tamperward 2.4.1 → 2.5.1

package/dist/cli/index.js

@@ -330,26 +330,52 @@ function diffWorktree(opts = {}) {
     (c) => enrich(c, (p) => blobAt("HEAD", p, opts.cwd), (p) => fromDisk(p, opts.cwd))
   );
 }
+function addOf(rel, cwd) {
+  const after = fromDisk(rel, cwd);
+  return {
+    kind: "file",
+    path: rel,
+    oldPath: null,
+    op: "add",
+    before: null,
+    after,
+    binary: false,
+    hunks: after == null ? [] : addHunks(after)
+  };
+}
 function untrackedAdds(opts = {}, keep, exclude) {
   const others = git(["ls-files", "--others", "--exclude-standard", "-z"], opts.cwd).split("\0").filter(Boolean);
-  return others.filter((rel) => !exclude?.has(rel) && (!keep || keep(rel))).map((rel) => {
-    const after = fromDisk(rel, opts.cwd);
-    return {
-      kind: "file",
-      path: rel,
-      oldPath: null,
-      op: "add",
-      before: null,
-      after,
-      binary: false,
-      hunks: after == null ? [] : addHunks(after)
-    };
-  });
+  return others.filter((rel) => !exclude?.has(rel) && (!keep || keep(rel))).map((rel) => addOf(rel, opts.cwd));
 }
-function diffWorktreeWithUntracked(opts = {}) {
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
+var IGNORED_LS = ["ls-files", "--others", "--ignored", "--exclude-standard", "-z"];
+function underSkippedDir(rel) {
+  return rel.split("/").some((seg) => SKIP_DIRS.has(seg));
+}
+function ignoredPaths(opts = {}, keep) {
+  const files = [];
+  const dirs = [];
+  for (const entry of git([...IGNORED_LS, "--directory"], opts.cwd).split("\0").filter(Boolean)) {
+    if (underSkippedDir(entry)) continue;
+    if (entry.endsWith("/")) dirs.push(entry);
+    else files.push(entry);
+  }
+  if (dirs.length > 0) {
+    const expanded = git([...IGNORED_LS, "--", ...dirs.map((d) => `:(literal)${d}`)], opts.cwd).split("\0").filter(Boolean);
+    for (const rel of expanded) if (!underSkippedDir(rel)) files.push(rel);
+  }
+  return files.filter(keep);
+}
+function ignoredAdds(opts = {}, keep, exclude) {
+  return ignoredPaths(opts, keep).filter((rel) => !exclude?.has(rel)).map((rel) => addOf(rel, opts.cwd));
+}
+function diffWorktreeWithUntracked(opts = {}, keepIgnored) {
   const tracked = diffWorktree(opts);
   const seen = new Set(tracked.filter((c) => c.kind === "file").map((c) => c.path));
-  return [...tracked, ...untrackedAdds(opts, void 0, seen)];
+  const untracked = untrackedAdds(opts, void 0, seen);
+  for (const c of untracked) if (c.kind === "file") seen.add(c.path);
+  const ignored = keepIgnored ? ignoredAdds(opts, keepIgnored, seen) : [];
+  return [...tracked, ...untracked, ...ignored];
 }
 function hiddenTrackedPaths(opts = {}) {
   const out2 = [];
@@ -560,12 +586,12 @@ function matcher(glob) {
   }
   return m;
 }
-function matchesAny(path, globs2) {
-  return !!globs2 && globs2.some((g) => matcher(g)(path));
+function matchesAny(path, globs3) {
+  return !!globs3 && globs3.some((g) => matcher(g)(path));
 }
 function protectedCategory(path, policy) {
-  for (const [cat, globs2] of Object.entries(policy.protected ?? {})) {
-    if (matchesAny(path, globs2)) return cat;
+  for (const [cat, globs3] of Object.entries(policy.protected ?? {})) {
+    if (matchesAny(path, globs3)) return cat;
   }
   return null;
 }
@@ -581,9 +607,9 @@ function isIgnored(path, policy) {
 }
 function mergeProtected(base, user) {
   const out2 = { ...base };
-  for (const [cat, globs2] of Object.entries(user ?? {})) {
+  for (const [cat, globs3] of Object.entries(user ?? {})) {
     const have = new Set(out2[cat] ?? []);
-    out2[cat] = [...out2[cat] ?? [], ...(globs2 ?? []).filter((g) => !have.has(g))];
+    out2[cat] = [...out2[cat] ?? [], ...(globs3 ?? []).filter((g) => !have.has(g))];
   }
   return out2;
 }
@@ -631,7 +657,19 @@ function defaultPolicy(version = 1) {
         "**/tsconfig*.json",
         "**/.eslintrc*",
         "**/eslint.config.*",
-        "**/package.json"
+        "**/package.json",
+        // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
+        // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
+        // codecov `target` lived in files no glob protected, so lowering them fired
+        // nothing. ADDITIVE, like every baseline widening (the policy-diff reads it
+        // as a strengthening). pyproject.toml carries [tool.coverage.report].
+        "**/.coveragerc",
+        "**/pyproject.toml",
+        "**/.nycrc",
+        "**/.nycrc.*",
+        "**/nyc.config.*",
+        "**/codecov.yml",
+        "**/.codecov.yml"
       ],
       ci: [".github/workflows/**"],
       // Recorded expected outputs. An assertion stored as data is still an assertion;
@@ -735,9 +773,11 @@ var IMPORTS = {
   cs: /^(?:using\b|namespace\b)/
 };
 var HASH_COMMENT = /* @__PURE__ */ new Set(["py", "rb"]);
+var DEBUG_ONLY = /^(?:console\.\w+\(.*\)\s*;?|debugger\s*;?)$/;
 function isSignificantLine(trimmed, lang) {
   if (trimmed.length < 10) return false;
   if (COMMON.test(trimmed)) return false;
+  if (DEBUG_ONLY.test(trimmed)) return false;
   const l = lang ?? "js";
   if (IMPORTS[l].test(trimmed)) return false;
   if (HASH_COMMENT.has(l) && trimmed.startsWith("#")) return false;
@@ -1075,7 +1115,47 @@ var testSkip = {
 };
 
 // src/detectors/coverage-lowering.ts
+import picomatch2 from "picomatch";
 import ts2 from "typescript";
+
+// src/detectors/repo.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+var cache2 = /* @__PURE__ */ new Map();
+function trackedFiles(ctx) {
+  if (!ctx) return null;
+  if (ctx.trackedFiles) return ctx.trackedFiles;
+  if (!ctx.cwd) return null;
+  const hit = cache2.get(ctx.cwd);
+  if (hit !== void 0) return hit;
+  let files = null;
+  try {
+    files = execFileSync2("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+      cwd: ctx.cwd,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"]
+    }).split("\0").filter(Boolean);
+  } catch {
+    files = null;
+  }
+  cache2.set(ctx.cwd, files);
+  return files;
+}
+var dirOf = (t) => t.replace(/^\.\//, "").replace(/\/+$/, "");
+function containsProtected(token, policy, category, ctx) {
+  const dir = dirOf(token);
+  if (!dir || dir === "." || dir === "/" || dir.startsWith("-")) return false;
+  const files = trackedFiles(ctx);
+  if (files) {
+    const prefix = dir + "/";
+    return files.some((f) => f.startsWith(prefix) && isProtected(f, policy, category));
+  }
+  if (isProtected(dir + "/probe", policy, category)) return true;
+  const base = dir.split("/").pop() ?? "";
+  return category === "tests" && /^(?:test|tests|__tests__|spec|specs)$/i.test(base);
+}
+
+// src/detectors/coverage-lowering.ts
 var RULE4 = "coverage-lowering";
 var METRICS = ["branches", "functions", "lines", "statements"];
 var isMetric = (k) => METRICS.includes(k);
@@ -1086,29 +1166,36 @@ function keyName(name) {
 }
 function numericOf(e) {
   if (ts2.isNumericLiteral(e)) return Number(e.text);
+  if (ts2.isStringLiteral(e) && /^-?\d+(?:\.\d+)?$/.test(e.text.trim())) return Number(e.text);
   if (ts2.isPrefixUnaryExpression(e) && e.operator === ts2.SyntaxKind.MinusToken && ts2.isNumericLiteral(e.operand)) {
     return -Number(e.operand.text);
   }
   return void 0;
 }
-function metricsOf(obj) {
+function metricsOf(expr, resolve5) {
+  const obj = resolve5(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
-  const out2 = {};
+  const out2 = { values: {}, opaque: false };
   let any = false;
   for (const p of obj.properties) {
+    if (ts2.isSpreadAssignment(p)) {
+      out2.opaque = true;
+      any = true;
+      continue;
+    }
     if (!ts2.isPropertyAssignment(p)) continue;
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
-    const n = numericOf(p.initializer);
-    if (n === void 0) continue;
-    out2[k] = n;
     any = true;
+    const n = numericOf(resolve5(p.initializer));
+    if (n === void 0) out2.opaque = true;
+    else out2.values[k] = n;
   }
   return any ? out2 : void 0;
 }
-function underCoverageKey(node) {
+function underKey(node, key2) {
   for (let p = node.parent; p; p = p.parent) {
-    if (ts2.isPropertyAssignment(p) && keyName(p.name) === "coverage") return true;
+    if (ts2.isPropertyAssignment(p) && keyName(p.name) === key2) return true;
   }
   return false;
 }
@@ -1116,25 +1203,54 @@ function asExpression(src) {
   const t = src.trim();
   return t.startsWith("{") ? `(${t})` : src;
 }
+function sourceOf(src) {
+  return ts2.createSourceFile("cfg.ts", asExpression(src), ts2.ScriptTarget.Latest, true, ts2.ScriptKind.TS);
+}
+function resolverFor(sf) {
+  const consts = /* @__PURE__ */ new Map();
+  for (const st of sf.statements) {
+    if (!ts2.isVariableStatement(st)) continue;
+    for (const d of st.declarationList.declarations) {
+      if (ts2.isIdentifier(d.name) && d.initializer) consts.set(d.name.text, d.initializer);
+    }
+  }
+  return (e) => {
+    if (ts2.isIdentifier(e)) {
+      const bound = consts.get(e.text);
+      return bound ?? e;
+    }
+    return e;
+  };
+}
 function parseThresholds(src) {
-  const res = { paths: /* @__PURE__ */ new Map(), present: false };
+  const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
-    const sf = ts2.createSourceFile("cfg.ts", asExpression(src), ts2.ScriptTarget.Latest, true, ts2.ScriptKind.TS);
+    const sf = sourceOf(src);
+    const resolve5 = resolverFor(sf);
     const visit = (node) => {
-      if (ts2.isPropertyAssignment(node) && ts2.isObjectLiteralExpression(node.initializer)) {
+      if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
-        if (key2 === "coverageThreshold" || key2 === "thresholds" && underCoverageKey(node)) {
+        if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const flat = metricsOf(node.initializer);
-          if (flat) res.global = { ...res.global ?? {}, ...flat };
-          for (const p of node.initializer.properties) {
-            if (!ts2.isPropertyAssignment(p)) continue;
-            const k = keyName(p.name);
-            if (k === null || isMetric(k)) continue;
-            const m = metricsOf(p.initializer);
