tamperward 2.39.10 → 2.39.11

package/dist/cli/index.js

@@ -671,7 +671,7 @@ var init_policy = __esm({
 });
 
 // src/disk.ts
-import { closeSync, constants, fstatSync, lstatSync as lstatSync2, openSync, readSync, readlinkSync, realpathSync as realpathSync2 } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync as lstatSync2, openSync, readSync, readlinkSync, realpathSync as realpathSync2, writeSync } from "node:fs";
 import { join as join3 } from "node:path";
 function errText(e) {
   return e instanceof Error ? e.message : String(e);
@@ -791,6 +791,36 @@ function readStateFile(abs) {
     `${abs} ${notARegularFile(e)}; the gate reads its session state only as a regular file \u2014 remove what stands there so the state can be re-established`
   );
 }
+function multiplyLinked(st) {
+  return st.nlink === 1 ? null : `has ${st.nlink} names \u2014 a hard link is the same file under another name, the session marker's or the policy's, say`;
+}
+function appendRegular(abs, text, mode = 438) {
+  const st = lstatSync2(abs, { throwIfNoEntry: false });
+  if (st !== void 0 && !st.isFile()) throw new StateFileError(`${abs} ${notARegularFile(classify(abs, st))}${APPEND_REFUSED}`);
+  const linked = st === void 0 ? null : multiplyLinked(st);
+  if (linked !== null) throw new StateFileError(`${abs} ${linked}${APPEND_REFUSED}`);
+  let fd;
+  try {
+    fd = openSync(abs, O_APPEND_REGULAR, mode);
+  } catch (e) {
+    const code2 = errCode(e);
+    if (code2 === "ELOOP" || code2 === "ENXIO" || code2 === "EISDIR") {
+      throw new StateFileError(`${abs} changed shape while it was being opened (${errText(e)})${APPEND_REFUSED}`);
+    }
+    throw e;
+  }
+  try {
+    const now = fstatSync(fd);
+    if (!now.isFile()) throw new StateFileError(`${abs} is a ${irregularName(now)}${APPEND_REFUSED}`);
+    const opened = multiplyLinked(now);
+    if (opened !== null) throw new StateFileError(`${abs} ${opened}${APPEND_REFUSED}`);
+    const buf = Buffer.from(text, "utf8");
+    let off2 = 0;
+    while (off2 < buf.length) off2 += writeSync(fd, buf, off2, buf.length - off2);
+  } finally {
+    closeSync(fd);
+  }
+}
 function describe(e, shown) {
   switch (e.kind) {
     case "symlink":
@@ -831,7 +861,7 @@ function unjudgeableProtected(cwd, policy, changes) {
   }
   return out3;
 }
-var READ_CAP, NO_META, O_READ, StateFileError;
+var READ_CAP, NO_META, O_READ, StateFileError, O_APPEND_REGULAR, APPEND_REFUSED;
 var init_disk = __esm({
   "src/disk.ts"() {
     "use strict";
@@ -842,6 +872,8 @@ var init_disk = __esm({
     O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
     StateFileError = class extends Error {
     };
+    O_APPEND_REGULAR = constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+    APPEND_REFUSED = "; the gate appends its records only to a regular file with one name \u2014 remove what stands there so the record can be kept";
   }
 });
 
@@ -11777,8 +11809,53 @@ var init_effect = __esm({
   }
 });
 
