tamperward 2.39.11 → 2.39.12

package/dist/cli/index.js

@@ -788,9 +788,23 @@ function readStateFile(abs) {
   if (e.kind === "absent") return null;
   if (e.kind === "file") return textOf2(e) ?? "";
   throw new StateFileError(
-    `${abs} ${notARegularFile(e)}; the gate reads its session state only as a regular file \u2014 remove what stands there so the state can be re-established`
+    `${abs} ${notARegularFile(e)}; the gate reads its state files only as regular files \u2014 remove what stands there so the state can be re-established`
   );
 }
+function stateDirectory(gitDir3) {
+  const dir = join3(gitDir3, "tamperward");
+  const st = lstatSync2(dir, { throwIfNoEntry: false });
+  if (st === void 0 || st.isDirectory()) return dir;
+  if (st.isSymbolicLink()) {
+    let target = "";
+    try {
+      target = readlinkSync(dir);
+    } catch {
+    }
+    throw new StateFileError(`${dir} is a symbolic link to ${escapeControl(target)}${STATE_DIR_REFUSED}`);
+  }
+  throw new StateFileError(`${dir} is a ${st.isFile() ? "regular file" : irregularName(st)}${STATE_DIR_REFUSED}`);
+}
 function multiplyLinked(st) {
   return st.nlink === 1 ? null : `has ${st.nlink} names \u2014 a hard link is the same file under another name, the session marker's or the policy's, say`;
 }
@@ -861,7 +875,7 @@ function unjudgeableProtected(cwd, policy, changes) {
   }
   return out3;
 }
-var READ_CAP, NO_META, O_READ, StateFileError, O_APPEND_REGULAR, APPEND_REFUSED;
+var READ_CAP, NO_META, O_READ, StateFileError, STATE_DIR_REFUSED, O_APPEND_REGULAR, APPEND_REFUSED;
 var init_disk = __esm({
   "src/disk.ts"() {
     "use strict";
@@ -872,6 +886,7 @@ var init_disk = __esm({
     O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
     StateFileError = class extends Error {
     };
+    STATE_DIR_REFUSED = "; the gate keeps its state only in a directory of its own under the git directory \u2014 replace what stands there with a directory, or remove it";
     O_APPEND_REGULAR = constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
     APPEND_REFUSED = "; the gate appends its records only to a regular file with one name \u2014 remove what stands there so the record can be kept";
   }
@@ -11614,7 +11629,13 @@ function writeBaseline(p, sha3) {
 function baselinePath(cwd, sessionId) {
   const gd = gitDir(cwd);
   if (!gd) return null;
-  return join10(gd, "tamperward", `session-${sessionId.replace(UNSAFE, "")}`);
+  const name = `session-${sessionId.replace(UNSAFE, "")}`;
+  try {
+    return join10(stateDirectory(gd), name);
+  } catch (e) {
+    if (e instanceof StateFileError) throw new BaselineWriteError(join10(gd, "tamperward", name), e);
+    throw e;
+  }
 }
 function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
@@ -11681,7 +11702,7 @@ function statePath(cwd, sessionId, kind) {
   if (!sessionId) return null;
   const gd = gitDir2(cwd);
   if (!gd) return null;
-  const dir = join11(gd, "tamperward");
+  const dir = stateDirectory(gd);
   return join11(dir, `${kind}-${sessionId.replace(UNSAFE2, "")}.json`);
 }
 function ptreePath(cwd, sessionId) {
@@ -11867,7 +11888,7 @@ function snap(abs) {
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
-  return join12(gitDir(cwd) ?? join12(cwd, ".git"), "tamperward", "fsevents.jsonl");
+  return join12(stateDirectory(gitDir(cwd) ?? join12(cwd, ".git")), "fsevents.jsonl");
 }
 function watcherHealthPath(log) {
   return `${log}.health.json`;
@@ -12425,19 +12446,19 @@ function configuredAuditPath(cwd, env = process.env) {
   if (!value) return null;
   if (value === "auto") {
     const ctx = repoContext(cwd);
-    return ctx ? join13(ctx.gitDir, "tamperward", "audit.jsonl") : null;
+    return ctx ? join13(stateDirectory(ctx.gitDir), "audit.jsonl") : null;
   }
   return isAbsolute8(value) ? value : resolve4(cwd, value);
 }
 function defaultAuditPath(cwd) {
   const ctx = repoContext(cwd);
-  return ctx ? join13(ctx.gitDir, "tamperward", "audit.jsonl") : null;
