tamperward 2.39.9 → 2.39.11

package/dist/cli/index.js

@@ -671,7 +671,7 @@ var init_policy = __esm({
 });
 
 // src/disk.ts
-import { closeSync, constants, fstatSync, lstatSync as lstatSync2, openSync, readSync, readlinkSync, realpathSync as realpathSync2 } from "node:fs";
+import { closeSync, constants, fstatSync, lstatSync as lstatSync2, openSync, readSync, readlinkSync, realpathSync as realpathSync2, writeSync } from "node:fs";
 import { join as join3 } from "node:path";
 function errText(e) {
   return e instanceof Error ? e.message : String(e);
@@ -769,6 +769,58 @@ function inspectResolved(abs) {
 function textOf2(e) {
   return e.content == null ? null : e.content.toString("utf8");
 }
+function notARegularFile(e) {
+  switch (e.kind) {
+    case "symlink":
+      return `is a symbolic link to ${escapeControl(e.detail)}`;
+    case "directory":
+      return "is a directory";
+    case "irregular":
+      return `is a ${e.detail}`;
+    case "oversize":
+      return `is ${e.detail}, above the ${READ_CAP / (1024 * 1024)} MiB the gate reads`;
+    default:
+      return `cannot be read (${e.detail})`;
+  }
+}
+function readStateFile(abs) {
+  const e = inspectPath(abs);
+  if (e.kind === "absent") return null;
+  if (e.kind === "file") return textOf2(e) ?? "";
+  throw new StateFileError(
+    `${abs} ${notARegularFile(e)}; the gate reads its session state only as a regular file \u2014 remove what stands there so the state can be re-established`
+  );
+}
+function multiplyLinked(st) {
+  return st.nlink === 1 ? null : `has ${st.nlink} names \u2014 a hard link is the same file under another name, the session marker's or the policy's, say`;
+}
+function appendRegular(abs, text, mode = 438) {
+  const st = lstatSync2(abs, { throwIfNoEntry: false });
+  if (st !== void 0 && !st.isFile()) throw new StateFileError(`${abs} ${notARegularFile(classify(abs, st))}${APPEND_REFUSED}`);
+  const linked = st === void 0 ? null : multiplyLinked(st);
+  if (linked !== null) throw new StateFileError(`${abs} ${linked}${APPEND_REFUSED}`);
+  let fd;
+  try {
+    fd = openSync(abs, O_APPEND_REGULAR, mode);
+  } catch (e) {
+    const code2 = errCode(e);
+    if (code2 === "ELOOP" || code2 === "ENXIO" || code2 === "EISDIR") {
+      throw new StateFileError(`${abs} changed shape while it was being opened (${errText(e)})${APPEND_REFUSED}`);
+    }
+    throw e;
+  }
+  try {
+    const now = fstatSync(fd);
+    if (!now.isFile()) throw new StateFileError(`${abs} is a ${irregularName(now)}${APPEND_REFUSED}`);
+    const opened = multiplyLinked(now);
+    if (opened !== null) throw new StateFileError(`${abs} ${opened}${APPEND_REFUSED}`);
+    const buf = Buffer.from(text, "utf8");
+    let off2 = 0;
+    while (off2 < buf.length) off2 += writeSync(fd, buf, off2, buf.length - off2);
+  } finally {
+    closeSync(fd);
+  }
+}
 function describe(e, shown) {
   switch (e.kind) {
     case "symlink":
@@ -809,7 +861,7 @@ function unjudgeableProtected(cwd, policy, changes) {
   }
   return out3;
 }
-var READ_CAP, NO_META, O_READ;
+var READ_CAP, NO_META, O_READ, StateFileError, O_APPEND_REGULAR, APPEND_REFUSED;
 var init_disk = __esm({
   "src/disk.ts"() {
     "use strict";
@@ -818,6 +870,10 @@ var init_disk = __esm({
     READ_CAP = 64 * 1024 * 1024;
     NO_META = { mode: 0, size: 0, mtimeMs: 0 };
     O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+    StateFileError = class extends Error {
+    };
+    O_APPEND_REGULAR = constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+    APPEND_REFUSED = "; the gate appends its records only to a regular file with one name \u2014 remove what stands there so the record can be kept";
   }
 });
 
@@ -10868,20 +10924,6 @@ function parseOrThrow(src, where) {
   }
   return parsePolicy(raw, where);
 }
-function notARegularFile(e) {
-  switch (e.kind) {
-    case "symlink":
-      return `is a symbolic link to ${escapeControl(e.detail)}`;
-    case "directory":
-      return "is a directory";
-    case "irregular":
-      return `is a ${e.detail}`;
-    case "oversize":
-      return `is ${e.detail}, above the ${READ_CAP / (1024 * 1024)} MiB the gate reads`;
-    default:
-      return `cannot be read (${e.detail})`;
-  }
-}
 function loadPolicy(cwd = process.cwd()) {
   const entry = inspectPath(join8(repoRoot(cwd), POLICY_FILE));
   if (entry.kind === "absent") return defaultPolicy();
@@ -11553,7 +11595,7 @@ var init_deny = __esm({
 });
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join10 } from "node:path";
 function writeBaseline(p, sha3) {
   mkdirSync2(dirname3(p), { recursive: true });
@@ -11578,13 +11620,8 @@ function turnBaseline(cwd, sessionId) {
   if (!sessionId) return null;
   const p = baselinePath(cwd, sessionId);
   if (!p) return null;
-  try {
-    if (existsSync5(p)) {
-      const v = readFileSync6(p, "utf8").trim();
-      if (SHA.test(v)) return v;
-    }
-  } catch {
-  }
+  const v = readStateFile(p)?.trim();
+  if (v !== void 0 && SHA.test(v)) return v;
   const head = headSha(cwd);
   if (!head) return null;
   try {
@@ -11608,6 +11645,7 @@ var UNSAFE, SHA, BaselineWriteError;
 var init_session = __esm({
   "src/session.ts"() {
     "use strict";
+    init_disk();
     init_build();
     UNSAFE = /[^A-Za-z0-9_-]/g;
     SHA = /^[0-9a-f]{40}$/;
@@ -11623,7 +11661,7 @@ var init_session = __esm({
 
 // src/effect.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { lstatSync as lstatSync4, mkdirSync as mkdirSync3, readdirSync, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join11 } from "node:path";
 function ptreeFrom(value) {
   if (!isRecord(value)) return null;
@@ -11715,9 +11753,11 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync6(p)) return null;
+  if (!p) return null;
+  const text = readStateFile(p);
+  if (text === null) return null;
   try {
-    return ptreeFrom(JSON.parse(readFileSync7(p, "utf8")));
+    return ptreeFrom(JSON.parse(text));
   } catch {
     return null;
   }
@@ -11769,8 +11809,53 @@ var init_effect = __esm({
   }
 });
 
