pikiloom 0.4.26 → 0.4.28

package/dist/dashboard/session-control.js

@@ -1,23 +1,9 @@
-/**
- * Public session task control surface for dashboard and API routes.
- */
 import path from 'node:path';
 import { getProjectSkillPaths, listSkills, stageSessionFiles, ensureManagedSession, findPikiloomSession, getDriverCapabilities, isPendingSessionId } from '../agent/index.js';
 import { loadUserConfig } from '../core/config/user-config.js';
 import { decomposeEffortSelection } from '../core/config/runtime-config.js';
 import { runtime } from './runtime.js';
 const KNOWN_AGENTS = new Set(['claude', 'codex', 'gemini', 'hermes']);
-/**
- * Parse a `/goal[ args]` prompt typed in the dashboard chat box. Returns null
- * when the prompt is not a goal slash command. Sub-commands mirror the IM
- * `handleGoalCommand` semantics (set / clear / pause / resume / status).
- *
- * Routing /goal through the native bridge is the dashboard's analog of what
- * channels/{telegram,feishu,weixin}/bot.ts do via `handleGoalCommand` — before
- * this hook, dashboard /goal was matched by the legacy `goal` skill resolver
- * and silently rewritten to "Read SKILL.md and execute", which bypassed both
- * the claude native /goal slash command and codex's thread/goal RPC.
- */
 function parseGoalSlash(prompt) {
     const trimmed = prompt.trim();
     const m = trimmed.match(/^\/goal(?:\s+([\s\S]*))?$/);
@@ -35,22 +21,16 @@ function parseGoalSlash(prompt) {
         return { action: 'resume', objective: '' };
     return { action: 'set', objective: args };
 }
-/**
- * Resolve a `/skill-name [args]` prompt into the full skill execution prompt.
- * Returns null if the prompt is not a skill invocation or the skill is not found.
- */
 function resolveSkillFromPrompt(workdir, prompt) {
     const trimmed = prompt.trim();
     if (!trimmed.startsWith('/'))
         return null;
-    // Extract command name and args: "/skill-name some args" → name="skill-name", args="some args"
     const match = trimmed.match(/^\/([^\s]+)(?:\s+(.*))?$/s);
     if (!match)
         return null;
     const name = match[1];
     const args = (match[2] || '').trim();
     const { skills } = listSkills(workdir);
-    // Match by exact skill name (case-insensitive)
     const skill = skills.find(s => s.name.toLowerCase() === name.toLowerCase());
     if (!skill)
         return null;
@@ -62,12 +42,6 @@ function resolveSkillFromPrompt(workdir, prompt) {
     const resolvedPrompt = `${workdirHint}Read the skill definition at \`${targetPath}\` and execute the instructions defined there.${extra}`;
     return { resolvedPrompt, skillName: skill.name };
 }
-/**
- * Resolve a `handoverFrom` ref from the request's `previousAgent` /
- * `previousSessionId` fields, validating that it points to a real, non-self,
- * different-agent session managed by pikiloom. Returns null when the inputs
- * are absent or invalid — handover is best-effort and silent-skip on bad data.
- */
 function resolveHandoverFrom(request, targetAgent) {
     const prevAgent = typeof request.previousAgent === 'string' ? request.previousAgent.trim() : '';
     const prevSessionId = typeof request.previousSessionId === 'string' ? request.previousSessionId.trim() : '';
@@ -76,9 +50,9 @@ function resolveHandoverFrom(request, targetAgent) {
     if (!KNOWN_AGENTS.has(prevAgent))
         return null;
     if (prevAgent === targetAgent)
-        return null; // same-agent continuation goes via --resume, not handover
+        return null;
     if (isPendingSessionId(prevSessionId))
-        return null; // no native history yet → nothing to compact
+        return null;
     const record = findPikiloomSession(request.workdir, prevAgent, prevSessionId);
     if (!record)
         return null;
@@ -96,21 +70,13 @@ export async function queueDashboardSessionTask(request) {
         ? request.agent
         : runtime.getRuntimeDefaultAgent(config);
     const modelId = typeof request.model === 'string' ? request.model.trim() : '';
-    // "ultra" is a synthetic effort rung = max depth + Workflow orchestration;
-    // decompose it so the spawn carries a real --effort value plus the workflow
-    // flag (the per-send pick is the single knob — no separate workflow control).
