llm-cli-gateway 1.17.4 → 1.17.5

package/dist/job-store.d.ts

@@ -23,10 +23,6 @@ export declare function resolveJobStoreDbPath(): string | null;
 export declare function resolveJobRetentionMs(): number;
 export declare function resolveDedupWindowMs(): number;
 export declare function computeRequestKey(cli: string, args: string[], extra?: string): string;
-/**
- * Public surface every backend (sqlite/postgres/memory) must implement. The
- * AsyncJobManager talks to this interface only.
- */
 export interface JobStore {
     recordStart(input: {
         id: string;
@@ -51,15 +47,6 @@ export interface JobStore {
     }): void;
     getById(id: string): JobRecord | null;
     findByRequestKey(requestKey: string): JobRecord | null;
-    /**
-     * Flip every `status='running'` row to `'orphaned'` at gateway boot.
-     *
-     * Returns the row count AND a snapshot of every row that was flipped, so
-     * AsyncJobManager can write a flight-recorder logComplete with the full
-     * sync-helper-equivalent payload (response from stderr||stdout,
-     * durationMs from startedAt). Pre-slice-1.5 rows that never wrote a
-     * logStart degrade silently to a no-op UPDATE inside the FR.
-     */
     markOrphanedOnStartup(): {
         count: number;
         orphaned: Array<OrphanedJobSnapshot>;
@@ -67,11 +54,6 @@ export interface JobStore {
     evictExpired(): number;
     close(): void;
 }
-/**
- * Per-orphan snapshot returned by `markOrphanedOnStartup` so the
- * AsyncJobManager constructor can build a faithful FlightLogResult for
- * each row it flipped.
- */
 export interface OrphanedJobSnapshot {
     id: string;
     correlationId: string;
@@ -80,10 +62,6 @@ export interface OrphanedJobSnapshot {
     stderr: string;
     exitCode: number | null;
 }
-/**
- * SQLite-backed job store. Default backend for production. Durable across
- * gateway restarts; safe for single-instance deployments.
- */
 export declare class SqliteJobStore implements JobStore {
     private logger;
     private db;
@@ -101,9 +79,6 @@ export declare class SqliteJobStore implements JobStore {
         retentionMs?: number;
         dedupWindowMs?: number;
     });
-    /**
-     * Insert a new running job row. Caller has already computed requestKey.
-     */
     recordStart(input: {
         id: string;
         correlationId: string;
@@ -114,13 +89,7 @@ export declare class SqliteJobStore implements JobStore {
         startedAt: string;
         pid: number | null;
     }): void;
-    /**
-     * Batched output flush. Cheap to call repeatedly; better-sqlite3 is sync.
-     */
     recordOutput(id: string, stdout: string, stderr: string, outputTruncated: boolean): void;
-    /**
-     * Mark a job as completed/failed/canceled. Sets expires_at = now + retention.
-     */
     recordComplete(input: {
         id: string;
         status: Exclude<JobStoreStatus, "running">;
@@ -132,43 +101,15 @@ export declare class SqliteJobStore implements JobStore {
         finishedAt: string;
     }): void;
     getById(id: string): JobRecord | null;
-    /**