+// src/safe-write.ts
+import { randomBytes } from "node:crypto";
+import { lstatSync as lstatSync5, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+function writeTargetKind(path) {
+  let st;
+  try {
+    st = lstatSync5(path, { throwIfNoEntry: false });
+  } catch (e) {
+    if (errnoCode(e) === "ENOTDIR") return "absent";
+    throw e;
+  }
+  if (!st) return "absent";
+  if (st.isSymbolicLink()) return "symlink";
+  return st.isFile() ? "file" : "irregular";
+}
+function refuseNonRegular(path) {
+  switch (writeTargetKind(path)) {
+    case "symlink":
+      return "refusing: symlink \u2014 the target would be written instead of this path; replace the link with a regular file, then re-run";
+    case "irregular":
+      return "refusing: not a regular file \u2014 a directory or special file stands where a file is expected; remove it, then re-run";
+    default:
+      return null;
+  }
+}
+function existingMode(path, fallback) {
+  if (writeTargetKind(path) !== "file") return fallback;
+  return lstatSync5(path).mode & 511;
+}
+function atomicReplaceFile(path, content, mode) {
+  const tmp = `${path}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    writeFileSync4(tmp, content, { encoding: "utf8", flag: "wx", mode });
+    renameSync3(tmp, path);
+  } finally {
+    rmSync4(tmp, { force: true });
+  }
+}
+var init_safe_write = __esm({
+  "src/safe-write.ts"() {
+    "use strict";
+    init_narrow();
+  }
+});
+
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, readdirSync as readdirSync2, watch, writeFileSync as writeFileSync4 } from "node:fs";
+import { lstatSync as lstatSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync2, watch } from "node:fs";
 import { join as join12 } from "node:path";
 import { createHash as createHash5 } from "node:crypto";
 function snap(abs) {
@@ -11788,8 +11873,10 @@ function watcherHealthPath(log) {
   return `${log}.health.json`;
 }
 function readWatcherHealth(log) {
+  const text = readStateFile(watcherHealthPath(log));
+  if (text === null) return null;
   try {
-    const value = JSON.parse(readFileSync8(watcherHealthPath(log), "utf8"));
+    const value = JSON.parse(text);
     if (!isRecord(value)) return null;
     const { state, backend, pid, started_at } = value;
     if (value.version !== 1 || typeof pid !== "number" || typeof started_at !== "string") return null;
@@ -11823,7 +11910,13 @@ function pidAlive(pid) {
   }
 }
 function watcherTelemetry(log) {
-  const health = readWatcherHealth(log);
+  let health;
+  try {
+    health = readWatcherHealth(log);
+  } catch (e) {
+    if (!(e instanceof StateFileError)) throw e;
+    return { state: "unavailable", health: null, reason: e.message };
+  }
   if (!health) return { state: "unavailable", health: null, reason: "no health record" };
   if (health.state === "stopped")
     return { state: "unavailable", health, reason: "observer stopped" };
@@ -11873,7 +11966,7 @@ function watchTree(dir, cb, onState, onError, watchFn = watch) {
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (lstatSync5(join12(dir, child)).isDirectory()) addDir(child);
+          if (lstatSync6(join12(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -11909,7 +12002,7 @@ function watchTree(dir, cb, onState, onError, watchFn = watch) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (lstatSync5(join12(dir, child)).isDirectory()) walk2(child);
+        if (lstatSync6(join12(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -11948,7 +12041,7 @@ function startWatcher(dir, log, policy, watchFn = watch) {
   let healthWriteWarningEmitted = false;
   const persistHealth = () => {
     try {
-      writeFileSync4(healthPath, JSON.stringify(health) + "\n", { mode: 384 });
+      atomicReplaceFile(healthPath, JSON.stringify(health) + "\n", 384);
       healthWriteWarningEmitted = false;
     } catch (e) {
       if (!healthWriteWarningEmitted) {
@@ -11988,7 +12081,7 @@ function startWatcher(dir, log, policy, watchFn = watch) {
         ...s
       };
       try {
-        appendFileSync3(log, JSON.stringify(ev) + "\n");
+        appendRegular(log, JSON.stringify(ev) + "\n");
         health.event_count++;
         health.last_append_at = (/* @__PURE__ */ new Date()).toISOString();
         persistHealth();
@@ -12051,6 +12144,7 @@ var init_watch = __esm({
   "src/cli/watch.ts"() {
     "use strict";
     init_disk();
+    init_safe_write();
     init_policy_load();
     init_policy();
     init_build();
@@ -12316,15 +12410,15 @@ var init_fs_events = __esm({
 });
 
 // src/cli/audit.ts
-import { createHash as createHash6, randomBytes } from "node:crypto";
-import { appendFileSync as appendFileSync4, closeSync as closeSync4, existsSync as existsSync7, mkdirSync as mkdirSync5, openSync as openSync4, readSync as readSync3 } from "node:fs";
+import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+import { closeSync as closeSync4, existsSync as existsSync5, mkdirSync as mkdirSync5, openSync as openSync4, readSync as readSync3 } from "node:fs";
 import { dirname as dirname4, isAbsolute as isAbsolute8, join as join13, resolve as resolve4 } from "node:path";
 function sessionHash(sessionId) {
   if (!sessionId) return void 0;
   return "sha256:" + createHash6("sha256").update(sessionId).digest("hex").slice(0, 24);
 }
 function eventId() {
-  return "sha256:" + createHash6("sha256").update(randomBytes(32)).digest("hex").slice(0, 32);
+  return "sha256:" + createHash6("sha256").update(randomBytes2(32)).digest("hex").slice(0, 32);
 }
 function configuredAuditPath(cwd, env = process.env) {
   const value = env[AUDIT_LOG_ENV];
@@ -12362,7 +12456,7 @@ function recordAuditFindings(findings, context) {
       };
       return JSON.stringify(event);
     });
-    appendFileSync4(path, lines.join("\n") + "\n");
+    appendRegular(path, lines.join("\n") + "\n");
   } catch {
   }
 }
@@ -12576,7 +12670,7 @@ function runStats(opts = {}) {
   const file = opts.file ? isAbsolute8(opts.file) ? opts.file : resolve4(cwd, opts.file) : configured && configured !== "auto" ? isAbsolute8(configured) ? configured : resolve4(cwd, configured) : defaultAuditPath(cwd);
   const cutoff = opts.since ? parseSince(opts.since) : null;
   if (!file) throw new Error("stats needs --file outside a Git repository");
-  if (!existsSync7(file)) {
+  if (!existsSync5(file)) {
     if (explicitFile) throw new Error(`audit file not found: ${file}`);
     const empty2 = summarizeAudit([]);
     process.stdout.write(opts.json ? JSON.stringify(empty2) + "\n" : renderAuditStats(empty2));
@@ -12597,6 +12691,7 @@ var init_audit = __esm({
   "src/cli/audit.ts"() {
     "use strict";
     init_repo_context();
+    init_disk();
     AUDIT_SCHEMA_VERSION = 1;
     AUDIT_LOG_ENV = "TAMPERWARD_AUDIT_LOG";
     MAX_AUDIT_LINE_BYTES = 16 * 1024;
@@ -12615,14 +12710,14 @@ var init_audit = __esm({
 });
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync9, appendFileSync as appendFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
 function setSnapshotCache(cache3) {
   snapshotCache = cache3;
 }
 function readStdin() {
   try {
-    return readFileSync9(0, "utf8");
+    return readFileSync6(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -12650,7 +12745,7 @@ function recordDenylog(blocks2) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync5(log, blocks2.map((b) => b.rule).join(",") + "\n");
+    appendRegular(log, blocks2.map((b) => b.rule).join(",") + "\n");
   } catch {
   }
 }
@@ -12912,10 +13007,11 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
     recordObserverHealth(cwd, sessionId, telemetry.state, telemetry.reason);
   }
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync8(log)) return none;
+  if (!existsSync6(log)) return none;
   let offset = 0;
-  if (cp && existsSync8(cp)) {
-    const n2 = Number(readFileSync9(cp, "utf8"));
+  const cursorText = cp ? readStateFile(cp) : null;
+  if (cursorText !== null) {
+    const n2 = Number(cursorText);
     offset = Number.isFinite(n2) ? n2 : 0;
   }
   const drained = drainEvents(log, offset);
@@ -12968,7 +13064,7 @@ function recordWarns(cwd, sessionId, warns) {
   const log = process.env.TAMPERWARD_DENYLOG;
   if (!log) return;
   try {
-    appendFileSync5(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
+    appendRegular(log, warns.map((w) => `warn:${w.rule}:${w.file ?? ""}`).join("\n") + "\n");
   } catch {
   }
 }
@@ -12978,7 +13074,7 @@ function recordObserverHealth(cwd, sessionId, state, reason) {
   if (!log) return;
   const detail = (reason ?? "").replace(/[\r\n]+/g, " ").trim();
   try {
-    appendFileSync5(
+    appendRegular(
       log,
       `warn:transient-observer:${state}${detail ? ":" + detail : ""}
 `
@@ -13095,7 +13191,7 @@ var init_hook = __esm({
 });
 