-            if (!m) continue;
-            if (k === "global") res.global = { ...res.global ?? {}, ...m };
-            else res.paths.set(norm(k), m);
+          const init = resolve5(node.initializer);
+          if (!ts2.isObjectLiteralExpression(init)) {
+            res.opaque = true;
+          } else {
+            const flat = metricsOf(init, resolve5);
+            if (flat) res.global = merge(res.global, flat);
+            for (const p of init.properties) {
+              if (ts2.isSpreadAssignment(p)) {
+                res.opaque = true;
+                continue;
+              }
+              if (!ts2.isPropertyAssignment(p)) continue;
+              const k = keyName(p.name);
+              if (k === null || isMetric(k)) continue;
+              const m = metricsOf(p.initializer, resolve5);
+              if (!m) continue;
+              if (k === "global") res.global = merge(res.global, m);
+              else res.paths.set(norm(k), m);
+            }
           }
         }
       }
@@ -1145,41 +1261,242 @@ function parseThresholds(src) {
   }
   return res;
 }
-var eff = (t, path) => t.paths.get(norm(path)) ?? t.global;
+function merge(a, b) {
+  return { values: { ...a?.values ?? {}, ...b.values }, opaque: (a?.opaque ?? false) || b.opaque };
+}
+function literals(e) {
+  if (ts2.isStringLiteral(e)) return { items: [e.text], opaque: false };
+  if (!ts2.isArrayLiteralExpression(e)) return { items: [], opaque: true };
+  const items = [];
+  let opaque = false;
+  for (const el of e.elements) {
+    if (ts2.isStringLiteral(el) || ts2.isNoSubstitutionTemplateLiteral(el)) items.push(el.text);
+    else opaque = true;
+  }
+  return { items, opaque };
+}
+function parseLists(src) {
+  const res = { collectFrom: null, ignore: [], opaqueCollect: false, opaqueIgnore: false };
+  try {
+    const sf = sourceOf(src);
+    const resolve5 = resolverFor(sf);
+    const visit = (node) => {
+      if (ts2.isPropertyAssignment(node)) {
+        const k = keyName(node.name);
+        if (k === "collectCoverageFrom") {
+          const { items, opaque } = literals(resolve5(node.initializer));
+          res.collectFrom = items;
+          if (opaque) res.opaqueCollect = true;
+        } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && underKey(node, "coverage")) {
+          const { items, opaque } = literals(resolve5(node.initializer));
+          res.ignore.push(...items);
+          if (opaque) res.opaqueIgnore = true;
+        }
+      }
+      ts2.forEachChild(node, visit);
+    };
+    visit(sf);
+  } catch {
+  }
+  return res;
+}
+var BENIGN_EXEMPTION = /node_modules|(?:^|[/!])(?:dist|build|out|coverage|tmp|temp|vendor|test|tests|__tests__|__mocks__|__fixtures__|fixtures?|mocks?|spec|specs|e2e|cypress|playwright|storybook|scripts?|examples?|docs?|bin|types?|typings)(?:\/|$|\*)|\.(?:test|spec|stories|d)\.|\.(?:config|setup)\.|\.git\b|\.cache|\.next|\.nuxt|\.output|\.idea|\.d\.ts|\.json$|\.md$|\.css$|\.s[ac]ss$/i;
 function compareMetrics(scope, before, after, out2) {
   if (!before) return;
   for (const m of METRICS) {
-    const bv = before[m];
+    const bv = before.values[m];
     if (bv === void 0) continue;
-    const av = after?.[m];
-    if (av === void 0) out2.push(`${scope} ${m} threshold removed (was ${bv})`);
-    else if (av < bv) out2.push(`${scope} ${m} threshold lowered ${bv} \u2192 ${av}`);
+    const av = after?.values[m];
+    if (av === void 0) {
+      if (!after?.opaque) out2.push(`${scope} ${m} threshold removed (was ${bv})`);
+    } else if (av < bv) out2.push(`${scope} ${m} threshold lowered ${bv} \u2192 ${av}`);
+  }
+}
+function overrideTargetExists(key2, configPath, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return null;
+  const root = configPath.includes("/") ? configPath.slice(0, configPath.lastIndexOf("/") + 1) : "";
+  const rel = norm(key2);
+  let m;
+  try {
+    m = /[*?{}[\]]/.test(rel) ? picomatch2(rel, { dot: true }) : (p) => p === rel;
+  } catch {
+    return null;
   }
+  return files.some((f) => f.startsWith(root) && m(f.slice(root.length)));
 }
-function weakenings(before, after) {
+function weakenings(before, after, configPath, ctx) {
   const out2 = [];
   if (before.present && !after.present) {
     out2.push("the coverage threshold gate was removed");
     return out2;
   }
+  if (after.opaque && !after.global && after.paths.size === 0) return out2;
   compareMetrics("global", before.global, after.global, out2);
   const paths = /* @__PURE__ */ new Set([...before.paths.keys(), ...after.paths.keys()]);
   for (const p of paths) {
-    compareMetrics(`required coverage for ${p}:`, eff(before, p), eff(after, p), out2);
+    const scope = `required coverage for ${p}:`;
+    const b = before.paths.get(p);
+    const a = after.paths.get(p);
+    if (b && a) {
+      compareMetrics(scope, b, a, out2);
+    } else if (a) {
+      const g = before.global;
+      if (!g) continue;
+      for (const m of METRICS) {
+        const gv = g.values[m];
+        const av = a.values[m];
+        if (gv !== void 0 && av !== void 0 && av < gv) out2.push(`${scope} ${m} threshold lowered ${gv} \u2192 ${av}`);
+      }
+    } else if (b) {
+      if (overrideTargetExists(p, configPath, ctx) === false) continue;
+      compareMetrics(scope, b, after.global, out2);
+    }
+  }
+  return out2;
+}
+function narrowings(before, after) {
+  const out2 = [];
+  if (before.collectFrom && after.collectFrom && !after.opaqueCollect) {
+    const kept = new Set(after.collectFrom);
+    for (const g of before.collectFrom) {
+      if (!g.startsWith("!") && !kept.has(g)) out2.push(`collectCoverageFrom no longer measures ${JSON.stringify(g)}`);
+    }
+    const had2 = new Set(before.collectFrom);
+    for (const g of after.collectFrom) {
+      if (g.startsWith("!") && !had2.has(g) && !BENIGN_EXEMPTION.test(g)) out2.push(`collectCoverageFrom now exempts ${JSON.stringify(g)}`);
+    }
+  }
+  const had = new Set(before.ignore);
+  for (const g of after.ignore) {
+    if (!had.has(g) && !BENIGN_EXEMPTION.test(g)) out2.push(`coverage now exempts ${JSON.stringify(g)} (coveragePathIgnorePatterns / coverage.exclude)`);
+  }
+  return out2;
+}
+var SIMPLE_FILES = [
+  {
+    // coverage.py: `fail_under = 90` under [report] (.coveragerc, setup.cfg-style) or
+    // [tool.coverage.report] (pyproject.toml)
+    file: /(?:^|\/)(?:\.coveragerc|pyproject\.toml)$/,
+    keys: [{ key: /^\s*fail[_-]under\s*=\s*"?(\d+(?:\.\d+)?)/, label: "fail_under", weakens: "lower" }],
+    removable: true
+  },
+  {
+    // nyc: .nycrc / .nycrc.json / .nycrc.yml / nyc.config.js — metric thresholds
+    file: /(?:^|\/)(?:\.nycrc(?:\.\w+)?|nyc\.config\.\w+)$/,
+    keys: METRICS.map((m) => ({
+      key: new RegExp(`(?:^|[\\s{,])"?${m}"?\\s*[:=]\\s*"?(\\d+(?:\\.\\d+)?)`, "g"),
+      label: m,
+      weakens: "lower"
+    })),
+    removable: false
+  },
+  {
+    // codecov: `target: 90%` is the floor (lowering weakens); `threshold: 2%` is the
+    // permitted drop (raising weakens)
+    file: /(?:^|\/)\.?codecov\.yml$/,
+    keys: [
+      { key: /^\s*target:\s*"?(\d+(?:\.\d+)?)%?/, label: "target", weakens: "lower" },
+      { key: /^\s*threshold:\s*"?(\d+(?:\.\d+)?)%?/, label: "threshold", weakens: "raise" }
+    ],
+    removable: false
+  }
+];
+function numbersOf(src, key2) {
+  const out2 = [];
+  for (const line of src.split("\n")) {
+    if (key2.global) {
+      for (const m of line.matchAll(key2)) out2.push(Number(m[1]));
+    } else {
+      const m = line.match(key2);
+      if (m) out2.push(Number(m[1]));
+    }
   }
   return out2;
 }
+function simpleWeakenings(path, before, after) {
+  const out2 = [];
+  const spec = SIMPLE_FILES.find((s) => s.file.test(path));
+  if (!spec) return out2;
+  for (const k of spec.keys) {
+    const b = numbersOf(before, k.key).sort((x, y) => y - x);
+    const a = numbersOf(after, k.key).sort((x, y) => y - x);
+    if (b.length === 0) continue;
+    if (a.length === 0) {
+      if (spec.removable) out2.push(`${k.label} removed (was ${b.join(", ")})`);
+      continue;
+    }
+    if (k.weakens === "lower") {
+      for (let i = 0; i < b.length; i++) {
+        const av = a[Math.min(i, a.length - 1)];
+        if (av < b[i]) {
+          out2.push(`${k.label} lowered ${b[i]} \u2192 ${av}`);
+          break;
+        }
+      }
+    } else {
+      const bMax = b[0];
+      const aMax = a[0];
+      if (aMax > bMax) out2.push(`${k.label} raised ${bMax} \u2192 ${aMax} (a wider permitted drop)`);
+    }
+  }
+  return out2;
+}
+var SWITCHES = [
+  {
+    re: /--passWithNoTests\b/,
+    message: "--passWithNoTests added \u2014 the suite can now pass with zero tests.",
+    remediation: "Remove --passWithNoTests; an empty suite must not be a green check."
+  },
+  {
+    re: /\bpassWithNoTests"?\s*:\s*true\b/,
+    message: "passWithNoTests: true added to the runner config \u2014 the suite can now pass with zero tests.",
+    remediation: "Remove passWithNoTests; an empty suite must not be a green check."
+  },
+  {
+    re: /--coverage=false\b|--no-coverage\b|--coverage\.enabled=false\b/,
+    message: "coverage switched off on the command line (--coverage=false).",
+    remediation: "Keep coverage reporting on; do not switch it off to dodge the gate."
+  },
+  {
+    re: /--coverageThreshold[= ]/,
+    message: "the coverage threshold is overridden on the command line (--coverageThreshold), which replaces the configured gate.",
+    remediation: "Remove the override; the configured threshold is the gate."
+  },
+  {
+    re: /\bautoUpdate"?\s*:\s*true\b/,
+    message: "thresholds.autoUpdate: true added \u2014 the gate now follows the measured number.",
+    remediation: "Remove autoUpdate; a threshold that tracks the result gates nothing."
+  },
+  {
+    re: /"?check-coverage"?\s*[:=]\s*false\b/,
+    message: "check-coverage: false \u2014 nyc will no longer fail on the thresholds.",
+    remediation: "Keep check-coverage on; raise real coverage instead."
