@khoavu882/doflow 2.0.0-beta.3 → 2.0.0-beta.5

package/src/cli/commands/{rollback.ts → rollback.js}

@@ -6,31 +6,31 @@
 // restores per tool, as it always did.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
 const path = require('node:path');
-const { resolveTargets, toolDirs } = require('../../install/targets.ts');
-const { resolveContext, printContext } = require('../../install/context.ts');
+const { resolveTargets, toolDirs } = require('../../install/targets.js');
+const { resolveContext, printContext } = require('../../install/context.js');
 const {
   BackupError, createFileBackup, planRestore, executeRestore, listBackups, formatBytes,
-} = require('../../install/backup.ts');
-const { backupSetFromPaths } = require('../../install/backup-set.ts');
-const { writeManifest } = require('../../install/manifest.ts');
-const { stateRoot, ledgerPath } = require('../../state/index.ts');
-const { confirm, promptLine } = require('../../helper/prompt.ts');
-const { sourceCommit } = require('../../helper/git.ts');
-const { captureCaught } = require('../../runtime/cli-result.ts');
+} = require('../../install/backup.js');
+const { backupSetFromPaths } = require('../../install/backup-set.js');
+const { writeManifest } = require('../../install/manifest.js');
+const { stateRoot, ledgerPath } = require('../../state/index.js');
+const { confirm, promptLine } = require('../../helper/prompt.js');
+const { sourceCommit } = require('../../helper/git.js');
+const { captureCaught } = require('../../runtime/cli-result.js');
 const {
   REPO_ROOT, SCRIPT_DIR, pkg, installPaths, printBackupTable, holdRunLock, checkpointRunLock,
-} = require('../shared.ts');
+} = require('../shared.js');
 
 const LISTED_ABSENT = 10;
 
-function fail(error: any): void {
+function fail(error     )       {
   captureCaught(error, 'rollback', 1);
   console.error(`[ERROR] ${error.message}`);
   console.error('[ERROR] Use --list-backups to see available backups');
   process.exit(1);
 }
 
-function cmdRollback(o: any): void {
+function cmdRollback(o     )       {
   const targets = resolveTargets(o.targets);
   const dirs = toolDirs({ global: o.global, projectRoot: '.' });
   const scope = { global: o.global, projectRoot: '.' };
@@ -50,7 +50,7 @@ function cmdRollback(o: any): void {
     }
 
     // Worked out before anything is written. Reads only, so a bad id fails here, before the prompt.
-    let plan: any;
+    let plan     ;
     try {
       const neutralStateRoot = stateRoot({ scope: scopeName, projectRoot: lifecyclePaths.scopeRoot, homeDir: lifecyclePaths.scopeRoot });
       plan = planRestore({ bid, backupRoot, scope: scopeName, scopeRoot: lifecyclePaths.scopeRoot, targets, explicitTargets, dirs,
@@ -61,7 +61,7 @@ function cmdRollback(o: any): void {
     // A per-file backup restores the harnesses it holds (only those in --target when given), so the
     // banner and the install manifest name those, not the default target.
     const restoredTools = plan.format === 2
-      ? [...new Set(plan.restore.flatMap((item: any) => item.harnesses))].filter((h) => !explicitTargets || targets.includes(h)).sort()
+      ? [...new Set(plan.restore.flatMap((item     ) => item.harnesses))].filter((h) => !explicitTargets || targets.includes(h)).sort()
       : targets;
     printContext(resolveContext({ repoRoot: REPO_ROOT, targets: restoredTools, dirs, sourceCommit: commit, global: o.global, projectRoot: '.' }));
 
@@ -87,7 +87,7 @@ function cmdRollback(o: any): void {
 
     snapshotBeforeRestore({ o, plan, bid, backupRoot, lifecyclePaths, scopeName, commit });
 
-    let result: any;
+    let result     ;
     try {
       result = executeRestore(plan, { backupRoot, dryRun: o.dryRun });
     } catch (error) {
@@ -134,7 +134,7 @@ function cmdRollback(o: any): void {
 /** A backup of exactly the files the restore will overwrite, taken regardless of --no-backup:
  * rollback is destructive enough that skipping it is not offered. Skipped when the restore
  * overwrites nothing, so an empty snapshot never pushes a real restore point out of retention. */
-function snapshotBeforeRestore({ o, plan, bid, backupRoot, lifecyclePaths, scopeName, commit }: any): void {
+function snapshotBeforeRestore({ o, plan, bid, backupRoot, lifecyclePaths, scopeName, commit }     )       {
   if (o.dryRun) {
     console.log(`[DRY]  Would snapshot ${plan.snapshot.length} file(s) before restoring`);
     return;
@@ -157,7 +157,7 @@ function snapshotBeforeRestore({ o, plan, bid, backupRoot, lifecyclePaths, scope
     });
     snapshot = createFileBackup({ operation: 'pre-rollback', set, backupRoot, repoRoot: SCRIPT_DIR, sourceCommit: commit,
       version: pkg.version, date: new Date(), restores: bid });
-  } catch (error: any) {
+  } catch (error     ) {
     if (!(error instanceof BackupError)) throw error;
     console.error(`[ERROR] Pre-rollback snapshot failed, nothing was restored: ${error.message}`);
     process.exit(1);

