@vodmal/vdx-cli 0.25.0 → 0.27.0

package/README.md

@@ -91,7 +91,7 @@ vdx ai@m3
 `vdx ai` reads a personal profile, never a bundled one: `$VDX_ENVIRONMENT`, else
 `~/.vdx-environment.yaml`, else a plain `claude`/`codex` with no flags. Format:
 [docs/specs/environment-format.md](../docs/specs/environment-format.md).
-The session's `{project}` is `[vdx] name` from the project's `mise.toml`, else the
+The session's `{project}` is `[_.vdx] name` (or the older `[vdx]`) from the project's `mise.toml`, else the
 first file in the profile's `session.project_names` that has one, else the repo
 name. `vdx ai@<host>` runs the same command on `<host>` over ssh — that machine's vdx,
 profile and tmux, the path taken under its home directory; `--detach` only
@@ -126,7 +126,7 @@ npm run typecheck
 ## Structure
 
 - `src/rubric.ts`     — types + YAML loader
-- `src/manifest.ts`   — parser for `[vdx]` block in `mise.toml` + `.vdx-overrides.yml`
+- `src/manifest.ts`   — parser for the `[_.vdx]` block in `mise.toml` (the older `[vdx]` too) + `.vdx-overrides.yml`
 - `src/facts.ts`      — fact source loaders (tasks, packages, configs, sub-package detection)
 - `src/predicates.ts` — predicate registry; true / false / unknown with a reason (schema 0.3)
 - `src/evaluator.ts`  — recursive evaluator + sugar notation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vodmal/vdx-cli",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "vdx — unified lifecycle interface (up/down/build/test/check/fix) + versioned maturity audit with drift detection. Pairs with the vdx Claude Code plugin.",
   "keywords": [
     "vdx",
@@ -34,16 +34,21 @@
     "LICENSE"
   ],
   "scripts": {
+    "prepare": "git config core.hooksPath .githooks || true",
     "vdx": "tsx src/index.ts",
     "vdx-mcp": "tsx src/mcp-server.ts",
     "audit": "tsx src/index.ts audit",
     "smoke": "bash smoke.sh",
     "typecheck": "tsc --noEmit",
     "format:check": "prettier --check .",
-    "check": "npm run typecheck && npm run format:check",
-    "fix": "prettier --write .",
+    "lint": "eslint .",
+    "knip": "knip",
+    "check": "npm run typecheck && npm run format:check && npm run lint && npm run knip",
+    "check:code:security": "npm audit --omit=dev",
+    "fix": "eslint --fix . && prettier --write .",
     "test": "vitest run",
     "test:unit": "vitest run tests/unit",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage"
   },
   "dependencies": {
@@ -57,18 +62,23 @@
     "zod": "^3.23.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/js-yaml": "^4.0.9",
     "@types/marked-terminal": "^6.1.1",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^4.1.11",
+    "eslint": "^10.12.0",
+    "eslint-config-prettier": "^10.1.8",
+    "knip": "^6.41.0",
     "prettier": "^3.9.10",
     "typescript": "^5.6.0",
-    "vitest": "^4.1.7"
+    "typescript-eslint": "^8.71.2",
+    "vitest": "^4.1.11"
   },
   "publishConfig": {
     "access": "public"
   },
   "engines": {
-    "node": ">=20.11"
+    "node": ">=22"
   }
 }

package/rubric/vdx-rubric.yaml

@@ -11,7 +11,7 @@ schema_version: "0.3"
 
