@khoavu882/doflow 2.0.0-beta.3 → 2.0.0-beta.5

package/src/install/{manifest.ts → manifest.js}

@@ -6,10 +6,10 @@
 //
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): authored as `.ts`, run directly by Node
 // native type-stripping — no build step, no runtime dependency. Body stays CommonJS so a `.js`
-// caller's `require('../install/manifest.ts')` keeps working while the tree is still `.js`.
+// caller's `require('../install/manifest.js')` keeps working while the tree is still `.js`.
 const fs = require('node:fs');
 const path = require('node:path');
-const { sourceCommit: gitSourceCommit } = require('../helper/git.ts');
+const { sourceCommit: gitSourceCommit } = require('../helper/git.js');
 
 // Explicit migration bridge: pre-registry installations stored this record beneath .claude.
 // Lifecycle commands use the scope-neutral .doflow location; only the neutral-state importer
@@ -17,27 +17,27 @@ const { sourceCommit: gitSourceCommit } = require('../helper/git.ts');
 const LEGACY_MANIFEST_FILE_NAME = '.install-manifest.json';
 const MANIFEST_FILE_NAME = LEGACY_MANIFEST_FILE_NAME;
 
-function manifestPath(claudeDir: string): string {
+function manifestPath(claudeDir        )         {
   return path.join(claudeDir, MANIFEST_FILE_NAME);
 }
 
-function canonicalManifestPath(scopeRoot: string): string {
+function canonicalManifestPath(scopeRoot        )         {
   return path.join(path.resolve(scopeRoot), '.doflow', MANIFEST_FILE_NAME);
 }
 
-interface WriteManifestInput {
-  scopeRoot?: string;
-  claudeDir?: string;
-  scriptVersion: string;
-  operation: string;
-  repoRoot: string;
-  backupId?: string;
-  tools: string[];
-  date: Date;
-  dryRun?: boolean;
-  sourceCommit?: string;
-  managedResources?: object[];
-}
+                              
+                     
+                     
+                        
+                    
+                   
+                    
+                  
+             
+                   
+                        
+                              
+ 
 
 /**
  * `sourceCommit` lets a caller (bin/doflow.js) pass an already-resolved commit instead of this
@@ -48,16 +48,16 @@ interface WriteManifestInput {
  * for fine-grained Codex resources. Each record uses {target,scope,kind,identity,sourceVersion,
  * fingerprint,selection,recoveryPoint}. Omit it to preserve a ledger written by a newer command.
  */
-function writeManifest({ scopeRoot, claudeDir, scriptVersion, operation, repoRoot, backupId = '', tools, date, dryRun = false, sourceCommit, managedResources }: WriteManifestInput): string {
+function writeManifest({ scopeRoot, claudeDir, scriptVersion, operation, repoRoot, backupId = '', tools, date, dryRun = false, sourceCommit, managedResources }                    )         {
   if (!scopeRoot && !claudeDir) throw new Error('scopeRoot is required for lifecycle metadata');
-  const file = scopeRoot ? canonicalManifestPath(scopeRoot) : manifestPath(claudeDir as string);
+  const file = scopeRoot ? canonicalManifestPath(scopeRoot) : manifestPath(claudeDir          );
   if (dryRun) return file;
 
   // Preserve per-tool last_updated for tools NOT part of this operation (matches sync.sh's
   // incremental jq merge, which only touches the tools passed to write_manifest).
-  let existingTools: Record<string, any> = {};
-  let existingMcpServers: any;
-  let existingManagedResources: any;
+  let existingTools                      = {};
+  let existingMcpServers     ;
+  let existingManagedResources     ;
   const existingFile = file;
   if (existingFile && fs.existsSync(existingFile)) {
     try {
@@ -72,10 +72,10 @@ function writeManifest({ scopeRoot, claudeDir, scriptVersion, operation, repoRoo
     } catch { /* start fresh */ }
   }
   const ts = date.toISOString().replace(/\.\d+Z$/, 'Z');
-  const toolsOut: Record<string, any> = { ...existingTools };
+  const toolsOut                      = { ...existingTools };
   for (const t of tools) toolsOut[t] = { installed: true, last_updated: ts };
 
-  const manifest: any = {
+  const manifest      = {
     script_version: scriptVersion,
     last_operation: operation,
     last_run: ts,
@@ -102,7 +102,7 @@ function writeManifest({ scopeRoot, claudeDir, scriptVersion, operation, repoRoo
 }
 
