blun-king-cli 9.1.597 → 9.1.600

package/agent-spine-plugin/src/lib/pre-answer-timeline-recall.js

@@ -0,0 +1,104 @@
+import {createHash} from "node:crypto";
+import {authorizeSessionTimelineInvocation,searchSessionTimeline} from "./session-timeline.js";
+import {resolvePrivateSessionTimelineEnrollment} from "./session-timeline-enrollment.js";
+import {rankTimelineEvents,timelineTerms} from "./session-timeline-query.js";
+import {timelineTransportDigest} from "./session-timeline-transport.js";
+
+const SCHEMA="agentspine.pre-answer-timeline-recall/v1", AUTHORITY="context-only";
+const hash=value=>createHash("sha256").update(value).digest("hex");
+const unavailable=(reason,s=0,o=0)=>({schema:SCHEMA,status:"unavailable",reason,awaited:true,
+  sourceReads:s,events:[],omittedEvents:o,completionVerified:false,authority:AUTHORITY});
+
+function exactScope(binding,visibility){
+  const {host,sessionId,taskId,...continuity}=binding;
+  return {...continuity,groupId:null,currentTaskId:taskId,timelineVisibility:visibility};
+}
+
+function prefix(values){
+  let value=values[0]||"";
+  for (const item of values.slice(1)) while(value&&!item.startsWith(value)) value=value.slice(0,-1);
+  return value;
+}
+
+function compact(events){
+  const sources=[],indices=new Map(),messagePrefix=prefix(events.map(item=>item.messageRef)),
+    timePrefix=prefix(events.map(item=>item.at));
+  const rows=events.map(item=>{
+    const key=`${item.sourceDigest}\0${item.sourceProvider}\0${item.sessionRef}`;
+    let source=indices.get(key);
+    if(source===undefined){source=sources.length;indices.set(key,source);
+      sources.push({digest:item.sourceDigest,provider:item.sourceProvider,session:item.sessionRef});}
+    const kind=item.kind === "objective-result" ? "result" : item.kind === "user-message-candidate" ? "user" : "correction";
+    const value=kind === "result" ? [item.outcome,item.count?.value ?? null,item.count?.total ?? null,
+      item.testLabel, item.excerpt] : kind === "correction" ? item.nextStepSummary : item.sourceText;
+    return [source, item.messageRef.slice(messagePrefix.length), item.at.slice(timePrefix.length), kind, value];
+  });
+  const fields = ["source", "message", "at", "kind", "value"], prefixes = [messagePrefix, timePrefix];
+  return sources.length === 1 ? { source: sources[0], prefixes, fields: fields.slice(1), events: rows.map((row) => row.slice(1)) }
+    : { sources, prefixes, fields, events: rows };
+}
+
+async function lane({root,enrollment,hostHome,transport,turnId,name,query,ref,at,environment}){
+  const {binding:b,enrollmentDigest:d,timelineVisibility:v}=enrollment,{host,...fields}=b,w=at?900:0;
+  const scope = exactScope(b,v);
+  const runtime = { root, host, sessionId:b.sessionId, scope, hostHome, environment };
+  const request = { root, tool: "search", ...fields, groupId: null,
+    timelineVisibility:v, enrollmentDigest:d, at:at||null, query, windowSeconds:w,
+    includePriorSessions: true, includePriorProviders: false, ...(ref && { ref }) };
+  const authorized = await authorizeSessionTimelineInvocation({ ...runtime, tool: "search", request,
+    toolUseId: `automatic-pre-answer:${hash(`${turnId}\0${name}\0${d}`)}`,
+    transportDigest: transport, enrollmentDigest:d });
+  return authorized && searchSessionTimeline({ ...runtime, at, query, windowSeconds:w, includePriorSessions: true,
+    includePriorProviders: false, invocationRequest: request, invocationTool: "search", transportDigest: transport,
+    enrollmentDigest:d });
+}
+
+export async function automaticPreAnswerTimelineRecall({root,host,sessionId,scope,hostHome,eventId,
+  turnId,prompt,environment=process.env}) {
+  if(!scope||scope.groupId!==null||!scope.currentTaskId)return unavailable("private-task-scope-unavailable");
+  let sourceReads=0;
+  try {
+    const enrollment=await resolvePrivateSessionTimelineEnrollment({root,host,sessionId,hostHome});
+    if(enrollment.status!=="enrolled")return unavailable("private-enrollment-unavailable");
+    const transport=timelineTransportDigest({root,binding:enrollment.binding,environment});
+    if(!transport)return unavailable("timeline-transport-unavailable");
+    const recallId=turnId||eventId||"turn",terms=timelineTerms(prompt);
+    sourceReads++;
+    const objective = await lane({ root, enrollment, hostHome, transport, turnId: recallId,
+      name: "objective", query: ["objective result", ...terms].join(" ").slice(0,512), environment });
+    if(!objective||objective.blocked)return unavailable("timeline-search-unavailable",sourceReads);
+    const selected = rankTimelineEvents((objective.events || []).map((item) =>
+      ({ ...item, terms: timelineTerms(item.excerpt) })), terms)[0];
+    if(!selected)return timelineRecallNotFound(sourceReads);
+    sourceReads++;
+    const natural = await lane({ root, enrollment, hostHome, transport, turnId: recallId,
+      name: "natural-feedback", query: "user message", ref: selected?.sessionRef, at:selected?.at, environment });
+    if(!natural||natural.blocked)return unavailable("timeline-search-unavailable",sourceReads);
+    const events = [...selected ? [selected] : [], ...(natural.events || []).slice(0, 3)];
+    const unique = [...new Map(events.map((item) => [`${item.sourceDigest}\0${item.id}`, item])).values()];
+    return { schema: SCHEMA, status: unique.length ? "recalled" : "not-found", awaited: true,
+      sourceReads, ...compact(unique), omittedEvents:(objective.events?.length||0)
+        +(natural.events?.length||0)-unique.length,completionVerified:false,
+      naturalMessages: "unresolved", trust: "untrusted-session-history", authority: AUTHORITY };
+  } catch { return unavailable("timeline-search-unavailable", sourceReads); }
+}
+
+const removeLast=r=>r.events.length>1?{...r,events:r.events.slice(0,-1),omittedEvents:r.omittedEvents+1}
+  :unavailable("host-context-budget",r.sourceReads,r.omittedEvents+1);
+export const timelineRecallNotFound=(s=0)=>({...unavailable(null,s),status:"not-found"});
+
+export function fitTimelineRecallToHostContext({timeline,render,maximumBytes}) {
+  let fitted=timeline,recall=timeline?.preAnswerRecall,context=render(fitted);
+  while (Buffer.byteLength(context)>maximumBytes&&recall?.events?.length) {
+    recall=removeLast(recall); fitted={...fitted,preAnswerRecall:recall}; context=render(fitted);
+  }
+  if (Buffer.byteLength(context)>maximumBytes&&recall) {
+    fitted={...fitted,preAnswerRecall:unavailable("host-context-budget",recall.sourceReads,
+      recall.omittedEvents)}; context=render(fitted);
+  }
+  if (Buffer.byteLength(context)>maximumBytes) {
+    fitted={schema:"agentspine.session-timeline/v1",status:"unavailable",
+      reason: "host-context-budget", authority: AUTHORITY }; context = render(fitted);
+  }
+  return {timeline:fitted,context};
+}

