1) : null;
-            if (afterLines && step && !stepHasCheck(afterLines, step)) continue;
-            if (afterLines && !step && l.newLine != null) {
-              const job = jobOf(afterLines, l.newLine - 1);
-              if (job && !jobHasCheck(afterLines, job)) continue;
-            }
-            if (coe && isTruthy(coe[1])) {
-              out3.push(
-                makeFinding(RULE7, policy, {
-                  file: c.path,
-                  line: l.newLine ?? void 0,
-                  message: "continue-on-error: true added \u2014 failures will no longer fail the job.",
-                  evidence: l.content.trim(),
-                  remediation: "Remove it. A check that cannot fail is not a check."
-                })
-              );
-            } else if (cond && isAlwaysFalse(cond[1])) {
-              out3.push(
-                makeFinding(RULE7, policy, {
-                  file: c.path,
-                  line: l.newLine ?? void 0,
-                  message: `if: ${uncommented(cond[1])} added \u2014 this step can never run.`,
-                  evidence: l.content.trim(),
-                  remediation: "Re-enable the step instead of conditioning it off."
-                })
-              );
-            }
-          }
-          if (afterLines && github) {
-            for (const b of runBlocks(afterLines)) {
-              if (!b.body.some(invokesCheck2)) continue;
-              const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
-              for (let k = 0; k < b.body.length; k++) {
-                const idx = b.start + 1 + k;
-                if (!addedAt.has(idx + 1)) continue;
-                const n = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
-                if (!n || propagates && /set\s\+e/.test(b.body[k])) continue;
-                out3.push(
-                  makeFinding(RULE7, policy, {
-                    file: c.path,
-                    line: idx + 1,
-                    message: `A check's run block was neutralised: ${n.what}.`,
-                    evidence: b.body[k].trim(),
-                    remediation: "Let the check decide the step. Masking its exit status is the same tamper as removing it."
-                  })
-                );
-              }
-            }
-            for (const l of addedLines(c)) {
-              if (!/^\s*-?\s*shell:\s*.*\{0\}/.test(l.content) || l.newLine == null) continue;
-              if (SHELL_ERREXIT.test(uncommented(l.content.replace(/^\s*-?\s*shell:\s*/, "")))) continue;
-              const step = stepOf(afterLines, l.newLine - 1);
-              if (step && !stepHasCheck(afterLines, step)) continue;
-              out3.push(
-                makeFinding(RULE7, policy, {
-                  file: c.path,
-                  line: l.newLine,
-                  message: "shell: \u2026 {0} added on a check step \u2014 the shell no longer stops on the first failure.",
-                  evidence: l.content.trim(),
-                  remediation: "Keep the default shell (fail-fast) on steps that run checks."
-                })
-              );
-            }
-            for (const l of addedLines(c)) {
-              if (l.newLine == null) continue;
-              const i = l.newLine - 1;
-              const wd = l.content.match(WORKDIR_LINE);
-              if (wd) {
-                const dir = literalValue(wd[1]);
-                if (dir === null || !dirRunsNothing(dir, ctx)) continue;
-                const step2 = stepOf(afterLines, i);
-                if (step2) {
-                  if (!stepHasCheck(afterLines, step2)) continue;
-                } else {
-                  const d = defaultsOf(afterLines, i);
-                  if (d === null) continue;
-                  const job = jobOf(afterLines, d);
-                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck2(x) || usesCheck(x))) continue;
-                }
-                out3.push(
-                  makeFinding(RULE7, policy, {
-                    file: c.path,
-                    line: l.newLine,
-                    message: `A check was pointed at ${dir} by working-directory \u2014 a directory holding no code or package the check could run.`,
-                    evidence: l.content.trim(),
-                    remediation: "Run the check where the code is. A suite pointed at an empty directory passes on nothing."
-                  })
-                );
-                continue;
-              }
-              const ref = l.content.match(REF_LINE);
-              if (!ref) continue;
-              const step = enclosingStep(afterLines, i);
-              if (!step || !afterLines.slice(step[0], step[1]).some((x) => CHECKOUT.test(x))) continue;
-              const target = literalValue(ref[1]);
-              if (target === null) continue;
-              out3.push(
-                makeFinding(RULE7, policy, {
-                  file: c.path,
-                  line: l.newLine,
-                  message: `actions/checkout was pinned to ref: ${target} \u2014 the checks run against that ref, not against the change under review.`,
-                  evidence: l.content.trim(),
-                  remediation: "Let checkout take the event's ref (its default). A suite that checks out main proves nothing about the pull request."
-                })
-              );
-            }
-            if (c.before != null && c.after != null && !isCompositeAction(c.path)) {
-              triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
-              for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
-                out3.push(
-                  makeFinding(RULE7, policy, {
-                    file: c.path,
-                    message: `The workflow's triggers were narrowed: ${reason}.`,
-                    evidence: reason,
-                    remediation: "Keep the workflow running on push and pull_request for the default branch and its source paths; a check that never runs is no check."
-                  })
-                );
-              }
-            }
-          }
-          const afterCommands = afterLines ? commandLines(afterLines) : null;
-          const afterCores = (afterCommands ?? addedLines(c).map((l) => l.content)).map(commandCore);
-          const addedCores = addedLines(c).map((l) => commandCore(afterCommands && l.newLine != null ? afterCommands[l.newLine - 1] : l.content));
-          for (const l of afterLines ?? []) {
-            for (const reused of localUses(l)) {
-              const content = afterByPath.get(reused);
-              if (content == null || reused === c.path) continue;
-              const cores = commandLines(content.split("\n")).map(commandCore);
-              afterCores.push(...cores);
-              addedCores.push(...cores);
-            }
-          }
-          if (!github && c.after == null) {
-            for (const o of changes) {
-              if (o.kind !== "file" || o.op !== "add" || o.after == null || !isProtected(o.path, policy, "ci")) continue;
-              const cores = commandLines(o.after.split("\n")).map(commandCore);
-              afterCores.push(...cores);
-              addedCores.push(...cores);
-            }
+        const files = changes.filter((c) => c.kind === "file");
+        const addedPaths = new Set(files.filter((c) => c.op === "add").map((c) => c.path));
+        const tsconfigs = files.filter((c) => isTsconfig(c.path) && isProtected(c.path, policy, "config"));
+        const eslints = files.filter((c) => (isEslintConfig(c.path) || isEslintIgnore(c.path)) && isProtected(c.path, policy, "config"));
+        const biomes = files.filter((c) => isBiome(c.path) && isProtected(c.path, policy, "config"));
+        const priorOf = (list3, facts) => {
+          const all = emptyFacts();
+          for (const c of list3) {
+            const f = facts(c.path, c.before);
+            for (const [k, v] of f.off) all.off.set(k, v);
+            for (const k of f.on) all.on.add(k);
+            all.ignores.push(...f.ignores);
+            if (f.linterOff) all.linterOff = true;
           }
-          const runKey = github ? GH_RUN_KEY : GENERIC_RUN_KEY;
-          for (const l of removedLines(c)) {
-            if (/^\s*#/.test(l.content)) continue;
-            const isUsesLine = usesCheck(l.content);
-            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? runKey.test(l.content) : true) && invokesCheck2(l.content);
-            if (!isUsesLine && !isCheckCommand) continue;
-            const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
-            if (s.state === "kept") continue;
-            if (s.state === "neutralised") {
-              out3.push(
-                makeFinding(RULE7, policy, {
-                  file: c.path,
-                  message: "A CI check command was neutralised in place: it still runs, but its result no longer decides (or its suite was narrowed).",
-                  evidence: `${l.content.trim()} \u2192 ${s.by}`,
-                  remediation: "Let the check decide the step; do not mask its status, cut it short, or narrow what it runs."
-                })
-              );
-              continue;
-            }
+          return all;
+        };
+        const eslintPrior = priorOf(eslints, eslintFacts);
+        const biomePrior = priorOf(biomes, biomeFacts);
+        for (const c of tsconfigs) tsconfigWeakenings(c, tsconfigs, policy, addedPaths, ctx, out3);
+        for (const c of eslints) lintWeakenings(c, eslintFacts, eslintPrior, policy, ctx, out3);
+        for (const c of biomes) lintWeakenings(c, biomeFacts, biomePrior, policy, ctx, out3);
+        for (const c of files) {
+          if (c.after === null || !isProtected(c.path, policy, "config")) continue;
+          const rn = runnerOf(c.path, c.after) ?? runnerOf(c.path, c.before);
+          if (rn !== "jest" && rn !== "vitest") continue;
+          for (const e of newSetupEntries(c.before, c.after, c.path)) {
+            const cands = targetCandidates(c.path, e.target);
+            const added = cands.find((f) => addedPaths.has(f));
+            if (added === void 0 && cands.some((f) => isProtected(f, policy))) continue;
             out3.push(
-              makeFinding(RULE7, policy, {
+              makeFinding(RULE6, policy, {
                 file: c.path,
-                message: isUsesLine ? "A CI check step (test/lint/typecheck) was removed." : "A CI check command was removed from a run block.",
-                evidence: l.content.trim(),
-                remediation: "Restore the step. Removing the check that protects main is itself the tamper."
+                message: `The runner now loads ${e.target} through ${e.key}, ${added !== void 0 ? `a file this change adds (${added})` : "a file no protected glob covers"}: it runs with the suite's globals in reach.`,
+                evidence: `${c.path}: ${e.key} += ${JSON.stringify(e.target)}`,
+                remediation: "Review the module the runner will execute around every test, and protect it (protected.config in .tamperward.yml) so later edits to it are gated too.",
+                defaultSeverity: "warn"
               })
             );
           }
@@ -6726,444 +6615,1130 @@ var init_ci_tampering = __esm({
   }
 });
 
-// src/detectors/suite-config.ts
-function runnerSkips(path) {
-  const parts = path.split("/");
-  if (/\.rs$/.test(path)) {
-    const i = parts.indexOf("tests");
-    if (i < 0 || parts.slice(0, i).includes("src")) return null;
-    const rest = parts.slice(i + 1);
-    if (rest.length === 1 || rest.length === 2 && rest[1] === "main.rs") return null;
-    return "cargo builds only tests/*.rs and tests/*/main.rs as test targets";
+// src/detectors/coverage-exclusion.ts
+function isText(line, idx, lang) {
+  const opener = LINE_COMMENT[lang];
+  let quote = null;
+  for (let j = 0; j < idx; j++) {
+    const ch = line[j];
+    if (quote) {
+      if (ch === "\\") j++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
+    else if (opener && opener.test(line.slice(j, j + 2))) return true;
   }
-  if (/\.go$/.test(path)) {
-    const hit = parts.find((p) => p === "testdata" || p.startsWith("_") || p.startsWith("."));
-    if (hit === void 0) return null;
-    return `go test skips ${hit === "testdata" ? "testdata/" : hit.startsWith("_") ? "_*" : ".*"} paths (${JSON.stringify(hit)})`;
+  return quote !== null;
+}
+var RULE7, PATTERNS3, OUT_OF_SCOPE_PATH, LINE_COMMENT, coverageExclusion;
+var init_coverage_exclusion = __esm({
+  "src/detectors/coverage-exclusion.ts"() {
+    "use strict";
+    init_select();
+    init_files();
+    init_policy();
+    init_finding();
+    RULE7 = "coverage-exclusion";
+    PATTERNS3 = {
+      js: [
+        { re: /\/\*\s*istanbul\s+ignore\b/, why: "`istanbul ignore` takes the next statement, branch or the whole file out of the coverage measurement" },
+        { re: /\/\*\s*c8\s+ignore\b(?!\s*stop\b)/, why: "`c8 ignore` takes the next statement or the marked range out of the coverage measurement" },
+        { re: /\/\*\s*v8\s+ignore\b(?!\s*stop\b)/, why: "`v8 ignore` takes the next statement or the marked range out of the coverage measurement" },
+        { re: /\/\*\s*node:coverage\s+(?:ignore|disable)\b/, why: "`node:coverage ignore/disable` takes the following code out of the coverage measurement" }
+      ],
+      py: [{ re: /#\s*pragma[:\s]\s*no\s*cover\b/i, why: "`# pragma: no cover` takes the line or block out of the coverage measurement" }],
+      rs: [{ re: /#\s*!?\[[^\]]*\bcoverage\s*\(\s*off\s*\)/, why: "`#[coverage(off)]` takes the item out of the coverage measurement" }],
+      go: [
+        {
+          re: /^\s*\/\/\s*(?:go:build\b|\+build\b)/,
+          why: "a build constraint added to an existing file takes it out of the default build, and out of `go test -cover`",
+          existingOnly: true
+        }
+      ]
+    };
+    OUT_OF_SCOPE_PATH = /(?:^|\/)(?:node_modules|vendor|third_party|dist|build|out|coverage|generated|__generated__|codegen|examples?|docs?|scripts?|fixtures?|__fixtures__|__mocks__)\/|\.d\.[cm]?ts$|\.(?:generated|gen|pb)\.[^/]*$/;
+    LINE_COMMENT = { js: /^\/\//, go: /^\/\//, rs: /^\/\//, py: /^#/ };
+    coverageExclusion = {
+      id: RULE7,
+      surface: ["file"],
+      certainty: "mechanical",
+      run(changes, policy) {
+        const out3 = [];
+        for (const c of changes) {
+          if (c.kind !== "file" || c.op === "delete") continue;
+          const lang = langOf(c.path);
+          if (!lang) continue;
+          const patterns = PATTERNS3[lang];
+          if (!patterns) continue;
+          const category = protectedCategory(c.path, policy);
+          if (OUT_OF_SCOPE_PATH.test(c.path) || category === "tests" || category === "config") continue;
+          const removed = new Set(removedLines(c).map((l) => l.content.trim()));
+          const before = c.before ?? "";
+          for (const l of addedLines(c)) {
+            const trimmed = l.content.trim();
+            if (removed.has(trimmed)) continue;
+            for (const p of patterns) {
+              const m = p.re.exec(l.content);
