tamperward 2.3.0 → 2.4.1

package/dist/cli/index.js

@@ -202,6 +202,27 @@ function parseHunk(lines, start) {
   return { hunk: { oldStart, oldLines, newStart, newLines, lines: out2 }, next: i };
 }
 
+// src/diff/synth.ts
+function linesOf(content) {
+  if (content === "") return [];
+  const lines = content.split("\n");
+  if (content.endsWith("\n")) lines.pop();
+  return lines;
+}
+function addHunks(content) {
+  const lines = linesOf(content);
+  if (lines.length === 0) return [];
+  return [
+    {
+      oldStart: 0,
+      oldLines: 0,
+      newStart: 1,
+      newLines: lines.length,
+      lines: lines.map((l, i) => ({ type: "add", content: l, oldLine: null, newLine: i + 1 }))
+    }
+  ];
+}
+
 // src/git/build.ts
 function git(args, cwd) {
   try {
@@ -256,6 +277,9 @@ function mergeBaseOf(base, head, opts = {}) {
 function fileAt(rev, path, opts = {}) {
   return blobAt(rev, path, opts.cwd);
 }
+function fileOnDisk(path, opts = {}) {
+  return fromDisk(path, opts.cwd);
+}
 function isGitRepo(cwd) {
   try {
     git(["rev-parse", "--git-dir"], cwd);
@@ -306,18 +330,35 @@ function diffWorktree(opts = {}) {
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
 }
+function untrackedAdds(opts = {}, keep, exclude) {
+  const others = git(["ls-files", "--others", "--exclude-standard", "-z"], opts.cwd).split("\0").filter(Boolean);
+  return others.filter((rel) => !exclude?.has(rel) && (!keep || keep(rel))).map((rel) => {
+    const after = fromDisk(rel, opts.cwd);
+    return {
+      kind: "file",
+      path: rel,
+      oldPath: null,
+      op: "add",
+      before: null,
+      after,
+      binary: false,
+      hunks: after == null ? [] : addHunks(after)
+    };
+  });
+}
 function diffWorktreeWithUntracked(opts = {}) {
   const tracked = diffWorktree(opts);
-  const others = git(["ls-files", "--others", "--exclude-standard", "-z"], opts.cwd).split("\0").filter(Boolean);
   const seen = new Set(tracked.filter((c) => c.kind === "file").map((c) => c.path));
-  const untracked = others.filter((rel) => !seen.has(rel)).map(
-    (rel) => enrich(
-      { kind: "file", path: rel, oldPath: null, op: "add", before: null, after: null, binary: false, hunks: [] },
-      () => null,
-      (p) => fromDisk(p, opts.cwd)
-    )
-  );
-  return [...tracked, ...untracked];
+  return [...tracked, ...untrackedAdds(opts, void 0, seen)];
+}
+function hiddenTrackedPaths(opts = {}) {
+  const out2 = [];
+  for (const entry of git(["ls-files", "-v", "-z"], opts.cwd).split("\0")) {
+    if (entry.length < 3 || entry[1] !== " ") continue;
+    const tag = entry[0];
+    if (tag === "S" || tag !== tag.toUpperCase()) out2.push(entry.slice(2));
+  }
+  return out2;
 }
 
 // src/detectors/finding.ts
@@ -947,8 +988,20 @@ var PATTERNS2 = {
   py: [
     // `import pytest as pt` makes the decorator `@pt.mark.skip`; the module alias is free.
     { re: /@\w+\.mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker" },
+    // `from pytest import mark` makes it `@mark.skip`; `marks=pytest.mark.skip` is the
+    // parametrize form. Both carry the same marker without the `@<module>.` shape.
+    { re: /@mark\.(?:skip|skipif|xfail)\b/, why: "a pytest skip/skipif/xfail marker (from pytest import mark)" },
+    { re: /\bmarks\s*=\s*(?:\w+\.)?mark\.(?:skip|skipif|xfail)\b/, why: "a parametrize marks= skip/skipif/xfail marker" },
     { re: /\bpytestmark\s*=.*\.mark\.(?:skip|skipif|xfail)\b/, why: "a module-level pytestmark skip (every test in the file is skipped)" },
-    { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail() call" },
+    { re: /\bpytest\.(?:skip|xfail|importorskip)\(/, why: "a runtime pytest.skip()/xfail()/importorskip() call" },
+    // Collection-time drops. A conftest.py is protected as a test file, and these
+    // are how pytest is told never to collect a test in the first place — no
+    // marker ever appears in the test itself. `collect_ignore` / `collect_ignore_glob`
+    // are conftest globals (pytest docs, "Customizing test collection");
+    // `pytest_ignore_collect` is the hook whose only job is to say "skip this path";
+    // `__test__ = False` de-collects a class or function.
+    { re: /\bcollect_ignore(?:_glob)?\s*(?:=|\+=|\.(?:append|extend)\()/, why: "a collect_ignore / collect_ignore_glob entry (the files are never collected)" },
+    { re: /\bdef\s+pytest_ignore_collect\s*\(/, why: "a pytest_ignore_collect hook (paths are dropped at collection)" },
     // `from unittest import skip` makes the decorator bare `@skip`.
     { re: /@(?:unittest\.)?(?:skip|skipIf|skipUnless|expectedFailure)\b/, why: "a unittest skip/expectedFailure decorator" },
     { re: /\bself\.skipTest\(/, why: "a runtime self.skipTest() call" },
@@ -1162,12 +1215,12 @@ var coverageLowering = {
         );
       }
       for (const l of added) {
-        if (/--passWithNoTests\b/.test(l.content)) {
+        if (/--passWithNoTests\b/.test(l.content) || /\bpassWithNoTests\s*:\s*true\b/.test(l.content)) {
           out2.push(
             makeFinding(RULE4, policy, {
               file: c.path,
               line: l.newLine ?? void 0,
-              message: "--passWithNoTests added \u2014 the suite can now pass with zero tests.",
+              message: "passWithNoTests added \u2014 the suite can now pass with zero tests.",
               evidence: l.content.trim(),
               remediation: "Remove --passWithNoTests; an empty suite must not be a green check."
             })
@@ -1309,6 +1362,10 @@ var ciTampering = {
   }
 };
 
+// src/detectors/hook-tampering.ts
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
 var globs = (list) => Array.isArray(list) ? list.filter((g) => typeof g === "string").map(normalizeGlob) : [];
@@ -1419,19 +1476,390 @@ function policyWeakening(before, after) {
   }
   return reasons;
 }
+function policyAddWeakening(after) {
+  let doc;
+  try {
+    doc = parse(after);
+  } catch {
+    return ["the added policy is not valid YAML \u2014 the gate fails closed until it is fixed"];
+  }
+  if (doc === null || doc === void 0) return [];
+  if (typeof doc !== "object" || Array.isArray(doc)) {
+    return ["the added policy is not a policy mapping \u2014 the gate fails closed until it is fixed"];
+  }
+  return policyWeakening("{}", after) ?? [];
+}
 
-// src/detectors/hook-tampering.ts
-var RULE6 = "hook-tampering";
-var HOOK_INVOCATION = /\b(tamperward|npx|npm|pnpm|yarn|bun|jest|vitest|eslint|tsc|lefthook|husky|lint-staged|make|cargo|pytest)\b/;
-var isShellComment = (s) => /^\s*#/.test(s);
-var ownerExec = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
+// src/detectors/hook-wiring.ts
+import { parse as parseYaml } from "yaml";
+function stripComment(line) {
+  let single = false;
+  let double = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "'" && !double) single = !single;
+    else if (ch === '"' && !single) double = !double;
+    else if (ch === "#" && !single && !double && (i === 0 || /\s/.test(line[i - 1]))) return line.slice(0, i);
+  }
+  return line;
+}
+var isComment = (line) => /^\s*#/.test(line);
+var RUNNER = /^(?:npx|pnpm|yarn|bunx|bun|npm)\s+(?:(?:exec|dlx|x|run)\s+)?(?:(?:--yes|-y|--no-install|--silent|-s|--)\s+)*/;
+var TOOL = /^(tamperward|jest|vitest|eslint|tsc|lint-staged|lefthook|husky|pytest|make|cargo|go|pre-commit|mypy|ruff|rubocop|prettier|gradlew?)\b/;
+var SCRIPT = /^(test|tests|lint|typecheck|type-check|coverage|check)\b/;
+var SUBCOMMAND_TOOLS = /* @__PURE__ */ new Set(["tamperward", "make", "cargo", "go", "lefthook", "husky", "pre-commit"]);
+var PREFIX = /^(?:(?:then|do|else|\{|\(|!|exec|command|time|nice|env|sudo|[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"(?=\s|$)|'[^']*'(?=\s|$)|[^\s"']\S*|(?=\s)))\s+)*/;
+function checkIdentity(segment) {
+  const core = segment.trim().replace(PREFIX, "").replace(/\s+/g, " ");
+  const viaRunner = RUNNER.test(core);
+  const rest = core.replace(RUNNER, "");
+  const tool = rest.match(TOOL)?.[1] ?? (viaRunner ? rest.match(SCRIPT)?.[1] : void 0);