+  },
+  {
+    re: /^\s*informational:\s*true\b/,
+    message: "informational: true added \u2014 the codecov status can no longer fail.",
+    remediation: "Remove informational; a status that cannot fail is not a gate."
+  }
+];
+var isJsConfig = (path) => /\.(?:[cm]?[jt]sx?|json)$/.test(path);
 var coverageLowering = {
   id: RULE4,
   surface: ["file"],
   certainty: "mechanical",
-  run(changes, policy) {
+  run(changes, policy, _view, ctx) {
     const out2 = [];
     for (const c of changes) {
       if (c.kind !== "file") continue;
       if (!isProtected(c.path, policy, "config")) continue;
       if (c.after != null && c.op !== "delete") {
-        for (const reason of weakenings(parseThresholds(c.before ?? ""), parseThresholds(c.after))) {
+        const reasons = [];
+        if (isJsConfig(c.path)) {
+          reasons.push(...weakenings(parseThresholds(c.before ?? ""), parseThresholds(c.after), c.path, ctx));
+          reasons.push(...narrowings(parseLists(c.before ?? ""), parseLists(c.after)));
+        }
+        reasons.push(...simpleWeakenings(c.path, c.before ?? "", c.after));
+        for (const reason of reasons) {
           out2.push(
             makeFinding(RULE4, policy, {
               file: c.path,
@@ -1190,7 +1507,9 @@ var coverageLowering = {
           );
         }
       } else if (c.op === "delete" || c.after === "" && (c.before ?? "").length > 0) {
-        if (parseThresholds(c.before ?? "").present) {
+        const before = c.before ?? "";
+        const gated = isJsConfig(c.path) ? parseThresholds(before).present : simpleWeakenings(c.path, before, "").length > 0 || SIMPLE_FILES.some((s) => s.file.test(c.path) && s.keys.some((k) => numbersOf(before, k.key).length));
+        if (gated) {
           out2.push(
             makeFinding(RULE4, policy, {
               file: c.path,
@@ -1215,20 +1534,22 @@ var coverageLowering = {
         );
       }
       for (const l of added) {
-        if (/--passWithNoTests\b/.test(l.content) || /\bpassWithNoTests\s*:\s*true\b/.test(l.content)) {
+        for (const s of SWITCHES) {
+          if (!s.re.test(l.content)) continue;
+          if (removed.some((r) => s.re.test(r.content))) continue;
           out2.push(
             makeFinding(RULE4, policy, {
               file: c.path,
               line: l.newLine ?? void 0,
-              message: "passWithNoTests added \u2014 the suite can now pass with zero tests.",
+              message: s.message,
               evidence: l.content.trim(),
-              remediation: "Remove --passWithNoTests; an empty suite must not be a green check."
+              remediation: s.remediation
             })
           );
         }
       }
       if (c.after == null) {
-        const KEY = /\b(branches|functions|lines|statements)\b\s*:\s*(\d+(?:\.\d+)?)/;
+        const KEY = /\b(branches|functions|lines|statements|fail[_-]under|target)\b"?\s*[:=]\s*"?(\d+(?:\.\d+)?)/;
         const oldNums = /* @__PURE__ */ new Map();
         for (const l of removed) {
           const m = l.content.match(KEY);
@@ -1254,7 +1575,7 @@ var coverageLowering = {
     }
     const seen = /* @__PURE__ */ new Set();
     return out2.filter((f) => {
-      const k = `${f.rule}|${f.message}`;
+      const k = `${f.rule}|${f.file ?? ""}|${f.message}`;
       if (seen.has(k)) return false;
       seen.add(k);
       return true;
@@ -1276,23 +1597,287 @@ var invokesCheck = (line) => INVOKES_TOOL.test(line) || INVOKES_SCRIPT.test(line
 function commandCore(line) {
   return line.trim().replace(/^-\s*/, "").replace(/^(?:run|uses):\s*/, "").replace(/\s+/g, " ").trim();
 }
+function canonical(core) {
+  let s = core.replace(/^(['"])(.*)\1$/, "$2").trim();
+  s = s.replace(/^(?:npx|pnpm\s+(?:exec|dlx)|yarn\s+(?:exec|dlx)|bunx|bun\s+x)\s+/, "exec ");
+  s = s.replace(/^(?:npm|pnpm|yarn|bun)\s+(?:run(?:-script)?\s+)?/, "exec ");
+  s = s.replace(/^exec\s+(?:t|tst)(?=\s|$)/, "exec test");
+  s = s.replace(/^exec\s+/, "");
+  return s.replace(/\s+--\s*$/, "").trim();
+}
+var usesRef = (core) => core.replace(/@.*$/, "");
+var NEUTRALISING_SUFFIX = /\|\||;|(?<!&)&(?!&)|\|(?!\|)|--passWithNoTests\b|--coverage=false\b|--coverageThreshold\b|--testPathIgnorePatterns\b|--testPathPattern\b|--testNamePattern\b|(?:^|\s)-t\s|--onlyChanged\b|--changed\b|--findRelatedTests\b/;
+function survives(removedCore, isUses, afterCores) {
+  if (isUses) {
+    const ref = usesRef(removedCore);
+    return afterCores.some((a) => usesRef(a) === ref) ? { state: "kept" } : { state: "gone" };
+  }
+  const r = canonical(removedCore);
+  let neutralised;
+  for (const raw of afterCores) {
+    const a = canonical(raw);
+    if (a === r) return { state: "kept" };
+    if (a.startsWith(r + " ")) {
+      const rest = a.slice(r.length);
+      if (NEUTRALISING_SUFFIX.test(rest)) neutralised = raw;
+      else return { state: "kept" };
+    } else if (r.startsWith(a + " ") && invokesCheck(a)) {
+      return { state: "kept" };
+    }
+  }
+  return neutralised ? { state: "neutralised", by: neutralised } : { state: "gone" };
+}
 var uncommented = (v) => v.replace(/\s+#.*$/, "").trim();
-function isAlwaysFalse(raw) {
-  const v = uncommented(raw);
-  if (/^false$/i.test(v)) return true;
+function lex(src) {
+  const out2 = [];
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (/\s/.test(ch)) {
+      i++;
+      continue;
+    }
+    if (ch === "'") {
+      let j = i + 1;
+      let s = "";
+      while (j < src.length) {
+        if (src[j] === "'" && src[j + 1] === "'") {
+          s += "'";
+          j += 2;
+        } else if (src[j] === "'") break;
+        else s += src[j++];
+      }
+      if (j >= src.length) return null;
+      out2.push({ t: "str", v: s });
+      i = j + 1;
+      continue;
+    }
+    const num = src.slice(i).match(/^-?\d+(?:\.\d+)?/);
+    if (num) {
+      out2.push({ t: "num", v: num[0] });
+      i += num[0].length;
+      continue;
+    }
+    const op = src.slice(i).match(/^(?:==|!=|&&|\|\||<=|>=|[!()<>])/);
+    if (op) {
+      out2.push({ t: "op", v: op[0] });
+      i += op[0].length;
+      continue;
+    }
+    const id = src.slice(i).match(/^[A-Za-z_][\w.\-[\]*]*/);
+    if (id) {
+      out2.push({ t: "id", v: id[0] });
+      i += id[0].length;
+      continue;
+    }
+    return null;
+  }
+  return out2;
+}
+function foldConst(src) {
+  const toks = lex(src);
+  if (!toks) return void 0;
+  let p = 0;
+  const peek = () => toks[p];
+  const eat = (v2) => toks[p]?.t === "op" && toks[p].v === v2 ? (p++, true) : false;
+  const truthy = (v2) => typeof v2 === "string" ? v2 !== "" : typeof v2 === "number" ? v2 !== 0 : v2 === true;
+  const num = (v2) => typeof v2 === "number" ? v2 : typeof v2 === "boolean" ? v2 ? 1 : 0 : v2 === null ? 0 : v2.trim() === "" ? 0 : Number(v2);
+  const eq = (a, b) => {
+    if (typeof a === "string" && typeof b === "string") return a.toLowerCase() === b.toLowerCase();
+    if (a === null && b === null) return true;
+    const x = num(a);
+    const y = num(b);
+    return !Number.isNaN(x) && x === y;
+  };
+  const or = () => {
+    let l = and();
+    while (eat("||")) {
+      const r = and();
+      if (l === void 0 || r === void 0) return void 0;
+      l = truthy(l) ? l : r;
+    }
+    return l;
+  };
+  const and = () => {
+    let l = cmp();
+    while (eat("&&")) {
+      const r = cmp();
+      if (l === void 0 || r === void 0) return void 0;
+      l = truthy(l) ? r : l;
+    }
+    return l;
+  };
+  const cmp = () => {
+    let l = unary();
+    for (; ; ) {
+      const t = peek();
+      if (!t || t.t !== "op" || !/^(?:==|!=|<|>|<=|>=)$/.test(t.v)) return l;
+      p++;
+      const r = unary();
+      if (l === void 0 || r === void 0) return void 0;
+      if (t.v === "==") l = eq(l, r);
+      else if (t.v === "!=") l = !eq(l, r);
+      else {
+        const x = num(l);
+        const y = num(r);
+        if (Number.isNaN(x) || Number.isNaN(y)) return void 0;
+        l = t.v === "<" ? x < y : t.v === ">" ? x > y : t.v === "<=" ? x <= y : x >= y;
+      }
+    }
+  };
+  const unary = () => {
+    if (eat("!")) {
+      const v2 = unary();
+      return v2 === void 0 ? void 0 : !truthy(v2);
+    }
+    return primary();
+  };
+  const primary = () => {
+    const t = peek();
+    if (!t) return void 0;
+    if (eat("(")) {
+      const v2 = or();
+      return eat(")") ? v2 : void 0;
+    }
+    p++;
+    if (t.t === "str") return t.v;
+    if (t.t === "num") return Number(t.v);
+    if (t.t === "id") {
+      if (/^true$/i.test(t.v)) return true;
+      if (/^false$/i.test(t.v)) return false;
+      if (/^null$/i.test(t.v)) return null;
+      return void 0;
+    }
+    return void 0;
+  };
+  const v = or();
+  return p === toks.length ? v : void 0;
+}
+function expressionOf(raw) {
+  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
   const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
-  if (!m) return false;
-  const e = m[1];
-  if (/^(false|0|''|"")$/i.test(e)) return true;
-  const cmp = e.match(/^(-?\d+)\s*(==|!=)\s*(-?\d+)$/);
-  if (cmp) return cmp[2] === "==" ? cmp[1] !== cmp[3] : cmp[1] === cmp[3];
-  return false;
+  return m ? m[1] : v;
+}
+function isAlwaysFalse(raw) {
+  const e = expressionOf(raw);
+  if (e === "") return false;
+  const v = foldConst(e);
+  return v !== void 0 && !(typeof v === "string" ? v !== "" : typeof v === "number" ? v !== 0 : v === true);
 }
 function isTruthy(raw) {
-  const v = uncommented(raw);
-  if (/^true$/i.test(v)) return true;
+  const v = uncommented(raw).replace(/^(['"])(.*)\1$/, "$2").trim();