package/src/cli/commands/{self-update.ts → self-update.js}

@@ -3,10 +3,10 @@
 // installed trees match the freshly pulled source.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
 const { execFileSync } = require('node:child_process');
-const { REPO_ROOT } = require('../shared.ts');
-const cmdInstall = require('./install.ts');
+const { REPO_ROOT } = require('../shared.js');
+const cmdInstall = require('./install.js');
 
-function cmdSelfUpdate(o: any): void {
+function cmdSelfUpdate(o     )       {
   console.log('[INFO] Self-update: checking for upstream changes...');
   let pulled = false;
   let fetchOk = false;

package/src/cli/commands/{status.ts → status.js}

@@ -4,35 +4,35 @@
 // scripting).
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
 const path = require('node:path');
-const { resolveTargets, toolDirs } = require('../../install/targets.ts');
-const { resolveContext, printContext } = require('../../install/context.ts');
-const { readInstallManifest } = require('../../install/manifest.ts');
-const { sourceCommit } = require('../../helper/git.ts');
-const { loadRegistry, mcpCapable } = require('../../registry/index.ts');
-const { recordedMcpSelections } = require('../../install/mcp.ts');
-const { pinnedSelections } = require('../../state/lockfile.ts');
-const { readLedger } = require('../../state/index.ts');
-const { verifyLifecycle } = require('../../lifecycle/index.ts');
-const { registryLifecycleView, LIFECYCLE_HARNESSES } = require('../../lifecycle/view.ts');
-const { REPO_ROOT, SCRIPT_DIR, installPaths, scopeOf, scopeSelectionState } = require('../shared.ts');
+const { resolveTargets, toolDirs } = require('../../install/targets.js');
+const { resolveContext, printContext } = require('../../install/context.js');
+const { readInstallManifest } = require('../../install/manifest.js');
+const { sourceCommit } = require('../../helper/git.js');
+const { loadRegistry, mcpCapable } = require('../../registry/index.js');
+const { recordedMcpSelections } = require('../../install/mcp.js');
+const { pinnedSelections } = require('../../state/lockfile.js');
+const { readLedger } = require('../../state/index.js');
+const { verifyLifecycle } = require('../../lifecycle/index.js');
+const { registryLifecycleView, LIFECYCLE_HARNESSES } = require('../../lifecycle/view.js');
+const { REPO_ROOT, SCRIPT_DIR, installPaths, scopeOf, scopeSelectionState } = require('../shared.js');
 