 metadata:
   name: vdx-rubric-vodmal
-  version: "1.4.0"
+  version: "1.4.2"
   description: "Personal maturity rubric for multi-stack projects (vodmal)"
   owner: vodmal
   homepage: "https://github.com/vodmal/vdx-rubric"
@@ -193,17 +193,24 @@ axes:
             predicate: { tsc_flag: { name: noImplicitOverride, equals: true } }
           - id: eslint_flat
             weight: 1.0
-            predicate:
+            # Имена flat-конфига — те, что ищет ESLint 10 (lib/config/config-loader.js).
+            # Одно определение на сет: code-style ссылается сюда (v1.4.1).
+            predicate: &eslint_flat_config
               any_of:
                 - has_file: eslint.config.js
                 - has_file: eslint.config.mjs
+                - has_file: eslint.config.cjs
                 - has_file: eslint.config.ts
+                - has_file: eslint.config.mts
+                - has_file: eslint.config.cts
           - id: eslint_type_checked
             weight: 1.0
             predicate:
               file_contains:
-                paths: [eslint.config.js, eslint.config.mjs, eslint.config.ts]
-                pattern: "recommended-type-checked"
+                paths: [eslint.config.js, eslint.config.mjs, eslint.config.cjs, eslint.config.ts, eslint.config.mts, eslint.config.cts]
+                # typescript-eslint во flat-конфиге — recommendedTypeChecked / strictTypeChecked,
+                # в .eslintrc было recommended-type-checked (v1.4.1).
+                pattern: "(recommended|strict)-?[Tt]ype-?[Cc]hecked"
         level_thresholds: { L4: 0.85, L3: 0.65, L2: 0.35, L1: 0.10 }
 
   - id: ci
@@ -316,9 +323,31 @@ axes:
             - has_file: ecs.php
             - has_file: .php-cs-fixer.php
             - has_file: phpcs.xml.dist
-            - has_file: .prettierrc
-            - has_file: biome.json
-            - has_file: eslint.config.js
+            # Форматтер: имена конфига — те, что ищет Prettier 3.9, и Biome (v1.4.1).
+            - &formatter_config
+              any_of:
+                - has_file: .prettierrc
+                - has_file: .prettierrc.json
+                - has_file: .prettierrc.yaml
+                - has_file: .prettierrc.yml
+                - has_file: .prettierrc.json5
+                - has_file: .prettierrc.toml
+                - has_file: .prettierrc.js
+                - has_file: .prettierrc.mjs
+                - has_file: .prettierrc.cjs
+                - has_file: .prettierrc.ts
+                - has_file: .prettierrc.mts
+                - has_file: .prettierrc.cts
+                - has_file: prettier.config.js
+                - has_file: prettier.config.mjs
+                - has_file: prettier.config.cjs
+                - has_file: prettier.config.ts
+                - has_file: prettier.config.mts
+                - has_file: prettier.config.cts
+                - config_value: { path: package.json, jsonpath: "prettier", op: present }
+                - has_file: biome.json
+                - has_file: biome.jsonc
+            - *eslint_flat_config
       L3:
         requires:
           any_of:
@@ -333,8 +362,8 @@ axes:
                 - has_file: ecs.php
                 - has_file: phpcs.xml.dist
             - all_of:
-                - any_of: [{ has_file: .prettierrc }, { has_file: biome.json }]
-                - has_file: eslint.config.js
+                - *formatter_config
+                - *eslint_flat_config
 
   - id: dependency-hygiene
     class: supporting
@@ -544,10 +573,17 @@ axes:
         requires:
           any_of:
             - file_contains: { path: scripts/docker-up.sh, pattern: "(traefik|nginx-proxy)" }
+            # Манифест vdx — в [_.vdx] (vdx 0.26+) или в старом [vdx]; оба места — с v1.4.2.
+            - config_value: { path: mise.toml, jsonpath: "_.vdx.shared_infra.precheck", equals: true }
             - config_value: { path: mise.toml, jsonpath: "vdx.shared_infra.precheck", equals: true }
       L4:
         requires:
           any_of:
+            - config_value:
+                path: mise.toml
+                jsonpath: "_.vdx.shared_infra.provider"
+                op: matches
+                pattern: "github.com/.+@v\\d+"
             - config_value:
                 path: mise.toml
                 jsonpath: "vdx.shared_infra.provider"

package/src/ai.ts

@@ -6,7 +6,7 @@ import YAML from 'js-yaml';
 import { evalPredicate } from './evaluator.ts';
 import { GIT_HOOK_EVENTS } from './hooks.ts';
 import { autoDetectStack, readStructured, resolveConfigPath, type Ctx } from './facts.ts';
-import { loadManifest } from './manifest.ts';
+import { loadManifestAt } from './manifest.ts';
 import { type Author, effectiveAuthor, isGitRepo, rankAuthors, scanPool, writeAuthor } from './author.ts';
 import type { Predicate } from './rubric.ts';
 import {
@@ -28,6 +28,7 @@ import {
   parseMachineReport,
   runsInProject,
 } from './conversations.ts';
+import { at, errorMessage, isStringList, str } from './narrow.ts';
 