+              if (!m || isText(l.content, m.index, lang)) continue;
+              if (p.existingOnly && (c.op === "add" || c.before == null || before.split("\n").some((b) => p.re.test(b)))) continue;
+              out3.push(
+                makeFinding(RULE7, policy, {
+                  file: c.path,
+                  line: l.newLine ?? void 0,
+                  message: `Coverage exclusion added: ${p.why}.`,
+                  evidence: trimmed,
+                  remediation: "Cover the code with a test instead of excluding it from the measurement; if it is genuinely unreachable, say so in review.",
+                  defaultSeverity: "warn"
+                })
+              );
+              break;
+            }
+          }
+        }
+        return out3;
+      }
+    };
   }
-  if (/\.py$/.test(path)) {
-    const hit = PYTEST_DEFAULT_IGNORE.find((g) => globs2([g])(path));
-    return hit === void 0 ? null : `pytest's default norecursedirs matches it (${JSON.stringify(hit)})`;
+});
+
+// src/detectors/gh-expression.ts
+function foldExpressions(s) {
+  return s.replace(/\$\{\{([^}]*)\}\}/g, (_m, e) => {
+    const v = foldConst(e.trim());
+    if (v !== void 0 && v !== TRUTHY) return String(v);
+    return /\b(?:matrix|strategy|inputs)\./.test(e) ? MATRIX_TOKEN : EXPR_TOKEN;
+  });
+}
+function lex(src) {
+  const out3 = [];
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (/\s/.test(ch)) {
+      i++;
+      continue;
+    }
+    if (ch === "'") {
+      let j = i + 1;
+      let s = "";
+      while (j < src.length) {
+        if (src[j] === "'" && src[j + 1] === "'") {
+          s += "'";
+          j += 2;
+        } else if (src[j] === "'") break;
+        else s += src[j++];
+      }
+      if (j >= src.length) return null;
+      out3.push({ t: "str", v: s });
+      i = j + 1;
+      continue;
+    }
+    const num = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
+    if (num) {
+      out3.push({ t: "num", v: num[0] });
+      i += num[0].length;
+      continue;
+    }
+    const op = src.slice(i).match(/^(?:==|!=|&&|\|\||<=|>=|[!()<>,[\]])/);
+    if (op) {
+      out3.push({ t: "op", v: op[0] });
+      i += op[0].length;
+      continue;
+    }
+    const id = src.slice(i).match(/^[A-Za-z_][\w.\-*]*/);
+    if (id) {
+      out3.push({ t: "id", v: id[0] });
+      i += id[0].length;
+      continue;
+    }
+    return null;
+  }
+  return out3;
+}
+function foldConst(src) {
+  const toks = lex(src);
+  if (!toks) return void 0;
+  let p = 0;
+  const peek = () => toks[p];
+  const eat = (v2) => toks[p]?.t === "op" && toks[p].v === v2 ? (p++, true) : false;
+  const num = (v2) => v2 === TRUTHY ? NaN : typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
+  const eq = (a, b) => {
+    if (a === TRUTHY || b === TRUTHY) return void 0;
+    if (typeof a === "string" && typeof b === "string") return a.toLowerCase() === b.toLowerCase();
+    if (a === null && b === null) return true;
+    const x = num(a);
+    const y2 = num(b);
+    return !Number.isNaN(x) && x === y2;
+  };
+  const or = () => {
+    let l = and();
+    while (eat("||")) {
+      const r = and();
+      if (l !== void 0 && truthy(l)) continue;
+      if (l !== void 0) l = r;
+      else l = r !== void 0 && truthy(r) ? TRUTHY : void 0;
+    }
+    return l;
+  };
+  const and = () => {
+    let l = cmp();
+    while (eat("&&")) {
+      const r = cmp();
+      if (l !== void 0 && !truthy(l)) continue;
+      if (l !== void 0) l = r;
+      else l = r !== void 0 && !truthy(r) ? false : void 0;
+    }
+    return l;
+  };
+  const cmp = () => {
+    let l = unary();
+    for (; ; ) {
+      const t = peek();
+      if (!t || t.t !== "op" || !/^(?:==|!=|<|>|<=|>=)$/.test(t.v)) return l;
+      p++;
+      const r = unary();
+      if (l === void 0 || r === void 0) {
+        l = void 0;
+        continue;
+      }
+      if (t.v === "==" || t.v === "!=") {
+        const e = eq(l, r);
+        l = e === void 0 ? void 0 : t.v === "==" ? e : !e;
+      } else {
+        const x = num(l);
+        const y2 = num(r);
+        if (Number.isNaN(x) || Number.isNaN(y2)) l = void 0;
+        else l = t.v === "<" ? x < y2 : t.v === ">" ? x > y2 : t.v === "<=" ? x <= y2 : x >= y2;
+      }
+    }
+  };
+  const unary = () => {
+    if (eat("!")) {
+      const v2 = unary();
+      return v2 === void 0 ? void 0 : !truthy(v2);
+    }
+    return primary();
+  };
+  const primary = () => {
+    const t = peek();
+    if (!t) return void 0;
+    if (eat("(")) {
+      const v2 = or();
+      return eat(")") ? v2 : void 0;
+    }
+    p++;
+    if (t.t === "str") return t.v;
+    if (t.t === "num") return Number(t.v);
+    if (t.t === "id") {
+      if (/^true$/i.test(t.v)) return true;
+      if (/^false$/i.test(t.v)) return false;
+      if (/^null$/i.test(t.v)) return null;
+      if (eat("(")) {
+        const args = [];
+        if (!eat(")")) {
+          for (; ; ) {
+            args.push(or());
+            if (eat(")")) break;
+            if (!eat(",")) return void 0;
+          }
+        }
+        let indexed = false;
+        while (eat("[")) {
+          or();
+          indexed = true;
+          if (!eat("]")) return void 0;
+        }
+        if (indexed) return void 0;
+        return callConst(t.v, args);
+      }
+      while (eat("[")) {
+        or();
+        if (!eat("]")) return void 0;
+      }
+      return void 0;
+    }
+    return void 0;
+  };
+  const v = or();
+  return p === toks.length ? v : void 0;
+}
+function callConst(name, args) {
+  const vals = [];
+  for (const a of args) {
+    if (a === void 0 || a === TRUTHY) return void 0;
+    vals.push(a);
+  }
+  const s = (i) => vals[i] == null ? "" : String(vals[i]);
+  switch (name.toLowerCase()) {
+    case "contains":
+      return vals.length === 2 ? s(0).toLowerCase().includes(s(1).toLowerCase()) : void 0;
+    case "startswith":
+      return vals.length === 2 ? s(0).toLowerCase().startsWith(s(1).toLowerCase()) : void 0;
+    case "endswith":
+      return vals.length === 2 ? s(0).toLowerCase().endsWith(s(1).toLowerCase()) : void 0;
+    case "format": {
+      if (vals.length < 1) return void 0;
+      return s(0).replace(/\{\{|\}\}|\{(\d+)\}/g, (m, i) => m === "{{" ? "{" : m === "}}" ? "}" : s(Number(i) + 1));
+    }
+    case "join":
+      return vals.length >= 1 && vals.length <= 2 ? s(0) : void 0;
+    case "tojson":
+      return vals.length === 1 ? JSON.stringify(vals[0]) : void 0;
+    case "fromjson": {
+      if (vals.length !== 1) return void 0;
+      try {
+        const v = JSON.parse(s(0));
+        if (v === null || typeof v === "string" || typeof v === "number" || typeof v === "boolean") return v;
+        return TRUTHY;
+      } catch {
+        return void 0;
+      }
+    }
+    default:
+      return void 0;
+  }
+}
+var EXPR_TOKEN, MATRIX_TOKEN, TRUTHY, truthy;
+var init_gh_expression = __esm({
+  "src/detectors/gh-expression.ts"() {
+    "use strict";
+    EXPR_TOKEN = "__expr__";
+    MATRIX_TOKEN = "__matrix__";
+    TRUTHY = /* @__PURE__ */ Symbol("truthy");
+    truthy = (v) => v === TRUTHY ? true : typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true;
+  }
+});
+
+// src/detectors/invocation.ts
+function canonical(core) {
+  let s = foldExpressions(core.replace(/^(['"])(.*)\1$/, "$2").trim()).replace(MATRIX_FLAG, " ").replace(/\s+/g, " ").trim();
+  s = s.replace(/^(?:cd|pushd)\s+\S+\s*&&\s*/, "");
+  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
+  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
+  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
+  s = s.replace(/^exec\s+/, "");
+  return s.replace(/\s+--\s*$/, "").trim();
+}
+function runnerNarrowed(cmd, args) {
+  return runnerNarrowing(cmd, args) !== null;
+}
+function runnerNarrowing(cmd, args) {
+  const t = RUNNER_NARROWINGS.find((x) => x.runner.test(cmd));
+  const m = t ? (" " + args.trim()).match(t.flags) : null;
+  return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+}
+function coverageFloorLowered(removed, added) {
+  const was = removed.match(COVERAGE_FLOOR);
+  const now = added.match(COVERAGE_FLOOR);
+  return was !== null && now !== null && Number(now[1]) < Number(was[1]);
+}
+function inCommandPosition(core) {
+  return canonical(core).split(/\s*(?:&&|\|\||;|\|)\s*/).some((seg) => CHECK_HEAD.test(canonical(seg.replace(COMMAND_PREFIX, ""))));
+}
+function narrowedByPositional(args) {
+  return positionalOf(args) !== null;
+}
+function positionalOf(args) {
+  const toks = args.trim().split(/\s+/).filter(Boolean);
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if (t === "--" || t.startsWith("-")) continue;
+    const prev = toks[i - 1];
+    if (prev && (prev.startsWith("-") && prev !== "--" && !prev.includes("=") || /[<>]/.test(prev))) continue;
+    if (/[<>|;&]/.test(t)) continue;
+    if (PATH_SHAPED.test(t)) return t;
+  }
+  return null;
+}
+function checkKind(core) {
+  if (!invokesCheck(core)) return null;
+  const s = canonical(core);
+  if (/\btamperward\b/.test(s)) return "gate";
+  if (/\b(?:lint|eslint|biome|oxlint|golangci-lint|ruff)\b/i.test(s)) return "lint";
+  if (/\b(?:typecheck|type-check|tsc|tsgo|mypy)\b|\bdeno\s+check\b/i.test(s)) return "types";
+  return "test";
+}
+function survives(removedCore, isUses, afterCores, addedCores) {
+  if (isUses) {
+    const ref = usesRef(removedCore);
+    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
+  }
+  const r = canonical(removedCore);
+  const kind = checkKind(removedCore);
+  const narrowed = (args) => kind === "test" && narrowedByPositional(args);
+  let neutralised;
+  for (const raw of afterCores) {
+    const a = canonical(raw);
+    if (a === r) return { state: "kept" };
+    if (a.startsWith(r + " ")) {
+      const rest = a.slice(r.length);
+      if (NEUTRALISING_SUFFIX.test(rest) || narrowed(rest) || runnerNarrowed(a, rest)) neutralised ??= raw;
+      else return { state: "kept" };
+    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
+      return { state: "kept" };
+    } else {
+      const w = a.match(TIMEOUT_WRAP);
+      if (w && (canonical(w[1]) === r || canonical(w[1]).startsWith(r + " "))) neutralised ??= raw;
+    }
+  }
+  const maskOf = (args) => (" " + args).match(NEUTRALISING_SUFFIX)?.[0]?.trim() ?? null;
+  const priorMask = r.includes(" ") ? maskOf(r.slice(r.indexOf(" ") + 1)) : null;
+  let respelled = false;
+  for (const raw of addedCores) {
+    if (!kind || checkKind(raw) !== kind) continue;
+    const a = canonical(raw);
+    if (a.match(TIMEOUT_WRAP)) {
+      neutralised ??= raw;
+      continue;
+    }
+    if (!inCommandPosition(raw)) continue;
+    if (coverageFloorLowered(r, a)) {
+      neutralised ??= raw;
+      continue;
+    }
+    const args = a.slice(a.indexOf(" ") + 1 || a.length);
+    const mask = maskOf(args);
+    const newMask = mask !== null && mask !== priorMask;
+    if (a.includes(" ") && (newMask || narrowed(args) || runnerNarrowed(a, args))) neutralised ??= raw;
+    else respelled = true;
+  }
+  if (respelled) return { state: "kept" };
+  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
+}
+function unwrap(seg) {
+  const s = seg.trim().replace(PYTHON_M, "").replace(NODE_BIN, "$1").replace(BIN_OF, "$1$2");
+  if (invokesCheck(s) || PRINTER.test(s) || /^["']/.test(s)) return s;
+  const toks = s.split(/\s+/);
+  for (let i = 1; i < toks.length && i <= 16; i++) {
+    const rest = toks.slice(i).join(" ");
+    if (invokesCheck(rest)) return rest;
+  }
+  return s;
+}
+function scriptKind3(inner) {
+  const kind = checkKind(inner);
+  if (!kind) return null;
+  const head = canonical(inner).match(/^(tests?|lint|type-?check|coverage)(?=[\s:]|$)/i)?.[1];
+  if (!head) return kind;
+  return /^type/i.test(head) ? "types" : /^lint/i.test(head) ? "lint" : "test";
+}
+function runnerOfSegment(canon) {
+  const m = canon.match(RUNNER_NAME);
+  if (!m) return null;
+  const n = m[1];
+  return n === "jest" || n === "vitest" || n === "mocha" || n === "pytest" || n === "go" || n === "cargo" ? n : "node";
+}
+function statements(raw) {
+  const out3 = [];
+  let single = false;
+  let double = false;
+  let last = 0;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (ch === "\\" && !single) {
+      i++;
+      continue;
+    }
+    if (ch === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (ch === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single || double) continue;
+    const prev = raw[i - 1];
+    const next = raw[i + 1];
+    let op = null;
+    if (ch === "&" && next === "&") op = "&&";
+    else if (ch === "|" && next === "|") op = "||";
+    else if (ch === "|" && next === "&") op = "|&";
+    else if (ch === ";" || ch === "\n") op = ";";
+    else if (ch === "|" && prev !== ">") op = "|";
+    else if (ch === "&" && prev !== ">" && next !== ">") op = "&";
+    if (!op) continue;
+    out3.push({ seg: raw.slice(last, i).trim(), op });
+    i += op.length - 1;
+    last = i + 1;
+  }
+  out3.push({ seg: raw.slice(last).trim(), op: null });
+  return out3.filter((s) => s.seg !== "");
+}
+function descriptors(cmd, runner, opts) {
+  const out3 = [];
+  const stmts = statements(cmd);
+  for (let i = 0; i < stmts.length; i++) {
+    const { seg, op } = stmts[i];
+    const wrapped = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(wrapped ? wrapped[1] : seg);
+    if (!invokesCheck(inner)) continue;
+    const kind = scriptKind3(inner);
+    const canon = canonical(inner);
+    const rn = runner ?? runnerOfSegment(canon);
+    const args = canon.includes(" ") ? " " + canon.slice(canon.indexOf(" ") + 1) : " ";
+    if (wrapped) out3.push({ key: "timeout", what: "a timeout wrapper", direction: "added" });
+    const following = stmts[i + 1]?.seg ?? "";
+    if (op === "||" || op === "|" || op === "&" || op === ";" && !invokesCheck(unwrap(following))) {
+      out3.push({ key: `op:${op}`, what: `${op} ${following.split(/\s+/).slice(0, 2).join(" ")}`.trim(), direction: "added" });
+    }
+    for (const re of MASKING_FLAGS) {
+      const f = spelled(re, args);
+      if (f) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    for (const re of GATE_FLAGS) {
+      const f = spelled(re, " " + seg);
+      if (f) out3.push({ key: `gate:${f}`, what: f, direction: "removed" });
+    }
+    if (kind !== "test" || opts.sliceByDesign || opts.extended?.has(kind)) continue;
+    const flags = [SUITE_NARROWING_FLAGS, ...NARROWING_BY_RUNNER["*"], ...rn ? NARROWING_BY_RUNNER[rn] : []];
+    for (const re of flags) {
+      const f = spelled(re, args);
+      if (f && !opts.excuseFlag?.(f, canon)) out3.push({ key: `flag:${f}`, what: f, direction: "added" });
+    }
+    if (rn === "cargo" && CARGO_SKIP.test(args)) out3.push({ key: "flag:-- --skip", what: "-- --skip", direction: "added" });
+    const shared = runnerNarrowing(canon, args);
+    if (shared && !opts.excuseFlag?.(shared, canon)) out3.push({ key: `flag:${shared}`, what: shared, direction: "added" });
+    if (opts.fresh) continue;
+    const cfg = args.match(CONFIG_FLAG);
+    if (cfg && !opts.configReviewed?.(cfg[3])) out3.push({ key: `config:${cfg[3]}`, what: `${cfg[1]} ${cfg[3]}`, direction: "added" });
