@orboto/mcp 0.192.0 → 0.194.0

package/dist/oauth-bootstrap.js

@@ -1,26 +1,5 @@
 /**
  * ORB-943 - OAuth bootstrap for the stdio local-proxy.
- *
- * The stdio proxy (`@orboto/mcp` spawned by Claude Desktop / Cursor) was
- * PAT-only: the operator had to paste a long-lived `orb_*` key into the
- * client config. This module gives the stdio proxy the SAME short-lived,
- * SSO-backed OAuth path the HTTP transport already offers - a browser-assisted
- * loopback flow (RFC 8252) so a desktop user connects without ever pasting a
- * token. The PAT stays the documented fallback for headless service accounts
- * (see index.ts).
- *
- * Design:
- *   - No new API surface. This reuses the shipped provider-side OAuth stack
- *     (discovery + DCR + PKCE + rotating refresh) exactly as an HTTP MCP client
- *     would: discover -> register -> authorize-in-browser -> exchange -> use
- *     the access token as the REST Bearer (the api's `authenticate` decorator
- *     already accepts OAuth access tokens alongside `orb_*` keys).
- *   - The refresh token is cached on disk (0600) keyed by the instance origin,
- *     so a subsequent boot refreshes silently instead of re-opening a browser.
- *   - The pure pieces (PKCE, request building, response parsing, the cache
- *     round-trip, the token-provider refresh math) are exported so they unit
- *     test without a browser or a live server. The loopback listener + browser
- *     open is the thin I/O shell.
  */
 import { createHash, randomBytes } from 'node:crypto';
 import { createServer } from 'node:http';
@@ -47,9 +26,6 @@ export function generatePkce() {
 export function generateState() {
     return randomBytes(16).toString('base64url');
 }
-// ---------------------------------------------------------------------------
-// Origin derivation + discovery
-// ---------------------------------------------------------------------------
 /**
  * The OAuth authorization server lives at the instance ORIGIN, while the stdio
  * proxy is configured with the REST base (`<origin>/api`). Strip a trailing
@@ -74,9 +50,6 @@ export async function discoverAuthServer(origin, fetchImpl = fetch) {
     }
     return meta;
 }
-// ---------------------------------------------------------------------------
-// Dynamic Client Registration (RFC 7591)
-// ---------------------------------------------------------------------------
 /** Register a public client for the loopback redirect. Returns the client_id. */
 export async function registerLoopbackClient(registrationEndpoint, redirectUri, fetchImpl = fetch) {
     const res = await fetchImpl(registrationEndpoint, {
@@ -99,9 +72,6 @@ export async function registerLoopbackClient(registrationEndpoint, redirectUri,
         throw new Error('OAuth client registration returned no client_id');
     return json.client_id;
 }
-// ---------------------------------------------------------------------------
-// Authorize URL + token exchange
-// ---------------------------------------------------------------------------
 export function buildAuthorizeUrl(authorizationEndpoint, params) {
     const u = new URL(authorizationEndpoint);
     u.searchParams.set('response_type', 'code');
@@ -159,9 +129,6 @@ export async function refreshTokens(tokenEndpoint, params, fetchImpl = fetch) {
     }
     return parseTokenResponse(await res.json());
 }
-// ---------------------------------------------------------------------------