package/agent-spine-plugin/src/lib/session-timeline-codex.js

@@ -11,8 +11,6 @@ const RECORDS = new Set(["session_meta", "response_item", "event_msg", "compacte
   "token_usage_record", "world_state", "retained_context", "security_risk_score", "realtime_item",
   "inter_agent_communication", "inter_agent_communication_metadata"]);
 
-// Read only the explicitly supplied native source. No directory discovery,
-// decompression, inherited-history traversal or source rewriting is allowed.
 export async function validateCodexTimelineHeader({ source, root, sessionId }) {
   let handle;
   try {
@@ -37,8 +35,6 @@ export async function validateCodexTimelineHeader({ source, root, sessionId }) {
   finally { await handle?.close(); }
 }
 
-// Whitelist actual Responses output records, never assistant/user assertions.
-// The caller applies the common secret/injection filter to the original line.
 export function codexTimelineToolResult(line) {
   if (!RECORDS.has(line?.type) || line.schema_version !== undefined) {
     throw new Error("codex-history-format-mismatch");

package/agent-spine-plugin/src/lib/session-timeline-enrollment-source.js

@@ -7,9 +7,6 @@ export const PRIVATE_TIMELINE_PREFIX_BYTES = 4096;
 
 function digest(value) { return createHash("sha256").update(value).digest("hex"); }
 
