@jrpool/kilotest 50.0.0 → 51.1.0

package/api/requestFeature.test.ts

@@ -7,6 +7,20 @@
 
 import {test, beforeEach, after} from 'node:test';
 import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// Blank the alert configuration unconditionally, before ./requestFeature.ts (which
+// calls sendAlert) is ever imported below, so this file sends no real alert emails
+// even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
+// ENVIRONMENT
+
+const testDir = path.join(import.meta.dirname, '../test/fixtures/featureRequests');
+process.env.FEATURE_REQUESTS_PATH = path.join(testDir, 'featureRequests.json');
 
 // SETUP AND TEARDOWN
 
@@ -14,16 +28,19 @@ let logged: any[] = [];
 const originalLog = console.log;
 
 // Capture console.log so the alert sendAlert emits can be observed. The alert
-// configuration is empty in tests, so sendAlert logs a WARNING instead of sending.
-beforeEach(() => {
+// configuration is blanked above, so sendAlert logs a WARNING instead of sending.
+beforeEach(async () => {
   logged = [];
   console.log = (...args) => logged.push(args.join(' '));
+  await fs.mkdir(testDir, {recursive: true});
+  await fs.writeFile(process.env.FEATURE_REQUESTS_PATH!, '[]\n');
 });
 
 import {response} from './requestFeature.ts';
 
-after(() => {
+after(async () => {
   console.log = originalLog;
+  await fs.rm(testDir, {recursive: true, force: true});
 });
 
 // TESTS
@@ -72,3 +89,64 @@ test('requestFeature includes tool name and metadata', async () => {
   assert.equal(body['tool name'], 'requestFeature');
   assert.ok(body['response metadata'].identifier);
 });
+
+test('requestFeature records a valid feature request to the feature-requests file', async () => {
+  await response(['Add a dark mode toggle to the reports page']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'Add a dark mode toggle to the reports page');
+  assert.ok(featureRequests[0].timeStamp);
+});
+
+test('requestFeature appends to, rather than overwrites, existing feature requests', async () => {
+  await response(['First feature request of at least 20 characters']);
+  await response(['Second feature request of at least 20 characters']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 2);
+});
+
+test('requestFeature does not record an invalid feature request', async () => {
+  await response(['short']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 0);
+});
+
+test('requestFeature creates the feature-requests file when it does not exist', async () => {
+  await fs.unlink(process.env.FEATURE_REQUESTS_PATH!);
+  await response(['A feature request when no file yet exists']);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'A feature request when no file yet exists');
+});
+
+test('requestFeature rejects a feature request identical to one already on file', async () => {
+  const feature = 'Add a dark mode toggle to the reports page';
+  const firstBody = await response([feature]);
+  const firstDetails = firstBody['response content']['details about your request'] as any;
+  assert.equal(firstDetails.error, undefined);
+  const secondBody = await response([feature]);
+  const secondDetails = secondBody['response content']['details about your request'] as any;
+  assert.ok(secondDetails.error.includes('identical to one already submitted'));
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  // The duplicate was not recorded a second time.
+  assert.equal(featureRequests.length, 1);
+});
+
+test('requestFeature does not notify the manager of a duplicate feature request', async () => {
+  const feature = 'Add a dark mode toggle to the settings page';
+  await response([feature]);
+  logged = [];
+  await response([feature]);
+  assert.ok(
+    !logged.some(line => line.startsWith('WARNING (Kilotest: MCP feature request received)'))
+  );
+});
+
+test('requestFeature accepts a feature request that differs from an existing one', async () => {
+  await response(['An existing feature request on file']);
+  const body = await response(['A different feature request entirely']);
+  const details = body['response content']['details about your request'] as any;
+  assert.equal(details.error, undefined);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 2);
+});

package/api/requestFeature.ts

@@ -8,14 +8,20 @@
 import {z} from 'zod';
 import {getResponseMetadata, getThisHost, getToolsFacts} from './util.ts';
 import {sendAlert} from '../alerts.ts';
-import {checkLength} from '../util.ts';
+import {checkCommentDuplicate, checkLength, getJSON, getNowStamp} from '../util.ts';
 import {requestFeatureResponseSchema} from './schemas.ts';
+import fs from 'node:fs/promises';
+import path from 'node:path';
 
 // TYPES
 
 // The response content defined by the response schema.
 type ResponseContent = z.infer<typeof requestFeatureResponseSchema>['response content'];
 
+// FUNCTIONS (helpers)
+
+const getFeatureRequestsPath = () => process.env.FEATURE_REQUESTS_PATH || path.join(import.meta.dirname, '../db/featureRequests.json');
+
 // FUNCTIONS
 
 // Returns the response body.
@@ -35,15 +41,45 @@ export const response = async (args: string[]) => {
   }
   // Otherwise, i.e. if it is valid:
   else {
-    // Notify the manager.
-    await sendAlert('Kilotest: MCP feature request received', feature);
-    // Add the disposition to the response content.
-    responseContent = {
-      'details about your request': {
-        'date and time received': new Date().toISOString(),
-        disposition: 'received and logged; manager notified'
-      }
-    };
+    // Get the feature requests already on file.
+    const featureRequestsPath = getFeatureRequestsPath();
+    let featureRequests: {timeStamp: string; content: string}[] = [];
+    try {
+      const existing = await fs.readFile(featureRequestsPath, 'utf8');
+      featureRequests = JSON.parse(existing);
+    }
+    catch {
+      // Initialize an empty feature-requests array.
+    }
+    // If the request is identical to one already on file:
+    const duplicateCheck = checkCommentDuplicate(featureRequests, feature);
+    if (duplicateCheck.status === 'error') {
+      responseContent = {
+        'details about your request': {
+          error: 'request invalid: your feature request is identical to one already submitted, ' +
+            'but you are welcome to submit a different one'
+        }
+      };
+    }
+    // Otherwise, i.e. if it is not a duplicate:
+    else {
+      // Record the feature request alongside the existing ones.
+      featureRequests.push({
+        timeStamp: getNowStamp(),
+        content: feature
+      });
+      await fs.mkdir(path.dirname(featureRequestsPath), {recursive: true});
+      await fs.writeFile(featureRequestsPath, getJSON(featureRequests));
+      // Notify the manager.
+      await sendAlert('Kilotest: MCP feature request received', feature);
+      // Add the disposition to the response content.
+      responseContent = {
+        'details about your request': {
+          'date and time received': new Date().toISOString(),
+          disposition: 'received and logged; manager notified'
+        }
+      };
+    }
   }
   // Create a response body.
   const body = {

package/api/requestRetest.test.ts

@@ -11,6 +11,13 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import {fixtureDBDir} from '../test/dbFixture.ts';
 
