blun-king-cli 9.1.536 → 9.1.561

package/agent-spine-plugin/docs/shared-memory.md

@@ -1,259 +0,0 @@
-# Shared memory adapters
-
-AgentSpine can exchange reviewed context between installations without requiring a vendor account, hosted database, or network service. The first reference adapter uses an ordinary directory. That directory may remain local or be placed on a user-controlled network drive or synchronization service.
-
-A signed directory can also be exported as an immutable JSON file for the hardened, provider-neutral [HTTPS snapshot transport](https-transport.md). HTTPS is only another delivery path: all signer trust, quarantine, local review, privacy, history, and authority rules remain identical.
-
-Shared memory is optional. Local discovery, identity, learning, relationships, attention, coordination, and auditing remain complete when no adapter exists.
-
-## Trust flow
-
-```mermaid
-flowchart LR
-    L["Locally accepted learning"]
-    P["Owner-confirmed publish"]
-    E["Immutable shared event"]
-    Q["Receiving quarantine"]
-    R["Second local review"]
-    C["Privacy-filtered shared context"]
-    L --> P --> E --> Q --> R --> C
-    Q -. "not visible" .-> C
-    C -. "never grants" .-> A["Host or delegation authority"]
-```
-
-Only an accepted local learning record can be published. The receiving installation imports the event as `pending`; it is absent from `shared_context` until a local user explicitly accepts it. This double-review model treats transport integrity and human trust as separate concerns.
-
-AgentSpine never shares:
-
-- private learning;
-- source Markdown or document contents;
-- evidence summaries or conversation transcripts;
-- delegation policy or assignment grants;
-- tasks, attention cues, credentials, or host settings;
-- graph state or private relationship profiles.
-
-## Directory adapter
-
-Initialize a scope in a directory outside the scanned project:
-
-```bash
-agentspine share-init /srv/agent-memory/team-alpha \
-  --scope team:alpha \
-  --adapter adapter:team-alpha \
-  --confirm-local-share
-```
-
-The resulting layout is deliberately portable:
-
-```text
-team-alpha/
-  .agentspine-exchange.json
-  events/
-    <sha256-of-event-id>.json
-```
-
-The manifest binds the directory to one stable scope. Events are immutable JSON records. Their filenames derive from stable event IDs, which gives different writers deterministic collision behavior without relying on a central server.
-
-The directory must be outside the scanned project, including after symlink resolution. Adapter manifests, event files, and the event directory must be regular filesystem objects rather than symlinks. A pull is capped at 2,000 events and 20 MiB; each manifest or event is capped at 64 KiB.
-
-## Authenticated signed mode
-
-The baseline adapter uses canonical SHA-256 integrity for compatibility. Anyone with write access can replace a baseline event and recompute its digest. Signed mode adds Ed25519 origin authentication while preserving the same event payload, quarantine, privacy, and review workflow.
-
-```mermaid
-flowchart LR
-    K["Publisher private key\ninstallation-local"] --> S["Signed manifest + events"]
-    P["Exported public identity"] --> T["Receiver project trust store"]
-    S --> V["Signature verification"]
-    T --> V
-    V --> Q["Pending quarantine"]
-    Q --> R["Independent local content review"]
-    R --> C["Context-only memory"]
-    V -. "authenticates key, not permission" .-> A["No host or delegation authority"]
-```
-
-Create a local signer and export only its public identity:
-
-```bash
-agentspine share-keygen signer:team-alpha \
-  --root /path/to/publisher-project \
-  --public-out /safe/exchange/team-alpha-signer.json \
-  --confirm-local-share
-```
-
-The private key is generated under the AgentSpine installation state directory. It is never returned by the command, copied into the project, placed in the adapter, exposed through MCP, or injected by hooks. The exported JSON contains the Ed25519 public key, stable signer ID, cryptographic key fingerprint, creation time, and integrity digest.
