tamperward 2.37.0 → 2.37.1

package/dist/cli/index.js

@@ -12201,7 +12201,7 @@ var init_fs_events = __esm({
 
 // src/cli/audit.ts
 import { createHash as createHash6, randomBytes } from "node:crypto";
-import { appendFileSync as appendFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync10 } from "node:fs";
+import { appendFileSync as appendFileSync4, closeSync as closeSync3, existsSync as existsSync9, mkdirSync as mkdirSync5, openSync as openSync3, readSync as readSync3 } from "node:fs";
 import { dirname as dirname4, isAbsolute as isAbsolute8, join as join13, resolve as resolve4 } from "node:path";
 function sessionHash(sessionId) {
   if (!sessionId) return void 0;
@@ -12311,19 +12311,56 @@ function parseAuditEvent(value, line = 0) {
     ...typeof value.session === "string" ? { session: value.session } : {}
   };
 }
-function parseAuditJsonl(raw) {
-  const events = [];
-  raw.split(/\r?\n/).forEach((line, index) => {
-    if (!line.trim()) return;
-    let value;
-    try {
-      value = JSON.parse(line);
-    } catch {
-      throw new Error(`audit line ${index + 1} is not valid JSON`);
+function parseAuditLine(line, lineNumber) {
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch {
+    throw new Error(`audit line ${lineNumber} is not valid JSON`);
+  }
+  return parseAuditEvent(value, lineNumber);
+}
+function forEachAuditLine(file, onLine, maxLineBytes = MAX_AUDIT_LINE_BYTES) {
+  const fd = openSync3(file, "r");
+  try {
+    const chunk = Buffer.allocUnsafe(64 * 1024);
+    let pending = [];
+    let pendingBytes = 0;
+    let lineNumber = 0;
+    const emit3 = (parts) => {
+      lineNumber++;
+      let line = parts.length === 1 ? parts[0].toString("utf8") : Buffer.concat(parts).toString("utf8");
+      if (line.endsWith("\r")) line = line.slice(0, -1);
+      if (line.trim()) onLine(line, lineNumber);
+    };
+    for (; ; ) {
+      const read = readSync3(fd, chunk, 0, chunk.length, null);
+      if (read === 0) break;
+      let start = 0;
+      for (let i = 0; i < read; i++) {
+        if (chunk[i] !== 10) continue;
+        const part = chunk.subarray(start, i);
+        if (pendingBytes + part.length > maxLineBytes) {
+          throw new Error(`audit line ${lineNumber + 1} exceeds ${maxLineBytes} bytes (not an audit-v1 event)`);
+        }
+        emit3(pending.length ? [...pending, part] : [part]);
+        pending = [];
+        pendingBytes = 0;
+        start = i + 1;
+      }
+      if (start < read) {
+        const rest = Buffer.from(chunk.subarray(start, read));
+        pendingBytes += rest.length;
+        if (pendingBytes > maxLineBytes) {
+          throw new Error(`audit line ${lineNumber + 1} exceeds ${maxLineBytes} bytes (not an audit-v1 event)`);
+        }
+        pending.push(rest);
+      }
     }
-    events.push(parseAuditEvent(value, index + 1));
-  });
-  return events;
+    if (pending.length) emit3(pending);
+  } finally {
+    closeSync3(fd);
+  }
 }
 function parseSince(value, nowMs = Date.now()) {
   const relative13 = /^(\d+)(m|h|d)$/.exec(value);
@@ -12339,37 +12376,58 @@ function parseSince(value, nowMs = Date.now()) {
   }
   return parsed;
 }
-function summarizeAudit(events) {
-  const ordered = [...events].sort(
-    (a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp) || a.id.localeCompare(b.id)
-  );
+function createAuditAggregator() {
+  let events = 0;
+  let blocked = 0;
+  let warnings = 0;
   const rules = /* @__PURE__ */ new Map();
   const surfaces = /* @__PURE__ */ new Map();
   const sessions = /* @__PURE__ */ new Set();
-  for (const event of ordered) {
-    const bucket = rules.get(event.rule) ?? { events: 0, blocked: 0, warnings: 0 };
-    bucket.events++;
-    if (event.severity === "block") bucket.blocked++;
-    else bucket.warnings++;
-    rules.set(event.rule, bucket);
-    surfaces.set(event.surface, (surfaces.get(event.surface) ?? 0) + 1);
-    if (event.session) sessions.add(event.session);
-  }
-  const by_rule = [...rules.entries()].map(([rule, counts]) => ({ rule, ...counts })).sort((a, b) => b.events - a.events || a.rule.localeCompare(b.rule));
-  const by_surface = [...surfaces.entries()].map(([surface, count]) => ({ surface, events: count })).sort((a, b) => b.events - a.events || a.surface.localeCompare(b.surface));
+  const bounds = { first: null, last: null };
   return {
-    schema_version: AUDIT_SCHEMA_VERSION,
-    events: ordered.length,
-    blocked: ordered.filter((event) => event.severity === "block").length,
-    warnings: ordered.filter((event) => event.severity === "warn").length,
-    sessions: sessions.size,
-    first_event: ordered[0]?.timestamp ?? null,
-    last_event: ordered.at(-1)?.timestamp ?? null,
-    by_rule,
-    by_surface,
-    interpretation: "finding-is-not-proof-of-intent"
+    add(event) {
+      events++;
