tamperward 2.8.0 → 2.10.0

package/dist/cli/index.js

@@ -1450,8 +1450,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve5) {
-  const obj = resolve5(expr);
+function metricsOf(expr, resolve6) {
+  const obj = resolve6(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1465,7 +1465,7 @@ function metricsOf(expr, resolve5) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve5(p.initializer));
+    const n = numericOf(resolve6(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1511,17 +1511,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve5(node.initializer);
+          const init = resolve6(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve5);
+            const flat = metricsOf(init, resolve6);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1535,7 +1535,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve5);
+              const m = metricsOf(p.initializer, resolve6);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1568,18 +1568,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -2660,12 +2660,13 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute, join as join3, relative } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join3, relative } from "node:path";
 
 // src/wiring.ts
-import { readFileSync } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { readFileSync, realpathSync as realpathSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join as join2, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
@@ -2689,7 +2690,7 @@ var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
 var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
 var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
 var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
-var PLAIN_SEMVER = /^\d+\.\d+\.\d+$/;
+var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
   const pa = a.split(".").map(Number);
@@ -2702,13 +2703,46 @@ function pinNotBelow(now, floor) {
   const c = compareVersions(now, floor);
   return c !== null && c >= 0;
 }
-var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n?$/;
+var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n*$/;
 function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
 }
+function homeDir(env = process.env) {
+  const h = (env.HOME ?? env.USERPROFILE ?? "").trim() || homedir();
+  return h.replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+}
+function claudeConfigDir(env = process.env) {
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir || `${homeDir(env)}/.claude`;
+}
 var CLAUDE_SETTINGS = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|managed-settings\.json)$/;
-var isClaudeSettings = (path) => CLAUDE_SETTINGS.test(path);
+function isClaudeSettings(path, env = process.env) {
+  const p = path.replace(/\\/g, "/");
+  if (CLAUDE_SETTINGS.test(p)) return true;
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir !== "" && (p === `${dir}/settings.json` || p === `${dir}/settings.local.json`);
+}
+function canonicalPath(path) {
+  const tail = [];
+  let cur = path;
+  for (let i = 0; i < 256; i++) {
+    try {
+      const real = realpathSync2(cur).replace(/\\/g, "/");
+      return tail.length ? posix.join(real, ...tail.reverse()) : real;
+    } catch {
+    }
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    tail.push(basename(cur));
+    cur = parent;
+  }
+  return path;
+}
+function resolvesToClaudeSettings(path, env = process.env) {
+  if (isClaudeSettings(path, env)) return true;
+  return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
+}
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
@@ -2835,6 +2869,8 @@ function policyAddWeakening(after) {
 }
 
 // src/detectors/hook-wiring.ts
+import { existsSync } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 function stripComment(line) {
   let single = false;
@@ -2853,6 +2889,8 @@ var TOOL = /^(tamperward|jest|vitest|eslint|tsc|lint-staged|lefthook|husky|pytes
 var SCRIPT = /^(test|tests|lint|typecheck|type-check|coverage|check)\b/;
 var SUBCOMMAND_TOOLS = /* @__PURE__ */ new Set(["tamperward", "make", "cargo", "go", "lefthook", "husky", "pre-commit"]);
 var PREFIX = /^(?:(?:then|do|else|\{|\(|exec|command|time|nice|env|sudo|[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"(?=\s|$)|'[^']*'(?=\s|$)|[^\s"']\S*|(?=\s)))\s+)*/;
+var MODE = /\s(--staged|--worktree|--diff(?:[=\s]+[^\s-][^\s;)}|&]*)?)(?=[\s;)}|&]|$)/;
+var CWD = /\s--cwd(?:=|\s+)("[^"]*"|'[^']*'|\S+)/;
 function checkIdentity(segment) {
   const core = segment.trim().replace(PREFIX, "").replace(/\s+/g, " ");
   const viaRunner = RUNNER.test(core);
@@ -2863,8 +2901,10 @@ function checkIdentity(segment) {
   if (tool === "tamperward") {
     const sub = toks[1];
     if (!sub || sub.startsWith("-")) return null;
-    const cwd = rest.match(/\s--cwd(?:=|\s+)(\S+)/)?.[1];
-    return cwd ? `tamperward ${sub} --cwd ${cwd}` : `tamperward ${sub}`;
+    const mode = rest.match(MODE)?.[1].replace(/[=\s]+/, " ");
+    const cwd = rest.match(CWD)?.[1];
+    const away = cwd !== void 0 && !/rev-parse\s+--show-toplevel/.test(cwd) ? `--cwd ${cwd}` : void 0;
+    return ["tamperward", sub, mode, away].filter((x) => !!x).join(" ");
   }
   if (SUBCOMMAND_TOOLS.has(tool) && toks[1] && !toks[1].startsWith("-")) return `${tool} ${toks[1]}`;
   return tool;
@@ -2900,7 +2940,8 @@ function split(stmt) {
       continue;
     }
     if (depth > 0) continue;
-    const op = stmt.startsWith("&&", i) ? "&&" : stmt.startsWith("||", i) ? "||" : ch === ";" ? ";" : ch === "|" ? "|" : null;
+    const bg = ch === "&" && stmt[i + 1] !== "&" && stmt[i + 1] !== ">" && !/[<>]$/.test(stmt.slice(0, i));
+    const op = stmt.startsWith("&&", i) ? "&&" : stmt.startsWith("||", i) ? "||" : ch === ";" ? ";" : ch === "|" ? "|" : bg ? "&" : null;
     if (!op) continue;
     segs.push(stmt.slice(last, i));
     ops.push(op);
@@ -3129,7 +3170,10 @@ function prepare(lines, opts) {
   }
   return { top, fns, shadowed, pipefail, errexit };
 }
-var TRANSPARENT = /^(?:fi|done|esac|\}|\)|;;|then|do|else|exit\s+"?\$\??"?|exit\s+"?\$\{\?\}"?)\s*;?$/;
+var SENSITIVE_ENV = /^(?:PATH|NODE_OPTIONS|NODE_PATH|HOME|LD_PRELOAD|BASH_ENV|ENV|npm_config_\w*|NPM_CONFIG_\w*)$/;
+var assignedNames = (prefix) => [...prefix.matchAll(/(?:^|\s)([A-Za-z_]\w*)=(?:"[^"]*"|'[^']*'|[^\s"']\S*|(?=\s))/g)].map((m) => m[1]);
+var WAIT_PID = /^wait\s+"?\$!"?\s*;?$/;
+var TRANSPARENT = /^(?:fi|done|esac|\}|\)|;;|then|do|else|exit\s+"?\$\??"?|exit\s+"?\$\{\?\}"?|wait\s+"?\$!"?)\s*;?$/;
 function statusAfterFailure(seg, vars) {
   const inner = seg.trim().replace(/^[{(]\s*/, "").replace(/\s*[})]\s*;?\s*$/, "");
   let status = "fail";
@@ -3178,7 +3222,7 @@ function reaches(segs, ops, i) {
     if (!runs) continue;