+  return ctx ? join13(stateDirectory(ctx.gitDir), "audit.jsonl") : null;
 }
 function recordAuditFindings(findings, context) {
   if (findings.length === 0) return;
-  const path = configuredAuditPath(context.cwd);
-  if (!path) return;
   try {
+    const path = configuredAuditPath(context.cwd);
+    if (!path) return;
     mkdirSync5(dirname4(path), { recursive: true });
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const session = sessionHash(context.sessionId);
@@ -15950,7 +15971,7 @@ var init_verifier_backend = __esm({
 // src/verification-state.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7 } from "node:fs";
 import { dirname as dirname8, join as join19 } from "node:path";
 function git2(args, cwd) {
   return execFileSync8("git", args, {
@@ -16067,7 +16088,7 @@ function computeBinding(cwd, inputs, precomputed) {
 }
 function stateDir(cwd) {
   const ctx = repoContext(cwd);
-  return ctx ? join19(ctx.gitDir, "tamperward") : null;
+  return ctx ? stateDirectory(ctx.gitDir) : null;
 }
 function verificationRecordPath(cwd) {
   const dir = stateDir(cwd);
@@ -16094,11 +16115,17 @@ function recordVerification(cwd, inputs, treeFingerprintValue) {
     binding
   };
   mkdirSync8(dirname8(path), { recursive: true });
-  writeFileSync8(path, JSON.stringify(record) + "\n");
+  atomicReplaceFile(path, JSON.stringify(record) + "\n", 438);
   return true;
 }
 function invalidateVerificationRecordIfCurrent(cwd) {
-  const record = readVerificationRecord(cwd);
+  let record;
+  try {
+    record = readVerificationRecord(cwd);
+  } catch (e) {
+    if (e instanceof StateFileError) return false;
+    throw e;
+  }
   if (!record) return false;
   let live;
   try {
@@ -16160,12 +16187,8 @@ function parseVerificationRecord(value) {
 function readVerificationRecord(cwd) {
   const path = verificationRecordPath(cwd);
   if (!path) return null;
-  let raw;
-  try {
-    raw = readFileSync11(path, "utf8");
-  } catch {
-    return null;
-  }
+  const raw = readStateFile(path);
+  if (raw === null) return null;
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -16183,25 +16206,25 @@ function pidAlive3(pid) {
   }
 }
 function beginVerifying(cwd) {
-  const path = verifyingMarkerPath(cwd);
-  if (!path) return false;
   try {
+    const path = verifyingMarkerPath(cwd);
+    if (!path) return false;
     const marker = {
       schema_version: VERIFICATION_STATE_SCHEMA_VERSION,
       pid: process.pid,
       started_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     mkdirSync8(dirname8(path), { recursive: true });
-    writeFileSync8(path, JSON.stringify(marker) + "\n");
+    atomicReplaceFile(path, JSON.stringify(marker) + "\n", 438);
     return true;
   } catch {
     return false;
   }
 }
 function endVerifying(cwd) {
-  const path = verifyingMarkerPath(cwd);
-  if (!path) return;
   try {
+    const path = verifyingMarkerPath(cwd);
+    if (!path) return;
     rmSync7(path, { force: true });
   } catch {
   }
@@ -16209,9 +16232,11 @@ function endVerifying(cwd) {
 function readVerifyingMarker(cwd) {
   const path = verifyingMarkerPath(cwd);
   if (!path) return null;
+  const raw = readStateFile(path);
+  if (raw === null) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(path, "utf8"));
+    parsed = JSON.parse(raw);
   } catch {
     return null;
   }
@@ -16238,10 +16263,22 @@ function environmentInputDivergences(recorded, live) {
   return ENVIRONMENT_INPUTS.filter((input) => recorded[input] !== live[input]);
 }
 function evaluateVerificationState(cwd) {
-  if (readVerifyingMarker(cwd)) {
+  let marker;
+  let record;
+  try {
+    marker = readVerifyingMarker(cwd);
+    record = marker ? null : readVerificationRecord(cwd);
+  } catch (e) {
+    if (!(e instanceof StateFileError)) throw e;
+    return {
+      state: "UNVERIFIED",
+      reason: "the verification store cannot be read: something other than a regular file stands at a record path",
+      detail: e.message
+    };
+  }
+  if (marker) {