+// src/safe-write.ts
+import { randomBytes } from "node:crypto";
+import { lstatSync as lstatSync5, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+function writeTargetKind(path) {
+  let st;
+  try {
+    st = lstatSync5(path, { throwIfNoEntry: false });
+  } catch (e) {
+    if (errnoCode(e) === "ENOTDIR") return "absent";
+    throw e;
+  }
+  if (!st) return "absent";
+  if (st.isSymbolicLink()) return "symlink";
+  return st.isFile() ? "file" : "irregular";
+}
+function refuseNonRegular(path) {
+  switch (writeTargetKind(path)) {
+    case "symlink":
+      return "refusing: symlink \u2014 the target would be written instead of this path; replace the link with a regular file, then re-run";
+    case "irregular":
+      return "refusing: not a regular file \u2014 a directory or special file stands where a file is expected; remove it, then re-run";
+    default:
+      return null;
+  }
+}
+function existingMode(path, fallback) {
+  if (writeTargetKind(path) !== "file") return fallback;
+  return lstatSync5(path).mode & 511;
+}
+function atomicReplaceFile(path, content, mode) {
+  const tmp = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    writeFileSync4(tmp, content, { encoding: "utf8", flag: "wx", mode });
+    renameSync3(tmp, path);
+  } finally {
+    rmSync4(tmp, { force: true });
+  }
+}
+var init_safe_write = __esm({
+  "src/safe-write.ts"() {
+    "use strict";
+    init_narrow();
+  }
+});
+
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync2, watch, writeFileSync as writeFileSync4 } from "node:fs";
+import { lstatSync as lstatSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync2, watch } from "node:fs";
 import { join as join12 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 function snap(abs) {
@@ -11889,7 +11966,7 @@ function watchTree(dir, cb, onState, onError, watchFn = watch) {
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (lstatSync5(join12(dir, child)).isDirectory()) addDir(child);
+          if (lstatSync6(join12(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -11925,7 +12002,7 @@ function watchTree(dir, cb, onState, onError, watchFn = watch) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (lstatSync5(join12(dir, child)).isDirectory()) walk2(child);
+        if (lstatSync6(join12(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -11964,7 +12041,7 @@ function startWatcher(dir, log, policy, watchFn = watch) {
   let healthWriteWarningEmitted = false;
   const persistHealth = () => {
     try {
-      writeFileSync4(healthPath, JSON.stringify(health) + "\n", { mode: 384 });
+      atomicReplaceFile(healthPath, JSON.stringify(health) + "\n", 384);
       healthWriteWarningEmitted = false;
     } catch (e) {
       if (!healthWriteWarningEmitted) {
@@ -12004,7 +12081,7 @@ function startWatcher(dir, log, policy, watchFn = watch) {
         ...s
       };
       try {
-        appendFileSync3(log, JSON.stringify(ev) + "\n");
+        appendRegular(log, JSON.stringify(ev) + "\n");
         health.event_count++;
         health.last_append_at = (/* @__PURE__ */ new Date()).toISOString();
         persistHealth();
@@ -12067,6 +12144,7 @@ var init_watch = __esm({
   "src/cli/watch.ts"() {
     "use strict";
     init_disk();
+    init_safe_write();
     init_policy_load();
     init_policy();
     init_build();
@@ -12332,15 +12410,15 @@ var init_fs_events = __esm({
 });
 
 // src/cli/audit.ts
-import { createHash as createHash6, randomBytes } from "node:crypto";
-import { appendFileSync as appendFileSync4, closeSync as closeSync4, existsSync as existsSync5, mkdirSync as mkdirSync5, openSync as openSync4, readSync as readSync3 } from "node:fs";
+import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+import { closeSync as closeSync4, existsSync as existsSync5, mkdirSync as mkdirSync5, openSync as openSync4, readSync as readSync3 } from "node:fs";
 import { dirname as dirname4, isAbsolute as isAbsolute8, join as join13, resolve as resolve4 } from "node:path";
 function sessionHash(sessionId) {
   if (!sessionId) return void 0;
   return "sha256:" + createHash6("sha256").update(sessionId).digest("hex").slice(0, 24);
 }
 function eventId() {
-  return "sha256:" + createHash6("sha256").update(randomBytes(32)).digest("hex").slice(0, 32);
+  return "sha256:" + createHash6("sha256").update(randomBytes2(32)).digest("hex").slice(0, 32);
 }
 function configuredAuditPath(cwd, env = process.env) {
   const value = env[AUDIT_LOG_ENV];
@@ -12378,7 +12456,7 @@ function recordAuditFindings(findings, context) {
       };
       return JSON.stringify(event);
     });
-    appendFileSync4(path, lines.join("\n") + "\n");
+    appendRegular(path, lines.join("\n") + "\n");
   } catch {
   }
 }
@@ -12613,6 +12691,7 @@ var init_audit = __esm({
   "src/cli/audit.ts"() {
     "use strict";
     init_repo_context();
+    init_disk();
     AUDIT_SCHEMA_VERSION = 1;
     AUDIT_LOG_ENV = "TAMPERWARD_AUDIT_LOG";
     MAX_AUDIT_LINE_BYTES = 16 * 1024;
@@ -12631,7 +12710,7 @@ var init_audit = __esm({
 });
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync6, appendFileSync as appendFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
 function setSnapshotCache(cache3) {
   snapshotCache = cache3;
@@ -12666,7 +12745,7 @@ function recordDenylog(blocks2) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync5(log, blocks2.map((b) => b.rule).join(",") + "\n");
+    appendRegular(log, blocks2.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -12985,7 +13064,7 @@ function recordWarns(cwd, sessionId, warns) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync5(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
+    appendRegular(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
   } catch {
   }
 }
@@ -12995,7 +13074,7 @@ function recordObserverHealth(cwd, sessionId, state, reason) {
   if (!log) return;
   const detail = (reason ?? "").replace(/[\r\n]+/g, " ").trim();
   try {
-    appendFileSync5(
+    appendRegular(
       log,
       `warn:transient-observer:${state}${detail ? ":" + detail : ""}
 `
@@ -13112,7 +13191,7 @@ var init_hook = __esm({
 });
 