     const s = constStatus(segs[j]);
     if (s === "unknown" && (ops[j] === "&&" || ops[j] === "||")) certain = false;
-    if (ops[j] === ";" || ops[j] === "|") {
+    if (ops[j] === ";" || ops[j] === "|" || ops[j] === "&") {
       status = "ok";
       certain = certain && true;
       continue;
@@ -3187,7 +3231,7 @@ function reaches(segs, ops, i) {
   }
   const gate = i === 0 ? true : ops[i - 1] === "&&" ? status !== "fail" : ops[i - 1] === "||" ? status !== "ok" : true;
   if (!gate) return "no";
-  if (i === 0 || ops[i - 1] === ";" || ops[i - 1] === "|") return "yes";
+  if (i === 0 || ops[i - 1] === ";" || ops[i - 1] === "|" || ops[i - 1] === "&") return "yes";
   if (!certain || status === "unknown") return "maybe";
   return "yes";
 }
@@ -3278,15 +3322,18 @@ function walk(lines, st, topIdx, depth) {
     }
     if (/^;;$/.test(stmt)) continue;
     if (/^[{}()]$/.test(stmt)) continue;
-    const bg = /(?<!&)&\s*$/.test(stmt) && !/&&\s*$/.test(stmt);
-    if (bg) stmt = stmt.replace(/\s*&\s*$/, "");
+    const bgLine = /(?<![&<>])&\s*$/.test(stmt) && !/&&\s*$/.test(stmt);
+    if (bgLine) stmt = stmt.replace(/\s*&\s*$/, "");
+    const bg = bgLine && !WAIT_PID.test(stripComment(lines[i + 1] ?? "").trim());
     const { segs, ops } = split(stmt);
     for (let s = 0; s < segs.length; s++) {
       let seg = segs[s].trim();
       const inverted = /^!\s+/.test(seg);
       seg = seg.replace(/^!\s+/, "");
       const execs = /^exec\s+/.test(seg) && !/^exec\s+(?:\d*[<>]|&>)/.test(seg);
+      const whole = seg;
       seg = seg.replace(PREFIX, "");
+      const prefix = whole.slice(0, whole.length - seg.length);
       const reach = dead() ? "no" : reaches(segs, ops, s);
       const first = seg.split(/\s+/)[0] ?? "";
       if (reach !== "no") {
@@ -3313,11 +3360,12 @@ function walk(lines, st, topIdx, depth) {
           const sigs = trap[4].split(/\s+/);
           if (sigs.some((x) => /^(?:EXIT|ERR|0|SIGERR)$/i.test(x)) && /(?:^|[;\s])(?:exit(?:\s+0+)?|true|:)\s*(?:;|$)/.test(action)) st.traps.push(idx);
         }
-        const asg = seg.match(/^(?:export\s+|readonly\s+)?([A-Za-z_]\w*)=(.*)$/);
+        const asg = seg.match(/^(?:export\s+|readonly\s+|declare\s+-\w+\s+|local\s+)?([A-Za-z_]\w*)=(.*)$/);
         if (asg) {
           const v = certain ? literal(asg[2], st.vars) : null;
           if (v === null) st.vars.delete(asg[1]);
           else st.vars.set(asg[1], v);
+          if (SENSITIVE_ENV.test(asg[1])) st.redirected = true;
         }
         if (first === "cd") {
           const home = cdStaysHome(seg.slice(2), st.vars);
@@ -3344,6 +3392,7 @@ function walk(lines, st, topIdx, depth) {
             st.errexit = sub.errexit;
             st.pipefail = sub.pipefail;
             st.cdAway = sub.cdAway;
+            st.redirected = sub.redirected;
             const verdict2 = chainVerdict(segs, ops, s, st, inverted, bg);
             for (let k = start; k < st.out.length; k++) {
               const inv = st.out[k];
@@ -3388,8 +3437,18 @@ function walk(lines, st, topIdx, depth) {
           state = "neutered";
           why = "runs from another directory after a `cd` away from the repository root";
         }
+        if (state === "live" && /^tamperward\b/.test(id)) {
+          const onGate = assignedNames(prefix).filter((n) => SENSITIVE_ENV.test(n));
+          if (onGate.length) {
+            state = "neutered";
+            why = `runtime redirected \u2014 \`${onGate[0]}=\` in front of it decides what the gate resolves to`;
+          } else if (st.redirected) {
+            state = "neutered";
+            why = "runtime redirected \u2014 PATH, NODE_OPTIONS or another variable the gate resolves through is set earlier in the script";
+          }
+        }
         if (state === "live") {
-          const words2 = [first, "tamperward"].filter((w) => w && st.shadowed.has(w));
+          const words2 = [...prefix.split(/\s+/), first, "tamperward"].filter((w) => w && st.shadowed.has(w));
           if (words2.length) {
             state = "neutered";
             why = `\`${words2[0]}\` is redefined by a function or alias in this script`;
@@ -3406,6 +3465,7 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
   if (inverted) return { state: "neutered", why: "its status is inverted by `!`", passthrough: false };
   if (bg) return { state: "neutered", why: "run in the background \u2014 the hook does not wait for its status", passthrough: false };
   let cur = "fail";
+  let waited = -1;
   for (let j = i; j < ops.length; j++) {
     const op = ops[j];
     const next = segs[j + 1];
@@ -3413,6 +3473,13 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
       if (!st.pipefail) return { state: "neutered", why: "piped into another command without `pipefail`", passthrough: false };
       continue;
     }
+    if (op === "&") {
+      if (WAIT_PID.test((next ?? "").trim())) {
+        waited = j + 1;
+        continue;
+      }
+      return { state: "neutered", why: "run in the background \u2014 a `wait` without its pid returns 0, and without `wait` the hook does not wait for its status", passthrough: false };
+    }
     if (cur === "exit") break;
     if (op === "||") {
       if (cur === "fail") cur = statusAfterFailure(next, st.vars);
@@ -3430,7 +3497,7 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
   }
   if (cur === "ok") return { state: "neutered", why: "the `||` chain after it ends in success", passthrough: false };
   if (cur === "exit") return { state: "live", passthrough: false };
-  return { state: "live", passthrough: i === ops.length || ops.slice(i).every((o) => o === "&&" || o === "||") };
+  return { state: "live", passthrough: i === ops.length || ops.slice(i).every((o, k) => o === "&&" || o === "||" || o === "&" && i + k + 1 === waited) };
 }
 function invocations(lines, opts = {}) {
   const prep = prepare(lines, opts);
@@ -3438,6 +3505,7 @@ function invocations(lines, opts = {}) {
     errexit: prep.errexit,
     pipefail: prep.pipefail,
     cdAway: false,
+    redirected: false,
     vars: /* @__PURE__ */ new Map(),
     fns: prep.fns,
     shadowed: prep.shadowed,
@@ -3471,6 +3539,27 @@ var strip = (inv) => {
   const { idx: _i, errexit: _e, passthrough: _p, ...rest } = inv;
   return rest;
 };
+var baseIdentity = (id) => id.replace(/\s--.*$/, "");
+function pinRaiseOnly(before, after) {
+  const mask = (src) => {
+    const pins = [];
+    const text = src.replace(/\n+$/, "").replace(/\btamperward(?:@(\d+\.\d+\.\d+))?(?=\s|$)/g, (_m, v) => {
+      pins.push(v ?? "");
+      return "tamperward@\0";
+    });
+    return { text, pins };
+  };
+  const b = mask(before);
+  const a = mask(after);
+  if (b.text !== a.text || b.pins.length !== a.pins.length) return false;