-// Token cache (0600, keyed by origin)
-// ---------------------------------------------------------------------------
 /** Cache file path. Honours ORBOTO_MCP_TOKEN_CACHE for tests / custom homes. */
 export function tokenCachePath() {
     const override = process.env.ORBOTO_MCP_TOKEN_CACHE;
@@ -187,8 +154,6 @@ export function saveCachedGrant(origin, grant, path = tokenCachePath()) {
     file[origin] = grant;
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, JSON.stringify(file, null, 2), { mode: 0o600 });
-    // writeFileSync's mode only applies on create; force 0600 on an existing file
-    // too so a cache written before this code shipped is tightened.
     try {
         chmodSync(path, 0o600);
     }
@@ -219,8 +184,6 @@ export function createTokenProvider(initial, refresh, onRefreshed, now = Date.no
             throw new Error('OAuth session expired and no refresh token is available - reconnect the client.');
         }
         const next = await refresh(current.refreshToken);
-        // The AS rotates the refresh token; if a response omits it (shouldn't with
-        // offline_access) keep the prior one so the chain isn't lost.
         current = { ...next, refreshToken: next.refreshToken ?? current.refreshToken };
         onRefreshed?.(current);
         return current.accessToken;
@@ -240,9 +203,6 @@ export function createTokenProvider(initial, refresh, onRefreshed, now = Date.no
         },
     };
 }
-// ---------------------------------------------------------------------------
-// Interactive loopback flow (the I/O shell)
-// ---------------------------------------------------------------------------
 /** Open a URL in the user's default browser. Returns false if no opener is
  *  available (headless) so the caller can print the URL for manual paste. */
 export async function openInBrowser(url) {
@@ -333,9 +293,6 @@ export async function runLoopbackAuthorization(opts) {
             clearTimeout(timeout);
             reject(e);
         });
-        // Bind to an ephemeral loopback port, THEN register the client at that exact
-        // redirect_uri (the api allows any loopback port at authorize time per RFC
-        // 8252, but DCR still needs a concrete uri).
         server.listen(0, '127.0.0.1', async () => {
             try {
                 const addr = server.address();
@@ -365,9 +322,6 @@ export async function runLoopbackAuthorization(opts) {
         });
     });
 }
-// ---------------------------------------------------------------------------
-// Top-level bootstrap: cache -> refresh -> interactive, returns a provider
-// ---------------------------------------------------------------------------
 /**
  * Resolve an OAuth token provider for the stdio proxy. Order:
  *   1. A cached grant whose refresh token still works -> silent refresh.
@@ -398,7 +352,6 @@ export async function bootstrapOAuth(opts) {
             return createTokenProvider(tokens, (rt) => refreshTokens(cached.tokenEndpoint, { clientId: cached.clientId, refreshToken: rt }, fetchImpl), (next) => persist(cached.clientId, cached.tokenEndpoint, next));
         }
         catch (e) {
-            // A revoked / expired refresh token drops us back to interactive.
             log(`[orboto-mcp] cached OAuth session no longer valid (${e.message}); re-authorizing`);
             clearCachedGrant(origin, cachePath);
         }