-// A receipt and enrollment never read a complete host transcript.  A small
-// stable prefix makes later replacement detectable while append verification
-// establishes the bounded full commitment separately.
 export async function privateTimelinePrefixDigest(source, bytes = Math.min(source?.size, PRIVATE_TIMELINE_PREFIX_BYTES)) {
   if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > PRIVATE_TIMELINE_PREFIX_BYTES) return null;
   let handle;

package/agent-spine-plugin/src/lib/session-timeline-enrollment-storage.js

@@ -55,10 +55,6 @@ export async function readPrivateEnrollmentState({
   if (typeof assertOwned !== "function" || !recoverableForwardCommit(state, head)) {
     throw new Error("private timeline enrollment state replay was rejected");
   }
-  // A state replacement can survive a crash before its paired head replacement.
-  // Repair is allowed only while holding the owned lock and only for the exact
-  // authenticated one-generation successor of the retained head.  Re-read both
-  // records after writing so a path swap cannot produce usable content.
   const freshState = await readAuthenticatedTimelineState(path, maximumBytes, assertStable);
   const checkedState = await verifySessionTimelineState(validate(JSON.parse(freshState), root.value));
   const checkedHead = await readHead(headPath, root, assertStable, headSchema, headAuthority, maximumBytes);

package/agent-spine-plugin/src/lib/session-timeline-enrollment-transport.js

@@ -2,8 +2,6 @@ import { sameTimelineBinding } from "./session-timeline-contract.js";
 import { resolvePrivateSessionTimelineEnrollment } from "./session-timeline-enrollment.js";
 import { validTimelineTransportDigest } from "./session-timeline-transport.js";
 
-// Keep the digest inside the signed enrollment record. This verifier returns
-// only a boolean so neither the transport value nor its digest reaches cards.
 export async function timelineTransportEnrollmentMatches({
   root, binding, enrollmentDigest, transportDigest, hostHome = null
 }) {

package/agent-spine-plugin/src/lib/session-timeline-enrollment.js

@@ -177,10 +177,6 @@ async function saveState(state, path, headPath, root, assertOwned, assertStable)
   });
 }
 
-// The normal path remains read-only.  If a crash left one verified state
-// generation ahead of its signed head, retry under the existing owned lock so
-// storage can perform its exact one-step repair; every other failure remains
-// unavailable and yields no enrollment or source data.
 async function loadStateWithRecovery(rootPath, { create = false } = {}) {
   const names = await enrollmentPaths(rootPath, { create });
   try {
@@ -212,9 +208,6 @@ async function canonicalRoot(root) {
   catch { return null; }
 }
 
-// This is called only by a verified provider UserPromptSubmit lifecycle adapter. It
-// records a signed, short-lived observation; the opaque token itself is never
-// returned through hook context or a briefing.
 export async function issueHostTranscriptReceipt({
   root, host, sessionId, scope, transcriptPath, hostHome, event, eventId = null,
   hostOrigin = null, clock = null, environment = process.env
@@ -241,8 +234,6 @@ export async function issueHostTranscriptReceipt({
     protocolVersion: timelineProtocolFromRuntime(host, environment) })) {
     return hostReceiptUnavailable("king-history-format-version-or-binding-mismatch");
   }
-  // This bounded 4 KiB digest is an immutable source binding, not transcript
-  // capture: receipt issuance never retains or injects the source text.
   const snapshot = await normalizePrivateTimelineSource(source);
   if (!snapshot) return hostReceiptUnavailable("transcript-snapshot-unavailable");
   try {
@@ -270,9 +261,6 @@ export async function issueHostTranscriptReceipt({
   }
 }
 
-// The local owner can retrieve only the opaque current-session token.  The
-// protected transport capability proves the caller's host session; no source
-// path, scope, or transcript content is returned to a generic CLI process.
 export async function currentHostTranscriptReceipt({ root, clock = null, environment = process.env }) {
   const current = runtimeDate(clock);
   if (!current) return hostReceiptUnavailable("invalid-host-receipt-time");
@@ -292,9 +280,6 @@ export async function currentHostTranscriptReceipt({ root, clock = null, environ
   }
 }
 