+      if (event.severity === "block") blocked++;
+      else warnings++;
+      const bucket = rules.get(event.rule) ?? { events: 0, blocked: 0, warnings: 0 };
+      bucket.events++;
+      if (event.severity === "block") bucket.blocked++;
+      else bucket.warnings++;
+      rules.set(event.rule, bucket);
+      surfaces.set(event.surface, (surfaces.get(event.surface) ?? 0) + 1);
+      if (event.session) sessions.add(event.session);
+      const ms = Date.parse(event.timestamp);
+      const { first, last } = bounds;
+      if (first === null || ms < first.ms || ms === first.ms && event.id.localeCompare(first.id) < 0) {
+        bounds.first = { ms, id: event.id, timestamp: event.timestamp };
+      }
+      if (last === null || ms > last.ms || ms === last.ms && event.id.localeCompare(last.id) > 0) {
+        bounds.last = { ms, id: event.id, timestamp: event.timestamp };
+      }
+    },
+    finish() {
+      const by_rule = [...rules.entries()].map(([rule, counts]) => ({ rule, ...counts })).sort((a, b) => b.events - a.events || a.rule.localeCompare(b.rule));
+      const by_surface = [...surfaces.entries()].map(([surface, count]) => ({ surface, events: count })).sort((a, b) => b.events - a.events || a.surface.localeCompare(b.surface));
+      return {
+        schema_version: AUDIT_SCHEMA_VERSION,
+        events,
+        blocked,
+        warnings,
+        sessions: sessions.size,
+        first_event: bounds.first === null ? null : bounds.first.timestamp,
+        last_event: bounds.last === null ? null : bounds.last.timestamp,
+        by_rule,
+        by_surface,
+        interpretation: "finding-is-not-proof-of-intent"
+      };
+    }
   };
 }
+function summarizeAudit(events) {
+  const aggregator = createAuditAggregator();
+  for (const event of events) aggregator.add(event);
+  return aggregator.finish();
+}
 function renderAuditStats(summary) {
   const out3 = [
     "TamperWard audit stats",
@@ -12408,21 +12466,24 @@ function runStats(opts = {}) {
     process.stdout.write(opts.json ? JSON.stringify(empty2) + "\n" : renderAuditStats(empty2));
     return 0;
   }
-  let events = parseAuditJsonl(readFileSync10(file, "utf8"));
-  if (cutoff !== null) {
-    events = events.filter((event) => Date.parse(event.timestamp) >= cutoff);
-  }
-  const summary = summarizeAudit(events);
+  const aggregator = createAuditAggregator();
+  forEachAuditLine(file, (line, lineNumber) => {
+    const event = parseAuditLine(line, lineNumber);
+    if (cutoff !== null && Date.parse(event.timestamp) < cutoff) return;
+    aggregator.add(event);
+  });
+  const summary = aggregator.finish();
   process.stdout.write(opts.json ? JSON.stringify(summary) + "\n" : renderAuditStats(summary));
   return 0;
 }
-var AUDIT_SCHEMA_VERSION, AUDIT_LOG_ENV, ALLOWED_KEYS;
+var AUDIT_SCHEMA_VERSION, AUDIT_LOG_ENV, MAX_AUDIT_LINE_BYTES, ALLOWED_KEYS;
 var init_audit = __esm({
   "src/cli/audit.ts"() {
     "use strict";
     init_repo_context();
     AUDIT_SCHEMA_VERSION = 1;
     AUDIT_LOG_ENV = "TAMPERWARD_AUDIT_LOG";
+    MAX_AUDIT_LINE_BYTES = 16 * 1024;
     ALLOWED_KEYS = /* @__PURE__ */ new Set([
       "schema_version",
       "id",
@@ -12438,14 +12499,14 @@ var init_audit = __esm({
 });
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "node:fs";
+import { readFileSync as readFileSync10, appendFileSync as appendFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
 function setSnapshotCache(cache3) {
   snapshotCache = cache3;
 }
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync10(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -12738,7 +12799,7 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync10(log)) return none;
   let offset = 0;
   if (cp && existsSync10(cp)) {
-    const n2 = Number(readFileSync11(cp, "utf8"));
+    const n2 = Number(readFileSync10(cp, "utf8"));
     offset = Number.isFinite(n2) ? n2 : 0;
   }
   const drained = drainEvents(log, offset);
@@ -13012,13 +13073,13 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync12, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync11, lstatSync as lstatSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync11, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
 function readServiceState(paths) {
   try {
-    const v = JSON.parse(readFileSync12(paths.state, "utf8"));
+    const v = JSON.parse(readFileSync11(paths.state, "utf8"));
     if (!isRecord(v)) return null;
     const { pid, version, root, started_at } = v;
     if (typeof pid !== "number" || typeof version !== "string" || typeof root !== "string" || typeof started_at !== "string") return null;
@@ -13579,7 +13640,7 @@ var init_safe_write = __esm({
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync13, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync12, realpathSync as realpathSync5 } from "node:fs";