-function cmdStatus(o: any): void {
+function cmdStatus(o     )       {
   const targets = resolveTargets(o.targets);
   const scope = scopeOf(o);
   const dirs = toolDirs(scope);
   const lifecyclePaths = installPaths(scope);
-  const ctx: any = resolveContext({ repoRoot: REPO_ROOT, targets, dirs, sourceCommit: sourceCommit(SCRIPT_DIR), ...scope });
+  const ctx      = resolveContext({ repoRoot: REPO_ROOT, targets, dirs, sourceCommit: sourceCommit(SCRIPT_DIR), ...scope });
   const manifest = readInstallManifest({ scopeRoot: lifecyclePaths.scopeRoot });
-  let registryView: any = null;
+  let registryView      = null;
   // Per MCP-capable target, the servers doflow.lock records for it, or null when it records none.
-  let mcpSelections: any = null;
+  let mcpSelections      = null;
   try {
     const registry = loadRegistry({ repoRoot: REPO_ROOT });
     const { lock, ledger, manifestServers } = scopeSelectionState(scope);
     const recorded = recordedMcpSelections({ registry, lock, ledger, targets, manifestServers });
     const rows = pinnedSelections(lock);
-    mcpSelections = Object.fromEntries(targets.filter((harness: string) => mcpCapable(registry, harness))
-      .map((harness: string) => [harness, rows[harness] ?? null]));
+    mcpSelections = Object.fromEntries(targets.filter((harness        ) => mcpCapable(registry, harness))
+      .map((harness        ) => [harness, rows[harness] ?? null]));
     registryView = registryLifecycleView({ registry, repoRoot: REPO_ROOT, scope, dirs, targets,
       mcpSelections: recorded.selections, mcpAdoptable: recorded.adoptable, retainedMcpIds: recorded.retainedMcpIds });
     ctx.registry = {
@@ -46,17 +46,17 @@ function cmdStatus(o: any): void {
     // registryView.plan.changes/conflicts across every target — otherwise, e.g., Codex having
     // pending changes when it isn't installed yet would make Claude's line falsely report
     // 'drift-or-pending-change' even though Claude itself has nothing pending.
-    const harnessPlan = (harness: string) => registryView.plan.targets.find((target: any) => target.harness === harness);
+    const harnessPlan = (harness        ) => registryView.plan.targets.find((target     ) => target.harness === harness);
     // Hook-wiring status needs the same general per-harness verification every install/update run
     // already flows through (src/lifecycle's verifyLifecycle) rather than a Codex-only hardcode:
     // it is the one place that can tell 'installed and active' apart from 'installed but pending a
     // prerequisite' (Codex's unreviewed trust, Gemini's live hook-trust check) from 'absent'.
     const verification = verifyLifecycle({ plan: registryView.plan, adapters: registryView.adapters, context: { registry } });
-    const hooksFor = (harness: string) => verification.verifications.find((item: any) => item.harness === harness)?.hookWiring ?? null;
-    const harnessStatus = (harness: string) => {
+    const hooksFor = (harness        ) => verification.verifications.find((item     ) => item.harness === harness)?.hookWiring ?? null;
+    const harnessStatus = (harness        ) => {
       const target = harnessPlan(harness);
       if (!target) return { status: 'verified', resources: [], errors: [], hooks: hooksFor(harness) };
-      const resources = registryView.ledger.resources.filter((resource: any) => resource.harness === harness);
+      const resources = registryView.ledger.resources.filter((resource     ) => resource.harness === harness);
       // A conflict is reported first: a user-owned file in the way is not the same as nothing being
       // installed. With no conflict, a harness the ledger owns nothing of was never installed: its
       // whole plan is pending, which is not drift from an installation that does not exist.
@@ -75,7 +75,7 @@ function cmdStatus(o: any): void {
     for (const harness of LIFECYCLE_HARNESSES) {
       if (targets.includes(harness)) ctx[harness] = harnessStatus(harness);
     }
-  } catch (error: any) {
+  } catch (error     ) {
     // Status must remain usable for an existing installation even if a local registry is invalid.
     ctx.registry = { status: 'invalid', error: error.message };
   }
@@ -85,7 +85,7 @@ function cmdStatus(o: any): void {
     return;
   }
 
-  const hookLine = (label: string, hooks: any) => {
+  const hookLine = (label        , hooks     ) => {
     if (!hooks || hooks.status === 'absent') return null;
     const prereqSuffix = hooks.prerequisites.length ? ` (unmet: ${hooks.prerequisites.join(', ')})` : '';
     return `  ${label} hooks: ${hooks.status}${prereqSuffix}`;
@@ -104,7 +104,7 @@ function cmdStatus(o: any): void {
   console.log(`  Last backup ID:       ${manifest.backupId}`);
   console.log(`  Script version:       ${manifest.scriptVersion}`);
   if (mcpSelections && Object.keys(mcpSelections).length) {
-    const recordedText = (ids: any) => (ids === null ? 'not recorded' : ids.join(', ') || 'none');
+    const recordedText = (ids     ) => (ids === null ? 'not recorded' : ids.join(', ') || 'none');
     console.log(`  MCP selections:       ${Object.entries(mcpSelections).map(([harness, ids]) => `${harness} ${recordedText(ids)}`).join('; ')}`);
   }
   // Printed in the same order LIFECYCLE_HARNESSES declares, so every wired harness gets a line —

package/src/cli/commands/{tools.ts → tools.js}

@@ -2,34 +2,34 @@
 // `doflow tools` — inspect or manage registered external tools (status/install/update/uninstall).
 // --force is deliberately unavailable: every mutation gets its own confirmation.
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
-const { confirm, promptLine } = require('../../helper/prompt.ts');
-const { loadRegistry } = require('../../registry/index.ts');
-const { commandText, planToolLifecycle, executeToolLifecycle } = require('../../install/tool-lifecycle.ts');
-const { REPO_ROOT } = require('../shared.ts');
+const { confirm, promptLine } = require('../../helper/prompt.js');
+const { loadRegistry } = require('../../registry/index.js');
+const { commandText, planToolLifecycle, executeToolLifecycle } = require('../../install/tool-lifecycle.js');
+const { REPO_ROOT } = require('../shared.js');
 