     const { effort: splitEffort, workflow: ultraWorkflow } = decomposeEffortSelection(typeof request.effort === 'string' ? request.effort : '');
     const thinkingEffort = resolvedAgent === 'gemini' ? '' : splitEffort;
     const workflowEnabled = ultraWorkflow || request.workflow === true;
-    // /goal — route directly to the goal bridge (claude native slash, codex RPC,
-    // or portable goal.json for gemini/hermes). Must run BEFORE skill resolution
-    // so the legacy `goal` skill doesn't grab the prompt and rewrite it into a
-    // "Read SKILL.md" instruction.
     const goalCmd = parseGoalSlash(request.prompt || '');
     if (goalCmd && request.sessionId && !isPendingSessionId(request.sessionId)) {
         return runDashboardGoalSlash(bot, resolvedAgent, request, goalCmd, modelId, thinkingEffort);
     }
-    // Resolve /skill-name prompts into full skill execution prompts
     let prompt = request.prompt;
     const skillResult = prompt ? resolveSkillFromPrompt(request.workdir, prompt) : null;
     if (skillResult) {
@@ -119,13 +85,8 @@ export async function queueDashboardSessionTask(request) {
     }
     let sessionId = request.sessionId;
     let attachments = request.attachments || [];
-    // Resolve handover source. Only meaningful when we're about to stage a fresh
-    // session (sessionId blank or pending). For an existing session we never
-    // replay handover — that session's own --resume history is canonical.
     const isFreshSession = !sessionId || isPendingSessionId(sessionId);
     const handoverFrom = isFreshSession ? resolveHandoverFrom(request, resolvedAgent) : null;
-    // Stage files into the session workspace so temp uploads survive cleanup.
-    // Also creates a new pending session when no sessionId is provided.
     if (!sessionId || attachments.length) {
         const staged = stageSessionFiles({
             agent: resolvedAgent,
@@ -150,9 +111,6 @@ export async function queueDashboardSessionTask(request) {
         attachments,
         ...(modelId ? { modelId } : {}),
         ...(thinkingEffort ? { thinkingEffort } : {}),
-        // Always thread the per-send workflow choice (even when false) so the run
-        // explicitly reflects the picked rung (Ultra ⇒ on) rather than any ambient
-        // default.
         workflowEnabled,
         ...(handoverFrom ? { handoverFrom } : {}),
     });
@@ -160,11 +118,6 @@ export async function queueDashboardSessionTask(request) {
 async function runDashboardGoalSlash(bot, agent, request, cmd, modelId, thinkingEffort) {
     const opts = { chatId: 'dashboard', modelId: modelId || undefined, thinkingEffort: thinkingEffort || undefined };
     const sessionKey = `${agent}:${request.sessionId}`;
-    // Synthetic task id — for set / clear / resume on agents that internally
-    // submit a follow-up task (claude native slash, portable continuation),
-    // the real task id is owned by submitSessionTask. The dashboard's SSE
-    // stream listener picks that up via session events; this id is just to
-    // give the HTTP caller a non-empty taskId field.
     const taskId = `goal-${cmd.action}-${Date.now().toString(36)}`;
     try {
         if (cmd.action === 'status') {
@@ -183,7 +136,6 @@ async function runDashboardGoalSlash(bot, agent, request, cmd, modelId, thinking
             const goal = await bot.resumeSessionGoal(request.workdir, agent, request.sessionId, opts);
             return { ok: true, taskId, sessionKey, queued: false, goal };
         }
-        // set
         const goal = await bot.setSessionGoal(request.workdir, agent, request.sessionId, {
             objective: cmd.objective,
             ...opts,
@@ -209,26 +161,17 @@ export function forkDashboardSessionTask(request) {
         return { ok: false, error: `Agent ${agent} does not support fork` };
     }
     const modelId = typeof request.model === 'string' ? request.model.trim() : '';
-    // Same "ultra" decomposition as the send path — a forked turn launched at
-    // Ultra inherits max depth + Workflow orchestration.
