teapot-coding-agent 0.37.59 → 0.37.61

package/dist/agent/mcp-registry.js

@@ -1,40 +1,10 @@
-/**
- * The MCP server registry: connections, tool discovery, dispatch, and the OAuth
- * flow's plumbing.
- *
- * Why a registry instead of connecting per agent: several agents usually want the same
- * server, and a stdio server is a PROCESS. The pool keys by server name, so N agents share
- * one connection — and a `tools/call` is still per-agent, because the arguments are.
- *
- * Naming. Two servers may both expose `search`, and a server may expose a name that
- * collides with a built-in tool (`bash`, `read_file`). Every MCP tool is therefore exposed
- * as `mcp__<server>__<tool>`, which cannot collide with a built-in (those have no `__`)
- * and tells the model where a result came from.
- *
- * OAuth lives here because it is per SERVER (one grant, shared by every agent) while the
- * protocol itself belongs to the SDK — see `mcp-oauth-manager.ts` for the provider.
- */
-/**
- * `connectMcp` is imported LAZILY, and only as a value.
- *
- * A static import here pulls `mcp.ts`, which lazily loads `@modelcontextprotocol/client` — but a
- * static EDGE from this module means the bundler/runtime must resolve the whole file graph at load.
- * MEASURED: this module alone cost +48.7MB RSS. The registry is constructed at boot on every
- * machine, while a connection is only attempted when a server is actually configured.
- */
 const connectMcp = async (...args) => (await import("./mcp.js")).connectMcp(...args);
 import { FLOW_TIMEOUT_MS, McpAuthStore, ServerAuth, listenForCallback, } from "./mcp-oauth-manager.js";
-/** the prefix a model-visible MCP tool name carries */
 export const MCP_PREFIX = "mcp__";
-/** `mcp__server__tool` — the flat name handed to the LLM */
 export function flattenToolName(server, tool) {
-    // `__` is the separator, so a server or tool name containing it would be ambiguous.
-    // Collapse runs rather than rejecting: a server called "my__server" is unusual but not
-    // worth failing over, and the mapping stays stable.
     const s = server.replace(/__/g, "_");
     return `${MCP_PREFIX}${s}__${tool}`;
 }
-/** pull the parts back out of a flat name, or null when it is not an MCP tool */
 export function splitToolName(flat) {
     if (!flat.startsWith(MCP_PREFIX))
         return null;
@@ -49,14 +19,9 @@ export class McpRegistry {
     auths = new Map();
     store = null;
     flows = new Map();
-    /**
-     * Point the registry at its grant store. Called once at boot; until then OAuth is
-     * inert (no grant is read from an assumed location).
-     */
     init(dataDir) {
         this.store = new McpAuthStore(dataDir);
     }
-    /** replace the configured server list (on boot and after a settings save) */
     apply(configs) {
         const wanted = new Set(configs.map((c) => c.name));
         for (const [name, st] of this.servers) {
@@ -67,7 +32,6 @@ export class McpRegistry {
         }
         for (const cfg of configs) {
             const prev = this.servers.get(cfg.name);
-            // a config EDIT means the old connection is pointing at the wrong thing
             const changed = Boolean(prev) && JSON.stringify(prev.config) !== JSON.stringify(cfg);
             if (changed)
                 void prev.connection?.close();
@@ -91,45 +55,22 @@ export class McpRegistry {
     states() {
         return [...this.servers.values()];
     }
-    /** the state of ONE server, or undefined when it is not configured */
     state(name) {
         return this.servers.get(name);
     }
-    /**
-     * Record an out-of-band successful connection for a SAVED server.
-     *
-     * `/api/mcp/test` opens a throwaway connection (it must not disturb the live one) but the result is
-     * real evidence about the same config, so the row's badge has to reflect it. Without this a server
-     * that failed at boot stayed `● error` after a test successfully listed its tools.
-     */
     recordSuccess(name, tools) {
         const st = this.servers.get(name);
         if (!st)
-            return; // testing an unsaved edit must not invent an entry
+            return;
         st.status = "connected";
         st.tools = tools;
         st.lastError = undefined;
         st.lastChecked = Date.now();
         st.oauthRequired = false;
     }
-    /** the OAuth state of one server, for the settings panel */
     oauthStatus(name) {
         return this.auths.get(name)?.status() ?? { pending: false, authorized: false, expiresAt: null, hasRefreshToken: false, flow: { phase: "idle" } };
     }
-    /**
-     * The provider for one server, created on demand.