-
-The receiving project must trust that exact exported key through a genuine local owner action:
-
-```bash
-agentspine share-trust /safe/exchange/team-alpha-signer.json \
-  --root /path/to/receiving-project \
-  --confirm-local-share
-
-agentspine share-trust-list /path/to/receiving-project --json
-```
-
-Create and publish through a signed adapter:
-
-```bash
-agentspine share-init /srv/agent-memory/team-alpha \
-  --root /path/to/publisher-project \
-  --scope team:alpha \
-  --signer signer:team-alpha \
-  --confirm-local-share
-
-agentspine share-publish /srv/agent-memory/team-alpha \
-  --root /path/to/publisher-project \
-  --learning learning:release-process \
-  --id shared:release-process-v1 \
-  --signer signer:team-alpha \
-  --confirm-local-share
-```
-
-Require authentication at the receiver:
-
-```bash
-agentspine share-pull /srv/agent-memory/team-alpha \
-  --root /path/to/receiving-project \
-  --require-authenticated
-```
-
-Pull verifies the signed manifest and every signed event before any quarantine write. A signed adapter cannot mix unsigned events, and an unsigned adapter cannot smuggle signed files. Each event signer is checked independently, so a trusted adapter owner does not implicitly trust another writer.
-
-### What a signature means
-
-A valid signature proves that the envelope matches the private key corresponding to a public key explicitly trusted for this receiving project. It does not prove the operator's legal identity, truthfulness, current role, relationship, or permission. It does not approve the claim, grant delegation, authorize a tool, or bypass the second local content review.
-
-Public-key exchange must therefore use a channel appropriate to the deployment. Compare the full key fingerprint out of band when identity matters. Encrypt the transport when metadata confidentiality matters; signatures provide authenticity and integrity, not encryption.
-
-### Rotation and revocation
-
-Rotation is explicit and never overwrites the old public identity silently:
-
-```bash
-agentspine share-keygen signer:team-alpha \
-  --root /path/to/publisher-project \
-  --rotate \
-  --public-out /safe/exchange/team-alpha-signer-v2.json \
-  --confirm-local-share
-```
-
-The installation retains the retired public identity in history and removes the retired local private key. Receivers import the new public identity as a separate trusted fingerprint. Old signatures remain cryptographically verifiable as long as the old public trust record remains available.
-
-Revoke a compromised or retired key locally:
-
-```bash
-agentspine share-trust-revoke ed25519:<full-fingerprint> \
-  --root /path/to/receiving-project \
-  --reason "Key retired after verified rotation" \
-  --confirm-local-share
-```
-
-Revocation blocks new acceptance immediately. If already accepted context depends on that key, shared context and audit fail closed until the user rolls back, rejects, or permanently deletes the affected import. Revocation never rewrites source Markdown or remote adapter files.
-
-## Publish and receive
-
-Publish an already accepted learning:
-
-```bash
-agentspine share-publish /srv/agent-memory/team-alpha \
-  --root /path/to/source-project \
-  --learning learning:release-process \
-  --id shared:release-process-v1 \
-  --confirm-local-share
-```
-
-Pull on another installation:
-
-```bash
-agentspine share-pull /srv/agent-memory/team-alpha \
-  --root /path/to/receiving-project
-
-agentspine share-inbox /path/to/receiving-project --status pending --json
-```
-
-Pulling reads the adapter and writes only to the receiving project's external `sharing.json`. It never changes the adapter, the project, or accepted context. Repeated and concurrent pulls are idempotent.
-
-Review locally, then read:
-
-```bash
-agentspine share-review shared:release-process-v1 \
-  --root /path/to/receiving-project \
-  --decision accept \
-  --reason "Confirmed for this installation" \
-  --confirmed-by-user
-
-agentspine share-context /path/to/receiving-project \
-  --scope team:alpha \
-  --json
-```
-
-`--confirmed-by-user` is an integration attestation, not authentication. A wrapper must bind it to a real local user action. It must never be inferred from an imported event, another agent, memory, Markdown, a task, or a prior confirmation at the publishing installation.
-
-## Event contract
-
-Every `agentspine.shared-event/v1` contains only:
-
-- stable event, scope, and origin-instance IDs;
-- learning kind and descriptive claim;
-- optional subject and exact group scope;
-- confidence and publication timestamp;
-- minimal provenance: source learning ID, acceptance timestamp, automatic/manual marker, evidence count, and a digest of the original review proof;
-- optional predecessor event ID;
-- `authority: context-only`;
-- a SHA-256 digest over canonical JSON.
-
-Signed mode wraps the unchanged event in an `agentspine.signed-envelope/v1` containing a strict public identity, envelope kind, signing timestamp, `context-only` marker, and Ed25519 signature. The receiver retains the minimal signature proof with the quarantined record and replays it during reads and audits. Public keys and signatures are intentionally omitted from hook text and MCP context results; callers see only a signer ID, key fingerprint, and verification time.