 // src/ptree-cache.ts
-import { lstatSync as lstatSync6 } from "node:fs";
+import { lstatSync as lstatSync7 } from "node:fs";
 import { join as join14 } from "node:path";
 function keyOf(st) {
   return `${st.dev}:${st.ino}:${st.size}:${st.mode}:${st.mtimeNs}:${st.ctimeNs}`;
@@ -13166,7 +13245,7 @@ var init_ptree_cache = __esm({
         const abs = join14(cwd, rel);
         let st;
         try {
-          st = lstatSync6(abs, { bigint: true });
+          st = lstatSync7(abs, { bigint: true });
         } catch {
           this.map.delete(abs);
           this.stats.misses++;
@@ -13188,7 +13267,7 @@ var init_ptree_cache = __esm({
         const entry = compute();
         let after;
         try {
-          after = lstatSync6(abs, { bigint: true });
+          after = lstatSync7(abs, { bigint: true });
         } catch {
           this.map.delete(abs);
           return entry;
@@ -13206,7 +13285,7 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync7, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync7, lstatSync as lstatSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
@@ -13289,13 +13368,13 @@ function withEnv(env, fn) {
 }
 function removeQuietly(p) {
   try {
-    rmSync4(p, { force: true });
+    rmSync5(p, { force: true });
   } catch {
   }
 }
 function ensurePrivateDir(dir, uid) {
   if (!existsSync7(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
-  const st = lstatSync7(dir);
+  const st = lstatSync8(dir);
   if (!st.isDirectory()) throw new Error(`${dir} is not a directory`);
   if (st.uid !== uid) throw new Error(`${dir} is owned by uid ${st.uid}, not ${uid}; refusing to serve from it`);
   if ((st.mode & 63) !== 0) chmodSync(dir, 448);
@@ -13725,51 +13804,6 @@ var init_verifier_limits = __esm({
   }
 });
 
-// src/safe-write.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync8, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
-function writeTargetKind(path) {
-  let st;
-  try {
-    st = lstatSync8(path, { throwIfNoEntry: false });
-  } catch (e) {
-    if (errnoCode(e) === "ENOTDIR") return "absent";
-    throw e;
-  }
-  if (!st) return "absent";
-  if (st.isSymbolicLink()) return "symlink";
-  return st.isFile() ? "file" : "irregular";
-}
-function refuseNonRegular(path) {
-  switch (writeTargetKind(path)) {
-    case "symlink":
-      return "refusing: symlink \u2014 the target would be written instead of this path; replace the link with a regular file, then re-run";
-    case "irregular":
-      return "refusing: not a regular file \u2014 a directory or special file stands where a file is expected; remove it, then re-run";
-    default:
-      return null;
-  }
-}
-function existingMode(path, fallback) {
-  if (writeTargetKind(path) !== "file") return fallback;
-  return lstatSync8(path).mode & 511;
-}
-function atomicReplaceFile(path, content, mode) {
-  const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
-  try {
-    writeFileSync7(tmp, content, { encoding: "utf8", flag: "wx", mode });
-    renameSync3(tmp, path);
-  } finally {
-    rmSync5(tmp, { force: true });
-  }
-}
-var init_safe_write = __esm({
-  "src/safe-write.ts"() {
-    "use strict";
-    init_narrow();
-  }
-});
-
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
@@ -15063,7 +15097,7 @@ var init_dependency_env = __esm({
 
