tamperward 2.8.0 → 2.9.0

package/dist/cli/index.js

@@ -1450,8 +1450,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve5) {
-  const obj = resolve5(expr);
+function metricsOf(expr, resolve6) {
+  const obj = resolve6(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1465,7 +1465,7 @@ function metricsOf(expr, resolve5) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve5(p.initializer));
+    const n = numericOf(resolve6(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1511,17 +1511,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve5(node.initializer);
+          const init = resolve6(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve5);
+            const flat = metricsOf(init, resolve6);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1535,7 +1535,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve5);
+              const m = metricsOf(p.initializer, resolve6);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1568,18 +1568,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -2660,12 +2660,13 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { isAbsolute, join as join3, relative } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join3, relative } from "node:path";
 
 // src/wiring.ts
-import { readFileSync } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { readFileSync, realpathSync as realpathSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join as join2, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
@@ -2689,7 +2690,7 @@ var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
 var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
 var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
 var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
-var PLAIN_SEMVER = /^\d+\.\d+\.\d+$/;
+var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
   const pa = a.split(".").map(Number);
@@ -2707,8 +2708,41 @@ function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
 }
+function homeDir(env = process.env) {
+  const h = (env.HOME ?? env.USERPROFILE ?? "").trim() || homedir();
+  return h.replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+}
+function claudeConfigDir(env = process.env) {
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir || `${homeDir(env)}/.claude`;
+}
 var CLAUDE_SETTINGS = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|managed-settings\.json)$/;
-var isClaudeSettings = (path) => CLAUDE_SETTINGS.test(path);
+function isClaudeSettings(path, env = process.env) {
+  const p = path.replace(/\\/g, "/");
+  if (CLAUDE_SETTINGS.test(p)) return true;
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir !== "" && (p === `${dir}/settings.json` || p === `${dir}/settings.local.json`);
+}
+function canonicalPath(path) {
+  const tail = [];
+  let cur = path;
+  for (let i = 0; i < 256; i++) {
+    try {
+      const real = realpathSync2(cur).replace(/\\/g, "/");
+      return tail.length ? posix.join(real, ...tail.reverse()) : real;
+    } catch {
+    }
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    tail.push(basename(cur));
+    cur = parent;
+  }
+  return path;
+}
+function resolvesToClaudeSettings(path, env = process.env) {
+  if (isClaudeSettings(path, env)) return true;
+  return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
+}
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
@@ -2835,6 +2869,8 @@ function policyAddWeakening(after) {
 }
 
 // src/detectors/hook-wiring.ts
+import { existsSync } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 function stripComment(line) {
   let single = false;
@@ -3825,7 +3861,8 @@ var WRAPPERS = /^(?:sudo|command|exec|time|nice|env|[A-Za-z_][A-Za-z0-9_]*=\S*)$
 var INTERPRETERS = /* @__PURE__ */ new Set(["python", "python2", "python3", "node", "perl", "ruby", "php", "deno", "bun"]);