+    const pos = positionalOf(args);
+    if (pos) out3.push({ key: "positional", what: `a path positional (${pos})`, direction: "added" });
   }
-  if (/\.[cm]?[jt]sx?$/.test(path)) {
-    const hit = JS_UNWALKED.find((g) => globs2([g])(path));
-    return hit === void 0 ? null : `the runner's default exclude matches it (${JSON.stringify(hit)})`;
+  return out3;
+}
+function checkStatements(cmd) {
+  const out3 = [];
+  for (const seg of segments(cmd)) {
+    const w = seg.match(TIMEOUT_WRAP);
+    const inner = unwrap(w ? w[1] : seg);
+    const kind = scriptKind3(inner);
+    if (kind) out3.push({ kind, canon: canonical(inner) });
   }
-  return null;
+  return out3;
 }
-function keyName2(name) {
-  if (ts.isIdentifier(name) || ts.isStringLiteral(name)) return name.text;
-  return null;
+function checkKinds(cmd) {
+  return new Set(checkStatements(cmd).map((s) => s.kind));
 }
-function literals2(e) {
-  if (isStr(e)) return { items: [e.text], opaque: false };
-  if (!ts.isArrayLiteralExpression(e)) return { items: [], opaque: true };
-  const items = [];
-  let opaque = false;
-  for (const el of e.elements) {
-    if (isStr(el)) items.push(el.text);
-    else if (ts.isSpreadElement(el) && /^(?:configDefaults\.|default)(?:exclude|include)$/i.test(el.expression.getText())) {
-      items.push(.../exclude$/i.test(el.expression.getText()) ? VITEST_DEFAULT_EXCLUDE : VITEST_DEFAULT_INCLUDE);
-    } else opaque = true;
+function failsLoudly(cmd) {
+  const last = segments(cmd).pop();
+  return last !== void 0 && FAILS_LOUDLY.test(last.trim());
+}
+function invocationWeakening(before, after, runner, opts = {}) {
+  const was = checkKinds(before);
+  const now = checkKinds(after);
+  if (now.size === 0 && failsLoudly(after)) return { state: "kept" };
+  for (const k of was) {
+    if (now.has(k) || opts.relocated?.(k)) continue;
+    const instead = [...now].filter((x) => !was.has(x));
+    return { state: "removed", kind: k, what: instead.length ? `runs a ${instead.join("/")} check instead` : now.size ? "the check is gone" : "no check is run" };
   }
-  return { items, opaque };
+  const survived = new Set(checkStatements(before).map((s) => s.canon));
+  const extended = new Set(checkStatements(after).filter((s) => survived.has(s.canon)).map((s) => s.kind));
+  const read = { ...opts, fresh: was.size === 0, extended };
+  const beforeDs = descriptors(before, runner, read);
+  const afterDs = descriptors(after, runner, read);
+  const seenBefore = new Set(beforeDs.map((d) => d.key));
+  const added = afterDs.find((d) => d.direction === "added" && !seenBefore.has(d.key));
+  if (added) return { state: "neutralised", what: added.what, direction: "added" };
+  if (coverageFloorLowered(before, after)) return { state: "neutralised", what: "a lowered --cov-fail-under", direction: "added" };
+  const seenAfter = new Set(afterDs.map((d) => d.key));
+  const dropped = beforeDs.find((d) => d.direction === "removed" && !seenAfter.has(d.key));
+  if (dropped) return { state: "neutralised", what: dropped.what, direction: "removed" };
+  return { state: "kept" };
 }
-function ownerKey2(node) {
-  const obj = node.parent;
-  if (!obj || !ts.isObjectLiteralExpression(obj)) return null;
-  let q = obj.parent;
-  while (q && (ts.isParenthesizedExpression(q) || ts.isAsExpression(q) || q.kind === ts.SyntaxKind.SatisfiesExpression)) q = q.parent;
-  return q && ts.isPropertyAssignment(q) ? keyName2(q.name) : null;
+var INVOKES_TOOL, INVOKES_SCRIPT, invokesCheck, MATRIX_FLAG, usesRef, SUITE_NARROWING_FLAGS, NEUTRALISING_SUFFIX, TIMEOUT_WRAP, RUNNER_NARROWINGS, COVERAGE_FLOOR, COMMAND_PREFIX, CHECK_HEAD, PATH_SHAPED, NARROWING_BY_RUNNER, CARGO_SKIP, MASKING_FLAGS, GATE_FLAGS, CONFIG_FLAG, PRINTER, PYTHON_M, NODE_BIN, BIN_OF, RUNNER_NAME, spelled, FAILS_LOUDLY;
+var init_invocation = __esm({
+  "src/detectors/invocation.ts"() {
+    "use strict";
+    init_gh_expression();
+    init_command();
+    INVOKES_TOOL = /(?:^\s*|[;&|`]\s*|\$\(\s*|\b(?:npx|yarn|pnpm|bunx?)\s+)(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint|node\s+--test|biome\s+(?:ci|check|lint)|deno\s+(?:test|lint|check)|ruff\s+check)\b/;
+    INVOKES_SCRIPT = /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|tests|lint|typecheck|type-check|coverage)\b|\b(?:make|cargo|go)\s+test\b|\bgradle\w*\s+(?:test|check)\b/;
+    invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line);
+    MATRIX_FLAG = new RegExp(`(?:^|\\s)-{1,2}[\\w-]+(?:=|\\s+)${MATRIX_TOKEN}(?:/\\S*)?(?=\\s|$)`, "g");
+    usesRef = (core) => core.replace(/@.*$/, "");
+    SUITE_NARROWING_FLAGS = /--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b|--exclude\b|--dir\b|--project\b/;
+    NEUTRALISING_SUFFIX = new RegExp(
+      `\\|\\||;|(?<!&)&(?!&)|\\|(?!\\|)|--passWithNoTests\\b|--coverage=false\\b|--coverageThreshold\\b|${SUITE_NARROWING_FLAGS.source}`
+    );
+    TIMEOUT_WRAP = /^timeout\s+(?:-{1,2}\S+\s+)*\d\S*\s+(.+)$/;
+    RUNNER_NARROWINGS = [
+      {
+        // a package-manager script: `test --prefix dir`, `-w pkg`, `--workspace=pkg`,
+        // `--if-present` (no script, no failure), pnpm's `--filter` / `-F`, npm's `-C`
+        runner: /^(?:test|tests|coverage)(?::\S+)?(?=\s|$)/,
+        flags: /\s--if-present(?=\s|$)|\s--prefix(?:=|\s)|\s-C(?:=|\s)|\s-w(?:=|\s)|\s--workspace(?:=|\s)|\s--filter(?:=|\s)|\s-F(?:=|\s)/
+      },
+      {
+        runner: /^(?:jest|vitest)\b/,
+        flags: /\s--shard(?:=|\s)|\s--root(?:Dir)?(?:=|\s)|\s--testMatch(?:=|\s)|\s--testRegex(?:=|\s)|\s--modulePathIgnorePatterns(?:=|\s)|\s--selectProjects(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)/
+      },
+      { runner: /^playwright\b/, flags: /\s--shard(?:=|\s)|\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--grep-invert(?:=|\s)/ },
+      { runner: /^mocha\b/, flags: /\s--grep(?:=|\s)|\s-g(?:=|\s)|\s--fgrep(?:=|\s)|\s-f(?:=|\s)/ },
+      { runner: /^ava\b/, flags: /\s--match(?:=|\s)|\s-m(?:=|\s)/ },
+      { runner: /^node --test\b/, flags: /\s--test-name-pattern(?:=|\s)|\s--test-skip-pattern(?:=|\s)|\s--test-only(?=\s|$)/ },
+      {
+        // `-p no:<plugin>` disables collection when the plugin is the collector
+        // (`python`, `doctest`, `cov`); the cache, warning and output plugins select nothing
+        runner: /^pytest\b/,
+        flags: /\s-k(?:=|\s)|\s-m(?:=|\s)|\s--deselect(?:=|\s)|\s--ignore(?:-glob)?(?:=|\s)|\s-p\s*no:(?!(?:cacheprovider|warnings|faulthandler|randomly|logging|legacypath|pastebin|stepwise|tmpdir|junitxml|terminal|terminalreporter)(?=\s|$))|\s--collect-only(?=\s|$)|\s--co(?=\s|$)/
+      },
+      { runner: /^cargo test\b/, flags: /\s--\s(?:\S+\s+)*--skip(?:=|\s)|\s--exclude(?:=|\s)/ },
+      { runner: /^go test\b/, flags: /\s-run(?:=|\s)|\s-skip(?:=|\s)/ }
+    ];
+    COVERAGE_FLOOR = /--cov-fail-under(?:=|\s+)(\d+(?:\.\d+)?)/;
+    COMMAND_PREFIX = /^(?:(?:[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\S*)|sudo|env|nice|time|exec|command|nohup|xvfb-run|dbus-launch|cross-env|dotenv|poetry\s+run|pipenv\s+run|uv\s+run|hatch\s+run|pdm\s+run|bundle\s+exec)\s+(?:-{1,2}\S+\s+)*)*/;
+    CHECK_HEAD = /^(?:(?:test|tests|lint|typecheck|type-check|coverage)(?::\S+)?(?=\s|$)|(?:jest|vitest|eslint|tsc|playwright|pytest|tamperward|mocha|ava|oxlint|tsgo|mypy|golangci-lint)\b|node --test\b|biome (?:ci|check|lint)\b|deno (?:test|lint|check)\b|ruff check\b|(?:make|cargo|go) test\b|gradle\w* (?:test|check)\b)/;
+    PATH_SHAPED = /\/|\.(?:test|spec)\./;
+    NARROWING_BY_RUNNER = {
+      "*": [/--shard\b/],
+      jest: [/--root\b/, /--rootDir\b/, /--testMatch\b/, /--testRegex\b/, /--modulePathIgnorePatterns\b/, /--selectProjects\b/, /--ignoreProjects\b/, /--filter\b/],
+      vitest: [/--grep\b/],
+      mocha: [/--grep\b/, /(?:^|\s)-g(?:\s|=)/, /--ignore\b/, /(?:^|\s)-f(?:\s|=)/, /--fgrep\b/],
+      pytest: [/(?:^|\s)-k(?:\s|=)/, /(?:^|\s)-m(?:\s|=)/, /--deselect\b/, /--ignore\b/, /--ignore-glob\b/, /--last-failed\b/, /(?:^|\s)--lf(?:\s|$)/, /--collect-only\b/, /(?:^|\s)--co(?:\s|$)/],
+      go: [/(?:^|\s)-run(?:\s|=)/, /(?:^|\s)-skip(?:\s|=)/],
+      cargo: [],
+      node: [/--test-name-pattern\b/, /--test-skip-pattern\b/]
+    };
+    CARGO_SKIP = /\s--\s+(?:\S+\s+)*--skip\b/;
+    MASKING_FLAGS = [/--passWithNoTests\b/, /--coverage=false\b/, /--coverageThreshold\b/, /--if-present\b/];
+    GATE_FLAGS = [/--check-coverage\b/];
+    CONFIG_FLAG = /(?:^|\s)(--config|-c)(?:=|\s+)(['"]?)([^\s'"]+)\2(?=\s|$)/;
+    PRINTER = /^(?:echo|printf|true|false|:|cat|exit|return|sleep|test|\[|node|git|curl|wget)(?=\s|$)/;
+    PYTHON_M = /^python\d?(?:\.\d+)?\s+-m\s+(?=pytest\b)/;
+    NODE_BIN = /^node(?:\s+-\S+)*\s+\S*node_modules\/(?:\.bin\/)?(jest|vitest|mocha|ava)\b\S*/;
+    BIN_OF = /\$\((?:yarn|npm|pnpm)\s+bin\s+(\w+)\)|\$\((?:yarn|npm|pnpm)\s+bin\)\/(\w+)/g;
+    RUNNER_NAME = /^(jest|vitest|mocha|pytest|go|cargo|node)\b/;
+    spelled = (re, s) => {
+      const m = s.match(re);
+      return m ? m[0].trim().replace(/[=\s].*$/, "") : null;
+    };
+    FAILS_LOUDLY = /^(?:exit\s+(?:[1-9]\d*)|false)\s*$/;
+  }
+});
+
+// src/detectors/ci-tampering.ts
+function isActiveWorkflow(path) {
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
 }
-function asExpression2(src) {
-  const t = src.trim();
-  return t.startsWith("{") ? `(${t})` : src;
+function commandCore(line) {
+  return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses|script|command|before_script|after_script|sh|bash|pwsh|powershell):\s*/, "").replace(/\s+/g, " ").trim();
 }
-function runnerOf(path, content) {
-  const base = path.split("/").pop() ?? path;
-  if (/^jest\.config\./.test(base) || base === "package.json") return "jest";
-  if (/^vitest\.(?:config|workspace)\./.test(base)) return "vitest";
-  if (/^vite\.config\./.test(base) && content != null && /(?:^|[\s,{])["']?test["']?\s*:/m.test(content)) return "vitest";
-  if (base === "pytest.ini" || base === ".pytest.ini") return "pytest";
-  if (content == null) return null;
-  if (base === "tox.ini" && /^\s*\[pytest\]/m.test(content)) return "pytest";
-  if (base === "setup.cfg" && /^\s*\[tool:pytest\]/m.test(content)) return "pytest";
-  if (base === "pyproject.toml" && /^\s*\[tool\.pytest\.ini_options\]/m.test(content)) return "pytest";
-  return null;
+function expressionOf(raw) {
+  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
+  const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
+  return m ? m[1] : v;
 }
-function claimsPytest(name, src) {
-  if (name === "pytest.ini" || name === ".pytest.ini") return true;
-  const section = name === "pyproject.toml" ? /^\s*\[tool\.pytest\.ini_options\]\s*$/m : name === "tox.ini" ? /^\s*\[pytest\]\s*$/m : name === "setup.cfg" ? /^\s*\[tool:pytest\]\s*$/m : null;
-  return section !== null && section.test(src);
+function isAlwaysFalse(raw) {
+  const e = expressionOf(raw);
+  if (e === "") return false;
+  const v = foldConst(e);
+  return v !== void 0 && !truthy(v);
 }
-function effectivePytestFile(files) {
-  for (const name of PYTEST_INI_ORDER) {
-    const content = files.get(name);
-    if (content == null) continue;
-    if (claimsPytest(name, content)) return { path: name, content };
-  }
-  return null;
+function isTruthy(raw) {
+  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
+  if (/^(?:true|yes|on|1)$/i.test(v)) return true;
+  const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
+  if (!m) return false;
+  const f = foldConst(m[1]);
+  return f !== void 0 && truthy(f);
 }
-function effectivePytestConfig(path, ctx) {
-  if (path.includes("/")) return false;
-  const base = path;
-  const rank = PYTEST_INI_ORDER.findIndex((name) => name === base);
-  if (rank < 0) return false;
-  const files = ctx?.trackedFiles;
-  if (!files) return true;
-  const rootNames = new Set(files.filter((f) => !f.includes("/")));
-  return !PYTEST_INI_ORDER.slice(0, rank).some((n) => rootNames.has(n));
+function stepOf(lines, i) {
+  const ind = indentOf(lines[i]);
+  let s = i - 1;
+  while (s >= 0 && (lines[s].trim() === "" || indentOf(lines[s]) >= ind)) s--;
+  if (s < 0 || !STEP_START.test(lines[s])) return null;
+  const stepInd = indentOf(lines[s]);
+  let e = i + 1;
+  while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > stepInd)) e++;
+  return [s, e];
 }
-function pytestBlock(src) {
-  const lines = src.split(/\r?\n/);
-  const head = /^\s*\[(pytest|tool:pytest|tool\.pytest\.ini_options)\]\s*$/;
-  let i = lines.findIndex((l) => head.test(l));
-  if (i < 0) return null;
-  const out3 = {};
-  let key2 = null;
-  for (i += 1; i < lines.length; i++) {
-    const line = lines[i];
-    if (/^\s*\[/.test(line)) break;
-    if (/^\s*[#;]/.test(line) || !line.trim()) {
+function jobOf(lines, i) {
+  const ind = indentOf(lines[i]);
+  let h = i - 1;
+  while (h >= 0 && (lines[h].trim() === "" || indentOf(lines[h]) >= ind)) h--;
+  if (h < 0 || !/^\s+[\w-]+:\s*(?:#.*)?$/.test(lines[h])) return null;
+  let t = h - 1;
+  while (t >= 0 && (lines[t].trim() === "" || indentOf(lines[t]) > 0)) t--;
+  if (t < 0 || !/^jobs:/.test(lines[t])) return null;
+  const hi = indentOf(lines[h]);
+  let e = i + 1;
+  while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > hi)) e++;
+  return [h, e];
+}
+function runBlocks(lines) {
+  const out3 = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*-?\s*run:\s*[|>][-+]?\s*$/.test(lines[i])) continue;
+    const ind = indentOf(lines[i].replace(/^(\s*)-\s+/, "$1  "));
+    let e = i + 1;
+    while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > ind)) e++;
+    out3.push({ start: i, end: e, body: lines.slice(i + 1, e) });
+  }
+  return out3;
+}
+function commandLines(lines) {
+  const out3 = lines.slice();
+  for (const b of runBlocks(lines)) {
+    if (/^\s*-?\s*run:\s*>/.test(lines[b.start])) {
+      out3[b.start + 1] = b.body.map((l) => l.trim()).filter(Boolean).join(" ");
+      for (let k = b.start + 2; k < b.end; k++) out3[k] = "";
       continue;
     }
-    const m = line.match(/^(\w[\w.-]*)\s*[=:]\s*(.*)$/);
-    if (m) {
-      key2 = m[1];
-      out3[key2] = m[2].trim();
-      continue;
+    const indents = b.body.filter((l) => l.trim() !== "").map(indentOf);
+    const ind = indents.length ? Math.min(...indents) : 0;
+    const dedented = b.body.map((l) => l.slice(Math.min(ind, indentOf(l))));
+    const kept = stripHeredocs(dedented);
+    let j = 0;
+    for (let k = 0; k < dedented.length; k++) {
+      if (j < kept.length && kept[j] === dedented[k]) j++;
+      else out3[b.start + 1 + k] = "";
     }
-    if (key2 && /^\s+\S/.test(line)) out3[key2] += " " + line.trim();
   }
   return out3;
 }
-function pytestTokens(raw) {
-  const v = raw.trim();
-  if (v.startsWith("[")) {
-    return [...v.matchAll(/"([^"]*)"|'([^']*)'/g)].map((m) => m[1] ?? m[2] ?? "");
-  }
-  const unq2 = v.replace(/^"([\s\S]*)"$/, "$1").replace(/^'([\s\S]*)'$/, "$1");
-  return [...unq2.matchAll(/"([^"]*)"|'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2] ?? m[3] ?? "").filter(Boolean);
-}
-function pytestSelection(src) {
-  const sel = empty();
-  const blk = pytestBlock(src);
-  if (!blk) return sel;
-  sel.present = true;