 // src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join17 } from "node:path";
 function emptySuiteDiagnostics() {
@@ -15149,7 +15183,7 @@ function runCapturedProcessSync(executable, args, opts) {
   const configFile = join17(stateDir2, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
-    writeFileSync8(
+    writeFileSync7(
       configFile,
       JSON.stringify({
         executable,
@@ -15916,7 +15950,7 @@ var init_verifier_backend = __esm({
 // src/verification-state.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname8, join as join19 } from "node:path";
 function git2(args, cwd) {
   return execFileSync8("git", args, {
@@ -16060,7 +16094,7 @@ function recordVerification(cwd, inputs, treeFingerprintValue) {
     binding
   };
   mkdirSync8(dirname8(path), { recursive: true });
-  writeFileSync9(path, JSON.stringify(record) + "\n");
+  writeFileSync8(path, JSON.stringify(record) + "\n");
   return true;
 }
 function invalidateVerificationRecordIfCurrent(cwd) {
@@ -16158,7 +16192,7 @@ function beginVerifying(cwd) {
       started_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     mkdirSync8(dirname8(path), { recursive: true });
-    writeFileSync9(path, JSON.stringify(marker) + "\n");
+    writeFileSync8(path, JSON.stringify(marker) + "\n");
     return true;
   } catch {
     return false;
@@ -16311,7 +16345,7 @@ var init_verification_state = __esm({
 
 // src/verification-receipt.ts
 import { createHash as createHash13 } from "node:crypto";
-import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname9, join as join20 } from "node:path";
 function isRecord5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -16358,7 +16392,7 @@ function storeReceipt(cwd, receipt) {
   if (!path) return false;
   try {
     mkdirSync9(dirname9(path), { recursive: true });
-    writeFileSync10(path, JSON.stringify(receipt) + "\n");
+    writeFileSync9(path, JSON.stringify(receipt) + "\n");
     return true;
   } catch {
     return false;
@@ -16541,7 +16575,7 @@ var init_verification_receipt = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync11, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname10, isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
@@ -16736,7 +16770,7 @@ function probeFilesystemCaseSensitivity(dir) {
   const upper = join21(dir, ".tw-case-probe-A");
   const lower = join21(dir, ".tw-case-probe-a");
   try {
-    writeFileSync11(upper, "", { flag: "wx" });
+    writeFileSync10(upper, "", { flag: "wx" });
     return !existsSync10(lower);
   } finally {
     rmSync9(upper, { force: true });
@@ -16839,7 +16873,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync11(out3, content);
+      writeFileSync10(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -16864,7 +16898,7 @@ function suiteEnv(scratch) {
   }
   const userRc = join21(scratch, "npmrc-user");
   const globalRc = join21(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync11(f, "", { mode: 292 });
+  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -17615,7 +17649,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -17712,7 +17746,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync12(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -21005,7 +21039,7 @@ var init_adapter3 = __esm({
 