 /** null if no manifest yet. */
-function readManifestFile(file: string): any {
+function readManifestFile(file        )      {
   if (!fs.existsSync(file)) return null;
   try {
     const m = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -129,13 +129,13 @@ function readManifestFile(file: string): any {
 }
 
 /** Read only the canonical scope-neutral manifest used by lifecycle commands. */
-function readInstallManifest({ scopeRoot }: { scopeRoot: string }): any {
+function readInstallManifest({ scopeRoot }                       )      {
   if (!scopeRoot) throw new Error('scopeRoot is required');
   return readManifestFile(canonicalManifestPath(scopeRoot));
 }
 
 /** Read only the legacy path; neutral-state migration uses this deliberately. */
-function readManifest(claudeDir: string): any {
+function readManifest(claudeDir        )      {
   return readManifestFile(manifestPath(claudeDir));
 }
 

package/src/install/{mcp.ts → mcp.js}

@@ -5,24 +5,24 @@
 //
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): authored as `.ts`, run directly by Node
 // native type-stripping — no build step, no runtime dependency. Body stays CommonJS so a `.js`
-// caller's `require('../install/mcp.ts')` keeps working while the tree is still `.js`. The
+// caller's `require('../install/mcp.js')` keeps working while the tree is still `.js`. The
 // `../registry` and `../state/lockfile` requires stay bare while those modules are still `.js`.
-const { readSyncBlocking } = require('../helper/prompt.ts');
-const { selectMcpServers, nativeMcpCatalog, mcpCapable } = require('../registry/index.ts');
-const { pinnedSelections } = require('../state/lockfile.ts');
+const { readSyncBlocking } = require('../helper/prompt.js');
+const { selectMcpServers, nativeMcpCatalog, mcpCapable } = require('../registry/index.js');
+const { pinnedSelections } = require('../state/lockfile.js');
 
 const ESC = String.fromCharCode(27);
 const CTRL_C = String.fromCharCode(3);
 
 /** `registry` is a loaded registry (src/registry#loadRegistry); returns server names in registry
  * declaration order. */
-function readAllServers(registry: any): string[] {
+function readAllServers(registry     )           {
   return nativeMcpCatalog(selectMcpServers(registry)).allServers;
 }
 
 /** Parse `--mcp`: `all` and `none` are keywords that cannot be mixed with names or each other, an
  * empty list and an unknown name are errors, names are deduplicated. `null` when the flag is absent. */
-function parseMcpFlag(requested: string[] | undefined, catalogIds: string[]): string[] | null {
+function parseMcpFlag(requested                      , catalogIds          )                  {
   if (!requested) return null;
   const keywords = requested.filter((s) => s === 'all' || s === 'none');
   if (keywords.length) {
@@ -44,27 +44,27 @@ function parseMcpFlag(requested: string[] | undefined, catalogIds: string[]): st
   return [...new Set(requested)];
 }
 
-const holdsRows = (ledger: any, harness: string) => (ledger?.resources ?? []).some((row: any) => row.harness === harness);
+const holdsRows = (ledger     , harness        ) => (ledger?.resources ?? []).some((row     ) => row.harness === harness);
 
 /** Ids of `lists` that the catalog still declares, as one union in registry order. */
-const catalogUnion = (catalogIds: string[], lists: string[][]) => catalogIds.filter((id) => lists.some((ids) => ids.includes(id)));
+const catalogUnion = (catalogIds          , lists            ) => catalogIds.filter((id) => lists.some((ids) => ids.includes(id)));
 
 /** 1.18.0 wrote lock rows only for claude and codex, and only non-empty ones. Any other row was
  * written by a later run, which already settled which of that harness's entries are DoFlow's. */
 const LEGACY_LOCK_HARNESSES = ['claude', 'codex'];
 
-function settledByLaterRun(rows: Record<string, string[]>, harness: string): boolean {
+function settledByLaterRun(rows                          , harness        )          {
   return harness in rows && (!LEGACY_LOCK_HARNESSES.includes(harness) || rows[harness].length === 0);
 }
 
