javi-forge 1.37.1 → 1.38.0

package/dist/lib/claude-hook-manager.d.ts

@@ -30,7 +30,6 @@ export interface ClaudeHookAssetClassification {
 }
 export interface ClaudeHookDoctorReport {
     healthy: boolean;
-    platformSupport?: PlatformSupport;
     settings: {
         state: ClaudeHookComponentState;
         version?: number;
@@ -73,6 +72,12 @@ export interface ClaudeHookDoctorReport {
      */
     nodeOnPath: NodeOnPathProbe;
 }
+export interface ClaudeHookDoctorRefusal {
+    state: "unsupported-platform";
+    healthy: false;
+    platformSupport: PlatformSupport;
+}
+export type ClaudeHookDoctorResult = ClaudeHookDoctorReport | ClaudeHookDoctorRefusal;
 /**
  * Classify the asset into one of nine states from observed bytes only. Never
  * trusts a claimed hash: the full-file SHA is always recomputed and compared to
@@ -158,8 +163,8 @@ export interface ManagedSettingsPaths {
     file: string;
     dropInDir: string;
 }
-/** Static managed-settings locations per OS (no fs). WSL reports `linux`. */
-export declare function resolveManagedSettingsPaths(platform: NodeJS.Platform): ManagedSettingsPaths;
+/** Static managed-settings locations for supported hosts only (no fs). */
+export declare function resolveManagedSettingsPaths(platform: NodeJS.Platform): ManagedSettingsPaths | null;
 /**
  * Probe one settings source path for the two documented hook-neutralizing
  * flags. Fail-closed: only a genuinely-absent path or a cleanly-parsed source
@@ -210,7 +215,7 @@ export declare function doctorClaudePreToolUse(projectDir: string, options?: {
     /** Injectable read-only ACL capability probe (defaults to the real one). */
     aclProbe?: () => Promise<AclCapability>;
     platform?: NodeJS.Platform;
-}): Promise<ClaudeHookDoctorReport>;
+}): Promise<ClaudeHookDoctorResult>;
 interface ClaudeHookMutationResultWithReport {
     ok: boolean;
     changed: string[];
@@ -257,9 +262,9 @@ export interface ClaudeHookRunDeps {
 export declare function _run(projectDir: string, mode: "install" | "repair", options: {
     force?: boolean;
 }, deps: ClaudeHookRunDeps): Promise<ClaudeHookMutationResult>;
-export declare function installClaudePreToolUse(projectDir: string): Promise<ClaudeHookMutationResult>;
+export declare function installClaudePreToolUse(projectDir: string, deps?: ClaudeHookRunDeps): Promise<ClaudeHookMutationResult>;
 export declare function repairClaudePreToolUse(projectDir: string, options?: {
     force?: boolean;
-}): Promise<ClaudeHookMutationResult>;
+}, deps?: ClaudeHookRunDeps): Promise<ClaudeHookMutationResult>;
 export {};
 //# sourceMappingURL=claude-hook-manager.d.ts.map