+  if (/^(?:true|yes|on|1)$/i.test(v)) return true;
   const m = v.match(/^\$\{\{\s*(.+?)\s*\}\}$/);
-  return !!m && /^(true|1)$/i.test(m[1]);
+  if (!m) return false;
+  const f = foldConst(m[1]);
+  return f !== void 0 && (typeof f === "string" ? f !== "" : typeof f === "number" ? f !== 0 : f === true);
+}
+var indentOf = (l) => l.match(/^\s*/)[0].length;
+var STEP_START = /^\s*-\s+(?:name|uses|run|if|id|with|env|shell|continue-on-error|working-directory|timeout-minutes):/;
+function stepOf(lines, i) {
+  const ind = indentOf(lines[i]);
+  let s = i - 1;
+  while (s >= 0 && (lines[s].trim() === "" || indentOf(lines[s]) >= ind)) s--;
+  if (s < 0 || !STEP_START.test(lines[s])) return null;
+  const stepInd = indentOf(lines[s]);
+  let e = i + 1;
+  while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > stepInd)) e++;
+  return [s, e];
+}
+var stepHasCheck = (lines, range) => range === null || lines.slice(range[0], range[1]).some((l) => invokesCheck(l) || USES.test(l) && CHECK.test(l));
+function runBlocks(lines) {
+  const out2 = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^\s*-?\s*run:\s*[|>][-+]?\s*$/.test(lines[i])) continue;
+    const ind = indentOf(lines[i].replace(/^(\s*)-\s+/, "$1  "));
+    let e = i + 1;
+    while (e < lines.length && (lines[e].trim() === "" || indentOf(lines[e]) > ind)) e++;
+    out2.push({ start: i, end: e, body: lines.slice(i + 1, e) });
+  }
+  return out2;
+}
+var NEUTRALISERS = [
+  { re: /^\s*set\s+\+e\b/, what: "set +e \u2014 a failing check no longer fails the step" },
+  { re: /^\s*exit\s+0\s*(?:$|[;#])/, what: "exit 0 \u2014 the step ends green whatever the check did" },
+  { re: /^\s*if\s+false\s*;?\s*then\b/, what: "if false; then \u2014 the check is never run" },
+  { re: /^\s*:\s*<<\s*['"]?\w+/, what: "a heredoc fed to `:` \u2014 the check is commented out" }
+];
+function flowList(v) {
+  const m = v.trim().match(/^\[(.*)\]$/);
+  if (!m) return null;
+  return m[1].split(",").map((s) => s.trim().replace(/^(['"])(.*)\1$/, "$2")).filter(Boolean);
+}
+function parseTriggers(src) {
+  const t = { events: /* @__PURE__ */ new Set(), branches: /* @__PURE__ */ new Map(), branchesIgnore: /* @__PURE__ */ new Map(), pathsIgnore: /* @__PURE__ */ new Map(), present: false };
+  const lines = src.split("\n");
+  const i = lines.findIndex((l) => /^(?:on|"on"|'on'|true):/.test(l));
+  if (i < 0) return t;
+  t.present = true;
+  const head = lines[i].replace(/^(?:on|"on"|'on'|true):\s*/, "");
+  const inline = uncommented(head);
+  if (inline) {
+    const list = flowList(inline);
+    for (const e of list ?? [inline]) t.events.add(e);
+    return t;
+  }
+  let event = null;
+  let listKey = null;
+  let listInd = -1;
+  for (let j = i + 1; j < lines.length; j++) {
+    const l = lines[j];
+    if (l.trim() === "" || /^\s*#/.test(l)) continue;
+    const ind = indentOf(l);
+    if (ind === 0) break;
+    const body = uncommented(l);
+    const item = body.match(/^\s*-\s+(.+)$/);
+    if (item && listKey && event && ind > listInd) {
+      const target = t[listKey].get(event) ?? [];
+      target.push(item[1].replace(/^(['"])(.*)\1$/, "$2"));
+      t[listKey].set(event, target);
+      continue;
+    }
+    const kv = body.match(/^\s*([\w-]+):\s*(.*)$/);
+    if (!kv) continue;
+    if (ind === 2 || event === null && ind < 4) {
+      event = kv[1];
+      t.events.add(event);
+      listKey = null;
+      continue;
+    }
+    if (event && /^(?:branches|branches-ignore|paths-ignore)$/.test(kv[1])) {
+      listKey = kv[1] === "branches" ? "branches" : kv[1] === "branches-ignore" ? "branchesIgnore" : "pathsIgnore";
+      listInd = ind;
+      const list = flowList(kv[2]);
+      t[listKey].set(event, list ?? []);
+    } else listKey = null;
+  }
+  return t;
+}
+var DEFAULT_BRANCH = /^(?:main|master)$/;
+var ALL = (g) => /^\*\*?$|^\*\*\/\*$/.test(g);
+function triggerNarrowings(before, after) {
+  const out2 = [];
+  if (!before.present || !after.present) return out2;
+  for (const e of ["push", "pull_request", "pull_request_target"]) {
+    if (before.events.has(e) && !after.events.has(e)) out2.push(`the ${e} trigger was removed \u2014 the workflow no longer runs on it`);
+  }
+  for (const [e, list] of after.pathsIgnore) {
+    const had = before.pathsIgnore.get(e) ?? [];
+    if (list.some((g) => ALL(g) && !had.includes(g))) out2.push(`on.${e}.paths-ignore now ignores every path \u2014 the workflow never runs on ${e}`);
+  }
+  for (const [e, list] of after.branchesIgnore) {
+    const had = before.branchesIgnore.get(e) ?? [];
+    if (list.some((g) => (ALL(g) || DEFAULT_BRANCH.test(g)) && !had.includes(g))) out2.push(`on.${e}.branches-ignore now covers the default branch`);
+  }
+  for (const [e, was] of before.branches) {
+    const now = after.branches.get(e);
+    if (!now || !after.events.has(e)) continue;
+    if (now.some(ALL)) continue;
+    const lostDefault = was.some((b) => DEFAULT_BRANCH.test(b) && !now.includes(b));
+    const replaced = was.length > 0 && !was.some((b) => now.includes(b));
+    if (lostDefault || replaced) out2.push(`on.${e}.branches no longer names ${was.filter((b) => !now.includes(b)).join(", ")} (now [${now.join(", ")}])`);
+  }
+  return out2;
 }
 var ciTampering = {
   id: RULE5,
@@ -1314,9 +1899,14 @@ var ciTampering = {
         continue;
       }
       if (!isProtected(c.path, policy, "ci")) continue;
+      const afterLines = c.after != null ? c.after.split("\n") : null;
+      const addedAt = new Set(addedLines(c).map((l) => l.newLine).filter((n) => n != null));
       for (const l of addedLines(c)) {
         const coe = l.content.match(/^\s*-?\s*continue-on-error:\s*(.+?)\s*$/);
         const cond = l.content.match(/^\s*-?\s*if:\s*(.+?)\s*$/);
+        if (!coe && !cond) continue;
+        const step = afterLines && l.newLine != null ? stepOf(afterLines, l.newLine - 1) : null;
+        if (afterLines && step && !stepHasCheck(afterLines, step)) continue;
         if (coe && isTruthy(coe[1])) {
           out2.push(
             makeFinding(RULE5, policy, {
@@ -1339,15 +1929,72 @@ var ciTampering = {
           );
         }
       }
-      const afterCores = new Set(
-        (c.after != null ? c.after.split("\n") : addedLines(c).map((l) => l.content)).map(commandCore)
-      );
+      if (afterLines) {
+        for (const b of runBlocks(afterLines)) {
+          if (!b.body.some(invokesCheck)) continue;
+          const propagates = b.body.some((l) => /\bexit\s+"?\$/.test(l));
+          for (let k = 0; k < b.body.length; k++) {
+            const idx = b.start + 1 + k;
+            if (!addedAt.has(idx + 1)) continue;
+            const n = NEUTRALISERS.find((x) => x.re.test(b.body[k]));
+            if (!n || propagates && /set\s\+e/.test(b.body[k])) continue;
+            out2.push(
+              makeFinding(RULE5, policy, {
+                file: c.path,
+                line: idx + 1,
+                message: `A check's run block was neutralised: ${n.what}.`,
+                evidence: b.body[k].trim(),
+                remediation: "Let the check decide the step. Masking its exit status is the same tamper as removing it."
+              })
+            );
+          }
+        }
+        for (const l of addedLines(c)) {
+          if (!/^\s*-?\s*shell:\s*.*\{0\}/.test(l.content) || l.newLine == null) continue;
+          const step = stepOf(afterLines, l.newLine - 1);
+          if (step && !stepHasCheck(afterLines, step)) continue;
+          out2.push(
+            makeFinding(RULE5, policy, {
+              file: c.path,
+              line: l.newLine,
+              message: "shell: \u2026 {0} added on a check step \u2014 the shell no longer stops on the first failure.",
+              evidence: l.content.trim(),
+              remediation: "Keep the default shell (fail-fast) on steps that run checks."
+            })
+          );
+        }
+        if (c.before != null) {
+          for (const reason of triggerNarrowings(parseTriggers(c.before), parseTriggers(c.after))) {
+            out2.push(
+              makeFinding(RULE5, policy, {
+                file: c.path,
+                message: `The workflow's triggers were narrowed: ${reason}.`,
+                evidence: reason,
+                remediation: "Keep the workflow running on push and pull_request for the default branch; a check that never runs is no check."
+              })
+            );
+          }
+        }
+      }
+      const afterCores = (afterLines ?? addedLines(c).map((l) => l.content)).map(commandCore);
       for (const l of removedLines(c)) {
         if (/^\s*#/.test(l.content)) continue;
         const isUsesLine = USES.test(l.content) && CHECK.test(l.content);
         const isCheckCommand = !isUsesLine && !/^\s*-?\s*uses:/.test(l.content) && (YAML_KEY.test(l.content) ? /^\s*-?\s*run:/.test(l.content) : true) && invokesCheck(l.content);
         if (!isUsesLine && !isCheckCommand) continue;
-        if (afterCores.has(commandCore(l.content))) continue;
+        const s = survives(commandCore(l.content), isUsesLine, afterCores);
+        if (s.state === "kept") continue;
+        if (s.state === "neutralised") {
+          out2.push(
+            makeFinding(RULE5, policy, {
+              file: c.path,
+              message: "A CI check command was neutralised in place: it still runs, but its result no longer decides (or its suite was narrowed).",
+              evidence: `${l.content.trim()} \u2192 ${s.by}`,
+              remediation: "Let the check decide the step; do not mask its status or narrow what it runs."