 import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative4, resolve as resolve6 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -13673,34 +13734,34 @@ function verifierCandidates(cwd) {
     if (!candidates.includes(command)) candidates.push(command);
   };
   try {
-    const pkg = JSON.parse(readFileSync13(join15(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync12(join15(cwd, "package.json"), "utf8"));
     const test = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts.test : void 0;
     if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
   } catch {
   }
   try {
-    const pyproject = readFileSync13(join15(cwd, "pyproject.toml"), "utf8");
+    const pyproject = readFileSync12(join15(cwd, "pyproject.toml"), "utf8");
     if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
   } catch {
   }
   if (existsSync12(join15(cwd, "pytest.ini"))) add("pytest");
   try {
-    const setupCfg = readFileSync13(join15(cwd, "setup.cfg"), "utf8");
+    const setupCfg = readFileSync12(join15(cwd, "setup.cfg"), "utf8");
     if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
   } catch {
   }
   try {
-    const tox = readFileSync13(join15(cwd, "tox.ini"), "utf8");
+    const tox = readFileSync12(join15(cwd, "tox.ini"), "utf8");
     if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
   } catch {
   }
   try {
-    const cargo = readFileSync13(join15(cwd, "Cargo.toml"), "utf8");
+    const cargo = readFileSync12(join15(cwd, "Cargo.toml"), "utf8");
     if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
   } catch {
   }
   try {
-    const goMod = readFileSync13(join15(cwd, "go.mod"), "utf8");
+    const goMod = readFileSync12(join15(cwd, "go.mod"), "utf8");
     if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
   } catch {
   }
@@ -13772,7 +13833,7 @@ function planGitignore(cwd) {
   }
   const refused = refuseNonRegular(path);
   if (refused) return { item: "gitignore", path: rel, status: "error", detail: refused };
-  if (kind === "file") existing = readFileSync13(path, "utf8");
+  if (kind === "file") existing = readFileSync12(path, "utf8");
   try {
     const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
       cwd,
@@ -13830,7 +13891,7 @@ function planClaudeHooks(cwd) {
   if (existsSync12(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync13(path, "utf8"));
+      parsed = JSON.parse(readFileSync12(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -13972,7 +14033,7 @@ function planPreCommit(cwd) {
   const rel = display(cwd, path);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "pre-commit", path: rel, status: "error", detail: refused };
-  const existing = existsSync12(path) ? readFileSync13(path, "utf8") : null;
+  const existing = existsSync12(path) ? readFileSync12(path, "utf8") : null;
   const hookMode = () => existingMode(path, 493) | 73;
   if (existing === null) {
     return {
@@ -14063,7 +14124,7 @@ function planCodeowners(cwd) {
   const path = join15(cwd, existingRel ?? rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "codeowners", path: existingRel ?? rel, status: "error", detail: refused };
-  const existing = existingRel ? readFileSync13(path, "utf8") : null;
+  const existing = existingRel ? readFileSync12(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (existingRel !== void 0 && missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -14114,7 +14175,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync13(path, "utf8");
+    src = readFileSync12(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -14414,7 +14475,7 @@ import {
   existsSync as existsSync13,
   lstatSync as lstatSync8,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync6,
   statSync as statSync3
@@ -14472,7 +14533,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync14(path));
+      h.update(readFileSync13(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -14506,7 +14567,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync14(path));
+          h.update(readFileSync13(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -14677,7 +14738,7 @@ function venvProblem(root) {
   const cfg = join16(root, "pyvenv.cfg");
   if (!existsSync13(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync14(cfg, "utf8");
+    const body = readFileSync13(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -15193,7 +15254,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash11, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync15, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants3, readFileSync as readFileSync14, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve8 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -15238,7 +15299,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash11("sha256").update(readFileSync15(path)).digest("hex");