package/dist/lib/claude-hook-manager.js

@@ -258,15 +258,8 @@ export async function probeNodeOnPath(spawn = defaultNodeSpawn) {
     }
     return { status: "resolved", version: banner, major: Number(match[1]) };
 }
-/** Static managed-settings locations per OS (no fs). WSL reports `linux`. */
+/** Static managed-settings locations for supported hosts only (no fs). */
 export function resolveManagedSettingsPaths(platform) {
-    if (platform === "darwin") {
-        const base = "/Library/Application Support/ClaudeCode";
-        return {
-            file: `${base}/managed-settings.json`,
-            dropInDir: `${base}/managed-settings.d`,
-        };
-    }
     if (platform === "win32") {
         const base = "C:\\Program Files\\ClaudeCode";
         return {
@@ -274,6 +267,8 @@ export function resolveManagedSettingsPaths(platform) {
             dropInDir: `${base}\\managed-settings.d`,
         };
     }
+    if (platform !== "linux")
+        return null;
     const base = "/etc/claude-code";
     return {
         file: `${base}/managed-settings.json`,
@@ -379,10 +374,10 @@ export async function probeExecution(projectDir, componentStates, env = {}) {
     const homeDir = env.homeDir ?? os.homedir();
     const processEnv = env.env ?? process.env;
     const resolved = resolveManagedSettingsPaths(platform);
-    const managedFile = env.managedFile !== undefined ? env.managedFile : resolved.file;
+    const managedFile = env.managedFile !== undefined ? env.managedFile : resolved?.file;
     const dropInDir = env.managedDropInDir !== undefined
         ? env.managedDropInDir
-        : resolved.dropInDir;
+        : resolved?.dropInDir;
     const specs = [
         {
             label: "project",
@@ -485,6 +480,14 @@ export async function probeExecution(projectDir, componentStates, env = {}) {
  * The `execution` verdict is INDEPENDENT of `healthy`.
  */
 export async function doctorClaudePreToolUse(projectDir, options) {
+    const platformSupport = resolvePlatformSupport(options?.platform ?? process.platform);
+    if (platformSupport) {
+        return {
+            state: "unsupported-platform",
+            healthy: false,
+            platformSupport,
+        };
+    }
     const manifest = options?.manifest ?? (await readManifest());
     const currentAssetSha = manifest.asset.sha256;
     const asset = await classifyAssetState(path.join(projectDir, ".claude", "hooks", ASSET_NAME), manifest);
@@ -538,9 +541,7 @@ export async function doctorClaudePreToolUse(projectDir, options) {
         execution.blockers.some((blocker) => blocker.startsWith("guard:"))) {
         remediation.add(aclRemediation);
     }
-    const platformSupport = resolvePlatformSupport(options?.platform ?? process.platform);
     return {
-        ...(platformSupport ? { platformSupport } : {}),
         healthy,
         settings: {
             state: settings.state,
@@ -740,11 +741,17 @@ export async function _run(projectDir, mode, options, deps) {
     // report, so the run never spawns `node --version` twice and the warning, the
     // report row and the verdict can never disagree about the same PATH.
     const nodeOnPath = await (deps.nodeProbe ?? probeNodeOnPath)();
-    const doctor = () => doctorFn(projectDir, {
-        manifest,
-        aclProbe: deps.aclProbe,
-        execution: { nodeProbe: async () => nodeOnPath },
-    });
+    const doctor = async () => {
+        const result = await doctorFn(projectDir, {
+            manifest,
+            aclProbe: deps.aclProbe,
+            execution: { nodeProbe: async () => nodeOnPath },
+        });
+        if ("state" in result) {
+            throw new Error("supported Claude lifecycle received unsupported doctor result");
+        }
+        return result;
+    };
     // Non-blocking runtime notice, computed once and carried by EVERY outcome
     // (success, no-op and refusal alike) — it never gates the mutation.
     const warnings = nodeOnPathWarnings(nodeOnPath);
@@ -832,10 +839,10 @@ export async function _run(projectDir, mode, options, deps) {
         report: await doctor(),
     };
 }
-export function installClaudePreToolUse(projectDir) {
-    return _run(projectDir, "install", {}, {});
+export function installClaudePreToolUse(projectDir, deps = {}) {
+    return _run(projectDir, "install", {}, deps);
 }
-export function repairClaudePreToolUse(projectDir, options) {
-    return _run(projectDir, "repair", options ?? {}, {});
+export function repairClaudePreToolUse(projectDir, options, deps = {}) {
+    return _run(projectDir, "repair", options ?? {}, deps);
 }
 //# sourceMappingURL=claude-hook-manager.js.map