+            })
+          );
+          continue;
+        }
         out2.push(
           makeFinding(RULE5, policy, {
             file: c.path,
@@ -1364,7 +2011,7 @@ var ciTampering = {
 
 // src/detectors/hook-tampering.ts
 import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2, relative } from "node:path";
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
@@ -1874,9 +2521,22 @@ function chmodDropsExec(toks) {
   return false;
 }
 var WRAPPERS = /^(?:sudo|command|exec|time|nice|env|[A-Za-z_][A-Za-z0-9_]*=\S*)$/;
+var REDIRECT_TARGET = /(?:^|\s)\d*>{1,2}\|?\s*(\S+)/g;
+var hookPath = (t) => t.replace(/^["']|["']$/g, "").replace(/^\.\//, "");
+function shellHookTarget(seg, toks, policy) {
+  for (const m of seg.matchAll(REDIRECT_TARGET)) {
+    const t = hookPath(m[1]);
+    if (isProtected(t, policy, "hooks")) return t;
+  }
+  for (const tok of toks) {
+    const t = hookPath(tok.replace(/^of=/, ""));
+    if (isProtected(t, policy, "hooks")) return t;
+  }
+  return null;
+}
 function shellWritesHook(seg, toks, policy) {
   const hook = (t) => isProtected(t.replace(/^\.\//, ""), policy, "hooks");
-  for (const m of seg.matchAll(/(?:^|\s)\d*>{1,2}\|?\s*(\S+)/g)) {
+  for (const m of seg.matchAll(REDIRECT_TARGET)) {
     if (hook(m[1].replace(/^["']|["']$/g, ""))) return "a redirect empties or rewrites a protected hook";
   }
   let at = 0;
@@ -2087,14 +2747,24 @@ function configFindings(c, policy) {
 function updateIndexHiding(toks, policy) {
   if (!toks.some((t) => t === "git" || t.endsWith("/git")) || !toks.includes("update-index")) return null;
   const hide = toks.find((t) => /^--(?:skip-worktree|assume-unchanged)$/.test(t));
-  if (hide && toks.some((t) => isProtected(t, policy))) {
-    return `git update-index ${hide} hides a protected file from every git diff \u2014 edits to it no longer reach the sweep or the pre-commit gate`;
+  const hidden = hide ? toks.find((t) => isProtected(t, policy)) : void 0;
+  if (hide && hidden) {
+    return {
+      reason: `git update-index ${hide} hides a protected file from every git diff \u2014 edits to it no longer reach the sweep or the pre-commit gate`,
+      file: hidden
+    };
   }
-  if (toks.some((t) => /^--chmod=-x$/.test(t)) && toks.some((t) => isProtected(t, policy, "hooks"))) {
-    return "git update-index --chmod=-x clears the execute bit on a protected hook through the index, which disables it";
+  const hook = toks.some((t) => /^--chmod=-x$/.test(t)) ? toks.find((t) => isProtected(t, policy, "hooks")) : void 0;
+  if (hook) {
+    return { reason: "git update-index --chmod=-x clears the execute bit on a protected hook through the index, which disables it", file: hook };
   }
   return null;
 }
+function repoRelative(path, ctx) {
+  if (!ctx?.cwd || !isAbsolute(path)) return path;
+  const rel = relative(ctx.cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+}
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
@@ -2244,7 +2914,8 @@ var hookTampering = {
           if (hiding) {
             out2.push(
               makeFinding(RULE6, policy, {
-                message: `Hook tampering via shell: ${hiding}.`,
+                file: repoRelative(hiding.file, ctx),
+                message: `Hook tampering via shell: ${hiding.reason}.`,
                 evidence: seg,
                 remediation: "Leave protected files visible to git. Hiding one from the diff hides it from the gate, which is the tamper \u2014 use `--no-skip-worktree` / `--no-assume-unchanged` to undo it."
               })
@@ -2253,8 +2924,10 @@ var hookTampering = {
           }
           const why = shellWritesHook(seg, toks, policy);
           if (why) {
+            const target = shellHookTarget(seg, toks, policy);
             out2.push(
               makeFinding(RULE6, policy, {
+                ...target ? { file: repoRelative(target, ctx) } : {},
                 message: `Hook tampering via shell: ${why}.`,
                 evidence: seg,
                 remediation: "Leave the hooks in place. Mutating them from the shell is still tampering."
@@ -2269,44 +2942,215 @@ var hookTampering = {
 };
 
 // src/detectors/test-deletion.ts
+import ts4 from "typescript";
+
+// src/detectors/suite-config.ts
+import picomatch3 from "picomatch";
 import ts3 from "typescript";
+var JEST_DEFAULT_MATCH = ["**/__tests__/**/*.[jt]s?(x)", "**/?(*.)+(spec|test).[jt]s?(x)"];
+var JEST_DEFAULT_IGNORE = ["/node_modules/"];
+var VITEST_DEFAULT_INCLUDE = ["**/*.{test,spec}.?(c|m)[jt]s?(x)"];
+var VITEST_DEFAULT_EXCLUDE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/cypress/**",
+  "**/.{idea,git,cache,output,temp}/**",
+  "**/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build,eslint,prettier}.config.*"
+];
+var CANONICAL_SAMPLES = [
+  "src/a.test.ts",
+  "src/a.spec.ts",
+  "test/a.test.ts",
+  "tests/a.test.js",
+  "src/__tests__/a.ts",
+  "a.test.tsx",
+  "a.spec.js",
+  "test/a.test.mjs"
+];
+function keyName2(name) {
+  if (ts3.isIdentifier(name) || ts3.isStringLiteral(name)) return name.text;
+  return null;
+}
+function literals2(e) {
+  if (ts3.isStringLiteral(e) || ts3.isNoSubstitutionTemplateLiteral(e)) return { items: [e.text], opaque: false };
+  if (!ts3.isArrayLiteralExpression(e)) return { items: [], opaque: true };
+  const items = [];
+  let opaque = false;
+  for (const el of e.elements) {
+    if (ts3.isStringLiteral(el) || ts3.isNoSubstitutionTemplateLiteral(el)) items.push(el.text);
+    else if (ts3.isSpreadElement(el) && /^(?:configDefaults\.|default)(?:exclude|include)$/i.test(el.expression.getText())) {
+      items.push(.../exclude$/i.test(el.expression.getText()) ? VITEST_DEFAULT_EXCLUDE : VITEST_DEFAULT_INCLUDE);
+    } else opaque = true;
+  }
+  return { items, opaque };
+}
+function underKey2(node, key2) {
+  for (let p = node.parent; p; p = p.parent) {
+    if (ts3.isPropertyAssignment(p) && keyName2(p.name) === key2) return true;
+  }
+  return false;
+}
+function asExpression2(src) {
+  const t = src.trim();
+  return t.startsWith("{") ? `(${t})` : src;
+}
+function runnerOf(path) {
+  const base = path.split("/").pop() ?? path;
+  if (/^jest\.config\./.test(base) || base === "package.json") return "jest";
+  if (/^vitest\.config\./.test(base)) return "vitest";
+  return null;
+}
+function parseSelection(src, runner) {
+  const sel = { include: null, regex: null, ignore: null, opaque: false, present: false };
+  try {
+    const sf = ts3.createSourceFile("cfg.ts", asExpression2(src), ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TS);
+    const seen = /* @__PURE__ */ new Set();
+    const take = (key2, e) => {
+      const { items, opaque } = literals2(e);
+      if (opaque || seen.has(key2)) sel.opaque = true;
+      seen.add(key2);
+      sel.present = true;
+      return items.map((g) => g.replace(/^<rootDir>\//, ""));
+    };
+    const visit = (node) => {
+      if (ts3.isPropertyAssignment(node)) {
+        const k = keyName2(node.name);
+        if (runner === "jest") {
+          if (k === "testMatch") sel.include = take(k, node.initializer);
+          else if (k === "testRegex") sel.regex = take(k, node.initializer);
+          else if (k === "testPathIgnorePatterns") sel.ignore = take(k, node.initializer);
+        } else if (underKey2(node, "test") && !underKey2(node, "coverage")) {
+          if (k === "include") sel.include = take(k, node.initializer);
+          else if (k === "exclude") sel.ignore = take(k, node.initializer);
+        }
+      }
+      ts3.forEachChild(node, visit);
+    };
+    visit(sf);
+  } catch {
+  }
+  return sel;
+}
+var globs2 = (patterns) => {
+  const ms = patterns.map((g) => {
+    try {
+      return picomatch3(g, { dot: true });
+    } catch {
+      return () => false;
+    }
+  });
+  return (path) => ms.some((m) => m(path));
+};
+var regexes = (patterns) => {
+  const rs = patterns.flatMap((p) => {
+    try {
+      return [new RegExp(p.replace(/<rootDir>/g, ""))];
+    } catch {
+      return [];
+    }
+  });
+  return (path) => rs.some((r) => r.test("/" + path));
+};
+function predicate(sel, runner) {
+  const includeList = sel.include ?? (runner === "jest" ? sel.regex ? null : JEST_DEFAULT_MATCH : VITEST_DEFAULT_INCLUDE);
+  const ignoreList = sel.ignore ?? (runner === "jest" ? JEST_DEFAULT_IGNORE : VITEST_DEFAULT_EXCLUDE);
+  const included = includeList ? globs2(includeList) : sel.regex ? regexes(sel.regex) : () => true;
+  const ignored = runner === "jest" ? regexes(ignoreList) : globs2(ignoreList);
+  return {
+    selects: (p) => included(p) && !ignored(p),
+    why: (p) => {
+      if (ignored(p)) {
+        const key3 = runner === "jest" ? "testPathIgnorePatterns" : "test.exclude";
+        const hit = ignoreList.find((g) => (runner === "jest" ? regexes([g]) : globs2([g]))(p));
+        return `${key3} now matches it (${JSON.stringify(hit ?? "")})`;
+      }
+      const key2 = sel.include ? runner === "jest" ? "testMatch" : "test.include" : "testRegex";
+      return `${key2} no longer matches it (${JSON.stringify(sel.include ?? sel.regex ?? [])})`;
+    }
+  };
+}
+function suiteNarrowings(before, after, path, samples) {
+  const runner = runnerOf(path);
+  if (!runner) return [];