+  return createHash11("sha256").update(readFileSync14(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -15672,7 +15733,7 @@ var init_verifier_backend = __esm({
 // src/verification-state.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync16, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync15, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname8, join as join19 } from "node:path";
 function git2(args, cwd) {
   return execFileSync8("git", args, {
@@ -15721,7 +15782,7 @@ function interventionWiring(cwd) {
   return sources.map(([source, path]) => {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync16(path, "utf8"));
+      parsed = JSON.parse(readFileSync15(path, "utf8"));
     } catch {
       return { source, present: false };
     }
@@ -15874,7 +15935,7 @@ function readVerificationRecord(cwd) {
   if (!path) return null;
   let raw;
   try {
-    raw = readFileSync16(path, "utf8");
+    raw = readFileSync15(path, "utf8");
   } catch {
     return null;
   }
@@ -15923,7 +15984,7 @@ function readVerifyingMarker(cwd) {
   if (!path) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync16(path, "utf8"));
+    parsed = JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     return null;
   }
@@ -16035,7 +16096,7 @@ var init_verification_state = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, readlinkSync as readlinkSync3, rmSync as rmSync8, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync14 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync9, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync16, readlinkSync as readlinkSync3, rmSync as rmSync8, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname9, isAbsolute as isAbsolute11, join as join20, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
@@ -16295,7 +16356,7 @@ function overlayDigest(dest, paths) {
     try {
       const st = lstatSync9(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync17(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync16(p));
     } catch {
       h.update("<gone>");
     }
@@ -17092,7 +17153,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync18, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync17, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync9, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname10, join as join21, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -17246,7 +17307,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync18(resultFile, "utf8"));
+      state = JSON.parse(readFileSync17(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -17290,7 +17351,7 @@ function observerExited(pid) {
   if (!pidAlive4(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -17412,7 +17473,7 @@ function git4(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync18("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync17("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -17435,7 +17496,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n2 = Number(pid);
     if (n2 === process.pid) continue;
     try {
-      const stat = readFileSync18(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync17(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -18008,7 +18069,7 @@ raise SystemExit(0)
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync5 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
 import { join as join22, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
@@ -18067,7 +18128,7 @@ function pinsInFile(path) {
   if (!existsSync15(path)) return [];
   let src = "";
   try {
-    src = readFileSync19(path, "utf8");
+    src = readFileSync18(path, "utf8");
   } catch {
     return [];
   }
@@ -18094,7 +18155,7 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync19(path, "utf8"));
+      doc = yaml.parse(readFileSync18(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -18518,7 +18579,7 @@ function diagnose(opts = {}) {
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync19(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync18(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -18831,7 +18892,7 @@ import { execFileSync as execFileSync12, spawnSync as spawnSync5 } from "node:ch
 import {
   existsSync as existsSync16,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
   rmSync as rmSync10,
@@ -19145,7 +19206,7 @@ function straceOnce(root, command, budget) {
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync20(path, "utf8"), TRACE_ROOT));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync19(path, "utf8"), TRACE_ROOT));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -19377,7 +19438,7 @@ var init_trace_verify = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync17, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync20 } from "node:fs";
 import { join as join24 } from "node:path";