 /**
  * `vdx ai` — start the person's agent in a project, with the flags their
@@ -48,12 +49,12 @@ import {
  */
 
 /** A prompt a conditional flag is known to cause, and the tmux keys that answer it. */
-export interface ConfirmRule {
+interface ConfirmRule {
   screen: string;
   keys: string[];
 }
 
-export interface WhenRule {
+interface WhenRule {
   id: string;
   description?: string;
   if: Predicate;
@@ -70,7 +71,7 @@ export interface AgentProfile {
   when?: WhenRule[];
 }
 
-export type Multiplexer = 'tmux' | 'none';
+type Multiplexer = 'tmux' | 'none';
 
 /** A place a project's short name may come from: a structured file and a dot path into it. */
 export interface NameSource {
@@ -79,10 +80,10 @@ export interface NameSource {
   jsonpath: string;
 }
 
-export interface SessionProfile {
+interface SessionProfile {
   multiplexer?: Multiplexer;
   name?: string;
-  /** Tried after `[vdx] name` in the project's mise.toml; the first non-empty string wins. */
+  /** Tried after `[_.vdx] name` (or the older `[vdx]`) in the project's mise.toml; the first non-empty string wins. */
   project_names?: NameSource[];
   /** The machines a project's agent may run on, as ssh destinations; vdx asks the others what runs there. */
   machines?: string[];
@@ -106,7 +107,7 @@ export interface PersonalHook {
   description?: string;
 }
 
-export interface GitProfile {
+interface GitProfile {
   /** Directories whose repos are the neighbours an author is proposed from; default — the project's parent. */
   author_pool?: string[];
   hooks?: PersonalHook[];
@@ -120,19 +121,19 @@ export interface Environment {
   git?: GitProfile;
 }
 
-export const ENVIRONMENT_ENV_VAR = 'VDX_ENVIRONMENT';
-export const HOST_ENV_VAR = 'VDX_HOST';
+const ENVIRONMENT_ENV_VAR = 'VDX_ENVIRONMENT';
+const HOST_ENV_VAR = 'VDX_HOST';
 /** Set by `vdx ai@<host>` for the vdx it starts there: the machine the person sits at. */
-export const SEAT_ENV_VAR = 'VDX_AI_FROM';
+const SEAT_ENV_VAR = 'VDX_AI_FROM';
 /**
  * `1` in the environment of an agent started with `vdx ai --focused`, and so of
  * its hooks and MCP servers: nothing wakes this session or reads its inbox for it.
  */
-export const FOCUSED_ENV_VAR = 'VDX_FOCUSED';
-export const USER_ENVIRONMENT_FILE = '.vdx-environment.yaml';
+const FOCUSED_ENV_VAR = 'VDX_FOCUSED';
+const USER_ENVIRONMENT_FILE = '.vdx-environment.yaml';
 /** Tried in order when no profile names an agent. Started plain, with no flags. */
-export const FALLBACK_AGENTS = ['claude', 'codex'] as const;
-export const DEFAULT_SESSION_NAME = '{project}';
+const FALLBACK_AGENTS = ['claude', 'codex'] as const;
+const DEFAULT_SESSION_NAME = '{project}';
 
 export function resolveEnvironmentPath(
   env: NodeJS.ProcessEnv = process.env,
@@ -144,13 +145,9 @@ export function resolveEnvironmentPath(
   return fs.existsSync(user) ? user : null;
 }
 
-function isStringList(v: unknown): v is string[] {
-  return Array.isArray(v) && v.every((x) => typeof x === 'string');
-}
-
 /** Parse and validate a profile. Throws with the offending key named. */
 export function parseEnvironment(text: string, source: string): Environment {
-  const data = YAML.load(text) as unknown;
+  const data: unknown = YAML.load(text);
   if (data === null || data === undefined) return {};
   if (typeof data !== 'object' || Array.isArray(data)) {
     throw new Error(`${source}: expected a YAML mapping at the top level`);
@@ -271,8 +268,8 @@ export function loadEnvironment(file: string): Environment {
   let text: string;
   try {
     text = fs.readFileSync(file, 'utf8');
-  } catch (e: any) {
-    throw new Error(`cannot read profile ${file}: ${e?.code ?? e?.message ?? e}`);
+  } catch (e) {
+    throw new Error(`cannot read profile ${file}: ${str(at(e, 'code')) ?? errorMessage(e)}`, { cause: e });
   }
   return parseEnvironment(text, file);
 }
@@ -372,7 +369,7 @@ export function planLaunch(input: {
 }
 