 /** The servers a 1.18.0 install recorded writing for this harness, from state no later run writes:
  * the manifest's MCP list, Antigravity's rows that carry no fingerprint, and Copilot's whole-map
  * registration row, which covers the manifest's list or, with none, the catalog 1.18.0 wrote. */
-function legacyRecordedIds({ catalogIds, ledger, harness, manifestServers }: { catalogIds: string[]; ledger: any; harness: string; manifestServers: string[] | null | undefined }): string[] {
-  const rows = (ledger?.resources ?? []).filter((row: any) => row.harness === harness);
+function legacyRecordedIds({ catalogIds, ledger, harness, manifestServers }                                                                                                      )           {
+  const rows = (ledger?.resources ?? []).filter((row     ) => row.harness === harness);
   const ids = [...(manifestServers ?? [])];
   for (const row of rows) if (row.kind === 'mcp-server' && (row.fingerprint ?? null) === null) ids.push(row.identity);
-  if (!manifestServers && rows.some((row: any) => row.ownershipIdentity === `${harness}:mcp:registration`)) ids.push(...catalogIds);
+  if (!manifestServers && rows.some((row     ) => row.ownershipIdentity === `${harness}:mcp:registration`)) ids.push(...catalogIds);
   return catalogUnion(catalogIds, [ids]);
 }
 
@@ -72,7 +72,7 @@ function legacyRecordedIds({ catalogIds, ledger, harness, manifestServers }: { c
  * only what a 1.18.0 install recorded for a harness the ledger holds, and only until a later run
  * has recorded the harness's own selection. An entry a user wrote is never adoptable merely because
  * DoFlow installed something else for that harness. Retired ids are dropped. */
-function adoptableMcpIds({ registry, lock, ledger, harnesses, manifestServers = null }: { registry: any; lock: any; ledger: any; harnesses: string[]; manifestServers?: string[] | null }): Record<string, string[]> {
+function adoptableMcpIds({ registry, lock, ledger, harnesses, manifestServers = null }                                                                                                   )                           {
   const catalogIds = readAllServers(registry);
   const rows = pinnedSelections(lock);
   return Object.fromEntries(harnesses.filter((harness) => mcpCapable(registry, harness)).map((harness) => {
@@ -83,7 +83,7 @@ function adoptableMcpIds({ registry, lock, ledger, harnesses, manifestServers =
 
 /** Servers another harness of this scope still has recorded: the union of the lock rows of the lock's
  * harnesses that are not targeted, registry order. */
-function retainedMcpIds(catalogIds: string[], rows: Record<string, string[]>, targets: string[]): string[] {
+function retainedMcpIds(catalogIds          , rows                          , targets          )           {
   return catalogUnion(catalogIds, Object.entries(rows).filter(([harness]) => !targets.includes(harness)).map(([, ids]) => ids));
 }
 
@@ -100,26 +100,26 @@ function retainedMcpIds(catalogIds: string[], rows: Record<string, string[]>, ta
  */
 function resolveMcpSelections({
   cmd, requested, targets, registry, lock, ledger, manifestServers = null, interactive = false, promptFn, onStale,
-}: any): any {
+}     )      {
   const catalogIds = readAllServers(registry);
   const flagged = parseMcpFlag(requested, catalogIds);
   const rows = pinnedSelections(lock);
-  const capable = targets.filter((harness: string) => mcpCapable(registry, harness));
-  const retired = new Set<string>();
-  const known = (ids: string[]) => {
+  const capable = targets.filter((harness        ) => mcpCapable(registry, harness));
+  const retired = new Set        ();
+  const known = (ids          ) => {
     for (const id of ids) if (!catalogIds.includes(id)) retired.add(id);
     return catalogUnion(catalogIds, [ids]);
   };
 
-  let prompted: string[] | null = null;
+  let prompted                  = null;
   if (!flagged && cmd === 'install' && interactive && capable.length) {
-    const recorded = capable.filter((harness: string) => harness in rows).map((harness: string) => rows[harness]);
+    const recorded = capable.filter((harness        ) => harness in rows).map((harness        ) => rows[harness]);
     const seed = recorded.length ? catalogUnion(catalogIds, recorded.map(known))
       : manifestServers ? known(manifestServers) : [...catalogIds];
     prompted = promptFn(catalogIds, seed);
   }
 