-
-Unknown fields are rejected. IDs are identifiers, not identities or authentication claims. An `originInstanceId` distinguishes local installations but does not prove who operated one.
-
-The baseline digest detects accidental damage and unsophisticated mutation. It is not a signature: anyone who can write the adapter directory can replace an event and recompute its digest. Signed mode detects that replacement unless the attacker also controls a locally trusted private key. Both modes retain quarantine because authentication and content trust are different decisions.
-
-## Supersession and rollback
-
-New shared information does not overwrite old context. Publish the replacement with an explicit predecessor:
-
-```bash
-agentspine share-publish /srv/agent-memory/team-alpha \
-  --root /path/to/source-project \
-  --learning learning:release-process-v2 \
-  --id shared:release-process-v2 \
-  --supersedes shared:release-process-v1 \
-  --confirm-local-share
-```
-
-The adapter verifies that predecessor and replacement retain the same kind, subject, and privacy scope. When the receiver accepts the replacement, the old active record becomes `superseded` and remains in history. A rollback restores it atomically:
-
-```bash
-agentspine share-rollback shared:release-process-v2 \
-  --root /path/to/receiving-project \
-  --reason "The replacement was incorrect"
-```
-
-Permanent local deletion is CLI-only, requires `--confirm-local-share`, and removes the selected import plus retained local versions. It does not delete the immutable event from the shared adapter.
-
-## Privacy and groups
-
-Only `shared` and `group` learning can be published. Group events retain the exact group ID and optional subject. The receiving installation must know that group and its visible membership before acceptance. `includePrivate` cannot bypass a missing or different group audience.
-
-Lifecycle hooks have no group audience. They expose only counts and kinds of already accepted, non-private shared context. They never inject claims, subjects, adapter paths, pending inbox records, or event provenance.
-
-## MCP boundary
-
-MCP exposes only `shared_context`, which reads locally accepted records. Adapter initialization, publication, pulling, inbox review, rollback, configuration, deletion, key generation, rotation, trust, and revocation remain local CLI operations. An agent therefore cannot use AgentSpine's MCP surface to connect an arbitrary path, export data, accept its own import, read a private key, trust itself, or widen trust.
-
-## Adapter compatibility
-
-The implemented HTTPS, mutable-feed, peer, and local SQLite adapters map their transport back into the reference directory semantics before local import. Future hosted adapters must produce the same strict manifest and event semantics or map their transport into them before local import:
-
-1. immutable stable event IDs;
-2. canonical integrity digest and, for authenticated transports, a verifiable signed envelope;
-3. one explicit scope per adapter connection;
-4. no private, authority, source-document, evidence-text, task, or policy payloads;
-5. quarantine before local review;
-6. idempotent import and collision detection;
-7. retained supersession history and rollback;
-8. no dependency for local AgentSpine operation.
-9. explicit key trust, rotation, and revocation without converting signatures into authority.
-
-Transport plugins may strengthen authenticity, encryption, retention, and remote access control. They may never weaken privacy filtering, local confirmation, the context-only authority marker, or protected-source preservation.

package/agent-spine-plugin/docs/source-roots.md

@@ -1,86 +0,0 @@
-# Host-native source roots
-
-AgentSpine `0.8.0` resolves active user, project, and host-memory sources before every production lifecycle hook. Resolution does not depend on the directory from which the plugin was installed, and it never treats the entire home directory as one project.
-
-## Resolution contract
-
-```mermaid
-flowchart LR
-    H["Native hook payload"] --> R["Provider-neutral source-root resolver"]
-    C["Claude profile"] --> R
-    X["Codex profile"] --> R
-    P["Active project chain"] --> R
-    B["Explicit local state binding"] --> R
-    R --> U["User-wide sources"]
-    R --> J["Exact project sources"]
-    R --> M["Exact Claude project memory"]
-    U --> S["Byte-budgeted session_briefing"]
-    J --> S
-    M --> S
-```
-
-Claude resolution follows the documented user and project hierarchy: `CLAUDE_CONFIG_DIR` or `~/.claude`, user `CLAUDE.md` and rules, the active project chain, and the exact project-memory directory evidenced by `autoMemoryDirectory`, `CLAUDE_CODE_PROJECT_DIR_NAME`, or the native hook `transcript_path`. Inside that directory, `MEMORY.md` is the only index. The live path never enumerates that directory and never follows links found inside a fact file. AgentSpine does not guess Claude's private project-directory encoding. See Anthropic's [memory hierarchy and storage-location documentation](https://code.claude.com/docs/en/memory) and [Claude configuration directory documentation](https://code.claude.com/docs/en/claude-directory).