-  const ignore = blk.norecursedirs !== void 0 ? pytestTokens(blk.norecursedirs).flatMap((d) => pathGlobs(d).map((pattern) => ({ pattern, key: "norecursedirs" }))) : PYTEST_DEFAULT_IGNORE.map((pattern) => ({ pattern, key: "norecursedirs" }));
-  if (blk.testpaths !== void 0) sel.roots = pytestTokens(blk.testpaths).map((t) => t.replace(/^\.\//, ""));
-  if (blk.python_files !== void 0) sel.include = pytestTokens(blk.python_files).map((g) => g.includes("/") ? g : "**/" + g);
-  for (const key2 of ["python_classes", "python_functions"]) {
-    if (blk[key2] !== void 0) ignore.push({ pattern: "\0" + key2, key: key2 });
-  }
-  const opts = blk.addopts !== void 0 ? pytestTokens(blk.addopts) : [];
-  for (let j = 0; j < opts.length; j++) {
-    const o = opts[j];
-    const val = (inline) => o.includes("=") ? o.slice(o.indexOf("=") + 1) : opts[++j] ?? inline;
-    if (o === "--ignore" || o.startsWith("--ignore=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--ignore" });
-    else if (o === "--ignore-glob" || o.startsWith("--ignore-glob=")) {
-      const g = val("");
-      ignore.push({ pattern: g, key: "--ignore-glob" });
-      if (!g.startsWith("**/") && !g.startsWith("/")) ignore.push({ pattern: "**/" + g, key: "--ignore-glob" });
-    } else if (o === "--deselect" || o.startsWith("--deselect=")) for (const g of pathGlobs(val(""))) ignore.push({ pattern: g, key: "--deselect" });
-    else if (o === "-k" || o.startsWith("-k=")) {
-      for (const w of (val("").match(/\bnot\s+([A-Za-z_][\w]*)/g) ?? []).map((t) => t.replace(/^not\s+/, "")))
-        ignore.push({ pattern: `**/*${w}*`, key: "-k" });
-    } else if (o === "-m" || o.startsWith("-m=")) {
-      ignore.push({ pattern: "\0-m " + val(""), key: "-m" });
-    } else if (o === "-p" || o.startsWith("-p=") || o.length > 2 && o.startsWith("-p")) {
-      const v = o === "-p" ? opts[++j] ?? "" : o.startsWith("-p=") ? o.slice(3) : o.slice(2);
-      if (v.startsWith("no:")) ignore.push({ pattern: "\0-p " + v, key: "-p" });
-    } else if (o === "--collect-only" || o === "--co") ignore.push({ pattern: "**", key: o });
-  }
-  sel.ignore = ignore;
-  return sel;
-}
-function dirValue(e) {
-  if (!isStr(e)) return { dir: null, opaque: true };
-  const d = stripRootDir(e.text).replace(/^\.\//, "").replace(/\/+$/, "");
-  if (d === "." || d === "" || d.split("/").includes("..")) return { dir: null, opaque: false };
-  return { dir: d, opaque: false };
+function flowList(v) {
+  const m = v.trim().match(/^\[(.*)\]$/);
+  if (!m) return null;
+  return m[1].split(",").map((s) => s.trim().replace(/^(['"])(.*)\1$/, "$2")).filter(Boolean);
 }
-function collect(root, runner) {
-  const sel = empty();
-  const seen = /* @__PURE__ */ new Set();
-  const take = (key2, e) => {
-    const { items, opaque } = literals2(e);
-    if (opaque || seen.has(key2)) sel.opaque = true;
-    seen.add(key2);
-    sel.present = true;
-    return items.map(stripRootDir);
-  };
-  const ignores = (key2, e) => {
-    const entries = take(key2, e).map((pattern) => ({ pattern, key: key2 }));
-    sel.ignore = [...sel.ignore ?? [], ...entries];
-  };
-  let projectList = null;
-  const projects = (e) => {
-    sel.present = true;
-    projectList = e;
+function parseTriggers(src) {
+  const t = {
+    events: /* @__PURE__ */ new Set(),
+    branches: /* @__PURE__ */ new Map(),
+    branchesIgnore: /* @__PURE__ */ new Map(),
+    pathsIgnore: /* @__PURE__ */ new Map(),
+    paths: /* @__PURE__ */ new Map(),
+    types: /* @__PURE__ */ new Map(),
+    tags: /* @__PURE__ */ new Map(),
+    present: false
   };
-  const visit = (node) => {
-    if (ts.isSpreadAssignment(node) && spreadsIntoConfig(node, runner)) {
-      sel.present = true;
-      sel.opaque = true;
-    }
-    if (ts.isCallExpression(node) && /^(?:\w+\.)?mergeConfig$/.test(node.expression.getText()) && node.arguments[0] && !ts.isObjectLiteralExpression(unwrapConfigCall(node.arguments[0]))) {
-      sel.present = true;
-      sel.opaque = true;
+  const lines = src.split("\n");
+  const i = lines.findIndex((l) => /^(?:on|"on"|'on'|true):/.test(l));
+  if (i < 0) return t;
+  t.present = true;
+  const head = lines[i].replace(/^(?:on|"on"|'on'|true):\s*/, "");
+  const inline = uncommented(head);
+  if (inline) {
+    const list3 = flowList(inline);
+    for (const e of list3 ?? [inline]) t.events.add(e);
+    return t;
+  }
+  let event = null;
+  let listKey = null;
+  let listInd = -1;
+  for (let j = i + 1; j < lines.length; j++) {
+    const l = lines[j];
+    if (l.trim() === "" || /^\s*#/.test(l)) continue;
+    const ind = indentOf(l);
+    if (ind === 0) break;
+    const body = uncommented(l);
+    const item = body.match(/^\s*-\s+(.+)$/);
+    if (item && listKey && event && ind > listInd) {
+      const target = t[listKey].get(event) ?? [];
+      target.push(item[1].replace(/^(['"])(.*)\1$/, "$2"));
+      t[listKey].set(event, target);
+      continue;
     }
-    if (ts.isPropertyAssignment(node)) {
-      const k = keyName2(node.name);
-      if (runner === "jest") {
-        if (k === "testMatch") sel.include = take(k, node.initializer);
-        else if (k === "testRegex") sel.regex = take(k, node.initializer);
-        else if (k === "testPathIgnorePatterns" || k === "modulePathIgnorePatterns") ignores(k, node.initializer);
-        else if (k === "roots") sel.roots = take(k, node.initializer);
-        else if (k === "rootDir") {
-          const { dir, opaque } = dirValue(node.initializer);
-          sel.present = true;
-          if (opaque) sel.opaque = true;
-          else sel.base = dir;
-        } else if (k === "projects") {
-          projects(node.initializer);
-          return;
-        }
-      } else if (ownerKey2(node) === "test") {
-        if (k === "include") sel.include = take(k, node.initializer);
-        else if (k === "exclude") ignores(k, node.initializer);
-        else if (k === "dir" || k === "root") {
-          const { dir, opaque } = dirValue(node.initializer);
-          sel.present = true;
-          if (opaque) sel.opaque = true;
-          else sel.base = dir;
-        } else if (k === "projects") {
-          projects(node.initializer);
-          return;
-        }
-      }
+    const kv = body.match(/^\s*([\w-]+):\s*(.*)$/);
+    if (!kv) continue;
+    if (ind === 2 || event === null && ind < 4) {
+      event = kv[1];
+      t.events.add(event);
+      listKey = null;
+      continue;
     }
-    ts.forEachChild(node, visit);
-  };
-  visit(root);
-  if (projectList) sel.projects = readProjects(projectList, sel, runner);
-  if (sel.projects?.some((p) => p.opaque)) sel.opaque = true;
-  return sel;
-}
-function unwrapConfigCall(e) {
-  let x = e;
-  while (ts.isParenthesizedExpression(x) || ts.isAsExpression(x) || ts.isSatisfiesExpression(x)) {
-    x = x.expression;
+    const key2 = LIST_KEYS[kv[1]];
+    if (event && key2) {
+      listKey = key2;
+      listInd = ind;
+      const list3 = flowList(kv[2]);
+      t[listKey].set(event, list3 ?? []);
+    } else listKey = null;
   }
-  if (ts.isCallExpression(x) && /^(?:\w+\.)?define(?:Config|Project)$/.test(x.expression.getText()) && x.arguments[0]) return unwrapConfigCall(x.arguments[0]);
-  return x;
+  return t;
 }
-function spreadsIntoConfig(node, runner) {
-  const obj = node.parent;
-  if (!ts.isObjectLiteralExpression(obj)) return false;
-  const keys = obj.properties.map((p) => ts.isPropertyAssignment(p) ? keyName2(p.name) : null);
-  if (runner === "vitest") {
-    if (keys.includes("test")) return true;
-    let q = obj.parent;
-    while (q && (ts.isParenthesizedExpression(q) || ts.isAsExpression(q) || q.kind === ts.SyntaxKind.SatisfiesExpression)) q = q.parent;
-    return !!q && ts.isPropertyAssignment(q) && keyName2(q.name) === "test";
+function ghGlob(g) {
+  const re = g.split("**").map((part) => part.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")).join(".*");
+  try {
+    const r = new RegExp(`^${re}$`);
+    return (p) => r.test(p);
+  } catch {
+    return () => false;
   }
-  return keys.some((k) => k !== null && JEST_SELECTION_KEYS.test(k));
 }
-function extendsOf(el) {
-  for (const p of el.properties) {
-    if (!ts.isPropertyAssignment(p) || keyName2(p.name) !== "extends") continue;
-    if (p.initializer.kind === ts.SyntaxKind.TrueKeyword) return true;
-    if (p.initializer.kind === ts.SyntaxKind.FalseKeyword) return null;
-    return "path";
+function admits(globs4, name) {
+  let on = false;
+  for (const g of globs4) {
+    const neg = g.startsWith("!");
+    if (ghGlob(neg ? g.slice(1) : g)(name)) on = !neg;
   }
-  return null;
+  return on;
 }
-function readProject(el, root, runner) {
-  const p = collect(el, runner);
-  const ext = extendsOf(el);
-  if (ext === "path") p.opaque = true;
-  else if (ext === true && root) {
-    p.include ??= root.include;
-    p.regex ??= root.regex;
-    p.ignore ??= root.ignore;
-    p.roots ??= root.roots;
-    p.base ??= root.base;
-    if (root.opaque) p.opaque = true;
-  }
-  p.present = true;
-  return p;
+function sourceProbes(ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return CODE_PROBES;
+  const code2 = files.filter((f) => langOf(f) !== null);
+  return code2.length ? code2 : CODE_PROBES;
 }
-function readProjects(e, root, runner) {
-  if (!ts.isArrayLiteralExpression(e)) {
-    root.opaque = true;
-    return [];
+function triggerNarrowings(before, after, opts) {
+  const out3 = [];
+  if (!before.present || !after.present) return out3;
+  const isDefault = (b) => opts.defaultBranch ? b === opts.defaultBranch : DEFAULT_BRANCH.test(b);
+  const candidates = opts.defaultBranch ? [opts.defaultBranch] : ["main", "master"];
+  const namesDefault = (l) => candidates.some((b) => admits(l, b));
+  for (const e of CODE_EVENTS) {
+    if (before.events.has(e) && !after.events.has(e)) out3.push(`the ${e} trigger was removed \u2014 the workflow no longer runs on it`);
+  }
+  for (const [e, list3] of after.pathsIgnore) {
+    const had = before.pathsIgnore.get(e) ?? [];
+    if (list3.some((g) => ALL(g) && !had.includes(g))) {
+      out3.push(`on.${e}.paths-ignore now ignores every path \u2014 the workflow never runs on ${e}`);
+      continue;
+    }
+    if (!CODE_EVENTS.includes(e) || !after.events.has(e)) continue;
+    if (had.length && ignoresEverySource(had, opts.sources)) continue;
+    if (ignoresEverySource(list3, opts.sources)) out3.push(`on.${e}.paths-ignore now ignores every source file (now [${list3.join(", ")}]) \u2014 the workflow never runs on code`);
+  }
+  for (const [e, list3] of after.paths) {
+    if (!CODE_EVENTS.includes(e) || !after.events.has(e)) continue;
+    const had = before.paths.get(e);
+    if (had && !pathsMatchSource(had, opts.sources)) continue;
+    if (!pathsMatchSource(list3, opts.sources)) out3.push(`on.${e}.paths matches no source file (now [${list3.join(", ")}]) \u2014 the workflow never runs on code`);
+  }
+  for (const [e, list3] of after.types) {
+    if (!/^pull_request(?:_target)?$/.test(e) || !after.events.has(e)) continue;
+    const had = before.types.get(e);
+    if (had && !had.some((t) => PR_CODE_TYPES.test(t))) continue;
+    if (!list3.some((t) => PR_CODE_TYPES.test(t))) out3.push(`on.${e}.types no longer includes opened/synchronize (now [${list3.join(", ")}]) \u2014 the workflow does not run on the pull request's code`);
   }
-  const list3 = [];
-  for (const el of e.elements) {
-    const lit = unwrapConfigCall(el);
-    if (ts.isObjectLiteralExpression(lit)) list3.push(readProject(lit, root, runner));
-    else root.opaque = true;
+  for (const [e, list3] of after.branchesIgnore) {
+    const had = before.branchesIgnore.get(e) ?? [];
+    if (list3.some((g) => (ALL(g) || isDefault(g)) && !had.includes(g))) out3.push(`on.${e}.branches-ignore now covers the default branch`);
   }
-  return list3;
-}
-function workspaceArray(sf) {
-  for (const st of sf.statements) {
-    let e;
-    if (ts.isExportAssignment(st)) e = st.expression;
-    else if (ts.isExpressionStatement(st) && ts.isBinaryExpression(st.expression) && /module\.exports/.test(st.expression.left.getText())) e = st.expression.right;
-    if (!e) continue;
-    while (ts.isParenthesizedExpression(e) || ts.isAsExpression(e) || ts.isSatisfiesExpression(e)) {
-      e = e.expression;
+  const events = /* @__PURE__ */ new Set([...before.branches.keys(), ...CODE_EVENTS.filter((e) => before.events.has(e))]);
+  for (const e of events) {
+    const was = before.branches.get(e) ?? (before.tags.has(e) ? null : ["**"]);
+    if (!was || !after.events.has(e)) continue;
+    const now = after.branches.get(e);
+    if (!now) {
+      const tags = after.tags.get(e);
+      if (tags && namesDefault(was)) out3.push(`on.${e} now filters on tags only (tags: [${tags.join(", ")}]) \u2014 no push to the default branch runs the workflow`);
+      continue;
     }
-    if (ts.isCallExpression(e) && e.arguments.length > 0) e = e.arguments[0];
-    return ts.isArrayLiteralExpression(e) ? e : null;
+    const renamed = (b) => DEFAULT_BRANCH.test(b) && now.includes(b) && admits(now, b) && opts.hasBranch(b) !== false;
+    const lost = candidates.filter((b) => admits(was, b) && !admits(now, b));
+    const lostDefault = lost.length > 0 && !["main", "master"].some(renamed);
+    const replaced = !namesDefault(was) && !namesDefault(now) && was.length > 0 && !was.some((b) => now.includes(b));
+    if (!lostDefault && !replaced) continue;
+    const dropped = was.filter((b) => !now.includes(b) && !ALL(b));
+    out3.push(
+      dropped.length ? `on.${e}.branches no longer names ${dropped.join(", ")} (now [${now.join(", ")}])` : `on.${e}.branches now filters to [${now.join(", ")}], which does not admit the default branch`
+    );
   }
-  return null;
+  return out3;
 }
-function parseSelection(src, runner, path = "") {
-  let sel = empty();
-  if (runner === "pytest") return pytestSelection(src);
-  try {
-    const sf = parseSource("cfg.ts", asExpression2(src));
-    if (!sf) return sel;
-    if (runner === "vitest" && isWorkspaceFile(path)) {
-      const arr = workspaceArray(sf);
-      if (arr) {
-        sel.projects = readProjects(arr, sel, runner);
-        sel.present = true;
-        if (sel.projects.some((p) => p.opaque)) sel.opaque = true;
-      } else if (src.trim()) sel.opaque = true;
-    } else sel = collect(sf, runner);
-  } catch {
-  }
-  return sel;
+function localUses(line) {
+  const wf = line.match(REUSED_WORKFLOW)?.[1];
+  if (wf) return [wf];
+  const action = line.match(LOCAL_ACTION)?.[1];
+  return action ? [`${action}/action.yml`, `${action}/action.yaml`] : [];
 }
-function predicate(sel, runner) {
-  if (sel.projects) {
-    const ps = sel.projects.map((p) => predicate(p, runner));
-    return {
-      selects: (p) => ps.some((x) => x.selects(p)),
-      why: (p) => ps.length ? `no project selects it (${ps[0].why(p)})` : "the projects list is empty"
-    };
-  }
-  const includeList = sel.include ?? (runner === "jest" ? sel.regex ? null : JEST_DEFAULT_MATCH : runner === "pytest" ? PYTEST_DEFAULT_INCLUDE : VITEST_DEFAULT_INCLUDE);
-  const ignoreList = sel.ignore ?? (runner === "jest" ? JEST_DEFAULT_IGNORE : runner === "pytest" ? PYTEST_DEFAULT_IGNORE : VITEST_DEFAULT_EXCLUDE).map((pattern) => ({