+  if (!tool) return null;
+  const toks = rest.replace(/^tamperward@\S+/, "tamperward").split(" ");
+  if (tool === "tamperward") {
+    const sub = toks[1];
+    if (!sub || sub.startsWith("-")) return null;
+    return `tamperward ${sub}`;
+  }
+  if (SUBCOMMAND_TOOLS.has(tool) && toks[1] && !toks[1].startsWith("-")) return `${tool} ${toks[1]}`;
+  return tool;
+}
+function split(stmt) {
+  const segs = [];
+  const ops = [];
+  const re = /(&&|\|\||;|\|)/g;
+  let last = 0;
+  for (const m of stmt.matchAll(re)) {
+    segs.push(stmt.slice(last, m.index));
+    ops.push(m[1]);
+    last = (m.index ?? 0) + m[1].length;
+  }
+  segs.push(stmt.slice(last));
+  return { segs, ops };
+}
+var unq = (s) => s.replace(/^["']|["']$/g, "");
+function alwaysFalse(cond) {
+  const c = cond.trim().replace(/;$/, "").trim();
+  if (/^(?:false|!\s*true|\(\s*exit\s+[1-9]\d*\s*\))$/.test(c)) return true;
+  const m = c.match(/^(?:\[\[\s+(.+?)\s+\]\]|\[\s+(.+?)\s+\]|test\s+(.+))$/);
+  if (!m) return false;
+  const inner = (m[1] ?? m[2] ?? m[3]).trim();
+  if (inner.includes("$")) return false;
+  const parts = inner.match(/^(\S+)\s+(-eq|-ne|-lt|-le|-gt|-ge|=|==|!=)\s+(\S+)$/);
+  if (parts) {
+    const [, a, op, b] = parts;
+    const x = unq(a);
+    const y = unq(b);
+    const nx = Number(x);
+    const ny = Number(y);
+    const ints = /^-?\d+$/.test(x) && /^-?\d+$/.test(y);
+    switch (op) {
+      case "-eq":
+        return ints && nx !== ny;
+      case "-ne":
+        return ints && nx === ny;
+      case "-lt":
+        return ints && !(nx < ny);
+      case "-le":
+        return ints && !(nx <= ny);
+      case "-gt":
+        return ints && !(nx > ny);
+      case "-ge":
+        return ints && !(nx >= ny);
+      case "=":
+      case "==":
+        return x !== y;
+      case "!=":
+        return x === y;
+    }
+  }
+  const unary = inner.match(/^(-n|-z)\s+(\S+)$/);
+  if (unary) {
+    const v = unq(unary[2]);
+    return unary[1] === "-n" ? v === "" : v !== "";
+  }
+  if (/^(?:""|'')$/.test(inner)) return true;
+  return false;
+}
+var alwaysTrue = (cond) => /^(?:true|:|\[\s+1\s+-eq\s+1\s+\]|\[\s+-n\s+"?\S"?\s+\])$/.test(cond.trim().replace(/;$/, "").trim());
+var EXIT_ZERO = /^(?:exit|return)(?:\s+0+)?$/;
+var EXIT_ANY = /^(?:exit|return)(?:\s+\S+)?$/;
+var FAILS_LOUDLY = /\b(?:exit|return)\s+(?:[1-9]\d*|"?\$\?"?|"?\$\{?[A-Za-z_]\w*\}?"?)(?=[\s;})]|$)|\bfalse\b|\bkill\b|\bexit\s*$|\breturn\s*$/;
+function insertsPassingExit(line) {
+  if (isComment(line)) return false;
+  return split(stripComment(line)).segs.some((s) => EXIT_ZERO.test(s.trim().replace(PREFIX, "")));
+}
+function insertsDeadGuard(line) {
+  if (isComment(line)) return false;
+  const m = stripComment(line).trim().match(/^(?:if|elif)\s+(.+?)\s*(?:;\s*then)?\s*$/);
+  return !!m && alwaysFalse(m[1]);
+}
+function invocations(lines) {
+  const out2 = [];
+  const pipefail = lines.some((l) => /\bpipefail\b/.test(stripComment(l)));
+  const frames = [{ dead: false }];
+  const dead = () => frames.some((f) => f.dead);
+  for (const raw of lines) {
+    if (isComment(raw)) {
+      const id = checkIdentity(raw.replace(/^\s*#+\s*/, ""));
+      if (id) out2.push({ identity: id, line: raw, state: "comment" });
+      continue;
+    }
+    const stmt = stripComment(raw).trim();
+    if (!stmt) continue;
+    const ifm = stmt.match(/^(if|elif)\s+(.+?)\s*(?:;\s*then)?\s*$/);
+    if (ifm) {
+      if (ifm[1] === "if") frames.push({ dead: alwaysFalse(ifm[2]) });
+      else if (frames.length > 1) frames[frames.length - 1].dead = alwaysFalse(ifm[2]);
+      continue;
+    }
+    if (/^else\b/.test(stmt)) {
+      if (frames.length > 1) frames[frames.length - 1].dead = false;
+      continue;
+    }
+    if (/^fi\b/.test(stmt)) {
+      if (frames.length > 1) frames.pop();
+      continue;
+    }
+    const { segs, ops } = split(stmt);
+    for (let i = 0; i < segs.length; i++) {
+      const seg = segs[i].trim().replace(PREFIX, "");
+      const id = checkIdentity(seg);
+      if (!id) {
+        if (EXIT_ANY.test(seg) && !dead() && (i === 0 || ops[i - 1] === ";")) frames[frames.length - 1].dead = true;
+        continue;
+      }
+      let state = dead() ? "unreachable" : "live";
+      if (state === "live" && i > 0) {
+        if (ops[i - 1] === "&&" && alwaysFalse(segs[i - 1])) state = "unreachable";
+        if (ops[i - 1] === "||" && alwaysTrue(segs[i - 1])) state = "unreachable";
+      }
+      if (state === "live" && i < ops.length) {
+        const after = segs.slice(i + 1).join(" ");
+        if (ops[i] === "||" && !FAILS_LOUDLY.test(after)) state = "neutered";
+        else if (ops[i] === "|" && !pipefail) state = "neutered";
+        else if (ops[i] === ";" && segs.slice(i + 1).some((s) => /^(?:true|:)$/.test(s.trim()) || EXIT_ZERO.test(s.trim()))) state = "neutered";
+      }
+      out2.push({ identity: id, line: raw, state });
+    }
+  }
+  return out2;
+}
+function scriptWeakening(before, after) {
+  const live = (inv) => new Set(inv.filter((i) => i.state === "live").map((i) => i.identity));
+  const bl = live(invocations(before));
+  const afterInv = invocations(after);
+  const al = live(afterInv);
+  const out2 = [];
+  for (const id of bl) {
+    if (al.has(id)) continue;
+    const trace = afterInv.find((i) => i.identity === id);
+    const how = trace?.state === "neutered" ? "neutralised in place (its failure can no longer fail the hook)" : trace?.state === "unreachable" ? "made unreachable (behind an always-false guard or an early exit)" : trace?.state === "comment" ? "commented out" : "removed";
+    const evidence = (trace?.line ?? before.find((l) => checkIdentity(stripComment(l).trim().replace(PREFIX, "")) === id) ?? id).trim();
+    out2.push({ reason: `the check invocation \`${id}\` was ${how}`, evidence });
+  }
+  return out2;
+}
+var isCodeowners = (path) => /(?:^|\/)CODEOWNERS$/.test(path);
+var GATE_CRITICAL = [
+  "/.github/workflows/",
+  "/.tamperward.yml",
+  "/.github/CODEOWNERS",
+  "/CODEOWNERS",
+  "/docs/CODEOWNERS",
+  "/.husky/",
+  "/.claude/settings.json",
+  "/.claude/settings.local.json",
+  "/.pre-commit-config.yaml",
+  "/lefthook.yml",
+  "/lefthook.yaml"
+];
+function covers(pattern, critical) {
+  if (pattern === "*" || pattern === "**") return true;
+  let p = pattern.replace(/\/\*\*$/, "/").replace(/\/\*$/, "/");
+  if (!p.startsWith("/")) p = "/" + p;
+  if (p === critical) return true;
+  if (p.endsWith("/") && critical.startsWith(p)) return true;
+  return critical.startsWith(p + "/");
+}
+function ownersOf(content, critical) {
+  let owners = null;
+  for (const line of content.split("\n")) {
+    const t = line.trim();
+    if (!t || t.startsWith("#")) continue;
+    const [pattern, ...rest] = t.split(/\s+/);
+    if (covers(pattern, critical)) owners = rest.filter((o) => !o.startsWith("#"));
+  }
+  return owners;
+}
+function codeownersWeakening(before, after) {
+  const out2 = [];
+  for (const critical of GATE_CRITICAL) {
+    const was = ownersOf(before, critical);
+    if (!was || was.length === 0) continue;
+    const now = ownersOf(after, critical);
+    if (!now) out2.push(`the code-owner rule covering ${critical} was removed \u2014 the gate's own files no longer require a human reviewer`);
+    else if (now.length === 0) out2.push(`the code-owner rule covering ${critical} lost its owners \u2014 the gate's own files no longer require a human reviewer`);
+  }
+  return out2;
+}
+var isDoc = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function parseDoc(src) {
+  try {
+    const v = parseYaml(src);
+    return isDoc(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+var isLefthook = (path) => /(?:^|\/)\.?lefthook(?:-local)?\.(?:ya?ml|toml|json)$/.test(path);
+var isPreCommitConfig = (path) => /(?:^|\/)\.pre-commit-config\.ya?ml$/.test(path);
+var isPackageJson = (path) => /(?:^|\/)package\.json$/.test(path);
+var GATE = /\btamperward\b/;