 var INLINE_FLAG = /^-(?:c|e|r|E|p|pe|pi|i|ne|ni|le)$|^--eval$|^--print$|^--exec$/;
 var EDITORS = /* @__PURE__ */ new Set(["ex", "ed", "vim", "vi", "nvim"]);
-var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
+var SCRIPT_WORD = /[\w.~/$%{}\\-]+/g;
+var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", "managed-settings.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
 function nameGlob(pattern) {
   const re = new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
   return (n) => re.test(n);
@@ -3864,24 +3901,56 @@ function destinations(cmd, args, isDir) {
   return [dest];
 }
 var REDIRECT_TARGET = /(?:^|\s)(?:\d*>{1,2}\|?|&>{1,2})\s*(\S+)/g;
+function expandShellPath(t, env = process.env) {
+  const home = homeDir(env);
+  return t.replace(/\\/g, "/").replace(/^~(?=\/|$)/, home).replace(/\$(?:\{HOME\}|HOME\b|ENV\{HOME\})/g, home).replace(/%USERPROFILE%/gi, home).replace(/\$(?:\{CLAUDE_CONFIG_DIR\}|CLAUDE_CONFIG_DIR\b)/g, claudeConfigDir(env));
+}
 function hookTests(policy, ctx) {
+  const cwd = ctx?.cwd;
+  const onDisk = cwd !== void 0 && existsSync(cwd);
+  const root = onDisk ? canonicalPath(cwd) : cwd;
+  const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
-    let p = t.replace(/^["']|["']$/g, "");
-    if (ctx?.cwd && p.startsWith(ctx.cwd + "/")) p = p.slice(ctx.cwd.length + 1);
-    return p.replace(/^\.\/(?=.)/, "");
+    const hit = memo.get(t);
+    if (hit !== void 0) return hit;
+    let p = expandShellPath(t.replace(/^["']|["']$/g, ""));
+    const pathy = isAbsolute2(p) || p.includes("/") && !/^[-:]/.test(p);
+    if (pathy && (isAbsolute2(p) || onDisk)) {
+      p = canonicalPath(isAbsolute2(p) ? p : resolve(cwd, p));
+      if (root !== void 0) {
+        if (p === root) p = ".";
+        else if (p.startsWith(root + "/")) p = p.slice(root.length + 1);
+      }
+    }
+    if (cwd !== void 0 && p.startsWith(cwd + "/")) p = p.slice(cwd.length + 1);
+    p = p.replace(/^\.\/(?=.)/, "");
+    memo.set(t, p);
+    return p;
+  };
+  const hook = (t) => {
+    const p = rel(t);
+    return isProtected(p, policy, "hooks") || isClaudeSettings(p) || isClaudeSettings(expandShellPath(t.replace(/^["']|["']$/g, "")));
   };
-  const hook = (t) => isProtected(rel(t), policy, "hooks");
-  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || ctx?.cwd !== void 0 && rel(t) === ctx.cwd;
-  const holds = (t) => !t.startsWith("-") && (whole(t) || containsProtected(rel(t), policy, "hooks", ctx));
+  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || cwd !== void 0 && rel(t) === cwd;
+  const userSettings = `${claudeConfigDir()}/settings.json`;
+  const userSettingsUnder = (t) => {
+    const dir = rel(t).replace(/\/+$/, "");
+    return dir !== "" && dir !== "/" && userSettings.startsWith(dir + "/") ? userSettings : null;
+  };
+  const holds = (t) => !t.startsWith("-") && (whole(t) || userSettingsUnder(t) !== null || containsProtected(rel(t), policy, "hooks", ctx));
   const hookish = (t) => hook(t) || holds(t);
-  return { rel, hook, whole, holds, hookish };
+  return { rel, hook, whole, holds, hookish, userSettingsUnder };
 }
 function shellHookTarget(seg, toks, policy, ctx) {
-  const { rel, hook, whole, holds } = hookTests(policy, ctx);
+  const { rel, hook, whole, holds, userSettingsUnder } = hookTests(policy, ctx);
   for (const m of seg.matchAll(REDIRECT_TARGET)) {
     if (hook(m[1])) return rel(m[1]);
   }
   const args = toks.map((t) => t.replace(/^(?:of=|--(?:include|exclude|directory)=)/, ""));
+  for (let i = 1; i < args.length; i++) {
+    if (!INLINE_FLAG.test(args[i - 1])) continue;
+    for (const word of args[i].match(SCRIPT_WORD) ?? []) if (hook(word)) return rel(word);
+  }
   const fileLike = (p) => {
     const b = p.replace(/\/+$/, "").split("/").pop() ?? "";
