pikiloom 0.4.26 → 0.4.28

package/dist/dashboard/routes/extensions.js

@@ -1,16 +1,3 @@
-/**
- * Dashboard API routes for extension management — MCP servers and skills.
- *
- * Catalog-first design: GET /catalog returns a unified list of recommended
- * registry entries merged with the user's installed servers, each tagged with
- * a single `state` field. The frontend uses that state to render the right CTA
- * (Install / Authorize / Enable / Disable / Remove).
- *
- * OAuth endpoints:
- *   POST /oauth/start    — kicks off auth-code flow, returns auth URL + state
- *   GET  /oauth/callback — provider redirects here; exchanges code for tokens
- *   POST /oauth/revoke   — clears stored tokens for a server
- */
 import { Hono } from 'hono';
 import { execFile } from 'node:child_process';
 import { addGlobalMcpExtension, removeGlobalMcpExtension, updateGlobalMcpExtension, addWorkspaceMcpExtension, removeWorkspaceMcpExtension, updateWorkspaceMcpExtension, getCatalogItems, buildInstalledConfigFromRecommended, checkMcpHealth, getCachedHealth, cacheHealth, getRecommendedMcpServer, listSkills, installSkill, removeSkill, recordSkillInstall, getSkillLedgerEntry, getRecommendedSkillRepos, searchSkillRepos, searchMcpServers, startAuthorization, completeAuthorization, deleteMcpToken, getMcpToken, } from '../../agent/index.js';
@@ -19,11 +6,6 @@ import { ensurePeekabooWarm } from '../../agent/mcp/bridge.js';
 import { runtime } from '../runtime.js';
 import path from 'node:path';
 import fs from 'node:fs';
-/**
- * Builtin catalog entries don't live in `extensions.mcp` — they're toggled by
- * a top-level config flag. Each catalogId maps to one flag; add a branch when
- * registering a new builtin.
- */
 function setBuiltinEnabled(catalogId, enabled) {
     if (catalogId === 'pikiloom-browser') {
         saveUserConfig({ ...loadUserConfig(), browserEnabled: enabled });
@@ -31,9 +13,6 @@ function setBuiltinEnabled(catalogId, enabled) {
     }
     if (catalogId === 'peekaboo') {
         saveUserConfig({ ...loadUserConfig(), peekabooEnabled: enabled });
-        // Warm the npx package the moment Peekaboo is enabled so it's downloaded
-        // before the first session — otherwise the agent hits a cold cache and
-        // hangs at "Still connecting". Disabling is a no-op.
         if (enabled)
             ensurePeekabooWarm();
         return true;
@@ -54,15 +33,9 @@ function isValidWorkdir(dir) {
     }
 }
 function getCallbackRedirectUri(c) {
-    // Build from the current request so the URL matches whatever port/origin
-    // the dashboard is actually served on (dev, prod, custom port, etc.).
     const origin = new URL(c.req.url).origin;
     return `${origin}/api/extensions/mcp/oauth/callback`;
 }
-// ---------------------------------------------------------------------------
-// MCP — unified catalog
-// ---------------------------------------------------------------------------
-/** GET /api/extensions/mcp/catalog — Unified recommended + installed list with state. */
 app.get('/api/extensions/mcp/catalog', (c) => {
     const workdir = c.req.query('workdir') || runtime.getRequestWorkdir();
     const scopeParam = c.req.query('scope');
@@ -72,13 +45,6 @@ app.get('/api/extensions/mcp/catalog', (c) => {
     const items = getCatalogItems({ workdir, scope });
     return c.json({ ok: true, items });
 });
-/**
- * POST /api/extensions/mcp/install
- * Install a recommended registry entry. Body:
- *   { catalogId, scope, workdir?, credentials?, enable? }
- * Missing credentials for mcp-oauth servers is fine — they'll surface as
- * `needs_auth` in the catalog, and the UI should call /oauth/start next.
- */
 app.post('/api/extensions/mcp/install', async (c) => {
     try {
         const body = await c.req.json();
@@ -92,7 +58,6 @@ app.post('/api/extensions/mcp/install', async (c) => {
             const ok = setBuiltinEnabled(rec.id, enable !== false);
             return c.json({ ok, enabled: ok && enable !== false });
         }
-        // Don't enable yet for mcp-oauth if no token exists — user still needs to authorize.
         let shouldEnable = enable;
         if (rec.auth.type === 'mcp-oauth' && !getMcpToken(rec.id))
             shouldEnable = false;
@@ -120,10 +85,6 @@ app.post('/api/extensions/mcp/install', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/**
- * POST /api/extensions/mcp/toggle
- * Enable/disable an installed server by its installed key.