+var str = (v) => typeof v === "string" ? v : Array.isArray(v) ? v.map(String).join(" ") : v == null ? "" : JSON.stringify(v);
+function lefthookEntries(doc) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (const [section, v] of Object.entries(doc)) {
+    if (!isDoc(v)) continue;
+    for (const group of ["commands", "scripts"]) {
+      const g = v[group];
+      if (!isDoc(g)) continue;
+      for (const [name, cfg] of Object.entries(g)) {
+        if (!isDoc(cfg) || !GATE.test(str(cfg.run ?? cfg.runner))) continue;
+        out2.set(`${section}.${group}.${name}`, {
+          skip: cfg.skip,
+          sectionSkip: v.skip,
+          glob: str(cfg.glob),
+          exclude: str(cfg.exclude),
+          only: str(cfg.only)
+        });
+      }
+    }
+  }
+  return out2;
+}
+function lefthookWeakening(before, after) {
+  const out2 = [];
+  const b = lefthookEntries(before);
+  const a = lefthookEntries(after);
+  for (const [key2, was] of b) {
+    const now = a.get(key2);
+    if (!now) {
+      out2.push(`lefthook entry ${key2} (the gate) was removed`);
+      continue;
+    }
+    if (now.skip === true && was.skip !== true) out2.push(`lefthook entry ${key2} (the gate) is now \`skip: true\``);
+    if (now.sectionSkip === true && was.sectionSkip !== true) out2.push(`the lefthook hook carrying ${key2} (the gate) is now \`skip: true\``);
+    if (now.glob !== was.glob && now.glob) out2.push(`lefthook entry ${key2} (the gate) gained or changed \`glob\` (${now.glob}) \u2014 it no longer runs on every commit`);
+    if (now.exclude !== was.exclude && now.exclude) out2.push(`lefthook entry ${key2} (the gate) gained or changed \`exclude\` (${now.exclude})`);
+    if (now.only !== was.only && now.only) out2.push(`lefthook entry ${key2} (the gate) gained or changed \`only\` (${now.only})`);
+  }
+  return out2;
+}
+var COMMIT_STAGES = /* @__PURE__ */ new Set(["commit", "pre-commit", "push", "pre-push", "commit-msg", "pre-merge-commit", "prepare-commit-msg"]);
+function preCommitEntries(doc) {
+  const out2 = /* @__PURE__ */ new Map();
+  const repos = Array.isArray(doc.repos) ? doc.repos : [];
+  for (const repo of repos) {
+    if (!isDoc(repo)) continue;
+    const hooks = Array.isArray(repo.hooks) ? repo.hooks : [];
+    for (const h of hooks) {
+      if (!isDoc(h)) continue;
+      if (!GATE.test(`${str(repo.repo)} ${str(h.id)} ${str(h.entry)} ${str(h.name)}`)) continue;
+      out2.set(`${str(repo.repo)}:${str(h.id)}`, {
+        stages: Array.isArray(h.stages) ? h.stages.map(String) : null,
+        exclude: str(h.exclude),
+        files: str(h.files)
+      });
+    }
+  }
+  return out2;
+}
+function preCommitWeakening(before, after) {
+  const out2 = [];
+  const b = preCommitEntries(before);
+  const a = preCommitEntries(after);
+  for (const [key2, was] of b) {
+    const now = a.get(key2);
+    if (!now) {
+      out2.push(`pre-commit hook ${key2} (the gate) was removed`);
+      continue;
+    }
+    const wasStages = was.stages ?? [...COMMIT_STAGES];
+    if (now.stages && !now.stages.some((s) => COMMIT_STAGES.has(s)) && wasStages.some((s) => COMMIT_STAGES.has(s))) {
+      out2.push(`pre-commit hook ${key2} (the gate) now runs only at stages [${now.stages.join(", ")}] \u2014 no commit or push triggers it`);
+    } else if (now.stages && was.stages) {
+      const lost = was.stages.filter((s) => COMMIT_STAGES.has(s) && !now.stages.includes(s));
+      if (lost.length) out2.push(`pre-commit hook ${key2} (the gate) no longer runs at stage(s) ${lost.join(", ")}`);
+    }
+    if (now.exclude !== was.exclude && now.exclude) out2.push(`pre-commit hook ${key2} (the gate) gained or changed \`exclude\` (${now.exclude})`);
+    if (now.files !== was.files && now.files) out2.push(`pre-commit hook ${key2} (the gate) gained or changed \`files\` (${now.files})`);
+  }
+  const topB = str(before.exclude);
+  const topA = str(after.exclude);
+  if (topA && topA !== topB && b.size > 0) out2.push(`a top-level pre-commit \`exclude\` was added or changed (${topA}) \u2014 it scopes every hook, the gate included`);
+  return out2;
+}
+var INSTALLER = /\b(?:husky|lefthook|simple-git-hooks|pre-commit)\b/;
+var INSTALL_SCRIPTS = ["prepare", "postinstall", "install", "preinstall"];
+function packageJsonWeakening(before, after) {
+  let b;
+  let a;
+  try {
+    b = JSON.parse(before);
+    a = JSON.parse(after);
+  } catch {
+    return [];
+  }
+  if (!isDoc(b) || !isDoc(a)) return [];
+  const scripts = (d) => {
+    const sc = d.scripts;
+    return isDoc(sc) ? INSTALL_SCRIPTS.map((k) => str(sc[k])).join(" ") : "";
+  };
+  const was = scripts(b).match(INSTALLER)?.[0];
+  if (!was) return [];
+  if (INSTALLER.test(scripts(a))) return [];
+  return [`the install script that wires the git hooks (\`${was}\`) was removed from package.json scripts \u2014 a fresh checkout installs no hooks`];
+}
+var GIT_HOOKS = /* @__PURE__ */ new Set([
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "pre-receive",
+  "update",
+  "post-receive",
+  "post-update",
+  "push-to-checkout",
+  "pre-auto-gc",
+  "post-rewrite",
+  "sendemail-validate"
+]);
+function hookIdentity(path) {
+  const base = path.split("/").pop() ?? "";
+  if (isLefthook(path)) return "lefthook";
+  if (isPreCommitConfig(path)) return "pre-commit-config";
+  if (base === "CODEOWNERS") return "codeowners";
+  const husky = path.match(/(?:^|\/)\.husky\/([^/]+)$/);
+  if (husky && GIT_HOOKS.has(husky[1])) return `husky:${husky[1]}`;
+  return null;
+}
+var ownerExec = (mode) => (parseInt(mode.slice(-3).padStart(3, "0"), 8) & 64) !== 0;
 var SYMBOLIC = /^[ugoa]*([-+=])([rwxXst]*)$/;
-function chmodTouchesExec(seg) {
-  const toks = tokens(seg).map(unquote);
-  const at = toks.findIndex((t) => /^chmod$/.test(t));
+function chmodDropsExec(toks) {
+  const at = toks.findIndex((t) => t === "chmod" || t.endsWith("/chmod"));
   if (at === -1) return false;
   for (const tok of toks.slice(at + 1)) {
-    if (/^[0-7]{3,4}$/.test(tok)) {
+    if (/^--reference=/.test(tok)) return true;
+    if (/^[0-7]{1,5}$/.test(tok)) {
       if (!ownerExec(tok)) return true;
       continue;
     }
@@ -1439,23 +1867,260 @@ function chmodTouchesExec(seg) {
       const m = clause.match(SYMBOLIC);
       if (!m) continue;
       const [, op, perms] = m;
-      const namesExec = /[xX]/.test(perms);
-      if (op === "=" ? !namesExec : namesExec) return true;
+      if (op === "-" && /[xX]/.test(perms)) return true;
+      if (op === "=" && !/[xX]/.test(perms)) return true;
     }
   }
   return false;
 }
+var WRAPPERS = /^(?:sudo|command|exec|time|nice|env|[A-Za-z_][A-Za-z0-9_]*=\S*)$/;
+function shellWritesHook(seg, toks, policy) {
+  const hook = (t) => isProtected(t.replace(/^\.\//, ""), policy, "hooks");
+  for (const m of seg.matchAll(/(?:^|\s)\d*>{1,2}\|?\s*(\S+)/g)) {
+    if (hook(m[1].replace(/^["']|["']$/g, ""))) return "a redirect empties or rewrites a protected hook";
+  }
+  let at = 0;
+  while (at < toks.length && WRAPPERS.test(toks[at])) at++;
+  const cmd = (toks[at] ?? "").replace(/^.*\//, "");
+  const args = toks.slice(at + 1);
+  const positional = args.filter((a) => a !== "--" && !a.startsWith("-"));
+  const last = positional[positional.length - 1] ?? "";
+  const anyHook = args.some(hook);
+  const inPlace = args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a));
+  switch (cmd) {
+    case "rm":
+    case "unlink":
+    case "shred":
+      return anyHook ? "rm deletes a protected hook" : null;
+    case "truncate":
+      return anyHook ? "truncate empties a protected hook" : null;
+    case "chmod":
+      return anyHook && chmodDropsExec(toks) ? "chmod removes execute permission from a hook \u2014 git will skip it" : null;
+    case "mv":
+      return anyHook ? "mv moves a protected hook out of place or overwrites it" : null;
+    case "cp":
+    case "install":
+    case "ln":
+      return hook(last) ? `${cmd} replaces a protected hook in place` : null;
+    case "tee":
+    case "sponge":