+  return a.pins.every((now, i) => {
+    const was = b.pins[i];
+    if (now === was) return true;
+    if (now === "") return false;
+    if (was !== "" && (compareVersions(now, was) ?? -1) < 0) return false;
+    return !PLAIN_SEMVER.test(TW_VERSION) || (compareVersions(now, TW_VERSION) ?? 1) <= 0;
+  });
+}
 function scriptWeakening(before, after, opts = {}) {
   const beforeInv = invocations(before, opts);
   const afterInv = invocations(after, opts);
@@ -3480,7 +3569,7 @@ function scriptWeakening(before, after, opts = {}) {
   const out2 = [];
   for (const id of bl) {
     if (al.has(id)) continue;
-    const trace = afterInv.find((i) => i.identity === id) ?? afterInv.find((i) => i.identity.split(" --cwd ")[0] === id.split(" --cwd ")[0]);
+    const trace = afterInv.find((i) => i.identity === id) ?? afterInv.find((i) => baseIdentity(i.identity) === baseIdentity(id));
     const how = trace?.state === "neutered" ? `neutralised in place (${trace.why ?? "its failure can no longer fail the hook"})` : trace?.state === "unreachable" ? `made unreachable (${trace.why ?? "behind an always-false guard or an early exit"})` : trace?.state === "comment" ? "commented out" : trace && trace.identity !== id ? `replaced by \`${trace.identity}\`` : "removed";
     const evidence = (trace?.line ?? before.find((l) => checkIdentity(stripComment(l).trim().replace(/^!\s+/, "").replace(PREFIX, "")) === id) ?? id).trim();
     out2.push({ reason: `the check invocation \`${id}\` was ${how}`, evidence });
@@ -3488,8 +3577,9 @@ function scriptWeakening(before, after, opts = {}) {
   const floor = beforeInv.filter((i) => i.state === "live" && i.pin && PLAIN_SEMVER.test(i.pin)).map((i) => i.pin).sort((a, b) => compareVersions(a, b) ?? 0)[0];
   if (floor) {
     for (const inv of afterInv) {
-      if (inv.state !== "live" || !inv.pin || !PLAIN_SEMVER.test(inv.pin)) continue;
-      if ((compareVersions(inv.pin, floor) ?? 0) < 0) out2.push({ reason: `the gate's pin was lowered from ${floor} to ${inv.pin}`, evidence: inv.line.trim() });
+      if (inv.state !== "live" || !inv.pin) continue;
+      if (!PLAIN_SEMVER.test(inv.pin)) out2.push({ reason: `the gate's pin was changed from ${floor} to \`${inv.pin}\`, which is not a plain version \u2014 a range, tag or pre-release resolves to whatever the registry serves`, evidence: inv.line.trim() });
+      else if ((compareVersions(inv.pin, floor) ?? 0) < 0) out2.push({ reason: `the gate's pin was lowered from ${floor} to ${inv.pin}`, evidence: inv.line.trim() });
     }
   }
   return out2;
@@ -3595,8 +3685,22 @@ var isPackageJson = (path) => /(?:^|\/)package\.json$/.test(path);
 var GATE = /\btamperward\b/;
 var str = (v) => typeof v === "string" ? v : Array.isArray(v) ? v.map(String).join(" ") : v == null ? "" : JSON.stringify(v);
 var list = (v) => Array.isArray(v) ? v.map(String) : typeof v === "string" ? v.split(/[\s,]+/).filter(Boolean) : [];
-function runsGate(command) {
-  return invocations([command], { errexit: true }).some((i) => i.state === "live" && /^tamperward check\b/.test(i.identity));
+function gateOf(command) {
+  const live = invocations([command], { errexit: true }).find((i) => i.state === "live" && /^tamperward check\b/.test(i.identity));
+  return live ? { identity: live.identity, pin: live.pin ?? "" } : null;
+}
+var redirectingEnv = (env) => isDoc(env) ? Object.keys(env).filter((k) => SENSITIVE_ENV.test(k)).sort().map((k) => `${k}=${str(env[k])}`) : [];
+function gateDrift(what, was, now) {
+  const out2 = [];
+  if (was.gate && now.gate) {
+    if (now.gate.identity !== was.gate.identity) out2.push(`${what} now runs \`${now.gate.identity}\` instead of \`${was.gate.identity}\` \u2014 another check`);
+    if (PLAIN_SEMVER.test(was.gate.pin) && now.gate.pin) {
+      if (!PLAIN_SEMVER.test(now.gate.pin)) out2.push(`${what} pins the gate to \`${now.gate.pin}\`, which is not a plain version (was ${was.gate.pin}) \u2014 a range, tag or pre-release resolves to whatever the registry serves`);
+      else if ((compareVersions(now.gate.pin, was.gate.pin) ?? 0) < 0) out2.push(`${what} lowered the gate's pin from ${was.gate.pin} to ${now.gate.pin}`);
+    }
+  }
+  if (now.env.length && now.env.join(",") !== was.env.join(",")) out2.push(`${what} sets ${now.env.map((e) => e.split("=")[0]).join(", ")} in its \`env\` \u2014 the gate's runtime is redirected`);
+  return out2;
 }
 function mergeDocs(base, over) {
   const out2 = { ...base };
@@ -3621,8 +3725,11 @@ function lefthookEntries(doc) {
         const named = GATE.test(name);
         if (!GATE.test(str(run)) && !named) continue;
         const tags = list(cfg.tags);
+        const gate = run === void 0 ? named ? { identity: "tamperward check --staged", pin: "" } : null : gateOf(str(run));
         out2.set(`${section}.${group}.${name}`, {
-          live: run === void 0 ? named : runsGate(str(run)),
+          live: gate !== null,
+          gate,
+          env: redirectingEnv(cfg.env),
           skip: cfg.skip,
           only: cfg.only,
           sectionSkip: v.skip,
@@ -3648,6 +3755,7 @@ function lefthookWeakening(before, after) {
       continue;
     }
     if (!now.live) out2.push(`lefthook entry ${key2} no longer runs \`tamperward check\` live`);
+    out2.push(...gateDrift(`lefthook entry ${key2} (the gate)`, was, now));
     if (!off(now.skip) && off(was.skip)) out2.push(`lefthook entry ${key2} (the gate) is now \`skip: ${str(now.skip)}\``);
     if (!off(now.sectionSkip) && off(was.sectionSkip)) out2.push(`the lefthook hook carrying ${key2} (the gate) is now \`skip: ${str(now.sectionSkip)}\``);
     if (!off(now.only) && str(now.only) !== str(was.only)) out2.push(`lefthook entry ${key2} (the gate) gained or changed \`only\` (${str(now.only)})`);
@@ -3672,9 +3780,12 @@ function preCommitEntries(doc) {
     for (const h of hooks) {
       if (!isDoc(h)) continue;
       if (!GATE.test(`${str(repo.repo)} ${str(h.id)} ${str(h.entry)} ${str(h.name)}`)) continue;
-      const live = h.entry !== void 0 ? runsGate(str(h.entry)) : GATE.test(`${str(repo.repo)} ${str(h.id)}`);
+      const gate = h.entry !== void 0 ? gateOf(`${str(h.entry)} ${list(h.args).join(" ")}`.trim()) : GATE.test(`${str(repo.repo)} ${str(h.id)}`) ? { identity: "tamperward check --staged", pin: "" } : null;
       out2.set(`${str(repo.repo)}:${str(h.id)}`, {
-        live,
+        live: gate !== null,
+        gate,
+        env: redirectingEnv(h.env),
+        deps: str(h.additional_dependencies),
         stages: Array.isArray(h.stages) ? h.stages.map(String).map(normStage) : defaults,
         explicitStages: Array.isArray(h.stages),
         exclude: str(h.exclude),
@@ -3698,6 +3809,8 @@ function preCommitWeakening(before, after) {