package/dist/lib/codex-hook-manager.d.ts

@@ -102,7 +102,6 @@ export declare function classifyCodexHooksJson(value: unknown, expectedCommand:
 export type CodexTrustState = "trusted" | "untrusted";
 export interface CodexHookDoctorReport {
     healthy: boolean;
-    platformSupport?: PlatformSupport;
     hooksJson: {
         state: ClaudeHookComponentState;
         detail?: string;
@@ -128,6 +127,12 @@ export interface CodexHookDoctorReport {
     };
     remediation: string[];
 }
+export interface CodexHookDoctorRefusal {
+    state: "unsupported-platform";
+    healthy: false;
+    platformSupport: PlatformSupport;
+}
+export type CodexHookDoctorResult = CodexHookDoctorReport | CodexHookDoctorRefusal;
 export interface CodexDoctorOptions {
     platform?: NodeJS.Platform;
     manifest?: Manifest;
@@ -135,7 +140,7 @@ export interface CodexDoctorOptions {
     nodeVersion?: string;
     nodeProbe?: () => Promise<NodeOnPathProbe>;
 }
-export declare function doctorCodexPreToolUse(homeDir?: string, options?: CodexDoctorOptions): Promise<CodexHookDoctorReport>;
+export declare function doctorCodexPreToolUse(homeDir?: string, options?: CodexDoctorOptions): Promise<CodexHookDoctorResult>;
 interface CodexHookMutationResultWithReport {
     ok: boolean;
     changed: string[];
@@ -158,6 +163,7 @@ interface CodexHookLifecycleRefusal {
 }
 export type CodexHookMutationResult = CodexHookMutationResultWithReport | CodexHookLifecycleRefusal;
 export interface CodexHookRunDeps {
+    homeDirProvider?: () => string;
     secureFs?: PlatformSecureFs | null;
     clock?: () => Date;
     nonce?: () => string;
@@ -171,8 +177,8 @@ export interface CodexHookRunDeps {
 export declare function _runCodex(homeDir: string, _mode: "install" | "repair", _options: {
     force?: boolean;
 }, deps: CodexHookRunDeps): Promise<CodexHookMutationResult>;
-export declare function installCodexPreToolUse(homeDir?: string): Promise<CodexHookMutationResult>;
+export declare function installCodexPreToolUse(homeDir?: string, deps?: CodexHookRunDeps): Promise<CodexHookMutationResult>;
 export declare function repairCodexPreToolUse(homeDir?: string, options?: {
     force?: boolean;
-}): Promise<CodexHookMutationResult>;
+}, deps?: CodexHookRunDeps): Promise<CodexHookMutationResult>;
 //# sourceMappingURL=codex-hook-manager.d.ts.map