 // src/ptree-cache.ts
-import { lstatSync as lstatSync6 } from "node:fs";
+import { lstatSync as lstatSync7 } from "node:fs";
 import { join as join14 } from "node:path";
 function keyOf(st) {
   return `${st.dev}:${st.ino}:${st.size}:${st.mode}:${st.mtimeNs}:${st.ctimeNs}`;
@@ -13149,7 +13245,7 @@ var init_ptree_cache = __esm({
         const abs = join14(cwd, rel);
         let st;
         try {
-          st = lstatSync6(abs, { bigint: true });
+          st = lstatSync7(abs, { bigint: true });
         } catch {
           this.map.delete(abs);
           this.stats.misses++;
@@ -13171,7 +13267,7 @@ var init_ptree_cache = __esm({
         const entry = compute();
         let after;
         try {
-          after = lstatSync6(abs, { bigint: true });
+          after = lstatSync7(abs, { bigint: true });
         } catch {
           this.map.delete(abs);
           return entry;
@@ -13189,13 +13285,13 @@ var init_ptree_cache = __esm({
 });
 
 // src/cli/hook-service.ts
-import { chmodSync, existsSync as existsSync9, lstatSync as lstatSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync10, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync, existsSync as existsSync7, lstatSync as lstatSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { createConnection as createConnection2, createServer } from "node:net";
 import { realpathSync as realpathSync4 } from "node:fs";
 import { sep } from "node:path";
 function readServiceState(paths) {
   try {
-    const v = JSON.parse(readFileSync10(paths.state, "utf8"));
+    const v = JSON.parse(readFileSync7(paths.state, "utf8"));
     if (!isRecord(v)) return null;
     const { pid, version, root, started_at } = v;
     if (typeof pid !== "number" || typeof version !== "string" || typeof root !== "string" || typeof started_at !== "string") return null;
@@ -13272,13 +13368,13 @@ function withEnv(env, fn) {
 }
 function removeQuietly(p) {
   try {
-    rmSync4(p, { force: true });
+    rmSync5(p, { force: true });
   } catch {
   }
 }
 function ensurePrivateDir(dir, uid) {
-  if (!existsSync9(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
-  const st = lstatSync7(dir);
+  if (!existsSync7(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
+  const st = lstatSync8(dir);
   if (!st.isDirectory()) throw new Error(`${dir} is not a directory`);
   if (st.uid !== uid) throw new Error(`${dir} is owned by uid ${st.uid}, not ${uid}; refusing to serve from it`);
   if ((st.mode & 63) !== 0) chmodSync(dir, 448);
@@ -13474,7 +13570,7 @@ async function stopHookService(paths, expectedRoot) {
         process.kill(st.pid, "SIGTERM");
       } catch {
       }
-      const gone = () => !pidAlive2(st.pid) || !existsSync9(paths.socket);
+      const gone = () => !pidAlive2(st.pid) || !existsSync7(paths.socket);
       const until = Date.now() + STOP_WAIT_MS;
       while (!gone() && Date.now() < until) sleepSync(50);
       if (!gone()) throw new Error(`hook service pid ${st.pid} did not exit within ${STOP_WAIT_MS / 1e3}s`);
@@ -13708,55 +13804,10 @@ var init_verifier_limits = __esm({
   }
 });
 
