tamperward 2.9.0 → 2.10.1

package/dist/cli/index.js

@@ -2703,7 +2703,7 @@ function pinNotBelow(now, floor) {
   const c = compareVersions(now, floor);
   return c !== null && c >= 0;
 }
-var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n?$/;
+var INIT_SCRIPT = /^#!\/bin\/sh\n# tamperward: block agent shortcuts before they land\nnpx --yes tamperward(?:@(\S+))? check --staged\n*$/;
 function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
@@ -2889,6 +2889,8 @@ var TOOL = /^(tamperward|jest|vitest|eslint|tsc|lint-staged|lefthook|husky|pytes
 var SCRIPT = /^(test|tests|lint|typecheck|type-check|coverage|check)\b/;
 var SUBCOMMAND_TOOLS = /* @__PURE__ */ new Set(["tamperward", "make", "cargo", "go", "lefthook", "husky", "pre-commit"]);
 var PREFIX = /^(?:(?:then|do|else|\{|\(|exec|command|time|nice|env|sudo|[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"(?=\s|$)|'[^']*'(?=\s|$)|[^\s"']\S*|(?=\s)))\s+)*/;
+var MODE = /\s(--staged|--worktree|--diff(?:[=\s]+[^\s-][^\s;)}|&]*)?)(?=[\s;)}|&]|$)/;
+var CWD = /\s--cwd(?:=|\s+)("[^"]*"|'[^']*'|\S+)/;
 function checkIdentity(segment) {
   const core = segment.trim().replace(PREFIX, "").replace(/\s+/g, " ");
   const viaRunner = RUNNER.test(core);
@@ -2899,8 +2901,10 @@ function checkIdentity(segment) {
   if (tool === "tamperward") {
     const sub = toks[1];
     if (!sub || sub.startsWith("-")) return null;
-    const cwd = rest.match(/\s--cwd(?:=|\s+)(\S+)/)?.[1];
-    return cwd ? `tamperward ${sub} --cwd ${cwd}` : `tamperward ${sub}`;
+    const mode = rest.match(MODE)?.[1].replace(/[=\s]+/, " ");
+    const cwd = rest.match(CWD)?.[1];
+    const away = cwd !== void 0 && !/rev-parse\s+--show-toplevel/.test(cwd) ? `--cwd ${cwd}` : void 0;
+    return ["tamperward", sub, mode, away].filter((x) => !!x).join(" ");
   }
   if (SUBCOMMAND_TOOLS.has(tool) && toks[1] && !toks[1].startsWith("-")) return `${tool} ${toks[1]}`;
   return tool;
@@ -2936,7 +2940,8 @@ function split(stmt) {
       continue;
     }
     if (depth > 0) continue;
-    const op = stmt.startsWith("&&", i) ? "&&" : stmt.startsWith("||", i) ? "||" : ch === ";" ? ";" : ch === "|" ? "|" : null;
+    const bg = ch === "&" && stmt[i + 1] !== "&" && stmt[i + 1] !== ">" && !/[<>]$/.test(stmt.slice(0, i));
+    const op = stmt.startsWith("&&", i) ? "&&" : stmt.startsWith("||", i) ? "||" : ch === ";" ? ";" : ch === "|" ? "|" : bg ? "&" : null;
     if (!op) continue;
     segs.push(stmt.slice(last, i));
     ops.push(op);
@@ -3165,7 +3170,10 @@ function prepare(lines, opts) {
   }
   return { top, fns, shadowed, pipefail, errexit };
 }
-var TRANSPARENT = /^(?:fi|done|esac|\}|\)|;;|then|do|else|exit\s+"?\$\??"?|exit\s+"?\$\{\?\}"?)\s*;?$/;
+var SENSITIVE_ENV = /^(?:PATH|NODE_OPTIONS|NODE_PATH|HOME|LD_PRELOAD|BASH_ENV|ENV|npm_config_\w*|NPM_CONFIG_\w*)$/;
+var assignedNames = (prefix) => [...prefix.matchAll(/(?:^|\s)([A-Za-z_]\w*)=(?:"[^"]*"|'[^']*'|[^\s"']\S*|(?=\s))/g)].map((m) => m[1]);
+var WAIT_PID = /^wait\s+"?\$!"?\s*;?$/;
+var TRANSPARENT = /^(?:fi|done|esac|\}|\)|;;|then|do|else|exit\s+"?\$\??"?|exit\s+"?\$\{\?\}"?|wait\s+"?\$!"?)\s*;?$/;