- */
 app.post('/api/extensions/mcp/toggle', async (c) => {
     try {
         const body = await c.req.json();
@@ -150,7 +111,6 @@ app.post('/api/extensions/mcp/toggle', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/** POST /api/extensions/mcp/update — patch config fields (credentials, url, etc.). */
 app.post('/api/extensions/mcp/update', async (c) => {
     try {
         const body = await c.req.json();
@@ -173,7 +133,6 @@ app.post('/api/extensions/mcp/update', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/** POST /api/extensions/mcp/remove — uninstall. Also clears any OAuth tokens. */
 app.post('/api/extensions/mcp/remove', async (c) => {
     try {
         const body = await c.req.json();
@@ -201,7 +160,6 @@ app.post('/api/extensions/mcp/remove', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/** POST /api/extensions/mcp/custom — add a user-defined server not in the registry. */
 app.post('/api/extensions/mcp/custom', async (c) => {
     try {
         const body = await c.req.json();
@@ -229,7 +187,6 @@ app.post('/api/extensions/mcp/custom', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/** POST /api/extensions/mcp/health — health check with 10-min cache per catalogId. */
 app.post('/api/extensions/mcp/health', async (c) => {
     try {
         const body = await c.req.json();
@@ -251,7 +208,6 @@ app.post('/api/extensions/mcp/health', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/** GET /api/extensions/mcp/search — search community MCP servers (fallback path). */
 app.get('/api/extensions/mcp/search', async (c) => {
     const query = c.req.query('q') || '';
     const parsed = parseInt(c.req.query('limit') || '20', 10);
@@ -264,10 +220,6 @@ app.get('/api/extensions/mcp/search', async (c) => {
         return c.json({ ok: false, error: e?.message, results: [] });
     }
 });
-// ---------------------------------------------------------------------------
-// MCP — OAuth
-// ---------------------------------------------------------------------------
-/** POST /api/extensions/mcp/oauth/start — returns authUrl the client should open. */
 app.post('/api/extensions/mcp/oauth/start', async (c) => {
     try {
         const body = await c.req.json();
@@ -297,7 +249,6 @@ app.post('/api/extensions/mcp/oauth/start', async (c) => {
         return c.json({ ok: false, error: e?.message || 'oauth start failed' }, 500);
     }
 });
-/** GET /api/extensions/mcp/oauth/callback — browser landing page for the provider redirect. */
 app.get('/api/extensions/mcp/oauth/callback', async (c) => {
     const code = c.req.query('code') || '';
     const state = c.req.query('state') || '';
@@ -364,7 +315,6 @@ app.get('/api/extensions/mcp/oauth/callback', async (c) => {
         });
     }
 });
-/** POST /api/extensions/mcp/oauth/revoke — clear stored tokens. */
 app.post('/api/extensions/mcp/oauth/revoke', async (c) => {
     try {
         const body = await c.req.json();
@@ -378,12 +328,6 @@ app.post('/api/extensions/mcp/oauth/revoke', async (c) => {
         return c.json({ ok: false, error: e?.message || 'internal error' }, 500);
     }
 });
-/**
- * Extract the GitHub owner slug from a skill `source`. Accepts both the
- * compact `owner/repo` form and full `https://github.com/owner/repo[...]`
- * URLs. Returns null when the source doesn't look like a GitHub reference,
- * in which case the dashboard falls back to a letter avatar.
- */
 function extractGithubOwner(source) {
     if (!source)
         return null;
@@ -391,7 +335,6 @@ function extractGithubOwner(source) {
     const owner = cleaned.split('/')[0]?.trim();
     if (!owner)
         return null;
-    // GitHub usernames: alphanumerics + single hyphens, 1–39 chars.
     return /^[a-z0-9](?:[a-z0-9-]{0,38})$/i.test(owner) ? owner : null;
 }
 const githubMetaCache = new Map();
@@ -400,18 +343,6 @@ let githubMetaInflight = null;
 const remoteSkillsCache = new Map();
 const REMOTE_SKILLS_TTL_MS = 24 * 60 * 60 * 1000;
 const remoteSkillsInflight = new Map();
-/**
- * Resolve a GitHub API token without making the user export anything. Order:
- *   1. `GITHUB_TOKEN` env var (explicit override wins).