 export function shellQuote(s: string): string {
-  if (s !== '' && /^[A-Za-z0-9_\/.:@%+=,-]+$/.test(s)) return s;
+  if (s !== '' && /^[A-Za-z0-9_/.:@%+=,-]+$/.test(s)) return s;
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 
@@ -404,7 +401,7 @@ export interface ProcInfo {
   args: string;
 }
 
-export const PANE_FORMAT = '#{session_name}\t#{pane_id}\t#{pane_pid}\t#{pane_current_path}';
+const PANE_FORMAT = '#{session_name}\t#{pane_id}\t#{pane_pid}\t#{pane_current_path}';
 
 export function parsePanes(out: string): PaneInfo[] {
   const panes: PaneInfo[] = [];
@@ -465,7 +462,7 @@ function realpathOr(p: string): string {
   }
 }
 
-export function isInside(child: string, parent: string): boolean {
+function isInside(child: string, parent: string): boolean {
   return child === parent || child.startsWith(parent.endsWith(path.sep) ? parent : parent + path.sep);
 }
 
@@ -500,7 +497,7 @@ export function missingArgs(procArgs: string, required: string[]): string[] {
   return required.filter((a) => (/\s/.test(a) ? !procArgs.includes(a) : !tokens.has(a)));
 }
 
-export function resolveProjectRoot(p: string): string | null {
+function resolveProjectRoot(p: string): string | null {
   const abs = path.resolve(p);
   try {
     if (!fs.statSync(abs).isDirectory()) return null;
@@ -544,7 +541,7 @@ export interface ProjectName {
 }
 
 /**
- * `{project}`: `[vdx] name` in the project's mise.toml, else the first profile
+ * `{project}`: `[_.vdx] name` (or the older `[vdx]`) in the project's mise.toml, else the first profile
  * source holding a non-empty string, else the repository name. A source that is
  * missing or unreadable is skipped — a name is a label, not a reason to fail.
  */
@@ -555,8 +552,9 @@ export function resolveProjectName(input: {
   home: string;
   profileDir: string;
 }): ProjectName {
-  const own = loadManifest(input.projectRoot)?.name;
-  if (typeof own === 'string' && own.trim()) return { name: own.trim(), source: 'mise.toml [vdx] name' };
+  const found = loadManifestAt(input.projectRoot);
+  const own = found?.manifest.name;
+  if (typeof own === 'string' && own.trim()) return { name: own.trim(), source: `mise.toml [${found!.place}] name` };
   for (const src of input.sources) {
     const file = path.resolve(
       input.profileDir,
@@ -582,12 +580,12 @@ export function hostLabel(env: NodeJS.ProcessEnv = process.env): string {
 }
 
 /** The machine the person sits at: the one whose `vdx ai@<host>` started this vdx, else this one. */
-export function seatLabel(env: NodeJS.ProcessEnv = process.env): string {
+function seatLabel(env: NodeJS.ProcessEnv = process.env): string {
   return env[SEAT_ENV_VAR]?.trim() || hostLabel(env);
 }
 
 /** Machine labels compare without case: `M3` in the profile is `m3` in a transcript. */
-export function sameMachine(a: string | null, b: string | null): boolean {
+function sameMachine(a: string | null, b: string | null): boolean {
   return (a ?? '').toLowerCase() === (b ?? '').toLowerCase();
 }
 
@@ -739,9 +737,9 @@ export interface AiDeps {
   liveHere?: () => LiveSession[];
 }
 
-export function runSsh(args: string[], capture: boolean): { status: number; stdout: string } | null {
+function runSsh(args: string[], capture: boolean): { status: number; stdout: string } | null {
   const res = spawnSync('ssh', args, { stdio: capture ? ['ignore', 'pipe', 'ignore'] : 'inherit', encoding: 'utf8' });
-  if ((res.error as NodeJS.ErrnoException | undefined)?.code === 'ENOENT') return null;
+  if (at(res.error, 'code') === 'ENOENT') return null;
   return { status: res.status ?? 1, stdout: res.stdout ?? '' };
 }
 