-
-## Indexed and lazy memory
-
-Every direct index link is counted as indexed, but its target is opened only when a marker proves relevance:
-
-```markdown
-- [Communication style](style.md) <!-- agentspine:always -->
-- [BLUN project](projects/blun.md) <!-- agentspine:project=project:blun -->
-- [Alpha team](groups/alpha.md) <!-- agentspine:group=group:alpha -->
-- [Owner preference](people/owner.md) <!-- agentspine:entity=person:owner -->
-- [Current handoff](tasks/handoff.md) <!-- agentspine:task=task:handoff -->
-- [Carbonara preference](food/pasta.md) <!-- agentspine:keywords=carbonara,pasta -->
-```
-
-An exact person, project, group, or task ID must match the current hook scope. Prompt relevance requires a normalized keyword match against the link label, filename, or explicit `keywords` marker. If relevance is uncertain, the target remains unopened. The index itself is always loaded so the host retains its native memory overview.
-
-The persistent cache lives under AgentSpine's platform state directory, outside ordinary agent projects. If the active project root is exactly a recognized user home, the configured AgentSpine state subtree may be below that root but is explicitly pruned before source enumeration; it is never context. The exception does not apply to nested project roots. The cache stores integrity-checked snapshots keyed by an opaque root digest and relative path. A cache hit still opens and validates the original path and file identity, but does not reread or rehash unchanged source bytes. Corrections, deletion, link removal, source-binding rollback, purge, restart, and compaction invalidate or prune the affected cache record immediately. Cache contents and relevance markers are context-only.
-
-Indexed targets use no-follow open semantics. Parent components, canonical scope, regular-file status, size, identity, modification metadata, and the pathname-to-handle identity are checked around the same read. A changing target is retried a bounded number of times and then rejected as a race; mixed snapshots are never injected.
-
-The live resolver processes at most 128 direct index links, one target at a time, under the host resolver's two-second work budget. `MEMORY.md` and each target are limited to 4 MiB, while the complete external cache is capped at 16 MiB. Exceeding a bound fails closed instead of widening discovery.
-
-Codex resolution uses `CODEX_HOME` or `~/.codex`, selects `AGENTS.override.md` before `AGENTS.md` at user scope, and walks from the configured project root to `cwd`. Per directory it selects override, regular, then the configured `project_doc_fallback_filenames`; `project_root_markers` and `project_doc_max_bytes` are read from the active profile's `config.toml`. Without a root marker, only `cwd` is the project root. See OpenAI's [AGENTS.md discovery order](https://developers.openai.com/codex/agent-configuration/agents-md) and [configuration reference](https://developers.openai.com/codex/config-reference).
-
-Only regular files under these evidenced roots are read. Symlinks are skipped. The resolver caps source count, per-file bytes, aggregate bytes, and recursive host-rule files. A project-root scan is never run when the resolved root is the user's home directory. Foreign repositories and arbitrary hidden directories are not traversed.
-
-## Portable user continuity
-
-Accepted preferences, no-gos, corrections, and references can be attached once to the local user through an explicit state binding. The binding references the existing external AgentSpine state; it does not copy records between project hashes.
-
-```bash
-agentspine source-bind /path/where/continuity-was-configured \
-  --host all \
-  --scope state-user \
-  --project /current/project \
-  --host-home /current/profile \
-  --confirm-local-binding
-```
-
-Only portable low-risk learning and the known person relationship context are read from this binding. Project facts, tasks, attention events, group/private project content, delegation policy, execution grants, jobs, secrets, and trust material remain in the exact project state. The registry is append-audited and supports explicit rollback and purge:
-
-```bash
-agentspine source-status --host claude --cwd /current/project --json
-agentspine source-rollback binding:ID --confirm-local-binding
-agentspine source-purge binding:ID --confirm-local-binding
-```
-
-Bindings and their provenance are context-only. They cannot create identity equivalence, roles, permissions, delegation, host trust, or self-starter rights.