-function selectExternalTools(registry: any, o: any): any[] {
+function selectExternalTools(registry     , o     )        {
   let requested = o.tools;
   if (!requested) {
     const interactive = Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY);
     if (!interactive) throw new Error("doflow tools: --tool is required when stdin is not an interactive terminal");
     const answer = promptLine('Select tools (rtk, graphify; comma-separated): ');
-    requested = answer.split(',').map((item: string) => item.trim()).filter(Boolean);
+    requested = answer.split(',').map((item        ) => item.trim()).filter(Boolean);
   }
   if (!requested.length) throw new Error('doflow tools: select at least one tool');
-  const available = new Set(registry.externalTools.map((tool: any) => tool.id));
+  const available = new Set(registry.externalTools.map((tool     ) => tool.id));
   const unknown = [...new Set(requested)].filter((id) => !available.has(id));
   if (unknown.length) throw new Error(`doflow tools: unknown tool id(s): ${unknown.join(', ')}; expected: ${[...available].join(', ')}`);
   const wanted = new Set(requested);
-  return registry.externalTools.filter((tool: any) => wanted.has(tool.id));
+  return registry.externalTools.filter((tool     ) => wanted.has(tool.id));
 }
 
-function toolJsonResults(plan: any, execution: any = null): any[] {
-  const executed = new Map((execution?.results || []).map((result: any) => [result.tool, result]));
-  return plan.tools.map((item: any) => ({
+function toolJsonResults(plan     , execution      = null)        {
+  const executed = new Map((execution?.results || []).map((result     ) => [result.tool, result]));
+  return plan.tools.map((item     ) => ({
     tool: item.tool.id,
     state: item.state,
     inspections: item.inspections,
-    prerequisites: item.prerequisites.map((prerequisite: any) => ({ name: prerequisite.name, available: prerequisite.available })),
+    prerequisites: item.prerequisites.map((prerequisite     ) => ({ name: prerequisite.name, available: prerequisite.available })),
     action: item.action,
     result: executed.get(item.tool.id) ?? (item.action.applicable
       ? { tool: item.tool.id, status: 'not-attempted', command: [...item.action.command] }
@@ -37,7 +37,7 @@ function toolJsonResults(plan: any, execution: any = null): any[] {
   }));
 }
 
-function cmdTools(o: any): void {
+function cmdTools(o     )       {
   if (o.force) throw new Error("doflow tools: --force is not supported; each lifecycle command requires its own confirmation");
   if (!['status', 'install', 'update', 'uninstall'].includes(o.action)) {
     throw new Error(`doflow tools: unsupported action '${o.action}'; expected: status, install, update, uninstall`);
@@ -72,12 +72,12 @@ function cmdTools(o: any): void {
 
   const execution = executeToolLifecycle({
     plan,
-    displayCommand: (command: string[], tool: any) => console.error(`[INFO]  ${tool.displayName}: ${commandText(command)}`),
-    confirmCommand: (command: string[], tool: any, action: string) => confirm(`Run ${tool.displayName} ${action}: ${commandText(command)}?`, false),
+    displayCommand: (command          , tool     ) => console.error(`[INFO]  ${tool.displayName}: ${commandText(command)}`),
+    confirmCommand: (command          , tool     , action        ) => confirm(`Run ${tool.displayName} ${action}: ${commandText(command)}?`, false),
   });
   // Keep processing independent tools so the user receives every outcome, but make a confirmed
   // command failure visible to scripts and CI through the process result as well as the report.
-  const hasFailures = execution.results.some((result: any) => result.status === 'failed');
+  const hasFailures = execution.results.some((result     ) => result.status === 'failed');
   if (o.json) {
     console.log(JSON.stringify({ action: o.action, dryRun: false, results: toolJsonResults(plan, execution) }, null, 2));
     if (hasFailures) process.exitCode = 1;