package/dist/oauth-bootstrap.test.js

@@ -16,7 +16,6 @@ describe('PKCE', () => {
         expect(method).toBe('S256');
         const recomputed = createHash('sha256').update(verifier).digest('base64url');
         expect(recomputed).toBe(challenge);
-        // base64url, no padding
         expect(challenge).not.toContain('=');
         expect(challenge).not.toContain('+');
     });
@@ -99,7 +98,6 @@ describe('token cache', () => {
         expect(loadCachedGrant('https://a.test', path)?.clientId).toBe('c');
         expect(loadCachedGrant('https://b.test', path)?.refreshToken).toBe('r2');
         expect(loadCachedGrant('https://missing.test', path)).toBeNull();
-        // 0600 perms (owner rw only)
         const mode = statSync(path).mode & 0o777;
         expect(mode).toBe(0o600);
     });
@@ -114,12 +112,10 @@ describe('token cache', () => {
     });
 });
 describe('createTokenProvider', () => {
-    // expiresAt comfortably larger than EXPIRY_SKEW_MS so "fresh" and "within
-    // skew" are both expressible with a fake clock.
     const base = { accessToken: 'at0', refreshToken: 'rt0', expiresAt: 10_000_000, scope: 'mcp' };
     it('returns the cached access token while fresh', async () => {
         const refresh = vi.fn();
-        const now = () => 0; // well before expiry
+        const now = () => 0;
         const p = createTokenProvider(base, refresh, undefined, now);
         expect(await p.getAccessToken()).toBe('at0');
         expect(refresh).not.toHaveBeenCalled();
@@ -127,7 +123,7 @@ describe('createTokenProvider', () => {
     it('refreshes when within the expiry skew and rotates the refresh token', async () => {
         const refresh = vi.fn().mockResolvedValue({ accessToken: 'at1', refreshToken: 'rt1', expiresAt: 10_000_000, scope: 'mcp' });
         const onRefreshed = vi.fn();
-        const now = () => base.expiresAt - EXPIRY_SKEW_MS + 1; // inside skew window
+        const now = () => base.expiresAt - EXPIRY_SKEW_MS + 1;
         const p = createTokenProvider(base, refresh, onRefreshed, now);
         expect(await p.getAccessToken()).toBe('at1');
         expect(refresh).toHaveBeenCalledWith('rt0');
@@ -152,15 +148,11 @@ describe('createTokenProvider', () => {
         await expect(p.getAccessToken()).rejects.toThrow(/reconnect the client/);
     });
     it('ORB-1419 - single-flights concurrent getAccessToken calls into ONE refresh', async () => {
-        // Two concurrent callers that both see an expired token must share a single
-        // in-flight refresh rather than each firing one (which would present the OLD
-        // refresh token twice and trip server-side reuse-detection).
         let resolveRefresh = () => { };
         const refresh = vi.fn().mockImplementation(() => new Promise((r) => { resolveRefresh = r; }));
         const p = createTokenProvider(base, refresh, undefined, () => base.expiresAt);
         const a = p.getAccessToken();
         const b = p.getAccessToken();
-        // Both callers are now awaiting; only one refresh should have been started.
         expect(refresh).toHaveBeenCalledOnce();
         expect(refresh).toHaveBeenCalledWith('rt0');
         resolveRefresh({ accessToken: 'at-shared', refreshToken: 'rt1', expiresAt: 10_000_000, scope: 'mcp' });
@@ -190,19 +182,15 @@ describe('bootstrapOAuth cached-grant path', () => {
         });
         expect(await provider.getAccessToken()).toBe('fresh-at');
         expect(openBrowser).not.toHaveBeenCalled();
-        // rotation persisted
         expect(loadCachedGrant('https://x.test', path)?.refreshToken).toBe('rt1');
     });
     it('clears a dead cached grant and falls through to discovery', async () => {
         saveCachedGrant('https://x.test', {
             clientId: 'cid', refreshToken: 'dead', scope: 'mcp', tokenEndpoint: 'https://x.test/oauth/token',
         }, path);
-        // First call (refresh) 400s; then discovery is attempted (which we fail so
-        // we don't need to drive the whole interactive flow) - the point is the
-        // dead grant is cleared and discovery is reached.
         const fetchImpl = vi.fn()
-            .mockResolvedValueOnce(new Response('{"error":"invalid_grant"}', { status: 400 })) // refresh
-            .mockResolvedValueOnce(new Response('nope', { status: 500 })); // discovery
+            .mockResolvedValueOnce(new Response('{"error":"invalid_grant"}', { status: 400 }))
+            .mockResolvedValueOnce(new Response('nope', { status: 500 }));
         await expect(bootstrapOAuth({
             apiBaseUrl: 'https://x.test/api', fetchImpl: fetchImpl,
             openBrowser: vi.fn(), cachePath: path, log: () => { },