-
-## Empty and damaged state
-
-Hook context includes a bounded `sourceResolution` report with checked scopes, counts, profile digest, project root, and the concrete empty or fail-closed reason. Indexed-memory diagnostics add counts for indexed, relevant, loaded, cache hits, cache misses, missing targets, scope omissions, path escapes, symlinks, size rejection, races, and live directory enumeration. They never include fact contents or fact paths. `agentspine doctor --host claude|codex --cwd … --json`, `agentspine source-status`, and `agentspine audit … --host … --json` expose the same report.
-
-Live hooks never enumerate orphaned files. An operator can request the separate bounded offline diagnostic explicitly:
-
-```bash
-agentspine doctor --host claude --cwd /current/project --offline-memory-orphans --json
-```
-
-It reports counts only, reads no orphan content, follows no symlinks, and grants no cleanup or deletion authority.
-
-The installed-bundle check reproduces the original zero-source failure from an AgentSpine checkout and a foreign `cwd`, repeats restart and compaction, exercises custom Claude and Codex homes, Codex fallback and nested override precedence, and proves no broad home scan, no foreign-project visibility, zero model-side MCP calls, exactly one hook set, and unchanged source bytes.
-
-The scale acceptance creates 50,000 real unindexed files beside six indexed entries. For the fully matching scope it records five loaded facts, seven safe opens (`MEMORY.md` twice plus five targets), zero directory enumerations, and no opens, reads, hashes, or counts for the 50,000 files. The same instrumentation result is independent of the unindexed file count; wall-clock thresholds are deliberately not used as a correctness oracle.

package/agent-spine-plugin/docs/sqlite-transport.md

@@ -1,76 +0,0 @@
-# Local SQLite snapshot transport
-
-AgentSpine can retain authenticated shared-memory snapshots in one operator-selected SQLite file. The adapter is local, provider-neutral, optional, and implemented with Node.js `node:sqlite`; it adds no package dependency or cloud account. SQLite commands require Node.js 22.13 or newer for the hardened read-only and extension-control options. The rest of AgentSpine continues to support the runtime range declared by the package.
-
-The database is a transport history, not a new source of identity, policy, or canonical memory. It stores complete signed snapshots outside the scanned project and imports only the latest verified snapshot into the existing quarantine.
-
-```mermaid
-sequenceDiagram
-    participant O as Local owner CLI
-    participant D as Signed directory adapter
-    participant S as SQLite file outside project
-    participant R as Receiving project
-    O->>D: Build independently validated signed snapshot
-    O->>S: BEGIN IMMEDIATE
-    S->>S: Validate schema, integrity, metadata,<br/>all prior snapshots, and hash chain
-    O->>S: Append immutable revision + compare current head
-    O->>S: COMMIT revision and head atomically
-    R->>S: Read-only integrity and full-chain validation
-    R->>R: Verify snapshot + every nested signature
-    R->>R: Import claims only into quarantine
-```
-
-## Initialize and publish
-
-Start with an authenticated directory adapter. Keep the SQLite file outside every scanned agent project:
-
-```bash
-agentspine share-sqlite-init /srv/agent-memory/team-alpha \
-  --root /path/to/publisher-project \
-  --database /srv/agentspine-db/team-alpha.sqlite \
-  --confirm-local-share
-
-agentspine share-sqlite-publish /srv/agent-memory/team-alpha \
-  --root /path/to/publisher-project \
-  --database /srv/agentspine-db/team-alpha.sqlite \
-  --id snapshot:team-alpha-2026-08-28 \
-  --confirm-local-share
-```
-
-Initialization permanently binds the database to the directory adapter's signed manifest, scope, adapter ID, signer ID, and key ID. A later command cannot silently repurpose the file for another adapter or signing identity. Initialization and every publication require an explicit local owner confirmation.
-
-Publication uses `BEGIN IMMEDIATE`, validates the entire retained state before mutation, then appends one revision and advances the single head in the same transaction. Repeating the exact same snapshot is idempotent. Different snapshots receive monotonically increasing sequence numbers and link to the previous revision digest. There is no update or delete command for revision history.