package/src/cli/commands/{update.ts → update.js}

@@ -4,30 +4,30 @@
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): run directly by Node native type-stripping.
 const os = require('node:os');
 const path = require('node:path');
-const { resolveTargets, toolDirs } = require('../../install/targets.ts');
-const { resolveContext, printContext } = require('../../install/context.ts');
-const { DEFAULT_BACKUP_RETENTION, createFileBackup, applyRetention, retentionNote } = require('../../install/backup.ts');
-const { backupSetFromPlan } = require('../../install/backup-set.ts');
-const { ledgerPath } = require('../../state/index.ts');
-const { backupStep, reportBackup, printBackupDryRun, applyBackupRetention } = require('./install.ts');
-const { writeManifest, readInstallManifest } = require('../../install/manifest.ts');
-const { confirm } = require('../../helper/prompt.ts');
-const { sourceCommit } = require('../../helper/git.ts');
-const { chmodHooksExecutable } = require('../../helper/settings-scope.ts');
-const { resolveMcpSelections } = require('../../install/mcp.ts');
-const { loadRegistry } = require('../../registry/index.ts');
-const { storageAfterInstall } = require('../../runtime/storage/upkeep.ts');
-const { applyLifecycle, recordMcpOwnership, retentionSummary } = require('../../lifecycle/index.ts');
+const { resolveTargets, toolDirs } = require('../../install/targets.js');
+const { resolveContext, printContext } = require('../../install/context.js');
+const { DEFAULT_BACKUP_RETENTION, createFileBackup, applyRetention, retentionNote } = require('../../install/backup.js');
+const { backupSetFromPlan } = require('../../install/backup-set.js');
+const { ledgerPath } = require('../../state/index.js');
+const { backupStep, reportBackup, printBackupDryRun, applyBackupRetention } = require('./install.js');
+const { writeManifest, readInstallManifest } = require('../../install/manifest.js');
+const { confirm } = require('../../helper/prompt.js');
+const { sourceCommit } = require('../../helper/git.js');
+const { chmodHooksExecutable } = require('../../helper/settings-scope.js');
+const { resolveMcpSelections } = require('../../install/mcp.js');
+const { loadRegistry } = require('../../registry/index.js');
+const { storageAfterInstall } = require('../../runtime/storage/upkeep.js');
+const { applyLifecycle, recordMcpOwnership, retentionSummary } = require('../../lifecycle/index.js');
 const {
   codexScope, registryLifecycleView, printRegistryLifecycle, printPlanNotices, assertSafeRegistryPlan,
   lockDocument, lockDelta, recordLock,
-} = require('../../lifecycle/view.ts');
+} = require('../../lifecycle/view.js');
 const {
   REPO_ROOT, SCRIPT_DIR, pkg, scopeOf, installPaths, reportRetiredMcp, scopeSelectionState, printMcpSelection, plannedMcpSelections,
   printRecordedMcpOwnership, buildAdapterRegistry, refuseHomeRootedProject, holdRunLock, checkpointRunLock,
-} = require('../shared.ts');
+} = require('../shared.js');
 
-function cmdUpdate(o: any): void {
+function cmdUpdate(o     )       {
   refuseHomeRootedProject(o, 'update');
   const targets = resolveTargets(o.targets);
   const scope = scopeOf(o);
@@ -51,7 +51,7 @@ function cmdUpdate(o: any): void {
     // One lifecycle view across every requested target — computed unconditionally (not only under
     // --dry-run) so its safety gate and its plan are the exact same object the real apply below uses.
     const lifecycleView = registryLifecycleView({ registry, repoRoot: REPO_ROOT, scope, dirs, targets,
-      mcpSelections: selection.selections, mcpAdoptable: selection.adoptable, retainedMcpIds: selection.retainedMcpIds,
+      mcpSelections: selection.selections, mcpAdoptable: selection.adoptable, retainedMcpIds: selection.retainedMcpIds, operation: 'update',
       force: o.force, permissions: o.permissions === true, statusline: o.statusline === true });
     if (!lifecycleView.plan.safe) { assertSafeRegistryPlan(lifecycleView); return; }
     printMcpSelection(lifecycleView, selection.sources, { requested: o.mcp, prefix: o.dryRun ? '[DRY]' : '[INFO]' });
@@ -69,7 +69,7 @@ function cmdUpdate(o: any): void {
     const keep = o.prune ?? DEFAULT_BACKUP_RETENTION;
 
     const lockArgs = scope.global ? { scope: 'global', homeDir: os.homedir() } : { scope: 'project', projectRoot: path.resolve(scope.projectRoot) };
-    const nextLock = (ledgerAfter: any) => lockDocument({
+    const nextLock = (ledgerAfter     ) => lockDocument({
       registry, scope: codexScope(scope), scopeRoot: scope.global ? os.homedir() : path.resolve(scope.projectRoot),
       previous: lock, ledger: ledgerAfter, plannedTargets: targets, mcpSelections: plannedMcpSelections(lifecycleView),
     });
@@ -136,7 +136,7 @@ function cmdUpdate(o: any): void {
       stateRoot: lifecycleView.stateRoot, ledger: lifecycleView.ledger });
     for (const target of lifecycleView.plan.targets) {
       if (target.skipped || !target.changes.length) continue;
-      const owned = result.ledger.resources.filter((resource: any) => resource.harness === target.harness).length;
+      const owned = result.ledger.resources.filter((resource     ) => resource.harness === target.harness).length;
       console.log(`[INFO] ${target.harness}: lifecycle verified (${owned} owned resource(s))`);
     }
     printPlanNotices(lifecycleView);