package/dist/orboto-client.js

@@ -1,27 +1,6 @@
 /**
  * ORB-244 Phase A - thin HTTP client the MCP server uses to talk to
  * the orboto API.
- *
- * Deliberately speaks HTTPS-REST rather than importing `@orboto/api`'s
- * services directly, for three reasons:
- *   1. One code path covers both delivery variants from the ticket -
- *      Local-Proxy (`npx @orboto/mcp-cli`, running on the dev's laptop,
- *      pointing at the public orboto URL) AND Self-Hosted-inline
- *      (separate container in docker-compose, pointing at
- *      `http://api:3000`). The only difference is the env var.
- *   2. The API's `requirePermission` / PBAC cascade runs server-side
- *      where it belongs. The MCP server is a pure transport adapter;
- *      it never sees the DB or trust boundary.
- *   3. The `orb_*` API-key flow is already wired into the API's
- *      `authenticate` decorator - reusing it means the existing
- *      `mcp:use` + `api:use` scope checks, rate limits, and audit
- *      logs all light up for free.
- *
- * Every request adds `Authorization: Bearer <apiKey>` (from env) and
- * a `User-Agent: orboto-mcp/<version>` header for the admin UI to
- * distinguish MCP traffic from regular API traffic. Non-2xx responses
- * throw `OrbotoApiError` so tool handlers can translate to MCP's
- * `{isError: true}` shape.
  */
 import { VERSION } from './version.js';
 export class OrbotoApiError extends Error {
@@ -50,10 +29,6 @@ export class OrbotoClient {
         }
         this.apiKey = config.apiKey;
         this.tokenProvider = config.tokenProvider;
-        // User-Agent shape: `orboto-mcp/<version> (claude-desktop)`. The
-        // suffix is optional metadata so the admin's MCP-usage panel
-        // (Phase F) can group calls per client family without needing a
-        // new DB column.
         const ua = config.userAgentSuffix
             ? `orboto-mcp/${VERSION} (${config.userAgentSuffix})`
             : `orboto-mcp/${VERSION}`;
@@ -95,9 +70,6 @@ export class OrbotoClient {
         if (res.status === 401 && this.tokenProvider) {
             res = await doFetch(await this.bearer(true));
         }
-        // ORB-1727 - the api stamps `x-orboto-agent-mail: <count>` on responses
-        // while the caller has unread inbox messages. Capture it centrally so
-        // the tool-response wrapper can nudge without any extra request.
         const mail = res.headers?.get?.('x-orboto-agent-mail');
         this.pendingAgentMail = mail ? Number(mail) || 0 : 0;
         if (!res.ok) {
@@ -241,8 +213,6 @@ export async function preflightMcpSession(client) {
     if (!status.mcpUseGranted) {
         throw new Error(`MCP preflight failed: user ${status.userEmail} lacks the mcp:use permission. Ask an admin to grant it.`);
     }
-    // ORB-942 - per-user opt-out. Distinct message pointing at the toggle so
-    // the user knows this is their own setting, not an admin / permission block.
     if (!status.userMcpEnabled) {
         throw new Error('MCP preflight failed: you have disabled MCP access for your account. Re-enable it in Profile - Connect an AI Client.');
     }

package/dist/orboto-client.test.js

@@ -1,14 +1,5 @@
 /**
  * ORB-244 Phase A - orboto REST client unit tests.
- *
- * We mock `fetch` and cover the shape we promise to every tool
- * handler: correct base URL, bearer header, User-Agent string,
- * JSON body for write verbs, and the `OrbotoApiError` throw on
- * non-2xx with status + body captured.
- *
- * `preflightMcpSession` is tested too because its three-way
- * failure branching (401 / disabled / permission-denied) is the
- * most likely regression surface when the API contract drifts.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { OrbotoClient, OrbotoApiError, preflightMcpSession } from './orboto-client.js';
@@ -83,8 +74,6 @@ describe('OrbotoClient', () => {
         const result = await client.post('/action', {});
         expect(result).toBeUndefined();
     });
-    // ORB-799 - postMultipart sends FormData with no Content-Type header
-    // (fetch chooses the boundary). The bearer + UA headers still apply.
     it('postMultipart sends FormData body without Content-Type (boundary picked by fetch)', async () => {
         const spy = mockFetch({ json: async () => ({ docId: 'd1' }) });
         const client = new OrbotoClient({ baseUrl: 'https://orboto.example.com', apiKey: 'orb_test' });
@@ -95,7 +84,6 @@ describe('OrbotoClient', () => {
         const [, init] = spy.mock.calls[0];
         const headers = init.headers;
         expect(headers.Authorization).toBe('Bearer orb_test');
-        // No Content-Type header - fetch sets multipart/form-data; boundary=…
         expect(headers['Content-Type']).toBeUndefined();
         expect(init.method).toBe('POST');
     });