-
-## Inspect and pull
-
-```bash
-agentspine share-sqlite-inspect \
-  --root /path/to/project \
-  --database /srv/agentspine-db/team-alpha.sqlite
-
-agentspine share-sqlite-pull \
-  --root /path/to/receiver-project \
-  --database /srv/agentspine-db/team-alpha.sqlite
-```
-
-Inspection reports only transport metadata, hashes, counts, and context-only authority. Pull opens the database read-only, validates its SQLite integrity, exact application schema, authenticated manifest, every retained snapshot, the complete revision chain, and the atomic head. It then sends the latest snapshot through the normal signed importer. Received claims remain pending and invisible until a second local user review.
-
-## Database contract
-
-The v1 file has exactly three AgentSpine tables:
-
-- `agentspine_meta`: one immutable binding to a signed directory manifest;
-- `agentspine_revisions`: append-only signed-snapshot JSON plus a SHA-256 revision chain;
-- `agentspine_head`: one transactionally advanced pointer to the newest revision.
-
-Unexpected tables, views, triggers, indexes, schema versions, rows, broken digests, invalid JSON, malformed snapshots, signature failures, metadata changes, missing links, head mismatches, files over 128 MiB, symbolic-link or hard-link database and sidecar paths, and database paths inside the scanned project fail closed. SQLite extensions and double-quoted string literals are disabled, foreign keys and `trusted_schema=OFF` are set on every connection, defensive mode is enabled when the runtime exposes it, and SQL values use bound parameters.
-
-The file contains repeated full snapshots so every retained revision is independently verifiable. It is intentionally capped at 1,000 revisions, 2,000 events per snapshot through the shared snapshot contract, 21 MiB per snapshot, and 128 MiB for the database and retained JSON validation budget. Operators should rotate to a new explicitly initialized file before reaching a limit; AgentSpine does not compact or delete history automatically.
-
-## Security and authority boundary
-
-Filesystem access to the SQLite file is the transport access-control boundary. AgentSpine requests owner-only file mode on platforms that support POSIX permissions, but operators remain responsible for directory permissions, backups, disk encryption, copying, OS-level locks, and physical device security. The adapter is not a multi-tenant database server, a replication protocol, or a remote credential store.
-
-SQLite atomicity, integrity checks, hash chains, snapshot digests, and Ed25519 signatures detect defined corruption and origin-key mismatch. They do not establish real-world identity, freshness beyond the retained local head, truth, permission, delegation, production access, spending rights, or policy exceptions. Restoring an older but internally valid database copy cannot be distinguished without a separately retained external checkpoint.
-
-Database initialization, publication, inspection, paths, and pull are absent from MCP and lifecycle hooks. Agents cannot select a database, write a revision, approve an import, or gain database access through AgentSpine's agent-controlled surfaces. Existing `AGENTS.md`, `CLAUDE.md`, `SOUL.md`, `MEMORY.md`, and every other discovered Markdown source remain in place and byte-for-byte unchanged.

package/agent-spine-plugin/scripts/check-hosts.js

@@ -1,195 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { readFile, stat } from "node:fs/promises";
-import { isAbsolute, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-function assert(condition, message) {
-  if (!condition) throw new Error(message);
-}
-
-async function json(root, path) {
-  return JSON.parse(await readFile(resolve(root, path), "utf8"));
-}
-
-function expand(value, variable, root) {
-  assert(typeof value === "string" && value.length > 0, "host command values must be non-empty strings");
-  return value.split(`\${${variable}}`).join(root);
-}
-
-async function validateEntrypoint(root, value) {
-  const target = resolve(value);
-  const within = relative(root, target);
-  assert(within && !within.startsWith("..") && !isAbsolute(within), "MCP entrypoint must remain inside the plugin");
-  const metadata = await stat(target);
-  assert(metadata.isFile(), "MCP entrypoint must be a regular file");
-}
-
-function validateHooks(root, hooks, { required, commandRoot }) {
-  assert(hooks && typeof hooks === "object" && !Array.isArray(hooks), "hook bundle is missing");
-  assert(Object.keys(hooks).every((key) => ["description", "hooks"].includes(key)), "hook bundle contains unsupported top-level metadata");
-  assert(hooks.description && typeof hooks.description === "string", "hook bundle description is missing");
-  for (const event of required) {
-    const registrations = hooks.hooks?.[event];