-  const pick = (harness: string): [string[] | string, string] => {
+  const pick = (harness        )                              => {
     if (flagged) return [flagged, 'flag'];
     if (prompted !== null) return [prompted, 'prompt'];
     if (harness in rows) return [known(rows[harness]), 'recorded'];
@@ -127,10 +127,10 @@ function resolveMcpSelections({
     if (manifestServers) return [known(manifestServers), 'manifest'];
     return [[], 'default'];
   };
-  const selections: Record<string, string[] | string> = {};
-  const sources: Record<string, string> = {};
+  const selections                                    = {};
+  const sources                         = {};
   for (const harness of capable) [selections[harness], sources[harness]] = pick(harness);
-  for (const [harness, ids] of Object.entries(rows)) if (!targets.includes(harness)) known(ids as string[]);
+  for (const [harness, ids] of Object.entries(rows)) if (!targets.includes(harness)) known(ids            );
   if (retired.size && onStale) onStale([...retired].sort());
 
   return {
@@ -144,12 +144,12 @@ function resolveMcpSelections({
 /** The selections a scope has recorded, for readers that never prompt (reconcile, status, inventory):
  * each targeted MCP-capable harness's lock row, or 'keep' when the lock has none. Retired ids are
  * dropped silently. */
-function recordedMcpSelections({ registry, lock, ledger, targets, manifestServers = null }: any): any {
+function recordedMcpSelections({ registry, lock, ledger, targets, manifestServers = null }     )      {
   const catalogIds = readAllServers(registry);
   const rows = pinnedSelections(lock);
-  const capable = targets.filter((harness: string) => mcpCapable(registry, harness));
+  const capable = targets.filter((harness        ) => mcpCapable(registry, harness));
   return {
-    selections: Object.fromEntries(capable.map((harness: string) => [harness,
+    selections: Object.fromEntries(capable.map((harness        ) => [harness,
       harness in rows ? catalogUnion(catalogIds, [rows[harness]]) : 'keep'])),
     adoptable: adoptableMcpIds({ registry, lock, ledger, harnesses: capable, manifestServers }),
     retainedMcpIds: retainedMcpIds(catalogIds, rows, targets),
@@ -171,7 +171,7 @@ const KEY = {
  * case, bounded by a deadline for a genuinely unusable fd). Returns the decoded chunk, or null if
  * the fd is unusable.
  */
-function readKeypress(buf: Buffer): string | null {
+function readKeypress(buf        )                {
   try {
     const n = readSyncBlocking(0, buf);
     return buf.toString('utf8', 0, n);
@@ -187,7 +187,7 @@ function readKeypress(buf: Buffer): string | null {
  * the same primitive confirm()/promptLine() already use.
  * Returns selected server names, or null if no usable TTY (caller falls back).
  */
-function promptMcpCheckbox(servers: string[], initialSelected: string[], message = 'Select MCP servers to install:'): string[] | null {
+function promptMcpCheckbox(servers          , initialSelected          , message = 'Select MCP servers to install:')                  {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
   if (servers.length === 0) return [];
 
@@ -195,7 +195,7 @@ function promptMcpCheckbox(servers: string[], initialSelected: string[], message
   let cursor = 0;
   const help = '  (up/down or j/k move, space toggle, a toggle-all, enter confirm)';
 
-  const render = (first: boolean) => {
+  const render = (first         ) => {
     if (!first) process.stdout.write(`${ESC}[${servers.length + 2}A`);
     console.log(message);
     console.log(help);

package/src/install/{paths.ts → paths.js}

@@ -2,7 +2,7 @@
 
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): authored as `.ts`, run directly by Node
 // native type-stripping — no build step, no runtime dependency. Body stays CommonJS so a `.js`
-// caller's `require('../install/paths.ts')` keeps working while the rest of the tree is still `.js`.
+// caller's `require('../install/paths.js')` keeps working while the rest of the tree is still `.js`.
 const path = require('node:path');
 
 const DOFLOW_DIR_NAME = '.doflow';
@@ -19,26 +19,26 @@ const INSTALL_MANIFEST_FILE_NAME = '.install-manifest.json';
 // material and DoFlow no longer owns their lifecycle.
 const LEGACY_BACKUP_ANCHOR_DIR_NAME = '.claude';
 
-interface ScopeInput {
-  scopeRoot: string;
-}
+                      
+                    
+ 
 
-interface DoflowPaths {
-  scopeRoot: string;
-  doflowRoot: string;
-  backupRoot: string;
-  legacyBackupReadRoot: string;
-  manifestPath: string;
-}
+                       
+                    
+                     
+                     
+                               
+                       
+ 
 
 /** Read-only legacy backup location for a scope. Never a write or prune target — see the note above. */
-function legacyBackupReadRoot({ scopeRoot }: ScopeInput): string {
+function legacyBackupReadRoot({ scopeRoot }            )         {
   if (typeof scopeRoot !== 'string' || !scopeRoot) throw new Error('scopeRoot is required');
   return path.join(path.resolve(scopeRoot), LEGACY_BACKUP_ANCHOR_DIR_NAME, BACKUP_DIR_NAME);
 }
 