+      return anyHook ? `${cmd} rewrites a protected hook in place` : null;
+    case "dd":
+      return args.some((a) => a.startsWith("of=") && hook(a.slice(3))) ? "dd rewrites a protected hook in place" : null;
+    case "sed":
+    case "perl":
+      return anyHook && inPlace ? `an in-place ${cmd} rewrites a protected hook` : null;
+    case "awk":
+    case "gawk":
+      return anyHook && args.some((a, i) => a === "-i" && args[i + 1] === "inplace" || a === "--in-place" || a === "-i=inplace") ? "an in-place awk rewrites a protected hook" : null;
+    case "git": {
+      let i = 0;
+      while (i < args.length && args[i].startsWith("-")) i += args[i] === "-C" || args[i] === "-c" ? 2 : 1;
+      const sub = args[i];
+      const rest = args.slice(i + 1);
+      if (!rest.some(hook)) return null;
+      if (sub === "checkout") {
+        const dd = rest.indexOf("--");
+        const before = dd === -1 ? rest : rest.slice(0, dd);
+        const revs = before.filter((p) => !p.startsWith("-") && !hook(p));
+        return revs.length > 0 ? "git checkout <rev> -- <hook> puts an older version of a protected hook back" : null;
+      }
+      if (sub === "restore" && rest.some((a) => /^--source(?:=|$)/.test(a) || a === "-s")) {
+        return "git restore --source=<rev> <hook> puts an older version of a protected hook back";
+      }
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+// src/detectors/hook-tampering.ts
+var RULE6 = "hook-tampering";
+var ownerExec2 = (mode) => (parseInt(mode.slice(-3), 8) & 64) !== 0;
+var CLAUDE_SETTINGS = /(?:^|\/)\.claude\/settings(?:\.local)?\.json$/;
+var isClaudeSettings = (p) => CLAUDE_SETTINGS.test(p);
+function siblingSettings(p) {
+  return p.endsWith("settings.local.json") ? p.replace(/settings\.local\.json$/, "settings.json") : p.replace(/settings\.json$/, "settings.local.json");
+}
+var TW_INVOCATION = /\btamperward(?:@\S+)?\s+(?:hook|sweep)\s+claude\b/;
+var EVENTS = ["PreToolUse", "Stop"];
+function parseSettings(src) {
+  try {
+    const v = JSON.parse(src);
+    return v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
+function toolSet(matcher2) {
+  const m = typeof matcher2 === "string" ? matcher2.trim() : "";
+  if (m === "" || m === "*") return null;
+  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+}
+function eventEntries(s, event) {
+  const hooks = s.hooks;
+  if (hooks === null || typeof hooks !== "object" || Array.isArray(hooks)) return null;
+  const arr = hooks[event];
+  return Array.isArray(arr) ? arr : null;
+}
+var declares = (s, event) => eventEntries(s, event) !== null;
+function gateWiring(s, event) {
+  const out2 = [];
+  for (const m of eventEntries(s, event) ?? []) {
+    if (m === null || typeof m !== "object") continue;
+    const matcher2 = m;
+    if (!Array.isArray(matcher2.hooks)) continue;
+    for (const h of matcher2.hooks) {
+      if (h === null || typeof h !== "object") continue;
+      const entry = h;
+      if (entry.type !== void 0 && entry.type !== "command") continue;
+      if (typeof entry.command !== "string" || !TW_INVOCATION.test(entry.command)) continue;
+      out2.push({ tools: toolSet(matcher2.matcher), command: entry.command });
+    }
+  }
+  return out2;
+}
+function coverage(ws2) {
+  if (ws2.length === 0) return "none";
+  if (ws2.some((w) => w.tools === null)) return null;
+  return new Set(ws2.flatMap((w) => [...w.tools]));
+}
+var hooksDisabled = (s) => s.disableAllHooks === true;
+function settingsWeakening(before, after, sibling) {
+  const reasons = [];
+  if (hooksDisabled(after) && !(before !== null && hooksDisabled(before))) {
+    reasons.push("`disableAllHooks: true` switches every hook off, the gate included");
+  }
+  for (const event of EVENTS) {
+    const was = before ? coverage(gateWiring(before, event)) : "none";
+    const now = coverage(gateWiring(after, event));
+    if (was !== "none") {
+      if (now === "none") {
+        reasons.push(`the tamperward ${event} hook entry was removed`);
+      } else if (event === "PreToolUse") {
+        if (was === null && now !== null) {
+          reasons.push(`the PreToolUse matcher for the gate was narrowed from every tool to ${[...now].join("|")}`);
+        } else if (was !== null && now !== null) {
+          const lost = [...was].filter((t) => !now.has(t));
+          if (lost.length) reasons.push(`the PreToolUse matcher for the gate no longer covers ${lost.join(", ")}`);
+        }
+      }
+      continue;
+    }
+    if (now !== "none" || !declares(after, event)) continue;
+    if (before !== null && declares(before, event)) continue;
+    const empty = (eventEntries(after, event) ?? []).length === 0;
+    const shadowed = sibling !== null && gateWiring(sibling, event).length > 0;
+    if (empty || shadowed) {
+      reasons.push(
+        `${event} hooks declared ${empty ? "empty" : "without the tamperward entry"} in an override file` + (shadowed ? " \u2014 this shadows the gate the sibling settings file wires" : "")
+      );
+    }
+  }
+  return reasons;
+}
+function siblingOf(c, changes, ctx) {
+  const path = siblingSettings(c.path);
+  const inSet = changes.find((o) => o.kind === "file" && o.path === path);
+  if (inSet) return inSet.after != null ? parseSettings(inSet.after) : null;
+  if (!ctx?.cwd) return null;
+  try {
+    const p = join2(ctx.cwd, path);
+    return existsSync(p) ? parseSettings(readFileSync2(p, "utf8")) : null;
+  } catch {
+    return null;
+  }
+}
+function claudeSettingsFindings(c, changes, policy, ctx) {
+  if (c.after == null) return null;
+  const after = parseSettings(c.after);
+  const before = c.before != null ? parseSettings(c.before) : null;
+  const finding = (reason) => makeFinding(RULE6, policy, {
+    file: c.path,
+    message: `The Claude Code hook wiring was weakened: ${reason}.`,
+    evidence: reason,
+    remediation: "Leave the PreToolUse and Stop entries that run tamperward, and the matcher that covers every editing tool, exactly as `tamperward init` wrote them. Editing the wiring is editing the gate."
+  });
+  if (c.before != null && before === null) return null;
+  if (after === null) {
+    if (c.before == null) return [];
+    return [finding("the settings file no longer parses as JSON \u2014 the runtime ignores it, hooks and all")];
+  }
+  return settingsWeakening(before, after, siblingOf(c, changes, ctx)).map(finding);
+}
+function policyFindings(c, policy) {
+  if (c.after == null) return null;
+  const added = c.before == null;
+  const reasons = added ? policyAddWeakening(c.after) : policyWeakening(c.before, c.after);
+  if (reasons === null) return null;
+  return reasons.map(
+    (reason) => makeFinding(RULE6, policy, {
+      file: c.path,
+      message: added ? `A policy file was added that weakens the baseline: ${reason}.` : `The policy was weakened: ${reason}.`,
+      evidence: reason,
+      remediation: "A change that weakens the guardrail is a high-risk edit requiring human sign-off, not an automated pass."
+    })
+  );
+}
+function renameKept(c) {
+  if (!c.oldPath) return false;
+  const id = hookIdentity(c.oldPath);
+  if (id === null || hookIdentity(c.path) !== id) return false;
+  return c.before != null && c.after != null ? c.before === c.after : c.hunks.length === 0;
+}
+function configFindings(c, policy) {
+  if (c.before == null || c.after == null) return null;
+  const before = parseDoc(c.before);
+  const after = parseDoc(c.after);
+  if (before === null) return null;
+  const reasons = after === null ? ["the file no longer parses as YAML \u2014 the tool that reads it runs nothing"] : isLefthook(c.path) ? lefthookWeakening(before, after) : preCommitWeakening(before, after);
+  return reasons.map(
+    (reason) => makeFinding(RULE6, policy, {
+      file: c.path,
+      message: `The hook configuration was weakened: ${reason}.`,
+      evidence: reason,
+      remediation: "Leave the entry that runs the gate as `tamperward init` wrote it. Skipping, staging-off or scoping it is disabling it."