       continue;
     }
     if (!now.live) out2.push(`pre-commit hook ${key2} no longer runs \`tamperward check\` live`);
+    out2.push(...gateDrift(`pre-commit hook ${key2} (the gate)`, was, now));
+    if (now.deps && now.deps !== was.deps) out2.push(`pre-commit hook ${key2} (the gate) gained or changed \`additional_dependencies\` (${now.deps}) \u2014 they choose which gate the hook installs`);
     const lost = was.stages.filter((s) => GATE_STAGES.has(s) && !now.stages.includes(s));
     if (lost.length && !now.stages.some((s) => GATE_STAGES.has(s))) {
       out2.push(`pre-commit hook ${key2} (the gate) now runs only at stages [${now.stages.join(", ")}] \u2014 no commit or push triggers it`);
@@ -3825,7 +3938,8 @@ var WRAPPERS = /^(?:sudo|command|exec|time|nice|env|[A-Za-z_][A-Za-z0-9_]*=\S*)$
 var INTERPRETERS = /* @__PURE__ */ new Set(["python", "python2", "python3", "node", "perl", "ruby", "php", "deno", "bun"]);
 var INLINE_FLAG = /^-(?:c|e|r|E|p|pe|pi|i|ne|ni|le)$|^--eval$|^--print$|^--exec$/;
 var EDITORS = /* @__PURE__ */ new Set(["ex", "ed", "vim", "vi", "nvim"]);
-var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
+var SCRIPT_WORD = /[\w.~/$%{}\\-]+/g;
+var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", "managed-settings.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
 function nameGlob(pattern) {
   const re = new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
   return (n) => re.test(n);
@@ -3864,24 +3978,56 @@ function destinations(cmd, args, isDir) {
   return [dest];
 }
 var REDIRECT_TARGET = /(?:^|\s)(?:\d*>{1,2}\|?|&>{1,2})\s*(\S+)/g;
+function expandShellPath(t, env = process.env) {
+  const home = homeDir(env);
+  return t.replace(/\\/g, "/").replace(/^~(?=\/|$)/, home).replace(/\$(?:\{HOME\}|HOME\b|ENV\{HOME\})/g, home).replace(/%USERPROFILE%/gi, home).replace(/\$(?:\{CLAUDE_CONFIG_DIR\}|CLAUDE_CONFIG_DIR\b)/g, claudeConfigDir(env));
+}
 function hookTests(policy, ctx) {
+  const cwd = ctx?.cwd;
+  const onDisk = cwd !== void 0 && existsSync(cwd);
+  const root = onDisk ? canonicalPath(cwd) : cwd;
+  const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
-    let p = t.replace(/^["']|["']$/g, "");
-    if (ctx?.cwd && p.startsWith(ctx.cwd + "/")) p = p.slice(ctx.cwd.length + 1);
-    return p.replace(/^\.\/(?=.)/, "");
+    const hit = memo.get(t);
+    if (hit !== void 0) return hit;
+    let p = expandShellPath(t.replace(/^["']|["']$/g, ""));
+    const pathy = isAbsolute2(p) || p.includes("/") && !/^[-:]/.test(p);
+    if (pathy && (isAbsolute2(p) || onDisk)) {
+      p = canonicalPath(isAbsolute2(p) ? p : resolve(cwd, p));
+      if (root !== void 0) {
+        if (p === root) p = ".";
+        else if (p.startsWith(root + "/")) p = p.slice(root.length + 1);
+      }
+    }
+    if (cwd !== void 0 && p.startsWith(cwd + "/")) p = p.slice(cwd.length + 1);
+    p = p.replace(/^\.\/(?=.)/, "");
+    memo.set(t, p);
+    return p;
   };
-  const hook = (t) => isProtected(rel(t), policy, "hooks");
-  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || ctx?.cwd !== void 0 && rel(t) === ctx.cwd;
-  const holds = (t) => !t.startsWith("-") && (whole(t) || containsProtected(rel(t), policy, "hooks", ctx));
+  const hook = (t) => {
+    const p = rel(t);
+    return isProtected(p, policy, "hooks") || isClaudeSettings(p) || isClaudeSettings(expandShellPath(t.replace(/^["']|["']$/g, "")));
+  };
+  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || cwd !== void 0 && rel(t) === cwd;
+  const userSettings = `${claudeConfigDir()}/settings.json`;
+  const userSettingsUnder = (t) => {
+    const dir = rel(t).replace(/\/+$/, "");
+    return dir !== "" && dir !== "/" && userSettings.startsWith(dir + "/") ? userSettings : null;
+  };
+  const holds = (t) => !t.startsWith("-") && (whole(t) || userSettingsUnder(t) !== null || containsProtected(rel(t), policy, "hooks", ctx));
   const hookish = (t) => hook(t) || holds(t);
-  return { rel, hook, whole, holds, hookish };
+  return { rel, hook, whole, holds, hookish, userSettingsUnder };
 }
 function shellHookTarget(seg, toks, policy, ctx) {
-  const { rel, hook, whole, holds } = hookTests(policy, ctx);
+  const { rel, hook, whole, holds, userSettingsUnder } = hookTests(policy, ctx);
   for (const m of seg.matchAll(REDIRECT_TARGET)) {
     if (hook(m[1])) return rel(m[1]);
   }
   const args = toks.map((t) => t.replace(/^(?:of=|--(?:include|exclude|directory)=)/, ""));
+  for (let i = 1; i < args.length; i++) {
+    if (!INLINE_FLAG.test(args[i - 1])) continue;
+    for (const word of args[i].match(SCRIPT_WORD) ?? []) if (hook(word)) return rel(word);
+  }
   const fileLike = (p) => {
     const b = p.replace(/\/+$/, "").split("/").pop() ?? "";
     return HOOK_BASENAMES.includes(b) || /\.[A-Za-z0-9]+$/.test(b.replace(/^\.+/, "")) || (trackedFiles(ctx)?.includes(p) ?? false);
@@ -3889,6 +4035,8 @@ function shellHookTarget(seg, toks, policy, ctx) {
   for (const t of args) if (hook(t) && fileLike(rel(t))) return rel(t);
   for (const t of args) {
     if (t.startsWith("-") || !holds(t)) continue;
+    const user = userSettingsUnder(t);
+    if (user !== null) return user;
     const dir = rel(t).replace(/\/+$/, "");
     const under = whole(t) ? "" : dir + "/";
     const listed = trackedFiles(ctx)?.find((f) => f.startsWith(under) && isProtected(f, policy, "hooks"));
@@ -3912,7 +4060,7 @@ function shellWritesHook(seg, toks, policy, ctx) {
   const anyHook = args.some(hook);
   const inPlace = args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a));
   const scripts = args.filter((_, i) => i > 0 && INLINE_FLAG.test(args[i - 1]));
-  const namesHookInText = () => scripts.some((a) => (a.match(/[\w.~/-]+/g) ?? []).some(hook));
+  const namesHookInText = () => scripts.some((a) => (a.match(SCRIPT_WORD) ?? []).some(hook));
   switch (cmd) {
     case "rm":
     case "unlink":
@@ -3996,8 +4144,8 @@ function shellWritesHook(seg, toks, policy, ctx) {
 function xargsWritesHook(toks, fed, policy, ctx) {
   const at = toks.findIndex((t) => t === "xargs" || t.endsWith("/xargs"));
   if (at === -1) return null;
-  const rel = (t) => (ctx?.cwd && t.startsWith(ctx.cwd + "/") ? t.slice(ctx.cwd.length + 1) : t).replace(/^\.\//, "");
-  const fedHook = fed.some((t) => isProtected(rel(t), policy, "hooks") || !t.startsWith("-") && containsProtected(rel(t), policy, "hooks", ctx));
+  const { hookish } = hookTests(policy, ctx);
+  const fedHook = fed.some(hookish);
   if (!fedHook) return null;
   let i = at + 1;
   while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
@@ -4029,11 +4177,23 @@ function eventEntries(s, event) {
   return Array.isArray(arr) ? arr : null;
 }