     const { effort: splitEffort, workflow: ultraWorkflow } = decomposeEffortSelection(typeof request.effort === 'string' ? request.effort : '');
     const thinkingEffort = agent === 'gemini' ? '' : splitEffort;
-    // Resolve /skill-name shorthand the same way send/queue does, so a forked
-    // turn that starts with `/skill-name` runs the skill against the child.
     let prompt = request.prompt;
     const skillResult = prompt ? resolveSkillFromPrompt(request.workdir, prompt) : null;
     if (skillResult)
         prompt = skillResult.resolvedPrompt;
-    // Make sure the parent has a managed record so `recordFork` (called after the
-    // child stream completes) can write the lineage on both sides. Native-only
-    // sessions (started outside pikiloom) won't have a record yet.
     ensureManagedSession({
         agent,
         workdir: request.workdir,
         sessionId: request.parentSessionId,
     });
-    // Always create a fresh pending session for the child. stageSessionFiles
-    // also handles attachment imports into the new workspace.
     const staged = stageSessionFiles({
         agent,
         workdir: request.workdir,
@@ -265,13 +208,6 @@ export function cancelSessionTask(taskId) {
     const result = bot.cancelTask(taskId);
     return { ok: true, recalled: result.cancelled || result.interrupted };
 }
-/**
- * Stop only the currently running task for a session — queued follow-ups are
- * preserved and run normally once the chain advances. Works on (agent,
- * sessionId) rather than a single taskId so it still functions during the
- * brief window after send/before the queued WS snapshot reaches the client.
- * Per-row × buttons (→ cancelSessionTask) cancel one queued entry at a time.
- */
 export function stopSessionTasks(agent, sessionId) {
     const bot = runtime.getBotRef();
     if (!bot)
@@ -286,9 +222,6 @@ export async function steerSessionTask(taskId) {
     const result = await bot.steerTask(taskId);
     return { ok: true, steered: result.steered };
 }
-// ---------------------------------------------------------------------------
-// Interaction prompt control (human-in-the-loop)
-// ---------------------------------------------------------------------------
 export function interactionSelectOption(promptId, optionValue, opts) {
     const bot = runtime.getBotRef();
     if (!bot)

package/dist/model/catalog.js

@@ -1,9 +1,3 @@
-/**
- * models.dev catalog — read-only metadata about LLM providers and their
- * models (pricing, context window, capabilities). We hit the public JSON
- * endpoint and cache the result locally for 24h, with a fallback to the
- * cached copy when offline.
- */
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -45,10 +39,6 @@ async function fetchFromNetwork() {
     const text = await body.text();
     return JSON.parse(text);
 }
-/**
- * Get the catalog. Returns a cached copy if fresh; otherwise fetches in the
- * background and falls back to the stale cache on failure.
- */
 export async function getModelsDevCatalog(opts = {}) {
     const now = Date.now();
     if (!opts.forceRefresh && memCache && now - memCache.fetchedAt < CACHE_TTL_MS) {
@@ -70,7 +60,7 @@ export async function getModelsDevCatalog(opts = {}) {
             }
             catch (e) {
                 if (memCache)
-                    return memCache.data; // fall back to stale cache
+                    return memCache.data;
                 throw e;
             }
             finally {
@@ -80,20 +70,14 @@ export async function getModelsDevCatalog(opts = {}) {
     }
     return inflight;
 }
-/** Lookup a single provider by its models.dev id (e.g. "openrouter"). */
 export async function getCatalogProvider(providerId) {
     const cat = await getModelsDevCatalog().catch(() => null);
     return cat?.[providerId] || null;
 }
-/** Lookup a model entry within a provider. */
 export async function getCatalogModel(providerId, modelId) {
     const provider = await getCatalogProvider(providerId);
     return provider?.models?.[modelId] || null;
 }
-/**
- * Lightweight search: returns providers whose id/name match the query.
- * If query is empty, returns all providers sorted by id.