@@ -750,7 +748,7 @@ export function sleepSync(ms: number): void {
 }
 
 /** Read one line from the terminal, synchronously: the prompt runs before tmux takes it. */
-export function askLine(prompt: string): string | null {
+function askLine(prompt: string): string | null {
   process.stderr.write(prompt);
   const buf = Buffer.alloc(256);
   let text = '';
@@ -758,8 +756,8 @@ export function askLine(prompt: string): string | null {
     let n: number;
     try {
       n = fs.readSync(0, buf, 0, buf.length, null);
-    } catch (e: any) {
-      if (e?.code === 'EAGAIN') {
+    } catch (e) {
+      if (at(e, 'code') === 'EAGAIN') {
         sleepSync(50);
         continue;
       }
@@ -800,9 +798,9 @@ export const EXIT_LAUNCH_FAILED = 4;
  * a start with the resume args had nothing to resume (`claude --continue` exits
  * 1 at once); the window covers answering the channel prompt that comes first.
  */
-export const NOTHING_TO_RESUME_MS = 30_000;
+const NOTHING_TO_RESUME_MS = 30_000;
 
-export function renderPlan(
+function renderPlan(
   plan: LaunchPlan,
   multiplexer: Multiplexer,
   running: AgentPane[],
@@ -1085,7 +1083,7 @@ export function runAiRemote(opts: AiOptions, host: string, deps: AiDeps, from: s
  * The Claude Code sessions alive on `host` right now; null when it does not
  * answer over ssh (BatchMode: a password prompt counts as no answer).
  */
-export function askMachine(host: string, deps: AiDeps): MachineReport | null {
+function askMachine(host: string, deps: AiDeps): MachineReport | null {
   const res = (deps.ssh ?? runSsh)(
     ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', host, `sh -c ${shellQuote(LIVE_SESSIONS_SCRIPT)}`],
     true,
@@ -1094,7 +1092,7 @@ export function askMachine(host: string, deps: AiDeps): MachineReport | null {
 }
 
 /** What a start continues: resume args here, or a conversation on another machine. */
-export interface ConversationChoice {
+interface ConversationChoice {
   args: string[];
   /** Continue it on that machine (`vdx ai@<host>`); `reachable` — it answered over ssh just now. */
   remote?: { host: string; id: string; reachable: boolean };
@@ -1108,7 +1106,7 @@ export interface ConversationChoice {
   lines: string[];
 }
 
-export function isClaude(command: string): boolean {
+function isClaude(command: string): boolean {
   return path.basename(command) === 'claude';
 }
 
@@ -1138,7 +1136,7 @@ const resumeId = (id: string) => ['--resume', id];
  * takes the newest overall; without a terminal it is this machine's newest
  * idle one, never another's.
  */
-export function chooseConversation(plan: LaunchPlan, deps: AiDeps, canAsk: boolean): ConversationChoice {
+function chooseConversation(plan: LaunchPlan, deps: AiDeps, canAsk: boolean): ConversationChoice {
   if (!isClaude(plan.command)) return { args: plan.resumeArgs, lines: [] };
   const host = plan.host;
   const same = sameMachine;
@@ -1351,8 +1349,8 @@ function prepare(pathArg: string, deps: AiDeps, focused = false): Prepared | num
   if (profilePath) {
     try {
       environment = loadEnvironment(profilePath);
-    } catch (e: any) {
-      log(`vdx ai: ${e?.message ?? e}`);
+    } catch (e) {
+      log(`vdx ai: ${errorMessage(e)}`);
       return EXIT_USAGE;
     }
   }
@@ -1390,8 +1388,8 @@ function prepare(pathArg: string, deps: AiDeps, focused = false): Prepared | num
   let plan: LaunchPlan;
   try {
     plan = replan(focused);
-  } catch (e: any) {
-    log(`vdx ai: ${profilePath ?? 'profile'}: ${e?.message ?? e}`);
+  } catch (e) {
+    log(`vdx ai: ${profilePath ?? 'profile'}: ${errorMessage(e)}`);
     return EXIT_USAGE;
   }
   return { projectRoot, environment, profilePath, profileDir, plan, replan };
@@ -1414,7 +1412,7 @@ export function processFocused(pid: number): boolean {
 }
 