+  const b = parseSelection(before ?? "", runner);
+  const a = parseSelection(after, runner);
+  if (!a.present || a.opaque) return [];
+  const pb = predicate(b, runner);
+  const pa = predicate(a, runner);
+  const out2 = [];
+  for (const s of samples) {
+    if (pb.selects(s) && !pa.selects(s)) out2.push({ path: s, reason: pa.why(s) });
+  }
+  return out2;
+}
+
+// src/detectors/test-deletion.ts
 var RULE7 = "test-deletion";
+var JVM_TEST = /^\s*(?:@\w+(?:\([^)]*\))?\s+)*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/;
 var TEST_DEFS = {
   py: /^\s*(?:async\s+)?def\s+test\w*\s*\(/,
   go: /^func\s+(?:Test|Example|Fuzz)\w*\s*\(/,
   rs: /^\s*#\[[\w:]*test[\w:]*(?:\(|\])/,
   rb: /^\s*(?:(?:it|specify|test|scenario|example)\s*(?:\(\s*)?['"]|def\s+test_\w+)/,
-  java: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
-  kt: /^\s*@(?:Test|ParameterizedTest|RepeatedTest|TestFactory|TestTemplate)\b/,
+  java: JVM_TEST,
+  kt: JVM_TEST,
   php: /^\s*(?:(?:public\s+)?function\s+test\w*\s*\(|#\[Test\]|\*\s*@test\b)/,
   cs: /^\s*\[(?:Fact|Theory|Test|TestMethod|TestCase|DataTestMethod)\b/
 };
 function calleeName(expr) {
-  if (ts3.isIdentifier(expr)) return expr.text;
-  if (ts3.isPropertyAccessExpression(expr) && ts3.isIdentifier(expr.expression)) {
+  if (ts4.isIdentifier(expr)) return expr.text;
+  if (ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression)) {
     return expr.expression.text;
   }
   return null;
 }
-function countTestBlocks(src, path = "spec.ts") {
+var isEachOf = (expr) => ts4.isPropertyAccessExpression(expr) && ts4.isIdentifier(expr.expression) && (expr.expression.text === "it" || expr.expression.text === "test") && expr.name.text === "each";
+function eachRows(call) {
+  const arg = call.arguments[0];
+  if (!arg) return { n: 1, open: true };
+  if (ts4.isArrayLiteralExpression(arg)) {
+    let n = 0;
+    let open = false;
+    for (const el of arg.elements) {
+      if (ts4.isSpreadElement(el)) open = true;
+      else n++;
+    }
+    return { n: Math.max(n, open ? 0 : 1), open };
+  }
+  return { n: 1, open: true };
+}
+function countTests(src, path = "spec.ts") {
   const lang = langOf(path);
   if (lang && lang !== "js") {
     const re = TEST_DEFS[lang];
     let n2 = 0;
     for (const line of src.split("\n")) if (re.test(line)) n2++;
-    return n2;
+    return { min: n2, open: false };
   }
-  const sf = ts3.createSourceFile("spec.ts", src, ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TS);
+  const sf = ts4.createSourceFile("spec.ts", src, ts4.ScriptTarget.Latest, true, ts4.ScriptKind.TS);
   let n = 0;
+  let open = false;
   const visit = (node) => {
-    if (ts3.isCallExpression(node)) {
-      const name = calleeName(node.expression);
-      if (name === "it" || name === "test") n++;
+    if (ts4.isCallExpression(node)) {
+      if (isEachOf(node.expression)) {
+        const r = eachRows(node);
+        n += r.n;
+        if (r.open) open = true;
+      } else {
+        const name = calleeName(node.expression);
+        if (name === "it" || name === "test") n++;
+      }
+    } else if (ts4.isTaggedTemplateExpression(node) && isEachOf(node.tag)) {
+      const rows = node.template.getText().split("\n").filter((l) => /\S/.test(l.replace(/[`]/g, ""))).length - 1;
+      n += Math.max(rows, 1);
     }
-    ts3.forEachChild(node, visit);
+    ts4.forEachChild(node, visit);
   };
   visit(sf);
-  return n;
+  return { min: n, open };
+}
+function countTestBlocks(src, path = "spec.ts") {
+  return countTests(src, path).min;
 }
 function significantLines(src, path) {
   const out2 = /* @__PURE__ */ new Set();
@@ -2317,32 +3161,63 @@ function significantLines(src, path) {
   }
   return out2;
 }
+var OTHER_RUNNER_DIR = /(?:^|\/)(?:e2e|cypress|playwright)\//;
+function runnerSamples(configPath, policy, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files) return CANONICAL_SAMPLES;
+  const root = configPath.includes("/") ? configPath.slice(0, configPath.lastIndexOf("/") + 1) : "";
+  const own = files.filter((f) => f.startsWith(root) && langOf(f) === "js" && isProtected(f, policy, "tests") && !OTHER_RUNNER_DIR.test(f)).map((f) => f.slice(root.length));
+  return own.length ? own : CANONICAL_SAMPLES;
+}
+function joinRoot(root, to) {
+  const parts = root ? root.split("/") : [];
+  for (const seg of to.replace(/\/+$/, "").split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") {
+      if (parts.length === 0) return null;
+      parts.pop();
+    } else parts.push(seg);
+  }
+  return parts.join("/");
+}
+function leavesGlob(dir, dest, policy, ctx) {
+  const files = trackedFiles(ctx);
+  if (!files || !dir) return false;
+  const src = dir.replace(/^\.\//, "").replace(/\/+$/, "") + "/";
+  const to = dest.replace(/^\.\//, "").replace(/\/+$/, "") + "/";
+  return files.some((f) => f.startsWith(src) && isProtected(f, policy, "tests") && !isProtected(to + f.slice(src.length), policy, "tests"));
+}
+var SED_INPLACE = /(?:^|\s)(?:-i\b|--in-place\b|-[a-zA-Z]*i[a-zA-Z]*\b)/;
 var testDeletion = {
   id: RULE7,
   surface: ["file", "command"],
   certainty: "mechanical",
-  run(changes, policy) {
+  run(changes, policy, _view, ctx) {
     const out2 = [];
     const addedTestLines = /* @__PURE__ */ new Set();
     let addedTestBlocks = 0;
     for (const c of changes) {
-      if (c.kind === "file" && c.op === "add" && c.after != null && isProtected(c.path, policy, "tests")) {
+      if (c.kind !== "file" || c.after == null || !isProtected(c.path, policy, "tests")) continue;
+      if (c.op === "add") {
         for (const l of significantLines(c.after, c.path)) addedTestLines.add(l);
         addedTestBlocks += countTestBlocks(c.after, c.path);
+      } else if (c.before != null) {
+        const before = significantLines(c.before, c.path);
+        for (const l of significantLines(c.after, c.path)) if (!before.has(l)) addedTestLines.add(l);
+        addedTestBlocks += Math.max(0, countTestBlocks(c.after, c.path) - countTestBlocks(c.before, c.path));
       }
     }
-    const isRelocation = (before, path) => {
-      const sig = significantLines(before, path);
-      if (sig.size === 0 || addedTestLines.size === 0) return false;
+    const isRelocation = (removed, blocksRemoved) => {
+      if (removed.size === 0 || addedTestLines.size === 0) return false;
       let hit = 0;
-      for (const l of sig) if (addedTestLines.has(l)) hit++;
-      return hit / sig.size >= 0.6 && addedTestBlocks >= countTestBlocks(before, path);
+      for (const l of removed) if (addedTestLines.has(l)) hit++;
+      return hit / removed.size >= 0.6 && addedTestBlocks >= blocksRemoved;
     };
     for (const c of changes) {
       if (c.kind === "file") {
         const isTest = isProtected(c.path, policy, "tests");
         if (c.op === "delete" && isTest) {
-          if (c.before != null && isRelocation(c.before, c.path)) continue;
+          if (c.before != null && isRelocation(significantLines(c.before, c.path), countTestBlocks(c.before, c.path))) continue;
           out2.push(
             makeFinding(RULE7, policy, {
               file: c.path,
@@ -2361,41 +3236,95 @@ var testDeletion = {
             })
           );
         } else if ((c.op === "modify" || c.op === "rename") && isTest && c.before != null && c.after != null) {
-          const before = countTestBlocks(c.before, c.path);
-          const after = countTestBlocks(c.after, c.path);
-          if (after < before) {
+          const before = countTests(c.before, c.path);
+          const after = countTests(c.after, c.path);
+          if (after.min < before.min && !after.open) {
+            const afterLines = significantLines(c.after, c.path);
+            const removed = new Set([...significantLines(c.before, c.path)].filter((l) => !afterLines.has(l)));
+            if (isRelocation(removed, before.min - after.min)) continue;
             out2.push(
               makeFinding(RULE7, policy, {
                 file: c.path,
-                message: `Test blocks removed: ${before} \u2192 ${after} it()/test() in this spec.`,
-                evidence: `${before - after} test block(s) removed from ${c.path}`,
+                message: `Test blocks removed: ${before.min} \u2192 ${after.min} it()/test() in this spec (each-table rows count as tests).`,
+                evidence: `${before.min - after.min} test block(s) removed from ${c.path}`,
                 remediation: "Keep the assertions and fix the code. Removing test blocks to go green is the tamper."
               })
             );
           }
+        } else if (c.op !== "delete" && c.after != null && !isTest && isProtected(c.path, policy, "config") && runnerOf(c.path)) {
+          for (const n of suiteNarrowings(c.before, c.after, c.path, runnerSamples(c.path, policy, ctx))) {
+            out2.push(
+              makeFinding(RULE7, policy, {
+                file: c.path,
+                message: `The runner no longer selects ${n.path}: ${n.reason}.`,
+                evidence: `${n.path} dropped from the suite by ${c.path}`,
+                remediation: "Keep the runner pointed at the whole suite. Excluding a spec from the runner removes its tests without touching the file."