-// src/safe-write.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { lstatSync as lstatSync8, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "node:fs";
-function writeTargetKind(path) {
-  let st;
-  try {
-    st = lstatSync8(path, { throwIfNoEntry: false });
-  } catch (e) {
-    if (errnoCode(e) === "ENOTDIR") return "absent";
-    throw e;
-  }
-  if (!st) return "absent";
-  if (st.isSymbolicLink()) return "symlink";
-  return st.isFile() ? "file" : "irregular";
-}
-function refuseNonRegular(path) {
-  switch (writeTargetKind(path)) {
-    case "symlink":
-      return "refusing: symlink \u2014 the target would be written instead of this path; replace the link with a regular file, then re-run";
-    case "irregular":
-      return "refusing: not a regular file \u2014 a directory or special file stands where a file is expected; remove it, then re-run";
-    default:
-      return null;
-  }
-}
-function existingMode(path, fallback) {
-  if (writeTargetKind(path) !== "file") return fallback;
-  return lstatSync8(path).mode & 511;
-}
-function atomicReplaceFile(path, content, mode) {
-  const tmp = `${path}.${process.pid}.${randomBytes2(8).toString("hex")}.tmp`;
-  try {
-    writeFileSync7(tmp, content, { encoding: "utf8", flag: "wx", mode });
-    renameSync3(tmp, path);
-  } finally {
-    rmSync5(tmp, { force: true });
-  }
-}
-var init_safe_write = __esm({
-  "src/safe-write.ts"() {
-    "use strict";
-    init_narrow();
-  }
-});
-
 // src/cli/init.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync8, realpathSync as realpathSync5 } from "node:fs";
 import { basename as basename3, dirname as dirname5, isAbsolute as isAbsolute9, join as join15, relative as relative4, resolve as resolve6 } from "node:path";
 function gitConfig(cwd, key2) {
   try {
@@ -13850,34 +13901,34 @@ function verifierCandidates(cwd) {
     if (!candidates.includes(command)) candidates.push(command);
   };
   try {
-    const pkg = JSON.parse(readFileSync11(join15(cwd, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync8(join15(cwd, "package.json"), "utf8"));
     const test = isRecord(pkg) && isRecord(pkg.scripts) ? pkg.scripts.test : void 0;
     if (typeof test === "string" && test.trim() !== "" && !/error:\s*no test specified/i.test(test)) add("npm test");
   } catch {
   }
   try {
-    const pyproject = readFileSync11(join15(cwd, "pyproject.toml"), "utf8");
+    const pyproject = readFileSync8(join15(cwd, "pyproject.toml"), "utf8");
     if (/^\s*\[tool\.pytest(?:\.ini_options)?\]\s*$/m.test(pyproject)) add("pytest");
   } catch {
   }
-  if (existsSync10(join15(cwd, "pytest.ini"))) add("pytest");
+  if (existsSync8(join15(cwd, "pytest.ini"))) add("pytest");
   try {
-    const setupCfg = readFileSync11(join15(cwd, "setup.cfg"), "utf8");
+    const setupCfg = readFileSync8(join15(cwd, "setup.cfg"), "utf8");
     if (/^\s*\[tool:pytest\]\s*$/m.test(setupCfg)) add("pytest");
   } catch {
   }
   try {
-    const tox = readFileSync11(join15(cwd, "tox.ini"), "utf8");
+    const tox = readFileSync8(join15(cwd, "tox.ini"), "utf8");
     if (/^\s*\[tox\]\s*$/m.test(tox)) add("tox");
   } catch {
   }
   try {
-    const cargo = readFileSync11(join15(cwd, "Cargo.toml"), "utf8");
+    const cargo = readFileSync8(join15(cwd, "Cargo.toml"), "utf8");
     if (/^\s*\[(?:package|workspace)\]\s*(?:#.*)?$/m.test(cargo)) add("cargo test");
   } catch {
   }
   try {
-    const goMod = readFileSync11(join15(cwd, "go.mod"), "utf8");
+    const goMod = readFileSync8(join15(cwd, "go.mod"), "utf8");
     if (/^\s*module\s+\S+\s*(?:\/\/.*)?$/m.test(goMod)) add("go test ./...");
   } catch {
   }
@@ -13920,7 +13971,7 @@ function planPolicy(cwd) {
   const path = join15(cwd, POLICY_FILE);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "policy", path: POLICY_FILE, status: "error", detail: refused };
-  if (existsSync10(path)) {
+  if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -13939,7 +13990,7 @@ function planPolicy(cwd) {
 function planGitignore(cwd) {
   const rel = ".gitignore";
   const path = join15(cwd, rel);
-  if (!existsSync10(join15(cwd, "node_modules"))) return null;
+  if (!existsSync8(join15(cwd, "node_modules"))) return null;
   let existing = "";
   let kind;
   try {
@@ -13949,7 +14000,7 @@ function planGitignore(cwd) {
   }
   const refused = refuseNonRegular(path);
   if (refused) return { item: "gitignore", path: rel, status: "error", detail: refused };
-  if (kind === "file") existing = readFileSync11(path, "utf8");
+  if (kind === "file") existing = readFileSync8(path, "utf8");
   try {
     const tracked = execFileSync6("git", ["ls-files", "--cached", "--", "node_modules"], {
       cwd,
@@ -14004,10 +14055,10 @@ function planClaudeHooks(cwd) {
   const refused = refuseNonRegular(path);
   if (refused) return { item: "agent", path: rel, status: "error", detail: refused };
   let settings = {};
-  if (existsSync10(path)) {
+  if (existsSync8(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync11(path, "utf8"));
+      parsed = JSON.parse(readFileSync8(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -14056,7 +14107,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync10(path) ? "update" : "create",
+    status: existsSync8(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -14100,7 +14151,7 @@ function hooksDir(cwd) {
     if (out3) return resolve6(cwd, out3);
   } catch {
   }
-  return existsSync10(join15(cwd, ".git")) ? join15(cwd, ".git", "hooks") : null;
+  return existsSync8(join15(cwd, ".git")) ? join15(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative4(cwd, path);
@@ -14127,11 +14178,11 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync10(join15(cwd, ".husky"))) {
+  if (existsSync8(join15(cwd, ".husky"))) {
     path = join15(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync10(join15(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join15(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
@@ -14149,7 +14200,7 @@ function planPreCommit(cwd) {
   const rel = display(cwd, path);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "pre-commit", path: rel, status: "error", detail: refused };
-  const existing = existsSync10(path) ? readFileSync11(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync8(path, "utf8") : null;
   const hookMode = () => existingMode(path, 493) | 73;
   if (existing === null) {
     return {
@@ -14240,7 +14291,7 @@ function planCodeowners(cwd) {
   const path = join15(cwd, existingRel ?? rel);
   const refused = refuseNonRegular(path);
   if (refused) return { item: "codeowners", path: existingRel ?? rel, status: "error", detail: refused };
-  const existing = existingRel ? readFileSync11(path, "utf8") : null;
+  const existing = existingRel ? readFileSync8(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (existingRel !== void 0 && missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -14280,7 +14331,7 @@ function planWorkflow(cwd, force) {
   };
   const refused = refuseNonRegular(path);
   if (refused) return { item: "ci", path: rel, status: "error", detail: refused };
-  if (!existsSync10(path)) {
+  if (!existsSync8(path)) {
     return {
       item: "ci",
       path: rel,
@@ -14291,7 +14342,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync11(path, "utf8");
+    src = readFileSync8(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -14638,10 +14689,10 @@ var init_fingerprint = __esm({
 // src/dependency-env.ts
 import { createHash as createHash10 } from "node:crypto";
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync9,
   lstatSync as lstatSync9,
   readdirSync as readdirSync3,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync9,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync6,
   statSync as statSync3
@@ -14699,7 +14750,7 @@ function fingerprintRoot(root, cwd, h) {
       st = statSync3(path);
       if (!st.isFile()) throw new Error("not a regular file");
       h.update(label + "\0external-file\0" + path + "\0" + String(st.mode) + "\0");
-      h.update(readFileSync12(path));
+      h.update(readFileSync9(path));
       h.update("\0");
     } catch (e) {
       throw new Unattestable(
@@ -14733,7 +14784,7 @@ function fingerprintRoot(root, cwd, h) {
       h.update(rel + "\0" + ident.kind + "\0" + String(ident.mode) + "\0");
       if (ident.kind === "file") {
         try {
-          h.update(readFileSync12(path));
+          h.update(readFileSync9(path));
           h.update("\0");
         } catch (e) {
           throw new Unattestable(
@@ -14792,7 +14843,7 @@ function snapshot(roots, probes, cwd) {
   const h = createHash10("sha256");
   for (const probe of probes) {
     h.update(
-      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync11(probe.path) ? "present" : "absent") + "\0"
+      "probe\0" + probe.kind + "\0" + probe.path + "\0" + (existsSync9(probe.path) ? "present" : "absent") + "\0"
     );
   }
   for (const root of roots) fingerprintRoot(root, cwd, h);
@@ -14851,7 +14902,7 @@ function resolveExecutable(token, cwd, env) {
   if (token.includes("/") || token.includes("\\")) {
     const path = isAbsolute10(token) ? token : resolve7(cwd, token);
     try {
-      return existsSync11(path) ? realpathSync6(path) : null;
+      return existsSync9(path) ? realpathSync6(path) : null;
     } catch {
       return null;
     }
@@ -14859,7 +14910,7 @@ function resolveExecutable(token, cwd, env) {
   for (const entry of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     const candidate = resolve7(entry, token);
     try {
-      if (existsSync11(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
+      if (existsSync9(candidate) && statSync3(candidate).isFile()) return realpathSync6(candidate);
     } catch {
     }
   }
@@ -14882,7 +14933,7 @@ function inferredVenvFromToken(token, cwd) {
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname6(parent);
-  return existsSync11(join16(root, "pyvenv.cfg")) ? root : null;
+  return existsSync9(join16(root, "pyvenv.cfg")) ? root : null;
 }
 function unsupportedEcosystem(command, token) {
   const name = token ? basename4(token).toLowerCase() : "";
@@ -14898,13 +14949,13 @@ function inferredVenv(executable) {
   const parentName = basename4(parent).toLowerCase();
   if (parentName !== "bin" && parentName !== "scripts") return null;
   const root = dirname6(parent);
-  return existsSync11(join16(root, "pyvenv.cfg")) ? root : null;
+  return existsSync9(join16(root, "pyvenv.cfg")) ? root : null;
 }
 function venvProblem(root) {
   const cfg = join16(root, "pyvenv.cfg");
-  if (!existsSync11(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
+  if (!existsSync9(cfg)) return "VIRTUAL_ENV " + JSON.stringify(root) + " has no pyvenv.cfg";
   try {
-    const body = readFileSync12(cfg, "utf8");
+    const body = readFileSync9(cfg, "utf8");
     if (/^\s*include-system-site-packages\s*=\s*true\s*$/im.test(body)) {
       return "Python environment " + JSON.stringify(root) + " enables system site-packages; those external package roots are not bounded";
     }
@@ -14929,7 +14980,7 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
   };
   try {
     const nodeModules = join16(cwd, "node_modules");
-    if (existsSync11(nodeModules)) addRoot("node_modules", nodeModules);
+    if (existsSync9(nodeModules)) addRoot("node_modules", nodeModules);
     else probes.push({ kind: "node_modules", path: nodeModules });
     const token = firstExecutable(command);
     const executable = resolveExecutable(token, cwd, env);
@@ -14941,7 +14992,7 @@ function discoverDependencyEnvironment(cwdInput, command, env = process.env) {
       venv = resolve7(env.VIRTUAL_ENV);
     } else {
       venv = inferredVenv(executable) ?? inferredVenvFromToken(token, cwd);
-      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync11(join16(cwd, ".venv", "pyvenv.cfg"))) {
+      if (!venv && /(?:^|\s)uv\s+run(?:\s|$)/.test(command) && existsSync9(join16(cwd, ".venv", "pyvenv.cfg"))) {
         venv = join16(cwd, ".venv");
       }
     }
@@ -15046,7 +15097,7 @@ var init_dependency_env = __esm({
 