- */
 export async function searchCatalogProviders(query) {
     const cat = await getModelsDevCatalog().catch(() => ({}));
     const all = Object.values(cat);

package/dist/model/index.js

@@ -1,18 +1,3 @@
-/**
- * Pikiloom "Model" layer — barrel export.
- *
- * The Model layer is one of the four physical layers in pikiloom's
- * architecture (Terminal / Agent / **Model** / Tool). It centralises:
- *   - Provider/Profile data model (types.ts)
- *   - Read-only catalog of providers/models from models.dev (catalog.ts)
- *   - Persistence (store.ts) over ~/.pikiloom/setting.json
- *   - Feishu-style credential validation (validation.ts)
- *   - Per-agent credential injection at spawn time (injector.ts)
- *
- * Adding a new agent driver only needs to:
- *   1. Define a new AgentInjector entry in injector.ts
- *   2. Read `resolveAgentInjection(agentId)` before spawning
- */
 export { getModelsDevCatalog, getCatalogProvider, getCatalogModel, searchCatalogProviders, } from './catalog.js';
 export { listProviders, getProvider, addProvider, updateProvider, removeProvider, setProviderValidation, listProfiles, getProfile, addProfile, updateProfile, removeProfile, getActiveProfileId, getActiveProfile, setActiveProfile, } from './store.js';
 export { validateProvider } from './validation.js';

package/dist/model/injector.js

@@ -1,20 +1,9 @@
-/**
- * Credential injector — turn an active Profile into the env vars and
- * additional argv that should be applied when spawning a specific agent.
- *
- * This is the single point where pikiloom's Profile abstraction is
- * translated into per-agent quirks. Adding a new agent (e.g. OpenCode)
- * = adding one entry to AGENT_INJECT_TABLE.
- */
 import { resolveCredential } from '../core/secrets/index.js';
 import { writeScopedLog } from '../core/logging.js';
 import { getActiveProfile, getProvider } from './store.js';
 import { peekProviderModelInfo, prefetchProviderModels } from './provider-models.js';
 import { ensureResponsesBridge, upstreamToken } from './responses-bridge.js';
 const EMPTY = { env: {}, argvAppend: [], detail: '' };
-// ---------------------------------------------------------------------------
-// Shared host-based provider identification
-// ---------------------------------------------------------------------------
 function providerHost(provider) {
     try {
         return new URL(provider.baseURL).host.toLowerCase();
@@ -23,12 +12,6 @@ function providerHost(provider) {
         return '';
     }
 }
-/**
- * Stable slug used to identify the provider in TOML-style configs (Codex
- * `model_providers.<slug>`, Hermes ACP `<slug>:<model>`). Host-aware so a
- * "DeepSeek personal" provider always resolves to `deepseek`, regardless of
- * its display name.
- */
 function providerSlug(provider) {
     if (provider.kind === 'anthropic')
         return 'anthropic';
@@ -55,19 +38,9 @@ function providerSlug(provider) {
         return 'doubao';
     if (host.includes('openrouter'))
         return 'openrouter';
-    // Unknown host: derive a stable slug from the hostname's leading label. (The
-    // old `return 'openrouter'` fallback mis-slugged every unrecognised provider —
-    // including localhost Ollama — as openrouter.) This never collides with
-    // codex's reserved built-in `openai`/`oss`/`ollama` ids, which are routed
-    // before we ever reach providerSlug.
     const label = host.replace(/:\d+$/, '').replace(/^(www|api)\./, '').split('.')[0].replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
     return label || 'byok';
 }
-/**
- * Canonical env-var name(s) carrying the credential for a provider. Returned
- * as a map so e.g. Google fans out to both `GOOGLE_API_KEY` and
- * `GEMINI_API_KEY` for SDKs that expect either.