+              })
+            );
+          }
         }
       } else {
+        let root = "";
         for (const seg of segments(c.raw)) {
           const toks = tokens(seg).map(unquote);
-          const testToks = toks.filter((t) => isProtected(t, policy, "tests"));
-          if (testToks.length === 0) continue;
+          const cdTo = toks[0] === "cd" ? toks[1] : null;
+          if (cdTo !== null) {
+            root = cdTo === void 0 || /^[/~$]/.test(cdTo) || root === null ? null : joinRoot(root, cdTo);
+            continue;
+          }
+          const inRepo = (t) => root ? `${root}/${t}` : t;
+          const listing = trackedFiles(ctx);
+          const testToks = toks.filter((t) => {
+            if (!isProtected(t, policy, "tests")) return false;
+            if (!listing || root === null) return true;
+            const looksLikeFile = /\.[A-Za-z0-9]+$/.test(t.split("/").pop() ?? "");
+            if (looksLikeFile || listing.includes(inRepo(t))) return true;
+            return containsProtected(inRepo(t), policy, "tests", ctx);
+          });
+          const dirToks = toks.filter(
+            (t) => !t.startsWith("-") && !testToks.includes(t) && !/[*?{}[\]]/.test(t) && (root === null ? containsProtected(t, policy, "tests", ctx) : containsProtected(inRepo(t), policy, "tests", ctx))
+          );
+          if (testToks.length === 0 && dirToks.length === 0) continue;
+          const named = [...testToks, ...dirToks];
+          const cmd = toks[0] ?? "";
           let why = null;
           let evidence = seg;
           const redirectTarget = seg.match(/>\s*(\S+)/)?.[1];
           const redirectsOntoTest = redirectTarget ? isProtected(unquote(redirectTarget), policy, "tests") : false;
-          if (/\brm\b/.test(seg)) {
+          const findDeletes = cmd === "find" && /\s(?:-delete\b|-exec\s+(?:rm|unlink)\b|-execdir\s+(?:rm|unlink)\b)/.test(seg);
+          const gitRestoresOld = cmd === "git" && /^git\s+(?:checkout|restore)\b/.test(seg) && (() => {
+            const src = seg.match(/--source[= ]\s*(\S+)/)?.[1];
+            const rev = src ?? toks.slice(2).find((t) => !t.startsWith("-") && !named.includes(t) && t !== "--");
+            return !!rev && rev !== "HEAD" && (!!src || seg.includes(" -- "));
+          })();
+          if (/\brm\b/.test(seg) && !/^(?:git|npm|yarn|pnpm|bun)\b/.test(seg)) {
             why = "rm deletes a test file";
-          } else if (/\bsed\b/.test(seg) && /(?:^|\s)-i\b/.test(seg)) {
+          } else if (cmd === "git" && /^git\s+rm\b/.test(seg)) {
+            why = "git rm deletes a test file";
+          } else if (cmd === "sed" && SED_INPLACE.test(seg)) {
             why = "sed -i rewrites a test file in place";
+          } else if (cmd === "perl" && /(?:^|\s)-[a-zA-Z]*i\b|\s-i\S*/.test(seg)) {
+            why = "perl -i rewrites a test file in place";
           } else if (/\btruncate\b/.test(seg)) {
             why = "truncate empties a test file";
           } else if (redirectsOntoTest) {
             why = "a redirect overwrites/empties a test file";
+          } else if (cmd === "cp" && testToks.length > 0 && isProtected(toks[toks.length - 1] ?? "", policy, "tests") && !isProtected(toks[toks.length - 2] ?? "", policy, "tests")) {
+            why = "cp overwrites a test file with something else";
+          } else if (cmd === "tee" && !toks.includes("-a") && !toks.includes("--append")) {
+            why = "tee overwrites a test file";
+          } else if (findDeletes) {
+            why = "find -delete removes test files";
+          } else if (gitRestoresOld) {
+            why = "git checkout <rev> replaces a test file with an older version";
           } else if (/\bmv\b/.test(seg)) {
             const dest = toks[toks.length - 1];
-            if (dest && !isProtected(dest, policy, "tests")) {
+            if (dest && testToks.length > 0 && !isProtected(dest, policy, "tests")) {
               why = "mv renames a test file out of the test glob";
               evidence = `${testToks[0]} \u2192 ${dest}`;
+            } else if (dest && testToks.length === 0 && dirToks[0] !== dest && leavesGlob(dirToks[0] ?? "", dest, policy, ctx)) {
+              why = "mv renames a test directory so its specs leave the test glob";
+              evidence = `${dirToks[0]} \u2192 ${dest}`;
             }
           }
           if (why) {
@@ -2415,9 +3344,40 @@ var testDeletion = {
 };
 
 // src/detectors/test-content-removal.ts
+import ts5 from "typescript";
 var RULE8 = "test-content-removal";
 var MIN_REMOVED_LINES = 3;
+var MIN_REMOVED_ROWS = 2;
 var ws = (s) => s.replace(/\s+/g, "");
+function eachTables(src, path) {
+  const rows = /* @__PURE__ */ new Set();
+  let open = false;
+  if (langOf(path) !== "js" && langOf(path) !== null) return { rows, open };
+  try {
+    const sf = ts5.createSourceFile("spec.ts", src, ts5.ScriptTarget.Latest, true, ts5.ScriptKind.TS);
+    const visit = (node) => {
+      if (ts5.isCallExpression(node) && ts5.isPropertyAccessExpression(node.expression) && node.expression.name.text === "each" && ts5.isIdentifier(node.expression.expression) && /^(?:it|test|describe)$/.test(node.expression.expression.text)) {
+        const arg = node.arguments[0];
+        if (arg && ts5.isArrayLiteralExpression(arg)) {
+          for (const el of arg.elements) {
+            if (ts5.isSpreadElement(el)) {
+              open = true;
+              continue;
+            }
+            for (const raw of el.getText(sf).split("\n")) {
+              const l = raw.trim().replace(/,$/, "");
+              if (isSignificantLine(l, "js")) rows.add(l);
+            }
+          }
+        } else open = true;
+      }
+      ts5.forEachChild(node, visit);
+    };
+    visit(sf);
+  } catch {
+  }
+  return { rows, open };
+}
 function significantLinesOrdered(src, path) {
   const out2 = [];
   const lang = langOf(path);
@@ -2434,16 +3394,23 @@ var testContentRemoval = {
   run(changes, policy) {
     const out2 = [];
     let keptPool = "";
+    let addedPool = "";
     for (const c of changes) {
-      if (c.kind === "file" && c.after != null && isProtected(c.path, policy, "tests")) {
-        keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
+      if (c.kind !== "file" || c.after == null) continue;
+      if (isProtected(c.path, policy, "tests")) keptPool += ws(significantLinesOrdered(c.after, c.path).join("\n"));
+      if (c.op === "add") addedPool += ws(c.after);
+      else if (c.before != null) {
+        const had = new Set(c.before.split("\n").map((l) => l.trim()));
+        addedPool += ws(c.after.split("\n").filter((l) => !had.has(l.trim())).join("\n"));
       }
     }
     for (const c of changes) {
       if (c.kind !== "file" || c.op !== "modify" && c.op !== "rename" || c.before == null || c.after == null) continue;
       if (!isProtected(c.path, policy, "tests")) continue;
       if (isProtected(c.path, policy, "snapshots")) continue;
-      if (countTestBlocks(c.after, c.path) < countTestBlocks(c.before, c.path)) continue;
+      const blocksBefore = countTests(c.before, c.path);
+      const blocksAfter = countTests(c.after, c.path);
+      if (blocksAfter.min < blocksBefore.min && !blocksAfter.open) continue;
       const beforeSig = significantLinesOrdered(c.before, c.path);
       const afterSig = significantLinesOrdered(c.after, c.path);
       const netDrop = beforeSig.length - afterSig.length;
@@ -2454,6 +3421,19 @@ var testContentRemoval = {
         if (keptPool.includes(ws(line))) continue;
         gone.push(line);
       }
+      const table = eachTables(c.before, c.path);
+      const goneRows = table.rows.size && eachTables(c.after, c.path).open ? gone.filter((l) => table.rows.has(l.replace(/,$/, "")) && !addedPool.includes(ws(l))) : [];
+      if (goneRows.length >= MIN_REMOVED_ROWS) {
+        out2.push(
+          makeFinding(RULE8, policy, {
+            file: c.path,
+            message: `Rows removed from a test table: ${goneRows.length} case(s) gone from an each-table that now spreads from elsewhere, and they reappear nowhere in the change.`,
+            evidence: goneRows.slice(0, 3).map((l) => l.slice(0, 80)).join(" | "),
+            remediation: "Fix the code under test. A row of it.each is a test; moving the table out of the spec must carry every row with it."
+          })
+        );
+        continue;
+      }
       if (gone.length >= MIN_REMOVED_LINES && netDrop >= MIN_REMOVED_LINES) {
         out2.push(
           makeFinding(RULE8, policy, {
@@ -2644,7 +3624,7 @@ function hasBlocking(findings) {
 
 // src/policy-load.ts
 import { readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
-import { isAbsolute, join as join3, posix } from "node:path";
+import { isAbsolute as isAbsolute2, join as join3, posix } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -2661,7 +3641,7 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  if (!ledger.trim() || isAbsolute2(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
   const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
@@ -2692,8 +3672,8 @@ function validate(r, where) {
   if (r.ignore !== void 0 && !isStringList(r.ignore)) bad(`ignore must be a list of globs, got ${show(r.ignore)}`);
   if (r.protected !== void 0) {
     if (!isMapping(r.protected)) bad(`protected must be a mapping of category to a list of globs, got ${show(r.protected)}`);
-    for (const [cat, globs2] of Object.entries(r.protected)) {
-      if (!isStringList(globs2)) bad(`protected.${cat} must be a list of globs, got ${show(globs2)}`);
+    for (const [cat, globs3] of Object.entries(r.protected)) {
+      if (!isStringList(globs3)) bad(`protected.${cat} must be a list of globs, got ${show(globs3)}`);
     }
   }
   if (r.signoff !== void 0) {
@@ -2725,10 +3705,10 @@ function parsePolicy(raw, where = POLICY_FILE) {
   const version = normalizeVersion(r.version, where);
   validate(r, where);
   const base = defaultPolicy(version);
-  const globs2 = (list) => list?.map(normalizeGlob);
-  const userProtected = r.protected ? Object.fromEntries(Object.entries(r.protected).map(([cat, list]) => [cat, globs2(list) ?? []])) : void 0;
+  const globs3 = (list) => list?.map(normalizeGlob);
+  const userProtected = r.protected ? Object.fromEntries(Object.entries(r.protected).map(([cat, list]) => [cat, globs3(list) ?? []])) : void 0;
   const userRules = r.rules ? Object.fromEntries(
-    Object.entries(r.rules).map(([name, cfg]) => [name, cfg?.exclude ? { ...cfg, exclude: globs2(cfg.exclude) } : cfg])
+    Object.entries(r.rules).map(([name, cfg]) => [name, cfg?.exclude ? { ...cfg, exclude: globs3(cfg.exclude) } : cfg])
   ) : void 0;
   return {
     version,
@@ -2738,7 +3718,7 @@ function parsePolicy(raw, where = POLICY_FILE) {
     // an `exclude`-only override drop the rule's baseline severity (see mergeRules).
