pikiloom 0.4.26 → 0.4.27

package/dist/agent/mcp/extensions.js

@@ -1,17 +1,3 @@
-/**
- * MCP extension management — CRUD, catalog merge, health check, session merge.
- *
- * Global extensions live in ~/.pikiloom/setting.json under extensions.mcp.
- * Workspace extensions live in <workdir>/.mcp.json (standard format).
- *
- * getCatalogItems() produces the unified list the dashboard renders:
- * recommended-registry entries merged with installed entries, with a single
- * state field per item (recommended | needs_auth | disabled | ready | unhealthy).
- *
- * mergeExtensionsForSession() is called by bridge.ts before spawning an agent —
- * it resolves disabled flags, expands OAuth Bearer headers from the token store,
- * and hands the final config map to the agent CLI.
- */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -20,9 +6,6 @@ import { loadUserConfig, saveUserConfig } from '../../core/config/user-config.js
 import { terminateProcessTree } from '../../core/process-control.js';
 import { getRecommendedMcpServers, } from './registry.js';
 import { hasValidMcpToken, injectOAuthHeaders } from './oauth.js';
-// ---------------------------------------------------------------------------
-// Global extensions (setting.json)
-// ---------------------------------------------------------------------------
 export function loadGlobalMcpExtensions() {
     const config = loadUserConfig();
     const mcp = config.extensions?.mcp;
@@ -65,9 +48,6 @@ export function updateGlobalMcpExtension(name, patch) {
     });
     return true;
 }
-// ---------------------------------------------------------------------------
-// Workspace extensions (.mcp.json)
-// ---------------------------------------------------------------------------
 function workspaceMcpJsonPath(workdir) {
     return path.join(workdir, '.mcp.json');
 }
@@ -80,7 +60,7 @@ function readMcpJson(filePath) {
             return servers;
         }
     }
-    catch { /* not found or invalid */ }
+    catch { }
     return {};
 }
 function writeMcpJson(filePath, servers) {
@@ -122,9 +102,6 @@ export function updateWorkspaceMcpExtension(workdir, name, patch) {
     writeMcpJson(mcpPath, servers);
     return true;
 }
-// ---------------------------------------------------------------------------
-// Unified listing
-// ---------------------------------------------------------------------------
 export function listAllMcpExtensions(workdir) {
     const global = loadGlobalMcpExtensions();
     const workspace = workdir ? loadWorkspaceMcpExtensions(workdir) : [];
@@ -138,9 +115,6 @@ export function listAllMcpExtensions(workdir) {
     }
     return [...global, ...workspace, ...claudeMcp];
 }
-// ---------------------------------------------------------------------------
-// Catalog — merged recommended + installed with state computation
-// ---------------------------------------------------------------------------
 function cmdSummary(config) {
     if (config.type === 'http' && config.url)
         return config.url;
@@ -148,13 +122,6 @@ function cmdSummary(config) {
     const args = (config.args || []).filter(a => a !== '-y');
     return [cmd, ...args].join(' ').trim();
 }
-/**
- * Generic @modelcontextprotocol/server-* demos that historically shipped in the
- * recommended list but were later removed (no product identity, overlap with
- * built-in agent capabilities like search/time). We hide them from the catalog
- * UI so old installs don't clutter the Connected section. The configs are kept
- * in setting.json untouched — users can still edit by hand if they want.
- */
 const HIDDEN_GENERIC_DEMO_PACKAGES = new Set([
     '@modelcontextprotocol/server-time',
     '@modelcontextprotocol/server-fetch',
@@ -198,23 +165,12 @@ function computeStateForInstalled(config, auth, id, unhealthyIds) {
         return 'unhealthy';
     return 'ready';
 }
-/**
- * Produce the unified catalog for the dashboard: every recommended registry
- * entry, plus any custom installed entries the user added, each with a
- * computed state field.
- *
- * When `scope` is provided, recommended entries are filtered to those whose
- * `recommendedScope` matches (or is `'both'`). Custom entries are filtered
- * by where they are installed — `scope: 'global'` excludes workspace entries
- * and vice versa.
- */
 export function getCatalogItems(opts = {}) {
     const recommended = getRecommendedMcpServers();
     const installed = [
         ...loadGlobalMcpExtensions(),
         ...(opts.workdir ? loadWorkspaceMcpExtensions(opts.workdir) : []),
     ];
-    // Build lookup: catalogId -> installed entry (preferring global).
     const installedByCatalogId = new Map();
     const customEntries = [];
     for (const entry of installed) {
@@ -240,9 +196,6 @@ export function getCatalogItems(opts = {}) {
         return entry.scope === opts.scope;
     };
     const items = [];
-    // Builtin items derive their installed/state from a top-level config flag
-    // rather than `extensions.mcp`. Each catalogId maps to one flag — extend the
-    // switch when adding a new builtin.
     const userConfig = loadUserConfig();
     const builtinInstalled = (catalogId) => {
         if (catalogId === 'pikiloom-browser')
@@ -251,7 +204,6 @@ export function getCatalogItems(opts = {}) {
             return userConfig.peekabooEnabled === true;
         return false;
     };
-    // 1. Registry entries — preserve registry ordering.