+    })
+  );
+}
+function updateIndexHiding(toks, policy) {
+  if (!toks.some((t) => t === "git" || t.endsWith("/git")) || !toks.includes("update-index")) return null;
+  const hide = toks.find((t) => /^--(?:skip-worktree|assume-unchanged)$/.test(t));
+  if (hide && toks.some((t) => isProtected(t, policy))) {
+    return `git update-index ${hide} hides a protected file from every git diff \u2014 edits to it no longer reach the sweep or the pre-commit gate`;
+  }
+  if (toks.some((t) => /^--chmod=-x$/.test(t)) && toks.some((t) => isProtected(t, policy, "hooks"))) {
+    return "git update-index --chmod=-x clears the execute bit on a protected hook through the index, which disables it";
+  }
+  return null;
+}
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
   certainty: "mechanical",
-  run(changes, policy) {
+  run(changes, policy, _view, ctx) {
     const out2 = [];
     for (const c of changes) {
+      let semantic;
       if (c.kind === "file") {
         const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false);
-        if (!targetsHook) continue;
-        if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec(c.oldMode) && !ownerExec(c.newMode)) {
+        if (!targetsHook) {
+          if (isPackageJson(c.path) && c.before != null && c.after != null) {
+            for (const reason of packageJsonWeakening(c.before, c.after)) {
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  message: `The hook installation was weakened: ${reason}.`,
+                  evidence: reason,
+                  remediation: "Keep the lifecycle script that installs the git hooks. Without it a clone runs no hook at all."
+                })
+              );
+            }
+          }
+          continue;
+        }
+        if (c.op !== "delete" && c.oldMode && c.newMode && ownerExec2(c.oldMode) && !ownerExec2(c.newMode)) {
           out2.push(
             makeFinding(RULE6, policy, {
               file: c.path,
@@ -1474,7 +2139,7 @@ var hookTampering = {
               remediation: "Restore it. The hooks and the policy are protected assets, not obstacles to remove."
             })
           );
-        } else if (c.op === "rename") {
+        } else if (c.op === "rename" && !renameKept(c)) {
           out2.push(
             makeFinding(RULE6, policy, {
               file: c.path,
@@ -1483,22 +2148,27 @@ var hookTampering = {
               remediation: "Renaming a hook out of place disables it. Restore the original path."
             })
           );
-        } else if (c.path.endsWith(POLICY_FILE) && c.before != null && c.after != null && policyWeakening(c.before, c.after) !== null) {
-          for (const reason of policyWeakening(c.before, c.after) ?? []) {
-            out2.push(
-              makeFinding(RULE6, policy, {
-                file: c.path,
-                message: `The policy was weakened: ${reason}.`,
-                evidence: reason,
-                remediation: "A change that weakens the guardrail is a high-risk edit requiring human sign-off, not an automated pass."
-              })
-            );
+        } else if ((c.path.endsWith(POLICY_FILE) || isClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, changes, policy, ctx)) !== null) {
+          out2.push(...semantic);
+        } else if (c.op === "rename") {
+        } else if (isCodeowners(c.path)) {
+          if (c.before != null && c.after != null) {
+            for (const reason of codeownersWeakening(c.before, c.after)) {
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  message: `CODEOWNERS was weakened: ${reason}.`,
+                  evidence: reason,
+                  remediation: "Keep a code owner on the workflows, the policy and the hooks. That rule is the only thing requiring a human on a change to the gate itself."
+                })
+              );
+            }
           }
+        } else if ((isLefthook(c.path) || isPreCommitConfig(c.path)) && (semantic = configFindings(c, policy)) !== null) {
+          out2.push(...semantic);
         } else if (!c.path.endsWith(POLICY_FILE)) {
           const added = addedLines(c);
-          const removed = removedLines(c);
-          const live = added.filter((l) => !isShellComment(l.content));
-          const earlyExit = added.find((l) => /^\s*exit\s+0\s*$/.test(l.content));
+          const earlyExit = added.find((l) => insertsPassingExit(l.content));
           if (earlyExit) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -1510,20 +2180,30 @@ var hookTampering = {
               })
             );
           }
-          for (const l of removed) {
-            if (isShellComment(l.content) || !l.content.trim()) continue;
-            const m = l.content.match(HOOK_INVOCATION);
-            if (!m) continue;
-            if (live.some((a) => a.content.includes(m[0]))) continue;
+          const deadGuard = c.before == null || c.after == null ? added.find((l) => insertsDeadGuard(l.content)) : void 0;
+          if (deadGuard) {
             out2.push(
               makeFinding(RULE6, policy, {
                 file: c.path,
-                message: `A check invocation (\`${m[0]}\`) was removed from a protected hook.`,
-                evidence: l.content.trim(),
-                remediation: "Restore the check. Removing or commenting out the gate's invocation disables it just as surely as deleting the hook."
+                line: deadGuard.newLine ?? void 0,
+                message: "A guard that can never be true was inserted into a protected hook \u2014 what it wraps no longer runs.",
+                evidence: deadGuard.content.trim(),
+                remediation: "Remove the dead condition. A check behind `if false` is a removed check."
+              })
+            );
+          }
+          const beforeLines = c.before != null ? c.before.split("\n") : removedLines(c).map((l) => l.content);
+          const afterLines = c.after != null ? c.after.split("\n") : added.map((l) => l.content);
+          const lost = scriptWeakening(beforeLines, afterLines);
+          if (lost.length) {
+            out2.push(
+              makeFinding(RULE6, policy, {
+                file: c.path,
+                message: `A check invocation was removed from a protected hook: ${lost[0].reason}.`,
+                evidence: lost[0].evidence,
+                remediation: "Restore the check. Removing, commenting out, guarding off or swallowing the gate's exit status disables it just as surely as deleting the hook."
               })
             );
-            break;
           }
         } else {
           const INLINE = /^\s*([A-Za-z0-9_-]+):\s*\{[^}]*\bseverity:\s*(block|warn)\b/;
@@ -1559,18 +2239,19 @@ var hookTampering = {
         }
       } else {
         for (const seg of segments(c.raw)) {
-          const hitsHook = tokens(seg).map(unquote).some((t) => isProtected(t, policy, "hooks"));
-          if (!hitsHook) continue;
-          let why = null;
-          if (chmodTouchesExec(seg)) {
-            why = "chmod alters execute permission on a hook, which can disable it";
-          } else if (/\brm\b/.test(seg)) {
-            why = "rm deletes a protected hook";
-          } else if (/\btruncate\b/.test(seg) || /(?:^|\s)>\s*\S/.test(seg)) {
-            why = "a redirect/truncate empties a protected hook";
-          } else if (/\b(tee|sed|cp|dd|install|mv)\b/.test(seg)) {
-            why = "a shell rewrite (tee/sed/cp/dd/install/mv) replaces a protected hook in place";
+          const toks = tokens(seg).map(unquote);
+          const hiding = updateIndexHiding(toks, policy);
+          if (hiding) {
+            out2.push(
+              makeFinding(RULE6, policy, {
+                message: `Hook tampering via shell: ${hiding}.`,
+                evidence: seg,
+                remediation: "Leave protected files visible to git. Hiding one from the diff hides it from the gate, which is the tamper \u2014 use `--no-skip-worktree` / `--no-assume-unchanged` to undo it."