-     * Returns the most recent matching job within the dedup window, if any.
-     * Caller pre-filters out forceRefresh requests.
-     */
     findByRequestKey(requestKey: string): JobRecord | null;
-    /**
-     * On gateway boot, flip any jobs that were 'running' to 'orphaned'.
-     * The child processes were detached but can't be reattached to in this process.
-     *
-     * Returns the row count + a per-orphan snapshot so AsyncJobManager can
-     * write a flight-recorder logComplete with proper audit data
-     * (durationMs from startedAt, response from stderr||stdout).
-     */
     markOrphanedOnStartup(): {
         count: number;
         orphaned: Array<OrphanedJobSnapshot>;
     };
-    /**
-     * Delete rows whose expires_at has passed. Returns number of rows deleted.
-     */
     evictExpired(): number;
     close(): void;
 }
-/**
- * Backwards-compatibility alias. Older code and tests construct `new JobStore(path)`
- * directly; that surface now resolves to the SQLite implementation. Prefer
- * `createJobStore(config)` in new code.
- *
- * @deprecated Use `SqliteJobStore` directly, or `createJobStore(persistenceConfig)`.
- */
 export declare const JobStoreClass: typeof SqliteJobStore;
-/**
- * In-process job store. Same semantics as SqliteJobStore but state lives in a
- * Map and is lost on process exit. Use for tests and ephemeral/CI gateways
- * that have explicitly acknowledged the trade-off via
- * `[persistence].acknowledgeEphemeral = true`.
- */
 export declare class MemoryJobStore implements JobStore {
     private rows;
     private retentionMs;
@@ -200,10 +141,6 @@ export declare class MemoryJobStore implements JobStore {
     }): void;
     getById(id: string): JobRecord | null;
     findByRequestKey(requestKey: string): JobRecord | null;
-    /**
-     * In-memory stores have no cross-process state, so any "running" rows here
-     * came from this very process and aren't actually orphaned. No-op.
-     */
     markOrphanedOnStartup(): {
         count: number;
         orphaned: Array<OrphanedJobSnapshot>;
@@ -211,12 +148,6 @@ export declare class MemoryJobStore implements JobStore {
     evictExpired(): number;
     close(): void;
 }
-/**
- * Stub for the planned Postgres backend. The interface and config surface ship
- * now so multi-instance deployments can plan around them, but the
- * implementation is intentionally not yet provided — calling code must select
- * `sqlite` or `memory` until a real impl lands.
- */
 export declare class PostgresJobStore implements JobStore {
     constructor(_dsn: string, _logger?: Logger);
     recordStart(): void;
@@ -231,9 +162,4 @@ export declare class PostgresJobStore implements JobStore {
     evictExpired(): number;
     close(): void;
 }
-/**
- * Construct the JobStore appropriate to the resolved PersistenceConfig.
- * Returns `null` when `backend = "none"` — callers must not register
- * `*_request_async` tools in that case (use `config.asyncJobsEnabled`).
- */
 export declare function createJobStore(config: PersistenceConfig, logger?: Logger): JobStore | null;