package/dist/lib/codex-hook-manager.js

@@ -295,10 +295,19 @@ async function readManifest() {
         throw new Error(`unreadable claude-hooks manifest: ${read.reason}`);
     return JSON.parse(read.content);
 }
-export async function doctorCodexPreToolUse(homeDir = os.homedir(), options = {}) {
+export async function doctorCodexPreToolUse(homeDir, options = {}) {
+    const platformSupport = resolvePlatformSupport(options.platform ?? process.platform);
+    if (platformSupport) {
+        return {
+            state: "unsupported-platform",
+            healthy: false,
+            platformSupport,
+        };
+    }
+    const resolvedHomeDir = homeDir ?? os.homedir();
     const manifest = options.manifest ?? (await readManifest());
     const assetPath = options.assetPath ?? SHIPPED_CODEX_ASSET;
-    const { hooksFile, configFile } = codexConfigPaths(homeDir);
+    const { hooksFile, configFile } = codexConfigPaths(resolvedHomeDir);
     const expectedCommand = expectedCodexCommand(assetPath);
     // hooks.json registration.
     const hooksRead = await readText(hooksFile);
@@ -373,9 +382,7 @@ export async function doctorCodexPreToolUse(homeDir = os.homedir(), options = {}
     }
     if (!node.satisfiesMinimum)
         remediation.push("install Node 22 or newer");
-    const platformSupport = resolvePlatformSupport(options.platform ?? process.platform);
     return {
-        ...(platformSupport ? { platformSupport } : {}),
         healthy: status === "runnable",
         hooksJson,
         config: { featuresHooks, readable: configReadable },
@@ -421,11 +428,17 @@ export async function _runCodex(homeDir, _mode, _options, deps) {
     const { codexDir, hooksFile, configFile } = codexConfigPaths(homeDir);
     const expectedCommand = expectedCodexCommand(assetPath);
     const nodeOnPath = await (deps.nodeProbe ?? probeNodeOnPath)();
-    const doctor = () => doctorFn(homeDir, {
-        manifest,
-        assetPath,
-        nodeProbe: async () => nodeOnPath,
-    });
+    const doctor = async () => {
+        const result = await doctorFn(homeDir, {
+            manifest,
+            assetPath,
+            nodeProbe: async () => nodeOnPath,
+        });
+        if ("state" in result) {
+            throw new Error("supported Codex lifecycle received unsupported doctor result");
+        }
+        return result;
+    };
     if (!secureFs) {
         return {
             ok: false,
@@ -537,10 +550,28 @@ export async function _runCodex(homeDir, _mode, _options, deps) {
         report: await doctor(),
     };
 }
-export function installCodexPreToolUse(homeDir = os.homedir()) {
-    return _runCodex(homeDir, "install", {}, {});
+function unsupportedCodexLifecycle(platformSupport) {
+    return {
+        ok: false,
+        changed: [],
+        backups: [],
+        errors: [platformSupport.refusalCode],
+        warnings: [platformSupport.guidance],
+        lifecycleRefusal: platformSupport,
+    };
+}
+export function installCodexPreToolUse(homeDir, deps = {}) {
+    const platformSupport = resolvePlatformSupport(deps.platform ?? process.platform);
+    if (platformSupport)
+        return Promise.resolve(unsupportedCodexLifecycle(platformSupport));
+    const resolvedHomeDir = homeDir ?? (deps.homeDirProvider ?? os.homedir)();
+    return _runCodex(resolvedHomeDir, "install", {}, deps);
 }
-export function repairCodexPreToolUse(homeDir = os.homedir(), options) {
-    return _runCodex(homeDir, "repair", options ?? {}, {});
+export function repairCodexPreToolUse(homeDir, options, deps = {}) {
+    const platformSupport = resolvePlatformSupport(deps.platform ?? process.platform);
+    if (platformSupport)
+        return Promise.resolve(unsupportedCodexLifecycle(platformSupport));
+    const resolvedHomeDir = homeDir ?? (deps.homeDirProvider ?? os.homedir)();
+    return _runCodex(resolvedHomeDir, "repair", options ?? {}, deps);
 }
 //# sourceMappingURL=codex-hook-manager.js.map

package/dist/lib/platform-support.d.ts

@@ -1,19 +1,23 @@
-export declare const PLATFORM_SUPPORT_STATE: {
-    readonly MACOS_DEPRECATED: "macos-deprecated";
-};
-export declare const LIFECYCLE_SUPPORT: {
-    readonly UNSUPPORTED: "unsupported";
-};
-export declare const PLATFORM_REFUSAL: {
-    readonly MACOS_LIFECYCLE_UNSUPPORTED: "macos-lifecycle-unsupported";
+export declare const HOST_SUPPORT_STATE: {
+    readonly SUPPORTED: "supported";
+    readonly UNSUPPORTED: "unsupported-platform";
 };
+export declare const HOST_SUPPORT_GUIDANCE = "javi-forge supports Linux and Windows only.";
+export type SupportedHostPlatform = "linux" | "win32";
+export interface SupportedHost {
+    state: typeof HOST_SUPPORT_STATE.SUPPORTED;
+    platform: SupportedHostPlatform;
+}
 export interface PlatformSupport {
-    platform: "darwin";
-    state: typeof PLATFORM_SUPPORT_STATE.MACOS_DEPRECATED;
-    lifecycle: typeof LIFECYCLE_SUPPORT.UNSUPPORTED;
-    refusalCode: typeof PLATFORM_REFUSAL.MACOS_LIFECYCLE_UNSUPPORTED;
-    guidance: string;
+    state: typeof HOST_SUPPORT_STATE.UNSUPPORTED;
+    refusalCode: typeof HOST_SUPPORT_STATE.UNSUPPORTED;
+    guidance: typeof HOST_SUPPORT_GUIDANCE;
 }
-export declare const MACOS_DEPRECATION_GUIDANCE = "macOS is deprecated and unsupported for install, repair, and init; pin a supported release or migrate. Existing installed guards are not removed; Darwin removal is planned for 2.0.";
+export type HostSupportResult = SupportedHost | PlatformSupport;
+/**
+ * Classifies every host value without aliases or fallthrough.
+ */
+export declare function classifyHostPlatform(platform: string): HostSupportResult;
+/** Returns an unsupported result for legacy callers, otherwise undefined. */
 export declare function resolvePlatformSupport(platform: string): PlatformSupport | undefined;
 //# sourceMappingURL=platform-support.d.ts.map