-    pattern,
-    key: runner === "jest" ? "testPathIgnorePatterns" : runner === "pytest" ? "norecursedirs" : "test.exclude"
-  }));
-  const blockWide = ignoreList.filter((e) => e.pattern.startsWith("\0"));
-  const included = includeList ? globList2(includeList) : sel.regex ? regexes(sel.regex) : () => true;
-  const ignoredBy = (p) => blockWide[0] ?? ignoreList.filter((e) => !e.pattern.startsWith("\0")).find((e) => (runner === "jest" ? regexes([e.pattern]) : globs2([e.pattern]))(p));
-  const roots = sel.roots?.map((r) => r.replace(/^\.\//, "").replace(/\/+$/, "")).map((r) => r === "." ? "" : r) ?? null;
-  const rebase = (p) => sel.base === null ? p : underDir(p, sel.base) ? p.slice(sel.base.length + 1) : null;
-  const inRoots = (p) => roots === null || roots.some((r) => underDir(p, r));
-  return {
-    selects: (p) => {
-      const r = rebase(p);
-      return r !== null && inRoots(r) && included(r) && !ignoredBy(r);
-    },
-    why: (p) => {
-      const r = rebase(p);
-      const baseKey = runner === "jest" ? "rootDir" : "test.dir";
-      if (r === null) return `${baseKey} no longer covers it (${JSON.stringify(sel.base)})`;
-      if (!inRoots(r)) return `roots no longer covers it (${JSON.stringify(sel.roots)})`;
-      const hit = ignoredBy(r);
-      if (hit) {
-        if (hit.pattern.startsWith("\0")) return `${hit.key} narrows the whole run (${JSON.stringify(hit.pattern.slice(1))})`;
-        return `${hit.key === "exclude" ? "test.exclude" : hit.key} now matches it (${JSON.stringify(hit.pattern)})`;
-      }
-      const key2 = runner === "jest" ? sel.include ? "testMatch" : sel.regex ? "testRegex" : "testMatch (default)" : sel.include ? "test.include" : "test.include (default)";
-      return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? includeList ?? [])})`;
-    }
-  };
+function literalValue(raw) {
+  const v = foldExpressions(uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim());
+  return v.includes(EXPR_TOKEN) || v.includes(MATRIX_TOKEN) ? null : v;
 }
-function suiteNarrowings(before, after, path, samples) {
-  const runner = runnerOf(path, after) ?? runnerOf(path, before);
-  if (!runner) return [];
-  const b = parseSelection(before ?? "", runner, path);
-  const a = parseSelection(after, runner, path);
-  if (!a.present || a.opaque) return [];
-  const pb = predicate(b, runner);
-  const pa = predicate(a, runner);
-  const out3 = [];
-  for (const s of samples) {
-    if (pb.selects(s) && !pa.selects(s)) out3.push({ path: s, reason: pa.why(s) });
+function dirRunsNothing(dir, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return true;
+  const d = dir.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (d === "" || d === ".") return false;
+  return !files.some((f) => f.startsWith(d + "/") && (langOf(f) !== null || MANIFEST.test(f)));
+}
+function defaultsOf(lines, i) {
+  const run = ancestorOf(lines, i);
+  if (run === null || !/^\s*run:\s*$/.test(lines[run])) return null;
+  const d = ancestorOf(lines, run);
+  return d !== null && /^\s*defaults:\s*$/.test(lines[d]) ? d : null;
+}
+function enclosingStep(lines, i) {
+  let h = i;
+  while ((h = ancestorOf(lines, h)) !== null) {
+    if (!STEP_START.test(lines[h])) continue;
+    const ind = indentOf(lines[h]);
+    let e = i + 1;
+    while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > ind)) e++;
+    return [h, e];
   }
-  return out3;
+  return null;
 }
-var JEST_DEFAULT_MATCH, JEST_DEFAULT_IGNORE, VITEST_DEFAULT_INCLUDE, PYTEST_DEFAULT_INCLUDE, PYTEST_DEFAULT_IGNORE, VITEST_DEFAULT_EXCLUDE, JS_UNWALKED, CANONICAL_SAMPLES, PYTEST_CANONICAL_SAMPLES, isStr, PYTEST_INI_ORDER, pathGlobs, isWorkspaceFile, empty, stripRootDir, JEST_SELECTION_KEYS, globs2, globList2, regexes, underDir;
-var init_suite_config = __esm({
-  "src/detectors/suite-config.ts"() {
+function ancestorOf(lines, i) {
+  const ind = indentOf(lines[i]);
+  let h = i - 1;
+  while (h >= 0 && (lines[h].trim() === "" || /^\s*#/.test(lines[h]) || indentOf(lines[h]) >= ind)) h--;
+  return h >= 0 ? h : null;
+}
+var RULE8, USES, CHECK, YAML_KEY, isCompositeAction, isGithubFile, GH_RUN_KEY, GENERIC_RUN_KEY, invokesCheck2, uncommented, SHELL_ERREXIT, indentOf, STEP_START, REPORTER_ACTION, usesCheck, stepHasCheck, jobHasCheck, NEUTRALISERS, LIST_KEYS, DEFAULT_BRANCH, ALL, CODE_EVENTS, PR_CODE_TYPES, pathsMatchSource, ignoresEverySource, CODE_PROBES, REUSED_WORKFLOW, LOCAL_ACTION, MANIFEST, WORKDIR_LINE, REF_LINE, CHECKOUT, ciTampering;
+var init_ci_tampering = __esm({
+  "src/detectors/ci-tampering.ts"() {
     "use strict";
-    init_lazy_deps();
-    init_ts_lazy();
-    JEST_DEFAULT_MATCH = ["**/__tests__/**/*.[jt]s?(x)", "**/?(*.)+(spec|test).[jt]s?(x)"];
-    JEST_DEFAULT_IGNORE = ["/node_modules/"];
-    VITEST_DEFAULT_INCLUDE = ["**/*.{test,spec}.?(c|m)[jt]s?(x)"];
-    PYTEST_DEFAULT_INCLUDE = ["**/test_*.py", "**/*_test.py"];
-    PYTEST_DEFAULT_IGNORE = ["**/build/**", "**/dist/**", "**/node_modules/**", "**/venv/**", "**/.*/**"];
-    VITEST_DEFAULT_EXCLUDE = [
-      "**/node_modules/**",
-      "**/dist/**",
-      "**/cypress/**",
-      "**/.{idea,git,cache,output,temp}/**",
-      "**/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build,eslint,prettier}.config.*"
-    ];
-    JS_UNWALKED = [...VITEST_DEFAULT_EXCLUDE, "**/.*/**"];
-    CANONICAL_SAMPLES = [
-      "src/a.test.ts",
-      "src/a.spec.ts",
-      "test/a.test.ts",
-      "tests/a.test.js",
-      "src/__tests__/a.ts",
-      "a.test.tsx",
-      "a.spec.js",
-      "test/a.test.mjs"
-    ];
-    PYTEST_CANONICAL_SAMPLES = [
-      "tests/test_a.py",
-      "tests/a_test.py",
-      "test_a.py",
-      "src/tests/test_a.py",
-      "tests/conftest.py"
+    init_select();
+    init_policy();
+    init_finding();
+    init_files();
+    init_hook_wiring();
+    init_repo();
+    init_gh_expression();
+    init_invocation();
+    init_invocation();
+    RULE8 = "ci-tampering";
+    USES = /^\s*-\s*uses:/;
+    CHECK = /\b(test|tests|lint|typecheck|type-check|tsc|eslint|jest|vitest|playwright|coverage|tamperward)\b/i;
+    YAML_KEY = /^\s*-?\s*[A-Za-z_][\w-]*:\s*(?:$|\S)/;
+    isCompositeAction = (path) => /(^|\/)\.github\/actions\/.+\/action\.ya?ml$/.test(path);
+    isGithubFile = (path) => /(^|\/)\.github\//.test(path);
+    GH_RUN_KEY = /^\s*-?\s*run:/;
+    GENERIC_RUN_KEY = /^\s*-?\s*(?:run|script|command|before_script|after_script|sh|bash|pwsh|powershell):/;
+    invokesCheck2 = (line) => invokesCheck(line) || INVOKES_TOOL.test(commandCore(line));
+    uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
+    SHELL_ERREXIT = /(?:^|\s)-[a-zA-Z]*e[a-zA-Z]*(?:\s|$)|-o\s+errexit\b/;
+    indentOf = (l) => l.length - l.trimStart().length;
+    STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
+    REPORTER_ACTION = /^\s*-?\s*uses:\s*\S*?(?:[\w-]*-reporter|[\w-]*-results?[\w-]*|upload-[\w-]*|codecov[\w-]*|coveralls[\w-]*)(?:@|\s|$)/i;
+    usesCheck = (l) => USES.test(l) && CHECK.test(l) && !REPORTER_ACTION.test(l);
+    stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l));
+    jobHasCheck = (lines, range) => lines.slice(range[0], range[1]).some((l) => invokesCheck2(l) || usesCheck(l) || /^\s*uses:\s*\S/.test(l));
+    NEUTRALISERS = [
+      { re: /^\s*set\s+\+e\b/, what: "set +e \u2014 a failing check no longer fails the step" },
+      { re: /^\s*exit\s+0\s*(?:$|[;#])/, what: "exit 0 \u2014 the step ends green whatever the check did" },
+      { re: /^\s*if\s+false\s*;?\s*then\b/, what: "if false; then \u2014 the check is never run" },
+      { re: /^\s*:\s*<<\s*['"]?\w+/, what: "a heredoc fed to `:` \u2014 the check is commented out" }
     ];
-    isStr = (e) => ts.isStringLiteral(e) || ts.isNoSubstitutionTemplateLiteral(e);
-    PYTEST_INI_ORDER = ["pytest.ini", ".pytest.ini", "pyproject.toml", "tox.ini", "setup.cfg"];
-    pathGlobs = (p) => {
-      const clean = p.replace(/^\.\//, "").replace(/::.*$/, "").replace(/\/+$/, "");
-      return clean ? [clean, clean + "/**"] : [];
-    };
-    isWorkspaceFile = (path) => /^vitest\.workspace\./.test(path.split("/").pop() ?? path);
-    empty = () => ({ include: null, regex: null, ignore: null, roots: null, base: null, projects: null, opaque: false, present: false });
-    stripRootDir = (g) => g.replace(/^<rootDir>\/?/, "");
-    JEST_SELECTION_KEYS = /^(?:testMatch|testRegex|testPathIgnorePatterns|modulePathIgnorePatterns|roots|rootDir|projects)$/;
-    globs2 = (patterns) => {
-      const ms = patterns.map((g) => {
-        try {
-          return picomatch(g, { dot: true });
-        } catch {
-          return () => false;
-        }
-      });
-      return (path) => ms.some((m) => m(path));
-    };
-    globList2 = (patterns) => {
-      const pos = globs2(patterns.filter((g) => !g.startsWith("!")));
-      const neg = globs2(patterns.filter((g) => g.startsWith("!")).map((g) => g.slice(1)));
-      return (path) => pos(path) && !neg(path);
+    LIST_KEYS = {
+      branches: "branches",
+      "branches-ignore": "branchesIgnore",
+      "paths-ignore": "pathsIgnore",
+      paths: "paths",
+      types: "types",
+      tags: "tags"
     };
-    regexes = (patterns) => {
-      const rs = patterns.flatMap((p) => {
-        try {
-          return [new RegExp(p.replace(/<rootDir>/g, ""))];
-        } catch {
-          return [];
+    DEFAULT_BRANCH = /^(?:main|master)$/;
+    ALL = (g) => /^\*\*?$|^\*\*\/\*$/.test(g);
+    CODE_EVENTS = ["push", "pull_request", "pull_request_target"];
+    PR_CODE_TYPES = /^(?:opened|synchronize|reopened)$/;
+    pathsMatchSource = (globs4, sources) => sources.some((s) => admits(globs4, s));
+    ignoresEverySource = (globs4, sources) => sources.length > 0 && sources.every((s) => admits(globs4, s));
+    CODE_PROBES = ["src/index.ts", "src/index.js", "lib/index.js", "index.ts", "main.go", "src/main.py", "src/lib.rs", "packages/a/src/index.ts", "test/a.test.ts"];
+    REUSED_WORKFLOW = /^\s*-?\s*uses:\s*\.\/(\.github\/workflows\/[^\s@]+)/;
+    LOCAL_ACTION = /^\s*-?\s*uses:\s*\.\/(\.github\/actions\/[^\s@]+?)\/?\s*(?:#.*)?$/;
+    MANIFEST = /(?:^|\/)(?:package\.json|pyproject\.toml|setup\.py|setup\.cfg|Cargo\.toml|go\.mod|Makefile|build\.gradle(?:\.kts)?|pom\.xml|Gemfile|deno\.jsonc?)$/;
+    WORKDIR_LINE = /^\s*-?\s*working-directory:\s*(.+?)\s*$/;
+    REF_LINE = /^\s*ref:\s*(.+?)\s*$/;
+    CHECKOUT = /^\s*-?\s*uses:\s*actions\/checkout(?:@|\s|$)/;
+    ciTampering = {
+      id: RULE8,
+      surface: ["file"],
+      certainty: "mechanical",
+      run(changes, policy, _view, ctx) {
+        const out3 = [];
+        const afterByPath = /* @__PURE__ */ new Map();
+        for (const c of changes) if (c.kind === "file" && c.after != null) afterByPath.set(c.path, c.after);
+        let triggerOpts = null;
+        for (const c of changes) {
+          if (c.kind !== "file") continue;
+          if (c.op === "rename" && c.oldPath && isActiveWorkflow(c.oldPath) && !isActiveWorkflow(c.path)) {
+            out3.push(
+              makeFinding(RULE8, policy, {
+                file: c.path,
+                message: `A CI workflow was renamed so it no longer runs (${c.oldPath} \u2192 ${c.path}).`,
+                evidence: `${c.oldPath} \u2192 ${c.path}`,
+                remediation: "Restore the path and extension. GitHub runs only *.yml/*.yaml directly under .github/workflows \u2014 renaming outside that disables the checks as surely as deleting them."
+              })
+            );
+            continue;
+          }
+          if (!isProtected(c.path, policy, "ci")) continue;
+          const afterLines = c.after != null ? c.after.split("\n") : null;
+          const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
+          const github = isGithubFile(c.path);
+          for (const l of github ? addedLines(c) : []) {
+            const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
+            const cond = l.content.match(/^\s*-?\s*if:\s*(.+?)\s*$/);
+            if (!coe && !cond) continue;
+            const step = afterLines && l.newLine != null ? stepOf(afterLines, l.newLine - 1) : null;
+            if (afterLines && step && !stepHasCheck(afterLines, step)) continue;
+            if (afterLines && !step && l.newLine != null) {
+              const job = jobOf(afterLines, l.newLine - 1);
+              if (job && !jobHasCheck(afterLines, job)) continue;
+            }
+            if (coe && isTruthy(coe[1])) {
+              out3.push(
+                makeFinding(RULE8, policy, {
+                  file: c.path,
+                  line: l.newLine ?? void 0,
+                  message: "continue-on-error: true added \u2014 failures will no longer fail the job.",
+                  evidence: l.content.trim(),
+                  remediation: "Remove it. A check that cannot fail is not a check."
+                })
+              );
+            } else if (cond && isAlwaysFalse(cond[1])) {
+              out3.push(
+                makeFinding(RULE8, policy, {
+                  file: c.path,
+                  line: l.newLine ?? void 0,
+                  message: `if: ${uncommented(cond[1])} added \u2014 this step can never run.`,
+                  evidence: l.content.trim(),
+                  remediation: "Re-enable the step instead of conditioning it off."
+                })
+              );
+            }
+          }
+          if (afterLines && github) {
+            for (const b of runBlocks(afterLines)) {
+              if (!b.body.some(invokesCheck2)) continue;
+              const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
+              for (let k = 0; k < b.body.length; k++) {
+                const idx = b.start + 1 + k;
+                if (!addedAt.has(idx + 1)) continue;
+                const n = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
+                if (!n || propagates && /set\s\+e/.test(b.body[k])) continue;
+                out3.push(
+                  makeFinding(RULE8, policy, {
+                    file: c.path,
+                    line: idx + 1,
+                    message: `A check's run block was neutralised: ${n.what}.`,
+                    evidence: b.body[k].trim(),
+                    remediation: "Let the check decide the step. Masking its exit status is the same tamper as removing it."
+                  })
+                );
+              }
+            }
+            for (const l of addedLines(c)) {
+              if (!/^\s*-?\s*shell:\s*.*\{0\}/.test(l.content) || l.newLine == null) continue;
+              if (SHELL_ERREXIT.test(uncommented(l.content.replace(/^\s*-?\s*shell:\s*/, "")))) continue;
+              const step = stepOf(afterLines, l.newLine - 1);
+              if (step && !stepHasCheck(afterLines, step)) continue;
+              out3.push(
+                makeFinding(RULE8, policy, {
+                  file: c.path,
+                  line: l.newLine,
+                  message: "shell: \u2026 {0} added on a check step \u2014 the shell no longer stops on the first failure.",
+                  evidence: l.content.trim(),
+                  remediation: "Keep the default shell (fail-fast) on steps that run checks."