     for (const rec of recommended) {
         if (!scopeMatchesRec(rec))
             continue;
@@ -265,8 +217,6 @@ export function getCatalogItems(opts = {}) {
             installed = builtinInstalled(rec.id);
             state = installed ? 'ready' : 'recommended';
             installedKey = installed ? rec.id : undefined;
-            // Leave scope undefined: builtins aren't tied to global/workspace
-            // storage, and the catalog UI's scope filter ignores items with no scope.
             scope = undefined;
         }
         else {
@@ -299,7 +249,6 @@ export function getCatalogItems(opts = {}) {
             isBuiltin: rec.isBuiltin,
         });
     }
-    // 2. Custom entries — user-added servers not in the recommended registry.
     for (const entry of customEntries) {
         if (!scopeMatchesEntry(entry))
             continue;
@@ -331,10 +280,6 @@ export function getCatalogItems(opts = {}) {
 export function getCatalogItem(id, opts = {}) {
     return getCatalogItems(opts).find(i => i.id === id);
 }
-/**
- * Build an `McpServerConfig` from a recommended entry plus user-supplied
- * credentials. Used when installing a recommended server via the catalog flow.
- */
 export function buildInstalledConfigFromRecommended(rec, opts = { enabled: false }) {
     const creds = opts.credentials || {};
     if (rec.transport.type === 'stdio') {
@@ -355,8 +300,6 @@ export function buildInstalledConfigFromRecommended(rec, opts = { enabled: false
     }
     const headers = {};
     if (rec.auth.type === 'credentials') {
-        // Convention: first non-empty credential becomes Authorization: Bearer <value>.
-        // Matches how Stripe, Perplexity, and similar providers expect the token.
         const first = rec.auth.fields.find(f => creds[f.key]);
         if (first)
             headers.Authorization = `Bearer ${creds[first.key]}`;
@@ -369,18 +312,8 @@ export function buildInstalledConfigFromRecommended(rec, opts = { enabled: false
         catalogId: rec.id,
     };
 }
-// ---------------------------------------------------------------------------
-// Merge for session — called by bridge.ts
-// ---------------------------------------------------------------------------
-/**
- * Build the merged MCP server list for a session.
- * Priority (low → high): global → workspace .mcp.json → .claude/.mcp.json → ~/.claude/.mcp.json → builtins.
- * Disabled servers are filtered out. OAuth Bearer headers are injected for
- * any http-type server that has a valid token in the token store.
- */
 export function mergeExtensionsForSession(builtinServers, workdir) {
     const merged = {};
-    // 1. Global extensions from setting.json (lowest priority)
     const userConfig = loadUserConfig();
     const globalMcp = userConfig.extensions?.mcp;
     if (globalMcp) {
@@ -406,7 +339,6 @@ export function mergeExtensionsForSession(builtinServers, workdir) {
             }
         }
     }
-    // 2. Workspace .mcp.json files (overwrite global)
     if (workdir) {
         for (const candidate of [
             path.join(workdir, '.mcp.json'),
@@ -428,10 +360,9 @@ export function mergeExtensionsForSession(builtinServers, workdir) {
                     }
                 }
             }
-            catch { /* skip */ }
+            catch { }
         }
     }
-    // 3. Built-in servers (highest priority)
     for (const server of builtinServers) {
         merged[server.name] = {
             type: 'stdio',
@@ -440,7 +371,6 @@ export function mergeExtensionsForSession(builtinServers, workdir) {
             ...(server.env ? { env: server.env } : {}),
         };
     }
-    // Filter out any remaining disabled entries
     for (const [name, cfg] of Object.entries(merged)) {
         if (cfg?.disabled === true || cfg?.enabled === false) {
             delete merged[name];
@@ -448,15 +378,6 @@ export function mergeExtensionsForSession(builtinServers, workdir) {
     }
     return merged;
 }
-/**
- * Convert global + workspace extensions to RegisteredMcpServer[] for Codex
- * and Gemini agents that consume server arrays instead of merged configs.
- *
- * Supports both stdio and HTTP transports. For HTTP entries, OAuth Bearer
- * headers are injected from the token store (same path as
- * mergeExtensionsForSession), so a one-time global authorization carries
- * across every workspace.
- */
 export function getGlobalExtensionsAsServers(workdir) {
     const merged = new Map();
     const toEntry = (name, cfg) => {
@@ -615,7 +536,7 @@ export async function checkMcpHealth(config, timeoutMs = 10_000) {
             try {
                 child.stdin?.write(toolsHeader + toolsRequest);
             }
-            catch { /* best-effort */ }
+            catch { }
             setTimeout(() => {
                 stopChildTree();
                 const tools = [];
@@ -636,11 +557,11 @@ export async function checkMcpHealth(config, timeoutMs = 10_000) {
                                             tools.push(tool.name);
                                 }
                             }
-                            catch { /* try next match */ }
+                            catch { }
                         }
                     }
                 }
-                catch { /* best effort */ }
+                catch { }
                 finish({ ok: true, tools: tools.length ? tools : undefined, elapsedMs: Date.now() - start });
             }, 1500);
         }, 100);