     return { state: "VERIFYING", reason: "a verification is in progress" };
   }
-  const record = readVerificationRecord(cwd);
   if (!record) {
     return {
       state: "UNVERIFIED",
@@ -16296,6 +16333,8 @@ var init_verification_state = __esm({
     init_repo_context();
     init_wiring();
     init_dependency_env();
+    init_disk();
+    init_safe_write();
     VERIFICATION_STATE_SCHEMA_VERSION = 1;
     BINDING_INPUTS = [
       "tree",
@@ -16345,7 +16384,7 @@ var init_verification_state = __esm({
 
 // src/verification-receipt.ts
 import { createHash as createHash13 } from "node:crypto";
-import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync9, rmSync as rmSync8 } from "node:fs";
 import { dirname as dirname9, join as join20 } from "node:path";
 function isRecord5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -16385,23 +16424,23 @@ function receiptFromRecord(record) {
 }
 function receiptPath(cwd) {
   const ctx = repoContext(cwd);
-  return ctx ? join20(ctx.gitDir, "tamperward", "verification-receipt.json") : null;
+  return ctx ? join20(stateDirectory(ctx.gitDir), "verification-receipt.json") : null;
 }
 function storeReceipt(cwd, receipt) {
-  const path = receiptPath(cwd);
-  if (!path) return false;
   try {
+    const path = receiptPath(cwd);
+    if (!path) return false;
     mkdirSync9(dirname9(path), { recursive: true });
-    writeFileSync9(path, JSON.stringify(receipt) + "\n");
+    atomicReplaceFile(path, JSON.stringify(receipt) + "\n", 438);
     return true;
   } catch {
     return false;
   }
 }
 function removeStoredReceipt(cwd) {
-  const path = receiptPath(cwd);
-  if (!path) return;
   try {
+    const path = receiptPath(cwd);
+    if (!path) return;
     rmSync8(path, { force: true });
   } catch {
   }
@@ -16563,6 +16602,8 @@ var RECEIPT_SCHEMA_VERSION, RECEIPT_STAGE_RESULTS, RECEIPT_INTEGRITY_RESULTS;
 var init_verification_receipt = __esm({
   "src/verification-receipt.ts"() {
     "use strict";
+    init_disk();
+    init_safe_write();
     init_repo_context();
     init_verification_state();
     init_machine_output();
@@ -16575,7 +16616,7 @@ var init_verification_receipt = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync8, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname10, isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
@@ -16770,7 +16811,7 @@ function probeFilesystemCaseSensitivity(dir) {
   const upper = join21(dir, ".tw-case-probe-A");
   const lower = join21(dir, ".tw-case-probe-a");
   try {
-    writeFileSync10(upper, "", { flag: "wx" });
+    writeFileSync8(upper, "", { flag: "wx" });
     return !existsSync10(lower);
   } finally {
     rmSync9(upper, { force: true });
@@ -16873,7 +16914,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync10(out3, content);
+      writeFileSync8(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -16898,7 +16939,7 @@ function suiteEnv(scratch) {
   }
   const userRc = join21(scratch, "npmrc-user");
   const globalRc = join21(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
+  for (const f of [userRc, globalRc]) writeFileSync8(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -17649,7 +17690,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync9 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -17746,7 +17787,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync9(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -17857,8 +17898,7 @@ function observerExited(pid) {
 function supervisedObserverLog(cwd) {
   const gd = gitDir(cwd) ?? join22(cwd, ".git");
   return join22(
-    gd,
-    "tamperward",
+    stateDirectory(gd),
     `run-observer-${process.pid}-${Date.now()}-${randomBytes3(4).toString("hex")}.jsonl`
   );
 }
@@ -19304,7 +19344,10 @@ function renderStatus(model, colour) {
   if (v.state === "STALE" && v.reason) rows.push(["Reason", v.reason]);
   else if (v.state === "BROKEN") rows.push(["Reason", v.detail ?? v.reason ?? "authority wiring is invalid"]);