 /** True for `<anything>/.claude/backups` — used to refuse writes/prunes against the legacy root. */
-function isLegacyBackupReadRoot(candidate: unknown): boolean {
+function isLegacyBackupReadRoot(candidate         )          {
   if (typeof candidate !== 'string' || !candidate) return false;
   const resolved = path.resolve(candidate);
   return path.basename(resolved) === BACKUP_DIR_NAME
@@ -49,7 +49,7 @@ function isLegacyBackupReadRoot(candidate: unknown): boolean {
  * read path handed only that root can still derive the legacy one. Returns null for any path that
  * is not shaped `<scopeRoot>/.doflow/backups` (a test fixture, a hand-passed directory) — the
  * bridge then stays inert rather than inventing a sibling `.claude` next to an arbitrary path. */
-function scopeRootFromCanonicalBackupRoot(backupRoot: unknown): string | null {
+function scopeRootFromCanonicalBackupRoot(backupRoot         )                {
   if (typeof backupRoot !== 'string' || !backupRoot) return null;
   const resolved = path.resolve(backupRoot);
   if (path.basename(resolved) !== BACKUP_DIR_NAME) return null;
@@ -59,7 +59,7 @@ function scopeRootFromCanonicalBackupRoot(backupRoot: unknown): string | null {
 }
 
 /** Resolve DoFlow-owned lifecycle metadata without anchoring it to a harness directory. */
-function doflowPaths({ scopeRoot }: ScopeInput): DoflowPaths {
+function doflowPaths({ scopeRoot }            )              {
   if (typeof scopeRoot !== 'string' || !scopeRoot) throw new Error('scopeRoot is required');
   const root = path.resolve(scopeRoot);
   const doflowRoot = path.join(root, DOFLOW_DIR_NAME);

package/src/install/{targets.ts → targets.js}

@@ -11,7 +11,7 @@
 //
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): authored as `.ts`, run directly by Node
 // native type-stripping — no build step, no runtime dependency. Body stays CommonJS so a `.js`
-// caller's `require('../install/targets.ts')` keeps working while the rest of the tree is still `.js`.
+// caller's `require('../install/targets.js')` keeps working while the rest of the tree is still `.js`.
 const os = require('node:os');
 const path = require('node:path');
 
@@ -24,12 +24,12 @@ const VALID = ['claude', 'codex', 'gemini', 'copilot', 'kiro', 'opencode', 'pi',
  * rest explicitly with `--target claude,codex,gemini`. */
 const DEFAULT_TARGETS = ['claude'];
 
-const TARGET_ALIASES: Record<string, string> = {
+const TARGET_ALIASES                         = {
   agy: 'antigravity',
 };
 
 /** Default to DEFAULT_TARGETS; validate any explicitly requested. */
-function resolveTargets(requested: string[] | undefined): string[] {
+function resolveTargets(requested                      )           {
   const rawTargets = requested && requested.length ? requested : [...DEFAULT_TARGETS];
   const targets = rawTargets.map((t) => TARGET_ALIASES[t] || t);
   for (const t of targets) {
@@ -40,10 +40,10 @@ function resolveTargets(requested: string[] | undefined): string[] {
   return [...new Set(targets)];
 }
 
-interface ToolDirsOptions {
-  global?: boolean;
-  projectRoot?: string;
-}
+                           
+                   
+                       
+ 
 
 /**
  * Map tool -> install root.
@@ -66,14 +66,14 @@ interface ToolDirsOptions {
  *               reads (steering, agents, hooks, settings/mcp.json), so — unlike copilot — this is
  *               the clean, symmetric case.
  *   opencode -> Global config is `~/.config/opencode`, NOT `~/.opencode/` — a path DoFlow's own
- *               docs asserted incorrectly for several releases (see src/adapters/opencode/index.ts).
+ *               docs asserted incorrectly for several releases (see src/adapters/opencode/index.js).
  *               Project scope is `.opencode`, asymmetric with the global path the same way gemini's
  *               is.
  *   pi       -> Global config is `~/.pi/agent` — note the `agent/` segment; `~/.pi/settings.json`
  *               is not a location Pi reads. Project scope is `.pi` (see
- *               src/adapters/pi/index.ts's own `nativePaths()`, which this mirrors exactly).
+ *               src/adapters/pi/index.js's own `nativePaths()`, which this mirrors exactly).
  */
-function toolDirs(opts: ToolDirsOptions = {}): Record<string, string> {
+function toolDirs(opts                  = {})                         {
   const { global = false, projectRoot = '.' } = opts;
   const root = global ? os.homedir() : path.resolve(projectRoot);
   return {