 function statusAfterFailure(seg, vars) {
   const inner = seg.trim().replace(/^[{(]\s*/, "").replace(/\s*[})]\s*;?\s*$/, "");
   let status = "fail";
@@ -3214,7 +3222,7 @@ function reaches(segs, ops, i) {
     if (!runs) continue;
     const s = constStatus(segs[j]);
     if (s === "unknown" && (ops[j] === "&&" || ops[j] === "||")) certain = false;
-    if (ops[j] === ";" || ops[j] === "|") {
+    if (ops[j] === ";" || ops[j] === "|" || ops[j] === "&") {
       status = "ok";
       certain = certain && true;
       continue;
@@ -3223,7 +3231,7 @@ function reaches(segs, ops, i) {
   }
   const gate = i === 0 ? true : ops[i - 1] === "&&" ? status !== "fail" : ops[i - 1] === "||" ? status !== "ok" : true;
   if (!gate) return "no";
-  if (i === 0 || ops[i - 1] === ";" || ops[i - 1] === "|") return "yes";
+  if (i === 0 || ops[i - 1] === ";" || ops[i - 1] === "|" || ops[i - 1] === "&") return "yes";
   if (!certain || status === "unknown") return "maybe";
   return "yes";
 }
@@ -3314,15 +3322,18 @@ function walk(lines, st, topIdx, depth) {
     }
     if (/^;;$/.test(stmt)) continue;
     if (/^[{}()]$/.test(stmt)) continue;
-    const bg = /(?<!&)&\s*$/.test(stmt) && !/&&\s*$/.test(stmt);
-    if (bg) stmt = stmt.replace(/\s*&\s*$/, "");
+    const bgLine = /(?<![&<>])&\s*$/.test(stmt) && !/&&\s*$/.test(stmt);
+    if (bgLine) stmt = stmt.replace(/\s*&\s*$/, "");
+    const bg = bgLine && !WAIT_PID.test(stripComment(lines[i + 1] ?? "").trim());
     const { segs, ops } = split(stmt);
     for (let s = 0; s < segs.length; s++) {
       let seg = segs[s].trim();
       const inverted = /^!\s+/.test(seg);
       seg = seg.replace(/^!\s+/, "");
       const execs = /^exec\s+/.test(seg) && !/^exec\s+(?:\d*[<>]|&>)/.test(seg);
+      const whole = seg;
       seg = seg.replace(PREFIX, "");
+      const prefix = whole.slice(0, whole.length - seg.length);
       const reach = dead() ? "no" : reaches(segs, ops, s);
       const first = seg.split(/\s+/)[0] ?? "";
       if (reach !== "no") {
@@ -3349,11 +3360,12 @@ function walk(lines, st, topIdx, depth) {
           const sigs = trap[4].split(/\s+/);
           if (sigs.some((x) => /^(?:EXIT|ERR|0|SIGERR)$/i.test(x)) && /(?:^|[;\s])(?:exit(?:\s+0+)?|true|:)\s*(?:;|$)/.test(action)) st.traps.push(idx);
         }
-        const asg = seg.match(/^(?:export\s+|readonly\s+)?([A-Za-z_]\w*)=(.*)$/);
+        const asg = seg.match(/^(?:export\s+|readonly\s+|declare\s+-\w+\s+|local\s+)?([A-Za-z_]\w*)=(.*)$/);
         if (asg) {
           const v = certain ? literal(asg[2], st.vars) : null;
           if (v === null) st.vars.delete(asg[1]);
           else st.vars.set(asg[1], v);
+          if (SENSITIVE_ENV.test(asg[1])) st.redirected = true;
         }
         if (first === "cd") {
           const home = cdStaysHome(seg.slice(2), st.vars);
@@ -3380,6 +3392,7 @@ function walk(lines, st, topIdx, depth) {
             st.errexit = sub.errexit;
             st.pipefail = sub.pipefail;
             st.cdAway = sub.cdAway;
+            st.redirected = sub.redirected;