+              })
+            );
+            continue;
           }
+          const why = shellWritesHook(seg, toks, policy);
           if (why) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -1790,7 +2471,7 @@ var testContentRemoval = {
 
 // src/detectors/snapshot-rewrite.ts
 var RULE9 = "snapshot-rewrite";
-var RUNNER = /\b(?:jest|vitest|playwright|ava)\b/;
+var RUNNER2 = /\b(?:jest|vitest|playwright|ava)\b/;
 var PM_TEST_SCRIPT = /(?:^|\s)(?:npm|pnpm|yarn|bun)\s+(?:t|tst|test|run(?:-script)?\s+\S*test\S*)(?:\s|$)/;
 var UPDATE_ANY = /--(?:update-?[sS]napshots?|test-update-snapshots|snapshot-update)\b/;
 var UPDATE_WITH_RUNNER = /(?:^|\s)(?:-u|--update)(?:\s|$)/;
@@ -1817,7 +2498,7 @@ var snapshotRewrite = {
         for (const seg of segments(c.raw)) {
           let why = null;
           if (UPDATE_ANY.test(seg)) why = "the snapshot-update flag rewrites every failing snapshot to match current output";
-          else if ((RUNNER.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
+          else if ((RUNNER2.test(seg) || PM_TEST_SCRIPT.test(seg)) && UPDATE_WITH_RUNNER.test(seg)) why = "running the test runner in update mode rewrites failing snapshots to match current output";
           else if (INSTA_ACCEPT.test(seg)) why = "cargo insta accept rewrites every pending snapshot to match current output";
           else if (UPDATE_EXPECT.test(seg)) why = "UPDATE_EXPECT=1 rewrites every expect-test expectation to match current output";
           else if (REGEN_SCRIPT.test(seg)) why = "a regeneration script rewrites the recorded expected output from current output";
@@ -1899,6 +2580,12 @@ var allDetectors = [
 ];
 
 // src/engine.ts
+var GUARDED_RULE = "hook-tampering";
+var BASELINE_HOOKS = defaultPolicy().protected.hooks;
+function isGuardedFinding(f) {
+  if (f.rule !== GUARDED_RULE || !f.file) return false;
+  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS);
+}
 function key(f) {
   return `${f.rule}|${f.file ?? ""}|${f.line ?? ""}|${f.evidence}`;
 }
@@ -1910,13 +2597,13 @@ function isSuppressed(c, policy) {
 function activeChanges(changes, policy) {
   return changes.filter((c) => !isSuppressed(c, policy));
 }
-function evaluate(changes, policy, detectors = allDetectors, view) {
+function evaluate(changes, policy, detectors = allDetectors, view, ctx) {
   const active = activeChanges(changes, policy);
   const out2 = [];
   for (const d of detectors) {
-    if (!isEnabled(d.id, policy)) continue;
+    if (d.id !== GUARDED_RULE && !isEnabled(d.id, policy)) continue;
     try {
-      out2.push(...d.run(active, policy, view));
+      out2.push(...d.run(active, policy, view, ctx));
     } catch (e) {
       process.stderr.write(`tamperward: detector "${d.id}" errored: ${String(e)}
 `);
@@ -1939,20 +2626,25 @@ function evaluate(changes, policy, detectors = allDetectors, view) {
     seen.add(k);
     return true;
   });
-  return deduped.filter((f) => {
-    if (f.rule !== "detector-error" && !isEnabled(f.rule, policy)) return false;
+  return deduped.map(pinGuarded).filter((f) => {
+    if (f.rule === "detector-error" || isGuardedFinding(f)) return true;
+    if (!isEnabled(f.rule, policy)) return false;
     const ex = policy.rules[f.rule]?.exclude;
     if (!ex?.length || !f.file || isPolicyFile(f.file)) return true;
     return !matchesAny(f.file, ex);
   });
 }
+function pinGuarded(f) {
+  if (!isGuardedFinding(f) || f.severity === "block") return f;
+  return { ...f, severity: "block", signoff: { ...f.signoff, required: true } };
+}
 function hasBlocking(findings) {
   return findings.some((f) => f.severity === "block");
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync2, existsSync } from "node:fs";
-import { isAbsolute, join as join2, posix } from "node:path";
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
+import { isAbsolute, join as join3, posix } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -2076,9 +2768,9 @@ function parseOrThrow(src, where) {
   return parsePolicy(raw, where);
 }
 function loadPolicy(cwd = process.cwd()) {
-  const path = join2(cwd, POLICY_FILE);
-  if (!existsSync(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync2(path, "utf8"), POLICY_FILE);
+  const path = join3(cwd, POLICY_FILE);
+  if (!existsSync2(path)) return defaultPolicy();
+  return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -2088,8 +2780,8 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
-import { dirname, join as join3 } from "node:path";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
+import { dirname, join as join4 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
   return createHash("sha256").update(`${rule}\0${file ?? ""}\0${evidence}`).digest("hex").slice(0, 16);
@@ -2100,13 +2792,13 @@ function ledgerPath(cwd, policy) {
   if (!ledgerInsideRepo(rel)) {
     throw new PolicyError(`signoff.ledger must be a relative path inside the repository, got ${JSON.stringify(rel)}`);
   }
-  return join3(cwd, rel);
+  return join4(cwd, rel);
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync2(p)) return [];
+  if (!existsSync3(p)) return [];
   const out2 = [];
-  for (const line of readFileSync3(p, "utf8").split("\n")) {
+  for (const line of readFileSync4(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -2449,7 +3141,7 @@ function check(opts) {
     return 2;
   }
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
-  let findings = evaluate(changes, policy, void 0, view);
+  let findings = evaluate(changes, policy, void 0, view, { cwd });
   const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
   findings = remaining;
   if (cleared.length) {
@@ -2474,20 +3166,21 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, statSync as statSync4 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
+import { join as join9 } from "node:path";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFileSync as readFileSync4, existsSync as existsSync3, writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { readFileSync as readFileSync5, existsSync as existsSync4, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute2, join as join4, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, join as join5, relative, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
 function readDisk(path) {
   try {
-    return existsSync3(path) ? readFileSync4(path, "utf8") : null;
+    return existsSync4(path) ? readFileSync5(path, "utf8") : null;
   } catch {
     return null;
   }
@@ -2510,11 +3203,11 @@ function synthFileChange(displayPath, before, after) {
   if (before === null) op = "add";
   else if (after === null) op = "delete";
   else op = "modify";
-  const dir = mkdtempSync(join4(tmpdir(), "hf-"));
+  const dir = mkdtempSync(join5(tmpdir(), "hf-"));
   let raw = "";
   try {
-    const a = join4(dir, "a");
-    const b = join4(dir, "b");
+    const a = join5(dir, "a");
+    const b = join5(dir, "b");
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
@@ -2599,22 +3292,22 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join6 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
-  return join5(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
+  return join6(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync4(p)) {
-      const v = readFileSync5(p, "utf8").trim();
+    if (existsSync5(p)) {
+      const v = readFileSync6(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -2640,8 +3333,8 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join6 } from "node:path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join7 } from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -2653,23 +3346,32 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute3(d) ? d : join6(cwd, d);
+    return isAbsolute3(d) ? d : join7(cwd, d);
   } catch {
     return null;
   }
 }
-function ptreePath(cwd, sessionId) {
+function statePath(cwd, sessionId, kind) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join6(gd, "tamperward");
-  return join6(dir, `ptree-${sessionId.replace(UNSAFE2, "")}.json`);
+  const dir = join7(gd, "tamperward");
+  return join7(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
+}
+function ptreePath(cwd, sessionId) {
+  return statePath(cwd, sessionId, "ptree");
+}
+function turnTreePath(cwd, sessionId) {
+  return statePath(cwd, sessionId, "turntree");
 }
 var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
+function contentHash(content) {
+  return sha(Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"));
+}
 function snapshotProtected(cwd, policy, prev) {
   const out2 = {};
   const walk = (rel) => {
-    const abs2 = rel ? join6(cwd, rel) : cwd;
+    const abs2 = rel ? join7(cwd, rel) : cwd;
     let names;
     try {
       names = readdirSync(abs2);
@@ -2681,7 +3383,7 @@ function snapshotProtected(cwd, policy, prev) {
       const r = rel ? `${rel}/${name}` : name;
       let st;
       try {
-        st = statSync(join6(cwd, r));
+        st = statSync(join7(cwd, r));
       } catch {
         continue;
       }
@@ -2689,7 +3391,7 @@ function snapshotProtected(cwd, policy, prev) {
       else if (st.isFile() && isProtected(r, policy)) {
         let hash = "";
         try {
-          hash = sha(readFileSync6(join6(cwd, r)));
+          hash = sha(readFileSync7(join7(cwd, r)));
         } catch {
           hash = "unreadable";
         }
@@ -2710,35 +3412,45 @@ function driftBetween(expected, current) {
   }
   return { changed, deleted };
 }
-function loadPtree(cwd, sessionId) {
-  const p = ptreePath(cwd, sessionId);
-  if (!p || !existsSync5(p)) return null;
+function loadTree(p) {
+  if (!p || !existsSync6(p)) return null;
   try {
-    return JSON.parse(readFileSync6(p, "utf8"));
+    return JSON.parse(readFileSync7(p, "utf8"));
   } catch {
     return null;
   }
 }
-function savePtree(cwd, sessionId, tree) {
-  const p = ptreePath(cwd, sessionId);
+function saveTree(p, tree) {
   if (!p) return;
   try {
-    mkdirSync3(join6(p, ".."), { recursive: true });
+    mkdirSync3(join7(p, ".."), { recursive: true });
     writeFileSync3(p, JSON.stringify(tree));
   } catch {
   }
 }
+function loadPtree(cwd, sessionId) {
+  return loadTree(ptreePath(cwd, sessionId));
+}
+function savePtree(cwd, sessionId, tree) {
+  saveTree(ptreePath(cwd, sessionId), tree);
+}
+function loadTurnTree(cwd, sessionId) {
+  return loadTree(turnTreePath(cwd, sessionId));
+}
+function saveTurnTree(cwd, sessionId, tree) {
+  saveTree(turnTreePath(cwd, sessionId), tree);
+}
 
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2, watch } from "node:fs";