 // src/suite-diagnostics.ts
 import { spawnSync } from "node:child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join17 } from "node:path";
 function emptySuiteDiagnostics() {
@@ -15132,7 +15183,7 @@ function runCapturedProcessSync(executable, args, opts) {
   const configFile = join17(stateDir2, "config.json");
   const backstop = opts.backstopMs ?? 3e4;
   try {
-    writeFileSync8(
+    writeFileSync7(
       configFile,
       JSON.stringify({
         executable,
@@ -15420,7 +15471,7 @@ if (child) {
 // src/verifier-backend.ts
 import { createHash as createHash11, randomUUID } from "node:crypto";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants4, readFileSync as readFileSync13, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
+import { accessSync as accessSync2, constants as constants4, readFileSync as readFileSync10, realpathSync as realpathSync7, statSync as statSync4 } from "node:fs";
 import { delimiter as delimiter2, dirname as dirname7, join as join18, resolve as resolve8 } from "node:path";
 function identity() {
   const uid = typeof process.getuid === "function" ? process.getuid() : null;
@@ -15465,7 +15516,7 @@ function findExecutable(name) {
   return null;
 }
 function fileSha256(path) {
-  return createHash11("sha256").update(readFileSync13(path)).digest("hex");
+  return createHash11("sha256").update(readFileSync10(path)).digest("hex");
 }
 function engineClientEnv() {
   return {
@@ -15899,7 +15950,7 @@ var init_verifier_backend = __esm({
 // src/verification-state.ts
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { createHash as createHash12 } from "node:crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync14, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync11, rmSync as rmSync7, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname8, join as join19 } from "node:path";
 function git2(args, cwd) {
   return execFileSync8("git", args, {
@@ -15958,7 +16009,7 @@ function interventionWiring(cwd) {
   return sources.map(([source, path]) => {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync14(path, "utf8"));
+      parsed = JSON.parse(readFileSync11(path, "utf8"));
     } catch {
       return { source, present: false };
     }
@@ -16043,7 +16094,7 @@ function recordVerification(cwd, inputs, treeFingerprintValue) {
     binding
   };
   mkdirSync8(dirname8(path), { recursive: true });
-  writeFileSync9(path, JSON.stringify(record) + "\n");
+  writeFileSync8(path, JSON.stringify(record) + "\n");
   return true;
 }
 function invalidateVerificationRecordIfCurrent(cwd) {
@@ -16111,7 +16162,7 @@ function readVerificationRecord(cwd) {
   if (!path) return null;
   let raw;
   try {
-    raw = readFileSync14(path, "utf8");
+    raw = readFileSync11(path, "utf8");
   } catch {
     return null;
   }
@@ -16141,7 +16192,7 @@ function beginVerifying(cwd) {
       started_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     mkdirSync8(dirname8(path), { recursive: true });
-    writeFileSync9(path, JSON.stringify(marker) + "\n");
+    writeFileSync8(path, JSON.stringify(marker) + "\n");
     return true;
   } catch {
     return false;
@@ -16160,7 +16211,7 @@ function readVerifyingMarker(cwd) {
   if (!path) return null;
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(path, "utf8"));
+    parsed = JSON.parse(readFileSync11(path, "utf8"));
   } catch {
     return null;
   }
@@ -16294,7 +16345,7 @@ var init_verification_state = __esm({
 
 // src/verification-receipt.ts
 import { createHash as createHash13 } from "node:crypto";
-import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync9, rmSync as rmSync8, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname9, join as join20 } from "node:path";
 function isRecord5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -16341,7 +16392,7 @@ function storeReceipt(cwd, receipt) {
   if (!path) return false;
   try {
     mkdirSync9(dirname9(path), { recursive: true });
-    writeFileSync10(path, JSON.stringify(receipt) + "\n");
+    writeFileSync9(path, JSON.stringify(receipt) + "\n");
     return true;
   } catch {
     return false;
@@ -16524,7 +16575,7 @@ var init_verification_receipt = __esm({
 // src/cli/verify.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync11, existsSync as existsSync12 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync10, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync3, rmSync as rmSync9, symlinkSync, writeFileSync as writeFileSync10, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname10, isAbsolute as isAbsolute11, join as join21, relative as relative6, resolve as resolve9, sep as sep4 } from "node:path";
 function oracleAssuranceReport() {
@@ -16719,8 +16770,8 @@ function probeFilesystemCaseSensitivity(dir) {
   const upper = join21(dir, ".tw-case-probe-A");
   const lower = join21(dir, ".tw-case-probe-a");
   try {
-    writeFileSync11(upper, "", { flag: "wx" });
-    return !existsSync12(lower);
+    writeFileSync10(upper, "", { flag: "wx" });
+    return !existsSync10(lower);
   } finally {
     rmSync9(upper, { force: true });
   }
@@ -16784,7 +16835,7 @@ function overlayDigest(dest, paths) {
     try {
       const st = lstatSync10(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync15(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync12(p));
     } catch {
       h.update("<gone>");
     }
@@ -16822,7 +16873,7 @@ function overlayPristine(cwd, base, dest, policy, cmd, dependencyRoot, caseSensi
       safeSymlink(target, out3, dest, `the base's ${e.path}`);
       restoredLinks.push({ path: e.path, out: out3, target });
     } else {
-      writeFileSync11(out3, content);
+      writeFileSync10(out3, content);
       chmodSync2(out3, parseInt(e.mode.slice(-4), 8) & 511);
     }
     restored.push(e.path);
@@ -16847,7 +16898,7 @@ function suiteEnv(scratch) {
   }
   const userRc = join21(scratch, "npmrc-user");
   const globalRc = join21(scratch, "npmrc-global");
-  for (const f of [userRc, globalRc]) writeFileSync11(f, "", { mode: 292 });
+  for (const f of [userRc, globalRc]) writeFileSync10(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
   env.npm_config_node_options = " ";
@@ -17598,7 +17649,7 @@ var init_verify = __esm({
 // src/cli/run.ts
 import { execFileSync as execFileSync10, spawn, spawnSync as spawnSync4 } from "node:child_process";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync16, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync12 } from "node:fs";
+import { accessSync as accessSync3, constants as fsConstants, mkdtempSync as mkdtempSync4, readdirSync as readdirSync4, readFileSync as readFileSync13, readlinkSync as readlinkSync4, realpathSync as realpathSync8, rmSync as rmSync10, statSync as statSync5, writeFileSync as writeFileSync11 } from "node:fs";
 import { tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname11, join as join22, resolve as resolve10 } from "node:path";
 function authoritativeRunLifecyclePlatform(platform = process.platform) {
@@ -17695,7 +17746,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
           failure: trustedPython.reason ?? "trusted Linux python3 interpreter is unavailable"
         };
       }
-      writeFileSync12(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
+      writeFileSync11(agentEnvFile, JSON.stringify(process.env), { mode: 384 });
       executable = trustedPython.path;
       args = [
         "-I",
@@ -17752,7 +17803,7 @@ function runAgentSupervised(argv, cwd, budgetSecs, linuxPythonCandidates, lifecy
     }
     let state = {};
     try {
-      state = JSON.parse(readFileSync16(resultFile, "utf8"));
+      state = JSON.parse(readFileSync13(resultFile, "utf8"));
     } catch {
       return {
         exit: 1,
@@ -17796,7 +17847,7 @@ function observerExited(pid) {
   if (!pidAlive4(pid)) return true;
   if (process.platform !== "linux") return false;
   try {
-    const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync13(`/proc/${pid}/stat`, "utf8");
     const state = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[0];
     return state === "Z" || state === "X";
   } catch (e) {
@@ -17918,7 +17969,7 @@ function git4(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync13("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -17941,7 +17992,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     const n2 = Number(pid);
     if (n2 === process.pid) continue;
     try {
-      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync13(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (!Number.isFinite(startTicks) || startTicks < spawnedAfterTicks) continue;
     } catch {
@@ -18514,7 +18565,7 @@ raise SystemExit(0)
 
