tamperward 2.30.1 → 2.30.2

package/dist/cli/index.js

@@ -9837,7 +9837,8 @@ var init_test_deletion = __esm({
               fed.push(...toks);
               const testToks = source.filter((t) => expand(t).some(specPath));
               const dirToks = source.filter((t) => !t.startsWith("-") && !testToks.includes(t) && expand(t).some(dirPath));
-              if (testToks.length === 0 && dirToks.length === 0) continue;
+              const gitResetHard = toks.some((t) => t === "git" || t.endsWith("/git")) && toks.some((t) => t === "--hard" || t === "--merge" || t === "--keep");
+              if (testToks.length === 0 && dirToks.length === 0 && !(gitResetHard && rootHasProtected())) continue;
               const named = [...testToks, ...dirToks];
               let at = 0;
               while (at < toks.length && WRAPPERS.test(toks[at])) at++;
@@ -9856,9 +9857,19 @@ var init_test_deletion = __esm({
               const gitSub = cmd === "git" ? gitSubcommand(cmdToks) : null;
               const gitRestoresOld = (gitSub === "checkout" || gitSub === "restore") && (() => {
                 const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
+                const stagedRequested = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                const worktreeRequested = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                const stagedOnly = stagedRequested && !worktreeRequested;
+                if (stagedOnly) return false;
                 const revIdx = cmdToks.findIndex((t, i) => i >= 2 && !t.startsWith("-") && !named.includes(t) && t !== "--");
                 const rev2 = src ?? (revIdx >= 0 ? cmdToks[revIdx] : void 0);
-                if (!rev2 || rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true) return false;
+                if (rev2 && (rev2 === "HEAD" || rev2 === "@" || revIsHead(rev2, ctx) === true)) return false;
+                if (!rev2) {
+                  const stagedRequested2 = cmdToks.includes("--staged") || cmdToks.includes("-S");
+                  const worktreeRequested2 = cmdToks.includes("--worktree") || cmdToks.includes("-W");
+                  const stagedOnly2 = stagedRequested2 && !worktreeRequested2;
+                  return !stagedOnly2 && gitSub === "restore";
+                }
                 if (src || seg.includes(" -- ")) return true;
                 return revIdx >= 0 && cmdToks.some((t, i) => i > revIdx && named.includes(t));
               })();
@@ -9894,6 +9905,8 @@ var init_test_deletion = __esm({
                 why = "find -delete removes test files";
               } else if (gitRestoresOld) {
                 why = "git checkout <rev> replaces a test file with an older version";
+              } else if (gitSub === "reset" && gitResetHard) {
+                why = "git reset can discard changes to a test file";
               } else if (cmd === "mv") {
                 const dest = positional[positional.length - 1];
                 if (dest && testToks.length > 0 && !isSpec(dest)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.30.1",
+  "version": "2.30.2",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",