package/dist/prompts.js

@@ -1,29 +1,8 @@
 /**
  * ORB-244 Phase D - MCP prompts.
- *
- * Prompts are reusable instruction templates an MCP-aware client
- * (Claude Desktop, Cursor) surfaces in its UI as a one-click action.
- * Each handler returns `messages[]` that become the start of the
- * conversation; the user's model then drives the work, typically
- * by calling orboto MCP tools.
- *
- * Five v1 templates - each a thin wrapper that hands the model a
- * focused goal + a tool sequence to execute:
- * - plan-sprint(projectKey) - draft a sprint plan from open work
- * - triage-my-tickets() - sort caller's open assignments
- * - summarize-project(projectKey) - quick project briefing
- * - estimate-ticket(ticketKey) - rough effort guess via similar work
- * - find-duplicates(ticketKey) - search for overlapping tickets
- *
- * No backend AI calls - the prompts steer the model, the model
- * uses tools. Keeps the surface stateless and the AI provider
- * irrelevant (works with any MCP client).
  */
 import { z } from 'zod';
 export function registerOrbotoPrompts(server) {
-    // -------------------------------------------------------------------------
-    // plan-sprint
-    // -------------------------------------------------------------------------
     server.registerPrompt('plan-sprint', {
         title: 'Draft a sprint plan',
         description: 'Build a 2-week sprint plan from a project\'s open backlog and the team\'s recent velocity.',
@@ -52,9 +31,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // triage-my-tickets
-    // -------------------------------------------------------------------------
     server.registerPrompt('triage-my-tickets', {
         title: 'Triage my open tickets',
         description: 'Sort the caller\'s open assignments and recommend the next 3 to focus on.',
@@ -82,9 +58,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // summarize-project
-    // -------------------------------------------------------------------------
     server.registerPrompt('summarize-project', {
         title: 'Summarise a project',
         description: 'A 3-sentence briefing on a project - what it is, where it stands, what\'s next.',
@@ -108,9 +81,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // estimate-ticket
-    // -------------------------------------------------------------------------
     server.registerPrompt('estimate-ticket', {
         title: 'Estimate a ticket\'s effort',
         description: 'Rough effort guess for a ticket based on its description and similar past work.',
@@ -135,9 +105,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // find-duplicates
-    // -------------------------------------------------------------------------
     server.registerPrompt('find-duplicates', {
         title: 'Find duplicate tickets',
         description: 'Look for tickets that overlap with the given one - likely duplicates or competing work.',
@@ -165,9 +132,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // ORB-855 - wiki-ingest: guided URL ingest flow.
-    // -------------------------------------------------------------------------
     server.registerPrompt('wiki-ingest', {
         title: 'Ingest a URL into the wiki',
         description: 'Guided flow: import a URL into an LLM-Wiki space and confirm what the curation produced.',
@@ -190,9 +154,6 @@ export function registerOrbotoPrompts(server) {
                 },
             }],
     }));
-    // -------------------------------------------------------------------------
-    // ORB-855 - wiki-maintain: guided lint + fix flow.
-    // -------------------------------------------------------------------------
     server.registerPrompt('wiki-maintain', {
         title: 'Maintain a wiki (lint + fix)',
         description: 'Run the lint pass on an LLM-Wiki space and propose fixes for the open issues.',

package/dist/protect-text-usage.test.js

@@ -1,15 +1,7 @@
 /**
  * ORB-1818 - `PROTECT_TEXT_META` is a protection, not an escape hatch.
  *
- * A handler that sets it keeps its text half out of the shrinker, so a
- * tool could use it to opt out of the central response budget - the one
- * thing ORB-1697 exists to prevent. It is sanctioned for exactly one
- * payload: the complete binding workspace rules, which must never be cut
- * for either client class (Claude Code keeps the structured half,
- * text-only clients keep the Markdown one).
- *
- * This ratchet fails the build when any other source file sets it, the
- * same way the dark-mode / i18n / audit checks fail on a new violation.
+ * @see ORB-1697
  */
 import { describe, it, expect } from 'vitest';
 import { readdirSync, readFileSync, statSync } from 'node:fs';

package/dist/required-rules-wrapper.test.js

@@ -54,11 +54,6 @@ async function fixture() {
     });
     return { run, cache, ruleReads: () => ruleReads, set: (body, code = 200) => { rules = body; status = code; }, setNext: (body) => { next = body; } };
 }
-// ORB-1948 - each test spawns the REAL wrapper CLI (a 6,000-line module,
-// about 1 s locally); on a saturated CI host (tag run: boot gate, three
-// image builds, CLI binaries and the MCP split in parallel) that exceeded
-// vitest's 5 s default and blocked the v0.182.1 rollout. The budget is per
-// test and generous on purpose - a hang still fails, only slower.
 const SPAWN_TEST_TIMEOUT_MS = 60_000;
 describe('wrapper required rules through the real CLI', () => {
     it('does not turn malformed work-next responses into an idle result', async () => {