   else if (v.state === "VERIFYING") rows.push(["Reason", v.reason ?? "a verification is in progress"]);
-  else if (v.state === "UNVERIFIED") rows.push(["Next", "run `tamperward verify` to establish a verified baseline"]);
+  else if (v.state === "UNVERIFIED" && v.detail) {
+    rows.push(["Reason", v.detail]);
+    rows.push(["Next", "remove what stands at that path, then run `tamperward verify`"]);
+  } else if (v.state === "UNVERIFIED") rows.push(["Next", "run `tamperward verify` to establish a verified baseline"]);
   if (rows.length) {
     lines.push("");
     const width = Math.max(...rows.map(([k]) => k.length));
@@ -21039,7 +21082,7 @@ var init_adapter3 = __esm({
 
 // src/adapters/copilot-sdk/changes.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync12, readFileSync as readFileSync17, rmSync as rmSync12, existsSync as existsSync14, realpathSync as realpathSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync10, readFileSync as readFileSync17, rmSync as rmSync12, existsSync as existsSync14, realpathSync as realpathSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { basename as basename5, dirname as dirname12, isAbsolute as isAbsolute16, relative as relative11, resolve as resolve15, join as join26 } from "node:path";
 function asStr4(v) {
@@ -21116,9 +21159,9 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
   const dir = mkdtempSync6(join26(tmpdir7(), "hf-sdk-apply-"));
   try {
     const targetPath = join26(dir, TARGET);
-    if (op !== "create") writeFileSync12(targetPath, before ?? "");
+    if (op !== "create") writeFileSync10(targetPath, before ?? "");
     const patchPath = join26(dir, "change.patch");
-    writeFileSync12(patchPath, patch);
+    writeFileSync10(patchPath, patch);
     const git8 = (extra) => execFileSync13("git", ["apply", ...extra, patchPath], {
       cwd: dir,
       encoding: "utf8",
@@ -21886,17 +21929,19 @@ var init_runtime_qualification = __esm({
 
 // src/cli/runtime.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync18 } from "node:fs";
 import { join as join27, dirname as dirname13 } from "node:path";
 function storePath(cwd) {
   const dir = gitDir(cwd);
-  return dir ? join27(dir, "tamperward", "runtime-qualification.json") : null;
+  return dir ? join27(stateDirectory(dir), "runtime-qualification.json") : null;
 }
 function readStore(cwd) {
   const path = storePath(cwd);
-  if (!path || !existsSync15(path)) return null;
+  if (!path) return null;
+  const raw = readStateFile(path);
+  if (raw === null) return null;
   try {
-    const parsed = JSON.parse(readFileSync18(path, "utf8"));
+    const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
   } catch {
     return null;
@@ -22027,7 +22072,7 @@ function writeRecord(cwd, id, report2) {
   store.updated_at = report2.timestamp;
   try {
     mkdirSync11(dirname13(path), { recursive: true });
-    writeFileSync13(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    atomicReplaceFile(path, JSON.stringify(store, null, 2) + "\n", 384);
     return true;
   } catch {
     return false;
@@ -22207,7 +22252,13 @@ function emit2(report2, opts, cwd) {
   renderText3(report2, cwd);
 }
 function storedQualification(adapter, cwd, opts = {}) {
-  const raw = readStore(cwd)?.records[adapter.name];
+  let raw;
+  try {
+    raw = readStore(cwd)?.records[adapter.name];
+  } catch (e) {
+    if (e instanceof StateFileError) return { state: "rejected", reason: e.message };
+    throw e;
+  }
   if (raw === void 0) return { state: "none" };
   const validated = validateStoredReport(raw);
   if ("reason" in validated) return { state: "rejected", reason: validated.reason };
@@ -22246,10 +22297,18 @@ function runRuntime(sub, opts) {
     }
     const { binding, assessments } = buildQualification(target, opts, cwd);
     const report2 = reportFrom("verify", binding, assessments);
-    const wrote = writeRecord(cwd, target.name, report2);
+    let wrote = false;
+    let refused;
+    try {
+      wrote = writeRecord(cwd, target.name, report2);