package/dist/job-store.js

@@ -25,7 +25,7 @@ export function resolveJobRetentionMs() {
     }
     return days * 24 * 60 * 60 * 1000;
 }
-const DEFAULT_DEDUP_WINDOW_MS = 60 * 60 * 1000; // 1 hour
+const DEFAULT_DEDUP_WINDOW_MS = 60 * 60 * 1000;
 export function resolveDedupWindowMs() {
     const raw = process.env.LLM_GATEWAY_DEDUP_WINDOW_MS;
     if (raw === undefined)
@@ -59,10 +59,6 @@ function rowToRecord(row) {
         expiresAt: row.expires_at,
     };
 }
-/**
- * SQLite-backed job store. Default backend for production. Durable across
- * gateway restarts; safe for single-instance deployments.
- */
 export class SqliteJobStore {
     logger;
     db;
@@ -116,7 +112,6 @@ export class SqliteJobStore {
                 chmodSync(dbPath, 0o600);
             }
             catch {
-                // Best effort permissions hardening.
             }
         }
         this.retentionMs = options.retentionMs ?? resolveJobRetentionMs();
@@ -140,8 +135,6 @@ export class SqliteJobStore {
       WHERE id = @id
     `);
         this.getByIdStmt = this.db.prepare(`SELECT * FROM jobs WHERE id = ?`);
-        // Dedup query: most recent non-orphaned job with matching request_key, started within window.
-        // Exclude orphaned/canceled/failed-with-error from dedup so a broken run isn't reused.
         this.findByRequestKeyStmt = this.db.prepare(`
       SELECT * FROM jobs
       WHERE request_key = ?
@@ -150,12 +143,6 @@ export class SqliteJobStore {
       ORDER BY started_at DESC
       LIMIT 1
     `);
-        // Snapshot every in-flight row's audit data BEFORE the orphan-flip
-        // UPDATE so AsyncJobManager can construct a full FlightLogResult per
-        // orphan. No transaction wrapper required: gateway boot is
-        // single-threaded before any new jobs can arrive, so no
-        // status='running' row can be inserted between this SELECT and the
-        // UPDATE below.
         this.selectRunningOrphansStmt = this.db.prepare(`
       SELECT id, correlation_id, started_at, stdout, stderr, exit_code
       FROM jobs WHERE status = 'running'
@@ -170,9 +157,6 @@ export class SqliteJobStore {
     `);
         this.deleteExpiredStmt = this.db.prepare(`DELETE FROM jobs WHERE expires_at < ?`);
     }
-    /**
-     * Insert a new running job row. Caller has already computed requestKey.
-     */
     recordStart(input) {
         this.insertStmt.run({
             id: input.id,
@@ -190,13 +174,9 @@ export class SqliteJobStore {
             started_at: input.startedAt,
             finished_at: null,
             pid: input.pid,
-            // Running jobs never expire — only completed/failed/canceled do.
             expires_at: FAR_FUTURE_ISO,
         });
     }
-    /**
-     * Batched output flush. Cheap to call repeatedly; better-sqlite3 is sync.
-     */
     recordOutput(id, stdout, stderr, outputTruncated) {
         this.updateOutputStmt.run({
             id,
@@ -205,9 +185,6 @@ export class SqliteJobStore {
             output_truncated: outputTruncated ? 1 : 0,
         });
     }
-    /**
-     * Mark a job as completed/failed/canceled. Sets expires_at = now + retention.
-     */
     recordComplete(input) {
         const expiresAt = new Date(Date.parse(input.finishedAt) + this.retentionMs).toISOString();
         this.updateCompleteStmt.run({
@@ -226,30 +203,14 @@ export class SqliteJobStore {
         const row = this.getByIdStmt.get(id);
         return row ? rowToRecord(row) : null;
     }
-    /**
-     * Returns the most recent matching job within the dedup window, if any.
-     * Caller pre-filters out forceRefresh requests.
-     */
     findByRequestKey(requestKey) {
         const cutoff = new Date(Date.now() - this.dedupWindowMs).toISOString();
         const row = this.findByRequestKeyStmt.get(requestKey, cutoff);
         return row ? rowToRecord(row) : null;
     }
-    /**
-     * On gateway boot, flip any jobs that were 'running' to 'orphaned'.