package/dist/agent/mcp/oauth.js

@@ -1,22 +1,5 @@
-/**
- * MCP OAuth 2.1 + Dynamic Client Registration subsystem.
- *
- * Implements the MCP auth spec flow for remote HTTP MCP servers:
- *   1. Discover auth server (Protected Resource Metadata + WWW-Authenticate header).
- *   2. Fetch Authorization Server Metadata.
- *   3. Register client dynamically (RFC 7591) if no pre-registered client_id.
- *   4. Drive authorization_code + PKCE — returns auth URL for user's browser.
- *   5. Exchange code for tokens on callback.
- *   6. Refresh tokens when expired.
- *
- * Tokens are persisted via the token store (setting.json `extensions.mcpTokens`).
- * State for in-flight authorizations is kept in memory only.
- */
 import crypto from 'node:crypto';
 import { loadUserConfig, saveUserConfig, } from '../../core/config/user-config.js';
-// ---------------------------------------------------------------------------
-// Token store (setting.json-backed)
-// ---------------------------------------------------------------------------
 export function getMcpToken(serverId) {
     const cfg = loadUserConfig();
     return cfg.extensions?.mcpTokens?.[serverId];
@@ -45,18 +28,12 @@ export function hasValidMcpToken(serverId) {
         return false;
     return true;
 }
-// ---------------------------------------------------------------------------
-// PKCE helpers
-// ---------------------------------------------------------------------------
 function randomUrlSafe(bytes) {
     return crypto.randomBytes(bytes).toString('base64url');
 }
 function pkceChallenge(verifier) {
     return crypto.createHash('sha256').update(verifier).digest('base64url');
 }
-// ---------------------------------------------------------------------------
-// Discovery
-// ---------------------------------------------------------------------------
 async function fetchJson(url, init, timeoutMs = 8_000) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -70,17 +47,6 @@ async function fetchJson(url, init, timeoutMs = 8_000) {
         clearTimeout(timer);
     }
 }
-/**
- * Discover the authorization server for a remote MCP resource and the
- * canonical `resource` indicator the AS will validate against.
- *
- * Strategy:
- *   1. Try GET {resourceBase}/.well-known/oauth-protected-resource (RFC 9728).
- *   2. Fall back to probing the MCP endpoint for a 401 with WWW-Authenticate
- *      and follow the resource_metadata link.
- *   3. Last resort: treat the origin as the AS and the input URL as the
- *      canonical resource.
- */
 async function discoverAuthorizationServer(resourceUrl) {
     const origin = new URL(resourceUrl).origin;
     const adopt = (meta) => {
@@ -92,15 +58,13 @@ async function discoverAuthorizationServer(resourceUrl) {
             canonicalResource: meta.resource || resourceUrl,
         };
     };
-    // Strategy 1: Protected Resource Metadata at the origin
     try {
         const meta = await fetchJson(`${origin}/.well-known/oauth-protected-resource`);
         const out = adopt(meta);
         if (out)
             return out;
     }
-    catch { /* try next */ }
-    // Strategy 2: probe resource for WWW-Authenticate, follow resource_metadata
+    catch { }
     try {
         const controller = new AbortController();
         const timer = setTimeout(() => controller.abort(), 8_000);
@@ -113,9 +77,6 @@ async function discoverAuthorizationServer(resourceUrl) {
         clearTimeout(timer);
         if (res.status === 401) {
             const auth = res.headers.get('www-authenticate') || '';