 // src/cli/doctor.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync17, readdirSync as readdirSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync14, readdirSync as readdirSync5 } from "node:fs";
 import { join as join23, resolve as resolve11 } from "node:path";
 function lifecyclePlatformCheck(platform = process.platform, linuxPython = platform === "linux" ? trustedLinuxPython() : null) {
   if (platform === "linux") {
@@ -18570,10 +18621,10 @@ function wiringState(status, authority) {
   return authority ? "BROKEN" : "WARN";
 }
 function pinsInFile(path) {
-  if (!existsSync13(path)) return [];
+  if (!existsSync11(path)) return [];
   let src = "";
   try {
-    src = readFileSync17(path, "utf8");
+    src = readFileSync14(path, "utf8");
   } catch {
     return [];
   }
@@ -18594,13 +18645,13 @@ function workflowPermissionCheck(cwd, workflowRels = [".github/workflows/tamperw
   const warnings = [];
   for (const rel of workflowRels) {
     const path = resolve11(cwd, rel);
-    if (!existsSync13(path)) {
+    if (!existsSync11(path)) {
       broken.push(`${rel} is missing`);
       continue;
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync17(path, "utf8"));
+      doc = yaml.parse(readFileSync14(path, "utf8"));
     } catch (e) {
       broken.push(`${rel} is not valid YAML (${e instanceof Error ? e.message : String(e)})`);
       continue;
@@ -18999,7 +19050,7 @@ function diagnose(opts = {}) {
   } else {
     const workflowDirRel = ".github/workflows";
     const workflowDir = resolve11(cwd, workflowDirRel);
-    if (!existsSync13(workflowDir)) {
+    if (!existsSync11(workflowDir)) {
       return fail("ci-verifier", `${workflowDirRel}: workflow directory does not exist`);
     }
     let entries;
@@ -19019,12 +19070,12 @@ function diagnose(opts = {}) {
   const authorityWorkflows = [];
   for (const workflowRel of workflowRels) {
     const workflowPath = resolve11(cwd, workflowRel);
-    if (!existsSync13(workflowPath)) {
+    if (!existsSync11(workflowPath)) {
       return fail("ci-verifier", `${workflowRel}: workflow does not exist`);
     }
     let doc;
     try {
-      doc = yaml.parse(readFileSync17(workflowPath, "utf8"));
+      doc = yaml.parse(readFileSync14(workflowPath, "utf8"));
     } catch (e) {
       return fail(
         "ci-verifier",
@@ -19335,9 +19386,9 @@ var init_status2 = __esm({
 // src/cli/trace-verify.ts
 import { execFileSync as execFileSync12, spawnSync as spawnSync5 } from "node:child_process";
 import {
-  existsSync as existsSync14,
+  existsSync as existsSync12,
   mkdtempSync as mkdtempSync5,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync15,
   readdirSync as readdirSync6,
   realpathSync as realpathSync9,
   rmSync as rmSync11,
@@ -19594,7 +19645,7 @@ function materializeBase(base, cwd, dest) {
   }
   const hostModules = join24(cwd, "node_modules");
   const tracedModules = join24(dest, "node_modules");
-  if (existsSync14(hostModules) && !existsSync14(tracedModules)) {
+  if (existsSync12(hostModules) && !existsSync12(tracedModules)) {
     symlinkSync2(resolve12(hostModules), tracedModules, "dir");
   }
 }
@@ -19651,7 +19702,7 @@ function straceOnce(root, command, budget) {
       }
     );
     const logs = traced.error ? [] : traceFiles(prefix);
-    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync18(path, "utf8"), TRACE_ROOT));
+    const accesses = logs.flatMap((path) => parseStraceFileAccess(readFileSync15(path, "utf8"), TRACE_ROOT));
     const raw = {
       spawnError: traced.error ? traced.error.message : null,
       status: traced.status,
@@ -19906,7 +19957,7 @@ var init_immutable = __esm({
 });
 
 // src/runtimes.ts
-import { existsSync as existsSync15, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
 import { join as join25 } from "node:path";
 function isRecord6(x) {
   return typeof x === "object" && x !== null && !Array.isArray(x);
@@ -19936,8 +19987,8 @@ function claudeSettingsBeyondTamperward(cwd) {
   const path = join25(cwd, ".claude", "settings.json");
   let raw;
   try {
-    if (!existsSync15(path)) return false;
-    raw = readFileSync19(path, "utf8");
+    if (!existsSync13(path)) return false;
+    raw = readFileSync16(path, "utf8");
   } catch {
     return false;
   }
@@ -19963,7 +20014,7 @@ function detectRuntimes(cwd) {
   for (const rt of KNOWN_RUNTIMES) {
     const marker = rt.markers.find((m) => {
       try {
-        return existsSync15(join25(cwd, m));
+        return existsSync13(join25(cwd, m));
       } catch {
         return false;
       }
@@ -20988,7 +21039,7 @@ var init_adapter3 = __esm({
 
 // src/adapters/copilot-sdk/changes.ts
 import { execFileSync as execFileSync13 } from "node:child_process";
-import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync13, readFileSync as readFileSync20, rmSync as rmSync12, existsSync as existsSync16, realpathSync as realpathSync10 } from "node:fs";
+import { mkdtempSync as mkdtempSync6, writeFileSync as writeFileSync12, readFileSync as readFileSync17, rmSync as rmSync12, existsSync as existsSync14, realpathSync as realpathSync10 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { basename as basename5, dirname as dirname12, isAbsolute as isAbsolute16, relative as relative11, resolve as resolve15, join as join26 } from "node:path";
 function asStr4(v) {
@@ -21007,7 +21058,7 @@ function canonicalContainedTarget(abs, root) {
   }
   let dir = abs;
   const tail = [];
-  while (!existsSync16(dir)) {
+  while (!existsSync14(dir)) {
     const parent = dirname12(dir);
     if (parent === dir) break;
     tail.unshift(basename5(dir));
@@ -21065,9 +21116,9 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
   const dir = mkdtempSync6(join26(tmpdir7(), "hf-sdk-apply-"));
   try {
     const targetPath = join26(dir, TARGET);
-    if (op !== "create") writeFileSync13(targetPath, before ?? "");
+    if (op !== "create") writeFileSync12(targetPath, before ?? "");
     const patchPath = join26(dir, "change.patch");
-    writeFileSync13(patchPath, patch);
+    writeFileSync12(patchPath, patch);
     const git8 = (extra) => execFileSync13("git", ["apply", ...extra, patchPath], {
       cwd: dir,
       encoding: "utf8",
@@ -21082,7 +21133,7 @@ function reconstructAfterViaGit(rawDiff, display2, before, isCreate) {
     if (statPath !== TARGET) throw new Error(`write diff reconstructs a different file (${statPath}) than the bound target`);
     git8(["--check"]);
     git8([]);
-    return op === "delete" ? null : readFileSync20(targetPath, "utf8");
+    return op === "delete" ? null : readFileSync17(targetPath, "utf8");
   } catch (e) {
     throw new Error(`could not reconstruct the write to ${display2} from its diff via git apply: ${e instanceof Error ? e.message : String(e)}`);
   } finally {
@@ -21835,7 +21886,7 @@ var init_runtime_qualification = __esm({
 