             const verdict2 = chainVerdict(segs, ops, s, st, inverted, bg);
             for (let k = start; k < st.out.length; k++) {
               const inv = st.out[k];
@@ -3424,8 +3437,18 @@ function walk(lines, st, topIdx, depth) {
           state = "neutered";
           why = "runs from another directory after a `cd` away from the repository root";
         }
+        if (state === "live" && /^tamperward\b/.test(id)) {
+          const onGate = assignedNames(prefix).filter((n) => SENSITIVE_ENV.test(n));
+          if (onGate.length) {
+            state = "neutered";
+            why = `runtime redirected \u2014 \`${onGate[0]}=\` in front of it decides what the gate resolves to`;
+          } else if (st.redirected) {
+            state = "neutered";
+            why = "runtime redirected \u2014 PATH, NODE_OPTIONS or another variable the gate resolves through is set earlier in the script";
+          }
+        }
         if (state === "live") {
-          const words2 = [first, "tamperward"].filter((w) => w && st.shadowed.has(w));
+          const words2 = [...prefix.split(/\s+/), first, "tamperward"].filter((w) => w && st.shadowed.has(w));
           if (words2.length) {
             state = "neutered";
             why = `\`${words2[0]}\` is redefined by a function or alias in this script`;
@@ -3442,6 +3465,7 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
   if (inverted) return { state: "neutered", why: "its status is inverted by `!`", passthrough: false };
   if (bg) return { state: "neutered", why: "run in the background \u2014 the hook does not wait for its status", passthrough: false };
   let cur = "fail";
+  let waited = -1;
   for (let j = i; j < ops.length; j++) {
     const op = ops[j];
     const next = segs[j + 1];
@@ -3449,6 +3473,13 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
       if (!st.pipefail) return { state: "neutered", why: "piped into another command without `pipefail`", passthrough: false };
       continue;
     }
+    if (op === "&") {
+      if (WAIT_PID.test((next ?? "").trim())) {
+        waited = j + 1;
+        continue;
+      }
+      return { state: "neutered", why: "run in the background \u2014 a `wait` without its pid returns 0, and without `wait` the hook does not wait for its status", passthrough: false };
+    }
     if (cur === "exit") break;
     if (op === "||") {
       if (cur === "fail") cur = statusAfterFailure(next, st.vars);
@@ -3466,7 +3497,7 @@ function chainVerdict(segs, ops, i, st, inverted, bg) {
   }
   if (cur === "ok") return { state: "neutered", why: "the `||` chain after it ends in success", passthrough: false };
   if (cur === "exit") return { state: "live", passthrough: false };
-  return { state: "live", passthrough: i === ops.length || ops.slice(i).every((o) => o === "&&" || o === "||") };
+  return { state: "live", passthrough: i === ops.length || ops.slice(i).every((o, k) => o === "&&" || o === "||" || o === "&" && i + k + 1 === waited) };
 }
 function invocations(lines, opts = {}) {
   const prep = prepare(lines, opts);
@@ -3474,6 +3505,7 @@ function invocations(lines, opts = {}) {
     errexit: prep.errexit,
     pipefail: prep.pipefail,
     cdAway: false,
+    redirected: false,
     vars: /* @__PURE__ */ new Map(),
     fns: prep.fns,
     shadowed: prep.shadowed,
@@ -3507,6 +3539,27 @@ var strip = (inv) => {
   const { idx: _i, errexit: _e, passthrough: _p, ...rest } = inv;
   return rest;
 };
+var baseIdentity = (id) => id.replace(/\s--.*$/, "");
+function pinRaiseOnly(before, after) {
+  const mask = (src) => {
+    const pins = [];
+    const text = src.replace(/\n+$/, "").replace(/\btamperward(?:@(\d+\.\d+\.\d+))?(?=\s|$)/g, (_m, v) => {
+      pins.push(v ?? "");
+      return "tamperward@\0";
+    });
+    return { text, pins };
+  };
+  const b = mask(before);
+  const a = mask(after);
+  if (b.text !== a.text || b.pins.length !== a.pins.length) return false;
+  return a.pins.every((now, i) => {
+    const was = b.pins[i];
+    if (now === was) return true;
+    if (now === "") return false;
+    if (was !== "" && (compareVersions(now, was) ?? -1) < 0) return false;
+    return !PLAIN_SEMVER.test(TW_VERSION) || (compareVersions(now, TW_VERSION) ?? 1) <= 0;
+  });
+}
 function scriptWeakening(before, after, opts = {}) {
   const beforeInv = invocations(before, opts);
   const afterInv = invocations(after, opts);
@@ -3516,7 +3569,7 @@ function scriptWeakening(before, after, opts = {}) {
   const out2 = [];
   for (const id of bl) {
     if (al.has(id)) continue;
-    const trace = afterInv.find((i) => i.identity === id) ?? afterInv.find((i) => i.identity.split(" --cwd ")[0] === id.split(" --cwd ")[0]);
+    const trace = afterInv.find((i) => i.identity === id) ?? afterInv.find((i) => baseIdentity(i.identity) === baseIdentity(id));
     const how = trace?.state === "neutered" ? `neutralised in place (${trace.why ?? "its failure can no longer fail the hook"})` : trace?.state === "unreachable" ? `made unreachable (${trace.why ?? "behind an always-false guard or an early exit"})` : trace?.state === "comment" ? "commented out" : trace && trace.identity !== id ? `replaced by \`${trace.identity}\`` : "removed";
     const evidence = (trace?.line ?? before.find((l) => checkIdentity(stripComment(l).trim().replace(/^!\s+/, "").replace(PREFIX, "")) === id) ?? id).trim();
     out2.push({ reason: `the check invocation \`${id}\` was ${how}`, evidence });
@@ -3524,8 +3577,9 @@ function scriptWeakening(before, after, opts = {}) {
   const floor = beforeInv.filter((i) => i.state === "live" && i.pin && PLAIN_SEMVER.test(i.pin)).map((i) => i.pin).sort((a, b) => compareVersions(a, b) ?? 0)[0];
   if (floor) {
     for (const inv of afterInv) {
-      if (inv.state !== "live" || !inv.pin || !PLAIN_SEMVER.test(inv.pin)) continue;
-      if ((compareVersions(inv.pin, floor) ?? 0) < 0) out2.push({ reason: `the gate's pin was lowered from ${floor} to ${inv.pin}`, evidence: inv.line.trim() });
+      if (inv.state !== "live" || !inv.pin) continue;
+      if (!PLAIN_SEMVER.test(inv.pin)) out2.push({ reason: `the gate's pin was changed from ${floor} to \`${inv.pin}\`, which is not a plain version \u2014 a range, tag or pre-release resolves to whatever the registry serves`, evidence: inv.line.trim() });
+      else if ((compareVersions(inv.pin, floor) ?? 0) < 0) out2.push({ reason: `the gate's pin was lowered from ${floor} to ${inv.pin}`, evidence: inv.line.trim() });
     }
   }
   return out2;
@@ -3631,8 +3685,22 @@ var isPackageJson = (path) => /(?:^|\/)package\.json$/.test(path);
 var GATE = /\btamperward\b/;
 var str = (v) => typeof v === "string" ? v : Array.isArray(v) ? v.map(String).join(" ") : v == null ? "" : JSON.stringify(v);
 var list = (v) => Array.isArray(v) ? v.map(String) : typeof v === "string" ? v.split(/[\s,]+/).filter(Boolean) : [];
-function runsGate(command) {
-  return invocations([command], { errexit: true }).some((i) => i.state === "live" && /^tamperward check\b/.test(i.identity));
+function gateOf(command) {
+  const live = invocations([command], { errexit: true }).find((i) => i.state === "live" && /^tamperward check\b/.test(i.identity));
+  return live ? { identity: live.identity, pin: live.pin ?? "" } : null;
+}
+var redirectingEnv = (env) => isDoc(env) ? Object.keys(env).filter((k) => SENSITIVE_ENV.test(k)).sort().map((k) => `${k}=${str(env[k])}`) : [];
+function gateDrift(what, was, now) {
+  const out2 = [];
+  if (was.gate && now.gate) {
+    if (now.gate.identity !== was.gate.identity) out2.push(`${what} now runs \`${now.gate.identity}\` instead of \`${was.gate.identity}\` \u2014 another check`);
+    if (PLAIN_SEMVER.test(was.gate.pin) && now.gate.pin) {
+      if (!PLAIN_SEMVER.test(now.gate.pin)) out2.push(`${what} pins the gate to \`${now.gate.pin}\`, which is not a plain version (was ${was.gate.pin}) \u2014 a range, tag or pre-release resolves to whatever the registry serves`);
+      else if ((compareVersions(now.gate.pin, was.gate.pin) ?? 0) < 0) out2.push(`${what} lowered the gate's pin from ${was.gate.pin} to ${now.gate.pin}`);
+    }
+  }
+  if (now.env.length && now.env.join(",") !== was.env.join(",")) out2.push(`${what} sets ${now.env.map((e) => e.split("=")[0]).join(", ")} in its \`env\` \u2014 the gate's runtime is redirected`);
+  return out2;
 }
 function mergeDocs(base, over) {
   const out2 = { ...base };
@@ -3657,8 +3725,11 @@ function lefthookEntries(doc) {
         const named = GATE.test(name);
         if (!GATE.test(str(run)) && !named) continue;
         const tags = list(cfg.tags);
+        const gate = run === void 0 ? named ? { identity: "tamperward check --staged", pin: "" } : null : gateOf(str(run));
         out2.set(`${section}.${group}.${name}`, {
-          live: run === void 0 ? named : runsGate(str(run)),
+          live: gate !== null,
+          gate,
+          env: redirectingEnv(cfg.env),
           skip: cfg.skip,
           only: cfg.only,
           sectionSkip: v.skip,
@@ -3684,6 +3755,7 @@ function lefthookWeakening(before, after) {
       continue;
     }
     if (!now.live) out2.push(`lefthook entry ${key2} no longer runs \`tamperward check\` live`);
+    out2.push(...gateDrift(`lefthook entry ${key2} (the gate)`, was, now));
     if (!off(now.skip) && off(was.skip)) out2.push(`lefthook entry ${key2} (the gate) is now \`skip: ${str(now.skip)}\``);
     if (!off(now.sectionSkip) && off(was.sectionSkip)) out2.push(`the lefthook hook carrying ${key2} (the gate) is now \`skip: ${str(now.sectionSkip)}\``);
     if (!off(now.only) && str(now.only) !== str(was.only)) out2.push(`lefthook entry ${key2} (the gate) gained or changed \`only\` (${str(now.only)})`);
@@ -3708,9 +3780,12 @@ function preCommitEntries(doc) {
     for (const h of hooks) {
       if (!isDoc(h)) continue;
       if (!GATE.test(`${str(repo.repo)} ${str(h.id)} ${str(h.entry)} ${str(h.name)}`)) continue;
-      const live = h.entry !== void 0 ? runsGate(str(h.entry)) : GATE.test(`${str(repo.repo)} ${str(h.id)}`);
+      const gate = h.entry !== void 0 ? gateOf(`${str(h.entry)} ${list(h.args).join(" ")}`.trim()) : GATE.test(`${str(repo.repo)} ${str(h.id)}`) ? { identity: "tamperward check --staged", pin: "" } : null;
       out2.set(`${str(repo.repo)}:${str(h.id)}`, {
-        live,
+        live: gate !== null,
+        gate,
+        env: redirectingEnv(h.env),
+        deps: str(h.additional_dependencies),
         stages: Array.isArray(h.stages) ? h.stages.map(String).map(normStage) : defaults,
         explicitStages: Array.isArray(h.stages),
         exclude: str(h.exclude),
@@ -3734,6 +3809,8 @@ function preCommitWeakening(before, after) {
       continue;
     }
     if (!now.live) out2.push(`pre-commit hook ${key2} no longer runs \`tamperward check\` live`);
+    out2.push(...gateDrift(`pre-commit hook ${key2} (the gate)`, was, now));
+    if (now.deps && now.deps !== was.deps) out2.push(`pre-commit hook ${key2} (the gate) gained or changed \`additional_dependencies\` (${now.deps}) \u2014 they choose which gate the hook installs`);
     const lost = was.stages.filter((s) => GATE_STAGES.has(s) && !now.stages.includes(s));
     if (lost.length && !now.stages.some((s) => GATE_STAGES.has(s))) {
       out2.push(`pre-commit hook ${key2} (the gate) now runs only at stages [${now.stages.join(", ")}] \u2014 no commit or push triggers it`);
@@ -4549,7 +4626,63 @@ function repoRelative(path, ctx) {
   const rel = relative(ctx.cwd, path);
   return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
+var HUSKY_SHIM = '#!/usr/bin/env sh\n. "$(dirname "$0")/h"';
+var HUSKY_SHIM_NAMES = /* @__PURE__ */ new Set(["applypatch-msg", "commit-msg", "post-applypatch", "post-checkout", "post-commit", "post-merge", "post-rewrite", "pre-applypatch", "pre-auto-gc", "pre-commit", "pre-merge-commit", "pre-push", "pre-rebase", "prepare-commit-msg"]);
+var HUSKY_H_KNOWN = [
+  // husky 9.1.x
+  `#!/usr/bin/env sh
+[ "$HUSKY" = "2" ] && set -x
+n=$(basename "$0")
+s=$(dirname "$(dirname "$0")")/$n
+
+[ ! -f "$s" ] && exit 0
+
+if [ -f "$HOME/.huskyrc" ]; then
+	echo "husky - '~/.huskyrc' is DEPRECATED, please move your code to ~/.config/husky/init.sh"
+fi
+i="\${XDG_CONFIG_HOME:-$HOME/.config}/husky/init.sh"
+[ -f "$i" ] && . "$i"
+
+[ "\${HUSKY-}" = "0" ] && exit 0
+
+export PATH="node_modules/.bin:$PATH"
+sh -e "$s" "$@"
+c=$?
+
+[ $c != 0 ] && echo "husky - $n script failed (code $c)"
+[ $c = 127 ] && echo "husky - command not found in PATH=$PATH"
+exit $c
+`
+];
+var HUSKY_DEPRECATION = `echo "husky - DEPRECATED
+
+Please remove the following two lines from $0:
+
+#!/usr/bin/env sh
+. \\"\\$(dirname -- \\"\\$0\\")/_/husky.sh\\"
+
+They WILL FAIL in v10.0.0
+"`;
+var stripTrailingNl = (s) => s.endsWith("\n") ? s.slice(0, -1) : s;
+function huskyRuntimeWrite(path, content, ctx) {
+  const m = path.match(/(?:^|\/)\.husky\/_\/([^/]+)$/);
+  if (!m || content == null) return false;
+  const name = m[1];
+  const body = stripTrailingNl(content);
+  const ok = name === ".gitignore" ? body === "*" : name === "h" ? HUSKY_H_KNOWN.some((t) => stripTrailingNl(t) === body) : name === "husky.sh" ? stripTrailingNl(HUSKY_DEPRECATION) === body : HUSKY_SHIM_NAMES.has(name) && body === HUSKY_SHIM;
+  if (!ok) return false;
+  if (!ctx?.cwd) return false;
+  const root = path.slice(0, path.length - m[0].length + (m[0].startsWith("/") ? 1 : 0));
+  const entry = inspectRel(join3(ctx.cwd, root), ".husky/pre-commit");
+  if (entry.kind !== "file") return false;
+  const gate = textOf(entry);
+  if (gate == null) return false;
+  return invocations(gate.split("\n"), { errexit: true }).some(
+    (i) => i.identity === "tamperward check --staged" && i.state === "live" && i.pin === TW_VERSION
+  );
+}
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
+var isHookNote = (path) => /\.(?:md|markdown|txt)$|(?:^|\/)\.git(?:ignore|attributes)$/i.test(path);
 var hookTampering = {
   id: RULE6,
   surface: ["file", "command"],
@@ -4622,7 +4755,9 @@ var hookTampering = {
         } else if ((isLefthook(c.path) || isPreCommitConfig(c.path)) && (semantic = configFindings(c, changes, policy, ctx)) !== null) {
           out2.push(...semantic);
         } else if (!c.path.endsWith(POLICY_FILE)) {
+          if ((c.op === "add" || c.op === "modify") && huskyRuntimeWrite(c.path, c.after, ctx)) continue;
           const husky = isHuskyScript(c.path);
+          const opts = husky ? { errexit: true } : {};
           const beforePin = c.before != null && c.after != null ? initScriptPin(c.before) : null;
           if (beforePin !== null) {
             const afterPin = initScriptPin(c.after);
@@ -4639,22 +4774,71 @@ var hookTampering = {
             }
             continue;
           }
-          if (!husky && c.after != null) {
-            const problem = shebangProblem(c.after);
-            if (problem && (c.before == null || problem !== shebangProblem(c.before))) {
+          const added = addedLines(c);
+          const removed = removedLines(c);
+          const beforeLines = c.before != null ? c.before.split("\n") : removed.map((l) => l.content);
+          const afterLines = c.after != null ? c.after.split("\n") : added.map((l) => l.content);
+          const shebang = !husky && c.after != null ? shebangProblem(c.after) : null;
+          const shebangChanged = shebang !== null && (c.before == null || shebang !== shebangProblem(c.before));
+          const earlyExit = added.find((l) => insertsPassingExit(l.content));
+          if (c.op === "add") {
+            const gate = invocations(afterLines, opts).filter((i) => /^tamperward check\b/.test(i.identity));
+            const live = gate.find((i) => i.state === "live");
+            if (shebang || !live) {
+              const why = shebang ?? (gate.length ? `its \`${gate[0].identity}\` is ${gate[0].state}${gate[0].why ? ` (${gate[0].why})` : ""}` : "it runs no `tamperward check`");
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  message: `A protected hook script was added that does not run the gate live: ${why}. A new gate script needs a sign-off unless the gate is live in it.`,
+                  evidence: `a hook script was added; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or make the gate live in it`,
+                  remediation: "Run `tamperward check --staged` in the new hook, in a position where its failure fails the hook, or have a human sign off on a hook that does not."