-import { join as join7 } from "node:path";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync2, watch } from "node:fs";
+import { join as join8 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
   try {
     const st = statSync2(abs2);
     if (!st.isFile()) return { mode: st.mode, size: null, hash: null };
-    const hash = createHash3("sha256").update(readFileSync7(abs2)).digest("hex").slice(0, 16);
+    const hash = createHash3("sha256").update(readFileSync8(abs2)).digest("hex").slice(0, 16);
     return { mode: st.mode, size: st.size, hash };
   } catch {
     return { mode: null, size: null, hash: null };
@@ -2746,7 +3458,7 @@ function snap(abs2) {
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
-  return join7(gitDir(cwd) ?? join7(cwd, ".git"), "tamperward", "fsevents.jsonl");
+  return join8(gitDir(cwd) ?? join8(cwd, ".git"), "tamperward", "fsevents.jsonl");
 }
 function watchTree(dir, cb) {
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
@@ -2763,12 +3475,12 @@ function watchTree(dir, cb) {
     if (watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
-      w = watch(rel ? join7(dir, rel) : dir, (kind, fname) => {
+      w = watch(rel ? join8(dir, rel) : dir, (kind, fname) => {
         if (!fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync2(join7(dir, child)).isDirectory()) addDir(child);
+          if (statSync2(join8(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -2781,7 +3493,7 @@ function watchTree(dir, cb) {
     addDir(rel);
     let names = [];
     try {
-      names = readdirSync2(rel ? join7(dir, rel) : dir);
+      names = readdirSync2(rel ? join8(dir, rel) : dir);
     } catch {
       return;
     }
@@ -2789,7 +3501,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync2(join7(dir, child)).isDirectory()) walk(child);
+        if (statSync2(join8(dir, child)).isDirectory()) walk(child);
       } catch {
       }
     }
@@ -2801,13 +3513,13 @@ function watchTree(dir, cb) {
 }
 function startWatcher(dir, log, policy) {
   try {
-    mkdirSync4(join7(log, ".."), { recursive: true });
+    mkdirSync4(join8(log, ".."), { recursive: true });
   } catch {
   }
   const last = /* @__PURE__ */ new Map();
   return watchTree(dir, (kind, rel) => {
     if (SKIP2.test(rel) || !isProtected(rel, policy)) return;
-    const s = snap(join7(dir, rel));
+    const s = snap(join8(dir, rel));
     const key2 = `${s.hash}:${s.mode}`;
     if (last.get(rel) === key2) return;
     last.set(rel, key2);
@@ -2834,7 +3546,7 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync9, statSync as statSync3 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
@@ -2844,7 +3556,7 @@ function readEvents(log, offset) {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync8(log, "utf8").slice(offset);
+  const raw = readFileSync9(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -2897,7 +3609,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync9(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -2951,12 +3663,107 @@ function verdict(blocks, kind) {
   } : { decision: "block", reason };
   return { exitCode: 0, stdout: JSON.stringify(payload) + "\n" };
 }
+function fileChanges(changes) {
+  return changes.filter((c) => c.kind === "file");
+}
+function hashOnDisk(cwd, rel) {
+  try {
+    return contentHash(readFileSync10(join9(cwd, rel)));
+  } catch {
+    return null;
+  }
+}
+function gitMode(mode) {
+  return (mode & 64) !== 0 ? "100755" : "100644";
+}
+function turnView(cwd, sessionId, policy, base) {
+  const tracked = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of fileChanges(tracked)) {
+    seen.add(c.path);
+    if (c.oldPath) seen.add(c.oldPath);
+  }
+  const turnTree = loadTurnTree(cwd, sessionId);
+  const untracked = untrackedAdds({ cwd }, (rel) => isProtected(rel, policy), seen).filter(
+    (c) => c.kind !== "file" || !turnTree || turnTree[c.path]?.hash !== hashOnDisk(cwd, c.path)
+  );
+  for (const c of fileChanges(untracked)) seen.add(c.path);
+  const trusted = base ?? "HEAD";
+  const hidden = [];
+  for (const rel of hiddenTrackedPaths({ cwd })) {
+    if (seen.has(rel) || !isProtected(rel, policy)) continue;
+    hidden.push(...synthFileChange(rel, fileAt(trusted, rel, { cwd }), fileOnDisk(rel, { cwd })));
+  }
+  return [...tracked, ...untracked, ...hidden];
+}
+function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree) {
+  const d = driftBetween(expected, current);
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of fileChanges(covered)) {
+    seen.add(c.path);
+    if (c.oldPath) seen.add(c.oldPath);
+  }
+  const changes = [];
+  const blocks = [];
+  const trusted = base ?? "HEAD";
+  const candidates = base ? [base, "HEAD", ""] : ["HEAD", ""];
+  for (const rel of [...d.changed, ...d.deleted]) {
+    if (seen.has(rel)) continue;
+    const after = fileOnDisk(rel, { cwd });
+    const trustedBlob = fileAt(trusted, rel, { cwd });
+    const atGitState = after != null && trustedBlob != null && contentHash(after) === contentHash(trustedBlob);
+    const atTurnStart = current[rel] != null && turnTree?.[rel]?.hash === current[rel].hash;
+    if ((atGitState || atTurnStart) && current[rel] && expected[rel] && current[rel].mode === expected[rel].mode) {
+      continue;
+    }
+    const want = expected[rel]?.hash;
+    let before = null;
+    for (const rev of candidates) {
+      const blob = fileAt(rev, rel, { cwd });
+      if (blob != null && contentHash(blob) === want) {
+        before = blob;
+        break;
+      }
+    }
+    if (before == null) {
+      blocks.push({
+        rule: "hidden-drift",
+        severity: "block",
+        file: rel,
+        message: `Protected file ${rel} changed outside git's view, and its sanctioned content cannot be reconstructed to judge the change.`,
+        evidence: rel,
+        remediation: "Restore the file to its last sanctioned content (git restore, or undo the edit) and bring it back into git's view (git update-index --no-skip-worktree / --no-assume-unchanged); make the change through a tool call the gate can see.",
+        signoff: { required: true, command: `tamperward allow hidden-drift --file ${rel} --reason "..."` }
+      });
+      continue;
+    }
+    const synth = synthFileChange(rel, before, after);
+    if (synth.length > 0) {
+      changes.push(...synth);
+    } else if (after != null && current[rel] && expected[rel] && current[rel].mode !== expected[rel].mode) {
+      changes.push({
+        kind: "file",
+        path: rel,
+        oldPath: null,
+        op: "modify",
+        before,
+        after,
+        binary: false,
+        hunks: [],
+        oldMode: gitMode(expected[rel].mode),
+        newMode: gitMode(current[rel].mode)
+      });
+    }
+  }
+  return { changes, blocks };
+}
 function effectDriftBlocks(cwd, sessionId, policy) {
   if (!sessionId || !isGitRepo(cwd)) return null;
   const expected = loadPtree(cwd, sessionId);
   const current = snapshotProtected(cwd, policy, expected ?? void 0);
   if (!expected) {
     savePtree(cwd, sessionId, current);
+    if (!loadTurnTree(cwd, sessionId)) saveTurnTree(cwd, sessionId, current);
     return null;
   }
   const d = driftBetween(expected, current);
@@ -2965,12 +3772,13 @@ function effectDriftBlocks(cwd, sessionId, policy) {
     return null;
   }
   const base = turnBaseline(cwd, sessionId);
-  const all = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
+  const all = turnView(cwd, sessionId, policy, base);
   const drifted = /* @__PURE__ */ new Set([...d.changed, ...d.deleted]);
   const scoped = all.filter(
     (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
   );
-  const blocks = evaluate(scoped, policy, void 0, "turn").filter((f) => f.severity === "block");
+  const gap = uncoveredDrift(cwd, policy, expected, current, scoped, base, loadTurnTree(cwd, sessionId));
+  const blocks = evaluate([...scoped, ...gap.changes], policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks);
   if (blocks.length > 0) return blocks;
   savePtree(cwd, sessionId, current);
   return null;
@@ -3003,7 +3811,7 @@ function preToolUseVerdict(input) {
     const driftBlocks = effectDriftBlocks(cwd, input.session_id, policy);
     if (driftBlocks) return verdict(driftBlocks, "PreToolUse");
     const changes = changesFromClaudeHook(input, cwd);
-    const blocks = evaluate(changes, policy, void 0, "tool-call").filter((f) => f.severity === "block");
+    const blocks = evaluate(changes, policy, void 0, "tool-call", { cwd }).filter((f) => f.severity === "block");
     if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
     return verdict(blocks, "PreToolUse");
   } catch (e) {
@@ -3019,10 +3827,10 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync6(log)) return none;
+  if (!existsSync7(log)) return none;
   let offset = 0;
-  if (cp && existsSync6(cp)) {
-    const n = Number(readFileSync9(cp, "utf8"));
+  if (cp && existsSync7(cp)) {
+    const n = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -3036,7 +3844,7 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   const finalHash = (path) => {
     try {
       if (!statSync4(`${cwd}/${path}`).isFile()) return null;
-      return createHash4("sha256").update(readFileSync9(`${cwd}/${path}`)).digest("hex").slice(0, 16);
+      return createHash4("sha256").update(readFileSync10(`${cwd}/${path}`)).digest("hex").slice(0, 16);
     } catch {
       return null;
     }
@@ -3071,13 +3879,22 @@ function stopVerdict(input) {
   try {
     const policy = loadPolicy(cwd);
     const base = turnBaseline(cwd, input.session_id);
-    const changes = base ? diffSince(base, { cwd }) : diffWorktree({ cwd });
-    blocks = evaluate(changes, policy, void 0, "turn").filter((f) => f.severity === "block");
+    let changes = turnView(cwd, input.session_id, policy, base);
+    const expected = loadPtree(cwd, input.session_id);
+    const current = input.session_id ? snapshotProtected(cwd, policy, expected ?? void 0) : null;
+    let hiddenBlocks = [];
+    if (expected && current) {
+      const gap = uncoveredDrift(cwd, policy, expected, current, changes, base, loadTurnTree(cwd, input.session_id));
+      changes = changes.concat(gap.changes);
+      hiddenBlocks = gap.blocks;
+    }
+    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks);
     const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
     blocks = blocks.concat(transient.blocks);
     commitCursor = transient.commit;