package/src/cli/{index.ts → index.js}

@@ -11,25 +11,25 @@
 const {
   handleCapabilitiesCommand, handleReadinessCommand, handleEvidenceCommand,
   EVIDENCE_SCORE_FIELDS, scoreFieldRefusal,
-} = require('../runtime/cli.ts');
-const { pkg } = require('./shared.ts');
-const { VALID: VALID_TARGETS, DEFAULT_TARGETS } = require('../install/targets.ts');
-const { dispatchRuntimeCommand } = require('./runtime-commands.ts');
-const { usageError } = require('../runtime/cli-result.ts');
+} = require('../runtime/cli.js');
+const { pkg } = require('./shared.js');
+const { VALID: VALID_TARGETS, DEFAULT_TARGETS } = require('../install/targets.js');
+const { dispatchRuntimeCommand } = require('./runtime-commands.js');
+const { usageError } = require('../runtime/cli-result.js');
 
-const cmdInstall = require('./commands/install.ts');
-const cmdUpdate = require('./commands/update.ts');
-const cmdReconcile = require('./commands/reconcile.ts');
-const cmdRemove = require('./commands/remove.ts');
-const cmdStatus = require('./commands/status.ts');
-const cmdTools = require('./commands/tools.ts');
-const cmdListBackups = require('./commands/list-backups.ts');
-const cmdRollback = require('./commands/rollback.ts');
-const cmdSelfUpdate = require('./commands/self-update.ts');
+const cmdInstall = require('./commands/install.js');
+const cmdUpdate = require('./commands/update.js');
+const cmdReconcile = require('./commands/reconcile.js');
+const cmdRemove = require('./commands/remove.js');
+const cmdStatus = require('./commands/status.js');
+const cmdTools = require('./commands/tools.js');
+const cmdListBackups = require('./commands/list-backups.js');
+const cmdRollback = require('./commands/rollback.js');
+const cmdSelfUpdate = require('./commands/self-update.js');
 
 /** The installer command surface, written down once. The runtime verbs are dispatched separately
  * (see ./runtime-commands) because their namespace is owned by the doflow-run verb table. */
-const COMMANDS: Record<string, (o: any) => any> = {
+const COMMANDS                                  = {
   install: cmdInstall,
   update: cmdUpdate,
   reconcile: cmdReconcile,
@@ -42,15 +42,15 @@ const COMMANDS: Record<string, (o: any) => any> = {
 };
 
 /** "skip all backup protection" must be an explicit, deliberate choice, never a default combo. */
-function assertNoBackupRequiresForce(o: any): void {
+function assertNoBackupRequiresForce(o     )       {
   if (o.noBackup && !o.force) {
     console.error('doflow: --no-backup skips all backup protection and requires --force');
     process.exit(1);
   }
 }
 