+                })
+              );
+            } else if (earlyExit) {
               out2.push(
                 makeFinding(RULE6, policy, {
                   file: c.path,
-                  line: 1,
-                  message: `A protected hook's interpreter was changed: ${problem}.`,
-                  evidence: c.after.split("\n")[0],
-                  remediation: "Keep a shell in shebang position. git execs the hook directly, and an interpreter that never reads the script is a disabled hook."
+                  line: earlyExit.newLine ?? void 0,
+                  message: "An early `exit 0` was inserted into a protected hook \u2014 it now passes everything.",
+                  evidence: earlyExit.content.trim(),
+                  remediation: "Remove the early exit. A hook that always succeeds is a disabled hook."
                 })
               );
             }
+            continue;
+          }
+          if (!isHookNote(c.path)) {
+            const clean = c.before != null && c.after != null ? pinRaiseOnly(c.before, c.after) : pinRaiseOnly(removed.map((l) => l.content).join("\n"), added.map((l) => l.content).join("\n"));
+            if (!clean) {
+              const deadGuard2 = c.before == null || c.after == null ? added.find((l) => insertsDeadGuard(l.content)) : void 0;
+              const detail = [
+                shebangChanged ? `the interpreter changed: ${shebang}` : null,
+                ...scriptWeakening(beforeLines, afterLines, opts).map((l) => l.reason),
+                earlyExit ? `an early \`exit 0\` was inserted (\`${earlyExit.content.trim()}\`)` : null,
+                deadGuard2 ? `a guard that can never be true was inserted (\`${deadGuard2.content.trim()}\`)` : null
+              ].filter((d) => d !== null);
+              out2.push(
+                makeFinding(RULE6, policy, {
+                  file: c.path,
+                  message: `A hand-written protected hook script was changed: ${detail.length ? detail.join("; ") : "an edit other than a pin raise"}. Every edit to a gate script other than raising its pin needs a sign-off.`,
+                  evidence: `the gate script changed; sign off with \`tamperward allow hook-tampering --file ${c.path} --reason "..."\` locally or the \`tamperward:allow:hook-tampering@<head-sha>\` label in CI, or restore it`,
+                  remediation: "Restore the script, or have a human sign off. A line-by-line reading of a shell script cannot tell an honest restructuring from a neutered gate, so the gate script is held byte-for-byte: only raising its pin passes without a sign-off."
+                })
+              );
+            }
+            continue;
+          }
+          if (shebangChanged && c.after != null) {
+            out2.push(
+              makeFinding(RULE6, policy, {
+                file: c.path,
+                line: 1,
+                message: `A protected hook's interpreter was changed: ${shebang}.`,
+                evidence: c.after.split("\n")[0],
+                remediation: "Keep a shell in shebang position. git execs the hook directly, and an interpreter that never reads the script is a disabled hook."
+              })
+            );
           }
-          const added = addedLines(c);
-          const earlyExit = added.find((l) => insertsPassingExit(l.content));
           if (earlyExit) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -4678,9 +4862,7 @@ var hookTampering = {
               })
             );
           }
-          const beforeLines = c.before != null ? c.before.split("\n") : removedLines(c).map((l) => l.content);
-          const afterLines = c.after != null ? c.after.split("\n") : added.map((l) => l.content);
-          const lost = scriptWeakening(beforeLines, afterLines, husky ? { errexit: true } : {});
+          const lost = scriptWeakening(beforeLines, afterLines, opts);
           if (lost.length) {
             out2.push(
               makeFinding(RULE6, policy, {
@@ -5927,7 +6109,7 @@ function oobHeadFromEnv(env = process.env) {
   return v.length >= 7 ? v : void 0;
 }
 function oobFromEnv(env = process.env) {
-  return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return (env.TAMPERWARD_OOB_SIGNOFF ?? "").split(",").map((s) => s.trim().replace(/^tamperward:allow:/, "")).filter(Boolean);
 }
 
 // src/cli/render/text.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.9.0",
+  "version": "2.10.1",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",