-    if (blocks.length === 0 && input.session_id) {
-      savePtree(cwd, input.session_id, snapshotProtected(cwd, policy, loadPtree(cwd, input.session_id) ?? void 0));
+    if (blocks.length === 0 && input.session_id && current) {
+      savePtree(cwd, input.session_id, current);
+      saveTurnTree(cwd, input.session_id, current);
     }
   } catch (e) {
     return failClosed("Stop", errText(e));
@@ -3135,7 +3952,7 @@ function runAllow(opts) {
   const policy = loadPolicy(cwd);
   let findings;
   try {
-    findings = evaluate(diffWorktree({ cwd }), policy, void 0, "worktree");
+    findings = evaluate(diffWorktree({ cwd }), policy, void 0, "worktree", { cwd });
   } catch {
     process.stderr.write("tamperward: cannot read the working tree (not a git repo?).\n");
     return 2;
@@ -3170,8 +3987,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute4, join as join8, relative as relative2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute4, join as join10, relative as relative2, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
@@ -3236,7 +4053,7 @@ function shippedVersion() {
     const here = dirname3(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync10(join8(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync11(join10(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -3343,13 +4160,13 @@ function readWorkflowMark(src) {
   if (!m) return null;
   return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
 }
-function toolSet(matcher2) {
+function toolSet2(matcher2) {
   const m = String(matcher2 ?? "").trim();
   if (m === "" || m === "*") return null;
   return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
 }
 function missingTools(matcher2) {
-  const have = toolSet(matcher2);
+  const have = toolSet2(matcher2);
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
@@ -3369,8 +4186,8 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join8(cwd, POLICY_FILE);
-  if (existsSync7(path)) {
+  const path = join10(cwd, POLICY_FILE);
+  if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -3388,12 +4205,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join8(cwd, rel);
+  const path = join10(cwd, rel);
   let settings = {};
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync10(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -3427,7 +4244,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync7(path) ? "update" : "create",
+    status: existsSync8(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -3446,7 +4263,7 @@ function planClaudeHooks(cwd) {
         });
       }
       for (const m of stale) {
-        m.matcher = [...toolSet(m.matcher) ?? /* @__PURE__ */ new Set(), ...missingTools(m.matcher)].join("|");
+        m.matcher = [...toolSet2(m.matcher) ?? /* @__PURE__ */ new Set(), ...missingTools(m.matcher)].join("|");
       }
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
@@ -3486,7 +4303,7 @@ function hooksDir(cwd) {
     if (out2) return resolve2(cwd, out2);
   } catch {
   }
-  return existsSync7(join8(cwd, ".git")) ? join8(cwd, ".git", "hooks") : null;
+  return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative2(cwd, path);
@@ -3513,30 +4330,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync7(join8(cwd, ".husky"))) {
-    path = join8(cwd, ".husky", "pre-commit");
+  if (existsSync8(join10(cwd, ".husky"))) {
+    path = join10(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join8(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join10(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename(dir) === "_" && basename(dirname3(dir)) === ".husky") {
-      path = join8(dirname3(dir), "pre-commit");
+      path = join10(dirname3(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join8(dir, "pre-commit");
+      path = join10(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join8(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join10(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
-  if (existsSync7(path) && !statSync5(path).isFile()) {
+  if (existsSync8(path) && !statSync5(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync11(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -3625,10 +4442,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync7(join8(cwd, r))
+    (r) => existsSync8(join10(cwd, r))
   );
-  const path = join8(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync10(path, "utf8") : null;
+  const path = join10(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync11(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -3661,12 +4478,12 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join8(cwd, rel);
+  const path = join10(cwd, rel);
   const write = () => {
     mkdirSync5(dirname3(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return {
       item: "ci",
       path: rel,
@@ -3677,7 +4494,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync10(path, "utf8");
+    src = readFileSync11(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -3776,15 +4593,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname4, join as join11, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join13, resolve as resolve3 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join9 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync12 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -3797,7 +4614,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute5(d) ? d : join9(cwd, d);
+    return isAbsolute5(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -3822,9 +4639,9 @@ function objectRewriteState(cwd) {
       parts.push(`${rel}:<no-git-dir>`);
       continue;
     }
-    const p = join9(dir, rel);
+    const p = join11(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync12(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -3835,8 +4652,8 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync, statSync as statSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync, statSync as statSync6 } from "node:fs";
+import { join as join12 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -3849,7 +4666,7 @@ function treeFingerprint(cwd) {
     h.update(rel);
     h.update("\0");
     try {
-      h.update(readFileSync12(join10(cwd, rel)));
+      h.update(readFileSync13(join12(cwd, rel)));
     } catch {
       h.update("<unreadable>");
     }
@@ -3858,7 +4675,7 @@ function treeFingerprint(cwd) {
   return h.digest("hex");
 }
 function depsFingerprint(cwd) {
-  const root = join10(cwd, "node_modules");
+  const root = join12(cwd, "node_modules");
   const h = createHash7("sha256");
   const walk = (dir) => {
     let entries;
@@ -3868,12 +4685,12 @@ function depsFingerprint(cwd) {
       return;
     }
     for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join10(dir, e.name);
+      const p = join12(dir, e.name);
       if (e.isDirectory()) walk(p);
       else if (e.isFile()) {
         h.update(p);
         try {
-          h.update(readFileSync12(p));
+          h.update(readFileSync13(p));
           h.update(String(statSync6(p).mode));
         } catch {
           h.update("<unreadable>");
@@ -3988,7 +4805,7 @@ function baseIsAncestorOfHead(base, cwd) {
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join11(cwd, rel);
+    const src = join13(cwd, rel);
     let st;
     try {
       st = statSync7(src);
@@ -3996,18 +4813,18 @@ function materialize(cwd, dest) {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join11(dest, rel);
+    const out2 = join13(dest, rel);
     mkdirSync6(dirname4(out2), { recursive: true });
     dropSymlink(out2);
     if (lstatSync(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync13(src));
+      writeFileSync6(out2, readFileSync14(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve3(cwd, "node_modules");
-  if (existsSync9(nm)) symlinkSync(nm, join11(dest, "node_modules"), "dir");
+  if (existsSync10(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -4040,11 +4857,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join11(dest, rel);
+    const p = join13(dest, rel);
     try {
       const st = lstatSync(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync13(p));
+      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync14(p));
     } catch {
       h.update("<gone>");
     }
@@ -4067,7 +4884,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync7("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join11(dest, e.path);
+    const out2 = join13(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
     rmSync2(out2, { force: true });
     if (e.mode === "120000") {
@@ -4082,7 +4899,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync2(join11(dest, rel), { force: true });
+    rmSync2(join13(dest, rel), { force: true });
     removed++;
   }
   return { restored, removed };
@@ -4124,8 +4941,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join11(scratch, "npmrc-user");
-  const globalRc = join11(scratch, "npmrc-global");
+  const userRc = join13(scratch, "npmrc-user");
+  const globalRc = join13(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -4135,8 +4952,8 @@ function suiteEnv(scratch) {
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join11(tmpdir2(), "tw-verify-run-"));
-  const outFile = join11(outDir, "result.json");
+  const outDir = mkdtempSync2(join13(tmpdir2(), "tw-verify-run-"));
+  const outFile = join13(outDir, "result.json");
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
@@ -4149,7 +4966,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync13(outFile, "utf8"));
+      r = JSON.parse(readFileSync14(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -4200,8 +5017,8 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join11(visRoot, "t");
+  const visRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join13(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync2(d, { recursive: true, force: true });
@@ -4229,8 +5046,8 @@ function runVerify(opts) {
     out2("pristine run executes through it too. Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join11(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join11(priRoot, "t");
+  const priRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join13(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -4342,7 +5159,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -4351,7 +5168,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync15("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -4381,7 +5198,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync15(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {