@khoavu882/doflow 2.0.0-beta.3 → 2.0.0-beta.5

package/src/adapters/codex/{config.ts → config.js}

@@ -8,12 +8,12 @@
 const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
-const { parseToml, stripComment, tableViolations } = require('../../helper/toml.ts');
+const { parseToml, stripComment, tableViolations } = require('../../helper/toml.js');
 
 const CONFIG_NAME = 'config.toml';
 const CONFIG_KIND = 'configuration-entry';
 
-function configPath({ scope, codexDir, projectRoot, paths }: { scope?: string, codexDir?: string, projectRoot?: string, paths?: any } = {}): string {
+function configPath({ scope, codexDir, projectRoot, paths }                                                                           = {})         {
   // Preferred: the declared path resolved by the adapter (harnesses.json "paths".configFile).
   if (paths?.configFile) return paths.configFile;
   // Legacy derivation for direct callers passing raw scope inputs (tests, reconcileCodexConfig);
@@ -29,23 +29,23 @@ function configPath({ scope, codexDir, projectRoot, paths }: { scope?: string, c
   throw new Error(`Unsupported Codex configuration scope: ${scope}`);
 }
 
-function fingerprint(value: any): string {
+function fingerprint(value     )         {
   return `sha256:${crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex')}`;
 }
 
-function commentSuffix(line: string): string {
+function commentSuffix(line        )         {
   const withoutComment = stripComment(line);
   return line.slice(withoutComment.length);
 }
 
-function renderValue(value: any): string {
+function renderValue(value     )         {
   if (typeof value === 'boolean' || typeof value === 'number') return String(value);
   if (typeof value === 'string') return JSON.stringify(value);
   throw new Error('Managed Codex config values must be boolean, number, or string');
 }
 
-function normaliseDesired(resources: any): Map<string, any> {
-  const result = new Map<string, any>();
+function normaliseDesired(resources     )                   {
+  const result = new Map             ();
   for (const resource of resources || []) {
     if (!resource || (resource.kind && resource.kind !== CONFIG_KIND && resource.kind !== 'config-entry')) continue;
     const identity = resource.identity ?? resource.key;
@@ -62,49 +62,49 @@ function normaliseDesired(resources: any): Map<string, any> {
 
 /** The comment on a line DoFlow added to a table the user opened with no entry: it is how removal
  * knows to keep the user's header and restore the file's exact bytes. */
-function addedMarker(table: string): string { return ` # DoFlow added this to your [${table}] table`; }
+function addedMarker(table        )         { return ` # DoFlow added this to your [${table}] table`; }
 
 /** Where a new entry `<table>.<key>` goes in the parsed file: after the last entry of its table;
  * on the line right after the table's empty header, marked; as a root dotted line after the last
  * root dotted line of that table; refused (`valueEntry`) when the table or a parent of it is set as
  * a value, which TOML cannot extend; otherwise in a new table (no `at`). */
-function placeEntry(identity: string, value: any, parsed: any): any {
+function placeEntry(identity        , value     , parsed     )      {
   const parts = identity.split('.');
   const table = parts.slice(0, -1).join('.');
   const rendered = renderValue(value);
   const assignment = `${parts.at(-1)} = ${rendered}`;
-  const entries: any[] = [...parsed.entries];
-  const after = (items: any[]) => Math.max(...items.map(([, entry]: any) => entry.line)) + 1;
-  const inTable = entries.filter(([, entry]: any) => entry.table === table);
+  const entries        = [...parsed.entries];
+  const after = (items       ) => Math.max(...items.map(([, entry]     ) => entry.line)) + 1;
+  const inTable = entries.filter(([, entry]     ) => entry.table === table);
   if (inTable.length) return { table, at: after(inTable), line: assignment };
-  const header = parsed.headers.find((item: any) => item.table === table);
+  const header = parsed.headers.find((item     ) => item.table === table);
   if (header) return { table, at: header.line + 1, line: `${assignment}${addedMarker(table)}` };
-  const dotted = entries.filter(([key, entry]: any) => entry.table === '' && key.startsWith(`${table}.`));
+  const dotted = entries.filter(([key, entry]     ) => entry.table === '' && key.startsWith(`${table}.`));
   if (dotted.length) return { table, at: after(dotted), line: `${identity} = ${rendered}` };
-  const valueEntry = entries.find(([key]: any) => key === table || table.startsWith(`${key}.`));
+  const valueEntry = entries.find(([key]     ) => key === table || table.startsWith(`${key}.`));
   if (valueEntry) return { table, valueEntry };
   return { table, line: assignment };
 }
 
 /** Whether a managed entry's line is one placeEntry put into the user's own table: marked, or
  * written as a dotted key outside its table. */
-function placedLine(identity: string, entry: any, lines: any[]): boolean {
+function placedLine(identity        , entry     , lines       )          {
   const table = identity.split('.').slice(0, -1).join('.');
   return entry.table !== table || lines[entry.line].trimEnd().endsWith(addedMarker(table));
 }
 
 /** A conflict when `content` breaks a TOML table rule that `original` did not already break, so a
  * file that was valid is never written invalid; null otherwise. */
-function newViolation({ file, original, content, identities }: { file: string, original: string, content: string, identities: string[] }): string | null {
-  const refused = (reason: string) => `${file}: DoFlow cannot write ${identities.map((identity) => `'${identity}'`).join(', ')} without making the file invalid TOML (${reason}). Nothing was written.`;
+function newViolation({ file, original, content, identities }                                                                           )                {
+  const refused = (reason        ) => `${file}: DoFlow cannot write ${identities.map((identity) => `'${identity}'`).join(', ')} without making the file invalid TOML (${reason}). Nothing was written.`;
   const before = tableViolations(original);
   let after;
-  try { after = tableViolations(content); } catch (error: any) { return refused(error.message); }
-  const added = after.find((item: any) => !before.some((known: any) => known.kind === item.kind && known.table === item.table));
+  try { after = tableViolations(content); } catch (error     ) { return refused(error.message); }
+  const added = after.find((item     ) => !before.some((known     ) => known.kind === item.kind && known.table === item.table));
   return added ? refused(`${added.kind} '${added.table}' on line ${added.line}`) : null;
 }
 
-function isOwnedRecord(resource: any, scope: any): boolean {
+function isOwnedRecord(resource     , scope     )          {
   return resource && resource.target === 'codex' && resource.scope === scope &&
     (resource.kind === CONFIG_KIND || resource.kind === 'config-entry') && typeof resource.identity === 'string';
 }
@@ -118,20 +118,20 @@ function isOwnedRecord(resource: any, scope: any): boolean {
  *   entries written before the neutral ledger existed could never be re-adopted — the condition
  *   blocking the install was the same condition an install had to run to clear.
  */
-function planCodexConfig({ file, scope, managedResources = [], desiredResources = [], adopt = false }: { file: string, scope?: any, managedResources?: any[], desiredResources?: any[], adopt?: boolean }): any {
+function planCodexConfig({ file, scope, managedResources = [], desiredResources = [], adopt = false }                                                                                                    )      {
   const original = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
   let parsed;
-  try { parsed = parseToml(original); } catch (error: any) {
+  try { parsed = parseToml(original); } catch (error     ) {
     return { ok: false, status: 'malformed', file, original, changes: [], conflicts: [error.message], managedResources };
   }
   let desired;
-  try { desired = normaliseDesired(desiredResources); } catch (error: any) {
+  try { desired = normaliseDesired(desiredResources); } catch (error     ) {
     return { ok: false, status: 'invalid-request', file, original, changes: [], conflicts: [error.message], managedResources };
   }
-  const owned = new Map<string, any>(managedResources.filter((resource: any) => isOwnedRecord(resource, scope)).map((resource: any) => [resource.identity, resource]));
-  const changes: any[] = [];
-  const conflicts: string[] = [];
-  const placements = new Map<string, any>();
+  const owned = new Map             (managedResources.filter((resource     ) => isOwnedRecord(resource, scope)).map((resource     ) => [resource.identity, resource]));
+  const changes        = [];
+  const conflicts           = [];
+  const placements = new Map             ();
   const all = new Set([...desired.keys(), ...owned.keys()]);
   for (const identity of all) {
     const entry = parsed.entries.get(identity);
@@ -164,10 +164,10 @@ function planCodexConfig({ file, scope, managedResources = [], desiredResources
   }
   if (conflicts.length) return { ok: false, status: 'conflict', file, original, changes: [], conflicts, managedResources };
   const nextLines = [...parsed.lines];
-  for (const change of changes.filter((change: any) => change.type === 'update')) {
+  for (const change of changes.filter((change     ) => change.type === 'update')) {
     const key = change.identity.split('.').at(-1);
     const originalLine = nextLines[change.line];
-    const indentation = originalLine.match(/^\s*/)![0];
+    const indentation = originalLine.match(/^\s*/) [0];
     // A user comment beside an owned value is still user content. Retain it even though the
     // owned scalar changes, so reconciliation does not silently erase unrelated explanation.
     const suffix = commentSuffix(originalLine);
@@ -175,18 +175,18 @@ function planCodexConfig({ file, scope, managedResources = [], desiredResources
   }
   // A line DoFlow placed in the user's own table (marker or dotted form) is deleted outright and its
   // header kept, so the file returns to its exact bytes. Any other removal leaves a blank line.
-  const removals = changes.filter((change: any) => change.type === 'remove');
-  const placedInUserTable = removals.filter((change: any) => placedLine(change.identity, parsed.entries.get(change.identity), parsed.lines));
+  const removals = changes.filter((change     ) => change.type === 'remove');
+  const placedInUserTable = removals.filter((change     ) => placedLine(change.identity, parsed.entries.get(change.identity), parsed.lines));
   for (const change of removals) nextLines[change.line] = placedInUserTable.includes(change) ? null : '';
-  dropEmptiedTables(nextLines, changes.filter((change: any) => !placedInUserTable.includes(change)), parsed.headers);
+  dropEmptiedTables(nextLines, changes.filter((change     ) => !placedInUserTable.includes(change)), parsed.headers);
   // A new key must land INSIDE its own table. Appending at end-of-file only happens to be
   // correct when that table is the file's last one — otherwise the key silently joins whichever
   // table trails the file, so `features.hooks` written after an `[mcp_servers.x]` block becomes
   // `mcp_servers.x.hooks`. placeEntry chooses the spot; genuinely new tables are appended once
   // each, with all of their keys grouped under a single header.
-  const insertions: { at: number, line: string }[] = [];
-  const newTables = new Map<string, string[]>();
-  for (const change of changes.filter((change: any) => change.type === 'create')) {
+  const insertions                                 = [];
+  const newTables = new Map                  ();
+  for (const change of changes.filter((change     ) => change.type === 'create')) {
     const placement = placements.get(change.identity);
     if (placement.at !== undefined) insertions.push({ at: placement.at, line: placement.line });
     else newTables.set(placement.table, [...(newTables.get(placement.table) || []), placement.line]);
@@ -204,11 +204,11 @@ function planCodexConfig({ file, scope, managedResources = [], desiredResources
   }
   let content = nextLines.join('\n');
   if (content && !content.endsWith('\n')) content += '\n';
-  const invalid = newViolation({ file, original, content, identities: changes.map((change: any) => change.identity) });
+  const invalid = newViolation({ file, original, content, identities: changes.map((change     ) => change.identity) });
   if (invalid) return { ok: false, status: 'conflict', file, original, changes: [], conflicts: [invalid], managedResources };
-  const nextManagedResources = managedResources.filter((resource: any) => !isOwnedRecord(resource, scope) || desired.has(resource.identity));
+  const nextManagedResources = managedResources.filter((resource     ) => !isOwnedRecord(resource, scope) || desired.has(resource.identity));
   for (const resource of desired.values()) {
-    const index = nextManagedResources.findIndex((item: any) => isOwnedRecord(item, scope) && item.identity === resource.identity);
+    const index = nextManagedResources.findIndex((item     ) => isOwnedRecord(item, scope) && item.identity === resource.identity);
     const updated = { ...resource, target: 'codex', scope, kind: CONFIG_KIND, fingerprint: fingerprint(resource.value) };
     if (index >= 0) nextManagedResources[index] = updated;
     else nextManagedResources.push(updated);
@@ -221,17 +221,17 @@ function planCodexConfig({ file, scope, managedResources = [], desiredResources
  * it was the file's last table, the blank line the table append puts before a new header goes too.
  * A table that also receives a created key, or whose header line carries a comment, is kept.
  * Headers come from the parser's own records, never from re-reading lines. */
-function dropEmptiedTables(lines: any[], changes: any[], headerRecords: any[]): void {
-  const tableOf = (identity: string) => identity.split('.').slice(0, -1).join('.');
-  const removedTables = new Map<number, string>(changes.filter((change) => change.type === 'remove').map((change): [number, string] => [change.line, tableOf(change.identity)]));
-  const createdTables = new Set<string>(changes.filter((change) => change.type === 'create').map((change) => tableOf(change.identity)));
-  const headers: number[] = headerRecords.map((header) => header.line);
+function dropEmptiedTables(lines       , changes       , headerRecords       )       {
+  const tableOf = (identity        ) => identity.split('.').slice(0, -1).join('.');
+  const removedTables = new Map                (changes.filter((change) => change.type === 'remove').map((change)                   => [change.line, tableOf(change.identity)]));
+  const createdTables = new Set        (changes.filter((change) => change.type === 'create').map((change) => tableOf(change.identity)));
+  const headers           = headerRecords.map((header) => header.line);
   headers.forEach((start, position) => {
     const end = headers[position + 1] ?? lines.length;
     if (stripComment(lines[start]) !== lines[start]) return;
-    const body = lines.slice(start + 1, end).map((_: any, offset: number) => start + 1 + offset);
+    const body = lines.slice(start + 1, end).map((_     , offset        ) => start + 1 + offset);
     const removedHere = body.filter((index) => removedTables.has(index));
-    if (!removedHere.length || removedHere.some((index) => createdTables.has(removedTables.get(index) as string))) return;
+    if (!removedHere.length || removedHere.some((index) => createdTables.has(removedTables.get(index)          ))) return;
     if (body.some((index) => !removedTables.has(index) && lines[index] !== null && lines[index].trim() !== '')) return;
     lines[start] = null;
     for (const index of removedHere) lines[index] = null;
@@ -241,7 +241,7 @@ function dropEmptiedTables(lines: any[], changes: any[], headerRecords: any[]):
 
 /** Replace a file through a sibling temporary file, keeping the existing file's permission bits so
  * a config kept private stays so. A file this creates gets the process's default mode. */
-function atomicWrite(file: string, content: string, fsImpl: any = fs): void {
+function atomicWrite(file        , content        , fsImpl      = fs)       {
   fsImpl.mkdirSync(path.dirname(file), { recursive: true });
   const mode = fsImpl.existsSync(file) ? fsImpl.statSync(file).mode & 0o7777 : null;
   const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${Date.now()}.tmp`);
@@ -254,7 +254,7 @@ function atomicWrite(file: string, content: string, fsImpl: any = fs): void {
   }
 }
 
-function applyCodexConfig(plan: any, { dryRun = false, fsImpl = fs }: { dryRun?: boolean, fsImpl?: any } = {}): any {
+function applyCodexConfig(plan     , { dryRun = false, fsImpl = fs }                                     = {})      {
   if (!plan.ok) return { ...plan, applied: false };
   if (dryRun || plan.status === 'unchanged') return { ...plan, applied: false };
   // A removal that leaves nothing behind deletes the file rather than leaving it empty.
@@ -263,7 +263,7 @@ function applyCodexConfig(plan: any, { dryRun = false, fsImpl = fs }: { dryRun?:
   return { ...plan, applied: true };
 }
 
-function reconcileCodexConfig(options: any): any {
+function reconcileCodexConfig(options     )      {
   const file = options.file ?? configPath(options);
   const plan = planCodexConfig({ ...options, file });
   return applyCodexConfig(plan, options);

package/src/adapters/codex/{hooks.ts → hooks.js}

@@ -7,19 +7,20 @@
 // that are not executable.  Trust is reported as a prerequisite rather than being bypassed.
 const fs = require('node:fs');
 const path = require('node:path');
-const { verifyHookCommands } = require('../hook-commands.ts');
-const { mergeHooks } = require('../../helper/settings-merge.ts');
-const { atomicWrite } = require('./config.ts');
+const crypto = require('node:crypto');
+const { verifyHookCommands } = require('../hook-commands.js');
+const { mergeHooks } = require('../../helper/settings-merge.js');
+const { atomicWrite } = require('./config.js');
 
 const SUPPORTED_EVENTS = new Set([
   'PreToolUse', 'PermissionRequest', 'PostToolUse', 'PreCompact', 'PostCompact',
   'UserPromptSubmit', 'SubagentStop', 'Stop', 'SessionStart', 'SubagentStart', 'SessionEnd',
 ]);
 
-function validationError(errors: string[], message: string): void { errors.push(message); }
+function validationError(errors          , message        )       { errors.push(message); }
 
-function validateHooksConfig(config: any): { ok: boolean, errors: string[], events: string[] } {
-  const errors: string[] = [];
+function validateHooksConfig(config     )                                                      {
+  const errors           = [];
   if (!config || typeof config !== 'object' || Array.isArray(config)) {
     return { ok: false, errors: ['Hook configuration must be an object'], events: [] };
   }
@@ -35,7 +36,7 @@ function validateHooksConfig(config: any): { ok: boolean, errors: string[], even
       validationError(errors, `Hook event '${event}' requires a non-empty array of matcher groups`);
       continue;
     }
-    groups.forEach((group: any, groupIndex: number) => {
+    groups.forEach((group     , groupIndex        ) => {
       if (!group || typeof group !== 'object' || Array.isArray(group)) {
         validationError(errors, `Hook event '${event}' group ${groupIndex} must be an object`);
         return;
@@ -47,7 +48,7 @@ function validateHooksConfig(config: any): { ok: boolean, errors: string[], even
         validationError(errors, `Hook event '${event}' group ${groupIndex} requires a non-empty hooks array`);
         return;
       }
-      group.hooks.forEach((handler: any, handlerIndex: number) => {
+      group.hooks.forEach((handler     , handlerIndex        ) => {
         const label = `Hook event '${event}' group ${groupIndex} handler ${handlerIndex}`;
         if (!handler || typeof handler !== 'object' || Array.isArray(handler)) {
           validationError(errors, `${label} must be an object`);
@@ -73,9 +74,9 @@ function validateHooksConfig(config: any): { ok: boolean, errors: string[], even
 }
 
 /** Maps Claude guardrail intent, never fabricating a Codex equivalent for unavailable events. */
-function classifyClaudeGuardrails(claudeHooks: any = {}): { supported: any[], unsupported: any[] } {
-  const supported: any[] = [];
-  const unsupported: any[] = [];
+function classifyClaudeGuardrails(claudeHooks      = {})                                           {
+  const supported        = [];
+  const unsupported        = [];
   for (const [event, groups] of Object.entries(claudeHooks || {})) {
     const item = { sourceEvent: event, targetEvent: event, groups: Array.isArray(groups) ? groups.length : 0 };
     if (SUPPORTED_EVENTS.has(event)) supported.push(item);
@@ -84,7 +85,7 @@ function classifyClaudeGuardrails(claudeHooks: any = {}): { supported: any[], un
   return { supported, unsupported };
 }
 
-function destinationFor(context: any = {}): string {
+function destinationFor(context      = {})         {
   // Preferred: the declared path resolved by the adapter (harnesses.json "paths".hooksFile).
   if (context.paths?.hooksFile) return context.paths.hooksFile;
   // Legacy derivation for direct callers passing raw scope inputs; kept byte-compatible with the
@@ -102,20 +103,45 @@ function destinationFor(context: any = {}): string {
   throw new Error('A hook destination or Codex scope is required');
 }
 
-function planCodexHooks({ config, sourceFile, sourceHooksDir, destinationContext = {}, trusted = false, fsImpl = fs }: any = {}): any {
+/** DoFlow's record of a deployed hook script, in the ledger's fingerprint form: sha256 of its bytes. */
+function scriptFingerprint(bytes     )         { return `sha256:${crypto.createHash('sha256').update(bytes).digest('hex')}`; }
+
+/** The scripts beside the config that differ from the shipped source (or are absent), by name, and
+ * those among them a ledger row says were edited since DoFlow wrote them. A script with no row
+ * (an install from before scripts were recorded) is DoFlow's to refresh: the config deploy always
+ * overwrote it. `rows` are this harness's script rows: { target, fingerprint }. */
+function planHookScripts({ commands, sourceHooksDir, destinationHooksDir, rows = [], force = false, fsImpl = fs }     ) {
+  const sources = new Map                (commands.checks.map((check     ) => [check.script, check.file]                    ));
+  for (const name of shippedHookScripts(sourceHooksDir, fsImpl)) if (!sources.has(name)) sources.set(name, path.join(sourceHooksDir, name));
+  const stale           = [];
+  const edited           = [];
+  for (const [name, source] of sources) {
+    const target = path.join(destinationHooksDir, name);
+    if (fsImpl.existsSync(target)) {
+      const current = fsImpl.readFileSync(target);
+      if (current.equals(fsImpl.readFileSync(source))) continue;
+      const row = rows.find((item     ) => path.resolve(item.target) === path.resolve(target));
+      if (row && row.fingerprint !== scriptFingerprint(current) && !force) edited.push(name);
+    }
+    stale.push(name);
+  }
+  return { names: [...sources.keys()], stale, edited };
+}
+
+function planCodexHooks({ config, sourceFile, sourceHooksDir, destinationContext = {}, trusted = false, scriptRows = [], force = false, fsImpl = fs }      = {})      {
   let desired = config;
   try {
     if (!desired && sourceFile) desired = JSON.parse(fsImpl.readFileSync(sourceFile, 'utf8'));
-  } catch (error: any) {
+  } catch (error     ) {
     return { ok: false, status: 'malformed', changes: [], errors: [`Could not parse ${sourceFile}: ${error.message}`] };
   }
   const schema = validateHooksConfig(desired);
   let destination;
-  try { destination = destinationFor(destinationContext); } catch (error: any) {
+  try { destination = destinationFor(destinationContext); } catch (error     ) {
     return { ok: false, status: 'invalid-request', changes: [], errors: [...schema.errors, error.message] };
   }
   const commands = verifyHookCommands(desired || {}, { scriptsDir: sourceHooksDir, trusted, fsImpl });
-  const errors = [...schema.errors, ...commands.checks.filter((check: any) => !check.ok).map((check: any) => `${check.event}: ${check.reason}${check.script ? ` (${check.script})` : ''}`)];
+  const errors = [...schema.errors, ...commands.checks.filter((check     ) => !check.ok).map((check     ) => `${check.event}: ${check.reason}${check.script ? ` (${check.script})` : ''}`)];
   let mergedDesired = desired;
   const original = fsImpl.existsSync(destination) ? fsImpl.readFileSync(destination, 'utf8') : '';
   if (original.trim()) {
@@ -130,25 +156,34 @@ function planCodexHooks({ config, sourceFile, sourceHooksDir, destinationContext
   }
   const content = schema.ok && mergedDesired ? `${JSON.stringify(mergedDesired, null, 2)}\n` : null;
   if (errors.length) return { ok: false, status: 'invalid-request', destination, original, changes: [], errors, commands };
-  const changed = original !== content;
+  const configChanged = original !== content;
   const destinationHooksDir = destinationContext.paths?.hooksDirectory
     || destinationContext.hooksDir
     || path.join(path.dirname(destination), 'hooks');
+  // The scripts are deployed with the config but are not part of it: a script whose bytes differ
+  // from the source is redeployed even when the config is already right.
+  const scripts = planHookScripts({ commands, sourceHooksDir, destinationHooksDir, rows: scriptRows, force, fsImpl });
+  if (scripts.edited.length) {
+    return { ok: false, status: 'conflict', destination, original, changes: [], commands,
+      errors: scripts.edited.map((name        ) => `Codex hook script '${name}' was modified outside DoFlow`) };
+  }
+  const scriptsOnly = !configChanged && scripts.stale.length > 0;
+  const changed = configChanged || scriptsOnly;
   // The scripts deployCodexHooks copies beside hooks.json, so a backup of this change holds them too.
   const companionTargets = [...new Set([
-    ...commands.checks.map((check: any) => path.join(destinationHooksDir, check.script)),
-    ...shippedHookScripts(sourceHooksDir, fsImpl).map((name: string) => path.join(destinationHooksDir, name)),
+    ...commands.checks.map((check     ) => path.join(destinationHooksDir, check.script)),
+    ...shippedHookScripts(sourceHooksDir, fsImpl).map((name        ) => path.join(destinationHooksDir, name)),
   ])].sort();
-  return { ok: true, status: changed ? 'change' : 'unchanged', destination, original, content,
+  return { ok: true, status: changed ? 'change' : 'unchanged', destination, original, content, scriptsOnly, scriptNames: scripts.names,
     changes: changed ? [{ type: fsImpl.existsSync(destination) ? 'update' : 'create', file: destination, companionTargets }] : [],
     errors: [], commands, trust: commands.trust, scriptsDir: sourceHooksDir, destinationHooksDir };
 }
 
-function deployCodexHooks(plan: any, { dryRun = false, fsImpl = fs }: { dryRun?: boolean, fsImpl?: any } = {}): any {
+function deployCodexHooks(plan     , { dryRun = false, fsImpl = fs }                                     = {})      {
   if (!plan.ok) return { ...plan, applied: false };
   if (dryRun || plan.status === 'unchanged') return { ...plan, applied: false };
-  atomicWrite(plan.destination, plan.content, fsImpl);
-  const deployed = new Set<string>();
+  if (!plan.scriptsOnly) atomicWrite(plan.destination, plan.content, fsImpl);
+  const deployed = new Set        ();
   for (const check of plan.commands.checks) {
     const target = path.join(plan.destinationHooksDir, check.script);
     fsImpl.mkdirSync(path.dirname(target), { recursive: true });
@@ -174,16 +209,16 @@ function deployCodexHooks(plan: any, { dryRun = false, fsImpl = fs }: { dryRun?:
 
 /** Every file deployCodexHooks copies beside hooks.json: each regular, non-JSON file in the
  * shipped scripts directory (the command-named scripts are among them). */
-function shippedHookScripts(scriptsDir: any, fsImpl: any = fs): string[] {
+function shippedHookScripts(scriptsDir     , fsImpl      = fs)           {
   if (!scriptsDir || !fsImpl.existsSync(scriptsDir)) return [];
   return fsImpl.readdirSync(scriptsDir)
-    .filter((name: string) => !name.endsWith('.json') && fsImpl.statSync(path.join(scriptsDir, name)).isFile());
+    .filter((name        ) => !name.endsWith('.json') && fsImpl.statSync(path.join(scriptsDir, name)).isFile());
 }
 
 /** Undo deployCodexHooks' script copies. The ledger records only hooks.json, so ownership of a
  * script is proven by its bytes: one still identical to the shipped source is deleted, one the
  * user edited or added stays. The directory goes only once it is empty. */
-function removeCodexHookScripts({ scriptsDir, destinationHooksDir }: { scriptsDir?: string, destinationHooksDir?: string } = {}, { dryRun = false, fsImpl = fs }: { dryRun?: boolean, fsImpl?: any } = {}): { removed: number } {
+function removeCodexHookScripts({ scriptsDir, destinationHooksDir }                                                        = {}, { dryRun = false, fsImpl = fs }                                     = {})                      {
   if (!destinationHooksDir || !fsImpl.existsSync(destinationHooksDir)) return { removed: 0 };
   let removed = 0;
   for (const name of shippedHookScripts(scriptsDir, fsImpl)) {
@@ -200,4 +235,4 @@ function removeCodexHookScripts({ scriptsDir, destinationHooksDir }: { scriptsDi
   return { removed };
 }
 
-module.exports = { SUPPORTED_EVENTS, validateHooksConfig, classifyClaudeGuardrails, verifyHookCommands, planCodexHooks, deployCodexHooks, shippedHookScripts, removeCodexHookScripts };
+module.exports = { SUPPORTED_EVENTS, validateHooksConfig, classifyClaudeGuardrails, verifyHookCommands, planCodexHooks, deployCodexHooks, scriptFingerprint, shippedHookScripts, removeCodexHookScripts };