+// Blank the alert configuration unconditionally, before ./requestRetest.ts (whose
+// processTestRequest calls sendAlert) is ever imported below, so this file sends no
+// real alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;

package/api/requestTest.test.ts

@@ -11,6 +11,13 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import {fixtureDBDir} from '../test/dbFixture.ts';
 
+// Blank the alert configuration unconditionally, before ./requestTest.ts (whose
+// processTestRequest calls sendAlert) is ever imported below, so this file sends no
+// real alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;

package/api/util.test.ts

@@ -7,6 +7,15 @@
 
 import {test} from 'node:test';
 import assert from 'node:assert/strict';
+
+// Blank the alert configuration unconditionally, before ../util.ts (which
+// processTestRequest calls sendAlert from) is ever imported below, so this file sends
+// no real alert emails even when run directly (e.g. `npx tsx --test api/util.test.ts`)
+// rather than via `npm test`, which normally guards against this via test/setup.ts.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 import {getReportBasics, getResponseMetadata, getRuleEngineFacts, getRuleEnginesFacts, getIssueSpec, getToolsFacts} from './util.ts';
 import {processTestRequest} from '../util.ts';
 

package/apiIntegration.test.ts

@@ -8,19 +8,29 @@
 import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import {requestHandler} from './index.ts';
 
 // CONSTANTS
 
 const port = 3998;
+const featureRequestsPath = path.join(import.meta.dirname, 'test/fixtures/apiIntegration/featureRequests.json');
 
 // SETUP AND TEARDOWN
 
 const savedDBDir = process.env.DB_DIR;
+const savedFeatureRequestsPath = process.env.FEATURE_REQUESTS_PATH;
 let server: http.Server;
 
 before(async () => {
   process.env.DB_DIR = (await import('./test/dbFixture.ts')).fixtureDBDir;
+  // Use a fixture path, rather than the real default, for feature requests, so this
+  // test's submission neither pollutes real data nor is rejected as a duplicate of
+  // whatever a prior run of this same test already left on disk.
+  process.env.FEATURE_REQUESTS_PATH = featureRequestsPath;
+  await fs.mkdir(path.dirname(featureRequestsPath), {recursive: true});
+  await fs.writeFile(featureRequestsPath, '[]\n');
   server = http.createServer(requestHandler);
   await new Promise<void>(resolve => server.listen(port, () => resolve()));
 });
@@ -32,6 +42,13 @@ after(async () => {
   else {
     delete process.env.DB_DIR;
   }
+  if (savedFeatureRequestsPath !== undefined) {
+    process.env.FEATURE_REQUESTS_PATH = savedFeatureRequestsPath;
+  }
+  else {
+    delete process.env.FEATURE_REQUESTS_PATH;
+  }
+  await fs.rm(path.dirname(featureRequestsPath), {recursive: true, force: true});
   server.closeAllConnections?.();
   await new Promise<void>(resolve => {
     const timer = setTimeout(() => {

package/docs/SERVICE.md

@@ -256,11 +256,18 @@ kilotest.com {
   }
   # Enable Zstandard and Gzip compression of responses.
   encode zstd gzip
-  # Specify the only paths of forwardable requests. UptimeRobet uses HEAD.
+  # Specify the only paths of forwardable requests.
   @allowedGET {
-    method GET HEAD
+    method GET
     path /mcp / /index.html /robots.txt /openapi.yaml /openapi.json /swagger.yaml /swagger.json /api-docs /llms.txt /llms-full.txt /capability.md *.html* /fullReport.json/* /api/* /tutorialWeb/images/* /tutorialAI/images/* /qai /qai/comments /favicon.* /style.css /sitemap.xml
   }
+  # UptimeRobot's uptime check is the only known HEAD caller, and it targets only the site
+  # root (see "Health monitoring" below), so HEAD is forwarded only for that path, not the
+  # full GET allowlist above. index.ts's HEAD branch matches this same scope.
+  @allowedHEAD {
+    method HEAD
+    path / /index.html
+  }
   @allowedPOST {
     method POST
     path /mcp /requestRetest.html/* /requestTest.html /requestAction.html /reannotate.html /renewWCAG.html /ai0BalanceForm.html /expungeReportsForm.html /hideReportForm.html /metrics.html /pruneReportsForm.html /rewindReportsForm.html /showHiddenReportsForm.html /unhideReportForm.html /api/* /tutorialWebComment.html /tutorialAIComment.html /worker/job /worker/report
@@ -275,13 +282,19 @@ kilotest.com {
     }
     respond 204
   }
-  # Forward any other GET, POST, or OPTIONS request, if allowed, to port 3000.
+  # Forward any other GET, HEAD, or POST request, if allowed, to port 3000.
   handle @allowedGET {
     reverse_proxy localhost:3000 {
       # Improve SSE latency.
       flush_interval -1
     }
   }
+  handle @allowedHEAD {
+    reverse_proxy localhost:3000 {
+      # Improve SSE latency.
+      flush_interval -1
+    }
+  }
   handle @allowedPOST {
     reverse_proxy localhost:3000 {
       # Improve SSE latency.
@@ -362,7 +375,7 @@ The deployment is monitored for external health and availability using [UptimeRo
 
 UptimeRobot also sends a recovery message when the service recovers and a subsequent check succeeds after a prior failure.
 