- */
 function providerCredentialEnv(provider, apiKey) {
     if (provider.kind === 'anthropic')
         return { ANTHROPIC_API_KEY: apiKey };
@@ -96,53 +69,18 @@ function providerCredentialEnv(provider, apiKey) {
         return { ARK_API_KEY: apiKey, DOUBAO_API_KEY: apiKey };
     return { OPENROUTER_API_KEY: apiKey };
 }
-/** Pick the single env var Codex's `model_providers.<slug>.env_key` should reference. */
 function codexEnvKey(provider) {
     const keys = Object.keys(providerCredentialEnv(provider, ''));
     return keys[0] || 'OPENROUTER_API_KEY';
 }
-/** Escape a string for embedding inside a TOML double-quoted string literal. */
 function tomlEscape(value) {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
-/**
- * OpenAI-compatible providers that expose their Anthropic-protocol API under a
- * dedicated namespace on the SAME origin (not the OpenAI base we store). Keyed
- * by `providerSlug`; the value maps the origin → the Anthropic base URL.
- *
- *   slug       stored OpenAI baseURL                    Anthropic base
- *   ─────────  ───────────────────────────────────      ───────────────────────────────
- *   deepseek   https://api.deepseek.com                 https://api.deepseek.com/anthropic
- *   kimi       https://api.moonshot.cn/v1               https://api.moonshot.cn/anthropic
- *   zai        https://open.bigmodel.cn/api/paas/v4     https://open.bigmodel.cn/api/anthropic
- *
- * The SDK appends `/v1/messages`, so e.g. DeepSeek lands on
- * `…/anthropic/v1/messages` — the endpoint DeepSeek actually serves the
- * Anthropic protocol on (cf. src/agent/drivers/claude.ts).
- */
 const ANTHROPIC_ENDPOINT_BY_SLUG = {
     deepseek: origin => `${origin}/anthropic`,
     kimi: origin => `${origin}/anthropic`,
     zai: origin => `${origin}/api/anthropic`,
 };
-/**
- * Anthropic-protocol baseURL for Claude BYOK. Claude Code speaks the Anthropic
- * Messages API and appends `/v1/messages` to `ANTHROPIC_BASE_URL` itself, so
- * the base must point at the provider's *Anthropic-compatible* root.
- *
- * The base must NOT carry a trailing `/v1` (otherwise requests land on
- * `/v1/v1/messages` and 404). The canonical stored form is the OpenAI base
- * (so `validateProvider`'s GET /models and the Codex/Hermes injectors keep
- * working); we translate it here:
- *   - Anthropic-native (and Anthropic-shaped third parties): strip a trailing
- *     `/v1` and pass through verbatim.
- *   - Known OpenAI-compatible providers whose Anthropic API lives under a
- *     separate path (DeepSeek `/anthropic`, Kimi `/anthropic`, Zhipu
- *     `/api/anthropic`): rebuild from the origin via `ANTHROPIC_ENDPOINT_BY_SLUG`.
- *     Rebuilding from the origin (not the stored path) is idempotent — a user
- *     who already pasted the `/anthropic` URL doesn't get `/anthropic/anthropic`.
- *   - Anything else: best-effort, strip a trailing `/v1` (historical default).
- */
 function claudeAnthropicBaseURL(provider) {
     const raw = provider.baseURL.replace(/\/+$/, '');
     if (provider.kind === 'anthropic')
@@ -160,14 +98,6 @@ function claudeAnthropicBaseURL(provider) {
     }
     return raw.replace(/\/v1$/, '');
 }
-/**
- * First-party Anthropic = the official API host (`api.anthropic.com` / any
- * `*.anthropic.com`). A Claude route counts as "direct" when it lands here —
- * both the subscription path and an own-key BYOK profile pointed at
- * api.anthropic.com. Everything else (OpenRouter, DeepSeek, domestic series, a
- * self-hosted relay, localhost) is a third-party proxy. Unparseable → treat as
- * proxy (safe default: suppressing attribution is harmless, churning isn't).
- */
 function isFirstPartyAnthropic(baseURL) {
     let host;
     try {
@@ -178,17 +108,6 @@ function isFirstPartyAnthropic(baseURL) {
     }
     return host === 'anthropic.com' || host.endsWith('.anthropic.com');
 }
-/**
- * Claude Code respects `ANTHROPIC_BASE_URL` + `ANTHROPIC_API_KEY` (or
- * `ANTHROPIC_AUTH_TOKEN`) as a BYOK route. The CLI itself is unchanged.