package/dist/required-rules.js

@@ -69,8 +69,6 @@ export async function loadRequiredRules(client, path, knownHash) {
         }, 10_000);
     });
     try {
-        // Race the whole operation: OAuth token/keychain acquisition can stall
-        // before fetch starts and therefore cannot observe fetch's abort signal.
         value = await Promise.race([client.get(path, { signal: controller.signal }), timeout]);
     }
     catch (error) {

package/dist/resources.js

@@ -1,42 +1,11 @@
 /**
  * ORB-244 Phase D - MCP resources.
- *
- * Resources let MCP-aware clients (Claude Desktop, Cursor) read
- * orboto content as static blobs without explicitly invoking a tool.
- * Where tools are RPCs ("do this thing"), resources are URIs ("here
- * is content at this address").
- *
- * Four URI templates exposed:
- *   orboto://ticket/{ticketKey} - rendered Markdown of the ticket
- *   orboto://doc/{docId} - doc body (Markdown)
- *   orboto://project/{projectKey} - project summary
- *   orboto://search/{query} - search results as Markdown
- *
- * No `list` callback for tickets/docs because the candidate set is
- * unbounded (every ticket, every doc) - the URI templates are
- * sufficient. Clients discover content via tools first, then read a
- * specific resource. The required `list: undefined` pattern keeps
- * the SDK happy.
- *
- * Implementation note: each resource handler delegates to the same
- * REST endpoints the tools use; the only difference is response
- * shape (Markdown text vs. structured tool result). Sharing logic
- * with tools/*.ts would couple the two surfaces too tightly - for
- * now the resources are independent thin renderers.
  */
 import { ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { OrbotoApiError } from './orboto-client.js';
 import { loadRequiredRules } from './required-rules.js';
 import { resolveProjectByKey, resolveTicketByKey } from './tools/shared.js';
 export function registerOrbotoResources(server, client) {
-    // -------------------------------------------------------------------------
-    // orboto://rules
-    //
-    // ORB-1177 - the COMPLETE assembled binding rules, cap-independent. The
-    // MCP `instructions` block is budgeted + may be truncated by the client
-    // (ORB-1168); this resource is never truncated, so a client can fetch
-    // the full rule set on demand. Same source orboto_session_start reads.
-    // -------------------------------------------------------------------------
     server.registerResource('rules', new ResourceTemplate('orboto://rules', { list: undefined }), {
         title: 'Workspace agent rules (complete)',
         description: 'The complete, assembled binding rules you must follow as an agent in this workspace - cap-independent (the MCP instructions block may be truncated; this resource is not). orboto_session_start returns the same rules plus your in-progress work.',
@@ -48,9 +17,6 @@ export function registerOrbotoResources(server, client) {
             contents: [{ uri: uri.href, mimeType: 'text/markdown', text: `# orboto workspace agent rules\n\n${rules}` }],
         };
     });
-    // -------------------------------------------------------------------------
-    // orboto://ticket/{ticketKey}
-    // -------------------------------------------------------------------------
     server.registerResource('ticket', new ResourceTemplate('orboto://ticket/{ticketKey}', { list: undefined }), {
         title: 'orboto ticket',
         description: 'A single ticket with description, assignees, comments, and labels - rendered as Markdown.',
@@ -72,9 +38,6 @@ export function registerOrbotoResources(server, client) {
                 }],
         };
     });
-    // -------------------------------------------------------------------------
-    // orboto://doc/{docId}
-    // -------------------------------------------------------------------------
     server.registerResource('doc', new ResourceTemplate('orboto://doc/{docId}', { list: undefined }), {
         title: 'orboto doc',
         description: 'A wiki page from a doc space - Markdown body.',
@@ -92,9 +55,6 @@ export function registerOrbotoResources(server, client) {
             contents: [{ uri: uri.href, mimeType: 'text/markdown', text: lines.join('\n') }],
         };
     });
-    // -------------------------------------------------------------------------
-    // orboto://project/{projectKey}
-    // -------------------------------------------------------------------------
     server.registerResource('project', new ResourceTemplate('orboto://project/{projectKey}', { list: undefined }), {
         title: 'orboto project',
         description: 'Project metadata, milestones, members.',
@@ -114,13 +74,6 @@ export function registerOrbotoResources(server, client) {
                 }],
         };
     });
-    // -------------------------------------------------------------------------
-    // orboto://search/{query}
-    //
-    // Note: clients URL-encode `query` automatically. Special chars in
-    // a natural-language query are fine; the URI template handles
-    // unescaping.
-    // -------------------------------------------------------------------------
     server.registerResource('search', new ResourceTemplate('orboto://search/{query}', { list: undefined }), {
         title: 'orboto search',
         description: 'Full-text search across tickets, comments, docs - visibility-filtered.',
@@ -150,15 +103,6 @@ export function registerOrbotoResources(server, client) {
                 }],
         };
     });
-    // -------------------------------------------------------------------------
-    // orboto://user/me/notifications
-    //
-    // ORB-706 - read the calling user's recent notifications.
-    // Subscribable: every `notification:new` event for this user
-    // fires a `resources/updated` push. Used by agents that want to
-    // react to mentions / agent_message / status-change pings in
-    // real time.
-    // -------------------------------------------------------------------------
     server.registerResource('user-notifications', new ResourceTemplate('orboto://user/me/notifications', { list: undefined }), {
         title: 'My notifications',
         description: 'Calling user\'s recent notifications. Subscribable - every new notification fires resources/updated. Use this to react to mentions, agent_message (ORB-705), and status-change pings in real time.',
@@ -189,12 +133,6 @@ export function registerOrbotoResources(server, client) {
                 }],
         };
     });
-    // -------------------------------------------------------------------------
-    // ORB-855 - LLM-Wiki resources. The index + log are the space's singleton
-    // kind='index'/'log' docs; a page is any doc by id (namespaced under the
-    // space). A `page/` discriminator keeps the page template from colliding
-    // with the static index/log segments.
-    // -------------------------------------------------------------------------
     const layerDoc = async (spaceId, kind) => {
         const list = await client.get(`/spaces/${spaceId}/docs`);
         return list.find((d) => d.kind === kind) ?? null;