-// Internal state-only lookup for bootstrap and lifecycle hints. It reads the
-// signed enrollment record but deliberately never opens, stats, or hashes the
-// transcript; callers still need the normal resolver before any evidence read.
 export async function loadPrivateSessionTimelineEnrollment({
   root, host = null, sessionId = null, scope = null, enrollmentDigest: wantedDigest = null,
   expectedTransportDigest = null, clock = null
@@ -356,9 +341,6 @@ export async function inspectPrivateSessionTimelineEnrollment({
     const candidates = state.enrollments.filter((item) => item.binding.host === host && item.binding.sessionId === activeSessionId);
     const requestedPath = typeof transcriptPath === "string" && transcriptPath
       ? transcriptPath : candidates.length === 1 ? candidates[0].source.path : null;
-    // Post-compaction input may omit a host profile root. In that case, the
-    // sealed root from the one matching enrollment is the only allowed
-    // fallback; an environment or arbitrary caller path is never consulted.
     const trustedHome = hostHome === null || hostHome === undefined
       ? candidates.length === 1 ? candidates[0].source.profileRoot : null
       : isAbsolute(hostHome) ? hostHome : null;
@@ -399,10 +381,6 @@ export async function mutatePrivateSessionTimelineEnrollment({ root, task }) {
   }
 }
 
-// A first state write interrupted before any signed head exists is not
-// distinguishable from a deleted head.  It is never auto-accepted: a local
-// owner may explicitly discard all enrollment state, then obtain a fresh host
-// receipt.  This function exposes no historic binding, path, or transcript.
 export async function resetPrivateSessionTimelineEnrollment({ root, confirmation }) {
   if (confirmation !== LOCAL_TIMELINE_ENROLLMENT_RECOVERY_CONFIRMATION) return false;
   const rootPath = await canonicalRoot(root);

package/agent-spine-plugin/src/lib/session-timeline-host-origin.js

@@ -38,10 +38,6 @@ function eligibleTimelineOrigin(binding, input) {
     && typeof transcriptPath === "string" && transcriptPath.length > 0;
 }
 
-// The opaque object is process-local and recorded in a WeakSet only after the
-// exact preflight receipt was atomically consumed for this UserPromptSubmit.
-// It is never serialized, persisted, returned to a model, or accepted from a
-// raw CLI/API object. A raw issuer can therefore not simulate host origin.
 export async function consumeTimelineHostOrigin({
   event, input, scope, resolvedSources, preflight, prompt, environment = process.env, now = new Date()
 }) {