 var declares = (s, event) => eventEntries(s, event) !== null;
-var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout"]);
+var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout", "statusMessage"]);
+var HOOK_TYPES = /* @__PURE__ */ new Set(["command", "prompt", "agent", "http"]);
+var SIBLING_KEYS = GATE_KEYS;
 var CANONICAL_CMD = /^npx --yes tamperward@(\S+) (hook|sweep) claude$/;
 var MENTIONS_GATE = /\btamperward\b.*\b(?:hook|sweep)\b/;
 var FORGERY = /hookSpecificOutput|permissionDecision|updatedInput|"decision"|"continue"/;
-var SENSITIVE_ENV = /^(?:PATH|NODE_OPTIONS|NODE_PATH|HOME|npm_config_.*|NPM_CONFIG_.*)$/;
+var ENV_MECHANISM = [
+  [/^PATH$/, "the gate's launcher is looked up through it"],
+  [/^(?:NODE_OPTIONS|NODE_PATH)$/, "node loads what it names before the gate runs"],
+  [/^HOME$/, "npx's cache and configuration live under it"],
+  [/^npm_config_/i, "npx reads it as npm configuration, the registry the gate is fetched from included"],
+  [/^(?:BASH_ENV|ENV)$/, "a non-interactive shell sources it before every hook command"],
+  [/^BASH_FUNC_/, "bash imports it as a function that shadows the command it names"],
+  [/^(?:LD|DYLD)_/, "the dynamic loader injects it into every process, the gate included"],
+  [/^TAMPERWARD_/, "it configures the gate itself"]
+];
+var envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
 function analyseGateCommand(cmd, event) {
   const want = event === "PreToolUse" ? "hook" : "sweep";
   const problems = [];
@@ -4092,7 +4252,7 @@ function matcherSelection(m) {
   if (m === "" || m === "*") return { tools: null, problem: null };
   let problem = null;
   if (/[^\x00-\x7f]/.test(m)) problem = "the matcher contains non-ASCII characters that look like tool names but are not";
-  if (/^[A-Za-z0-9_ |-]+$/.test(m)) return { tools: new Set(m.split("|").map((t) => t.trim()).filter(Boolean)), problem };
+  if (/^[A-Za-z0-9_ ,|-]+$/.test(m)) return { tools: new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean)), problem };
   let re;
   try {
     re = new RegExp(m);
@@ -4101,48 +4261,58 @@ function matcherSelection(m) {
   }
   return { tools: new Set(PRE_TOOLS.filter((t) => re.test(t))), problem };
 }
+function entryShape(h) {
+  const problems = [];
+  let runs = true;
+  if (h.type !== "command") {
+    problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
+    if (h.type !== void 0) runs = false;
+  }
+  for (const k of Object.keys(h)) {
+    if (GATE_KEYS.has(k)) continue;
+    problems.push(`carries \`${k}\``);
+    runs = false;
+  }
+  if ("timeout" in h) {
+    const t = h.timeout;
+    if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
+      problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
+      runs = false;
+    }
+  }
+  if ("statusMessage" in h && typeof h.statusMessage !== "string") {
+    problems.push(`\`statusMessage\` ${JSON.stringify(h.statusMessage)} is not a string`);
+    runs = false;
+  }
+  return { problems, runs };
+}
+var mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
 function gateCandidates(s, event) {
   const out2 = [];
-  const mentions = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
   for (const group of eventEntries(s, event) ?? []) {
     if (!isObj(group)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
       continue;
     }
     if (!Array.isArray(group.hooks)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
       continue;
     }
     for (const h of group.hooks) {
       if (!isObj(h)) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
         continue;
       }
       const cmd = typeof h.command === "string" ? h.command : null;
       if (cmd === null) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
         continue;
       }
       if (!MENTIONS_GATE.test(cmd)) continue;
       const a = analyseGateCommand(cmd, event);
-      const problems = [...a.problems];
-      let runs = a.runs;
-      if (h.type !== "command") {
-        problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
-        if (h.type !== void 0) runs = false;
-      }
-      for (const k of Object.keys(h)) {
-        if (GATE_KEYS.has(k)) continue;
-        problems.push(`carries \`${k}\``);
-        runs = false;
-      }
-      if ("timeout" in h) {
-        const t = h.timeout;
-        if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
-          problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
-          runs = false;
-        }
-      }
+      const shape = entryShape(h);
+      const problems = [...a.problems, ...shape.problems];
+      let runs = a.runs && shape.runs;
       let tools = null;
       if (event === "PreToolUse") {
         const sel = matcherSelection(group.matcher);
@@ -4159,6 +4329,7 @@ function gateCandidates(s, event) {
   }
   return out2;
 }
+var carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
 function otherCommands(s, event) {
   const out2 = [];
   for (const group of eventEntries(s, event) ?? []) {
@@ -4170,6 +4341,35 @@ function otherCommands(s, event) {
   }
   return out2;
 }
+function allEntries(s) {
+  const hooks = s.hooks;
+  if (!isObj(hooks)) return [];
+  const out2 = [];
+  for (const [event, arr] of Object.entries(hooks)) {
+    if (!Array.isArray(arr)) continue;
+    for (const group of arr) {
+      if (!isObj(group) || !Array.isArray(group.hooks)) continue;
+      for (const h of group.hooks) out2.push({ event, key: JSON.stringify({ e: event, m: group.matcher, h }), group, h });
+    }
+  }
+  return out2;
+}
+function schemaProblem(group, h) {
+  if (group.matcher !== void 0 && typeof group.matcher !== "string") return `the matcher ${JSON.stringify(group.matcher)} is not a string`;
+  if (!isObj(h)) return `the hook entry ${JSON.stringify(h)} is not an object`;
+  if (typeof h.type !== "string" || !HOOK_TYPES.has(h.type)) return `\`type\` ${JSON.stringify(h.type)} is not one the runtime accepts`;
+  if (h.type === "command" && typeof h.command !== "string") return "`command` is not a string";
+  if ("timeout" in h && (typeof h.timeout !== "number" || !Number.isFinite(h.timeout) || h.timeout <= 0)) return `\`timeout\` ${JSON.stringify(h.timeout)} is not a positive number`;
+  return null;
+}
+function siblingProblem(h) {
+  const cmd = typeof h.command === "string" ? h.command : "";
+  if (FORGERY.test(cmd)) return `emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`;
+  if (h.type !== "command") return `is not a plain command entry (\`type\` is ${JSON.stringify(h.type)})`;
+  const extra = Object.keys(h).filter((k) => !SIBLING_KEYS.has(k));
+  if (extra.length) return `is not a plain command entry (carries \`${extra.join("`, `")}\`)`;