-    assert(Array.isArray(registrations) && registrations.length === 1, `${event} must have exactly one registration`);
-    assert(Array.isArray(registrations[0].hooks) && registrations[0].hooks.length === 1, `${event} must have exactly one hook command`);
-    const command = registrations[0].hooks[0];
-    assert(command.type === "command", `${event} must use a command hook`);
-    assert(command.command === `node "\${${commandRoot}}/src/hook.js"`, `${event} must use the bundled lifecycle adapter`);
-    assert(Number.isInteger(command.timeout) && command.timeout > 0 && command.timeout <= 15, `${event} timeout is unsafe`);
-  }
-  const extras = Object.keys(hooks.hooks || {}).filter((event) => !required.includes(event));
-  assert(extras.length === 0, `unknown hook events: ${extras.join(", ")}`);
-  return { events: required, commands: required.length, entrypoint: relative(root, resolve(root, "src/hook.js")) };
-}
-
-function validateBlunHooks(root, hooks) {
-  const required = [
-    "SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse",
-    "PreCompact", "PostCompact", "Stop", "SubagentStop"
-  ];
-  assert(Array.isArray(hooks), "BLUN hook bundle is missing");
-  assert(hooks.length === required.length, "BLUN must register exactly one command per lifecycle event");
-  assert(JSON.stringify(hooks.map(({ event }) => event)) === JSON.stringify(required),
-    "BLUN lifecycle events must remain complete and ordered");
-  for (const event of required) {
-    const registrations = hooks.filter((hook) => hook.event === event);
-    assert(registrations.length === 1, `${event} must have exactly one BLUN registration`);
-    const command = registrations[0];
-    assert(command.command === 'node "./src/hook.js"', `${event} must use the bundled BLUN lifecycle adapter`);
-    assert(Number.isInteger(command.timeout) && command.timeout > 0 && command.timeout <= 15, `${event} BLUN timeout is unsafe`);
-  }
-  return { events: required, commands: required.length, entrypoint: relative(root, resolve(root, "src/hook.js")) };
-}
-
-async function initializeServer({ label, root, variable, server, version }) {
-  assert(server && typeof server === "object" && !Array.isArray(server), `${label} MCP registration is missing`);
-  assert(server.command === "node", `${label} MCP registration must use the Node.js runtime`);
-  assert(Array.isArray(server.args) && server.args.length === 1, `${label} MCP registration must name exactly one entrypoint`);
-  const command = process.execPath;
-  const args = server.args.map((value) => {
-    const expanded = expand(value, variable, root);
-    return isAbsolute(expanded) ? expanded : resolve(root, expanded);
-  });
-  assert(!args.some((value) => value.includes("${")), `${label} MCP registration contains an unresolved variable`);
-  await validateEntrypoint(root, args[0]);
-
-  return await new Promise((resolveResult, reject) => {
-    const child = spawn(command, args, {
-      cwd: root,
-      env: { ...process.env, CLAUDE_PLUGIN_ROOT: root, PLUGIN_ROOT: root },
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    const finish = (error, value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      const settle = () => {
-        if (error) reject(error);
-        else resolveResult(value);
-      };
-      if (child.exitCode !== null || child.signalCode !== null) return settle();
-      child.once("close", settle);
-      child.kill();
-    };
-    const timer = setTimeout(() => {
-      finish(new Error(`${label} MCP initialize timed out${stderr ? `: ${stderr.trim()}` : ""}`));
-    }, 3000);
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => { stderr += chunk; });
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-      const newline = stdout.indexOf("\n");
-      if (newline < 0) return;
-      try {
-        const message = JSON.parse(stdout.slice(0, newline));
-        assert(message.id === 1, `${label} MCP initialize returned the wrong request id`);
-        assert(message.result?.serverInfo?.name === "agent-spine", `${label} MCP initialize returned the wrong server identity`);
-        assert(message.result?.serverInfo?.version === version, `${label} MCP initialize returned a stale server version`);
-        finish(null, { label, server: message.result.serverInfo.name, entrypoint: relative(root, args[0]) });
-      } catch (error) {
-        finish(error);
-      }
-    });
-    child.once("error", (error) => finish(error));
-    child.once("close", (code) => {
-      if (!settled) finish(new Error(`${label} MCP server exited with ${code}${stderr ? `: ${stderr.trim()}` : ""}`));
-    });
-    // A real MCP host keeps stdio open after initialization. Closing stdin
-    // here let macOS and Windows terminate the server before its queued reply.