 function isRecord5(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
@@ -19408,7 +19469,7 @@ function claudeSettingsBeyondTamperward(cwd) {
   let raw;
   try {
     if (!existsSync17(path)) return false;
-    raw = readFileSync21(path, "utf8");
+    raw = readFileSync20(path, "utf8");
   } catch {
     return false;
   }
@@ -19515,7 +19576,7 @@ var init_runtimes = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync22, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
+import { lstatSync as lstatSync10, mkdtempSync as mkdtempSync6, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join25, relative as relative8, resolve as resolve13, sep as sep6 } from "node:path";
 import { createInterface } from "node:readline";
@@ -19588,7 +19649,7 @@ function writeVerifyCommand(cwd, command) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync21(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -20200,7 +20261,7 @@ var init_capture = __esm({
 
 // src/research/manifest.ts
 import { createHash as createHash14 } from "node:crypto";
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync22 } from "node:fs";
 import { dirname as dirname11, resolve as resolve15 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
@@ -20234,7 +20295,7 @@ function readManifest(path) {
   const abs = resolve15(path);
   let bytes;
   try {
-    bytes = readFileSync23(abs);
+    bytes = readFileSync22(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -20532,7 +20593,7 @@ var init_record = __esm({
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { closeSync as closeSync3, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync10, openSync as openSync3, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync12, unlinkSync, writeFileSync as writeFileSync12, writeSync } from "node:fs";
+import { closeSync as closeSync4, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync10, openSync as openSync4, readFileSync as readFileSync23, renameSync as renameSync4, rmSync as rmSync12, unlinkSync, writeFileSync as writeFileSync12, writeSync } from "node:fs";
 import { hostname } from "node:os";
 import { join as join26, resolve as resolve16 } from "node:path";
 function git7(args, cwd) {
@@ -20546,7 +20607,7 @@ function researchLockPath(ledger) {
 }
 function readLockOwner(path) {
   try {
-    const parsed = JSON.parse(readFileSync24(path, "utf8"));
+    const parsed = JSON.parse(readFileSync23(path, "utf8"));
     if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
     return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
@@ -20612,12 +20673,12 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
   const text = JSON.stringify(owner) + "\n";
   let fd = -1;
   try {
-    fd = openSync3(path, "wx", 384);
+    fd = openSync4(path, "wx", 384);
     writeSync(fd, text);
-    closeSync3(fd);
+    closeSync4(fd);
     fd = -1;
   } catch (e) {
-    if (fd !== -1) closeSync3(fd);
+    if (fd !== -1) closeSync4(fd);
     if (e.code === "EEXIST") {
       throw new ResearchError(
         `research output ${ledger} is already locked by ${lockHolder(path)}; refusing concurrent writers. Verify the owner is not running, then remove ${path} deliberately or rerun with --break-lock`
@@ -20631,7 +20692,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
       if (released) return;
       released = true;
       try {
-        if (readFileSync24(path, "utf8") === text) unlinkSync(path);
+        if (readFileSync23(path, "utf8") === text) unlinkSync(path);
       } catch {
       }
     }
@@ -20640,7 +20701,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync24(path, "utf8"));
+    raw = JSON.parse(readFileSync23(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -21062,7 +21123,7 @@ var init_run2 = __esm({
 });
 
 // src/research/summarize.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync25 } from "node:fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync24 } from "node:fs";
 import { join as join27, resolve as resolve17 } from "node:path";
 function readLedger2(dir) {
   const pairsDir = join27(resolve17(dir), "pairs");
@@ -21077,7 +21138,7 @@ function readLedger2(dir) {
     const path = join27(pairsDir, n2);
     let raw;
     try {
-      raw = JSON.parse(readFileSync25(path, "utf8"));
+      raw = JSON.parse(readFileSync24(path, "utf8"));
     } catch (e) {
       throw new ResearchError(`ledger record ${path} is not valid JSON: ${errorMessage(e)}`);
     }
@@ -21209,7 +21270,7 @@ var init_summarize = __esm({
 
 // src/research/init.ts
 import { createHash as createHash15 } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync25, writeFileSync as writeFileSync13 } from "node:fs";
 import { basename as basename5, dirname as dirname12, resolve as resolve18 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
@@ -21261,7 +21322,7 @@ function runResearchInit(opts) {