     return HOOK_BASENAMES.includes(b) || /\.[A-Za-z0-9]+$/.test(b.replace(/^\.+/, "")) || (trackedFiles(ctx)?.includes(p) ?? false);
@@ -3889,6 +3958,8 @@ function shellHookTarget(seg, toks, policy, ctx) {
   for (const t of args) if (hook(t) && fileLike(rel(t))) return rel(t);
   for (const t of args) {
     if (t.startsWith("-") || !holds(t)) continue;
+    const user = userSettingsUnder(t);
+    if (user !== null) return user;
     const dir = rel(t).replace(/\/+$/, "");
     const under = whole(t) ? "" : dir + "/";
     const listed = trackedFiles(ctx)?.find((f) => f.startsWith(under) && isProtected(f, policy, "hooks"));
@@ -3912,7 +3983,7 @@ function shellWritesHook(seg, toks, policy, ctx) {
   const anyHook = args.some(hook);
   const inPlace = args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a));
   const scripts = args.filter((_, i) => i > 0 && INLINE_FLAG.test(args[i - 1]));
-  const namesHookInText = () => scripts.some((a) => (a.match(/[\w.~/-]+/g) ?? []).some(hook));
+  const namesHookInText = () => scripts.some((a) => (a.match(SCRIPT_WORD) ?? []).some(hook));
   switch (cmd) {
     case "rm":
     case "unlink":
@@ -3996,8 +4067,8 @@ function shellWritesHook(seg, toks, policy, ctx) {
 function xargsWritesHook(toks, fed, policy, ctx) {
   const at = toks.findIndex((t) => t === "xargs" || t.endsWith("/xargs"));
   if (at === -1) return null;
-  const rel = (t) => (ctx?.cwd && t.startsWith(ctx.cwd + "/") ? t.slice(ctx.cwd.length + 1) : t).replace(/^\.\//, "");
-  const fedHook = fed.some((t) => isProtected(rel(t), policy, "hooks") || !t.startsWith("-") && containsProtected(rel(t), policy, "hooks", ctx));
+  const { hookish } = hookTests(policy, ctx);
+  const fedHook = fed.some(hookish);
   if (!fedHook) return null;
   let i = at + 1;
   while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
@@ -4029,11 +4100,23 @@ function eventEntries(s, event) {
   return Array.isArray(arr) ? arr : null;
 }
 var declares = (s, event) => eventEntries(s, event) !== null;
-var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout"]);
+var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout", "statusMessage"]);
+var HOOK_TYPES = /* @__PURE__ */ new Set(["command", "prompt", "agent", "http"]);
+var SIBLING_KEYS = GATE_KEYS;
 var CANONICAL_CMD = /^npx --yes tamperward@(\S+) (hook|sweep) claude$/;
 var MENTIONS_GATE = /\btamperward\b.*\b(?:hook|sweep)\b/;
 var FORGERY = /hookSpecificOutput|permissionDecision|updatedInput|"decision"|"continue"/;
-var SENSITIVE_ENV = /^(?:PATH|NODE_OPTIONS|NODE_PATH|HOME|npm_config_.*|NPM_CONFIG_.*)$/;
+var ENV_MECHANISM = [
+  [/^PATH$/, "the gate's launcher is looked up through it"],
+  [/^(?:NODE_OPTIONS|NODE_PATH)$/, "node loads what it names before the gate runs"],
+  [/^HOME$/, "npx's cache and configuration live under it"],
+  [/^npm_config_/i, "npx reads it as npm configuration, the registry the gate is fetched from included"],
+  [/^(?:BASH_ENV|ENV)$/, "a non-interactive shell sources it before every hook command"],
+  [/^BASH_FUNC_/, "bash imports it as a function that shadows the command it names"],
+  [/^(?:LD|DYLD)_/, "the dynamic loader injects it into every process, the gate included"],
+  [/^TAMPERWARD_/, "it configures the gate itself"]
+];
+var envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
 function analyseGateCommand(cmd, event) {
   const want = event === "PreToolUse" ? "hook" : "sweep";
   const problems = [];
@@ -4092,7 +4175,7 @@ function matcherSelection(m) {
   if (m === "" || m === "*") return { tools: null, problem: null };
   let problem = null;
   if (/[^\x00-\x7f]/.test(m)) problem = "the matcher contains non-ASCII characters that look like tool names but are not";
-  if (/^[A-Za-z0-9_ |-]+$/.test(m)) return { tools: new Set(m.split("|").map((t) => t.trim()).filter(Boolean)), problem };
+  if (/^[A-Za-z0-9_ ,|-]+$/.test(m)) return { tools: new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean)), problem };
   let re;
   try {
     re = new RegExp(m);
@@ -4101,48 +4184,58 @@ function matcherSelection(m) {
   }
   return { tools: new Set(PRE_TOOLS.filter((t) => re.test(t))), problem };
 }
+function entryShape(h) {
+  const problems = [];
+  let runs = true;
+  if (h.type !== "command") {
+    problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
+    if (h.type !== void 0) runs = false;
+  }
+  for (const k of Object.keys(h)) {
+    if (GATE_KEYS.has(k)) continue;
+    problems.push(`carries \`${k}\``);
+    runs = false;
+  }
+  if ("timeout" in h) {
+    const t = h.timeout;
+    if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
+      problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
+      runs = false;
+    }
+  }
+  if ("statusMessage" in h && typeof h.statusMessage !== "string") {
+    problems.push(`\`statusMessage\` ${JSON.stringify(h.statusMessage)} is not a string`);
+    runs = false;
+  }
+  return { problems, runs };
+}
+var mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
 function gateCandidates(s, event) {
   const out2 = [];
-  const mentions = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
   for (const group of eventEntries(s, event) ?? []) {
     if (!isObj(group)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
       continue;
     }
     if (!Array.isArray(group.hooks)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
       continue;
     }
     for (const h of group.hooks) {
       if (!isObj(h)) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
         continue;
       }
       const cmd = typeof h.command === "string" ? h.command : null;
       if (cmd === null) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
         continue;
       }
       if (!MENTIONS_GATE.test(cmd)) continue;
       const a = analyseGateCommand(cmd, event);
-      const problems = [...a.problems];
-      let runs = a.runs;
-      if (h.type !== "command") {
-        problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
-        if (h.type !== void 0) runs = false;
-      }
-      for (const k of Object.keys(h)) {
-        if (GATE_KEYS.has(k)) continue;
-        problems.push(`carries \`${k}\``);
-        runs = false;
-      }
-      if ("timeout" in h) {
-        const t = h.timeout;
-        if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
-          problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
-          runs = false;
-        }
-      }
+      const shape = entryShape(h);
+      const problems = [...a.problems, ...shape.problems];
+      let runs = a.runs && shape.runs;
       let tools = null;
       if (event === "PreToolUse") {
         const sel = matcherSelection(group.matcher);
@@ -4159,6 +4252,7 @@ function gateCandidates(s, event) {
   }
   return out2;
 }
+var carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
 function otherCommands(s, event) {
   const out2 = [];
   for (const group of eventEntries(s, event) ?? []) {
@@ -4170,6 +4264,35 @@ function otherCommands(s, event) {
   }
   return out2;
 }
+function allEntries(s) {
+  const hooks = s.hooks;
+  if (!isObj(hooks)) return [];
+  const out2 = [];
+  for (const [event, arr] of Object.entries(hooks)) {
+    if (!Array.isArray(arr)) continue;
+    for (const group of arr) {
+      if (!isObj(group) || !Array.isArray(group.hooks)) continue;
+      for (const h of group.hooks) out2.push({ event, key: JSON.stringify({ e: event, m: group.matcher, h }), group, h });
+    }
+  }
+  return out2;
+}
+function schemaProblem(group, h) {
+  if (group.matcher !== void 0 && typeof group.matcher !== "string") return `the matcher ${JSON.stringify(group.matcher)} is not a string`;
+  if (!isObj(h)) return `the hook entry ${JSON.stringify(h)} is not an object`;