     protected: mergeProtected(base.protected, userProtected),
     rules: mergeRules(base.rules, userRules),
-    ignore: globs2(r.ignore) ?? base.ignore,
+    ignore: globs3(r.ignore) ?? base.ignore,
     signoff: {
       requiredFor: r.signoff?.required_for ?? r.signoff?.requiredFor ?? base.signoff.requiredFor,
       ledger: r.signoff?.ledger ?? base.signoff.ledger
@@ -3115,7 +4095,8 @@ function check(opts) {
     layer = "local";
     view = "staged";
   } else if (opts.worktree) {
-    changes = opts.includeUntracked ? diffWorktreeWithUntracked({ cwd: opts.cwd }) : diffWorktree({ cwd: opts.cwd });
+    const p = policy;
+    changes = opts.includeUntracked ? diffWorktreeWithUntracked({ cwd: opts.cwd }, (rel) => isProtected(rel, p)) : diffWorktree({ cwd: opts.cwd });
     layer = opts.ciLayer ? "ci" : "local";
     view = "worktree";
   } else if (opts.diff) {
@@ -3171,10 +4152,10 @@ import { createHash as createHash4 } from "node:crypto";
 import { join as join9 } from "node:path";
 
 // src/adapters/claude/changes.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync5, existsSync as existsSync4, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute2, join as join5, relative, resolve } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -3189,8 +4170,8 @@ function abs(path, cwd) {
   return resolve(cwd, path);
 }
 function relForDisplay(path, cwd) {
-  const rel = relative(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute2(rel) ? rel : path;
+  const rel = relative2(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -3211,7 +4192,7 @@ function synthFileChange(displayPath, before, after) {
     writeFileSync(a, before ?? "");
     writeFileSync(b, after ?? "");
     try {
-      raw = execFileSync2("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
+      raw = execFileSync3("git", ["diff", "--no-index", "--no-color", "--text", a, b], {
         encoding: "utf8",
         maxBuffer: 256 * 1024 * 1024
       });
@@ -3333,20 +4314,20 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute3, join as join7 } from "node:path";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join7 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
 function gitDir2(cwd) {
   try {
-    const d = execFileSync3("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync4("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute3(d) ? d : join7(cwd, d);
+    return isAbsolute4(d) ? d : join7(cwd, d);
   } catch {
     return null;
   }
@@ -3379,7 +4360,7 @@ function snapshotProtected(cwd, policy, prev) {
       return;
     }
     for (const name of names) {
-      if (SKIP_DIRS.has(name)) continue;
+      if (SKIP_DIRS2.has(name)) continue;
       const r = rel ? `${rel}/${name}` : name;
       let st;
       try {
@@ -3405,12 +4386,16 @@ function snapshotProtected(cwd, policy, prev) {
 function driftBetween(expected, current) {
   const changed = [];
   const deleted = [];
+  const added = [];
   for (const [path, e] of Object.entries(expected)) {
     const c = current[path];
     if (!c) deleted.push(path);
     else if (c.hash !== e.hash || c.mode !== e.mode) changed.push(path);
   }
-  return { changed, deleted };
+  for (const path of Object.keys(current)) {
+    if (!expected[path]) added.push(path);
+  }
+  return { changed, deleted, added };
 }
 function loadTree(p) {
   if (!p || !existsSync6(p)) return null;
@@ -3424,7 +4409,16 @@ function saveTree(p, tree) {
   if (!p) return;
   try {
     mkdirSync3(join7(p, ".."), { recursive: true });
-    writeFileSync3(p, JSON.stringify(tree));
+    const tmp = `${p}.${process.pid}.tmp`;
+    writeFileSync3(tmp, JSON.stringify(tree));
+    renameSync(tmp, p);
+  } catch {
+  }
+}
+function dropTree(p) {
+  if (!p) return;
+  try {
+    rmSync2(p, { force: true });
   } catch {
   }
 }
@@ -3440,6 +4434,9 @@ function loadTurnTree(cwd, sessionId) {
 function saveTurnTree(cwd, sessionId, tree) {
   saveTree(turnTreePath(cwd, sessionId), tree);
 }
+function dropTurnTree(cwd, sessionId) {
+  dropTree(turnTreePath(cwd, sessionId));
+}
 
 // src/cli/watch.ts
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync2, watch } from "node:fs";
@@ -3684,17 +4681,26 @@ function turnView(cwd, sessionId, policy, base) {
     if (c.oldPath) seen.add(c.oldPath);
   }
   const turnTree = loadTurnTree(cwd, sessionId);
-  const untracked = untrackedAdds({ cwd }, (rel) => isProtected(rel, policy), seen).filter(
-    (c) => c.kind !== "file" || !turnTree || turnTree[c.path]?.hash !== hashOnDisk(cwd, c.path)
-  );
+  const ptree = loadPtree(cwd, sessionId);
+  const keep = (rel) => isProtected(rel, policy);
+  const untouched = (rel, disk) => disk != null && turnTree?.[rel]?.hash === disk && ptree?.[rel]?.hash === disk;
+  const untracked = untrackedAdds({ cwd }, keep, seen).filter((c) => c.kind !== "file" || !untouched(c.path, hashOnDisk(cwd, c.path)));
   for (const c of fileChanges(untracked)) seen.add(c.path);
+  const ignored = ignoredAdds({ cwd }, keep, seen).filter((c) => {
+    if (c.kind !== "file") return false;
+    const disk = hashOnDisk(cwd, c.path);
+    if (untouched(c.path, disk)) return false;
+    const sanctioned = ptree?.[c.path];
+    return !(sanctioned && disk != null && sanctioned.hash !== disk);
+  });
+  for (const c of fileChanges(ignored)) seen.add(c.path);
   const trusted = base ?? "HEAD";
   const hidden = [];
   for (const rel of hiddenTrackedPaths({ cwd })) {
     if (seen.has(rel) || !isProtected(rel, policy)) continue;
     hidden.push(...synthFileChange(rel, fileAt(trusted, rel, { cwd }), fileOnDisk(rel, { cwd })));
   }
-  return [...tracked, ...untracked, ...hidden];
+  return [...tracked, ...untracked, ...ignored, ...hidden];
 }
 function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree) {
   const d = driftBetween(expected, current);
@@ -3712,7 +4718,7 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
     const after = fileOnDisk(rel, { cwd });
     const trustedBlob = fileAt(trusted, rel, { cwd });
     const atGitState = after != null && trustedBlob != null && contentHash(after) === contentHash(trustedBlob);
-    const atTurnStart = current[rel] != null && turnTree?.[rel]?.hash === current[rel].hash;
+    const atTurnStart = current[rel] != null && expected[rel]?.mtimeMs === -1 && turnTree?.[rel]?.hash === current[rel].hash;
     if ((atGitState || atTurnStart) && current[rel] && expected[rel] && current[rel].mode === expected[rel].mode) {
       continue;
     }
@@ -3755,6 +4761,23 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
       });
     }
   }
+  for (const rel of d.added) {
+    if (seen.has(rel)) continue;
+    const after = fileOnDisk(rel, { cwd });
+    if (after == null) {
+      blocks.push({
+        rule: "hidden-drift",
+        severity: "block",
+        file: rel,
+        message: `Protected file ${rel} appeared outside git's view and cannot be read to judge it.`,
+        evidence: rel,
+        remediation: "Remove the file, or make it readable and bring it into git's view; create protected files through a tool call the gate can see.",
+        signoff: { required: true, command: `tamperward allow hidden-drift --file ${rel} --reason "..."` }
+      });
+      continue;
+    }
+    changes.push(...synthFileChange(rel, null, after));
+  }
   return { changes, blocks };
 }
 function effectDriftBlocks(cwd, sessionId, policy) {
@@ -3763,17 +4786,18 @@ function effectDriftBlocks(cwd, sessionId, policy) {
   const current = snapshotProtected(cwd, policy, expected ?? void 0);
   if (!expected) {
     savePtree(cwd, sessionId, current);
-    if (!loadTurnTree(cwd, sessionId)) saveTurnTree(cwd, sessionId, current);
+    if (loadTurnTree(cwd, sessionId)) dropTurnTree(cwd, sessionId);
+    else saveTurnTree(cwd, sessionId, current);
     return null;
   }
   const d = driftBetween(expected, current);
-  if (d.changed.length === 0 && d.deleted.length === 0) {
+  if (d.changed.length === 0 && d.deleted.length === 0 && d.added.length === 0) {
     savePtree(cwd, sessionId, current);
     return null;
   }
   const base = turnBaseline(cwd, sessionId);
   const all = turnView(cwd, sessionId, policy, base);
-  const drifted = /* @__PURE__ */ new Set([...d.changed, ...d.deleted]);
+  const drifted = /* @__PURE__ */ new Set([...d.changed, ...d.deleted, ...d.added]);
   const scoped = all.filter(
     (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
   );
@@ -3985,16 +5009,16 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 }
 
 // src/cli/init.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute4, join as join10, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute5, join as join10, relative as relative3, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
   try {
-    return execFileSync4("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
+    return execFileSync5("git", ["config", "--get", key2], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || null;
   } catch {
     return null;
   }
@@ -4299,15 +5323,15 @@ var MANAGED_HOOKS = [
 ];
 function hooksDir(cwd) {
   try {
-    const out2 = execFileSync4("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (out2) return resolve2(cwd, out2);
   } catch {
   }
   return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
-  const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : path;
+  const rel = relative3(cwd, path);
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -4591,30 +5615,30 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 }
 
 // src/cli/verify.ts
-import { execFileSync as execFileSync7, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync2, rmSync as rmSync2, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14, readlinkSync as readlinkSync2, rmSync as rmSync3, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname4, join as join13, resolve as resolve3 } from "node:path";
 
 // src/git/trusted.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync9, readFileSync as readFileSync12 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join11 } from "node:path";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
 function gitDirOf(cwd) {
   try {
-    const d = execFileSync5("git", ["rev-parse", "--git-dir"], {
+    const d = execFileSync6("git", ["rev-parse", "--git-dir"], {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute5(d) ? d : join11(cwd, d);
+    return isAbsolute6(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -4623,7 +5647,7 @@ function objectRewriteState(cwd) {
   const parts = [];
   try {
     parts.push(
-      "replace:" + execFileSync5("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
+      "replace:" + execFileSync6("git", ["for-each-ref", "--format=%(refname) %(objectname)", "refs/replace/"], {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -4650,12 +5674,12 @@ function objectRewriteState(cwd) {
 }
 
 // src/fingerprint.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readdirSync as readdirSync3, readFileSync as readFileSync13, readlinkSync, statSync as statSync6 } from "node:fs";
 import { join as join12 } from "node:path";
 function treeFingerprint(cwd) {
-  const files = execFileSync6("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
     encoding: "utf8",
     maxBuffer: 1 << 28,
@@ -4787,7 +5811,7 @@ var VERIFICATION_SURFACE = [
   "**/*.runsettings"
 ];
 function git2(args, cwd) {
-  return execFileSync7("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function resolveBase(base, cwd) {
   assertRev(base);
@@ -4828,7 +5852,7 @@ function materialize(cwd, dest) {
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync(p).isSymbolicLink()) rmSync2(p, { force: true });
+    if (lstatSync(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -4839,9 +5863,9 @@ function verifierInputs(cmd, atBase, policy) {
     const tok = raw.replace(/^['"]|['"]$/g, "").replace(/^\.\//, "");
     if (tok && baseFiles.has(tok)) picked.add(tok);
   }
-  const globs2 = policy.verify?.inputs;
-  if (globs2 && globs2.length) {
-    for (const rel of atBase) if (matchesAny(rel, globs2)) picked.add(rel);
+  const globs3 = policy.verify?.inputs;
+  if (globs3 && globs3.length) {
+    for (const rel of atBase) if (matchesAny(rel, globs3)) picked.add(rel);
   }
   return picked;
 }
@@ -4883,10 +5907,10 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
     if (e.type === "commit") {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
-    const content = execFileSync7("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
+    const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
     const out2 = join13(dest, e.path);
     mkdirSync6(dirname4(out2), { recursive: true });
-    rmSync2(out2, { force: true });
+    rmSync3(out2, { force: true });
     if (e.mode === "120000") {
       symlinkSync(content.toString("utf8"), out2);
     } else {
@@ -4899,7 +5923,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync2(join13(dest, rel), { force: true });
+    rmSync3(join13(dest, rel), { force: true });
     removed++;
   }
   return { restored, removed };
@@ -4974,7 +5998,7 @@ function runSuite(dir, cmd, budgetSecs) {
     if (r.exit === null || r.exit === void 0) return { exit: null, secs };
     return { exit: r.exit, secs };
   } finally {
-    rmSync2(outDir, { recursive: true, force: true });
+    rmSync3(outDir, { recursive: true, force: true });
   }
 }
 function runVerify(opts) {
@@ -5021,7 +6045,7 @@ function runVerify(opts) {
   const visDir = join13(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
-    for (const d of dirs) rmSync2(d, { recursive: true, force: true });
+    for (const d of dirs) rmSync3(d, { recursive: true, force: true });
   };
   const treeBefore = treeFingerprint(cwd);
   const depsBefore = depsFingerprint(cwd);
@@ -5158,13 +6182,13 @@ function parseVerify(args) {
 }
 
 // src/cli/run.ts
-import { execFileSync as execFileSync8, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
 import { readdirSync as readdirSync4, readFileSync as readFileSync15, realpathSync } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
-  return execFileSync8("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
+  return execFileSync9("git", args, { cwd, encoding: "utf8", maxBuffer: 1 << 28, env: trustedGitEnv() });
 }
 function nowTicks() {
   try {
@@ -5289,7 +6313,7 @@ tamperward run \u2014 agent exit ${agentExit}; HISTORY_REWRITE \u2192 ENFORCEMEN
   const verifyCode = runVerify({ cwd, base, cmd: frozenCmd, budget: frozenBudget, policyOverride: frozenPolicy });
   if (opts.settle && opts.settle > 0) {
     try {
-      execFileSync8("sleep", [String(opts.settle)]);
+      execFileSync9("sleep", [String(opts.settle)]);
     } catch {
     }
   }