   }
 }
 function requireHash(path) {
-  return createHash15("sha256").update(readFileSync26(path)).digest("hex");
+  return createHash15("sha256").update(readFileSync25(path)).digest("hex");
 }
 var init_init2 = __esm({
   "src/research/init.ts"() {
@@ -21328,7 +21389,7 @@ var init_report2 = __esm({
 // src/research/bundle.ts
 import { createHash as createHash16 } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { existsSync as existsSync20, mkdirSync as mkdirSync12, readdirSync as readdirSync8, readFileSync as readFileSync27, statSync as statSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync12, readdirSync as readdirSync8, readFileSync as readFileSync26, statSync as statSync6, writeFileSync as writeFileSync14 } from "node:fs";
 import { dirname as dirname13, join as join28, resolve as resolve19 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
@@ -21382,7 +21443,7 @@ function walkLedger(ledger) {
   for (const name of names) {
     const path = join28(pairs, name);
     if (!statSync6(path).isFile()) continue;
-    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync27(path) });
+    entries.push({ name: `ledger/pairs/${name}`, bytes: readFileSync26(path) });
   }
   return entries;
 }
@@ -21392,7 +21453,7 @@ function jsonBytes(value) {
 function validateResearchBundle(path) {
   let files;
   try {
-    files = parseTar(gunzipSync(readFileSync27(resolve19(path))));
+    files = parseTar(gunzipSync(readFileSync26(resolve19(path))));
   } catch (e) {
     throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -21446,7 +21507,7 @@ function createResearchBundle(opts) {
   const summary = summarizeLedger(ledger);
   const entries = walkLedger(ledger);
   if (opts.manifest) {
-    const manifest = readFileSync27(resolve19(opts.manifest));
+    const manifest = readFileSync26(resolve19(opts.manifest));
     const sha3 = createHash16("sha256").update(manifest).digest("hex");
     if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
     entries.push({ name: "manifest.json", bytes: manifest });
@@ -22474,7 +22535,7 @@ var init_adapter4 = __esm({
 
 // src/adapters/copilot-sdk/changes.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync15, readFileSync as readFileSync28, rmSync as rmSync13, existsSync as existsSync21, realpathSync as realpathSync11 } from "node:fs";
+import { mkdtempSync as mkdtempSync7, writeFileSync as writeFileSync15, readFileSync as readFileSync27, rmSync as rmSync13, existsSync as existsSync21, realpathSync as realpathSync11 } from "node:fs";
 import { tmpdir as tmpdir8 } from "node:os";
 import { basename as basename6, dirname as dirname14, isAbsolute as isAbsolute17, relative as relative12, resolve as resolve22, join as join29 } from "node:path";
 function asStr4(v) {
@@ -22568,7 +22629,7 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
     if (statPath !== TARGET) throw new Error(`write diff reconstructs a different file (${statPath}) than the bound target`);
     git8(["--check"]);
     git8([]);
-    return op === "delete" ? null : readFileSync28(targetPath, "utf8");
+    return op === "delete" ? null : readFileSync27(targetPath, "utf8");
   } catch (e) {
     throw new Error(`could not reconstruct the write to ${display2} from its diff via git apply: ${e instanceof Error ? e.message : String(e)}`);
   } finally {
@@ -23312,7 +23373,7 @@ var init_runtime_qualification = __esm({
 
 // src/cli/runtime.ts
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync29, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync28, writeFileSync as writeFileSync16 } from "node:fs";
 import { join as join30, dirname as dirname15 } from "node:path";
 function storePath(cwd) {
   const dir = gitDir(cwd);
@@ -23322,7 +23383,7 @@ function readStore(cwd) {
   const path = storePath(cwd);
   if (!path || !existsSync22(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync29(path, "utf8"));
+    const parsed = JSON.parse(readFileSync28(path, "utf8"));
     if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
   } catch {
     return null;
@@ -23484,7 +23545,7 @@ function resolveHookConfigHash(canonicalId, cwd) {
   const file = files[canonicalId];
   if (!file || !existsSync22(file)) return null;
   try {
-    const raw = readFileSync29(file, "utf8");
+    const raw = readFileSync28(file, "utf8");
     let hooks = raw;
     try {
       const parsed = JSON.parse(raw);
@@ -24490,7 +24551,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync29 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -24503,7 +24564,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync30(0, "utf8");
+      raw = readFileSync29(0, "utf8");
     } catch {
       raw = null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.37.0",
+  "version": "2.37.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",