package/agent-spine-plugin/src/lib/session-timeline-prior.js

@@ -1,65 +1,57 @@
 import { createHash } from "node:crypto";
 import { matchesTimelineEvent, rankTimelineEvents } from "./session-timeline-query.js";
-
 const CONTINUITY_FIELDS = ["entityId", "userId", "tenantId", "projectId", "taskId", "portalRef", "threadRef"];
 const REFERENCE_FIELDS = ["host", ...CONTINUITY_FIELDS, "sessionId"];
-
 function digest(value) {
-  return createHash("sha256").update(value).digest("hex");
+return createHash("sha256").update(value).digest("hex");
 }
-
 function sameContinuationScope(candidate, current, includePriorProviders) {
-  return candidate.groupId === null && current.groupId === null
-    && (candidate.host !== current.host || candidate.sessionId !== current.sessionId)
-    && (includePriorProviders || candidate.host === current.host)
-    && CONTINUITY_FIELDS.every((field) => (candidate[field] ?? null) === (current[field] ?? null))
-    && (!candidate.goalId || !current.goalId || candidate.goalId === current.goalId);
+return candidate.groupId === null && current.groupId === null
+&& (candidate.host !== current.host || candidate.sessionId !== current.sessionId)
+&& (includePriorProviders || candidate.host === current.host)
+&& CONTINUITY_FIELDS.every((field) => (candidate[field] ?? null) === (current[field] ?? null))
+&& (!candidate.goalId || !current.goalId || candidate.goalId === current.goalId);
 }
-
 export function timelineSessionReference(binding) {
-  const fields = binding.portalRef || binding.threadRef ? [...REFERENCE_FIELDS, "portalRef", "threadRef"] : REFERENCE_FIELDS;
-  const material = fields
-    .map((field) => `${field}:${binding[field] || ""}`).join("\0");
-  return `session-ref:${digest(material).slice(0, 32)}`;
+const fields = binding.portalRef || binding.threadRef ? [...REFERENCE_FIELDS, "portalRef", "threadRef"] : REFERENCE_FIELDS;
+const material = fields
+.map((field) => `${field}:${binding[field] || ""}`).join("\0");
+return `session-ref:${digest(material).slice(0, 32)}`;
 }
-
 export function priorTimelineSources(state, scoped, { includePriorProviders = false } = {}) {
-  return state.sources.filter((source) => sameContinuationScope(source.binding, scoped, includePriorProviders))
-    .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+return state.sources.filter((source) => sameContinuationScope(source.binding, scoped, includePriorProviders))
+.sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
 }
-
-export function selectPriorTimelineSource(state, scoped, { target, wanted, windowMs, includePriorProviders = false }) {
-  const eligible = priorTimelineSources(state, scoped, { includePriorProviders });
-  const indexed = eligible.flatMap((source, sourceIndex) => rankTimelineEvents(source.events
-    .filter((event) => matchesTimelineEvent(event, wanted, target, windowMs)), wanted, target)
-    .slice(0, 8).map((event) => ({ ...event, sourceIndex })));
-  const ranked = rankTimelineEvents(indexed, wanted, target);
-  return eligible[ranked[0]?.sourceIndex ?? 0] || null;
+export function selectPriorTimelineSource(state, scoped, { target, wanted, windowMs, includePriorProviders = false, sessionRef = null }) {
+const eligible = priorTimelineSources(state, scoped, { includePriorProviders })
+.filter((source) => !sessionRef || timelineSessionReference(source.binding) === sessionRef);
+const indexed = eligible.flatMap((source, sourceIndex) => rankTimelineEvents(source.events
+.filter((event) => matchesTimelineEvent(event, wanted, target, windowMs)), wanted, target)
+.slice(0, 8).map((event) => ({ ...event, sourceIndex })));
+const ranked = rankTimelineEvents(indexed, wanted, target);
+return eligible[ranked[0]?.sourceIndex ?? 0] || null;
 }
-
 export function priorTimelineHint(state, scoped, sourceDigest, { includePriorProviders = false } = {}) {
-  const sources = priorTimelineSources(state, scoped, { includePriorProviders });
-  const latest = sources.flatMap((source) => source.events.map((event) => ({ source, event })))
-    .sort((left, right) => right.event.at.localeCompare(left.event.at))[0] || null;
-  return {
-    available: sources.length > 0,
-    sessions: sources.length,
-    indexedEvents: sources.reduce((total, source) => total + source.events.length, 0),
-    latest: latest ? {
-      sessionRef: timelineSessionReference(latest.source.binding),
-      messageRef: latest.event.id,
-      sourceProvider: latest.source.binding.host,
-      ...(latest.source.binding.portalRef && latest.source.binding.threadRef
-        ? { portalRef: latest.source.binding.portalRef, threadRef: latest.source.binding.threadRef } : {}),
-      sourceDigest: sourceDigest(latest.source),
-      at: latest.event.at,
-      outcome: latest.event.outcome,
-      testLabel: latest.event.testLabel
-    } : null,
-    instruction: sources.length
-      ? `Use session_timeline_search with includePriorSessions${includePriorProviders ? " and includePriorProviders" : ""} only for a relevant exact-time or two-term question.`
-      : null,
-    freshness: "source-not-read",
-    authority: "context-only"
-  };
+const sources = priorTimelineSources(state, scoped, { includePriorProviders });
+const latest = sources.flatMap((source) => source.events.map((event) => ({ source, event })))
+.sort((left, right) => right.event.at.localeCompare(left.event.at))[0] || null;
+return {
+available: sources.length > 0,
+sessions: sources.length,
+indexedEvents: sources.reduce((total, source) => total + source.events.length, 0),
+latest: latest ? {
+sessionRef: timelineSessionReference(latest.source.binding),
+messageRef: latest.event.id,
+sourceProvider: latest.source.binding.host,
+...(latest.source.binding.portalRef && latest.source.binding.threadRef
+? { portalRef: latest.source.binding.portalRef, threadRef: latest.source.binding.threadRef } : {}),
+sourceDigest: sourceDigest(latest.source),
+at: latest.event.at,
+outcome: latest.event.outcome,
+testLabel: latest.event.testLabel
+} : null,
+instruction: null,
+freshness: "source-not-read",
+authority: "context-only"
+};
 }

package/agent-spine-plugin/src/lib/session-timeline-provider.js

@@ -11,9 +11,6 @@ export function crossProviderTimelineEnabled(environment = process.env) {
   return environment?.[TIMELINE_CROSS_PROVIDER_ENV] === "1";
 }
 