-This monitoring service requires `Caddyfile` to permit `HEAD` requests, not only `GET` requests, to the root path.
+This monitoring service requires both `Caddyfile` and Kilotest itself to permit `HEAD` requests, not only `GET` requests, to the root path: `Caddyfile`’s `@allowedHEAD` matcher forwards such a request to port 3000, and `index.ts`’s own dedicated `HEAD` branch in `handleRequest` answers it. Before that branch existed, Kilotest treated `HEAD` as an invalid method for every path (its dispatch recognized only `GET` and `POST`), so UptimeRobot’s hourly check received a `400` response and reported the service as down even while it was actually up.
 
 ## Alerting
 
@@ -386,7 +399,7 @@ Alerts are sent to the maintainer in the following conditions:
 
 7. **Test request received via API**: When a test request is submitted via the API, an alert is sent with subject `"Kilotest: new test request in the API"` (via the `requestTest` API operation) or `"Kilotest: new retest request in the API"` (via the `requestRetest` API operation), including the target URL, description, and the user's stated reason. A request is treated as a duplicate, and no alert is sent for it, only if a request already pending in `db/jobs/testRequests.json`, i.e., submitted but not yet manually approved by the maintainer into an actual job, for the same URL has the identical description; this check ignores the stated reason and the test-versus-retest distinction, and is not limited to a recent time window, it compares against every request still pending approval for that URL. Once the maintainer approves a pending request (turning it into a job via `/enqueue.html`), all pending requests for that URL are cleared, so this check cannot detect a duplicate against a request that has already been approved, is currently running, or has already completed; an identical request submitted after approval alerts again. The check and its dedup key are identical for the UI and API paths, since both funnel through the same underlying request-queuing function.
 
-8. **MCP feature request received**: When a user submits a feature request via the MCP server's `requestFeature` tool, an alert is sent with subject `"MCP feature request received"`, including the text of the feature request.
+8. **MCP feature request received**: When a user submits a feature request via the MCP server's `requestFeature` tool, an alert is sent with subject `"MCP feature request received"`, including the text of the feature request, and the request is also appended to `db/featureRequests.json`, the same way tutorial comments are appended to their own files (see item 1), so that a manager can review or delete it later via `/deleteNotesForm.html`.
 
 9. **WAVE balance low**: When Kilotest detects that the account balance for the WAVE API service (used for accessibility testing) has fallen below a threshold, an alert is sent with subject `"Kilotest: WAVE balance low"`, indicating the number of credits remaining.
 

package/index.test.ts

@@ -15,9 +15,19 @@ process.env.DB_DIR = fixtureDBDir;
 process.env.AUTH_CODE = 'test-auth-code';
 process.env.TUTORIAL_WEB_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialWeb.json');
 process.env.TUTORIAL_AI_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialAI.json');
+process.env.FEATURE_REQUESTS_PATH = path.join(testCommentsDir, 'featureRequests.json');
 process.env.TESTARO_WORKERS = JSON.stringify({
   worker1: {secret: 'secret1', name: 'Worker One'}
 });
+// Blank the alert configuration unconditionally, so this file sends no real alert
+// emails (e.g. from the requestTest/requestRetest/tutorial-comment tests below) even
+// when run directly (e.g. `npx tsx --test index.test.ts`) rather than via `npm test`,
+// which normally guards against this by --require-ing test/setup.ts first. dotenv does
+// not override an already-set env var, so setting these here, before index.ts is ever
+// imported, prevents a real .env file's alert credentials from ever taking effect.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 // IMPORTS
 
@@ -58,6 +68,7 @@ beforeEach(async () => {
   await fs.mkdir(testCommentsDir, {recursive: true});
   await fs.writeFile(path.join(testCommentsDir, 'tutorialWeb.json'), '[]\n');
   await fs.writeFile(path.join(testCommentsDir, 'tutorialAI.json'), '[]\n');
+  await fs.writeFile(path.join(testCommentsDir, 'featureRequests.json'), '[]\n');
 });
 
 after(async () => {
@@ -215,6 +226,30 @@ test('GET /index.html serves the home page', async () => {
   assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
+// TESTS: HEAD routes
+
+test('HEAD / returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /index.html returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/index.html');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /robots.txt returns an invalid HEAD request error, since only the home page supports HEAD', async () => {
+  const res = await request('HEAD', '/robots.txt');
+  assert.equal(res.statusCode, 400);
+  assert.equal(res.body, '');
+});
+
 test('GET /robots.txt serves the robots file as text', async () => {
   const res = await request('GET', '/robots.txt');
   assert.equal(res.statusCode, 200);
@@ -1247,6 +1282,7 @@ const htmlPagePaths = [
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
   '/ai0BalanceForm.html',
+  '/deleteNotesForm.html',
   '/metrics.html'
 ];
 
@@ -1424,6 +1460,32 @@ test('POST /rewindReportsForm.html with no selections shows the form and records
   assert.equal(await getManagerActivityCount('rewindReportsForm', 'ok'), countBefore + 1);
 });
 