-            // A header may declare resource_metadata twice; prefer the most specific
-            // (last) match since servers commonly emit both origin-level and
-            // per-resource paths in one header.
             const matches = [...auth.matchAll(/resource_metadata="([^"]+)"/gi)];
             const link = matches.length ? matches[matches.length - 1][1] : null;
             if (link) {
@@ -126,12 +87,10 @@ async function discoverAuthorizationServer(resourceUrl) {
             }
         }
     }
-    catch { /* fall through */ }
-    // Last resort: assume the resource origin is itself the authorization server
+    catch { }
     return { authorizationServer: origin, canonicalResource: resourceUrl };
 }
 async function fetchAuthorizationServerMetadata(issuer) {
-    // Try OAuth AS metadata first (RFC 8414), then OIDC fallback
     const candidates = [
         `${issuer.replace(/\/$/, '')}/.well-known/oauth-authorization-server`,
         `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`,
@@ -183,9 +142,6 @@ async function resolveEndpoints(auth, resourceUrl) {
         canonicalResource: discovered.canonicalResource,
     };
 }
-// ---------------------------------------------------------------------------
-// Pending state (in-memory, short-lived)
-// ---------------------------------------------------------------------------
 const pendingFlows = new Map();
 const PENDING_TTL_MS = 10 * 60 * 1000;
 function sweepPending() {
@@ -195,18 +151,6 @@ function sweepPending() {
             pendingFlows.delete(state);
     }
 }
-// ---------------------------------------------------------------------------
-// Public API: start authorization, handle callback, refresh
-// ---------------------------------------------------------------------------
-/**
- * Kick off an OAuth flow for the given MCP server.
- *
- * @param serverId  The catalog id / installed-extension key.
- * @param auth      The auth spec from registry.
- * @param resourceUrl  The MCP server URL (http transport url).
- * @param redirectUri  Callback URL (http://localhost:<port>/api/extensions/mcp/oauth/callback).
- * @param clientName  Human-readable client name shown to the provider.
- */
 export async function startAuthorization(opts) {
     sweepPending();
     const { serverId, auth, resourceUrl, redirectUri, clientName } = opts;
@@ -254,9 +198,6 @@ export async function startAuthorization(opts) {
     });
     return { authUrl, state };
 }
-/**
- * Exchange the authorization code for tokens and persist the result.
- */
 export async function completeAuthorization(opts) {
     const flow = pendingFlows.get(opts.state);
     if (!flow)
@@ -298,10 +239,6 @@ export async function completeAuthorization(opts) {
     saveMcpToken(flow.serverId, record);
     return { ok: true, serverId: flow.serverId };
 }
-/**
- * Refresh an expired token. Returns the updated record or null if refresh failed
- * (e.g., no refresh_token available, or refresh rejected).
- */
 export async function refreshMcpToken(serverId) {
     const token = getMcpToken(serverId);
     if (!token?.refreshToken)
@@ -338,10 +275,6 @@ export async function refreshMcpToken(serverId) {
         return null;
     }
 }
-/**
- * Inject Authorization: Bearer headers for remote MCP configs that have a token.
- * Called by bridge.ts before handing merged config to agents.
- */
 export function injectOAuthHeaders(name, config) {
     const token = getMcpToken(name);
     if (!token?.accessToken)