- *   2. `gh auth token` — pikiloom recommends `gh` in its CLI catalog, so any
- *      user who's set up the CLI extensions has a token already. Cached for
- *      10 minutes since tokens rarely rotate; on rotation the next refresh
- *      picks it up automatically.
- *
- * Returns null when neither path works (gh missing or not signed in). In that
- * case GitHub Contents calls fall back to the 60 req/h unauth limit, which is
- * still enough for most casual users.
- */
 let githubTokenCache = null;
 let githubTokenInflight = null;
 const GITHUB_TOKEN_TTL_MS = 10 * 60 * 1000;
@@ -421,11 +352,6 @@ async function resolveGithubToken() {
     if (githubTokenCache && Date.now() - githubTokenCache.resolvedAt < GITHUB_TOKEN_TTL_MS) {
         return githubTokenCache.value;
     }
-    // Singleflight: if a probe is already in flight, await its result instead of
-    // spawning N parallel `gh` subprocesses. The 14-source catalog warm-up used
-    // to race here and one keyring lock-contention failure would poison the
-    // cache for the next 10 minutes. We also only cache on success — a null
-    // result just falls through to the next caller's probe.
     if (githubTokenInflight)
         return githubTokenInflight;
     githubTokenInflight = (async () => {
@@ -489,15 +415,6 @@ async function fetchGithubContents(owner, repo, path) {
         return null;
     }
 }
-/**
- * Discover skills inside a remote repo. Tries the two common layouts:
- *   1. `<repo>/skills/<name>/SKILL.md`   (Anthropic-style)
- *   2. `<repo>/<name>/SKILL.md`          (flat layout)
- *
- * Returns a deduplicated list of subdirectory names that look like skills.
- * Best-effort — a missing SKILL.md inside a subdir just gets included if the
- * subdir name matches sensible conventions, since some repos lazy-load.
- */
 async function listRemoteSkillsFromGithub(source) {
     const cached = remoteSkillsCache.get(source);
     if (cached && Date.now() - cached.cachedAt < REMOTE_SKILLS_TTL_MS)
@@ -510,7 +427,6 @@ async function listRemoteSkillsFromGithub(source) {
         if (!parsed)
             return null;
         const { owner, repo } = parsed;
-        // Look for skills/ subdir first; fall back to root if absent.
         let listing = await fetchGithubContents(owner, repo, 'skills');
         let basePath = 'skills';
         if (!listing || listing.length === 0) {
@@ -520,15 +436,10 @@ async function listRemoteSkillsFromGithub(source) {
         if (!listing)
             return null;
         const directories = listing.filter(e => e.type === 'dir' && !e.name.startsWith('.'));
-        // To keep one repo from costing 100+ subsequent fetches (verifying SKILL.md
-        // inside each subdir), we skip the per-skill verification and instead
-        // accept any directory under the resolved base as a candidate skill. This
-        // matches how `npx skills add` itself enumerates targets.
         const skills = directories.map(d => ({
             name: d.name,
             path: d.path,
         }));
-        // Some repos return >1000 entries; GitHub's contents endpoint caps there.
         const partial = directories.length >= 1000;
         const result = { skills, partial };
         remoteSkillsCache.set(source, { value: result, cachedAt: Date.now() });
@@ -537,7 +448,6 @@ async function listRemoteSkillsFromGithub(source) {
     remoteSkillsInflight.set(source, promise);
     return promise;
 }
-/** GET /api/extensions/skills/list?source=owner/repo — list a repo's available skills. */
 app.get('/api/extensions/skills/list', async (c) => {
     const source = c.req.query('source')?.trim();
     if (!source)
@@ -554,7 +464,6 @@ app.get('/api/extensions/skills/list', async (c) => {
     return c.json({ ok: true, skills: result.skills, partial: result.partial });
 });
 async function fetchOneRepoMeta(source) {
-    // Accept either `owner/repo` or a full GitHub URL.
     const slug = source.replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '');
     if (!/^[^/]+\/[^/]+$/.test(slug))
         return null;
@@ -582,13 +491,6 @@ async function fetchOneRepoMeta(source) {
         return null;
     }
 }
-/**
- * Default-branch HEAD commit SHA per source — the signal we diff installed
- * skills against. Cached with a much shorter TTL than the star/pushedAt meta
- * (10 min vs 24h) so "update available" stays close to real-time without
- * hammering the API; we only fetch it for collections that are actually
- * installed. Cache only on success so a transient null never sticks.