+test('POST /deleteNotesForm.html deletes multiple selected notes across sources in one submission', async () => {
+  await fs.writeFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(process.env.FEATURE_REQUESTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0001', content: 'A feature request'},
+    {timeStamp: '260101T0001', content: 'A different feature request'}
+  ]));
+  // Reconstructing the POST body's query string uses querystring.stringify, which (unlike
+  // the URLSearchParams object constructor) preserves multiple values for the same field
+  // name as repeated key=value pairs rather than collapsing them into one comma-joined
+  // value, so this exercises that multi-checkbox submission actually deletes every
+  // selected note, not just the one whose value happens to survive the collapse.
+  const res = await formRequest('POST', '/deleteNotesForm.html', [
+    ['authCode', 'test-auth-code'],
+    ['note', `tutorialWeb\t${encodeURIComponent('A web tutorial comment')}`],
+    ['note', `featureRequest\t${encodeURIComponent('A feature request')}`]
+  ]);
+  assert.equal(res.statusCode, 200);
+  const webComments = JSON.parse(await fs.readFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, 'utf8'));
+  assert.equal(webComments.length, 0);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'A different feature request');
+});
+
 test('GET /pruneReportsForm.html records a managerActivity failure when a report file is corrupt', {timeout: 500}, async () => {
   const reportPath = path.join(fixtureDBDir, 'reports', '260101T0001-ct.json');
   const backup = await fs.readFile(reportPath, 'utf8');

package/index.ts

@@ -42,7 +42,9 @@ import {answer as tutorialAI, handleComment as handleTutorialAIComment} from './
 import http, {type IncomingMessage, type ServerResponse} from 'node:http';
 import https from 'node:https';
 import path from 'node:path';
+import querystring from 'node:querystring';
 import {answer as ai0BalanceForm} from './web/ai0BalanceForm/index.ts';
+import {answer as deleteNotesForm} from './web/deleteNotesForm/index.ts';
 import {answer as enqueue} from './web/enqueue/index.ts';
 import {answer as enqueueForm} from './web/enqueueForm/index.ts';
 import {answer as expungeReportsForm} from './web/expungeReportsForm/index.ts';
@@ -97,6 +99,7 @@ type PageHandler = (...args: any[]) => Promise<AnswerData>;
 
 const answer: {
   ai0BalanceForm: PageHandler;
+  deleteNotesForm: PageHandler;
   enqueue: PageHandler;
   enqueueForm: PageHandler;
   expungeReportsForm: PageHandler;
@@ -126,6 +129,7 @@ const answer: {
   [key: string]: PageHandler | undefined;
 } = {
   ai0BalanceForm,
+  deleteNotesForm,
   enqueue,
   enqueueForm,
   expungeReportsForm,
@@ -207,6 +211,7 @@ export const routes = {
     '/api/*',
     '/mcp',
     '/ai0BalanceForm.html',
+    '/deleteNotesForm.html',
     '/expungeReportsForm.html',
     '/hideReportForm.html',
     '/metrics.html',
@@ -240,6 +245,7 @@ const managerPages = new Set([
   'unhideReportForm',
   'ai0BalanceForm',
   'renewWCAGForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The set of manager pages (a subset of managerPages) whose single answer() function both
@@ -255,6 +261,7 @@ const selfSubmittingManagerPages = new Set([
   'showHiddenReportsForm',
   'unhideReportForm',
   'ai0BalanceForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The subset of selfSubmittingManagerPages that must never be served on a direct GET
@@ -857,6 +864,19 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       );
     }
   }
+  // Otherwise, if the request is a HEAD request: only the home page supports HEAD, since
+  // UptimeRobot's uptime check is the only known HEAD caller and it targets only that path
+  // (see "Health monitoring" in docs/SERVICE.md). Its response must match what GET / would
+  // send, minus the body, so that a monitor reading headers alone sees the real page state.
+  else if (method === 'HEAD') {
+    if (['/', '/index.html'].includes(pathname)) {
+      setHeaders('text/html', '/index.html', 'medium');
+      response.end();
+    }
+    else {
+      await serveError({message: `ERROR: Invalid HEAD request (${pathname})`}, response, true);
+    }
+  }
   // Otherwise, if the request is a POST request:
   else if (method === 'POST') {
     // If the path is not authorized for POST requests:
@@ -1023,7 +1043,12 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         setHeaders('text/html', pathname, 'ultra');
         // Reconstruct a query string from the POST body, so the page's answer() function
         // can read its submitted parameters the same way it reads a GET query string.
-        const search = `?${new URLSearchParams(postData as Record<string, string>).toString()}`;
+        // querystring.stringify (rather than the URLSearchParams object constructor) is
+        // required here, because postData, from querystring.parse in getPOSTData, holds
+        // repeated form fields (e.g. multiple checked checkboxes sharing a name) as an
+        // array; the URLSearchParams constructor would join such an array into a single
+        // comma-separated value instead of preserving it as repeated key=value pairs.
+        const search = `?${querystring.stringify(postData as Record<string, string | string[]>)}`;
         // Get the answer data. The method is passed so the handler only processes a
         // submission for POST, never for GET, regardless of what its query string contains.
         const answerData = await answer[topic]!(pathTail, search, method);
@@ -1214,7 +1239,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       }
     }
   }
-  // Otherwise, i.e. if it is neither a GET nor a POST request:
+  // Otherwise, i.e. if it is none of GET, HEAD, or POST:
   else {
     // Report its invalidity. (Caddy handles OPTIONS requests.)
     await serveError({message: 'ERROR: Invalid request method'}, response, true);

package/linkValidation.test.ts

@@ -60,6 +60,7 @@ const htmlRoutes = [
   '/expungeReportsForm.html',
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
+  '/deleteNotesForm.html',
   '/renewWCAG.html',
   '/renewWCAGForm.html',
   '/enqueue.html',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "50.0.0",
+  "version": "51.1.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",

package/robots.txt

@@ -2,6 +2,7 @@
 User-agent: *
 Allow: /
 Disallow: /ai0BalanceForm.html
+Disallow: /deleteNotesForm.html
 Disallow: /enqueueForm.html
 Disallow: /recAction.html
 Disallow: /reannotateForm.html