+  return `was added (\`${cmd.slice(0, 60)}\`) \u2014 its output combines with the gate's verdict (an \`updatedInput\` after an allow, a \`continue: false\` over a block), and init writes no entry beside the gate`;
+}
 function coverage(cs) {
   const live = cs.filter((c) => c.runs);
   if (live.length === 0) return "none";
@@ -4220,16 +4420,26 @@ function duplicateJsonKeys(src) {
 }
 function settingsWeakening(before, after, local) {
   const reasons = [];
+  const gated = carriesGate(after);
+  const gatedBefore = before !== null && carriesGate(before);
   const dis = after.disableAllHooks;
   if (dis !== void 0 && dis !== false && !(before !== null && before.disableAllHooks === dis)) {
     reasons.push(`\`disableAllHooks: ${JSON.stringify(dis)}\` switches every hook off, the gate included`);
   }
+  if (gated && dis === void 0) {
+    if (before !== null && before.disableAllHooks === false) {
+      reasons.push("`disableAllHooks: false` was removed \u2014 init declares it so that a `true` in the user settings file cannot switch the gate off");
+    } else if (!gatedBefore) {
+      reasons.push("`disableAllHooks: false` is not declared \u2014 init declares it in the file it writes, so that a `true` in the user settings file cannot switch the gate off");
+    }
+  }
   if (isObj(after.env)) {
     const was = before !== null && isObj(before.env) ? before.env : {};
     for (const [k, v] of Object.entries(after.env)) {
-      if (SENSITIVE_ENV.test(k) && JSON.stringify(was[k]) !== JSON.stringify(v)) {
-        reasons.push(`a top-level \`env\` sets ${k} \u2014 the gate command resolves through it`);
-      }
+      if (k in was && JSON.stringify(was[k]) === JSON.stringify(v)) continue;
+      const how = envMechanism(k);
+      if (how) reasons.push(`a top-level \`env\` sets ${k} \u2014 ${how}`);
+      else if (gated) reasons.push(`a top-level \`env\` sets ${k} \u2014 every hook command runs with it, and init writes no \`env\``);
     }
   }
   for (const event of EVENTS) {
@@ -4257,15 +4467,36 @@ function settingsWeakening(before, after, local) {
       if (c.problems.length) reasons.push(`the ${event} gate entry does not match the shape \`tamperward init\` writes: ${c.problems.join("; ")}`);
     }
     const pins = bc.map((c) => c.pin).filter((p) => !!p && PLAIN_SEMVER.test(p)).sort((a, b) => compareVersions(b, a) ?? 0);
-    const floor = pins[0] ?? (before === null && PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null);
-    if (floor) {
-      for (const c of fresh) {
-        if (c.pin && PLAIN_SEMVER.test(c.pin) && !pinNotBelow(c.pin, floor)) reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`);
+    const judging = PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null;
+    const floor = pins[0] ?? (bc.length === 0 ? judging : null);
+    for (const c of fresh) {
+      if (c.pin === null || c.pin !== "" && !PLAIN_SEMVER.test(c.pin)) continue;
+      if (floor !== null && !pinNotBelow(c.pin, floor)) {
+        reasons.push(
+          c.pin === "" ? `the ${event} gate is unpinned, below ${floor} \u2014 \`npx\` then runs whatever \`tamperward\` resolves to on this machine` : `the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`
+        );
+      } else if (judging !== null && c.pin !== "" && (compareVersions(c.pin, judging) ?? 0) > 0) {
+        reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, above the ${judging} judging it \u2014 a pin npm cannot resolve fails the hook open; raise it by running \`tamperward init\` from the newer version, which raises the judging gate with it`);
+      }
+    }
+  }
+  if (gated) {
+    const had = new Set(before !== null ? allEntries(before).map((e) => e.key) : []);
+    for (const e of allEntries(after)) {
+      if (had.has(e.key) || mentionsGate(e.h)) continue;
+      const schema = schemaProblem(e.group, e.h);
+      if (schema) {
+        reasons.push(`a ${e.event} hook entry carries a value the runtime's schema rejects (${schema}) \u2014 the runtime continues without the broken file, the gate included`);
+      } else if (e.event === "PreToolUse" || e.event === "Stop") {
+        reasons.push(`a ${e.event} hook entry beside the gate ${siblingProblem(e.h)}`);
       }
     }
-    const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
-    for (const cmd of otherCommands(after, event)) {
-      if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+  } else {
+    for (const event of EVENTS) {
+      const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
+      for (const cmd of otherCommands(after, event)) {
+        if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+      }
     }
   }
   return reasons;
@@ -4278,7 +4509,7 @@ function claudeSettingsFindings(c, policy) {
     file: c.path,
     message: `The Claude Code hook wiring was weakened: ${reason}.`,
     evidence: reason,
-    remediation: "Leave the PreToolUse and Stop entries that run tamperward, and the matcher that covers every editing tool, exactly as `tamperward init` wrote them. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
+    remediation: "Leave the PreToolUse and Stop entries that run tamperward, the matcher that covers every editing tool, and `disableAllHooks: false` exactly as `tamperward init` wrote them, with no `env` and no hook entry beside the gate. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
   });
   if (c.before != null && before === null) return null;
   if (after === null) {
@@ -4321,7 +4552,7 @@ function lefthookBase(c, changes, ctx) {
   for (const n of names) {
     try {
       const p = join3(ctx.cwd, n);
-      if (existsSync(p)) return parseDoc(readFileSync2(p, "utf8"));
+      if (existsSync2(p)) return parseDoc(readFileSync2(p, "utf8"));
     } catch {
     }
   }
@@ -4391,11 +4622,12 @@ function updateIndexHiding(toks, policy) {
   return null;
 }
 function repoRelative(path, ctx) {
-  if (!ctx?.cwd || !isAbsolute(path)) return path;
+  if (!ctx?.cwd || !isAbsolute3(path)) return path;
   const rel = relative(ctx.cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
+var isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
@@ -4405,7 +4637,7 @@ var hookTampering = {
     for (const c of changes) {
       let semantic;
       if (c.kind === "file") {
-        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || isClaudeSettings(c.path);
+        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || resolvesToClaudeSettings(c.path);
         if (!targetsHook) {
           if (isPackageJson(c.path) && c.before != null && c.after != null) {
             for (const reason of packageJsonWeakening(c.before, c.after)) {
@@ -4449,7 +4681,7 @@ var hookTampering = {
               remediation: "Renaming a hook out of place disables it. Restore the original path."