-function parseArgs(argv: string[]): any {
-  const o: any = { cmd: null, positional: [], targets: [], mcp: null, dryRun: false, force: false, adopt: false,
+function parseArgs(argv          )      {
+  const o      = { cmd: null, positional: [], targets: [], mcp: null, dryRun: false, force: false, adopt: false,
     noBackup: false, prune: null, global: false, json: false, help: false, version: false,
     tools: null, action: 'status', days: null, slug: null,
     // Explicitly null, not absent. `handleReadinessCommand` declares defaults of `'feature'` and
@@ -70,6 +70,8 @@ function parseArgs(argv: string[]): any {
       case '--permissions': o.permissions = true; break;
       case '--statusline': o.statusline = true; break;
       case '--json': o.json = true; break;
+      case '--bare': o.bare = true; break;
+      case '--no-record': o.noRecord = true; break;
       case '--check': o.check = true; break;
       // decision --action list: every decision by id, not just the live ones.
       case '--all': o.all = true; break;
@@ -136,6 +138,7 @@ function parseArgs(argv: string[]): any {
         o.node = val; i++; break;
       }
       case '--forced': o.forced = true; break;
+      case '--absence': o.absence = true; break;
       case '--decision': {
         const val = argv[i + 1];
         if (val === undefined || val.startsWith('-')) { console.error(`doflow: ${a} requires a value`); process.exit(1); }
@@ -258,6 +261,9 @@ const RUNTIME_STRING_FLAGS = new Map([
                                        // change scope, <path>[,<path>...], unioned with the plan's bound
   ['--invariants', 'invariants'],      // readiness: the invariants a refactor must preserve
   ['--objective', 'objective'],        // context-pack
+  ['--mandatory-file', 'mandatoryFile'], // context-pack: caller-supplied mandatory fields
+  ['--max-bytes', 'maxBytes'],         // context-pack: per-call cap in bytes
+  ['--expand', 'expand'],              // context-pack: pointer id to expand
   ['--stage-id', 'stageId'],           // research-request: active feature stage
   ['--question', 'question'],           // research-request: external question
   ['--blocking', 'blocking'],           // research-request: true | false
@@ -266,6 +272,7 @@ const RUNTIME_STRING_FLAGS = new Map([
   ['--gap', 'gap'],                     // research-request: unresolved reason
   ['--stage', 'stage'],                // retrieval-plan: the stage id declaring the plan;
                                        // outcome: the stage writing it, refused unless terminal
+  ['--status', 'attemptStatus'],       // retrieval-plan: attempt status (EMPTY|UNREACHED|UNVERIFIED)
   ['--state', 'state'],                // outcome: the terminal state being recorded
   ['--result', 'result'],              // orchestrate complete-stage: the stage's own outcome, passed | failed (omit → unverified)
   // outcome: the verdicts the run saw, stated by it and validated against the vocabulary the
@@ -281,6 +288,8 @@ const RUNTIME_STRING_FLAGS = new Map([
   ['--owner', 'owner'],                // brief-tools: the agent type the brief is for
   ['--tier', 'tier'],                  // brief-tools: the task line's tier (light | standard | frontier)
   ['--harness', 'harness'],            // brief-tools: the harness the brief is for
+  ['--policy', 'policy'],              // enforcement: lifecycle policy id
+  ['--profile', 'profile'],             // enforcement: coverage profile filter
   ['--heading-level', 'headingLevel'], // brief-tools: 2 (default) or 3
   ['--tasks', 'tasks'],               // brief-tools: comma-separated plan task ids for tier advice
   ['--plan-path', 'planPath'],         // verify: a feature plan.md whose doflow-verification
@@ -324,12 +333,12 @@ const RUNTIME_INT_FLAGS = new Map([
  *
  * Returns the new loop index, or null when `arg` is not a runtime flag.
  */
-function parseRuntimeFlag(arg: string, argv: string[], i: number, o: any): number | null {
+function parseRuntimeFlag(arg        , argv          , i        , o     )                {
   const eq = arg.indexOf('=');
   const name = eq === -1 ? arg : arg.slice(0, eq);
   // A score-shaped flag is refused by name rather than falling through to "unknown flag", which
   // reads as "not built yet" and invites someone to build it. The name set and the reason both
-  // come from the evidence write boundary (src/runtime/cli.ts), so argv and a --batch JSON file
+  // come from the evidence write boundary (src/runtime/cli.js), so argv and a --batch JSON file
   // are refused by one rule with two enforcement points rather than two rules.
   const camel = name.replace(/^--/, '').replace(/-([a-z])/g, (_, c) => c.toUpperCase());
   if (EVIDENCE_SCORE_FIELDS.has(camel)) { console.error(`doflow: ${scoreFieldRefusal(name)}`); process.exit(2); }
@@ -337,7 +346,7 @@ function parseRuntimeFlag(arg: string, argv: string[], i: number, o: any): numbe
   const key = RUNTIME_STRING_FLAGS.get(name) || RUNTIME_LIST_FLAGS.get(name) || RUNTIME_INT_FLAGS.get(name);
   if (!key) return null;
 