- */
 const repoHeadShaCache = new Map();
 const REPO_HEAD_SHA_TTL_MS = 10 * 60 * 1000;
 const repoHeadShaInflight = new Map();
@@ -608,8 +510,6 @@ async function fetchRepoHeadSha(source) {
             const controller = new AbortController();
             const timer = setTimeout(() => controller.abort(), 5_000);
             const token = await resolveGithubToken();
-            // `commits?per_page=1` returns the latest commit on the default branch
-            // without needing to know the branch name first.
             const res = await fetch(`https://api.github.com/repos/${slug}/commits?per_page=1`, {
                 signal: controller.signal,
                 headers: {
@@ -661,14 +561,12 @@ async function ensureRepoMeta(sources) {
         githubMetaInflight = null;
     }
 }
-/** GET /api/extensions/skills/catalog — unified recommended + installed skills view. */
 app.get('/api/extensions/skills/catalog', async (c) => {
     const workdir = c.req.query('workdir') || runtime.getRequestWorkdir();
     const scopeParam = c.req.query('scope');
     const scope = scopeParam === 'global' || scopeParam === 'workspace' || scopeParam === 'both'
         ? scopeParam
         : undefined;
-    // Workspace view requires a workdir; global view can use the global skills dir without one.
     if (scope === 'workspace' && !workdir) {
         return c.json({ ok: false, error: 'workdir is required', items: [], installed: [] }, 400);
     }
@@ -680,27 +578,18 @@ app.get('/api/extensions/skills/catalog', async (c) => {
             return true;
         return repo.recommendedScope === scope || repo.recommendedScope === 'both';
     });
-    // Best-effort GitHub metadata. We don't await on a cold cache here so the
-    // first paint isn't blocked by GitHub latency — if results are still cold,
-    // they'll appear on the next refresh (the dashboard already does SWR).
     const sources = filtered.map(r => r.source);
     const allCached = sources.every(s => githubMetaCache.has(s));
     if (allCached) {
-        // Cheap path: nothing to fetch, just return.
     }
     else {
         await ensureRepoMeta(sources).catch(() => { });
     }
-    // Fire-and-forget warm-up for the remote-skills listing on any source we
-    // haven't seen yet. On the first ever catalog load this won't return totals,
-    // but the SWR refresh on the dashboard picks them up moments later.
     for (const s of sources) {
         if (!remoteSkillsCache.has(s) && !remoteSkillsInflight.has(s)) {
             void listRemoteSkillsFromGithub(s).catch(() => { });
         }
     }
-    // Build a lookup keyed by installed-skill name (lowercased) so we can quickly
-    // mark a repo's remote skills as installed. Scope-filter once up front.
     const scopedInstalled = scope === 'global'
         ? installed.filter(s => s.scope === 'global')
         : scope === 'workspace'
@@ -709,9 +598,6 @@ app.get('/api/extensions/skills/catalog', async (c) => {
     const installedByName = new Map();
     for (const s of scopedInstalled)
         installedByName.set(s.name.toLowerCase(), s);
-    // Resolve each repo's installed sub-skills first (sync). Prefer the remote
-    // listing intersection over the static `repo.skills` hint — most catalog
-    // entries don't fill the hint, and the GitHub listing is authoritative.
     const computeInstalledNames = (repo) => {
         const remote = remoteSkillsCache.get(repo.source)?.value;
         if (remote) {
@@ -725,12 +611,6 @@ app.get('/api/extensions/skills/catalog', async (c) => {
             .map(s => s.name);
     };
     const perRepo = filtered.map(repo => ({ repo, installedNames: computeInstalledNames(repo) }));
-    // Update detection — only for installed collections (it's the only place the
-    // signal is meaningful, and it keeps API calls proportional to what's
-    // actually installed). Diff the live remote HEAD against the provenance
-    // ledger. For installs predating the ledger (e.g. via skills.sh) we baseline
-    // the current HEAD so future commits surface as updates, rather than
-    // fabricating one we can't prove.