+  if (typeof h.type !== "string" || !HOOK_TYPES.has(h.type)) return `\`type\` ${JSON.stringify(h.type)} is not one the runtime accepts`;
+  if (h.type === "command" && typeof h.command !== "string") return "`command` is not a string";
+  if ("timeout" in h && (typeof h.timeout !== "number" || !Number.isFinite(h.timeout) || h.timeout <= 0)) return `\`timeout\` ${JSON.stringify(h.timeout)} is not a positive number`;
+  return null;
+}
+function siblingProblem(h) {
+  const cmd = typeof h.command === "string" ? h.command : "";
+  if (FORGERY.test(cmd)) return `emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`;
+  if (h.type !== "command") return `is not a plain command entry (\`type\` is ${JSON.stringify(h.type)})`;
+  const extra = Object.keys(h).filter((k) => !SIBLING_KEYS.has(k));
+  if (extra.length) return `is not a plain command entry (carries \`${extra.join("`, `")}\`)`;
+  return `was added (\`${cmd.slice(0, 60)}\`) \u2014 its output combines with the gate's verdict (an \`updatedInput\` after an allow, a \`continue: false\` over a block), and init writes no entry beside the gate`;
+}
 function coverage(cs) {
   const live = cs.filter((c) => c.runs);
   if (live.length === 0) return "none";
@@ -4220,16 +4343,26 @@ function duplicateJsonKeys(src) {
 }
 function settingsWeakening(before, after, local) {
   const reasons = [];
+  const gated = carriesGate(after);
+  const gatedBefore = before !== null && carriesGate(before);
   const dis = after.disableAllHooks;
   if (dis !== void 0 && dis !== false && !(before !== null && before.disableAllHooks === dis)) {
     reasons.push(`\`disableAllHooks: ${JSON.stringify(dis)}\` switches every hook off, the gate included`);
   }
+  if (gated && dis === void 0) {
+    if (before !== null && before.disableAllHooks === false) {
+      reasons.push("`disableAllHooks: false` was removed \u2014 init declares it so that a `true` in the user settings file cannot switch the gate off");
+    } else if (!gatedBefore) {
+      reasons.push("`disableAllHooks: false` is not declared \u2014 init declares it in the file it writes, so that a `true` in the user settings file cannot switch the gate off");
+    }
+  }
   if (isObj(after.env)) {
     const was = before !== null && isObj(before.env) ? before.env : {};
     for (const [k, v] of Object.entries(after.env)) {
-      if (SENSITIVE_ENV.test(k) && JSON.stringify(was[k]) !== JSON.stringify(v)) {
-        reasons.push(`a top-level \`env\` sets ${k} \u2014 the gate command resolves through it`);
-      }
+      if (k in was && JSON.stringify(was[k]) === JSON.stringify(v)) continue;
+      const how = envMechanism(k);
+      if (how) reasons.push(`a top-level \`env\` sets ${k} \u2014 ${how}`);
+      else if (gated) reasons.push(`a top-level \`env\` sets ${k} \u2014 every hook command runs with it, and init writes no \`env\``);
     }
   }
   for (const event of EVENTS) {
@@ -4257,15 +4390,36 @@ function settingsWeakening(before, after, local) {
       if (c.problems.length) reasons.push(`the ${event} gate entry does not match the shape \`tamperward init\` writes: ${c.problems.join("; ")}`);
     }
     const pins = bc.map((c) => c.pin).filter((p) => !!p && PLAIN_SEMVER.test(p)).sort((a, b) => compareVersions(b, a) ?? 0);
-    const floor = pins[0] ?? (before === null && PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null);
-    if (floor) {
-      for (const c of fresh) {
-        if (c.pin && PLAIN_SEMVER.test(c.pin) && !pinNotBelow(c.pin, floor)) reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`);
+    const judging = PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null;
+    const floor = pins[0] ?? (bc.length === 0 ? judging : null);
+    for (const c of fresh) {
+      if (c.pin === null || c.pin !== "" && !PLAIN_SEMVER.test(c.pin)) continue;