 /** macOS guards these folders on their own; a tmux server can hold a denial for every session under it. */
-export const GUARDED_FOLDERS = ['Downloads', 'Desktop', 'Documents'];
+const GUARDED_FOLDERS = ['Downloads', 'Desktop', 'Documents'];
 
 /**
  * The guarded folders an agent started here could not read. Through the tmux server
@@ -1445,8 +1443,9 @@ export function unreadableFolders(tmux: Tmux | null, home: string): string[] {
     try {
       fs.readdirSync(d);
       return false;
-    } catch (e: any) {
-      return e?.code === 'EPERM' || e?.code === 'EACCES';
+    } catch (e) {
+      const code = at(e, 'code');
+      return code === 'EPERM' || code === 'EACCES';
     }
   });
 }
@@ -1672,7 +1671,7 @@ export function runAi(opts: AiOptions, deps: AiDeps): number {
     const env = plan.focused ? { ...process.env, [FOCUSED_ENV_VAR]: '1' } : undefined;
     const startedAt = Date.now();
     let res = spawnSync(plan.command, [...plan.args, ...plan.resumeArgs], { cwd: projectRoot, stdio: 'inherit', env });
-    if ((res.error as NodeJS.ErrnoException | undefined)?.code === 'ENOENT') {
+    if (at(res.error, 'code') === 'ENOENT') {
       log(`vdx ai: \`${plan.command}\` not found on PATH`);
       return 127;
     }

package/src/author.ts

@@ -81,7 +81,7 @@ const GENERIC = new Set([
   'dmitry',
 ]);
 
-export function nameTokens(dir: string, remotePath: string): Set<string> {
+function nameTokens(dir: string, remotePath: string): Set<string> {
   return new Set(
     `${path.basename(dir)} ${remotePath}`
       .toLowerCase()

package/src/clone-checks.ts

@@ -34,7 +34,7 @@ function isGitWorkTree(root: string): boolean {
 
 function executableHooks(dir: string): Map<string, string> {
   const out = new Map<string, string>();
-  let names: string[] = [];
+  let names: string[];
   try {
     names = fs.readdirSync(dir).filter((f) => !f.startsWith('.') && !f.endsWith('.sample'));
   } catch {

package/src/conversations.ts

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { at, dict, str } from './narrow.ts';
 
 /**
  * Claude Code conversations of a project, and the machine each one was last
@@ -28,7 +29,7 @@ import * as path from 'node:path';
  */
 
 /** The opening of `vdx ai --check`'s text; the label is an ssh destination from the other machines. */
-export const MACHINE_LINE_PREFIX = 'vdx ai: this machine is';
+const MACHINE_LINE_PREFIX = 'vdx ai: this machine is';
 const MACHINE_LINE_RE = /^vdx ai: this machine is `([^`]+)`/m;
 /** A label read from a synced file goes to ssh: it must not be able to read as an option. */
 const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -86,17 +87,20 @@ export function readConversation(file: string, updated: Date): Conversation | nu
     const isTitle = line.includes('"ai-title"') || line.includes('"last-prompt"');
     if (!turns && line.includes('"type":"user"')) turns = true;
     if (!isHook && !isTitle) continue;
-    let entry: any;
+    let entry: unknown;
     try {
       entry = JSON.parse(line);
     } catch {
       continue;
     }
-    if (entry?.type === 'ai-title' && typeof entry.aiTitle === 'string') aiTitle = entry.aiTitle;
-    else if (entry?.type === 'last-prompt' && typeof entry.lastPrompt === 'string') lastPrompt = entry.lastPrompt;
-    else if (entry?.type === 'attachment' && entry.attachment?.type === 'hook_additional_context') {
-      const content = entry.attachment.content;
-      for (const part of Array.isArray(content) ? content : [content]) {
+    const type = at(entry, 'type');
+    const title = str(at(entry, 'aiTitle'));
+    const prompt = str(at(entry, 'lastPrompt'));
+    if (type === 'ai-title' && title !== undefined) aiTitle = title;
+    else if (type === 'last-prompt' && prompt !== undefined) lastPrompt = prompt;
+    else if (type === 'attachment' && at(entry, 'attachment', 'type') === 'hook_additional_context') {
+      const content = at(entry, 'attachment', 'content');
+      for (const part of Array.isArray(content) ? (content as unknown[]) : [content]) {
         const label = typeof part === 'string' ? part.match(MACHINE_LINE_RE)?.[1] : undefined;
         if (label && LABEL_RE.test(label)) machine = label;
       }
@@ -108,7 +112,7 @@ export function readConversation(file: string, updated: Date): Conversation | nu
 }
 