 // src/cli/runtime.ts
 import { execFileSync as execFileSync14 } from "node:child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join27, dirname as dirname13 } from "node:path";
 function storePath(cwd) {
   const dir = gitDir(cwd);
@@ -21843,9 +21894,9 @@ function storePath(cwd) {
 }
 function readStore(cwd) {
   const path = storePath(cwd);
-  if (!path || !existsSync17(path)) return null;
+  if (!path || !existsSync15(path)) return null;
   try {
-    const parsed = JSON.parse(readFileSync21(path, "utf8"));
+    const parsed = JSON.parse(readFileSync18(path, "utf8"));
     if (parsed && typeof parsed === "object" && parsed.records && typeof parsed.records === "object") return parsed;
   } catch {
     return null;
@@ -21976,7 +22027,7 @@ function writeRecord(cwd, id, report2) {
   store.updated_at = report2.timestamp;
   try {
     mkdirSync11(dirname13(path), { recursive: true });
-    writeFileSync14(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+    writeFileSync13(path, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
     return true;
   } catch {
     return false;
@@ -22014,9 +22065,9 @@ function resolveHookConfigHash(canonicalId, cwd) {
     "github-copilot-cli": join27(cwd, ".github", "hooks", "tamperward.json")
   };
   const file = files[canonicalId];
-  if (!file || !existsSync17(file)) return null;
+  if (!file || !existsSync15(file)) return null;
   try {
-    const raw = readFileSync21(file, "utf8");
+    const raw = readFileSync18(file, "utf8");
     let hooks = raw;
     try {
       const parsed = JSON.parse(raw);
@@ -22295,7 +22346,7 @@ var init_runtime = __esm({
 
 // src/cli/onboard.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
-import { lstatSync as lstatSync11, mkdtempSync as mkdtempSync7, readFileSync as readFileSync22, realpathSync as realpathSync11, rmSync as rmSync13 } from "node:fs";
+import { lstatSync as lstatSync11, mkdtempSync as mkdtempSync7, readFileSync as readFileSync19, realpathSync as realpathSync11, rmSync as rmSync13 } from "node:fs";
 import { tmpdir as tmpdir8 } from "node:os";
 import { join as join28, relative as relative12, resolve as resolve16, sep as sep6 } from "node:path";
 import { createInterface } from "node:readline";
@@ -22368,7 +22419,7 @@ function writeVerifyCommand(cwd, command) {
     return `${POLICY_FILE} is not a regular file; refusing to follow or replace a symlink or special file`;
   }
   const mode = existingMode(path, 420);
-  const original = kind === "file" ? readFileSync22(path, "utf8") : null;
+  const original = kind === "file" ? readFileSync19(path, "utf8") : null;
   let next;
   try {
     const doc = parseDocument(original && original.trim() ? original : "version: 1\n");
@@ -23023,7 +23074,7 @@ var init_capture = __esm({
 
 // src/research/manifest.ts
 import { createHash as createHash16 } from "node:crypto";
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { dirname as dirname14, resolve as resolve18 } from "node:path";
 function taskFrom(raw, index, manifestDir) {
   const where = `task #${index + 1}`;
@@ -23057,7 +23108,7 @@ function readManifest(path) {
   const abs = resolve18(path);
   let bytes;
   try {
-    bytes = readFileSync23(abs);
+    bytes = readFileSync20(abs);
   } catch (e) {
     throw new ResearchError(`cannot read task manifest ${abs}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -23476,7 +23527,7 @@ var init_record = __esm({
 // src/research/run.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFileSync as execFileSync16 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync18, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync24, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync15, writeSync } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync16, linkSync, mkdirSync as mkdirSync12, openSync as openSync5, readFileSync as readFileSync21, renameSync as renameSync4, rmSync as rmSync14, unlinkSync, writeFileSync as writeFileSync14, writeSync as writeSync2 } from "node:fs";
 import { hostname } from "node:os";
 import { join as join29, resolve as resolve19 } from "node:path";
 function git7(args, cwd) {
@@ -23490,7 +23541,7 @@ function researchLockPath(ledger) {
 }
 function readLockOwner(path) {
   try {
-    const parsed = JSON.parse(readFileSync24(path, "utf8"));
+    const parsed = JSON.parse(readFileSync21(path, "utf8"));
     if (!isRecord(parsed) || typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     if (typeof parsed.host !== "string" || typeof parsed.started_at !== "string" || typeof parsed.token !== "string") return null;
     return { pid: parsed.pid, host: parsed.host, started_at: parsed.started_at, token: parsed.token };
@@ -23513,7 +23564,7 @@ function lockHolder(path) {
 function acquireResearchLock(ledger, breakStaleLock = false) {
   mkdirSync12(ledger, { recursive: true });
   const path = researchLockPath(ledger);
-  if (breakStaleLock && existsSync18(path)) {
+  if (breakStaleLock && existsSync16(path)) {
     const owner2 = readLockOwner(path);
     if (!owner2) {
       throw new ResearchError(`research output ${ledger} has an unreadable lock at ${path}; verify no run is active, then remove it deliberately`);
@@ -23557,7 +23608,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
   let fd = -1;
   try {
     fd = openSync5(path, "wx", 384);
-    writeSync(fd, text);
+    writeSync2(fd, text);
     closeSync5(fd);
     fd = -1;
   } catch (e) {
@@ -23575,7 +23626,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
       if (released) return;
       released = true;
       try {
-        if (readFileSync24(path, "utf8") === text) unlinkSync(path);
+        if (readFileSync21(path, "utf8") === text) unlinkSync(path);
       } catch {
       }
     }
@@ -23584,7 +23635,7 @@ function acquireResearchLock(ledger, breakStaleLock = false) {
 function resumableRecord(path, expected) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync24(path, "utf8"));
+    raw = JSON.parse(readFileSync21(path, "utf8"));
   } catch (e) {
     throw new ResearchError(`ledger record ${path} is malformed (${errorMessage(e).split("\n")[0]}); remove it to regenerate the pair, or use a new --out`);
   }
@@ -23621,7 +23672,7 @@ function resumableRecord(path, expected) {
 }
 function writeRecordAtomically(path, text) {
   const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync15(tmp, text);
+  writeFileSync14(tmp, text);
   renameSync4(tmp, path);
 }
 function cloneArgs(repo, ws3) {
@@ -23886,7 +23937,7 @@ function runResearch(opts) {
       try {
         for (let pair = 1; pair <= pairs; pair++) {
           const path = pairRecordPath(ledger, task.id, pair);
-          if (!existsSync18(path)) continue;
+          if (!existsSync16(path)) continue;
           const existing = resumableRecord(path, {
             task: task.id,
             pair,
@@ -24006,7 +24057,7 @@ var init_run2 = __esm({
 });
 