- * The model is overridden via opts.claudeModel (handled in stream.ts).
- *
- * For OpenAI-compatible providers (OpenRouter, DeepSeek native, …), the
- * baseURL must point to an Anthropic-protocol-compatible endpoint
- * (`/v1/messages`-shaped). `claudeAnthropicBaseURL` translates the stored
- * OpenAI base into the right Anthropic root per provider (e.g. DeepSeek's
- * `https://api.deepseek.com` → `https://api.deepseek.com/anthropic`).
- */
 const claudeInjector = (provider, profile, apiKey) => {
     if (provider.kind !== 'anthropic' && provider.kind !== 'openai-compatible') {
         return {
@@ -202,16 +121,6 @@ const claudeInjector = (provider, profile, apiKey) => {
         ANTHROPIC_API_KEY: apiKey,
         ANTHROPIC_AUTH_TOKEN: apiKey,
     };
-    // Claude Code >= 2.1.36 stamps a per-request `x-anthropic-billing-header`
-    // (cc_version / cc_entrypoint / cch=… — the cch token churns every turn).
-    // Third-party proxies (OpenRouter, DeepSeek /anthropic, domestic series, any
-    // OpenAI-compat or self-hosted Anthropic-shaped front) often key their
-    // prefix/KV cache on request headers, so the churn forces a full prompt
-    // reprocess every turn — slow and expensive. `0` makes claude omit the header
-    // (env-bool: 0/false/no/off). Only on proxy routes: first-party Anthropic
-    // (api.anthropic.com — subscription OR own-key direct) is left exactly as
-    // shipped; its cache is content/breakpoint based, so attribution is irrelevant
-    // there and we don't touch it.
     if (!isFirstPartyAnthropic(baseURL)) {
         env.CLAUDE_CODE_ATTRIBUTION_HEADER = '0';
     }
@@ -230,43 +139,24 @@ function providerHostname(provider) {
         return '';
     }
 }
-/** True for localhost endpoints (Ollama / LM Studio / llama.cpp). */
 function isLocalProvider(provider) {
     const h = providerHostname(provider);
     return h === 'localhost' || h === '127.0.0.1' || h === '0.0.0.0' || h === '::1';
 }
-/** Providers that natively implement the OpenAI Responses API (codex talks to them directly). */
 function isResponsesNativeProvider(provider) {
     return providerHost(provider).includes('openrouter');
 }
-/** codex's built-in local provider id for a localhost endpoint. */
 function codexLocalProvider(provider) {
     let port = '';
     try {
         port = new URL(provider.baseURL).port;
     }
-    catch { /* ignore */ }
+    catch { }
     if (port === '1234' || /lm\s*studio/i.test(provider.name))
         return 'lmstudio';
     return 'ollama';
 }
-/** Ollama keeps a prewarmed model resident for this long (its `keep_alive`). */
 const PREWARM_KEEP_ALIVE = '30m';
-/**
- * Warm a localhost model backend so the user's first real turn doesn't pay the
- * model cold-load (weights → memory). Fire-and-forget: never blocks the caller,
- * never throws.
- *
- *  - Ollama has a native load endpoint — `POST /api/generate {model, keep_alive}`
- *    with no prompt loads the weights and returns immediately; `keep_alive`
- *    keeps them resident across the seed + real turns of a session.
- *  - LM Studio JIT-loads on first request, so we nudge it with a 1-token
- *    completion against its OpenAI-compatible endpoint.
- *
- * Called when a local Profile is bound (warm while the user reads / types) and
- * again at spawn (re-assert keep_alive). Measured: a cold gemma3:4b spent ~12s
- * before its first token; prewarmed, generation starts in ~2s.