package/smokeTest.ts

@@ -41,6 +41,7 @@ const concretePaths: Record<string, Record<string, string>> = {
     '/api/*': '/api/requestFeature',
     '/mcp': '/mcp',
     '/ai0BalanceForm.html': '/ai0BalanceForm.html',
+    '/deleteNotesForm.html': '/deleteNotesForm.html',
     '/expungeReportsForm.html': '/expungeReportsForm.html',
     '/hideReportForm.html': '/hideReportForm.html',
     '/metrics.html': '/metrics.html',
@@ -64,6 +65,7 @@ const postBodies: Record<string, object> = {
   '/api/requestFeature': {feature: 'smoke test'},
   '/mcp': {},
   '/ai0BalanceForm.html': {authCode: 'invalid'},
+  '/deleteNotesForm.html': {authCode: 'invalid'},
   '/expungeReportsForm.html': {authCode: 'invalid'},
   '/hideReportForm.html': {authCode: 'invalid'},
   '/metrics.html': {authCode: 'invalid'},
@@ -229,20 +231,23 @@ const isMCPErrorResponse = (result: {statusCode: number | undefined, body: strin
     console.log(`FAIL: POST ${mcpPath} initialize -> error: ${message}`);
     failures++;
   }
-  // Send a browser-style GET to verify that invalid MCP requests get JSON-RPC errors end-to-end.
+  // Send a POST with an Accept header the MCP SDK itself rejects (missing text/event-stream)
+  // to verify that invalid MCP requests get JSON-RPC errors end-to-end. A browser-style GET
+  // is not used here because index.ts deliberately intercepts it before handleMCP, serving a
+  // human-readable explainer page instead of a JSON-RPC error.
   try {
-    const probe = await sendMCPRequest('GET', 'text/html');
+    const probe = await sendMCPRequest('POST', 'application/json', mcpInitialize);
     if (isMCPErrorResponse(probe)) {
-      console.log(`PASS: GET ${mcpPath} browser -> ${probe.statusCode} (JSON-RPC error)`);
+      console.log(`PASS: POST ${mcpPath} bad accept -> ${probe.statusCode} (JSON-RPC error)`);
     }
     else {
-      console.log(`FAIL: GET ${mcpPath} browser -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
+      console.log(`FAIL: POST ${mcpPath} bad accept -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
       failures++;
     }
   }
   catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.log(`FAIL: GET ${mcpPath} browser -> error: ${message}`);
+    console.log(`FAIL: POST ${mcpPath} bad accept -> error: ${message}`);
     failures++;
   }
   console.log(`\n=== ${failures === 0 ? 'All checks passed' : `${failures} failure(s)`} ===`);

package/util.test.ts

@@ -9,6 +9,15 @@ import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+
+// Blank the alert configuration unconditionally, before util.ts (which processTestRequest
+// calls sendAlert from) is ever imported below, so this file sends no real alert emails
+// even when run directly (e.g. `npx tsx --test util.test.ts`) rather than via `npm test`,
+// which normally guards against this via test/setup.ts.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 import {
   annotateReportObject,
   checkCommentDuplicate,
@@ -116,26 +125,18 @@ test('checkCommentDuplicate accepts a comment with no existing comments', () =>
   assert.deepEqual(result, {status: 'ok'});
 });
 
-test('checkCommentDuplicate rejects a comment repeating one submitted within the last 1000 seconds', () => {
+test('checkCommentDuplicate rejects a comment identical to one already stored, regardless of when', () => {
   const content = 'a'.repeat(20);
-  const comments = [{timeStamp: getNowStamp(), content}];
+  const comments = [{content}];
   const result = checkCommentDuplicate(comments, content);
   assert.deepEqual(result, {
     status: 'error',
-    message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   });
 });
 
-test('checkCommentDuplicate accepts a comment repeating one submitted more than 1000 seconds ago', () => {
-  const content = 'a'.repeat(20);
-  const oldTimeStamp = getTimeStamp(new Date(Date.now() - 2000000));
-  const comments = [{timeStamp: oldTimeStamp, content}];
-  const result = checkCommentDuplicate(comments, content);
-  assert.deepEqual(result, {status: 'ok'});
-});
-
-test('checkCommentDuplicate accepts a comment that differs from a recent one', () => {
-  const comments = [{timeStamp: getNowStamp(), content: 'a'.repeat(20)}];
+test('checkCommentDuplicate accepts a comment that differs from a stored one', () => {
+  const comments = [{content: 'a'.repeat(20)}];
   const result = checkCommentDuplicate(comments, 'b'.repeat(20));
   assert.deepEqual(result, {status: 'ok'});
 });

package/util.ts

@@ -207,27 +207,22 @@ export const checkCommentLength = (
   }
   return {status: 'ok'};
 };
-// Returns whether a comment repeats, verbatim, one of the given comments submitted
-// within the last 1000 seconds. Comment time stamps use Kilotest's own timeStamp
-// format (see getTimeStamp), not an ISO date-time string, so this integrates with
-// the same comments.json shape that web/tutorial/index.ts already uses. The content
-// passed in should be the content as it will be stored (e.g. after sanitization),
-// so that it is compared on the same basis as the stored comments.
+// Returns whether a comment repeats, verbatim, one of the given comments, regardless
+// of when the earlier one was submitted: a legitimate need to resubmit exactly the
+// same content never arises (the near-term case is a browser "Back" resubmission),
+// so storing a second copy would only ever be redundant. The content passed in
+// should be the content as it will be stored (e.g. after sanitization), so that it
+// is compared on the same basis as the stored comments. Content, not any time
+// stamp, is what this checks and what identifies a comment as unique.
 export const checkCommentDuplicate = (
-  comments: {timeStamp: string; content: string}[], content: string
+  comments: {content: string}[], content: string
 ): {status: 'ok'} | {status: 'error'; message: string} => {
-  // Get the comments submitted within the last 1000 seconds with the same content.
-  // Comment time stamps are always valid, because this codebase is the sole writer
-  // of comments.json.
-  const duplicates = comments
-  .filter(comment => getDateTime(comment.timeStamp)!.getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === content);
-  // If the comment duplicates a recent one:
-  if (duplicates.length) {
+  // If the comment duplicates one already stored:
+  if (comments.some(comment => comment.content === content)) {
     // Return this.
     return {
       status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+      message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
     };
   }
   // Otherwise, the comment is not a duplicate.