-  let value: any = inline;
+  let value      = inline;
   let next = i;
   if (value === null) {
     value = argv[i + 1];
@@ -363,7 +372,7 @@ function parseRuntimeFlag(arg: string, argv: string[], i: number, o: any): numbe
     // spelling's comma-splitting, this generic path handling both spellings but never splitting),
     // so `--exclude=bin,src` silently excluded nothing while `--exclude bin,src` worked. One path,
     // both spellings, same behavior now.
-    const parts = name === '--exclude' ? value.split(',').map((s: string) => s.trim()).filter(Boolean) : [value];
+    const parts = name === '--exclude' ? value.split(',').map((s        ) => s.trim()).filter(Boolean) : [value];
     (o[key] = o[key] || []).push(...parts);
   } else if (name === '--evidence-id' && o.cmd === 'research-request') {
     (o.evidenceIds = o.evidenceIds || []).push(value);
@@ -388,12 +397,13 @@ Commands:
   self-update          git pull + reinstall
   tools                Inspect or manage registered external tools
   capabilities         Show registered abstract capabilities and resolved providers
+  enforcement          Report lifecycle policy enforcement coverage (--harness, --policy)
   doctor               System health and capability smoke check diagnostics
   readiness            Evaluate task readiness contract (--task-class, --task-id, both required)
   evidence             Record a stage's evidence batch, or inspect what is recorded (--task-id)
   claim                Record a claim, link evidence to it, or list them (--task-id, --action)
   context-pack         Compile a task's evidence and claims into a context block (--task-id)
-  retrieval-plan       Declare a stage's information needs, then report every declared item
+  retrieval-plan       Declare a stage's information needs, attempt retrieval, then report every declared item
   outcome              Record a task's terminal state with its basis, or show it (--task-id)
   classify             Validate a proposed task class and return its workflow (--task-class)
   workflow             Resolve a task class to its stages, gates and readiness templates
@@ -453,7 +463,7 @@ Runtime verb arguments (accept --flag value or --flag=value):
       --task-class     classify, workflow, readiness, context-pack, outcome --action record
       --task-id        readiness, evidence, claim, context-pack, retrieval-plan, outcome, verify, advise
       --action         claim: list|add|link|retract|supersede · evidence: list|add|supersede
-                       verify: report|contract · retrieval-plan: declare|report
+                       verify: report|contract · retrieval-plan: declare|report|attempt
                        outcome: record|show · advise: ask|outcome|configure · tools: see above
                        followup: add|list|take|settle|promote|report
                        task-attempt: claim|finish|release|status
@@ -470,7 +480,9 @@ Runtime verb arguments (accept --flag value or --flag=value):
       --statement, --claim-id,
       --evidence-id, --relation             claim
       --kind, --provenance, --provider,
-      --capability, --locator, --content    evidence --action add (one item)
+      --capability, --locator, --content,
+      --absence                             evidence --action add (one item)
+      --need <intent>                       evidence --action add (bind evidence to retrieval needs)
       --batch <file|->                      evidence --action add (a stage's JSON batch)
       --evidence-id, --replaced-by          evidence --action supersede (retire one item, point
                                             forward to the item that replaces it)
@@ -480,7 +492,7 @@ Runtime verb arguments (accept --flag value or --flag=value):
                                             evidence establishes; reported back as such
       --objective                           context-pack
       --need <intent[,intent]>,
-      --stage                               retrieval-plan (--need is repeatable), outcome
+      --stage, --status                     retrieval-plan (--need is repeatable), outcome
       --mcp-outcome <server>=<outcome>      orchestrate --action handoff, repeatable: used | nothing-usable |
                                             skipped:<reason> | unavailable (a server left out only warns)
       --state <COMPLETED|BLOCKED|
@@ -527,14 +539,14 @@ External tools:
 const COMMAND_NAMES = new Set([...Object.keys(COMMANDS), ...[...HELP.matchAll(/^  ([a-z][a-z-]*) {2,}\S/gm)].map((m) => m[1])]);
 
 /** `name` when it is one of DoFlow's own command names, else `unknown`. */
-function commandName(name: any): string { return typeof name === 'string' && COMMAND_NAMES.has(name) ? name : 'unknown'; }
+function commandName(name     )         { return typeof name === 'string' && COMMAND_NAMES.has(name) ? name : 'unknown'; }
 
 /**
  * Run one CLI invocation. Same behavior as the pre-extraction monolith's main(): --version and
  * --help answer first, --no-backup-without-force is refused, then the command resolves either
  * through the installer table above or through the runtime-verb dispatcher.
  */
-async function main(argv: string[]): Promise<any> {
+async function main(argv          )               {
   const o = parseArgs(argv);
   if (o.version) { console.log(pkg.version); return; }
   if (o.help || !o.cmd) { console.log(HELP); return; }
@@ -546,11 +558,11 @@ async function main(argv: string[]): Promise<any> {
     const handler = COMMANDS[o.cmd];
     if (handler) return handler(o);
     return await dispatchRuntimeCommand(o);
-  } catch (error: any) {
+  } catch (error     ) {
     // Recorded silently when it is a programming error (IC-016); the output and exit status below
     // are the same whether or not anything was written.
     // Required here, not at load, so a CLI whose failure modules cannot be loaded still runs as today.
-    try { require('../runtime/failure/capture.ts').captureError(error, { command: commandName(o.cmd), exit: 1 }); } catch { /* best-effort */ }
+    try { require('../runtime/failure/capture.js').captureError(error, { command: commandName(o.cmd), exit: 1 }); } catch { /* best-effort */ }
     // A lifecycle apply/remove can throw mid-mutation (fs error, TOCTOU ownership mismatch on a
     // multi-harness run) — surface a clean, actionable message instead of a raw stack trace, and
     // point at the recovery record applyLifecycle already wrote before rethrowing.
@@ -565,4 +577,4 @@ async function main(argv: string[]): Promise<any> {
   }
 }
 
-module.exports = { main, COMMANDS, commandName };
+module.exports = { main, COMMANDS, commandName, parseArgs };