- */
 export function prewarmLocalModel(provider, modelId) {
     if (!modelId || !isLocalProvider(provider))
         return;
@@ -290,15 +180,6 @@ export function prewarmLocalModel(provider, modelId) {
         body: JSON.stringify({ model: modelId, keep_alive: PREWARM_KEEP_ALIVE }),
     }).then(r => { writeScopedLog('model-prewarm', `ollama load ${modelId} → ${r.status}`); }, e => { writeScopedLog('model-prewarm', `ollama load ${modelId} failed: ${e?.message || e}`, { level: 'warn', stream: 'stderr' }); });
 }
-/**
- * Decide how codex should reach a provider. Codex 0.140+ speaks ONLY the
- * Responses API, so the route depends on what the provider implements:
- *   openai-native   genuine OpenAI            → built-in `openai` provider
- *   local-oss       localhost Ollama/LMStudio → built-in `ollama`/`lmstudio` (responses)
- *   responses-native OpenRouter, …            → custom provider, responses direct
- *   bridge          chat-only (DeepSeek, Kimi, MiniMax, 豆包, Qwen, Zhipu, …)
- *                                             → local Responses↔Chat bridge
- */
 function codexRoute(provider) {
     if (provider.kind === 'openai')
         return 'openai-native';
@@ -308,19 +189,6 @@ function codexRoute(provider) {
         return 'responses-native';
     return 'bridge';
 }
-/**
- * Codex CLI honours `model_providers.<slug>` definitions in `config.toml` and
- * binds the active one via `model_provider="<slug>"`. The credential lives in
- * the env var named by `env_key`, picked host-aware (e.g. `DEEPSEEK_API_KEY`).
- *
- * Codex 0.140+ dropped Chat Completions (`wire_api = "chat"` is rejected at
- * config load) — it speaks ONLY the Responses API. So this injector routes per
- * `codexRoute()`: responses-capable providers (OpenAI, OpenRouter, local
- * Ollama/LM Studio) are reached directly with the default `responses` wire;
- * chat-only providers (DeepSeek and the domestic series) are routed through the
- * in-process Responses↔Chat bridge, which codex sees as just another
- * responses-speaking provider on localhost.
- */
 const codexInjector = async (provider, profile, apiKey) => {
     if (provider.kind !== 'openai' && provider.kind !== 'openai-compatible') {
         return {
@@ -330,10 +198,6 @@ const codexInjector = async (provider, profile, apiKey) => {
     }
     const model = profile.modelId;
     const route = codexRoute(provider);
-    // Local Ollama / LM Studio: codex's built-in provider already speaks the
-    // Responses API to the local server. Just select it — no custom provider, no
-    // API key. (Defining `model_providers.<built-in>` is rejected: "Built-in
-    // providers cannot be overridden.")
     if (route === 'local-oss') {
         const local = codexLocalProvider(provider);
         prewarmLocalModel(provider, model);
@@ -344,7 +208,6 @@ const codexInjector = async (provider, profile, apiKey) => {
             detail: `Codex local → ${provider.name} / ${model} (built-in ${local}, responses)`,
         };
     }
-    // Genuine OpenAI: use the built-in `openai` provider; inject the key (+ base).
     if (route === 'openai-native') {
         const env = { OPENAI_API_KEY: apiKey };
         if (provider.baseURL)
@@ -358,9 +221,6 @@ const codexInjector = async (provider, profile, apiKey) => {
     }
     const slug = providerSlug(provider);
     const envKey = codexEnvKey(provider);
-    // Chat-only providers: route through the local Responses↔Chat bridge. Codex
-    // forwards `Authorization: Bearer <key>` (from env_key) to the bridge, which
-    // relays it to the upstream chat endpoint — the bridge never stores secrets.
     if (route === 'bridge') {
         const port = await ensureResponsesBridge();
         const base = `http://127.0.0.1:${port}/u/${upstreamToken(provider.baseURL)}`;
@@ -377,8 +237,6 @@ const codexInjector = async (provider, profile, apiKey) => {
             detail: `Codex BYOK → ${provider.name} / ${model} via Responses↔Chat bridge (provider=${slug})`,
         };
     }
-    // responses-native (OpenRouter, …): point codex straight at the provider's
-    // Responses endpoint (wire_api omitted ⇒ codex default `responses`).