package/dist/agent/mcp/registry.js

@@ -1,30 +1,6 @@
-/**
- * MCP extension registry — curated recommended servers, recommended skills, community search.
- *
- * Schema supports three transport × auth combinations:
- *   - stdio  + none         (local, zero-config)
- *   - stdio  + credentials  (local, needs API key/token)
- *   - http   + none         (rare)
- *   - http   + credentials  (remote with API key)
- *   - http   + mcp-oauth    (remote SaaS via MCP OAuth spec)
- *
- * For MCP-OAuth servers, `authorizationEndpoint` / `tokenEndpoint` can be
- * pre-declared (fast path) or omitted (discovered via MCP Protected Resource
- * Metadata at `<url>/.well-known/oauth-protected-resource`).
- */
-// ---------------------------------------------------------------------------
-// Recommended MCP servers + skill repos — data lives in src/catalog/
-//
-// This module owns the *types* and helper functions. Edit
-// `src/catalog/mcp-servers.ts` and `src/catalog/skill-repos.ts` to add or hide
-// entries; the arrays below are just pointers back at that catalog.
-// ---------------------------------------------------------------------------
 import { MCP_SERVERS, SKILL_REPOS } from '../../catalog/index.js';
 const RECOMMENDED_MCP_SERVERS = MCP_SERVERS;
 const RECOMMENDED_SKILL_REPOS = SKILL_REPOS;
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
 export function getRecommendedMcpServers() {
     return RECOMMENDED_MCP_SERVERS;
 }
@@ -34,10 +10,6 @@ export function getRecommendedMcpServer(id) {
 export function getRecommendedSkillRepos() {
     return RECOMMENDED_SKILL_REPOS;
 }
-/**
- * Search the official MCP Registry API for servers.
- * Falls back to npm search if the registry is unreachable.
- */
 export async function searchMcpServers(query, limit = 20) {
     if (!query.trim())
         return [];
@@ -87,12 +59,9 @@ export async function searchMcpServers(query, limit = 20) {
             }
         }
     }
-    catch { /* fallback failed */ }
+    catch { }
     return [];
 }
-/**
- * Search for skills via npm search (`agent skill` keywords).
- */
 export async function searchSkills(query, limit = 20) {
     if (!query.trim())
         return [];
@@ -114,6 +83,6 @@ export async function searchSkills(query, limit = 20) {
             })).filter((s) => s.name);
         }
     }
-    catch { /* unreachable */ }
+    catch { }
     return [];
 }