     const ledgerScope = scope === 'workspace' ? { workdir } : { global: true };
     const updateBySource = new Map();
     await Promise.all(perRepo.map(async ({ repo, installedNames }) => {
@@ -782,8 +662,6 @@ app.get('/api/extensions/skills/catalog', async (c) => {
             latestSha: upd?.latestSha,
         };
     });
-    // Pinned first-party packs lead; then community popularity (stars desc, with
-    // no-data entries sinking to the bottom so the most-loved repos surface first).
     items.sort((a, b) => {
         if (!!a.pinned !== !!b.pinned)
             return a.pinned ? -1 : 1;
@@ -791,7 +669,6 @@ app.get('/api/extensions/skills/catalog', async (c) => {
     });
     return c.json({ ok: true, items, installed });
 });
-/** POST /api/extensions/skills/install — install a skill via npx skills add. */
 app.post('/api/extensions/skills/install', async (c) => {
     try {
         const body = await c.req.json();
@@ -802,8 +679,6 @@ app.post('/api/extensions/skills/install', async (c) => {
         if (!isGlobal && !isValidWorkdir(workdir)) {
             return c.json({ ok: false, error: 'valid workdir is required for project-scoped install' }, 400);
         }
-        // Resolve the remote HEAD so installSkill can record provenance for update
-        // detection. Best-effort — a failed lookup just installs without a baseline.
         const sourceSha = await fetchRepoHeadSha(source.trim()).catch(() => null);
         const result = await installSkill(source.trim(), { global: isGlobal, skill, workdir, sourceSha });
         return c.json(result);
@@ -812,11 +687,6 @@ app.post('/api/extensions/skills/install', async (c) => {
         return c.json({ ok: false, error: e?.message || 'installation failed' }, 500);
     }
 });
-/**
- * POST /api/extensions/skills/update — pull the latest version of an installed
- * collection. Re-runs `skills add <source>` (no `-s`, so every skill from the
- * source is refreshed) and advances the provenance ledger to the new HEAD.
- */
 app.post('/api/extensions/skills/update', async (c) => {
     try {
         const body = await c.req.json();
@@ -835,7 +705,6 @@ app.post('/api/extensions/skills/update', async (c) => {
         return c.json({ ok: false, error: e?.message || 'update failed' }, 500);
     }
 });
-/** POST /api/extensions/skills/remove — remove an installed skill. */
 app.post('/api/extensions/skills/remove', async (c) => {
     try {
         const body = await c.req.json();
@@ -850,7 +719,6 @@ app.post('/api/extensions/skills/remove', async (c) => {
         return c.json({ ok: false, error: e?.message || 'removal failed' }, 500);
     }
 });
-/** GET /api/extensions/skills/search — search community skills. */
 app.get('/api/extensions/skills/search', async (c) => {
     const query = c.req.query('q') || '';
     try {

package/dist/dashboard/routes/local-models.js

@@ -1,29 +1,3 @@
-/**
- * Dashboard API: Local Model backends (Ollama / mlx-lm).
- *
- * Surfaces a probe endpoint plus a connect action that links a detected
- * backend into the Provider/Profile model layer so the agent cards above
- * pick it up without any further configuration.
- *
- *   GET  /api/local-models/probe    → which backends are running, what models
- *                                     they expose, install/run hints, and
- *                                     whether a Provider already points at each.
- *   POST /api/local-models/connect  → idempotently create the Provider for the
- *                                     named backend.
- *
- * Endpoints we expect:
- *   - Ollama  baseURL → http://127.0.0.1:11434
- *             version  → GET /api/version
- *             models   → GET /api/tags
- *             OpenAI   → /v1/chat/completions, /v1/models
- *
- *   - mlx-lm  baseURL → http://127.0.0.1:8080   (mlx_lm.server default)
- *             probe   → GET /v1/models   (200 OK iff server up; no version)
- *
- * Model downloads stay manual (user runs `ollama pull <tag>` or restarts
- * `mlx_lm.server --model <repo>` in their own terminal). The install spec
- * is shipped alongside detection so the UI can mirror the CLI tools page.