+                })
+              );
+            }
+            for (const l of addedLines(c)) {
+              if (l.newLine == null) continue;
+              const i = l.newLine - 1;
+              const wd = l.content.match(WORKDIR_LINE);
+              if (wd) {
+                const dir = literalValue(wd[1]);
+                if (dir === null || !dirRunsNothing(dir, ctx)) continue;
+                const step2 = stepOf(afterLines, i);
+                if (step2) {
+                  if (!stepHasCheck(afterLines, step2)) continue;
+                } else {
+                  const d = defaultsOf(afterLines, i);
+                  if (d === null) continue;
+                  const job = jobOf(afterLines, d);
+                  if (job ? !jobHasCheck(afterLines, job) : !afterLines.some((x) => invokesCheck2(x) || usesCheck(x))) continue;
+                }
+                out3.push(
+                  makeFinding(RULE8, policy, {
+                    file: c.path,
+                    line: l.newLine,
+                    message: `A check was pointed at ${dir} by working-directory \u2014 a directory holding no code or package the check could run.`,
+                    evidence: l.content.trim(),
+                    remediation: "Run the check where the code is. A suite pointed at an empty directory passes on nothing."
+                  })
+                );
+                continue;
+              }
+              const ref = l.content.match(REF_LINE);
+              if (!ref) continue;
+              const step = enclosingStep(afterLines, i);
+              if (!step || !afterLines.slice(step[0], step[1]).some((x) => CHECKOUT.test(x))) continue;
+              const target = literalValue(ref[1]);
+              if (target === null) continue;
+              out3.push(
+                makeFinding(RULE8, policy, {
+                  file: c.path,
+                  line: l.newLine,
+                  message: `actions/checkout was pinned to ref: ${target} \u2014 the checks run against that ref, not against the change under review.`,
+                  evidence: l.content.trim(),
+                  remediation: "Let checkout take the event's ref (its default). A suite that checks out main proves nothing about the pull request."
+                })
+              );
+            }
+            if (c.before != null && c.after != null && !isCompositeAction(c.path)) {
+              triggerOpts ??= { defaultBranch: defaultBranch(ctx), sources: sourceProbes(ctx), hasBranch: (b) => branchExists(b, ctx) };
+              for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after), triggerOpts)) {
+                out3.push(
+                  makeFinding(RULE8, policy, {
+                    file: c.path,
+                    message: `The workflow's triggers were narrowed: ${reason}.`,
+                    evidence: reason,
+                    remediation: "Keep the workflow running on push and pull_request for the default branch and its source paths; a check that never runs is no check."
+                  })
+                );
+              }
+            }
+          }
+          const afterCommands = afterLines ? commandLines(afterLines) : null;
+          const afterCores = (afterCommands ?? addedLines(c).map((l) => l.content)).map(commandCore);
+          const addedCores = addedLines(c).map((l) => commandCore(afterCommands && l.newLine != null ? afterCommands[l.newLine - 1] : l.content));
+          for (const l of afterLines ?? []) {
+            for (const reused of localUses(l)) {
+              const content = afterByPath.get(reused);
+              if (content == null || reused === c.path) continue;
+              const cores = commandLines(content.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
+          }
+          if (!github && c.after == null) {
+            for (const o of changes) {
+              if (o.kind !== "file" || o.op !== "add" || o.after == null || !isProtected(o.path, policy, "ci")) continue;
+              const cores = commandLines(o.after.split("\n")).map(commandCore);
+              afterCores.push(...cores);
+              addedCores.push(...cores);
+            }
+          }
+          const runKey = github ? GH_RUN_KEY : GENERIC_RUN_KEY;
+          for (const l of removedLines(c)) {
+            if (/^\s*#/.test(l.content)) continue;
+            const isUsesLine = usesCheck(l.content);
+            const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? runKey.test(l.content) : true) && invokesCheck2(l.content);
+            if (!isUsesLine && !isCheckCommand) continue;
+            const s = survives(commandCore(l.content), isUsesLine, afterCores, addedCores);
+            if (s.state === "kept") continue;
+            if (s.state === "neutralised") {
+              out3.push(
+                makeFinding(RULE8, policy, {
+                  file: c.path,
+                  message: "A CI check command was neutralised in place: it still runs, but its result no longer decides (or its suite was narrowed).",
+                  evidence: `${l.content.trim()} \u2192 ${s.by}`,
+                  remediation: "Let the check decide the step; do not mask its status, cut it short, or narrow what it runs."
+                })
+              );
+              continue;
+            }
+            out3.push(
+              makeFinding(RULE8, policy, {
+                file: c.path,
+                message: isUsesLine ? "A CI check step (test/lint/typecheck) was removed." : "A CI check command was removed from a run block.",
+                evidence: l.content.trim(),
+                remediation: "Restore the step. Removing the check that protects main is itself the tamper."
+              })
+            );
+          }
         }
-      });
-      return (path) => rs.some((r) => r.test("/" + path));
+        return out3;
+      }
     };
-    underDir = (path, dir) => dir === "" || path.startsWith(dir + "/");
   }
 });
 
@@ -7191,7 +7766,7 @@ function safeParse(src) {
     return null;
   }
 }
-function effective(raw) {
+function effective2(raw) {
   const v = raw.version;
   const version = typeof v === "number" && Number.isInteger(v) && v >= 1 ? v : 1;
   const base = defaultPolicy(version);
@@ -7256,8 +7831,8 @@ function policyWeakening(before, after, probe) {
   if (b === null) return null;
   const a = safeParse(after);
   if (a === null) return ["the policy no longer parses as a valid policy (emptied or corrupted)"];
-  const be = effective(b);
-  const ae = effective(a);
+  const be = effective2(b);
+  const ae = effective2(a);
   const reasons = [];
   if (ae.version < be.version) {
     reasons.push(
@@ -7520,7 +8095,7 @@ function entryShape(h) {
   }
   return { problems, runs };
 }
-function judgeGateEntry(event, matcher, h) {
+function judgeGateEntry(event, matcher2, h) {
   const cmd = typeof h.command === "string" ? h.command : "";
   const a = analyseGateCommand(cmd, event);
   const shape = entryShape(h);
@@ -7528,13 +8103,13 @@ function judgeGateEntry(event, matcher, h) {
   let runs = a.runs && shape.runs;
   let tools = null;
   if (event === "PreToolUse") {
-    const sel = matcherSelection(matcher);
+    const sel = matcherSelection(matcher2);
     tools = sel.tools;
     if (sel.problem) {
       problems.push(sel.problem);
     }
-  } else if (matcher !== void 0 && !(typeof matcher === "string" && (matcher === "" || matcher === "*"))) {
-    problems.push(`a \`matcher\` (${JSON.stringify(matcher)}) on the Stop entry`);
+  } else if (matcher2 !== void 0 && !(typeof matcher2 === "string" && (matcher2 === "" || matcher2 === "*"))) {
+    problems.push(`a \`matcher\` (${JSON.stringify(matcher2)}) on the Stop entry`);
     runs = false;
   }
   return { runs, problems, pin: a.pin, tools };
@@ -7741,7 +8316,7 @@ function claudeSettingsFindings(c, policy) {
   if (c.after == null) return null;
   const after = parseSettings(c.after);
   const before = c.before != null ? parseSettings(c.before) : null;
-  const finding = (reason) => makeFinding(RULE8, policy, {
+  const finding = (reason) => makeFinding(RULE9, policy, {
     file: c.path,
     message: `The Claude Code hook wiring was weakened: ${reason}.`,
     evidence: reason,
@@ -7766,7 +8341,7 @@ function policyFindings(c, policy, ctx) {
   const reasons = c.before == null ? policyAddWeakening(c.after, probe) : policyWeakening(c.before, c.after, probe);
   if (reasons === null) return null;
   return reasons.map(
-    (reason) => makeFinding(RULE8, policy, {
+    (reason) => makeFinding(RULE9, policy, {
       file: c.path,
       message: added ? `A policy file was added that weakens the baseline: ${reason}.` : `The policy was weakened: ${reason}.`,
       evidence: reason,
@@ -7876,7 +8451,7 @@ function configFindings(c, changes, policy, ctx) {
     reasons = after === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : isLefthook(c.path) ? lefthookWeakening(before, after) : preCommitWeakening(before, after);
   }
   return reasons.map(
-    (reason) => makeFinding(RULE8, policy, {
+    (reason) => makeFinding(RULE9, policy, {
       file: c.path,
       message: `The hook configuration was weakened: ${reason}.`,
       evidence: reason,
@@ -7927,7 +8502,7 @@ function huskyRuntimeWrite(path, content, ctx) {
     (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
   );
 }
-var RULE8, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
+var RULE9, ownerExec2, EVENTS, isObj, declares, GATE_KEYS, HOOK_TYPES, SIBLING_KEYS, MENTIONS_GATE, FORGERY, ENV_MECHANISM, envMechanism, mentionsGate, carriesGate, CANONICAL_GATE, COMMIT_STAGES, namesGate, liveOrCanonical, HUSKY_SHIM, HUSKY_SHIM_NAMES, HUSKY_H_KNOWN, HUSKY_DEPRECATION, stripTrailingNl, isHuskyScript, isHookNote, hookTampering;
 var init_hook_tampering = __esm({
   "src/detectors/hook-tampering.ts"() {
     "use strict";
@@ -7940,7 +8515,7 @@ var init_hook_tampering = __esm({
     init_command();
     init_repo();
     init_hook_wiring();
-    RULE8 = "hook-tampering";
+    RULE9 = "hook-tampering";
     ownerExec2 = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
     EVENTS = ["PreToolUse", "Stop"];
     isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
@@ -8008,7 +8583,7 @@ They WILL FAIL in v10.0.0
     isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
     isHookNote = (path) => !/(?:^|\/)\.husky\/_\//.test(path) && /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
     hookTampering = {
-      id: RULE8,
+      id: RULE9,
       surface: ["file", "command"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
@@ -8021,7 +8596,7 @@ They WILL FAIL in v10.0.0
               if (isPackageJson(c.path) && c.before != null && c.after != null) {
                 for (const reason of packageJsonWeakening(c.before, c.after)) {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `The hook installation was weakened: ${reason}.`,
                       evidence: reason,
@@ -8034,7 +8609,7 @@ They WILL FAIL in v10.0.0
             }
             if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec2(c.oldMode) && !ownerExec2(c.newMode)) {
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: `Execute permission was removed from a protected hook (${c.oldMode} \u2192 ${c.newMode}) \u2014 git will skip it.`,
                   evidence: `${c.path}: mode ${c.oldMode} \u2192 ${c.newMode}`,
@@ -8044,7 +8619,7 @@ They WILL FAIL in v10.0.0
             }
             if (c.op === "delete") {
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: "A protected hook/policy file was deleted.",
                   evidence: c.path,
@@ -8053,7 +8628,7 @@ They WILL FAIL in v10.0.0
               );
             } else if (c.op === "rename" && !renameKept(c)) {
               out3.push(
-                makeFinding(RULE8, policy, {
+                makeFinding(RULE9, policy, {
                   file: c.path,
                   message: `A protected hook/policy file was renamed (${c.oldPath} \u2192 ${c.path}).`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -8067,7 +8642,7 @@ They WILL FAIL in v10.0.0
               if (c.before != null && c.after != null) {
                 for (const reason of codeownersWeakening(c.before, c.after, [...repoGateFiles(ctx), c.path])) {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `CODEOWNERS was weakened: ${reason}.`,
                       evidence: reason,
@@ -8089,7 +8664,7 @@ They WILL FAIL in v10.0.0
                 const kept = afterPin !== null && (beforePin === "" ? afterPin === "" || PLAIN_SEMVER.test(afterPin) : pinNotBelow(afterPin, beforePin));
                 if (!kept) {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       message: "A protected hook script no longer matches the shape `tamperward init` writes.",
                       evidence: "the gate script no longer matches the shape init wrote; re-run init or sign off",
@@ -8112,7 +8687,7 @@ They WILL FAIL in v10.0.0
                 if (shebang || !live) {
                   const why = shebang ?? (gate.length ? `its \`${gate[0].identity}\` is ${gate[0].state}${gate[0].why ? ` (${gate[0].why})` : ""}` : "it runs no `tamperward check`");
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
                       evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
@@ -8121,7 +8696,7 @@ They WILL FAIL in v10.0.0
                   );
                 } else if (earlyExit) {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       line: earlyExit.newLine ?? void 0,
                       message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
@@ -8143,7 +8718,7 @@ They WILL FAIL in v10.0.0
                     deadGuard2 ? `a guard that can never be true was inserted (\`${deadGuard2.content.trim()}\`)` : null
                   ].filter((d) => d !== null);
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
                       evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
@@ -8155,7 +8730,7 @@ They WILL FAIL in v10.0.0
               }
               if (shebangChanged && c.after != null) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     line: 1,
                     message: `A protected hook's interpreter was changed: ${shebang}.`,
@@ -8166,7 +8741,7 @@ They WILL FAIL in v10.0.0
               }
               if (earlyExit) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     line: earlyExit.newLine ?? void 0,
                     message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
@@ -8178,7 +8753,7 @@ They WILL FAIL in v10.0.0
               const deadGuard = c.before == null || c.after == null ? added.find((l) => insertsDeadGuard(l.content)) : void 0;
               if (deadGuard) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     line: deadGuard.newLine ?? void 0,
                     message: "A guard that can never be true was inserted into a protected hook \u2014 what it wraps no longer runs.",
@@ -8190,7 +8765,7 @@ They WILL FAIL in v10.0.0
               const lost = scriptWeakening(beforeLines, afterLines, opts);
               if (lost.length) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: c.path,
                     message: `A check invocation was removed from a protected hook: ${lost[0].reason}.`,
                     evidence: lost[0].evidence,
@@ -8209,7 +8784,7 @@ They WILL FAIL in v10.0.0
                 const m = l.content.match(INLINE);
                 if (m && m[2] === "warn" && removedSeverity.get(m[1]) === "block") {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       line: l.newLine ?? void 0,
                       message: `Rule "${m[1]}" was lowered from block to warn in the policy.`,
@@ -8219,7 +8794,7 @@ They WILL FAIL in v10.0.0
                   );
                 } else if (/enabled:\s*false\b/.test(l.content)) {
                   out3.push(
-                    makeFinding(RULE8, policy, {
+                    makeFinding(RULE9, policy, {
                       file: c.path,
                       line: l.newLine ?? void 0,
                       message: "A rule was disabled (enabled: false) in the policy.",
@@ -8237,7 +8812,7 @@ They WILL FAIL in v10.0.0
               const hiding = updateIndexHiding(toks, policy);
               if (hiding) {
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     file: repoRelative(hiding.file, ctx),
                     message: `Hook tampering via shell: ${hiding.reason}.`,
                     evidence: seg,
@@ -8253,7 +8828,7 @@ They WILL FAIL in v10.0.0
                 const file = target ? repoRelative(target, ctx) : void 0;
                 const outside = file !== void 0 && (isAbsolute6(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
                 out3.push(
-                  makeFinding(RULE8, policy, {
+                  makeFinding(RULE9, policy, {
                     ...file !== void 0 ? { file } : {},
                     message: `Hook tampering via shell: ${why}${outside}.`,
                     evidence: seg,
@@ -8801,7 +9376,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
   if (!was || !now || was.path === now.path) return [];
   const samples = runnerSamples(now.path, policy, ctx, "pytest");
   return suiteNarrowings(was.content, now.content, now.path, samples).map(
-    (n) => makeFinding(RULE9, policy, {
+    (n) => makeFinding(RULE10, policy, {
       file: now.path,
       message: `The effective pytest config moved from ${was.path} to ${now.path}, and ${n.path} is no longer selected: ${n.reason}.`,
       evidence: `inifile precedence ${was.path} \u2192 ${now.path} drops ${n.path} from the suite`,
@@ -8809,7 +9384,7 @@ function pytestPrecedenceFindings(changes, policy, ctx) {
     })
   );
 }
-var RULE9, JVM_TEST, TEST_DEFS, isTableOf, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
+var RULE10, JVM_TEST, TEST_DEFS, isTableOf, isEachOf, isDescribeEach, OTHER_RUNNER_DIR, WHOLE_SUITE_SCRIPT, SLICE_SCRIPT, SED_INPLACE, testDeletion;
 var init_test_deletion = __esm({
   "src/detectors/test-deletion.ts"() {
     "use strict";
@@ -8826,7 +9401,7 @@ var init_test_deletion = __esm({
     init_narrow();
     init_reachability();
     init_runner_chain();
-    RULE9 = "test-deletion";
+    RULE10 = "test-deletion";
     JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
     TEST_DEFS = {
       py: /^\s*(?:async\s+)?def\s+test\w*\s*\(/,
@@ -8849,7 +9424,7 @@ var init_test_deletion = __esm({
     SLICE_SCRIPT = /^test:(?:unit|integration)$/;
     SED_INPLACE = /(?:^|\s)(?:-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b)/;
     testDeletion = {
-      id: RULE9,
+      id: RULE10,
       surface: ["file", "command"],
       certainty: "mechanical",
       run(changes, policy, _view, ctx) {
@@ -8881,7 +9456,7 @@ var init_test_deletion = __esm({
             if (c.op === "delete" && isTest) {
               if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
               out3.push(
-                makeFinding(RULE9, policy, {
+                makeFinding(RULE10, policy, {
                   file: c.path,
                   message: "A test file was deleted.",
                   evidence: c.path,
@@ -8890,7 +9465,7 @@ var init_test_deletion = __esm({
               );
             } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && isSpecShaped(c.oldPath, c.before, c.after) && !isSpec(c.path)) {
               out3.push(
-                makeFinding(RULE9, policy, {
+                makeFinding(RULE10, policy, {
                   file: c.path,
                   message: `A test file was renamed out of the test glob (${c.oldPath} \u2192 ${c.path}).`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -8899,7 +9474,7 @@ var init_test_deletion = __esm({
               );
             } else if (c.op === "rename" && c.oldPath && isSpec(c.oldPath) && isTest && leavesWalk(c.oldPath, c.path)) {
               out3.push(
-                makeFinding(RULE9, policy, {
+                makeFinding(RULE10, policy, {
                   file: c.path,
                   message: `A test file was renamed into a path the runner does not walk (${c.oldPath} \u2192 ${c.path}): ${leavesWalk(c.oldPath, c.path)}.`,
                   evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -8914,7 +9489,7 @@ var init_test_deletion = __esm({
                 const removed = new Set([...significantLines(c.before, c.path)].filter((l) => !afterLines.has(l)));
                 if (isRelocation(removed, before.min - after.min)) continue;
                 out3.push(
-                  makeFinding(RULE9, policy, {
+                  makeFinding(RULE10, policy, {
                     file: c.path,
                     message: `Test blocks removed: ${before.min} \u2192 ${after.min} it()/test() in this spec (each-table rows count as tests).`,
                     evidence: `${before.min - after.min} test block(s) removed from ${c.path}`,
@@ -8925,9 +9500,22 @@ var init_test_deletion = __esm({
             } else if (c.op !== "delete" && c.after != null && !isSpec(c.path) && isProtected(c.path, policy, "config") && runnerOf(c.path, c.after)) {
               const rn = runnerOf(c.path, c.after);
               const readable = rn !== "pytest" || effectivePytestConfig(c.path, ctx);
+              for (const d of suiteDelegations(c.before, c.after, c.path)) {
+                const cands = targetCandidates(c.path, d.target);
+                const added = cands.find((f) => addedPaths.has(f));
+                if (added === void 0 && cands.some((f) => isProtected(f, policy, "config"))) continue;
+                out3.push(
+                  makeFinding(RULE10, policy, {
+                    file: c.path,
+                    message: `The runner config now delegates its selection to ${d.target}, ${added !== void 0 ? `a file this change adds (${added})` : "a file no protected glob covers"}: ${d.how}.`,
+                    evidence: `${c.path}: ${d.how}`,
+                    remediation: "Keep the selection in the protected config, or protect the file it delegates to (protected.config in .tamperward.yml). A config the gate cannot read can select nothing."