package/dist/agent/mcp/session-server.js

@@ -1,29 +1,9 @@
-/**
- * mcp-session-server.ts — MCP server process for pikiloom session bridge.
- *
- * Spawned by the agent CLI (claude/codex/gemini) via --mcp-config or codex mcp add.
- * Communicates with the agent over stdio using the MCP protocol (JSON-RPC 2.0).
- *
- * Supports two stdio transports (auto-detected from first byte):
- *   - Content-Length framing (Claude, Gemini — standard MCP/LSP)
- *   - Newline-delimited JSON (Codex)
- *
- * Context is injected via environment variables:
- *   MCP_WORKSPACE_PATH — absolute path to the session workspace
- *   MCP_STAGED_FILES   — JSON array of staged file relative paths
- *   MCP_CALLBACK_URL   — HTTP URL for the pikiloom callback server
- *
- * Tools are defined in src/tools/ — each module exports definitions + handlers.
- */
 import path from 'node:path';
 import { createRetainedLogSink, writeScopedLog } from '../../core/logging.js';
 import { workspaceTools } from './tools/workspace.js';
 import { goalTools } from './tools/goal.js';
 import { awaitResumeTools } from './tools/await-resume.js';
 import { askUserTools } from './tools/ask-user.js';
-// ---------------------------------------------------------------------------
-// Logging — writes to stderr + file so it doesn't interfere with stdio MCP transport
-// ---------------------------------------------------------------------------
 const _logSink = (() => {
     try {
         const ws = process.env.MCP_WORKSPACE_PATH || '';
@@ -53,9 +33,6 @@ function summarizeArgs(args, max = 200) {
         return '{}';
     return text.length <= max ? text : `${text.slice(0, Math.max(0, max - 3)).trimEnd()}...`;
 }
-// ---------------------------------------------------------------------------
-// Context from environment
-// ---------------------------------------------------------------------------
 const ctx = {
     workspace: process.env.MCP_WORKSPACE_PATH || '',
     workdir: process.env.MCP_WORKDIR || undefined,
@@ -70,35 +47,21 @@ const ctx = {
     callbackUrl: process.env.MCP_CALLBACK_URL || '',
 };
 log(`started workspace=${ctx.workspace} stagedFiles=${ctx.stagedFiles.length} callbackUrl=${ctx.callbackUrl ? 'set' : 'MISSING'}`);
-// ---------------------------------------------------------------------------
-// Tool registry — collect all tool modules
-// ---------------------------------------------------------------------------
-// `MCP_TOOLS_AVAILABLE` lists tool families the bridge has wired up. Codex
-// has a native `/goal` implementation and native user-input, so it skips
-// `goalTools` and never receives `ask-user` via the bridge.
 const AVAILABLE = new Set((process.env.MCP_TOOLS_AVAILABLE || '').split(',').map(s => s.trim()).filter(Boolean));
 const IS_CODEX = process.env.MCP_AGENT === 'codex';
 const TOOL_MODULES = [
     ...(AVAILABLE.has('workspace') ? [workspaceTools] : []),
     ...(IS_CODEX ? [] : [goalTools]),
-    // Codex parks/resumes via its own native goal machinery; the pikiloom
-    // awaiting marker is for the `claude -p`-style drivers whose turn process
-    // exits at `result`.
     ...(IS_CODEX ? [] : [awaitResumeTools]),
     ...(AVAILABLE.has('ask-user') ? [askUserTools] : []),
 ];
 const ALL_TOOLS = TOOL_MODULES.flatMap(m => m.tools);
-/** Lookup: tool name → module that handles it. */
 const TOOL_HANDLERS = new Map();
 for (const mod of TOOL_MODULES) {
     for (const t of mod.tools) {
         TOOL_HANDLERS.set(t.name, mod);
     }
 }
-// ---------------------------------------------------------------------------
-// MCP protocol — auto-detect transport format
-// ---------------------------------------------------------------------------
-/** 'framed' = Content-Length (Claude/Gemini), 'ndjson' = newline-delimited (Codex) */
 let transport = null;
 function send(msg) {
     const body = JSON.stringify(msg);
@@ -115,9 +78,6 @@ function respond(id, result) {
 function respondError(id, code, message) {
     send({ jsonrpc: '2.0', id, error: { code, message } });
 }
-// ---------------------------------------------------------------------------
-// Stdio reader — auto-detecting Content-Length framed vs NDJSON
-// ---------------------------------------------------------------------------
 let buffer = '';
 function processFramed() {
     while (true) {
@@ -139,7 +99,7 @@ function processFramed() {
         try {
             handleMessage(JSON.parse(body));
         }
-        catch { /* ignore parse errors */ }
+        catch { }
     }
 }
 function processNdjson() {
@@ -154,7 +114,7 @@ function processNdjson() {
         try {
             handleMessage(JSON.parse(line));
         }
-        catch { /* ignore parse errors */ }
+        catch { }
     }
 }
 function processBuffer() {
@@ -175,9 +135,6 @@ process.stdin.on('data', (chunk) => {
     processBuffer();
 });
 process.stdin.on('end', () => process.exit(0));
-// ---------------------------------------------------------------------------
-// Message dispatcher
-// ---------------------------------------------------------------------------
 function handleMessage(msg) {
     const { id, method, params } = msg;
     switch (method) {