- */
 import { Hono } from 'hono';
 import { LOCAL_MODELS } from '../../catalog/local-models.js';
 import { listProviders, addProvider, listProfiles, addProfile, } from '../../model/index.js';
@@ -59,7 +33,6 @@ const BACKENDS = [
         label: 'mlx-lm',
         baseURL: 'http://127.0.0.1:8080',
         openAIBaseURL: 'http://127.0.0.1:8080/v1',
-        // mlx_lm.server has no /api/version; /v1/models doubles as liveness probe.
         probePath: '/v1/models',
         homepage: 'https://github.com/ml-explore/mlx-lm',
         install: {
@@ -73,17 +46,12 @@ const BACKENDS = [
             label: 'Start the server (replace model)',
             cmd: 'mlx_lm.server --model mlx-community/Qwen2.5-Coder-7B-Instruct-4bit --port 8080',
         },
-        // mlx-lm loads a single model per server instance — "pull" here means
-        // re-launching the server with that model id.
         pullCommandTemplate: 'mlx_lm.server --model ${model} --port 8080',
         modelField: 'mlxModel',
         platforms: ['darwin'],
     },
 ];
 const PROBE_TIMEOUT_MS = 1500;
-// ---------------------------------------------------------------------------
-// HTTP helpers
-// ---------------------------------------------------------------------------
 async function fetchJson(url, timeoutMs = PROBE_TIMEOUT_MS) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -127,10 +95,6 @@ async function probeMlx(spec) {
         models: (res.data || []).map(m => ({ id: m.id })),
     };
 }
-/**
- * Normalize a provider baseURL for comparison: drop trailing slashes and
- * collapse the localhost ↔ 127.0.0.1 distinction.
- */
 function normalizeBaseURL(raw) {
     return raw
         .replace(/\/+$/, '')
@@ -164,9 +128,6 @@ async function probeBackend(spec, providers) {
         supportedOnThisOs: supported,
     };
 }
-// ---------------------------------------------------------------------------
-// Catalog join — recommended models × backend availability
-// ---------------------------------------------------------------------------
 function isEntryInstalled(entry, spec, installed) {
     const target = entry[spec.modelField];
     if (!target)
@@ -193,12 +154,6 @@ function joinCatalog(backends) {
         return { ...entry, installed: null };
     });
 }
-/**
- * For a connected local backend, mirror every detected model as a Profile under
- * its Provider so the unified picker shows them without an extra user gesture.
- * Idempotent. Never deletes Profiles — a model that disappears from probe
- * output might be a transient blip.
- */
 function syncLocalProfilesForBackend(providerId, detected) {
     if (!providerId || !detected.length)
         return { added: 0 };
@@ -213,17 +168,10 @@ function syncLocalProfilesForBackend(providerId, detected) {
             existing.add(m.id);
         }
         catch {
-            // Provider may have been removed between calls — skip; next probe retries.
         }
     }
     return { added };
 }
-/**
- * Idempotently create a Provider pointing at this backend. Returns the
- * provider id. The placeholder API key is a sentinel ("local-no-auth") rather
- * than something that looks like a real key, so future code can recognize and
- * special-case local providers.
- */
 async function ensureProviderForBackend(spec) {
     const providers = listProviders();
     const existing = findProviderForBackend(providers, spec);
@@ -242,22 +190,6 @@ async function ensureProviderForBackend(spec) {
         return null;
     }
 }
-// ---------------------------------------------------------------------------
-// Routes
-// ---------------------------------------------------------------------------
-/**
- * Single probe-and-attach endpoint. The Local Models page no longer asks the
- * user to "connect" — every detected backend becomes a Provider automatically
- * so its models show up in the unified picker without an extra click.
- *
- *   - Backend detected, no existing Provider → create one, then sync Profiles.
- *   - Backend detected, Provider already exists → just sync Profiles.
- *   - Backend not detected → leave existing Provider in place (a transient
- *     blip during a restart shouldn't tear down config).
- *
- * Response includes `addedProviderIds` so the dashboard can refetch the upper
- * Model Providers / agent layer exactly when something new appears.
- */
 router.get('/api/local-models/probe', async (c) => {
     try {
         const initialProviders = listProviders();

package/dist/dashboard/routes/models.js

@@ -1,30 +1,8 @@
-/**
- * Dashboard API: Model layer (Providers, Profiles, BYOK bindings).