+                  })
+                );
+              }
               for (const n of readable ? suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx, rn)) : []) {
                 out3.push(
-                  makeFinding(RULE9, policy, {
+                  makeFinding(RULE10, policy, {
                     file: c.path,
                     message: `The runner no longer selects ${n.path}: ${n.reason}.`,
                     evidence: `${n.path} dropped from the suite by ${c.path}`,
@@ -8939,12 +9527,12 @@ var init_test_deletion = __esm({
                 const w = n.weakening;
                 const evidence = `"${n.script}": ${JSON.stringify(n.before)} \u2192 ${n.after === "" ? "deleted" : JSON.stringify(n.after)}`;
                 out3.push(
-                  w.state === "removed" ? makeFinding(RULE9, policy, {
+                  w.state === "removed" ? makeFinding(RULE10, policy, {
                     file: c.path,
                     message: `The test script no longer runs the ${w.kind} check: scripts.${n.script} ${w.what}.`,
                     evidence,
                     remediation: "Keep the script running its check. Replacing the runner in package.json removes every test from every `npm test` while the workflow line stays untouched."
-                  }) : makeFinding(RULE9, policy, {
+                  }) : makeFinding(RULE10, policy, {
                     file: c.path,
                     message: `The test script now narrows the suite: ${w.what} ${w.direction} ${w.direction === "added" ? "to" : "from"} scripts.${n.script}.`,
                     evidence,
@@ -9079,7 +9667,7 @@ var init_test_deletion = __esm({
               }
               if (why) {
                 out3.push(
-                  makeFinding(RULE9, policy, {
+                  makeFinding(RULE10, policy, {
                     message: `Test removed via shell: ${why}.`,
                     evidence,
                     remediation: "Fix the code under test. Mutating a spec from the shell is still deleting the test \u2014 and is blocked the same way."
@@ -9138,7 +9726,7 @@ function significantLinesOrdered(src, path) {
 function liveSignificantLines(src, path) {
   return significantLinesOrdered(partition(src, path).live, path);
 }
-var RULE10, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, KeptPool, testContentRemoval;
+var RULE11, MIN_REMOVED_LINES, MIN_REMOVED_ROWS, ws, TEST_DIR_FILE, KeptPool, testContentRemoval;
 var init_test_content_removal = __esm({
   "src/detectors/test-content-removal.ts"() {
     "use strict";
@@ -9149,7 +9737,7 @@ var init_test_content_removal = __esm({
     init_files();
     init_spec_shape();
     init_reachability();
-    RULE10 = "test-content-removal";
+    RULE11 = "test-content-removal";
     MIN_REMOVED_LINES = 3;
     MIN_REMOVED_ROWS = 2;
     ws = (s) => s.replace(/\s+/g, "");
@@ -9190,7 +9778,7 @@ var init_test_content_removal = __esm({
       }
     };
     testContentRemoval = {
-      id: RULE10,
+      id: RULE11,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy) {
@@ -9234,7 +9822,7 @@ var init_test_content_removal = __esm({
           const goneRows = table.rows.size && tableAfter.open ? [...table.rows].filter(([k]) => !tableAfter.rows.has(k) && !addedPool.includes(k)).map(([, text]) => text) : [];
           if (goneRows.length >= MIN_REMOVED_ROWS) {
             out3.push(
-              makeFinding(RULE10, policy, {
+              makeFinding(RULE11, policy, {
                 file: c.path,
                 message: `Rows removed from a test table: ${goneRows.length} case(s) gone from an each-table that spreads from elsewhere, and they reappear nowhere in the change.`,
                 evidence: goneRows.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -9245,7 +9833,7 @@ var init_test_content_removal = __esm({
           }
           if (hidden.length >= MIN_REMOVED_LINES) {
             out3.push(
-              makeFinding(RULE10, policy, {
+              makeFinding(RULE11, policy, {
                 file: c.path,
                 message: `Test content made unreachable in a surviving spec: ${hidden.length} significant line(s) kept only where they cannot run (a string, a template literal, a dead branch, after a return).`,
                 evidence: hidden.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -9256,7 +9844,7 @@ var init_test_content_removal = __esm({
           }
           if (gone.length >= MIN_REMOVED_LINES && netDrop >= MIN_REMOVED_LINES) {
             out3.push(
-              makeFinding(RULE10, policy, {
+              makeFinding(RULE11, policy, {
                 file: c.path,
                 message: `Test content removed from a surviving spec: ${gone.length} significant line(s) gone with no test block deleted.`,
                 evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -9279,14 +9867,14 @@ function namesProtectedSnapshot(seg, policy) {
   }
   return null;
 }
-var RULE11, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
+var RULE12, RUNNER3, PM_TEST_SCRIPT, UPDATE_ANY, UPDATE_WITH_RUNNER, INSTA_ACCEPT, UPDATE_EXPECT, REGEN_SCRIPT, MUTATE, snapshotRewrite;
 var init_snapshot_rewrite = __esm({
   "src/detectors/snapshot-rewrite.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_command();
-    RULE11 = "snapshot-rewrite";
+    RULE12 = "snapshot-rewrite";
     RUNNER3 = /\b(?:jest|vitest|playwright|ava)\b/;
     PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
     UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
@@ -9296,12 +9884,12 @@ var init_snapshot_rewrite = __esm({
     REGEN_SCRIPT = /\b(?:update|regen(?:erate)?|re?bless)[-_.]?(?:golden|snapshots?|baselines?|expected)\b/i;
     MUTATE = /(?:^|\s)(?:rm|cp|mv|tee|truncate|dd)(?:\s|$)|sed\s+-i|>{1,2}|\bfind\b.*\s-(?:delete\b|exec\s+rm\b)|\bgit\s+(?:checkout|restore)\b/;
     snapshotRewrite = {
-      id: RULE11,
+      id: RULE12,
       surface: ["command", "file"],
       certainty: "mechanical",
       run(changes, policy) {
         const out3 = [];
-        const warn = (input) => out3.push(makeFinding(RULE11, policy, { ...input, defaultSeverity: "warn" }));
+        const warn = (input) => out3.push(makeFinding(RULE12, policy, { ...input, defaultSeverity: "warn" }));
         for (const c of changes) {
           if (c.kind === "command") {
             for (const seg of segments(c.raw)) {
@@ -9349,16 +9937,16 @@ function isSnapshotChange(c, policy) {
   if (isProtected(c.path, policy, "snapshots")) return true;
   return c.oldPath != null && isProtected(c.oldPath, policy, "snapshots");
 }
-var RULE12, COMMIT_VIEWS, snapshotOnlyRewrite;
+var RULE13, COMMIT_VIEWS, snapshotOnlyRewrite;
 var init_snapshot_only = __esm({
   "src/detectors/snapshot-only.ts"() {
     "use strict";
     init_policy();
     init_finding();
-    RULE12 = "snapshot-only-rewrite";
+    RULE13 = "snapshot-only-rewrite";
     COMMIT_VIEWS = ["staged", "range"];
     snapshotOnlyRewrite = {
-      id: RULE12,
+      id: RULE13,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy, view) {
@@ -9371,7 +9959,7 @@ var init_snapshot_only = __esm({
         if (!first) return [];
         const names = snaps.map((c) => c.path).slice(0, 3).join(", ");
         return [
-          makeFinding(RULE12, policy, {
+          makeFinding(RULE13, policy, {
             file: first.path,
             message: `Only recorded expectations changed in this diff (${snaps.length} snapshot file${snaps.length === 1 ? "" : "s"}, no code change to explain them).`,
             evidence: names + (snaps.length > 3 ? ", \u2026" : ""),
@@ -9428,7 +10016,7 @@ function staticFacts(node) {
 }
 function expectAssertion(node, sf) {
   if (!ts.isPropertyAccessExpression(node.expression)) return null;
-  const matcher = node.expression.name.text;
+  const matcher2 = node.expression.name.text;
   let receiver = node.expression.expression;
   let polarity = "";
   if (ts.isPropertyAccessExpression(receiver) && receiver.name.text === "not") {
@@ -9443,10 +10031,10 @@ function expectAssertion(node, sf) {
   return {
     subject,
     polarity,
-    matcher,
+    matcher: matcher2,
     args,
     firstArgFacts: staticFacts(node.arguments[0]),
-    canonical: [subject, polarity, matcher, ...args].join("|"),
+    canonical: [subject, polarity, matcher2, ...args].join("|"),
     text: node.getText(sf).replace(/\s+/g, " ")
   };
 }
@@ -9549,7 +10137,7 @@ function findingForBlock(path, before, after, policy) {
   const weakened2 = directionalWeakening(before.assertions, after.assertions);
   if (weakened2) {
     const message = weakened2.kind === "throw-specificity" ? `Assertion weakened in test "${before.identity}": exception-message specificity was removed from toThrow().` : `Assertion weakened in test "${before.identity}": ${weakened2.before.matcher} was replaced by weaker ${weakened2.after.matcher} on the same subject.`;
-    return makeFinding(RULE13, policy, {
+    return makeFinding(RULE14, policy, {
       file: path,
       message,
       evidence: `${weakened2.before.text} -> ${weakened2.after.text}`,
@@ -9558,7 +10146,7 @@ function findingForBlock(path, before, after, policy) {
   }
   const removed = pureRemoval(before.assertions, after.assertions);
   if (removed) {
-    return makeFinding(RULE13, policy, {
+    return makeFinding(RULE14, policy, {
       file: path,
       message: `Assertion removed from kept test "${before.identity}" without a replacement assertion.`,
       evidence: removed.text,
@@ -9567,7 +10155,7 @@ function findingForBlock(path, before, after, policy) {
   }
   return null;
 }
-var RULE13, TEST_CALLS, SUITE_CALLS, EXACT_MATCHERS, WEAK_MATCHERS, compact, assertionWeakening;
+var RULE14, TEST_CALLS, SUITE_CALLS, EXACT_MATCHERS, WEAK_MATCHERS, compact, assertionWeakening;
 var init_assertion_weakening = __esm({
   "src/detectors/assertion-weakening.ts"() {
     "use strict";
@@ -9576,14 +10164,14 @@ var init_assertion_weakening = __esm({
     init_finding();
     init_files();
     init_runner_chain();
-    RULE13 = "assertion-weakening";
+    RULE14 = "assertion-weakening";
     TEST_CALLS = /* @__PURE__ */ new Set(["it", "test"]);
     SUITE_CALLS = /* @__PURE__ */ new Set(["describe", "suite", "context"]);
     EXACT_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toMatchObject"]);
     WEAK_MATCHERS = /* @__PURE__ */ new Set(["toBeTruthy", "toBeDefined"]);
     compact = (s) => s.replace(/\s+/g, "");
     assertionWeakening = {
-      id: RULE13,
+      id: RULE14,
       surface: ["file"],
       certainty: "heuristic",
       run(changes, policy) {
@@ -9617,7 +10205,7 @@ function significant(src, path) {
   }
   return out3;
 }
-var RULE14, MIN_REMOVED_LINES2, ws2, testSupport;
+var RULE15, MIN_REMOVED_LINES2, ws2, testSupport;
 var init_test_support = __esm({
   "src/detectors/test-support.ts"() {
     "use strict";
@@ -9625,11 +10213,11 @@ var init_test_support = __esm({
     init_finding();
     init_spec_shape();
     init_files();
-    RULE14 = "test-support";
+    RULE15 = "test-support";
     MIN_REMOVED_LINES2 = 3;
     ws2 = (s) => s.replace(/\s+/g, "");
     testSupport = {
-      id: RULE14,
+      id: RULE15,
       surface: ["file"],
       certainty: "mechanical",
       run(changes, policy) {
@@ -9644,7 +10232,7 @@ var init_test_support = __esm({
           if (c.op === "delete") {
             if (!isSupport(c.path, c.before, null)) continue;
             out3.push(
-              makeFinding(RULE14, policy, {
+              makeFinding(RULE15, policy, {
                 file: c.path,
                 message: "A test-support file was deleted (a helper, setup module or fixture under the test globs; it defines no test).",
                 evidence: c.path,
@@ -9654,7 +10242,7 @@ var init_test_support = __esm({
             );
           } else if (c.op === "rename" && c.oldPath && isSupport(c.oldPath, c.before, c.after) && !isProtected(c.path, policy, "tests")) {
             out3.push(
-              makeFinding(RULE14, policy, {
+              makeFinding(RULE15, policy, {
                 file: c.path,
                 message: `A test-support file was renamed out of the test globs (${c.oldPath} \u2192 ${c.path}).`,
                 evidence: `${c.oldPath} \u2192 ${c.path}`,
@@ -9672,7 +10260,7 @@ var init_test_support = __esm({
             const gone = [...new Set(beforeSig)].filter((l) => !afterSet.has(l) && !kept.includes(ws2(l)));
             if (gone.length < MIN_REMOVED_LINES2) continue;
             out3.push(
-              makeFinding(RULE14, policy, {
+              makeFinding(RULE15, policy, {
                 file: c.path,
                 message: `Test-support content removed: ${gone.length} significant line(s) gone from a helper, setup module or fixture under the test globs.`,
                 evidence: gone.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
@@ -9699,6 +10287,7 @@ var init_detectors = __esm({
     init_lint_suppression();
     init_test_skip();
     init_coverage_lowering();
+    init_config_weakening();
     init_coverage_exclusion();
     init_ci_tampering();
     init_hook_tampering();
@@ -9715,6 +10304,7 @@ var init_detectors = __esm({
       lintSuppression,
       testSkip,
       coverageLowering,
+      configWeakening,
       coverageExclusion,
       ciTampering,
       hookTampering,
@@ -11188,7 +11778,7 @@ function drainEvents(log, offset, maxTotalBytes = MAX_EVENT_SWEEP_BYTES, io = DE
   };
 }
 function transientFindings(events, persistentPaths, policy, finalHash) {
-  if (!isEnabled(RULE15, policy)) return [];
+  if (!isEnabled(RULE16, policy)) return [];
   const byPath = /* @__PURE__ */ new Map();
   for (const e of events) {
     if (!isProtected(e.path, policy)) continue;
@@ -11208,7 +11798,7 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
     const modeChurn = modes.size > 1;
     if (!contentChurn && !modeChurn) continue;
     const what = contentChurn ? `content was modified and restored within the turn (${hashes.size} distinct states observed)` : `file mode changed during the turn (${[...modes].map((m) => (m & 4095).toString(8)).join(" \u2192 ")})`;
-    const f = makeFinding(RULE15, policy, {
+    const f = makeFinding(RULE16, policy, {
       file: path,
       message: `Transient protected mutation: ${what}, leaving no net diff.`,
       evidence: evs.slice(0, 4).map((e) => `${e.ts} ${e.hash ?? "gone"}${e.mode != null ? `/${(e.mode & 4095).toString(8)}` : ""}`).join(" | "),
@@ -11223,14 +11813,14 @@ function transientFindings(events, persistentPaths, policy, finalHash) {
   }
   return out3;
 }
-var RULE15, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
+var RULE16, MAX_EVENT_READ_BYTES, MAX_EVENT_SWEEP_BYTES, DEFAULT_EVENT_READ_IO;
 var init_fs_events = __esm({
