| name | tw-self-check |
| description | Verify the scan status of Tripwire's own five tw-* skills as installed under ~/.claude/skills (self-integrity check). Use when the user runs /tw-self-check, or asks whether Tripwire's own skills are scanned, green, or would be blocked by their own hook. |
tw-self-check
Self-integrity check: /tw-verify's logic hard-scoped to the five tw-* skills as INSTALLED under ~/.claude/skills/ — the installed copies are what enforcement sees, not the repo copies. Never stop at the first problem; all five always get a row.
Step 1 — Parse arguments
The only accepted argument is force: a literal --force flag OR a bare force token. It passes through to the rescan offer in Step 5. Ignore any other arguments (mention that scope is fixed to the five tw-* skills).
Step 2 — Fixed scope, fixed resolution
The artifact list is EXACTLY these five installed skill directories — no name search, no other loci:
~/.claude/skills/tw-verify~/.claude/skills/tw-scan~/.claude/skills/tw-enable~/.claude/skills/tw-disable~/.claude/skills/tw-self-check
For each: if the directory exists, the identifier is its canonical absolute path (realpath, symlinks resolved, no trailing slash). If it does not exist → a ❓ NOT FOUND row with note Not installed under ~/.claude/skills — run tripwire setup-agent-hooks.
Step 3 — Query status (shared status procedure)
Read ~/.tripwire/config.json for enable, scan_validity_days, repo_root, env_file, uv_bin (missing/corrupt config: report that the hook treats this as tampering and denies, point at tripwire setup-agent-hooks, and stop). Then run the status driver ONCE with all existing identifiers — exactly this driver, no improvised queries:
cd "<repo_root>" && set -a && source "<env_file>" && set +a && "<uv_bin>" run --extra guard python -c '
import json, os, sys
from guard.status import content_changed, get_item_status, make_client
cfg = json.load(open(os.path.expanduser("~/.tripwire/config.json"), encoding="utf-8"))
days = int(cfg.get("scan_validity_days", 14))
client = make_client(os.environ["SUPABASE_URL"], os.environ["SUPABASE_SERVICE_ROLE_KEY"])
threshold = "red"
monitoring = True
rows = []
for ident in sys.argv[1:]:
s = get_item_status(client, ident, days)
threshold = s.get("threshold") or threshold
monitoring = bool(s.get("monitoring_enabled", True))
state = s["state"]
rag = s.get("rag")
# Tamper truthfulness: directory-resolved artifacts are re-hashed and
# compared against the stored content hash, exactly like the hook. MCP
# identifiers are bare keys, never paths (their pending:<key> hashes are
# exempt inside content_changed anyway).
changed = os.path.isdir(ident) and content_changed(ident, s.get("stored_content_hash"))
if changed:
blocked = True
elif state == "fresh":
blocked = rag == "red" or (rag == "amber" and threshold != "red")
elif state == "scanning":
blocked = not (rag == "green" or (rag == "amber" and threshold == "red"))
else:
blocked = True
item = s.get("item") or {}
q = item.get("quality_score")
quality_score = float(q) if isinstance(q, (int, float)) else None
rows.append({
"identifier": ident,
"state": state,
"rag": rag,
"scanned_at": s.get("scanned_at"),
"stale": state == "stale",
"errored": item.get("heatmap_status") == "error",
"changed": changed,
"will_be_blocked": blocked,
"quality_score": quality_score,
})
print(json.dumps({
"config": {
"enabled": bool(cfg.get("enable", True)),
"scan_validity_days": days,
"threshold": threshold,
"monitoring_enabled": monitoring,
},
"artifacts": rows,
}))
' <identifier-1> <identifier-2> ...
Step 4 — Report (Scan Status table only)
Render exactly the tw-verify human table — same columns Name | Type | Status | Quality | Note, emoji/labels, Quality as N/100 or —, blocked-message footer, and Sources line (Tessl Quality; Cisco/Snyk Status) (see ~/.claude/skills/tw-verify/SKILL.md §Step 5 and frontline-output-contract.md). Parse the driver's JSON privately; do not dump a fenced {config, artifacts} block to the user. Summary of the row rules (N = scan_validity_days):
fresh + green → 🟢 GREEN (fresh), note —.fresh + amber → 🟠 AMBER; Reported but not blocked at current threshold when threshold is red, else distinct amber note + footer when blocked.fresh + red → 🔴 RED; note rated red — at/above threshold (blocked sentence is footer-only).stale → ⚠️ STALE; Last scanned >N days ago — blocked until rescanned (run /tw-scan <name>).scanning → ⏳ SCANNING; Scan in progress — check back shortly (+ prior verdict if rag non-null).unscanned → 🚫 UNSCANNED; Never scanned — offer /tw-scan <name> (or Last scan errored — resubmit (run /tw-scan <name>) when errored).changed=true → ✏️ CHANGED; bold content changed since last scan — run /tw-scan — takes precedence over every state-based row, will_be_blocked true.- missing install dir →
❓ NOT FOUND; note Not installed under ~/.claude/skills — run tripwire setup-agent-hooks (footer covers blocked).
If any will_be_blocked, print Will be blocked when Tripwire is enabled once under the table.
If local enable is false, add the "currently bypassed" note; if monitoring_enabled is false, add the platform-switch warning.
A non-green result here matters: a blocked tw-* skill means the hook will block Tripwire's own tooling — the out-of-band remedies are cd <repo_root> && node <cli_bin> scan <abs path> --no-defaults --force in a terminal, or hand-editing ~/.tripwire/config.json to "enable": false.
Step 5 — Rescan offer
If any rows are unscanned, errored, stale, or changed — or if force mode is set (then ALL five installed skills are candidates, fresh ones included) — offer to submit them. On yes: follow the tw-scan procedure (~/.claude/skills/tw-scan/SKILL.md) for exactly those installed paths — its submission step always appends --force, which is what actually clears stale/errored/changed states (without force the CLI skips unchanged content and the state never clears) — then re-render with those rows as ⏳ SCANNING.