+      if (floor !== null && !pinNotBelow(c.pin, floor)) {
+        reasons.push(
+          c.pin === "" ? `the ${event} gate is unpinned, below ${floor} \u2014 \`npx\` then runs whatever \`tamperward\` resolves to on this machine` : `the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`
+        );
+      } else if (judging !== null && c.pin !== "" && (compareVersions(c.pin, judging) ?? 0) > 0) {
+        reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, above the ${judging} judging it \u2014 a pin npm cannot resolve fails the hook open; raise it by running \`tamperward init\` from the newer version, which raises the judging gate with it`);
+      }
+    }
+  }
+  if (gated) {
+    const had = new Set(before !== null ? allEntries(before).map((e) => e.key) : []);
+    for (const e of allEntries(after)) {
+      if (had.has(e.key) || mentionsGate(e.h)) continue;
+      const schema = schemaProblem(e.group, e.h);
+      if (schema) {
+        reasons.push(`a ${e.event} hook entry carries a value the runtime's schema rejects (${schema}) \u2014 the runtime continues without the broken file, the gate included`);
+      } else if (e.event === "PreToolUse" || e.event === "Stop") {
+        reasons.push(`a ${e.event} hook entry beside the gate ${siblingProblem(e.h)}`);
       }
     }
-    const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
-    for (const cmd of otherCommands(after, event)) {
-      if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+  } else {
+    for (const event of EVENTS) {
+      const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
+      for (const cmd of otherCommands(after, event)) {
+        if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+      }
     }
   }
   return reasons;
@@ -4278,7 +4432,7 @@ function claudeSettingsFindings(c, policy) {
     file: c.path,
     message: `The Claude Code hook wiring was weakened: ${reason}.`,
     evidence: reason,
-    remediation: "Leave the PreToolUse and Stop entries that run tamperward, and the matcher that covers every editing tool, exactly as `tamperward init` wrote them. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
+    remediation: "Leave the PreToolUse and Stop entries that run tamperward, the matcher that covers every editing tool, and `disableAllHooks: false` exactly as `tamperward init` wrote them, with no `env` and no hook entry beside the gate. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
   });
   if (c.before != null && before === null) return null;
   if (after === null) {
@@ -4321,7 +4475,7 @@ function lefthookBase(c, changes, ctx) {
   for (const n of names) {
     try {
       const p = join3(ctx.cwd, n);
-      if (existsSync(p)) return parseDoc(readFileSync2(p, "utf8"));
+      if (existsSync2(p)) return parseDoc(readFileSync2(p, "utf8"));
     } catch {
     }
   }
@@ -4391,9 +4545,9 @@ function updateIndexHiding(toks, policy) {
   return null;
 }
 function repoRelative(path, ctx) {
-  if (!ctx?.cwd || !isAbsolute(path)) return path;
+  if (!ctx?.cwd || !isAbsolute3(path)) return path;
   const rel = relative(ctx.cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
 var hookTampering = {
@@ -4405,7 +4559,7 @@ var hookTampering = {
     for (const c of changes) {
       let semantic;
       if (c.kind === "file") {
-        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || isClaudeSettings(c.path);
+        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || resolvesToClaudeSettings(c.path);
         if (!targetsHook) {
           if (isPackageJson(c.path) && c.before != null && c.after != null) {
             for (const reason of packageJsonWeakening(c.before, c.after)) {
@@ -4449,7 +4603,7 @@ var hookTampering = {
               remediation: "Renaming a hook out of place disables it. Restore the original path."