package/dist/agent/mcp/tools/ask-user.js

@@ -1,8 +1,3 @@
-/**
- * tools/ask-user.ts — im_ask_user: block the current turn and route a question
- * to the user via IM or dashboard. Used in place of Claude's native
- * `AskUserQuestion`, which is unusable in `-p` mode.
- */
 import http from 'node:http';
 import { toolResult, toolLog } from './types.js';
 const tools = [
@@ -97,7 +92,6 @@ function callbackAskUser(callbackUrl, body) {
             });
         });
         req.on('error', e => reject(e));
-        // User reply has no upper bound — never time out the socket.
         req.setTimeout(0);
         req.write(payload);
         req.end();

package/dist/agent/mcp/tools/await-resume.js

@@ -1,18 +1,3 @@
-/**
- * tools/await-resume.ts — "waiting for background work" marker MCP tool.
- *
- *   await_background — Lets the model declare that this turn is ending while
- *                      detached/background work it launched keeps running, and
- *                      it intends to report back later. Purely a UI hint: it
- *                      changes nothing about execution, it only lets the
- *                      dashboard show a "waiting" state instead of "completed"
- *                      for the interval until the session next runs.
- *
- * State lives at <sessionRoot>/awaiting.json; this server resolves the session
- * root from MCP_WORKSPACE_PATH (which points to <sessionRoot>/workspace). The
- * parent reads & clears it (see agent/await-resume.ts) — clearing happens
- * automatically the next time the session runs.
- */
 import fs from 'node:fs';
 import path from 'node:path';
 import { toolResult, toolLog } from './types.js';

package/dist/agent/mcp/tools/goal.js

@@ -1,22 +1,6 @@
-/**
- * tools/goal.ts — Persistent thread goal MCP tools.
- *
- *   goal_get    — Returns the current goal (objective, status, usage, budget).
- *   goal_update — Lets the model mark the goal complete after a completion audit.
- *                 The schema only accepts `status: "complete"`. Pause / resume /
- *                 clear / budget_limited transitions are user- or runtime-controlled
- *                 and not exposed to the model.
- *
- * Goal state lives at <sessionRoot>/goal.json; this server resolves the session
- * root from MCP_WORKSPACE_PATH (which points to <sessionRoot>/workspace).
- */
 import fs from 'node:fs';
 import path from 'node:path';
 import { toolResult, toolLog } from './types.js';
-// ---------------------------------------------------------------------------
-// Tool definitions — descriptions match Codex's analogous `get_goal` / `update_goal`
-// behaviour but use the pikiloom tool name.
-// ---------------------------------------------------------------------------
 const tools = [
     {
         name: 'goal_get',
@@ -46,9 +30,6 @@ const tools = [
         },
     },
 ];
-// ---------------------------------------------------------------------------
-// Path resolution — workspace → session root → goal.json
-// ---------------------------------------------------------------------------
 function sessionRootFromCtx(ctx) {
     const workspace = path.resolve(ctx.workspace || '');
     if (!workspace)
@@ -91,9 +72,6 @@ function serialize(goal) {
         updated_at: goal.updatedAt,
     };
 }
-// ---------------------------------------------------------------------------
-// Handlers
-// ---------------------------------------------------------------------------
 function handleGoalGet(ctx) {
     const file = goalPathFromCtx(ctx);
     toolLog('goal_get', `file=${file || '(unresolved)'}`);
@@ -129,9 +107,6 @@ function handleGoalUpdate(args, ctx) {
             : `tokens used: ${goal.tokensUsed}`,
     }, null, 2));
 }
-// ---------------------------------------------------------------------------
-// Module export
-// ---------------------------------------------------------------------------
 export const goalTools = {
     tools,
     handle(name, args, ctx) {

package/dist/agent/mcp/tools/types.js

@@ -1,12 +1,7 @@
-/**
- * MCP tool type definitions and helper utilities.
- */
 import { writeScopedLog } from '../../../core/logging.js';
-/** Helper to build a text tool result. */
 export function toolResult(text, isError = false) {
     return { content: [{ type: 'text', text }], ...(isError ? { isError: true } : {}) };
 }
-/** Shared logger for tool modules — writes to stderr to avoid interfering with stdio MCP transport. */
 export function toolLog(tool, msg) {
     writeScopedLog(`tool:${tool}`, msg, { level: 'debug', stream: 'stderr' });
 }