package/src/install/{tool-lifecycle.ts → tool-lifecycle.js}

@@ -6,30 +6,30 @@
 //
 // TypeScript migration (agent-docs/BRIEF_GOAL_DOFLOW.md): authored as `.ts`, run directly by Node
 // native type-stripping — no build step, no runtime dependency. Body stays CommonJS so a `.js`
-// caller's `require('../install/tool-lifecycle.ts')` keeps working while the tree is still `.js`.
+// caller's `require('../install/tool-lifecycle.js')` keeps working while the tree is still `.js`.
 const { execFileSync } = require('node:child_process');
 
 const SUPPORTED_PLATFORMS = new Set(['darwin', 'linux']);
 
-type ExecFileSyncImpl = (file: string, args: string[], opts: any) => any;
+                                                                         
 
-function isSupportedPlatform(platform: string = process.platform): boolean {
+function isSupportedPlatform(platform         = process.platform)          {
   return SUPPORTED_PLATFORMS.has(platform);
 }
 
-function commandText(command: string[]): string {
+function commandText(command          )         {
   return command.map((part) => JSON.stringify(part)).join(' ');
 }
 
-function failureKind(error: any): 'absent' | 'failed' {
+function failureKind(error     )                      {
   return error?.code === 'ENOENT' ? 'absent' : 'failed';
 }
 
-function runInspection(command: string[], execFileSyncImpl: ExecFileSyncImpl): any {
+function runInspection(command          , execFileSyncImpl                  )      {
   try {
     const output = execFileSyncImpl(command[0], command.slice(1), { encoding: 'utf8', stdio: 'pipe' });
     return { command: [...command], result: 'succeeded', output: output == null ? '' : String(output) };
-  } catch (error: any) {
+  } catch (error     ) {
     return {
       command: [...command], result: failureKind(error),
       error: error?.message || String(error),
@@ -38,26 +38,26 @@ function runInspection(command: string[], execFileSyncImpl: ExecFileSyncImpl): a
 }
 
 /** Reduce every status command result to a safe tool state. */
-function normalizeToolState(inspections: any[]): string {
+function normalizeToolState(inspections       )         {
   if (inspections.every((inspection) => inspection.result === 'succeeded')) return 'installed';
   if (inspections.every((inspection) => inspection.result === 'absent')) return 'absent';
   if (inspections.some((inspection) => inspection.result === 'succeeded')) return 'unknown';
   return 'inspection-failed';
 }
 
-function inspectTool(tool: any, { execFileSyncImpl = execFileSync }: { execFileSyncImpl?: ExecFileSyncImpl } = {}): any {
-  const inspections = tool.status.commands.map((command: string[]) => runInspection(command, execFileSyncImpl));
+function inspectTool(tool     , { execFileSyncImpl = execFileSync }                                          = {})      {
+  const inspections = tool.status.commands.map((command          ) => runInspection(command, execFileSyncImpl));
   return { state: normalizeToolState(inspections), inspections };
 }
 
-function inspectPrerequisites(tool: any, { execFileSyncImpl = execFileSync }: { execFileSyncImpl?: ExecFileSyncImpl } = {}): any[] {
-  return (tool.prerequisites || []).map((name: string) => {
+function inspectPrerequisites(tool     , { execFileSyncImpl = execFileSync }                                          = {})        {
+  return (tool.prerequisites || []).map((name        ) => {
     const inspection = runInspection([name, '--version'], execFileSyncImpl);
     return { name, available: inspection.result === 'succeeded', inspection };
   });
 }
 