             })
           );
-        } else if ((c.path.endsWith(POLICY_FILE) || isClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
+        } else if ((c.path.endsWith(POLICY_FILE) || resolvesToClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
           out2.push(...semantic);
         } else if (c.op === "rename") {
         } else if (isCodeowners(c.path)) {
@@ -4589,10 +4743,12 @@ var hookTampering = {
           const why = shellWritesHook(seg, toks, policy, ctx) ?? xargsWritesHook(toks, fed, policy, ctx);
           if (why) {
             const target = shellHookTarget(seg, toks, policy, ctx) ?? shellHookTarget("", fed, policy, ctx);
+            const file = target ? repoRelative(target, ctx) : void 0;
+            const outside = file !== void 0 && (isAbsolute3(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
             out2.push(
               makeFinding(RULE6, policy, {
-                ...target ? { file: repoRelative(target, ctx) } : {},
-                message: `Hook tampering via shell: ${why}.`,
+                ...file !== void 0 ? { file } : {},
+                message: `Hook tampering via shell: ${why}${outside}.`,
                 evidence: seg,
                 remediation: "Leave the hooks in place. Mutating them from the shell is still tampering."
               })
@@ -5497,7 +5653,7 @@ var GUARDED_RULE = "hook-tampering";
 var BASELINE_HOOKS = defaultPolicy().protected.hooks;
 function isGuardedFinding(f) {
   if (f.rule !== GUARDED_RULE || !f.file) return false;
-  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || isClaudeSettings(f.file);
+  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || resolvesToClaudeSettings(f.file);
 }
 function key(f) {
   return `${f.rule}|${f.file ?? ""}|${f.line ?? ""}|${f.evidence}`;
@@ -5556,8 +5712,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join4, posix } from "node:path";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join4, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -5574,8 +5730,8 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute2(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
-  const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
+  if (!ledger.trim() || isAbsolute4(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
 function validate(r, where) {
@@ -5682,7 +5838,7 @@ function parseOrThrow(src, where) {
 }
 function loadPolicy(cwd = process.cwd()) {
   const path = join4(cwd, POLICY_FILE);
-  if (!existsSync2(path)) return defaultPolicy();
+  if (!existsSync3(path)) return defaultPolicy();
   return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
@@ -5693,7 +5849,7 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
@@ -5709,7 +5865,7 @@ function ledgerPath(cwd, policy) {
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync3(p)) return [];
+  if (!existsSync4(p)) return [];
   const out2 = [];
   for (const line of readFileSync4(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
@@ -6081,14 +6237,14 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve } from "node:path";
+import { isAbsolute as isAbsolute5, join as join6, relative as relative2, resolve as resolve2 } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
@@ -6096,11 +6252,11 @@ function readDisk(path) {
   return textOf(inspectResolved(path));
 }
 function abs(path, cwd) {
-  return resolve(cwd, path);
+  return resolve2(cwd, path);
 }
 function relForDisplay(path, cwd) {
   const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -6202,7 +6358,7 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join7 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
@@ -6216,7 +6372,7 @@ function turnBaseline(cwd, sessionId) {
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       const v = readFileSync5(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
@@ -6243,8 +6399,8 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join8 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join8 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -6256,7 +6412,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute4(d) ? d : join8(cwd, d);
+    return isAbsolute6(d) ? d : join8(cwd, d);
   } catch {
     return null;
   }
@@ -6335,7 +6491,7 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync5(p)) return null;
+  if (!p || !existsSync6(p)) return null;
   try {
     return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
@@ -6793,9 +6949,9 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync6(log)) return none;
+  if (!existsSync7(log)) return none;
   let offset = 0;
-  if (cp && existsSync6(cp)) {
+  if (cp && existsSync7(cp)) {
     const n = Number(readFileSync9(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
@@ -6949,8 +7105,8 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute5, join as join10, relative as relative3, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join10, relative as relative3, resolve as resolve3 } from "node:path";
 var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
@@ -7103,7 +7259,7 @@ function readWorkflowMark(src) {
 function toolSet(matcher) {
   const m = String(matcher ?? "").trim();
   if (m === "" || m === "*") return null;
-  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+  return new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean));
 }