package/web/deleteNotesForm/deleteNotesForm.test.ts

@@ -0,0 +1,237 @@
+/*
+  deleteNotesForm.test.ts
+  Unit tests for web/deleteNotesForm/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, beforeEach, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// ENVIRONMENT
+
+const testDir = path.join(import.meta.dirname, '../../test/fixtures/deleteNotesForm');
+const tutorialWebPath = path.join(testDir, 'tutorialWeb.json');
+const tutorialAIPath = path.join(testDir, 'tutorialAI.json');
+const featureRequestsPath = path.join(testDir, 'featureRequests.json');
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedTutorialWebPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+const savedTutorialAIPath = process.env.TUTORIAL_AI_COMMENTS_PATH;
+const savedFeatureRequestsPath = process.env.FEATURE_REQUESTS_PATH;
+
+before(async () => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = tutorialWebPath;
+  process.env.TUTORIAL_AI_COMMENTS_PATH = tutorialAIPath;
+  process.env.FEATURE_REQUESTS_PATH = featureRequestsPath;
+  await fs.mkdir(testDir, {recursive: true});
+});
+
+beforeEach(async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(tutorialAIPath, JSON.stringify([
+    {timeStamp: '260102T0000', content: 'An AI tutorial comment'}
+  ]));
+  await fs.writeFile(featureRequestsPath, JSON.stringify([
+    {timeStamp: '260103T0000', content: 'A feature request'}
+  ]));
+});
+
+import {answer} from './index.ts';
+
+after(async () => {
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedTutorialWebPath !== undefined) {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedTutorialWebPath;
+  } else {
+    delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  }
+  if (savedTutorialAIPath !== undefined) {
+    process.env.TUTORIAL_AI_COMMENTS_PATH = savedTutorialAIPath;
+  } else {
+    delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  }
+  if (savedFeatureRequestsPath !== undefined) {
+    process.env.FEATURE_REQUESTS_PATH = savedFeatureRequestsPath;
+  } else {
+    delete process.env.FEATURE_REQUESTS_PATH;
+  }
+  await fs.rm(testDir, {recursive: true, force: true});
+});
+
+// TESTS
+
+test('deleteNotesForm lists notes from all three sources on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+  assert.ok(result.answerPage!.includes('An AI tutorial comment'));
+  assert.ok(result.answerPage!.includes('A feature request'));
+});
+
+test('deleteNotesForm ignores a note query string on a GET request', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'GET'
+  );
+  assert.equal(result.status, 'ok');
+  // The note should NOT have been deleted by a mere GET request.
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(
+    null,
+    `authCode=wrong&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm deletes a selected web tutorial comment with a valid auth code', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+  // The other sources are untouched.
+  const aiNotes = JSON.parse(await fs.readFile(tutorialAIPath, 'utf8'));
+  assert.equal(aiNotes.length, 1);
+});
+
+test('deleteNotesForm deletes selected notes across multiple sources in one submission', async () => {
+  const result = await answer(
+    null,
+    'authCode=test-auth-code' +
+      `&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}` +
+      `&note=tutorialAI%09${encodeURIComponent('An AI tutorial comment')}` +
+      `&note=featureRequest%09${encodeURIComponent('A feature request')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  assert.equal(JSON.parse(await fs.readFile(tutorialWebPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(tutorialAIPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(featureRequestsPath, 'utf8')).length, 0);
+});
+
+test('deleteNotesForm leaves unselected notes in a source intact', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'Keep this one'},
+    {timeStamp: '260101T0001', content: 'Delete this one'}
+  ]));
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('Delete this one')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+  assert.equal(notes[0].content, 'Keep this one');
+});
+
+test('deleteNotesForm reports no notes to delete when all sources are empty', async () => {
+  await fs.writeFile(tutorialWebPath, '[]');
+  await fs.writeFile(tutorialAIPath, '[]');
+  await fs.writeFile(featureRequestsPath, '[]');
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('There are no comments or feature requests to delete.'));
+});
+
+test('deleteNotesForm treats a missing source file as having no notes', async () => {
+  await fs.rm(featureRequestsPath, {force: true});
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+});
+
+test('deleteNotesForm escapes note content to prevent HTML injection', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: '<script>alert(1)</script>'}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(!result.answerPage!.includes('<script>'));
+});
+
+test('deleteNotesForm deletes a note whose content contains a literal tab character', async () => {
+  const content = 'Line one\tLine two, after an embedded tab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(
+    null, `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent(content)}`, 'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+});
+
+test('deleteNotesForm renders a checkbox value that round-trips a note with a literal tab', async () => {
+  const content = 'Has\ta\ttab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes(`tutorialWeb\t${encodeURIComponent(content)}`));
+});
+
+test('deleteNotesForm returns an error when a note file cannot be written', async () => {
+  // Point the web tutorial comments path at a location whose parent is a file, so that
+  // creating the directory for it fails.
+  const blockerFile = path.join(testDir, 'blocker');
+  const unwritablePath = path.join(blockerFile, 'tutorialWeb.json');
+  await fs.writeFile(blockerFile, 'not a directory');
+  const savedPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = unwritablePath;
+  try {
+    const result = await answer(
+      null,
+      `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+      'POST'
+    );
+    assert.equal(result.status, 'error');
+    assert.ok(result.message?.includes('Deleting notes failed'));
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedPath;
+    await fs.unlink(blockerFile).catch(() => {});
+  }
+});
+
+test('deleteNotesForm falls back to default paths when environment variables are not set', async () => {
+  const saved = {
+    tutorialWeb: process.env.TUTORIAL_WEB_COMMENTS_PATH,
+    tutorialAI: process.env.TUTORIAL_AI_COMMENTS_PATH,
+    featureRequest: process.env.FEATURE_REQUESTS_PATH
+  };
+  delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  delete process.env.FEATURE_REQUESTS_PATH;
+  try {
+    // None of the default db/ files exist in this environment, so the form should
+    // still render, treating each missing source as having no notes.
+    const result = await answer(null, '', 'GET');
+    assert.equal(result.status, 'ok');
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = saved.tutorialWeb;
+    process.env.TUTORIAL_AI_COMMENTS_PATH = saved.tutorialAI;
+    process.env.FEATURE_REQUESTS_PATH = saved.featureRequest;
+  }
+});