 /** Which of `ids` had a prompt typed in them on this machine. */
-export function typedHere(env: NodeJS.ProcessEnv, home: string, ids: Set<string>): Set<string> {
+function typedHere(env: NodeJS.ProcessEnv, home: string, ids: Set<string>): Set<string> {
   const found = new Set<string>();
   let text: string;
   try {
@@ -197,9 +201,11 @@ export function latestPerMachine(
  */
 export function liveConversationId(env: NodeJS.ProcessEnv, home: string, pid: number): string | null {
   try {
-    const data = JSON.parse(fs.readFileSync(path.join(claudeConfigDir(env, home), 'sessions', `${pid}.json`), 'utf8'));
-    const id = data?.sessionId;
-    return typeof id === 'string' && isConversationId(id) ? id : null;
+    const data: unknown = JSON.parse(
+      fs.readFileSync(path.join(claudeConfigDir(env, home), 'sessions', `${pid}.json`), 'utf8'),
+    );
+    const id = str(at(data, 'sessionId'));
+    return id !== undefined && isConversationId(id) ? id : null;
   } catch {
     return null;
   }
@@ -209,9 +215,8 @@ export function liveConversationId(env: NodeJS.ProcessEnv, home: string, pid: nu
 export function liveStartedAt(env: NodeJS.ProcessEnv, home: string, pid: number): number | null {
   try {
     const file = path.join(claudeConfigDir(env, home), 'sessions', `${pid}.json`);
-    const data: unknown = JSON.parse(fs.readFileSync(file, 'utf8'));
-    const at = typeof data === 'object' && data !== null ? (data as { startedAt?: unknown }).startedAt : undefined;
-    return typeof at === 'number' ? at : null;
+    const started = at(JSON.parse(fs.readFileSync(file, 'utf8')), 'startedAt');
+    return typeof started === 'number' ? started : null;
   } catch {
     return null;
   }
@@ -230,24 +235,26 @@ export interface LiveSession {
 }
 
 /** Session files, one JSON object per line — a file read here, or the output of LIVE_SESSIONS_SCRIPT. */
-export function parseLiveSessions(text: string): LiveSession[] {
+function parseLiveSessions(text: string): LiveSession[] {
   const out: LiveSession[] = [];
   for (const line of text.split('\n')) {
     if (!line.trim().startsWith('{')) continue;
-    let data: any;
+    let data: Record<string, unknown> | undefined;
     try {
-      data = JSON.parse(line);
+      data = dict(JSON.parse(line));
     } catch {
       continue;
     }
-    if (!Number.isInteger(data?.pid) || typeof data?.sessionId !== 'string' || !isConversationId(data.sessionId))
-      continue;
+    const pid = data?.['pid'];
+    const conversation = str(data?.['sessionId']);
+    if (typeof pid !== 'number' || !Number.isInteger(pid) || conversation === undefined) continue;
+    if (!isConversationId(conversation)) continue;
     out.push({
-      pid: data.pid,
-      conversation: data.sessionId,
-      tmux: typeof data.tmux === 'string' ? data.tmux : null,
-      status: typeof data.status === 'string' ? data.status : null,
-      cwd: typeof data.cwd === 'string' ? data.cwd : null,
+      pid,
+      conversation,
+      tmux: str(data?.['tmux']) ?? null,
+      status: str(data?.['status']) ?? null,
+      cwd: str(data?.['cwd']) ?? null,
     });
   }
   return out;
@@ -277,8 +284,8 @@ function pidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
     return true;
-  } catch (e: any) {
-    return e?.code === 'EPERM';
+  } catch (e) {
+    return at(e, 'code') === 'EPERM';
   }
 }