 function missingTools(matcher) {
   const have = toolSet(matcher);
@@ -7127,7 +7283,7 @@ function hooksShapeError(hooks) {
 }
 function planPolicy(cwd) {
   const path = join10(cwd, POLICY_FILE);
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
@@ -7147,7 +7303,7 @@ function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
   const path = join10(cwd, rel);
   let settings = {};
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     let parsed;
     try {
       parsed = JSON.parse(readFileSync10(path, "utf8"));
@@ -7176,7 +7332,8 @@ function planClaudeHooks(cwd) {
   const needStop = stopEntries.length === 0;
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
   const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
-  if (!needPre && !needStop && stale.length === 0 && repin.length === 0) {
+  const needDisableFalse = settings.disableAllHooks !== false;
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0 && !needDisableFalse) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
@@ -7184,12 +7341,13 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync7(path) ? "update" : "create",
+    status: existsSync8(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
       repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
-      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`
+      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`,
+      needDisableFalse && (settings.disableAllHooks === void 0 ? "declare disableAllHooks: false so the user settings file cannot switch the hooks off" : `set disableAllHooks: false (was ${JSON.stringify(settings.disableAllHooks)})`)
     ].filter(Boolean).join(" + "),
     apply: () => {
       for (const h of repin) {
@@ -7208,6 +7366,7 @@ function planClaudeHooks(cwd) {
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
+      if (needDisableFalse) settings.disableAllHooks = false;
       mkdirSync5(dirname4(path), { recursive: true });
       writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n");
     }
@@ -7240,14 +7399,14 @@ var MANAGED_HOOKS = [
 function hooksDir(cwd) {
   try {
     const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (out2) return resolve2(cwd, out2);
+    if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync7(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
+  return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -7270,17 +7429,17 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync7(join10(cwd, ".husky"))) {
+  if (existsSync8(join10(cwd, ".husky"))) {
     path = join10(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join10(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join10(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
-    if (basename(dir) === "_" && basename(dirname4(dir)) === ".husky") {
+    if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
       path = join10(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
@@ -7290,10 +7449,10 @@ function planPreCommit(cwd) {
     }
   }
   const rel = display(cwd, path);
-  if (existsSync7(path) && !statSync3(path).isFile()) {
+  if (existsSync8(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync10(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7382,7 +7541,7 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync7(join10(cwd, r))
+    (r) => existsSync8(join10(cwd, r))
   );
   const path = join10(cwd, existingRel ?? rel);
   const existing = existingRel ? readFileSync10(path, "utf8") : null;
@@ -7423,7 +7582,7 @@ function planWorkflow(cwd, force) {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync7(path)) {
+  if (!existsSync8(path)) {
     return {
       item: "ci",
       path: rel,
@@ -7533,15 +7692,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join13, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join13, resolve as resolve4 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -7554,7 +7713,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join11(cwd, d);
+    return isAbsolute8(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -7581,7 +7740,7 @@ function objectRewriteState(cwd) {
     }
     const p = join11(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync11(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -7759,8 +7918,8 @@ function materialize(cwd, dest) {
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve3(cwd, "node_modules");
-  if (existsSync9(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
+  const nm = resolve4(cwd, "node_modules");
+  if (existsSync10(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
@@ -8095,8 +8254,8 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync2 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync3 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -8113,7 +8272,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync2(cwd);
+    real = realpathSync3(cwd);
   } catch {
     return out2;
   }
@@ -8128,7 +8287,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     if (n === process.pid) continue;
     let held;
     try {
-      held = realpathSync2(`/proc/${pid}/cwd`);
+      held = realpathSync3(`/proc/${pid}/cwd`);
     } catch {
       continue;
     }
@@ -8143,7 +8302,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve4(opts.cwd ?? process.cwd());
+  const cwd = resolve5(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",