     return {
         env: { [envKey]: apiKey },
         argvAppend: [],
@@ -392,7 +250,6 @@ const codexInjector = async (provider, profile, apiKey) => {
         detail: `Codex BYOK → ${provider.name} / ${model} (provider=${slug}, native responses)`,
     };
 };
-/** Gemini CLI accepts `GEMINI_API_KEY` but does not allow custom baseURL. */
 const geminiInjector = (provider, profile, apiKey) => {
     if (provider.kind !== 'google') {
         return {
@@ -407,29 +264,9 @@ const geminiInjector = (provider, profile, apiKey) => {
         detail: `Gemini BYOK → ${provider.name} / ${profile.modelId}`,
     };
 };
-/**
- * Hermes injector. Two channels:
- *   1. Env vars carry the credential — `hermes acp` honours `OPENROUTER_API_KEY`,
- *      `ANTHROPIC_API_KEY`, etc. just like the top-level `hermes` CLI.
- *   2. The model is bound *per-session* by the driver via the ACP
- *      `session/set_model` request — `hermes acp` does NOT accept `-m` /
- *      `--provider` (only `--accept-hooks`); appending `-m` here used to make
- *      every BYOK-bound spawn die with `unrecognized arguments`.
- *
- * The model is handed to the driver via `modelOverride` (an ACP-style
- * `<provider>:<model>` string). The driver passes it to `session/set_model`
- * after `session/new` returns; if the user has no Profile bound, no
- * `set_model` call is made and Hermes uses its `~/.hermes/config.yaml`
- * default.
- */
 const hermesInjector = (provider, profile, apiKey) => {
     const env = providerCredentialEnv(provider, apiKey);
     const slug = providerSlug(provider);
-    // Only strip a leading `<slug>/` or `<slug>:` if the user accidentally
-    // stored a redundant provider prefix. Do NOT strip the *first segment* of
-    // a slash-separated model id wholesale — for OpenRouter the canonical
-    // model id is `vendor/model` (e.g. `deepseek/deepseek-v4-flash`), and
-    // dropping the `vendor/` part yields a non-existent model.
     let bareModel = profile.modelId;
     if (bareModel.startsWith(`${slug}/`) || bareModel.startsWith(`${slug}:`)) {
         bareModel = bareModel.slice(slug.length + 1);
@@ -447,14 +284,6 @@ const AGENT_INJECT_TABLE = {
     gemini: geminiInjector,
     hermes: hermesInjector,
 };
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-/**
- * Resolve the active Profile for an agent and return the spawn config to
- * inject. Returns `null` when no Profile is bound (caller should fall back
- * to the agent's native auth / default model).
- */
 export async function resolveAgentInjection(agentId) {
     const profile = getActiveProfile(agentId);
     if (!profile)
@@ -465,9 +294,6 @@ export async function resolveAgentInjection(agentId) {
     const injector = AGENT_INJECT_TABLE[agentId];
     if (!injector)
         return null;
-    // Local providers (Ollama / LM Studio / llama.cpp) need no credential — codex
-    // reaches them via its built-in localhost provider with no auth. Don't let a
-    // missing/placeholder key block an otherwise-valid local binding.
     let apiKey = '';
     try {
         apiKey = await resolveCredential(provider.credential);
@@ -478,12 +304,7 @@ export async function resolveAgentInjection(agentId) {
         }
     }
     const result = await injector(provider, profile, apiKey);
-    // Attach the provider display name so renders can surface "via <provider>"
-    // — this is what tells the user the turn is going through a BYOK route.
     result.providerName = provider.name;
-    // Attach the real context window from the provider's cached /models listing.
-    // Sync peek — no network blocking; on miss we kick off a fetch so the *next*
-    // session has it, and this turn falls back to the CLI's advertised value.
     const cached = peekProviderModelInfo(provider.id, profile.modelId);
     if (cached?.contextLength && cached.contextLength > 0) {
         result.contextWindow = cached.contextLength;
@@ -493,7 +314,6 @@ export async function resolveAgentInjection(agentId) {
     }
     return result;
 }
-/** Returns `true` if the given agent is bound to a Profile. */
 export function isAgentBoundToProfile(agentId) {
     return getActiveProfile(agentId) !== null;
 }