package/dist/lib/platform-support.js

@@ -1,22 +1,24 @@
-export const PLATFORM_SUPPORT_STATE = {
-    MACOS_DEPRECATED: "macos-deprecated",
+export const HOST_SUPPORT_STATE = {
+    SUPPORTED: "supported",
+    UNSUPPORTED: "unsupported-platform",
 };
-export const LIFECYCLE_SUPPORT = {
-    UNSUPPORTED: "unsupported",
-};
-export const PLATFORM_REFUSAL = {
-    MACOS_LIFECYCLE_UNSUPPORTED: "macos-lifecycle-unsupported",
-};
-export const MACOS_DEPRECATION_GUIDANCE = "macOS is deprecated and unsupported for install, repair, and init; pin a supported release or migrate. Existing installed guards are not removed; Darwin removal is planned for 2.0.";
-export function resolvePlatformSupport(platform) {
-    if (platform !== "darwin")
-        return undefined;
+export const HOST_SUPPORT_GUIDANCE = "javi-forge supports Linux and Windows only.";
+/**
+ * Classifies every host value without aliases or fallthrough.
+ */
+export function classifyHostPlatform(platform) {
+    if (platform === "linux" || platform === "win32") {
+        return { state: HOST_SUPPORT_STATE.SUPPORTED, platform };
+    }
     return {
-        platform: "darwin",
-        state: PLATFORM_SUPPORT_STATE.MACOS_DEPRECATED,
-        lifecycle: LIFECYCLE_SUPPORT.UNSUPPORTED,
-        refusalCode: PLATFORM_REFUSAL.MACOS_LIFECYCLE_UNSUPPORTED,
-        guidance: MACOS_DEPRECATION_GUIDANCE,
+        state: HOST_SUPPORT_STATE.UNSUPPORTED,
+        refusalCode: HOST_SUPPORT_STATE.UNSUPPORTED,
+        guidance: HOST_SUPPORT_GUIDANCE,
     };
 }
+/** Returns an unsupported result for legacy callers, otherwise undefined. */
+export function resolvePlatformSupport(platform) {
+    const result = classifyHostPlatform(platform);
+    return result.state === HOST_SUPPORT_STATE.UNSUPPORTED ? result : undefined;
+}
 //# sourceMappingURL=platform-support.js.map