 // src/adapters/copilot-sdk/changes.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync13, readFileSync as readFileSync17, rmSync as rmSync12, existsSync as existsSync14, realpathSync as realpathSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync12, readFileSync as readFileSync17, rmSync as rmSync12, existsSync as existsSync14, realpathSync as realpathSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { basename as basename5, dirname as dirname12, isAbsolute as isAbsolute16, relative as relative11, resolve as resolve15, join as join26 } from "node:path";
 function asStr4(v) {
@@ -21082,9 +21116,9 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
   const dir = mkdtempSync6(join26(tmpdir7(), "hf-sdk-apply-"));
   try {
     const targetPath = join26(dir, TARGET);
-    if (op !== "create") writeFileSync13(targetPath, before ?? "");
+    if (op !== "create") writeFileSync12(targetPath, before ?? "");
     const patchPath = join26(dir, "change.patch");
-    writeFileSync13(patchPath, patch);
+    writeFileSync12(patchPath, patch);
     const git8 = (extra) => execFileSync13("git", ["apply", ...extra, patchPath], {
       cwd: dir,
       encoding: "utf8",
@@ -21852,7 +21886,7 @@ var init_runtime_qualification = __esm({
 
 // src/cli/runtime.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join27, dirname as dirname13 } from "node:path";
 function storePath(cwd) {
   const dir = gitDir(cwd);
@@ -21993,7 +22027,7 @@ function writeRecord(cwd, id, report2) {
   store.updated_at = report2.timestamp;
   try {
     mkdirSync11(dirname13(path), { recursive: true });
-    writeFileSync14(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    writeFileSync13(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
     return true;
   } catch {
     return false;
@@ -23493,7 +23527,7 @@ var init_record = __esm({
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync16, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync15, writeSync } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync16, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync14, writeSync as writeSync2 } from "node:fs";
 import { hostname } from "node:os";
 import { join as join29, resolve as resolve19 } from "node:path";
 function git7(args, cwd) {
@@ -23574,7 +23608,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
   let fd = -1;
   try {
     fd = openSync5(path, "wx", 384);
-    writeSync(fd, text);
+    writeSync2(fd, text);
     closeSync5(fd);
     fd = -1;
   } catch (e) {
@@ -23638,7 +23672,7 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync15(tmp, text);
+  writeFileSync14(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
@@ -24239,7 +24273,7 @@ var init_summarize = __esm({
 
 // src/research/init.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
 import { basename as basename6, dirname as dirname15, resolve as resolve21 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
@@ -24269,7 +24303,7 @@ function createResearchManifest(opts) {
   };
   const text = JSON.stringify(doc, null, 2) + "\n";
   mkdirSync13(dirname15(out3), { recursive: true });
-  writeFileSync16(out3, text, { flag: "wx", mode: 384 });
+  writeFileSync15(out3, text, { flag: "wx", mode: 384 });
   const parsed = readManifest(out3);
   if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
   return out3;
@@ -24359,7 +24393,7 @@ var init_report2 = __esm({
 import { createHash as createHash18 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync17 } from "node:fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
 import { dirname as dirname16, resolve as resolve22 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
@@ -24559,7 +24593,7 @@ function createResearchBundle(opts) {
   entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
   const out3 = resolve22(opts.out);
   mkdirSync14(dirname16(out3), { recursive: true });
-  writeFileSync17(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  writeFileSync16(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
   return out3;
 }
 function runResearchBundle(opts) {
@@ -24706,7 +24740,7 @@ var init_research = __esm({
 });
 
 // src/cli/receipt.ts
-import { appendFileSync as appendFileSync6, readFileSync as readFileSync25, writeFileSync as writeFileSync18 } from "node:fs";
+import { appendFileSync as appendFileSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
 function parseReceipt(args) {
   const [sub, ...rest] = args;
   const exportOpts = {};
@@ -24808,7 +24842,7 @@ function runReceiptExport(opts = {}) {
   const serialized = JSON.stringify(receipt) + "\n";
   if (opts.out) {
     try {
-      writeFileSync18(opts.out, serialized);
+      writeFileSync17(opts.out, serialized);
     } catch (e) {
       process.stderr.write(`tamperward: could not write receipt to ${opts.out} (${e instanceof Error ? e.message : String(e)})
 `);
@@ -25030,7 +25064,7 @@ function writeJobSummary(r, receipt, ciBinding, adjudicatedTree) {
   for (const d of r.divergence) md.push(`- ${d}`);
   md.push("");
   try {
-    appendFileSync6(path, md.join("\n") + "\n");
+    appendFileSync3(path, md.join("\n") + "\n");
   } catch {
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.10",
+  "version": "2.39.11",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",