-// BLUN currently shares the Codex-compatible AGENTS.md hierarchy, but its
-// persisted agent wire is a distinct provider contract. Keep those identities
-// separate so a passing Codex adapter can never stand in for King history.
 export function timelineHostForRuntime(host, environment = process.env) {
   if (environment?.BLUN_HOME || environment?.BLUN_PLUGIN_ROOT) return "king";
   return validTimelineHost(host) ? host : null;

package/agent-spine-plugin/src/lib/session-timeline-query.js

@@ -33,7 +33,6 @@ export function timelineQuery({ at, query }) {
 }
 
 export function matchesTimelineEvent(event, wanted, target, windowMs) {
-  // Explicit query lane, not a language recognizer. Ordinary searches remain objective/strict-correction only.
   if (event.kind === "user-message-candidate" && !(wanted.includes("user") && wanted.includes("message"))) return false;
   return (!target || Math.abs(new Date(event.at).getTime() - target.getTime()) <= windowMs)
     && (!wanted.length || wanted.filter((term) => event.terms.includes(term)).length >= 2);

package/agent-spine-plugin/src/lib/session-timeline-sid-acl.js

@@ -4,8 +4,6 @@ import { lstat, mkdtemp, open, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-// Numeric FileSystemRights values and SDDL tokens are stable across Windows
-// display languages. Friendly account names never enter the authorization path.
 const FULL_CONTROL = 0x001f01ff;
 const WRITE_MASK = 0x000d0156;
 const GENERIC_WRITE_MASK = 0x50000000;
@@ -168,8 +166,6 @@ async function readNativeWindowsAcl(path, env, runCommand, run, identity) {
   }
 }
 
-// Retained only for dependency-injected compatibility tests. Production uses
-// icacls /save and parses its SID/SDDL export without starting PowerShell.
 export function windowsSidAclCommand(path) {
   const encodedPath = Buffer.from(path, "utf8").toString("base64");
   const script = [

package/agent-spine-plugin/src/lib/session-timeline-source.js

@@ -71,9 +71,6 @@ export function matchesSourceMetadata(metadata, source) {
 }
 
 export async function pathMatchesSource(source, hostHome = null) {
-  // A post-compaction read may not have a fresh host root. The persisted
-  // enrollment root is the sealed authority in that case; ambient process
-  // configuration must never redirect a previously bound transcript.
   const trustedHome = isAbsolute(hostHome || "") ? hostHome : source?.profileRoot;
   if (!isAbsolute(trustedHome || "")) return false;
   const current = await sourcePath(source.path, trustedHome, source.binding?.host || "claude");

package/agent-spine-plugin/src/lib/session-timeline-transport.js

@@ -2,8 +2,6 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import { completeTimelineBinding, safeTimelineId } from "./session-timeline-contract.js";
 import { sessionTimelineRootDigest } from "./session-timeline-root.js";
 
-// This capability is deliberately supplied only by a locally configured host
-// transport. It is never a MCP argument, stored value, hook output, or card.
 export const TIMELINE_TRANSPORT_CAPABILITY_ENV = "AGENTSPINE_TIMELINE_SESSION_CAPABILITY";
 export const TIMELINE_TRANSPORT_SESSION_ENV = "AGENTSPINE_TIMELINE_TRANSPORT_SESSION_ID";
 
@@ -27,9 +25,6 @@ function capability(environment) {
   return typeof value === "string" && CAPABILITY_RE.test(value) && sessionId ? { value, sessionId } : null;
 }
 
-// The environment must carry a freshly generated 32-byte capability for the
-// exact host session. A global or argument-supplied fallback is intentionally
-// absent: standard MCP stdio does not authenticate callers by itself.
 export function timelineTransportDigest({ root, binding, environment = process.env }) {
   const current = capability(environment);
   if (typeof root !== "string" || !root || !completeTimelineBinding(binding) || !current
@@ -45,6 +40,3 @@ export function sameTimelineTransportDigest(left, right) {
   if (!validTimelineTransportDigest(left) || !validTimelineTransportDigest(right)) return false;
   return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
 }
-
-// The one-use record is valid only while the exact local enrollment that
-// produced it is still active. This check occurs before the record is removed.

package/agent-spine-plugin/src/lib/session-timeline-windows-acl.js

@@ -119,9 +119,6 @@ export function createWindowsTimelineAclVerifier({ platform = process.platform,
   };
 }
 
-// Every boundary supplies fresh file metadata. On Windows, changing a security
-// descriptor changes ctime, so only an identical file identity/change-time can
-// reuse a parsed ACL. A changed DACL therefore misses this cache and is denied.
 export function createWindowsTimelineFileAclVerifier({ platform = process.platform, env = process.env, run = spawnSync } = {}) {
   const cache = new Map();
   let identity = null;