   "src/detectors/fs-events.ts"() {
     "use strict";
     init_policy();
     init_finding();
     init_narrow();
-    RULE15 = "transient-protected-mutation";
+    RULE16 = "transient-protected-mutation";
     MAX_EVENT_READ_BYTES = 4 * 1024 * 1024;
     MAX_EVENT_SWEEP_BYTES = 16 * 1024 * 1024;
     DEFAULT_EVENT_READ_IO = {
@@ -11294,10 +11884,7 @@ function failClosed(kind, detail) {
   };
   return verdict([f], kind);
 }
-function verdict(blocks2, kind) {
-  if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
-  recordDenylog(blocks2);
-  const reason = formatDenial(blocks2);
+function denyWire(reason, kind) {
   const payload = kind === "PreToolUse" ? {
     hookSpecificOutput: {
       hookEventName: "PreToolUse",
@@ -11305,7 +11892,13 @@ function verdict(blocks2, kind) {
       permissionDecisionReason: reason
     }
   } : { decision: "block", reason };
-  return { exitCode: 0, stdout: JSON.stringify(payload) + "\n" };
+  return JSON.stringify(payload) + "\n";
+}
+function verdict(blocks2, kind) {
+  if (blocks2.length === 0) return { exitCode: 0, stdout: "" };
+  recordDenylog(blocks2);
+  const reason = formatDenial(blocks2);
+  return { exitCode: 0, stdout: denyWire(reason, kind) };
 }
 function fileChanges(changes) {
   return changes.filter((c) => c.kind === "file");
@@ -11483,9 +12076,13 @@ function sanctionPredictedWrites(cwd, sessionId, policy, changes) {
   }
   if (dirty) savePtree(cwd, sessionId, tree);
 }
-function preToolUseVerdict(input, defaultCwd) {
+function preToolUseVerdict(input, defaultCwd, trustedRoot) {
   try {
     const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
+    if (trustedRoot !== void 0) {
+      const v = validateClaimAgainstRoot(input.cwd, trustedRoot, defaultCwd ?? process.cwd());
+      if (!v.ok) return failClosed("PreToolUse", `repository identity claim rejected: ${v.rejected}`);
+    }
     const cwd = repoRoot(sessionCwd);
     turnBaseline(cwd, input.session_id);
     const policy = loadPolicy(cwd);
@@ -11592,9 +12189,13 @@ function recordObserverHealth(state, reason) {
   } catch {
   }
 }
-function stopVerdict(input, defaultCwd) {
+function stopVerdict(input, defaultCwd, trustedRoot) {
   if (input.stop_hook_active) return { exitCode: 0, stdout: "" };
   const sessionCwd = input.cwd ?? defaultCwd ?? process.cwd();
+  if (trustedRoot !== void 0) {
+    const v = validateClaimAgainstRoot(input.cwd, trustedRoot, defaultCwd ?? process.cwd());
+    if (!v.ok) return failClosed("Stop", `repository identity claim rejected: ${v.rejected}`);
+  }
   const ctx = repoContext(sessionCwd);
   if (!ctx) {
     const why = outsideRepository(sessionCwd);
@@ -11637,16 +12238,16 @@ function emit(r) {
   if (r.stdout) process.stdout.write(r.stdout);
   return r.exitCode;
 }
-function preToolUseFromRaw(raw, defaultCwd) {
+function preToolUseFromRaw(raw, defaultCwd, trustedRoot) {
   try {
-    return preToolUseVerdict(parseInput(raw), defaultCwd);
+    return preToolUseVerdict(parseInput(raw), defaultCwd, trustedRoot);
   } catch (e) {
     return failClosed("PreToolUse", errText2(e));
   }
 }
-function stopFromRaw(raw, defaultCwd) {
+function stopFromRaw(raw, defaultCwd, trustedRoot) {
   try {
-    return stopVerdict(parseInput(raw), defaultCwd);
+    return stopVerdict(parseInput(raw), defaultCwd, trustedRoot);
   } catch (e) {
     return failClosed("Stop", errText2(e));
   }
@@ -11792,7 +12393,7 @@ var init_ptree_cache = __esm({
 // src/cli/hook-service.ts
 import { chmodSync, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
-import { realpathSync as realpathSync3 } from "node:fs";
+import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
 function readServiceState(paths) {
   try {
@@ -11830,7 +12431,7 @@ function listening(socket) {
 function within(root, cwd) {
   let real;
   try {
-    real = realpathSync3(cwd);
+    real = realpathSync4(cwd);
   } catch {
     return false;
   }
@@ -11895,7 +12496,7 @@ async function startHookService(opts) {
   if (uid === void 0) throw new Error("no uid on this platform; refusing to start");
   let root;
   try {
-    root = realpathSync3(repoRoot(realpathSync3(opts.root)));
+    root = realpathSync4(repoRoot(realpathSync4(opts.root)));
   } catch {
     throw new Error(`cannot resolve ${opts.root}`);
   }
@@ -12262,8 +12863,8 @@ var init_safe_write = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync4 } from "node:fs";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync12, realpathSync as realpathSync5 } from "node:fs";
+import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute8, join as join14, relative as relative3, resolve as resolve4 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
     return execFileSync6("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
@@ -12322,13 +12923,13 @@ function readWorkflowMark(src) {
   if (!m) return null;
   return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
 }
-function toolSet(matcher) {
-  const m = String(matcher ?? "").trim();
+function toolSet(matcher2) {
+  const m = String(matcher2 ?? "").trim();
   if (m === "" || m === "*") return null;
   return new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean));
 }
-function missingTools(matcher) {
-  const have = toolSet(matcher);
+function missingTools(matcher2) {
+  const have = toolSet(matcher2);
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
@@ -12643,7 +13244,7 @@ function planPreCommit(cwd) {
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
-    if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
+    if (basename3(dir) === "_" && basename3(dirname4(dir)) === ".husky") {
       path = join14(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
@@ -12840,7 +13441,7 @@ function planned(item, path, plan) {
 }
 function sameDir(a, b) {
   try {
-    return realpathSync4(a) === realpathSync4(b);
+    return realpathSync5(a) === realpathSync5(b);
   } catch {
     return false;
   }
@@ -13096,11 +13697,11 @@ import {
   readdirSync as readdirSync3,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
-  realpathSync as realpathSync5,
+  realpathSync as realpathSync6,
   statSync as statSync3
 } from "node:fs";
 import {
-  basename as basename3,
+  basename as basename4,
   delimiter,
   dirname as dirname5,
   isAbsolute as isAbsolute9,
@@ -13128,7 +13729,7 @@ function fingerprintRoot(root, cwd, h) {
   let currentReal;
   try {
     rootStat = lstatSync8(root.path);
-    currentReal = realpathSync5(root.path);
+    currentReal = realpathSync6(root.path);
   } catch (e) {
     throw new Unattestable(
       root.kind + " root " + JSON.stringify(root.path) + " can no longer be resolved (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -13144,7 +13745,7 @@ function fingerprintRoot(root, cwd, h) {
   }
   h.update("root\0" + root.kind + "\0" + root.path + "\0" + root.realPath + "\0" + String(rootStat.mode) + "\0");
   if (rootStat.isSymbolicLink()) h.update(readlinkSync2(root.path) + "\0");
-  const cwdReal = realpathSync5(cwd);
+  const cwdReal = realpathSync6(cwd);
   const visited = /* @__PURE__ */ new Set();
   const hashFile = (path, label) => {
     let st;
@@ -13161,7 +13762,7 @@ function fingerprintRoot(root, cwd, h) {
     }
   };
   const walk2 = (dir, namespace) => {
-    const realDir = realpathSync5(dir);
+    const realDir = realpathSync6(dir);
     if (visited.has(realDir)) return;
     visited.add(realDir);
     let entries;
@@ -13211,7 +13812,7 @@ function fingerprintRoot(root, cwd, h) {
         h.update(target + "\0");
         let resolved;
         try {
-          resolved = realpathSync5(path);
+          resolved = realpathSync6(path);
         } catch {
           continue;
         }
@@ -13266,7 +13867,7 @@ function freezeRoot(kind, path) {
     if (!statSync3(path).isDirectory()) {
       throw new Error("not a directory");
     }
-    return { kind, path: resolve5(path), realPath: realpathSync5(path) };
+    return { kind, path: resolve5(path), realPath: realpathSync6(path) };
   } catch (e) {
     throw new Unattestable(
       kind + " root " + JSON.stringify(path) + " is not resolvable (" + (e instanceof Error ? e.message : String(e)) + ")"
@@ -13304,7 +13905,7 @@ function resolveExecutable(token, cwd, env) {
   if (token.includes("/") || token.includes("\\")) {
     const path = isAbsolute9(token) ? token : resolve5(cwd, token);
     try {
-      return existsSync12(path) ? realpathSync5(path) : null;
+      return existsSync12(path) ? realpathSync6(path) : null;
     } catch {
       return null;
     }
@@ -13312,7 +13913,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve5(entry, token);
     try {
-      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync5(candidate);
+      if (existsSync12(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
     } catch {
     }
   }
@@ -13322,23 +13923,23 @@ function pythonName(name) {
   return /^(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)$/.test(name.toLowerCase());
 }
 function looksPython(command, executable, token) {
-  const exe = executable ? basename3(executable) : "";
-  const raw = token ? basename3(token) : "";
+  const exe = executable ? basename4(executable) : "";
+  const raw = token ? basename4(token) : "";
   if (pythonName(exe) || pythonName(raw)) return true;
   return /(?:^|[\s;&|()])(?:python(?:\d+(?:\.\d+)*)?|pytest|py\.test|pip(?:\d+(?:\.\d+)*)?)(?=$|[\s;&|()])/.test(command);
 }
 function inferredVenvFromToken(token, cwd) {
   if (!token || !token.includes("/") && !token.includes("\\")) return null;
   const path = isAbsolute9(token) ? token : resolve5(cwd, token);
-  if (!pythonName(basename3(path))) return null;
+  if (!pythonName(basename4(path))) return null;
   const parent = dirname5(path);
-  const parentName = basename3(parent).toLowerCase();
+  const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname5(parent);
   return existsSync12(join15(root, "pyvenv.cfg")) ? root : null;
 }
 function unsupportedEcosystem(command, token) {
-  const name = token ? basename3(token).toLowerCase() : "";
+  const name = token ? basename4(token).toLowerCase() : "";
   const raw = command.toLowerCase();
   if (["ruby", "bundle", "bundler", "rspec", "rake"].includes(name) || /(?:^|[\s;&|()])(?:bundle\s+exec|ruby|rspec|rake)(?=$|[\s;&|()])/.test(raw)) return "Ruby dependency environment discovery is not yet attestable";
   if (["mvn", "mvnw", "gradle", "gradlew", "java"].includes(name) || /(?:^|[\s;&|()])(?:mvn|mvnw|gradle|gradlew|java)(?=$|[\s;&|()])/.test(raw)) return "JVM dependency environment discovery is not yet attestable";
@@ -13348,7 +13949,7 @@ function unsupportedEcosystem(command, token) {
 function inferredVenv(executable) {
   if (!executable) return null;
   const parent = dirname5(executable);
-  const parentName = basename3(parent).toLowerCase();
+  const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname5(parent);
   return existsSync12(join15(root, "pyvenv.cfg")) ? root : null;
@@ -13818,7 +14419,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash9, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync6, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname6, join as join17, resolve as resolve6 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -13856,7 +14457,7 @@ function findExecutable(name) {
     const candidate = join17(raw, name);
     try {
       accessSync2(candidate, constants3.X_OK);
-      return realpathSync6(candidate);
+      return realpathSync7(candidate);
     } catch {
     }
   }
@@ -13931,7 +14532,7 @@ function inspectImageMetadata(enginePath, host, image) {
 function engineStable(backend) {
   if (!backend.enginePath || !backend.engineSha256) return false;
   try {
-    if (realpathSync6(backend.enginePath) !== backend.enginePath) return false;
+    if (realpathSync7(backend.enginePath) !== backend.enginePath) return false;
     if (replaceableByCaller(backend.enginePath)) return false;
     return fileSha256(backend.enginePath) === backend.engineSha256;
   } catch {
@@ -15172,7 +15773,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync9, rmSync as rmSync8, statSync as statSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname8, join as join19, resolve as resolve8 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -15227,7 +15828,7 @@ function trustedLinuxPython(candidates = DEFAULT_TRUSTED_PYTHON_CANDIDATES) {
   }
   for (const candidate of candidates) {
     try {
-      const real = realpathSync8(candidate);
+      const real = realpathSync9(candidate);
       const st = statSync5(real);
       if (!st.isFile() || writableByCaller2(real)) continue;
       const probe = spawnSync4(
@@ -15501,7 +16102,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out3 = [];
   let real;
   try {
-    real = realpathSync8(cwd);
+    real = realpathSync9(cwd);
   } catch {
     return out3;
   }
@@ -16723,7 +17324,7 @@ import {
   mkdtempSync as mkdtempSync5,
   readFileSync as readFileSync19,
   readdirSync as readdirSync6,
-  realpathSync as realpathSync9,
+  realpathSync as realpathSync10,
   rmSync as rmSync9,
   symlinkSync as symlinkSync2
 } from "node:fs";
@@ -16871,7 +17472,7 @@ function rewriteTraceRoot(accesses, actualRoot) {
     if (!inside3(actualRoot, abs)) return { ...item, path: abs };
     const rel = relative6(actualRoot, abs).split(sep4).join("/");
     try {
-      const real = resolve10(realpathSync9(abs));
+      const real = resolve10(realpathSync10(abs));
       if (!inside3(actualRoot, real)) return { ...item, path: real };
     } catch {
     }
@@ -17107,7 +17708,7 @@ var init_trace_verify = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync12 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync10, rmSync as rmSync10 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync20, realpathSync as realpathSync11, rmSync as rmSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join22, relative as relative7, resolve as resolve11, sep as sep5 } from "node:path";
 import { createInterface } from "node:readline";
@@ -17249,7 +17850,7 @@ async function runOnboard(opts, io = {}) {
   const cwd = resolve11(rootText);
   let sameRoot = cwd === requestedCwd;
   try {
-    sameRoot = realpathSync10(cwd) === realpathSync10(requestedCwd);
+    sameRoot = realpathSync11(cwd) === realpathSync11(requestedCwd);
   } catch {
   }
   if (!sameRoot) {
@@ -17587,8 +18188,8 @@ function runDemo(cwd, head, runners, out3) {
     let worktreeRoot;
     let realTarget;
     try {
-      worktreeRoot = realpathSync10(wt);
-      realTarget = realpathSync10(targetPath);
+      worktreeRoot = realpathSync11(wt);
+      realTarget = realpathSync11(targetPath);
     } catch {
       out3("Demo skipped: the selected test could not be resolved safely inside the disposable worktree.");
       return;