-function actionEligibility(tool: any, state: string, action: string, prerequisites: any[]): any {
+function actionEligibility(tool     , state        , action        , prerequisites       )      {
   if (action === 'status') return { applicable: false, reason: 'status inspection only' };
   const contract = tool[action];
   if (!contract) return { applicable: false, reason: `no verified ${action} command is registered` };
@@ -79,12 +79,12 @@ function actionEligibility(tool: any, state: string, action: string, prerequisit
  * Inspect all status command vectors, then create a non-mutating action plan.
  * The registry can be the loaded registry or an { externalTools } fixture.
  */
-function planToolLifecycle({ registry, action = 'status', platform = process.platform, execFileSyncImpl = execFileSync }: { registry?: any; action?: string; platform?: string; execFileSyncImpl?: ExecFileSyncImpl } = {}): any {
+function planToolLifecycle({ registry, action = 'status', platform = process.platform, execFileSyncImpl = execFileSync }                                                                                              = {})      {
   if (!['install', 'update', 'uninstall', 'status'].includes(action)) {
     throw new Error(`Unsupported external-tool action '${action}'`);
   }
   const supported = isSupportedPlatform(platform);
-  const tools = (registry?.externalTools || []).map((tool: any) => {
+  const tools = (registry?.externalTools || []).map((tool     ) => {
     if (!supported) {
       return {
         tool, state: 'unknown', inspections: [], prerequisites: [],
@@ -98,19 +98,19 @@ function planToolLifecycle({ registry, action = 'status', platform = process.pla
   return { action, platform, supported, tools };
 }
 
-function defaultDisplay(command: string[]): void { console.error(`[INFO]  ${commandText(command)}`); }
+function defaultDisplay(command          )       { console.error(`[INFO]  ${commandText(command)}`); }
 
 /**
  * Display and separately confirm every planned mutation.  A failed command never prevents later
  * commands from being independently offered and executed.
  */
-function executeToolLifecycle({ plan, execFileSyncImpl = execFileSync, displayCommand = defaultDisplay, confirmCommand }: { plan?: any; execFileSyncImpl?: ExecFileSyncImpl; displayCommand?: (command: string[], tool?: any, action?: string) => void; confirmCommand?: (command: string[], tool?: any, action?: string) => boolean } = {}): any {
+function executeToolLifecycle({ plan, execFileSyncImpl = execFileSync, displayCommand = defaultDisplay, confirmCommand }                                                                                                                                                                                                               = {})      {
   if (!plan) throw new Error('executeToolLifecycle requires a plan');
   if (typeof confirmCommand !== 'function') throw new Error('executeToolLifecycle requires confirmCommand');
 
   const notAttempted = plan.tools
-    .filter((item: any) => item.action.applicable)
-    .map((item: any) => ({ tool: item.tool.id, status: 'not-attempted', command: [...item.action.command] }));
+    .filter((item     ) => item.action.applicable)
+    .map((item     ) => ({ tool: item.tool.id, status: 'not-attempted', command: [...item.action.command] }));
   const results = [];
   for (const item of plan.tools) {
     const action = item.action;
@@ -127,7 +127,7 @@ function executeToolLifecycle({ plan, execFileSyncImpl = execFileSync, displayCo
     try {
       const output = execFileSyncImpl(command[0], command.slice(1), { encoding: 'utf8', stdio: 'pipe' });
       results.push({ tool: item.tool.id, status: 'succeeded', command: [...command], output: output == null ? '' : String(output) });
-    } catch (error: any) {
+    } catch (error     ) {
       results.push({ tool: item.tool.id, status: 'failed', command: [...command], error: error?.message || String(error) });
     }
   }

package/src/lifecycle/{bash-availability.ts → bash-availability.js}

@@ -13,7 +13,7 @@ const { execFileSync } = require('node:child_process');
  * unrelated binary could satisfy a mere PATH check, but only a real bash exits cleanly
  * on `--version`. ENOENT, a non-zero exit, or any other spawn error are all treated as
  * "not available"; the caller does not need to distinguish the reason. */
-function hasBashCapableShell(execFileSyncImpl: any = execFileSync): boolean {
+function hasBashCapableShell(execFileSyncImpl      = execFileSync)          {
   try {
     execFileSyncImpl('bash', ['--version'], { stdio: 'ignore' });
     return true;