- *
- * Endpoints:
- *   GET    /api/models/catalog                          → models.dev metadata
- *   GET    /api/models/providers                        → list configured providers
- *   POST   /api/models/providers                        → add new provider (paste key / use env)
- *   PATCH  /api/models/providers/:id                    → update provider
- *   DELETE /api/models/providers/:id                    → remove provider + bound profiles
- *   POST   /api/models/providers/:id/validate           → Feishu-style validation
- *
- *   GET    /api/models/profiles                         → list profiles
- *   POST   /api/models/profiles                         → add profile
- *   PATCH  /api/models/profiles/:id                     → update profile
- *   DELETE /api/models/profiles/:id                     → remove profile
- *
- *   GET    /api/models/agents                           → list active bindings
- *   POST   /api/models/agents/:agent/active             → bind/unbind a Profile
- */
 import { Hono } from 'hono';
 import { getModelsDevCatalog, searchCatalogProviders, listProviders, getProvider, addProvider, updateProvider, removeProvider, setProviderValidation, listProfiles, getProfile, addProfile, updateProfile, removeProfile, getActiveProfileId, setActiveProfile, prewarmLocalModel, validateProvider, getProviderModelList, invalidateProviderModels, } from '../../model/index.js';
 import { isCredentialRef, describeCredentialRef } from '../../core/secrets/index.js';
 import { allDriverIds } from '../../agent/index.js';
 const router = new Hono();
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
 function publicProvider(p) {
     return {
         id: p.id,
@@ -39,9 +17,6 @@ function publicProvider(p) {
     };
 }
 const VALID_KINDS = ['anthropic', 'openai', 'openai-compatible', 'google'];
-// ---------------------------------------------------------------------------
-// Catalog (read-only models.dev mirror)
-// ---------------------------------------------------------------------------
 router.get('/api/models/catalog', async (c) => {
     const q = c.req.query('q') || '';
     const refresh = c.req.query('refresh') === '1';
@@ -98,9 +73,6 @@ router.get('/api/models/catalog/:providerId', async (c) => {
         return c.json({ ok: false, error: e?.message || String(e) }, 500);
     }
 });
-// ---------------------------------------------------------------------------
-// Providers
-// ---------------------------------------------------------------------------
 router.get('/api/models/providers', c => {
     return c.json({ ok: true, providers: listProviders().map(publicProvider) });
 });
@@ -168,16 +140,6 @@ router.delete('/api/models/providers/:id', async (c) => {
     invalidateProviderModels(id);
     return c.json({ ok: true });
 });
-/**
- * GET /api/models/providers/:id/models — model id list for the configured
- * provider, served from a 30-minute in-memory TTL cache. The first hit (or any
- * hit after a config edit) re-fetches from the provider's /models endpoint.
- *
- * Used by:
- *   - Dashboard: per-agent unified config modal model picker
- *   - IM /models command: when an agent is bound to this provider
- *   - Agent status response: when an agent is bound to this provider
- */
 router.get('/api/models/providers/:id/models', async (c) => {
     const id = c.req.param('id');
     const refresh = c.req.query('refresh') === '1';
@@ -217,9 +179,6 @@ router.post('/api/models/providers/:id/validate', async (c) => {
         return c.json({ ok: true, validation: status, models: [] });
     }
 });
-// ---------------------------------------------------------------------------
-// Profiles
-// ---------------------------------------------------------------------------
 router.get('/api/models/profiles', c => {
     return c.json({ ok: true, profiles: listProfiles() });
 });
@@ -286,9 +245,6 @@ router.delete('/api/models/profiles/:id', c => {
         return c.json({ ok: false, error: 'Profile not found' }, 404);
     return c.json({ ok: true });
 });
-// ---------------------------------------------------------------------------
-// Agent bindings
-// ---------------------------------------------------------------------------
 router.get('/api/models/agents', c => {
     const agents = allDriverIds();
     return c.json({
@@ -315,8 +271,6 @@ router.post('/api/models/agents/:agent/active', async (c) => {
         return c.json({ ok: false, error: 'profileId (string|null) is required' }, 400);
     try {
         setActiveProfile(agent, profileId);
-        // Warm a local backend the instant it's selected, so the user's first turn
-        // skips the model cold-load. Fire-and-forget; never blocks the bind.
         if (profileId) {
             const profile = getProfile(profileId);
             const provider = profile ? getProvider(profile.providerId) : null;