package/dist/lib/secure-fs-posix.d.ts

@@ -1,7 +1,7 @@
 /**
  * POSIX `PlatformSecureFs` adapters for the SkillGuard transactional installer
- * (Slice 3a). This is the ONLY place a shell tool runs (`getfacl` on Linux,
- * `/bin/ls -lde` on macOS) and the ONLY place `os`/`fs` ownership bits are
+ * (Slice 3a). This is the ONLY place a shell tool runs (`getfacl` on Linux)
+ * and the ONLY place `os`/`fs` ownership bits are interpreted.
  * interpreted. Everything fails closed: a missing/erroring/timed-out ACL tool,
  * an extended/named/mask/default/inherited ACL entry, a foreign-owned or
  * group/other-writable directory, or any inconclusive result refuses rather than
@@ -38,7 +38,7 @@ export interface PosixAclAdapter {
      * mask) `w`, OR any named-group with effective `w`. Everything else (base
      * entries, a lone `mask::`, effective-non-write named entries, x-only, trusted
      * named users, `default:*`) proceeds. Same fail-closed spawn edges as
-     * `proveClean`. On darwin this is the no-op alias of `proveClean` (deferred).
+     * `proveClean`.
      */
     proveNoEndangeringAcl(target: string): Promise<SecureResult<void>>;
 }
@@ -51,13 +51,8 @@ export declare const ACL_DETAIL: {
     readonly getfaclAbsent: "getfacl absent";
     readonly getfaclTimeout: "getfacl timeout";
     readonly extendedAclEntry: "extended ACL entry";
-    readonly macosLsAbsent: "/bin/ls absent";
-    readonly macosLsTimeout: "ls timeout";
-    readonly macosAclFlag: "ACL present (+ flag)";
-    readonly macosAceListed: "ACE listed";
 };
 export declare function createLinuxAclAdapter(spawn?: SpawnFn, stat?: StatFn): PosixAclAdapter;
-export declare function createMacosAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
 /**
  * Whether the host's ACL adapter is RESOLVABLE — an install-time capability
  * question, deliberately separate from the per-target prover above. It never
@@ -65,10 +60,10 @@ export declare function createMacosAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
  */
 export type AclCapability = {
     status: "available";
-    tool: "getfacl" | "/bin/ls";
+    tool: "getfacl";
 } | {
     status: "absent";
-    tool: "getfacl" | "/bin/ls";
+    tool: "getfacl";
 } | {
     status: "unknown";
     tool: string;
@@ -89,9 +84,9 @@ export type AclCapability = {
 export declare function probeAclCapability(spawn?: SpawnFn, platform?: NodeJS.Platform): Promise<AclCapability>;
 export declare function createPosixSecureFs(acl: PosixAclAdapter): PlatformSecureFs;
 /**
- * Select the secure filesystem for the host platform. Linux uses the `getfacl`
- * adapter, macOS uses `/bin/ls -lde`, and win32 uses the digest-bound PowerShell
- * helper over a lazily-spawned session (Slice 3b). Every other platform returns
+ * Select the secure filesystem for supported hosts. Linux uses the `getfacl`
+ * adapter and win32 uses the digest-bound PowerShell helper over a lazily-spawned
+ * session (Slice 3b). Every other platform returns
  * `null` so the manager refuses with `windows-secure-object-unavailable` and
  * mutates nothing.
  *