 // src/research/ledger-files.ts
-import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync3, lstatSync as lstatSync12, openSync as openSync6, readFileSync as readFileSync25, readdirSync as readdirSync7, realpathSync as realpathSync12 } from "node:fs";
+import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync3, lstatSync as lstatSync12, openSync as openSync6, readFileSync as readFileSync22, readdirSync as readdirSync7, realpathSync as realpathSync12 } from "node:fs";
 import { join as join30, resolve as resolve20 } from "node:path";
 function lstatOrNull(path) {
   try {
@@ -24049,7 +24100,7 @@ function readRegularFile(path, realPairsDir, name) {
     if (!opened.isFile() || !sameInode || opened.nlink !== 1) {
       throw new ResearchError(`ledger record ${path} changed between listing and reading; refusing to read it`);
     }
-    return readFileSync25(fd);
+    return readFileSync22(fd);
   } finally {
     closeSync6(fd);
   }
@@ -24222,7 +24273,7 @@ var init_summarize = __esm({
 
 // src/research/init.ts
 import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync19, mkdirSync as mkdirSync13, readFileSync as readFileSync26, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
 import { basename as basename6, dirname as dirname15, resolve as resolve21 } from "node:path";
 function idFrom(repo) {
   const clean = repo.replace(/[\\/]$/, "").split(/[\\/]/).pop() || "task";
@@ -24234,7 +24285,7 @@ function createResearchManifest(opts) {
   if (!opts.prompt) throw new ResearchError("research init requires --prompt");
   if (!opts.verifyCommand) throw new ResearchError("research init requires --verify-command");
   const out3 = resolve21(opts.out);
-  if (existsSync19(out3)) throw new ResearchError(`research init refuses to overwrite ${out3}; choose a new path`);
+  if (existsSync17(out3)) throw new ResearchError(`research init refuses to overwrite ${out3}; choose a new path`);
   const id = opts.id ?? idFrom(opts.repo);
   if (!/^[A-Za-z0-9._-]+$/.test(id)) throw new ResearchError(`research init id must match [A-Za-z0-9._-] (got "${id}")`);
   if (opts.verifyBudget !== void 0 && (!Number.isFinite(opts.verifyBudget) || opts.verifyBudget <= 0)) {
@@ -24252,7 +24303,7 @@ function createResearchManifest(opts) {
   };
   const text = JSON.stringify(doc, null, 2) + "\n";
   mkdirSync13(dirname15(out3), { recursive: true });
-  writeFileSync16(out3, text, { flag: "wx", mode: 384 });
+  writeFileSync15(out3, text, { flag: "wx", mode: 384 });
   const parsed = readManifest(out3);
   if (parsed.tasks.length !== 1 || parsed.tasks[0].id !== id) throw new ResearchError(`research init wrote an invalid manifest ${out3}`);
   return out3;
@@ -24274,7 +24325,7 @@ function runResearchInit(opts) {
   }
 }
 function requireHash(path) {
-  return createHash17("sha256").update(readFileSync26(path)).digest("hex");
+  return createHash17("sha256").update(readFileSync23(path)).digest("hex");
 }
 var init_init2 = __esm({
   "src/research/init.ts"() {
@@ -24342,7 +24393,7 @@ var init_report2 = __esm({
 import { createHash as createHash18 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { gzipSync, gunzipSync } from "node:zlib";
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync27, writeFileSync as writeFileSync17 } from "node:fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "node:fs";
 import { dirname as dirname16, resolve as resolve22 } from "node:path";
 function octal(value, width) {
   return value.toString(8).padStart(width - 1, "0") + "\0";
@@ -24448,7 +24499,7 @@ function jsonBytes(value) {
 function validateResearchBundle(path) {
   let files;
   try {
-    files = parseTar(gunzipSync(readFileSync27(resolve22(path))));
+    files = parseTar(gunzipSync(readFileSync24(resolve22(path))));
   } catch (e) {
     throw new ResearchError(`cannot read research bundle ${path}: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -24518,7 +24569,7 @@ function createResearchBundle(opts) {
   const { records, entries } = packagedRecords(ledger);
   const summary = summarizeRecords(records);
   if (opts.manifest) {
-    const manifest = readFileSync27(resolve22(opts.manifest));
+    const manifest = readFileSync24(resolve22(opts.manifest));
     const sha3 = createHash18("sha256").update(manifest).digest("hex");
     if (sha3 !== summary.manifest_sha256) throw new ResearchError(`manifest sha256 ${sha3} does not match ledger ${summary.manifest_sha256}`);
     entries.push({ name: "manifest.json", bytes: manifest });
@@ -24542,7 +24593,7 @@ function createResearchBundle(opts) {
   entries.push({ name: "provenance.json", bytes: jsonBytes(provenance) });
   const out3 = resolve22(opts.out);
   mkdirSync14(dirname16(out3), { recursive: true });
-  writeFileSync17(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
+  writeFileSync16(out3, gzipSync(makeTar(entries)), { flag: "wx", mode: 384 });
   return out3;
 }
 function runResearchBundle(opts) {
@@ -24689,7 +24740,7 @@ var init_research = __esm({
 });
 
 // src/cli/receipt.ts
-import { appendFileSync as appendFileSync6, readFileSync as readFileSync28, writeFileSync as writeFileSync18 } from "node:fs";
+import { appendFileSync as appendFileSync3, readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
 function parseReceipt(args) {
   const [sub, ...rest] = args;
   const exportOpts = {};
@@ -24791,7 +24842,7 @@ function runReceiptExport(opts = {}) {
   const serialized = JSON.stringify(receipt) + "\n";
   if (opts.out) {
     try {
-      writeFileSync18(opts.out, serialized);
+      writeFileSync17(opts.out, serialized);
     } catch (e) {
       process.stderr.write(`tamperward: could not write receipt to ${opts.out} (${e instanceof Error ? e.message : String(e)})
 `);
@@ -24816,7 +24867,7 @@ function ciAdjudicate(cwd, opts) {
   if (opts.ciResult !== void 0) {
     let doc;
     try {
-      doc = JSON.parse(readFileSync28(opts.ciResult, "utf8"));
+      doc = JSON.parse(readFileSync25(opts.ciResult, "utf8"));
     } catch (e) {
       return {
         ci: { verdict: "CANNOT_VERIFY", binding, binding_error: `unreadable CI verify result: ${e instanceof Error ? e.message : String(e)}` },
@@ -24962,7 +25013,7 @@ function loadClaimedReceipt(path) {
   }
   let raw;
   try {
-    raw = readFileSync28(path, "utf8");
+    raw = readFileSync25(path, "utf8");
   } catch (e) {
     return { disposition: "MALFORMED", detail: `receipt file could not be read (${e instanceof Error ? e.message : String(e)})` };
   }
@@ -25013,7 +25064,7 @@ function writeJobSummary(r, receipt, ciBinding, adjudicatedTree) {
   for (const d of r.divergence) md.push(`- ${d}`);
   md.push("");
   try {
-    appendFileSync6(path, md.join("\n") + "\n");
+    appendFileSync3(path, md.join("\n") + "\n");
   } catch {
   }
 }
@@ -25823,7 +25874,7 @@ var init_main = __esm({
 // src/cli/index.ts
 init_hook_client();
 init_exit();
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 function loadMain() {
   return Promise.resolve().then(() => (init_main(), main_exports));
 }
@@ -25836,7 +25887,7 @@ async function launch(argv) {
   if (kind && hookServiceEnabled()) {
     let raw = null;
     try {
-      raw = readFileSync29(0, "utf8");
+      raw = readFileSync26(0, "utf8");
     } catch {
       raw = null;
     }