+    } catch (e) {
+      if (!(e instanceof StateFileError)) throw e;
+      refused = e.message;
+    }
     if (!wrote) {
-      const dest = storePath(cwd);
-      const reason = `could not persist the qualification to ${dest ?? "the git-local store (no repository found)"}; nothing was recorded, so \`tamperward runtime status\` will report UNQUALIFIED`;
+      const dir = gitDir(cwd);
+      const dest = dir ? join27(dir, "tamperward", "runtime-qualification.json") : null;
+      const reason = `could not persist the qualification to ${dest ?? "the git-local store (no repository found)"}${refused ? ` (${refused})` : ""}; nothing was recorded, so \`tamperward runtime status\` will report UNQUALIFIED`;
       const failure = {
         ...report2,
         recorded: false,
@@ -22319,6 +22378,8 @@ var HONESTY_NOTE, CAP_ID_SET, STATE_SEVERITY, AGGREGATE_SEVERITY, RUNTIME_SUBCOM
 var init_runtime = __esm({
   "src/cli/runtime.ts"() {
     "use strict";
+    init_disk();
+    init_safe_write();
     init_build();
     init_wiring();
     init_machine_output();
@@ -23527,7 +23588,7 @@ var init_record = __esm({
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync16, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync14, writeSync as writeSync2 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync16, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync11, writeSync as writeSync2 } from "node:fs";
 import { hostname } from "node:os";
 import { join as join29, resolve as resolve19 } from "node:path";
 function git7(args, cwd) {
@@ -23672,7 +23733,7 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync14(tmp, text);
+  writeFileSync11(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
@@ -24273,7 +24334,7 @@ var init_summarize = __esm({
 
 // src/research/init.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
 import { basename as basename6, dirname as dirname15, resolve as resolve21 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
@@ -24303,7 +24364,7 @@ function createResearchManifest(opts) {
   };
   const text = JSON.stringify(doc, null, 2) + "\n";
   mkdirSync13(dirname15(out3), { recursive: true });
-  writeFileSync15(out3, text, { flag: "wx", mode: 384 });
+  writeFileSync12(out3, text, { flag: "wx", mode: 384 });
   const parsed = readManifest(out3);
   if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
   return out3;
@@ -24393,7 +24454,7 @@ var init_report2 = __esm({
 import { createHash as createHash18 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "node:fs";
 import { dirname as dirname16, resolve as resolve22 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
@@ -24593,7 +24654,7 @@ function createResearchBundle(opts) {
   entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
   const out3 = resolve22(opts.out);
   mkdirSync14(dirname16(out3), { recursive: true });
-  writeFileSync16(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  writeFileSync13(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
   return out3;
 }
 function runResearchBundle(opts) {
@@ -24740,7 +24801,7 @@ var init_research = __esm({
 });
 
 // src/cli/receipt.ts
-import { appendFileSync as appendFileSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
+import { appendFileSync as appendFileSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync14 } from "node:fs";
 function parseReceipt(args) {
   const [sub, ...rest] = args;
   const exportOpts = {};
@@ -24842,7 +24903,7 @@ function runReceiptExport(opts = {}) {
   const serialized = JSON.stringify(receipt) + "\n";
   if (opts.out) {
     try {
-      writeFileSync17(opts.out, serialized);
+      writeFileSync14(opts.out, serialized);
     } catch (e) {
       process.stderr.write(`tamperward: could not write receipt to ${opts.out} (${e instanceof Error ? e.message : String(e)})
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.39.11",
+  "version": "2.39.12",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",