-    child.stdin.write(`${JSON.stringify({
-      jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2025-06-18" }
-    })}\n`);
-  });
-}
-
-export async function checkHosts(root = process.cwd()) {
-  root = resolve(root);
-  const [pkg, blunManifest, claudeManifest, claudeMcp, codexManifest, claudeHooks, codexHooks, hookVersion] = await Promise.all([
-    json(root, "package.json"),
-    json(root, "blun.plugin.json"),
-    json(root, ".claude-plugin/plugin.json"),
-    json(root, ".mcp.json"),
-    json(root, ".codex-plugin/plugin.json"),
-    json(root, "hooks/hooks.json"),
-    json(root, "hooks/codex.json"),
-    json(root, "hooks/version.json")
-  ]);
-  assert(blunManifest.version === pkg.version && claudeManifest.version === pkg.version && codexManifest.version === pkg.version,
-    "host manifests must use the package cache version");
-  assert(hookVersion.schema === "agentspine.hook-bundle/v1" && hookVersion.version === pkg.version,
-    "hook bundle version must match the package cache version");
-  assert(hookVersion.contract === "agentspine.preflight/v2", "hook bundle preflight contract is missing");
-  assert(pkg.bin?.["agentspine-worker"] === "./src/worker.js", "package must register exactly one gateway worker entrypoint");
-  await validateEntrypoint(root, resolve(root, pkg.bin["agentspine-worker"]));
-  assert(claudeManifest.mcpServers === "./.mcp.json", "Claude manifest must explicitly reference ./.mcp.json");
-  assert(claudeManifest.hooks === undefined, "default hooks/hooks.json must not also be registered through a supplemental manifest path");
-  assert(codexManifest.hooks === undefined, "Codex manifest must omit unsupported hook registration fields");
-  assert(claudeMcp.mcpServers && Object.keys(claudeMcp.mcpServers).length === 1, "Claude MCP file must contain one mcpServers registration");
-  assert(codexManifest.mcpServers && Object.keys(codexManifest.mcpServers).length === 1, "Codex manifest must contain one MCP registration");
-  const commonEvents = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PreCompact", "PostCompact", "Stop", "SubagentStop"];
-  const claudeHookInventory = validateHooks(root, claudeHooks, {
-    required: [...commonEvents, "InstructionsLoaded"], commandRoot: "CLAUDE_PLUGIN_ROOT"
-  });
-  const codexHookInventory = validateHooks(root, codexHooks, { required: commonEvents, commandRoot: "PLUGIN_ROOT" });
-  const blunHookInventory = validateBlunHooks(root, blunManifest.hooks);
-  const registrations = await Promise.all([
-    initializeServer({ label: "blun", root, variable: "BLUN_PLUGIN_ROOT", server: blunManifest.mcpServers["agent-spine"], version: pkg.version }),
-    initializeServer({ label: "claude", root, variable: "CLAUDE_PLUGIN_ROOT", server: claudeMcp.mcpServers["agent-spine"], version: pkg.version }),
-    initializeServer({ label: "codex", root, variable: "PLUGIN_ROOT", server: codexManifest.mcpServers["agent-spine"], version: pkg.version })
-  ]);
-  return {
-    ok: true, root, version: pkg.version, registrations,
-    hooks: { blun: blunHookInventory, claude: claudeHookInventory, codex: codexHookInventory },
-    hookDiscovery: {
-      blun: "plugin-manifest", claude: "default-hooks-directory", codex: "bundled-host-adapter",
-      trust: "host-user-required", liveTrustVerified: false
-    },
-    worker: { entrypoint: pkg.bin["agentspine-worker"], setsPerInstall: 1 },
-    exactlyOnce: { mcpServersPerHost: 1, hookSetsPerHost: 1, workerSetsPerInstall: 1 },
-    authority: "registration-check-only"
-  };
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  let root = process.cwd();
-  let pretty = false;
-  for (let index = 0; index < args.length; index += 1) {
-    if (args[index] === "--root") root = args[++index];
-    else if (args[index] === "--json") pretty = true;
-    else throw new Error(`unknown host-check argument: ${args[index]}`);
-  }
-  process.stdout.write(`${JSON.stringify(await checkHosts(root), null, pretty ? 2 : 0)}\n`);
-}
-
-if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
-  main().catch((error) => {
-    process.stderr.write(`AgentSpine host check failed: ${error.message}\n`);
-    process.exitCode = 1;
-  });
-}