package/dist/lib/secure-fs-posix.js

@@ -1,7 +1,7 @@
 /**
  * POSIX `PlatformSecureFs` adapters for the SkillGuard transactional installer
- * (Slice 3a). This is the ONLY place a shell tool runs (`getfacl` on Linux,
- * `/bin/ls -lde` on macOS) and the ONLY place `os`/`fs` ownership bits are
+ * (Slice 3a). This is the ONLY place a shell tool runs (`getfacl` on Linux)
+ * and the ONLY place `os`/`fs` ownership bits are interpreted.
  * interpreted. Everything fails closed: a missing/erroring/timed-out ACL tool,
  * an extended/named/mask/default/inherited ACL entry, a foreign-owned or
  * group/other-writable directory, or any inconclusive result refuses rather than
@@ -57,10 +57,6 @@ export const ACL_DETAIL = {
     getfaclAbsent: "getfacl absent",
     getfaclTimeout: "getfacl timeout",
     extendedAclEntry: "extended ACL entry",
-    macosLsAbsent: "/bin/ls absent",
-    macosLsTimeout: "ls timeout",
-    macosAclFlag: "ACL present (+ flag)",
-    macosAceListed: "ACE listed",
 };
 // --- Linux getfacl adapter (Algorithm D) -------------------------------------
 const LINUX_BASE_ENTRY = /^(user|group|other)::/;
@@ -208,39 +204,6 @@ export function createLinuxAclAdapter(spawn = defaultSpawn, stat = defaultStat)
         },
     };
 }
-// --- macOS /bin/ls -lde adapter (Algorithm E) --------------------------------
-const MACOS_ACE_LINE = /^\s*\d+:\s/;
-export function createMacosAclAdapter(spawn = defaultSpawn) {
-    const adapter = {
-        async proveClean(target) {
-            const res = await spawn("/bin/ls", ["-lde", "--", target]);
-            if (res.spawnError)
-                return refuse("unsupported-posix-acl", ACL_DETAIL.macosLsAbsent);
-            if (res.timedOut)
-                return refuse("unsupported-posix-acl", ACL_DETAIL.macosLsTimeout);
-            if (res.code !== 0) {
-                return refuse("unsupported-posix-acl", `ls exit ${res.code}`);
-            }
-            const lines = res.stdout.split("\n");
-            const modeLine = lines[0] ?? "";
-            if (modeLine[10] === "+") {
-                return refuse("unsupported-posix-acl", ACL_DETAIL.macosAclFlag);
-            }
-            if (lines.some((line) => MACOS_ACE_LINE.test(line))) {
-                return refuse("unsupported-posix-acl", ACL_DETAIL.macosAceListed);
-            }
-            return ok();
-        },
-        // DEFERRED (user: Linux only): darwin ancestors stay STRICT = status-quo
-        // over-refusal, not the reported Linux bug. `/bin/ls -lde` ACE text carries
-        // no numeric mask to compute effective rights from, so the path-endangering
-        // narrowing is a documented follow-up. Alias to the strict proof.
-        proveNoEndangeringAcl(target) {
-            return adapter.proveClean(target);
-        },
-    };
-    return adapter;
-}
 /**
  * Probe the ACL adapter READ-ONLY: it resolves and runs a version/list argv and
  * inspects nothing on disk. It creates, modifies and removes nothing, and its
@@ -254,29 +217,27 @@ export async function probeAclCapability(spawn = defaultSpawn, platform = proces
     if (platform === "win32") {
         return { status: "not-applicable", tool: "windows-secure-object" };
     }
-    if (platform !== "linux" && platform !== "darwin") {
+    if (platform !== "linux") {
         return {
             status: "unknown",
             tool: platform,
             detail: `no POSIX ACL adapter for platform ${platform}`,
         };
     }
-    const tool = platform === "linux" ? "getfacl" : "/bin/ls";
-    const args = platform === "linux" ? ["--version"] : ["-ld", "/"];
+    const tool = "getfacl";
+    const args = ["--version"];
     const res = await spawn(tool, args);
     if (res.spawnError)
         return { status: "absent", tool };
     if (res.timedOut) {
-        // The argv differs per platform (`getfacl --version` on linux, `/bin/ls -ld /`
-        // on darwin), so the detail names the probe, not a hardcoded flag.
         return { status: "unknown", tool, detail: `${tool} probe timeout` };
     }
     if (res.code !== 0) {
         return { status: "unknown", tool, detail: `${tool} exit ${res.code}` };
     }
-    // Linux only: a zero exit whose banner does not name getfacl is a foreign
-    // binary on PATH, not proof of the adapter — report ignorance, not success.
-    if (platform === "linux" && !res.stdout.toLowerCase().includes("getfacl")) {
+    // A zero exit whose banner does not name getfacl is a foreign binary on PATH,
+    // not proof of the adapter — report ignorance, not success.
+    if (!res.stdout.toLowerCase().includes("getfacl")) {
         return {
             status: "unknown",
             tool,
@@ -504,9 +465,9 @@ export function createPosixSecureFs(acl) {
     return secureFs;
 }
 /**
- * Select the secure filesystem for the host platform. Linux uses the `getfacl`
- * adapter, macOS uses `/bin/ls -lde`, and win32 uses the digest-bound PowerShell
- * helper over a lazily-spawned session (Slice 3b). Every other platform returns
+ * Select the secure filesystem for supported hosts. Linux uses the `getfacl`
+ * adapter and win32 uses the digest-bound PowerShell helper over a lazily-spawned
+ * session (Slice 3b). Every other platform returns
  * `null` so the manager refuses with `windows-secure-object-unavailable` and
  * mutates nothing.
  *
@@ -521,8 +482,6 @@ export function createPosixSecureFs(acl) {
 export function selectSecureFs(platform = process.platform) {
     if (platform === "linux")
         return createPosixSecureFs(createLinuxAclAdapter());
-    if (platform === "darwin")
-        return createPosixSecureFs(createMacosAclAdapter());
     if (platform === "win32")
         return createWindowsSecureFs(createPs1Session());
     return null;