             })
           );
-        } else if ((c.path.endsWith(POLICY_FILE) || isClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
+        } else if ((c.path.endsWith(POLICY_FILE) || resolvesToClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
           out2.push(...semantic);
         } else if (c.op === "rename") {
         } else if (isCodeowners(c.path)) {
@@ -4469,6 +4701,7 @@ var hookTampering = {
           out2.push(...semantic);
         } else if (!c.path.endsWith(POLICY_FILE)) {
           const husky = isHuskyScript(c.path);
+          const opts = husky ? { errexit: true } : {};
           const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;
           if (beforePin !== null) {
             const afterPin = initScriptPin(c.after);
@@ -4485,22 +4718,71 @@ var hookTampering = {
             }
             continue;
           }
-          if (!husky && c.after != null) {
-            const problem = shebangProblem(c.after);
-            if (problem && (c.before == null || problem !== shebangProblem(c.before))) {
+          const added = addedLines(c);
+          const removed = removedLines(c);
+          const beforeLines = c.before != null ? c.before.split("\n") : removed.map((l) => l.content);
+          const afterLines = c.after != null ? c.after.split("\n") : added.map((l) => l.content);
+          const shebang = !husky && c.after != null ? shebangProblem(c.after) : null;
+          const shebangChanged = shebang !== null && (c.before == null || shebang !== shebangProblem(c.before));
+          const earlyExit = added.find((l) => insertsPassingExit(l.content));
+          if (c.op === "add") {
+            const gate = invocations(afterLines, opts).filter((i) => /^tamperward check\b/.test(i.identity));
+            const live = gate.find((i) => i.state === "live");
+            if (shebang || !live) {
+              const why = shebang ?? (gate.length ? `its \`${gate[0].identity}\` is ${gate[0].state}${gate[0].why ? ` (${gate[0].why})` : ""}` : "it runs no `tamperward check`");
               out2.push(
                 makeFinding(RULE6, policy, {
                   file: c.path,
-                  line: 1,
-                  message: `A protected hook's interpreter was changed: ${problem}.`,
-                  evidence: c.after.split("\n")[0],
-                  remediation: "Keep a shell in shebang position. git execs the hook directly, and an interpreter that never reads the script is a disabled hook."
+                  message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
+                  evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
+                  remediation: "Run `tamperward check --staged` in the new hook, in a position where its failure fails the hook, or have a human sign off on a hook that does not."
+                })
+              );
+            } else if (earlyExit) {
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  line: earlyExit.newLine ?? void 0,
+                  message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
+                  evidence: earlyExit.content.trim(),
+                  remediation: "Remove the early exit. A hook that always succeeds is a disabled hook."
                 })
               );
             }
+            continue;
+          }
+          if (!isHookNote(c.path)) {
+            const clean = c.before != null && c.after != null ? pinRaiseOnly(c.before, c.after) : pinRaiseOnly(removed.map((l) => l.content).join("\n"), added.map((l) => l.content).join("\n"));
+            if (!clean) {
+              const deadGuard2 = c.before == null || c.after == null ? added.find((l) => insertsDeadGuard(l.content)) : void 0;
+              const detail = [
+                shebangChanged ? `the interpreter changed: ${shebang}` : null,
+                ...scriptWeakening(beforeLines, afterLines, opts).map((l) => l.reason),
+                earlyExit ? `an early \`exit 0\` was inserted (\`${earlyExit.content.trim()}\`)` : null,
+                deadGuard2 ? `a guard that can never be true was inserted (\`${deadGuard2.content.trim()}\`)` : null
+              ].filter((d) => d !== null);
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
+                  evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
+                  remediation: "Restore the script, or have a human sign off. A line-by-line reading of a shell script cannot tell an honest restructuring from a neutered gate, so the gate script is held byte-for-byte: only raising its pin passes without a sign-off."
+                })
+              );
+            }
+            continue;
+          }
+          if (shebangChanged && c.after != null) {
+            out2.push(
+              makeFinding(RULE6, policy, {
+                file: c.path,
+                line: 1,
+                message: `A protected hook's interpreter was changed: ${shebang}.`,
+                evidence: c.after.split("\n")[0],
+                remediation: "Keep a shell in shebang position. git execs the hook directly, and an interpreter that never reads the script is a disabled hook."
+              })
+            );
           }
-          const added = addedLines(c);
-          const earlyExit = added.find((l) => insertsPassingExit(l.content));
           if (earlyExit) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -4524,9 +4806,7 @@ var hookTampering = {
               })
             );
           }
-          const beforeLines = c.before != null ? c.before.split("\n") : removedLines(c).map((l) => l.content);
-          const afterLines = c.after != null ? c.after.split("\n") : added.map((l) => l.content);
-          const lost = scriptWeakening(beforeLines, afterLines, husky ? { errexit: true } : {});
+          const lost = scriptWeakening(beforeLines, afterLines, opts);
           if (lost.length) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -4589,10 +4869,12 @@ var hookTampering = {
           const why = shellWritesHook(seg, toks, policy, ctx) ?? xargsWritesHook(toks, fed, policy, ctx);
           if (why) {
             const target = shellHookTarget(seg, toks, policy, ctx) ?? shellHookTarget("", fed, policy, ctx);
+            const file = target ? repoRelative(target, ctx) : void 0;
+            const outside = file !== void 0 && (isAbsolute3(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
             out2.push(
               makeFinding(RULE6, policy, {
-                ...target ? { file: repoRelative(target, ctx) } : {},
-                message: `Hook tampering via shell: ${why}.`,
+                ...file !== void 0 ? { file } : {},
+                message: `Hook tampering via shell: ${why}${outside}.`,
                 evidence: seg,
                 remediation: "Leave the hooks in place. Mutating them from the shell is still tampering."