-     * The child processes were detached but can't be reattached to in this process.
-     *
-     * Returns the row count + a per-orphan snapshot so AsyncJobManager can
-     * write a flight-recorder logComplete with proper audit data
-     * (durationMs from startedAt, response from stderr||stdout).
-     */
     markOrphanedOnStartup() {
         const now = new Date().toISOString();
-        // Orphaned jobs retain a short window so callers can collect the partial output,
-        // then evict. Reuse the standard retention.
         const expiresAt = new Date(Date.now() + this.retentionMs).toISOString();
-        // SELECT before UPDATE — gateway boot is single-threaded so no row can
-        // appear in 'running' between the two statements.
         const rows = (this.selectRunningOrphansStmt.all?.() ?? []);
         const orphaned = rows.map(row => ({
             id: row.id,
@@ -262,9 +223,6 @@ export class SqliteJobStore {
         const result = this.markOrphanedStmt.run(now, expiresAt);
         return { count: result?.changes ?? 0, orphaned };
     }
-    /**
-     * Delete rows whose expires_at has passed. Returns number of rows deleted.
-     */
     evictExpired() {
         const now = new Date().toISOString();
         const result = this.deleteExpiredStmt.run(now);
@@ -279,20 +237,7 @@ export class SqliteJobStore {
         }
     }
 }
-/**
- * Backwards-compatibility alias. Older code and tests construct `new JobStore(path)`
- * directly; that surface now resolves to the SQLite implementation. Prefer
- * `createJobStore(config)` in new code.
- *
- * @deprecated Use `SqliteJobStore` directly, or `createJobStore(persistenceConfig)`.
- */
 export const JobStoreClass = SqliteJobStore;
-/**
- * In-process job store. Same semantics as SqliteJobStore but state lives in a
- * Map and is lost on process exit. Use for tests and ephemeral/CI gateways
- * that have explicitly acknowledged the trade-off via
- * `[persistence].acknowledgeEphemeral = true`.
- */
 export class MemoryJobStore {
     rows = new Map();
     retentionMs;
@@ -362,10 +307,6 @@ export class MemoryJobStore {
         }
         return best ? { ...best } : null;
     }
-    /**
-     * In-memory stores have no cross-process state, so any "running" rows here
-     * came from this very process and aren't actually orphaned. No-op.
-     */
     markOrphanedOnStartup() {
         return { count: 0, orphaned: [] };
     }
@@ -384,12 +325,6 @@ export class MemoryJobStore {
         this.rows.clear();
     }
 }
-/**
- * Stub for the planned Postgres backend. The interface and config surface ship
- * now so multi-instance deployments can plan around them, but the
- * implementation is intentionally not yet provided — calling code must select
- * `sqlite` or `memory` until a real impl lands.
- */
 export class PostgresJobStore {
     constructor(_dsn, _logger = noopLogger) {
         throw new Error("PostgresJobStore is not yet implemented. Use backend = 'sqlite' (single-instance) or " +
@@ -417,14 +352,8 @@ export class PostgresJobStore {
         throw new Error("not implemented");
     }
     close() {
-        /* no-op */
     }
 }
-/**
- * Construct the JobStore appropriate to the resolved PersistenceConfig.
- * Returns `null` when `backend = "none"` — callers must not register
- * `*_request_async` tools in that case (use `config.asyncJobsEnabled`).
- */
 export function createJobStore(config, logger = noopLogger) {
     const opts = {
         retentionMs: config.retentionDays * 24 * 60 * 60 * 1000,
@@ -436,7 +365,6 @@ export function createJobStore(config, logger = noopLogger) {
         case "memory":
             return new MemoryJobStore(opts);
         case "postgres":
-            // Throws today; design surface is honest so callers can react.
             return new PostgresJobStore(config.dsn ?? "", logger);
         case "sqlite":
         default:

package/dist/logger.d.ts

@@ -2,14 +2,7 @@ export interface Logger {
     info(message: string, meta?: unknown): void;
     error(message: string, meta?: unknown): void;
     debug(message: string, meta?: unknown): void;
-    /** Optional: callers that want explicit WARN routing can implement this. */
     warn?(message: string, meta?: unknown): void;
 }
 export declare const noopLogger: Logger;
-/**
- * Emit a warning through whichever logger surface is available. Some Logger
- * implementations (legacy) only provide `info`/`error`/`debug`; in that case
- * the message is prefixed with `[WARN]` and routed through `info` so it still
- * reaches stderr.
- */
 export declare function logWarn(logger: Logger, message: string, meta?: unknown): void;

package/dist/logger.js

@@ -4,12 +4,6 @@ export const noopLogger = {
     debug: () => { },
     warn: () => { },
 };
-/**
- * Emit a warning through whichever logger surface is available. Some Logger
- * implementations (legacy) only provide `info`/`error`/`debug`; in that case
- * the message is prefixed with `[WARN]` and routed through `info` so it still
- * reaches stderr.
- */
 export function logWarn(logger, message, meta) {
     if (typeof logger.warn === "function") {
         logger.warn(message, meta);

package/dist/migrate-sessions.d.ts

@@ -5,8 +5,5 @@ interface MigrationResult {
     failed: number;
     errors: string[];
 }
-/**
- * Migrate sessions from file-based storage to PostgreSQL
- */
 export declare function migrateFromFile(filePath: string, pgManager: PostgreSQLSessionManager): Promise<MigrationResult>;
 export {};

package/dist/migrate-sessions.js

@@ -5,22 +5,17 @@ import { join } from "path";
 import { PostgreSQLSessionManager } from "./session-manager-pg.js";
 import { loadConfig } from "./config.js";
 import { createDatabaseConnection } from "./db.js";
-// Simple console logger for migration script
 const logger = {
     info: (message, meta) => console.error(`[INFO] ${message}`, meta || ""),
     error: (message, meta) => console.error(`[ERROR] ${message}`, meta || ""),
     debug: (message, meta) => console.error(`[DEBUG] ${message}`, meta || ""),
 };
-/**
- * Migrate sessions from file-based storage to PostgreSQL
- */
 export async function migrateFromFile(filePath, pgManager) {
     const result = {
         migrated: 0,
         failed: 0,
         errors: [],
     };
-    // Read file-based sessions
     let fileData;
     try {
         const fileContent = readFileSync(filePath, "utf-8");
@@ -30,11 +25,9 @@ export async function migrateFromFile(filePath, pgManager) {
         throw new Error(`Failed to read sessions file: ${error instanceof Error ? error.message : String(error)}`);
     }
     console.error(`Found ${Object.keys(fileData.sessions).length} sessions to migrate`);
-    // Migrate sessions
     for (const [id, session] of Object.entries(fileData.sessions)) {
         try {
             await pgManager.createSession(session.cli, session.description, session.id);
-            // Migrate metadata if present
             if (session.metadata) {
                 await pgManager.updateSessionMetadata(id, session.metadata);
             }
@@ -48,7 +41,6 @@ export async function migrateFromFile(filePath, pgManager) {
             console.error(`✗ ${errorMsg}`);
         }
     }
-    // Restore active sessions
     console.error("\nRestoring active sessions...");
     for (const [cli, sessionId] of Object.entries(fileData.activeSession)) {
         if (sessionId) {
@@ -65,9 +57,6 @@ export async function migrateFromFile(filePath, pgManager) {
     }
     return result;
 }
-/**
- * Main CLI entry point
- */
 async function main() {
     const args = process.argv.slice(2);
     if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
@@ -85,7 +74,6 @@ Environment Variables:
 `);
         process.exit(args[0] === "--help" || args[0] === "-h" ? 0 : 1);
     }
-    // Parse arguments
     let filePath = join(homedir(), ".llm-cli-gateway", "sessions.json");
     for (let i = 0; i < args.length; i++) {
         if (args[i] === "--from" && args[i + 1]) {
@@ -97,19 +85,16 @@ Environment Variables:
     console.error(`  Source: ${filePath}`);
     console.error(`  DATABASE_URL: ${process.env.DATABASE_URL ? "[set]" : "[not set]"}`);
     console.error("");
-    // Load config
     const config = loadConfig();
     if (!config.database) {
         console.error("ERROR: DATABASE_URL must be set");
         process.exit(1);
     }
-    // Connect to database
     console.error("Connecting to database...");
     const db = await createDatabaseConnection(config, logger);
     const pgManager = new PostgreSQLSessionManager(db.getPool());
     console.error("✓ Connected to database\n");
     try {
-        // Run migration
         console.error("Starting migration...\n");
         const result = await migrateFromFile(filePath, pgManager);
         console.error("\n" + "=".repeat(50));
@@ -137,7 +122,6 @@ Environment Variables:
         await db.disconnect();
     }
 }
-// Run if executed directly
 if (import.meta.url === `file://${process.argv[1]}`) {
     main();
 }