package/web/deleteNotesForm/index.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>Delete notes | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: Delete notes</h1>
+      <p>__intro__</p>
+      <form action="/deleteNotesForm.html" method="post">
+        <fieldset>
+          <legend>Notes</legend>
+          __notes__
+        </fieldset>
+        <p><label>
+          Authorization code: <input size="3" minLength="3" maxlength="3" name="authCode" required__disabled__>
+        </label></p>
+        <p><button type="submit"__disabled__>Submit</button></p>
+      </form>
+    </main>
+  </body>
+</html>

package/web/deleteNotesForm/index.ts

@@ -0,0 +1,167 @@
+/*
+  index.ts
+  Serves a form for deleting web tutorial comments, AI tutorial comments, and MCP
+  feature requests, the three kinds of notes that Kilotest records to flat JSON files
+  rather than presenting through any other manager page.
+*/
+
+// IMPORTS
+
+import {errorMessage, getDateTimeString, getJSON, getPlainText, isValidAuthCode, populateTemplate} from '../../util.ts';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// TYPES
+
+// A note (comment or feature request) as stored in one of the note files.
+type Note = {
+  timeStamp: string;
+  content: string;
+};
+
+// The source of a kind of note, identifying its file and how it is labeled.
+type NoteSource = {
+  name: string;
+  label: string;
+  getPath: () => string;
+};
+
+// CONSTANTS
+
+// The note sources, in the order they are listed on the form. Each source's path is
+// read afresh on every call, via its own environment-variable override, exactly as
+// web/tutorialWeb/index.ts and web/tutorialAI/index.ts already do for their own
+// comment files, so that tests can point any of them at a fixture path.
+const noteSources: NoteSource[] = [
+  {
+    name: 'tutorialWeb',
+    label: 'Web tutorial comment',
+    getPath: () => process.env.TUTORIAL_WEB_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialWeb.json')
+  },
+  {
+    name: 'tutorialAI',
+    label: 'AI tutorial comment',
+    getPath: () => process.env.TUTORIAL_AI_COMMENTS_PATH ||
+      path.join(import.meta.dirname, '../../db/comments/tutorialAI.json')
+  },
+  {
+    name: 'featureRequest',
+    label: 'MCP feature request',
+    getPath: () => process.env.FEATURE_REQUESTS_PATH ||
+      path.join(import.meta.dirname, '../../db/featureRequests.json')
+  }
+];
+
+// FUNCTIONS (helpers)
+
+// Returns the notes in a source's file, or an empty array if it does not exist.
+const getNotes = async (source: NoteSource): Promise<Note[]> => {
+  try {
+    const existing = await fs.readFile(source.getPath(), 'utf8');
+    return JSON.parse(existing);
+  }
+  catch {
+    return [];
+  }
+};
+
+// FUNCTIONS
+
+// Returns a form for deleting selected notes, or, on a POST request with a valid
+// authorization code, deletes the selected notes and returns the form again. A GET
+// request never processes a submission, regardless of its query string; only a POST
+// request (the form's own submission) does.
+export const answer = async (
+  _: any, search: string, method: string
+): Promise<{status: string; message?: string; answerPage?: string}> => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  // Each selected checkbox's value is `${sourceName}\t${encodeURIComponent(content)}`.
+  // Content, rather than time stamp, identifies a note, because no two notes in the same
+  // source ever share content: checkCommentDuplicate rejects a submission identical to
+  // one already on file. Content is percent-encoded, and split out at the first tab
+  // only, because comment and feature-request content is not stripped of tab characters
+  // (see the sanitize functions in web/tutorialWeb/index.ts and web/tutorialAI/index.ts),
+  // so an unencoded tab within the content itself could otherwise be mistaken for the
+  // delimiter between the source name and the content.
+  const selections = searchParams?.getAll('note');
+  // If the form has been submitted and any notes are to be deleted:
+  if (method === 'POST' && selections?.length) {
+    // If the authorization code is valid:
+    if (isValidAuthCode(authCode)) {
+      try {
+        // Group the selected content by source.
+        const contentBySource = new Map<string, Set<string>>();
+        for (const selection of selections) {
+          const tabIndex = selection.indexOf('\t');
+          const sourceName = selection.slice(0, tabIndex);
+          const content = decodeURIComponent(selection.slice(tabIndex + 1));
+          if (!contentBySource.has(sourceName)) {
+            contentBySource.set(sourceName, new Set());
+          }
+          contentBySource.get(sourceName)!.add(content);
+        }
+        // For each source with any selected notes:
+        for (const source of noteSources) {
+          const contentSet = contentBySource.get(source.name);
+          if (!contentSet) {
+            continue;
+          }
+          // Remove the selected notes and save the rest.
+          const notes = await getNotes(source);
+          const remaining = notes.filter(note => !contentSet.has(note.content));
+          await fs.mkdir(path.dirname(source.getPath()), {recursive: true});
+          await fs.writeFile(source.getPath(), getJSON(remaining));
+        }
+      }
+      // If this failed:
+      catch (error: unknown) {
+        // Return why.
+        return {
+          status: 'error',
+          message: `Deleting notes failed (${errorMessage(error)})`
+        };
+      }
+    }
+    // Otherwise, i.e. if the authorization code is invalid:
+    else {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+  }
+  const lines: string[] = [];
+  const margin = ' '.repeat(12);
+  let anyNotes = false;
+  // For each source, in display order:
+  for (const source of noteSources) {
+    const notes = await getNotes(source);
+    // For each of its notes, oldest first:
+    for (const note of notes) {
+      anyNotes = true;
+      const value = `${source.name}\t${encodeURIComponent(note.content)}`;
+      const when = getDateTimeString(note.timeStamp);
+      lines.push(
+        `${margin}<p><input type="checkbox" name="note" value="${value}"> ` +
+        `<strong>${source.label}</strong> (${when}): ${getPlainText(note.content)}</p>`
+      );
+    }
+  }
+  const query: Record<string, string> = {
+    notes: lines.join('\n'),
+    intro: anyNotes ?
+      'Choose the comments and feature requests to delete.' :
+      'There are no comments or feature requests to delete.',
+    disabled: anyNotes ? '' : ' disabled'
+  };
+  // Return the populated page.
+  return {
+    status: 'ok',
+    answerPage: await populateTemplate(import.meta.dirname, query)
+  };
+};