package/dist/resources.test.js

@@ -1,15 +1,5 @@
 /**
  * ORB-244 Phase D - resources unit tests.
- *
- * The MCP SDK's resource-template handlers are normal functions
- * once registered. Pulling them off the server's internal registry
- * would couple us to SDK internals; instead we register against a
- * real McpServer and read back via the protocol-shaped
- * `_registeredResourceTemplates` accessor. If the SDK renames it,
- * the test fails loudly, but that's the point - we want to know.
- *
- * Each test exercises the URI → handler-output path with the
- * stubbed orboto REST client.
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -48,9 +38,7 @@ function getTemplateHandler(server, name) {
 describe('orboto:// ticket resource', () => {
     it('renders a ticket as Markdown with description + comments', async () => {
         stub([
-            // resolveTicketByKey: project lookup
             { json: { id: 'p1', key: 'ACME', name: 'Acme', description: null, status: 'active' } },
-            // resolveTicketByKey: ticket
             {
                 json: {
                     id: 't1', projectId: 'p1', ticketKey: 'ACME-7', title: 'Login bug',
@@ -61,7 +49,6 @@ describe('orboto:// ticket resource', () => {
                     labels: [{ id: 'l1', name: 'bug' }],
                 },
             },
-            // comments page
             {
                 json: {
                     items: [
@@ -124,11 +111,8 @@ describe('orboto:// doc resource', () => {
 describe('orboto:// project resource', () => {
     it('aggregates project + milestones + members into Markdown', async () => {
         stub([
-            // resolveProjectByKey
             { json: { id: 'p1', key: 'ACME', name: 'Acme Inc', description: 'CRM build', status: 'active' } },
-            // milestones
             { json: [{ id: 'm1', name: 'v1', status: 'active', startDate: '2026-04-01', endDate: '2026-05-01' }] },
-            // members
             { json: [{ user: { email: 'ada@acme', fullName: 'Ada' }, role: { name: 'developer' } }] },
         ]);
         const server = buildServerWithResources();