package/dist/migrate.js

@@ -4,14 +4,11 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
-/**
- * Load all migration files from migrations directory
- */
 function loadMigrations() {
     const migrationsDir = join(__dirname, "..", "migrations");
     const files = readdirSync(migrationsDir)
         .filter(f => f.endsWith(".sql"))
-        .sort(); // Ensures migrations run in order
+        .sort();
     return files.map(file => {
         const match = file.match(/^(\d+)_(.+)\.sql$/);
         if (!match) {
@@ -23,11 +20,7 @@ function loadMigrations() {
         return { version, name, sql };
     });
 }
-/**
- * Get list of applied migrations
- */
 async function getAppliedMigrations(pool) {
-    // First, ensure schema_migrations table exists
     await pool.query(`
     CREATE TABLE IF NOT EXISTS schema_migrations (
       version INTEGER PRIMARY KEY,
@@ -38,9 +31,6 @@ async function getAppliedMigrations(pool) {
     const result = await pool.query("SELECT version FROM schema_migrations ORDER BY version");
     return result.rows.map(row => row.version);
 }
-/**
- * Run a single migration
- */
 async function runMigration(pool, migration) {
     console.error(`Running migration ${migration.version}: ${migration.name}...`);
     const client = await pool.connect();
@@ -58,9 +48,6 @@ async function runMigration(pool, migration) {
         client.release();
     }
 }
-/**
- * Main migration runner
- */
 async function main() {
     const databaseUrl = process.env.DATABASE_URL;
     if (!databaseUrl) {
@@ -70,20 +57,16 @@ async function main() {
     const { Pool } = await importOptionalPg();
     const pool = new Pool({ connectionString: databaseUrl });
     try {
-        // Load migrations
         const migrations = loadMigrations();
         console.error(`Found ${migrations.length} migration(s)`);
-        // Get applied migrations
         const applied = await getAppliedMigrations(pool);
         console.error(`${applied.length} migration(s) already applied`);
-        // Filter pending migrations
         const pending = migrations.filter(m => !applied.includes(m.version));
         if (pending.length === 0) {
             console.error("✓ All migrations up to date");
             return;
         }
         console.error(`Running ${pending.length} pending migration(s)...`);
-        // Run pending migrations
         for (const migration of pending) {
             await runMigration(pool, migration);
         }