package/dist/lib/secure-fs-transaction.d.ts

@@ -74,9 +74,8 @@ export interface PlatformSecureFs {
      * ones (a lone mask, an effective-non-write or x-only or trusted named entry, a
      * `default:*`). Called by the engine on ANCESTOR (non-managed) controlling dirs
      * only; managed containers keep the strict proof. Selection is by the
-     * managed-containers role, NEVER by `process.platform`. On win32 this mirrors
-     * the ratified Predicate A (already lenient on ancestors); on darwin it is the
-     * strict no-op alias (deferred).
+     * managed-containers role, NEVER by `process.platform`. Supported adapters
+     * implement the same role contract without host branching in this engine.
      */
     proveNoEndangeringAcl(target: string): Promise<SecureResult<void>>;
     /** Create ONE child directory exclusively at mode, reopen+verify, return its handle. */

package/dist/types/index.d.ts

@@ -69,9 +69,14 @@ export interface DoctorSection {
     title: string;
     checks: DoctorCheck[];
 }
-export interface DoctorResult {
+export type DoctorResult = {
+    state: "supported";
     sections: DoctorSection[];
-}
+} | {
+    state: "unsupported-platform";
+    guidance: string;
+    sections: [];
+};
 export interface PluginManifest {
     name: string;
     version: string;

package/dist/ui/Doctor.d.ts

@@ -1,3 +1,5 @@
 import React from "react";
+import type { DoctorResult } from "../types/index.js";
+export declare function unsupportedDoctorMessage(result: DoctorResult): string | undefined;
 export default function Doctor(): React.JSX.Element;
 //# sourceMappingURL=Doctor.d.ts.map

package/dist/ui/Doctor.js

@@ -15,6 +15,11 @@ const STATUS_COLOR = {
     fail: theme.error,
     skip: theme.muted,
 };
+export function unsupportedDoctorMessage(result) {
+    return result.state === "unsupported-platform"
+        ? `unsupported-platform: ${result.guidance}`
+        : undefined;
+}
 export default function Doctor() {
     const { exit } = useApp();
     const isCI = useCIMode();
@@ -52,6 +57,14 @@ export default function Doctor() {
         if (input.toLowerCase() === "q" || key.return || key.escape)
             exit();
     }, { isActive: !isCI });
+    const unsupportedMessage = result
+        ? unsupportedDoctorMessage(result)
+        : undefined;
+    if (unsupportedMessage) {
+        return (React.createElement(Box, { flexDirection: "column", padding: 1 },
+            React.createElement(Header, { subtitle: "doctor" }),
+            React.createElement(Text, { color: theme.error }, unsupportedMessage)));
+    }
     // Compute health score
     const allChecks = result?.sections.flatMap((s) => s.checks) ?? [];
     const passed = allChecks.filter((c) => c.status === "ok").length;

package/lib/common.sh

@@ -39,16 +39,12 @@ log_info() { echo -e "  ${CYAN}[INFO]${NC} $1"; }
 log_step() { echo -e "${YELLOW}$1${NC}"; }
 
 # =============================================================================
-# sed_inplace - Portable sed -i (works on both GNU and BSD/macOS sed)
+# sed_inplace - GNU sed -i for supported Linux/WSL hosts
 # =============================================================================
 # Usage: sed_inplace "s/foo/bar/" file.txt
 # =============================================================================
 sed_inplace() {
-    if sed --version 2>/dev/null | grep -q GNU; then
-        sed -i "$@"
-    else
-        sed -i '' "$@"
-    fi
+    sed -i "$@"
 }
 
 # =============================================================================
@@ -130,7 +126,7 @@ detect_stack() {
         STACK_TYPE="java-gradle"
         BUILD_TOOL="gradle"
 
-        # Detect Java version from build files (compatible with macOS and Linux)
+        # Detect Java version from build files
         if [[ -f "$project_dir/build.gradle.kts" ]]; then
             JAVA_VERSION=$(grep -E 'languageVersion\s*=\s*JavaLanguageVersion\.of\(' "$project_dir/build.gradle.kts" 2>/dev/null | grep -o '[0-9]\+' | head -1 || echo "21")
         elif [[ -f "$project_dir/build.gradle" ]]; then