               })
@@ -5497,7 +5779,7 @@ var GUARDED_RULE = "hook-tampering";
 var BASELINE_HOOKS = defaultPolicy().protected.hooks;
 function isGuardedFinding(f) {
   if (f.rule !== GUARDED_RULE || !f.file) return false;
-  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || isClaudeSettings(f.file);
+  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || resolvesToClaudeSettings(f.file);
 }
 function key(f) {
   return `${f.rule}|${f.file ?? ""}|${f.line ?? ""}|${f.evidence}`;
@@ -5556,8 +5838,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join4, posix } from "node:path";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join4, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -5574,8 +5856,8 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute2(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
-  const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
+  if (!ledger.trim() || isAbsolute4(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
 function validate(r, where) {
@@ -5682,7 +5964,7 @@ function parseOrThrow(src, where) {
 }
 function loadPolicy(cwd = process.cwd()) {
   const path = join4(cwd, POLICY_FILE);
-  if (!existsSync2(path)) return defaultPolicy();
+  if (!existsSync3(path)) return defaultPolicy();
   return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
@@ -5693,7 +5975,7 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
@@ -5709,7 +5991,7 @@ function ledgerPath(cwd, policy) {
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync3(p)) return [];
+  if (!existsSync4(p)) return [];
   const out2 = [];
   for (const line of readFileSync4(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
@@ -5771,7 +6053,7 @@ function oobHeadFromEnv(env = process.env) {
   return v.length >= 7 ? v : void 0;
 }
 function oobFromEnv(env = process.env) {
-  return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
 }
 
 // src/cli/render/text.ts
@@ -6081,14 +6363,14 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve } from "node:path";
+import { isAbsolute as isAbsolute5, join as join6, relative as relative2, resolve as resolve2 } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -6096,11 +6378,11 @@ function readDisk(path) {
   return textOf(inspectResolved(path));
 }
 function abs(path, cwd) {
-  return resolve(cwd, path);
+  return resolve2(cwd, path);
 }
 function relForDisplay(path, cwd) {
   const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -6202,7 +6484,7 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join7 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
@@ -6216,7 +6498,7 @@ function turnBaseline(cwd, sessionId) {
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       const v = readFileSync5(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
@@ -6243,8 +6525,8 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join8 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join8 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -6256,7 +6538,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute4(d) ? d : join8(cwd, d);
+    return isAbsolute6(d) ? d : join8(cwd, d);
   } catch {
     return null;
   }
@@ -6335,7 +6617,7 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync5(p)) return null;
+  if (!p || !existsSync6(p)) return null;
   try {
     return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
@@ -6793,9 +7075,9 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync6(log)) return none;
+  if (!existsSync7(log)) return none;
   let offset = 0;
-  if (cp && existsSync6(cp)) {
+  if (cp && existsSync7(cp)) {
     const n = Number(readFileSync9(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
@@ -6949,8 +7231,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute5, join as join10, relative as relative3, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join10, relative as relative3, resolve as resolve3 } from "node:path";
 var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
@@ -7103,7 +7385,7 @@ function readWorkflowMark(src) {
 function toolSet(matcher) {
   const m = String(matcher ?? "").trim();
   if (m === "" || m === "*") return null;
-  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+  return new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean));
 }
 function missingTools(matcher) {
   const have = toolSet(matcher);
@@ -7127,7 +7409,7 @@ function hooksShapeError(hooks) {
 }
 function planPolicy(cwd) {
   const path = join10(cwd, POLICY_FILE);
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -7147,7 +7429,7 @@ function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
   const path = join10(cwd, rel);
   let settings = {};
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     let parsed;
     try {
       parsed = JSON.parse(readFileSync10(path, "utf8"));
@@ -7176,7 +7458,8 @@ function planClaudeHooks(cwd) {
   const needStop = stopEntries.length === 0;
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
   const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
-  if (!needPre && !needStop && stale.length === 0 && repin.length === 0) {
+  const needDisableFalse = settings.disableAllHooks !== false;
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0 && !needDisableFalse) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
@@ -7184,12 +7467,13 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync7(path) ? "update" : "create",
+    status: existsSync8(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
       repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
-      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`
+      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`,
+      needDisableFalse && (settings.disableAllHooks === void 0 ? "declare disableAllHooks: false so the user settings file cannot switch the hooks off" : `set disableAllHooks: false (was ${JSON.stringify(settings.disableAllHooks)})`)
     ].filter(Boolean).join(" + "),
     apply: () => {
       for (const h of repin) {
@@ -7208,6 +7492,7 @@ function planClaudeHooks(cwd) {
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
+      if (needDisableFalse) settings.disableAllHooks = false;
       mkdirSync5(dirname4(path), { recursive: true });
       writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n");
     }
@@ -7240,14 +7525,14 @@ var MANAGED_HOOKS = [
 function hooksDir(cwd) {
   try {
     const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (out2) return resolve2(cwd, out2);
+    if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync7(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
+  return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -7270,17 +7555,17 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync7(join10(cwd, ".husky"))) {
+  if (existsSync8(join10(cwd, ".husky"))) {
     path = join10(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join10(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join10(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
-    if (basename(dir) === "_" && basename(dirname4(dir)) === ".husky") {
+    if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
       path = join10(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
@@ -7290,10 +7575,10 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync7(path) && !statSync3(path).isFile()) {
+  if (existsSync8(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync10(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7382,7 +7667,7 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync7(join10(cwd, r))
+    (r) => existsSync8(join10(cwd, r))
   );
   const path = join10(cwd, existingRel ?? rel);
   const existing = existingRel ? readFileSync10(path, "utf8") : null;
@@ -7423,7 +7708,7 @@ function planWorkflow(cwd, force) {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return {
       item: "ci",
       path: rel,
@@ -7533,15 +7818,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join13, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join13, resolve as resolve4 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -7554,7 +7839,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join11(cwd, d);
+    return isAbsolute8(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -7581,7 +7866,7 @@ function objectRewriteState(cwd) {
     }
     const p = join11(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync11(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -7759,8 +8044,8 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve3(cwd, "node_modules");
-  if (existsSync9(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
+  const nm = resolve4(cwd, "node_modules");
+  if (existsSync10(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8095,8 +8380,8 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync3 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -8113,7 +8398,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync2(cwd);
+    real = realpathSync3(cwd);
   } catch {
     return out2;
   }
@@ -8128,7 +8413,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     if (n === process.pid) continue;
     let held;
     try {
-      held = realpathSync2(`/proc/${pid}/cwd`);
+      held = realpathSync3(`/proc/${pid}/cwd`);
     } catch {
       continue;
     }
@@ -8143,7 +8428,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve4(opts.cwd ?? process.cwd());
+  const cwd = resolve5(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;