package/dist/mistral-meta-json-parser.js

@@ -1,37 +1,3 @@
-/**
- * Phase 4 slice β — Mistral Vibe `meta.json` parser.
- *
- * Vibe writes per-session telemetry to
- *
- *   ~/.vibe/logs/session/session_<YYYYMMDD>_<HHMMSS>_<first8hex>/meta.json
- *
- * where `<first8hex>` is the first 8 lowercase hex characters of the full
- * session UUID. Inside the file:
- *
- *   {
- *     "session_id": "<full-uuid>",
- *     "stats": {
- *       "session_prompt_tokens":      <number>  → inputTokens
- *       "session_completion_tokens":  <number>  → outputTokens
- *       "session_cost":               <number>  → costUsd
- *     }
- *   }
- *
- * The gateway's mistral session-id surface accepts the full UUID (so does
- * `vibe --resume <uuid>`). To find the right directory we glob for
- * `session_*_<first8>` and disambiguate by reading each candidate's
- * `session_id` field. If callers happen to pass the directory basename
- * itself we still honour that — useful for tests and for forward-compat if
- * Vibe ever changes its dir naming scheme.
- *
- * Cache-token surfaces are not exposed by Vibe today, so `cacheReadTokens`
- * and `cacheCreationTokens` are intentionally absent.
- *
- * Best-effort by design: any failure (missing file, bad JSON, missing
- * fields, gateway-generated `gw-*` sessionId, unresolvable UUID, path
- * outside the session log root) returns `{}` so the flight-recorder row
- * simply lacks usage data.
- */
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "fs";
 import { join, resolve, sep } from "path";
 import { GATEWAY_SESSION_PREFIX } from "./request-helpers.js";
@@ -41,12 +7,6 @@ function asPositiveNumber(value) {
     }
     return value;
 }
-/**
- * Read a file only if its realpath lives under `realBase`. Returns undefined
- * on any error, missing file, or out-of-tree symlink target. This is the one
- * place that calls `readFileSync` for meta.json content — the rest of the
- * module routes through it so the security boundary is uniform.
- */
 function readInBase(realBase, candidate) {
     if (!existsSync(candidate))
         return undefined;
@@ -67,30 +27,12 @@ function readInBase(realBase, candidate) {
         return undefined;
     }
 }
-// UUID v4-ish (Vibe's own session UUIDs are not strictly v4, so we
-// validate against the broader 8-4-4-4-12 lowercase-hex shape) OR
-// Vibe's session_<digits>_<digits>_<first8> directory basename.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const DIRNAME_RE = /^session_\d{8}_\d{6}_[0-9a-f]{8}$/;
-/**
- * Resolve the session-log directory basename for a given gateway sessionId.
- * Returns undefined when no candidate can be found or the input is
- * unsuitable. Pure with respect to side-effects on the caller — only reads
- * the filesystem.
- *
- * Security invariants enforced here:
- *   - Inputs are charset-gated (UUID or DIRNAME) before any filesystem read.
- *   - For UUID input, the chosen candidate's meta.json MUST advertise the
- *     same `session_id` — single-candidate is NOT trusted, because two
- *     UUIDs sharing the first 8 hex chars would otherwise cross-attribute
- *     usage (and leak telemetry to the caller of the other session).
- */
 function resolveVibeSessionDirname(baseDir, realBase, sessionId) {
-    // 1. Caller already supplied the directory name verbatim.
     if (DIRNAME_RE.test(sessionId) && existsSync(join(baseDir, sessionId, "meta.json"))) {
         return sessionId;
     }
-    // 2. Treat the input as a full session UUID.
     if (!UUID_RE.test(sessionId))
         return undefined;
     const short = sessionId.slice(0, 8).toLowerCase();
@@ -101,8 +43,6 @@ function resolveVibeSessionDirname(baseDir, realBase, sessionId) {
     catch {
         return undefined;
     }
-    // Filter to candidates matching `session_*_<short>`. Sort newest-first
-    // by mtime; we still require an exact session_id match below.
     const candidates = entries
         .filter(name => DIRNAME_RE.test(name) && name.endsWith(`_${short}`))
         .map(name => {
@@ -111,7 +51,6 @@ function resolveVibeSessionDirname(baseDir, realBase, sessionId) {
             mtimeMs = statSync(join(baseDir, name)).mtimeMs;
         }
         catch {
-            /* ignore */
         }
         return { name, mtimeMs };
     })
@@ -127,7 +66,6 @@ function resolveVibeSessionDirname(baseDir, realBase, sessionId) {
             }
         }
         catch {
-            /* ignore and continue */
         }
     }
     return undefined;
@@ -136,7 +74,6 @@ export function parseVibeMetaJson(home, sessionId) {
     if (!sessionId)
         return {};
     if (sessionId.startsWith(GATEWAY_SESSION_PREFIX)) {
-        // gw-* IDs are gateway internal — Vibe never wrote a meta.json under that name.
         return {};
     }
     const baseDir = resolve(join(home, ".vibe", "logs", "session"));
@@ -150,10 +87,6 @@ export function parseVibeMetaJson(home, sessionId) {
     const dirname = resolveVibeSessionDirname(baseDir, realBase, sessionId);
     if (!dirname)
         return {};
-    // `readInBase` is the security boundary: it realpath-resolves the file
-    // and rejects anything whose target lives outside `realBase`. Re-routing
-    // the final read through it (instead of a bespoke readFileSync) keeps
-    // the in-tree-only invariant in one place.
     const text = readInBase(realBase, join(baseDir, dirname, "meta.json"));
     if (text === undefined)
         return {};