package/src/lifecycle/coverage.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const CLASS_ORDER = Object.freeze(['unknown', 'unsupported', 'observation', 'advisory', 'blocking']);
+const POLICY_ORDER = Object.freeze(['pre-implementation-gate', 'pre-bash-guard', 'session-context', 'mcp-tool-guard', 'stop-check']);
+const HARNESS_ORDER = Object.freeze(['claude', 'codex', 'gemini', 'opencode', 'pi', 'copilot', 'kiro', 'antigravity']);
+const NEVER_BLOCKING_EVENTS = new Set([
+  'pi\u0000tool_execution_start', 'antigravity\u0000PostToolUse', 'antigravity\u0000PreInvocation',
+  'antigravity\u0000PostInvocation', 'gemini\u0000AfterTool', 'claude\u0000PostToolUse', 'codex\u0000PostToolUse',
+]);
+function stable(value     )         {
+  if (Array.isArray(value)) return `[${value.map(stable).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stable(value[key])}`).join(',')}}`;
+  return JSON.stringify(value);
+}
+function rowsDigest(rows       )         { return `sha256:${crypto.createHash('sha256').update(stable(rows)).digest('hex')}`; }
+class UnknownEnforcementTarget extends Error {
+  code        ;
+  constructor(code        , detail        ) { super(detail); this.name = 'UnknownEnforcementTarget'; this.code = code; }
+}
+function enforcementFor(coverage     , query                                                       )      {
+  const rows = coverage?.rows || [];
+  const profiles = coverage?.profiles || {};
+  if (query.policy === '*') throw new UnknownEnforcementTarget('unknown-policy', "Unknown policy '*'");
+  if (!rows.some((row     ) => row.harness === query.harness)) throw new UnknownEnforcementTarget('unknown-harness', `Unknown harness '${query.harness}'`);
+  if (!rows.some((row     ) => row.policy === query.policy)) throw new UnknownEnforcementTarget('unknown-policy', `Unknown policy '${query.policy}'`);
+  if (query.profile !== undefined && !Object.hasOwn(profiles, query.profile)) throw new UnknownEnforcementTarget('unknown-profile', `Unknown profile '${query.profile}'`);
+  const pairRows = rows.filter((row     ) => row.harness === query.harness && (row.policy === query.policy || row.policy === '*'));
+  const timing = query.policy === 'stop-check' ? 'stop' : 'pre-tool';
+  const applicable = pairRows.filter((row     ) => row.timing === timing && (query.profile === undefined || row.profile === query.profile || row.profile === 'any'));
+  const enforced = applicable.length > 0 && applicable.every((row     ) => row.wired && row.class === 'blocking' && row.verification === 'verified');
+  const rank = (row     ) => CLASS_ORDER.indexOf(row.class);
+  const weakest = [...applicable].sort((a     , b     ) => rank(a) - rank(b))[0];
+  const intersection = (field        ) => applicable.length ? [...new Set        (applicable[0][field] || [])].filter((item) => applicable.every((row     ) => (row[field] || []).includes(item))) : [];
+  const union = (field        ) => [...new Set(applicable.flatMap((row     ) => row[field] || []))];
+  const parity = enforced && pairRows.length > 0 && pairRows.every((row     ) => row.class === 'blocking');
+  return {
+    harness: query.harness, policy: query.policy, profile: query.profile ?? null, enforced, parity,
+    class: weakest?.class || 'unknown', verification: weakest?.verification || 'unverified',
+    prerequisites: union('prerequisites'), covers: intersection('covers'), doesNotCover: union('doesNotCover'), caveats: union('caveats'),
+    rows: applicable, matrix: { schemaVersion: coverage.schemaVersion, revision: coverage.revision, rowsDigest: coverage.rowsDigest },
+    reason: weakest ? `${weakest.class} at (${weakest.policy}, ${weakest.harness}, ${weakest.event}, ${weakest.profile})` : `unknown at (${query.policy}, ${query.harness}, *, ${query.profile ?? '*'})`,
+  };
+}
+function renderEnforcementMatrix(coverage     )         {
+  const order = (items                   , value        ) => {
+    const index = items.indexOf(value);
+    return index < 0 ? items.length : index;
+  };
+  const rows = [...coverage.rows].sort((a     , b     ) => order(POLICY_ORDER, a.policy) - order(POLICY_ORDER, b.policy)
+    || order(HARNESS_ORDER, a.harness) - order(HARNESS_ORDER, b.harness)
+    || a.event.localeCompare(b.event) || a.profile.localeCompare(b.profile));
+  const lines = [`Schema ${coverage.schemaVersion}; revision ${coverage.revision}; ${coverage.rowsDigest}`, '| Policy | Harness | Native event | Profile | Class | Verification | Prerequisites | Does not cover |', '|---|---|---|---|---|---|---|---|'];
+  for (const row of rows) lines.push(`| ${row.policy} | ${row.harness} | ${row.event} | ${row.profile} | ${row.class} | ${row.verification} | ${(row.prerequisites || []).join(', ')} | ${(row.doesNotCover || []).join(', ')} |`);
+  return lines.join('\n');
+}
+module.exports = { enforcementFor, renderEnforcementMatrix, rowsDigest, UnknownEnforcementTarget, NEVER_BLOCKING_EVENTS };