package/web/manage/index.html

@@ -16,6 +16,7 @@
       <p>Kilotest managers can:</p>
       <ul class="nav">
         <li><a href="/enqueueForm.html">Approve or reject a test recommendation</a></li>
+        <li><a href="/deleteNotesForm.html">Delete a comment or feature request</a></li>
         <li><a href="/reannotateForm.html">
           Reannotate reports to incorporate newly classified and reclassified rules
         </a></li>

package/web/tutorialAI/index.ts

@@ -6,7 +6,7 @@
 // IMPORTS
 
 import {sendAlert} from '../../alerts.ts';
-import {checkCommentLength, getJSON} from '../../util.ts';
+import {checkCommentDuplicate, checkCommentLength, getJSON, getNowStamp} from '../../util.ts';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
@@ -56,18 +56,13 @@ export const handleComment = async (content: unknown) => {
     return {status: 'error', message: 'Comment is empty after sanitization'};
   }
   // Check for duplicate submissions within the last 1000 seconds.
-  const duplicates = comments
-  .filter(comment => new Date(comment.dateTime).getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === sanitized);
-  if (duplicates.length) {
-    return {
-      status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
-    };
+  const duplicateCheck = checkCommentDuplicate(comments, sanitized);
+  if (duplicateCheck.status === 'error') {
+    return duplicateCheck;
   }
-  // Add the comment to the existing ones, using dateTime format.
+  // Add the comment to the existing ones.
   comments.push({
-    dateTime: new Date().toISOString(),
+    timeStamp: getNowStamp(),
     content: sanitized
   });
   // Ensure the comments directory exists.

package/web/tutorialAI/tutorialAI.test.ts

@@ -14,6 +14,12 @@ import path from 'node:path';
 
 const testDir = path.join(import.meta.dirname, '../../test/fixtures/comments');
 process.env.TUTORIAL_AI_COMMENTS_PATH = path.join(testDir, 'tutorialAI.json');
+// Blank the alert configuration unconditionally, before index.ts (whose handleComment
+// calls sendAlert for a new comment) is ever imported below, so this file sends no real
+// alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 import {answer, handleComment} from './index.ts';
 
@@ -71,7 +77,7 @@ test('handleComment returns an error for a comment longer than 1000 characters',
   assert.equal(result.message, 'Your comment was longer than 1000 characters');
 });
 
-test('handleComment returns an error for a comment repeating one submitted within the last 1000 seconds', {timeout: 500}, async () => {
+test('handleComment returns an error for a comment identical to one already submitted', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const content = 'This is a duplicate comment.';
   const firstResult = await handleComment(content);
@@ -80,7 +86,7 @@ test('handleComment returns an error for a comment repeating one submitted withi
   assert.equal(secondResult.status, 'error');
   assert.equal(
     secondResult.message,
-    'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   );
 });
 
@@ -91,7 +97,7 @@ test('handleComment saves a sanitized comment and returns ok', {timeout: 500}, a
   const comments = JSON.parse(await fs.readFile(getCommentsPath(), 'utf8'));
   assert.equal(comments.length, 1);
   assert.equal(comments[0].content, 'This is a test comment.');
-  assert.ok(comments[0].dateTime);
+  assert.ok(comments[0].timeStamp);
 });
 
 test('handleComment strips HTML tags and control characters', {timeout: 500}, async () => {

package/web/tutorialWeb/tutorialWeb.test.ts

@@ -14,6 +14,12 @@ import path from 'node:path';
 
 const testDir = path.join(import.meta.dirname, '../../test/fixtures/comments');
 process.env.TUTORIAL_WEB_COMMENTS_PATH = path.join(testDir, 'tutorialWeb.json');
+// Blank the alert configuration unconditionally, before index.ts (whose handleComment
+// calls sendAlert for a new comment) is ever imported below, so this file sends no real
+// alert emails even when run directly rather than via `npm test`.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 import {answer, handleComment} from './index.ts';
 
@@ -73,7 +79,7 @@ test('handleComment returns an error for a comment longer than 1000 characters',
   assert.equal(result.message, 'Your comment was longer than 1000 characters');
 });
 
-test('handleComment returns an error for a comment repeating one submitted within the last 1000 seconds', {timeout: 500}, async () => {
+test('handleComment returns an error for a comment identical to one already submitted', {timeout: 500}, async () => {
   await fs.writeFile(getCommentsPath(), '[]\n');
   const content = 'This is a duplicate comment.';
   const firstResult = await handleComment(content);
@@ -82,7 +88,7 @@ test('handleComment returns an error for a comment repeating one submitted withi
   assert.equal(secondResult.status, 'error');
   assert.equal(
     secondResult.message,
-    'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   );
 });
 

package/.claude/scheduled_tasks.lock

@@ -1 +0,0 @@
-{"sessionId":"f44e6b44-375e-4007-879a-19e4e5ed34a0","pid":90042,"procStart":"Sun Sep 20 03:19:03 2026","acquiredAt":1789874948676}