-     *
-     * The redirect URL here is used for CLIENT REGISTRATION, not just for the authorization request:
-     * `clientMetadata.redirect_uris` is what gets registered on the first connect. A portless
-     * placeholder therefore registers a redirect URI the real flow can never match — MEASURED, that
-     * is exactly what happened (stored `redirect_uris: ["http://127.0.0.1/callback"]`), and it is why
-     * a completed Notion authorization left no access token.
-     *
-     * `ServerAuth.clientInformation()` now refuses a registration whose URI differs from the current
-     * one, so a stale record is re-made instead of reused. This value still cannot carry the real
-     * port — none is known until `startOAuth` opens one — but it is now harmless, and keeping a
-     * long-lived provider bound to a port that is not listening would be worse.
-     */
     async authFor(name) {
         if (!this.store)
             return undefined;
@@ -137,25 +78,11 @@ export class McpRegistry {
         if (existing)
             return existing;
         const stored = await this.store.get(name);
-        // a flow needs a redirect; the SDK only reads it during authorize, and
-        // `startOAuth` replaces the instance with one carrying the real port
         const auth = new ServerAuth(name, "http://127.0.0.1/callback", (server, data) => this.store.set(server, data));
         await auth.hydrate(stored);
         this.auths.set(name, auth);
         return auth;
     }
-    /**
-     * Try a configuration WITHOUT disturbing the saved connection, using the SAVED credentials.
-     *
-     * `test` used `connectMcp(cfg)` with no auth provider "on purpose", so an authorized server
-     * answered 401 and the row said "needs a grant (🔑 authorize)" while the same server was
-     * `● connected` with 65 tools two lines above — reported as "Notionは 🔑 authorized なのに
-     * Error POSTing to endpoint · needs a grant". A test that ignores the token it is testing cannot
-     * answer the question the button asks.
-     *
-     * The connection is throwaway (closed by the caller) and the registry entry is only touched on
-     * success, so a test against an unsaved edit cannot invent or corrupt an entry.
-     */
     async testConfig(cfg) {
         const auth = await this.authFor(cfg.name);
         const authArg = auth ? { provider: auth } : undefined;
@@ -167,7 +94,6 @@ export class McpRegistry {
             await conn.close();
         }
     }
-    /** connect one server (idempotent) and discover its tools */
     async connect(name) {
         const st = this.servers.get(name);
         if (!st)
@@ -177,19 +103,6 @@ export class McpRegistry {
             return st;
         }
         if (st.status === "connected" && st.connection) {
-            /**
-             * A cached connection is not proof the server is still there.
-             *
-             * This used to return immediately, so a server that restarted kept `status: "connected"` with
-             * its OLD tool list while the transport underneath was dead. The UI's `test` button opened a
-             * FRESH connection (`testConfig`), so it reported success and the tools appeared — and the
-             * agent, going through this cached path, could not call any of them. Reported as "test をすると
-             * 接続に成功するのに、エージェントからは呼べない".
-             *
-             * A cheap liveness probe settles it: a server that answers is reused, one that does not is
-             * dropped so the reconnect below builds a new transport. `tools()` is the cheapest call that
-             * exercises the transport for real (unlike reading the cached list).
-             */
             try {
                 st.tools = await st.connection.tools();
                 st.lastChecked = Date.now();
@@ -220,11 +133,6 @@ export class McpRegistry {
             st.lastChecked = Date.now();
             st.connection = undefined;
             st.tools = [];
-            // The SDK reports a missing grant as an UnauthorizedError (or an HTTP 401); both
-            // mean "authorize", which is a different situation from "broken".
-            // The SDK reports a missing grant as an HTTP error carrying the STATUS. Reading
-            // `status` is reliable; matching the message text is not, because the SDK's message
-            // is just "Error POSTing to endpoint: <body>" and a server may send an empty body —
             const status = err.status;
             const msg = err.message ?? "";
             const needsAuth = status === 401 ||
@@ -237,24 +145,20 @@ export class McpRegistry {
             throw err;
         }
     }
-    /** connect every enabled server; failures are recorded, never thrown */
     async connectAll() {
         await Promise.all([...this.servers.keys()].map(async (n) => {
             try {
                 await this.connect(n);
             }
             catch {
-                /* recorded in the state; one dead server must not stop the others */
             }
         }));
     }
-    /** every tool from every CONNECTED server, flattened */
     allTools() {
         return [...this.servers.values()]
             .filter((s) => s.status === "connected")
             .flatMap((s) => s.tools);
     }
-    /** dispatch a flattened name; returns null when it is not an MCP tool */
     async call(flatName, args) {
         const parts = splitToolName(flatName);
         if (!parts)
@@ -262,8 +166,6 @@ export class McpRegistry {
         const st = this.servers.get(parts.server);
         if (!st)
             return { ok: false, text: `no such MCP server: ${parts.server}` };
-        // a call for a configured-but-unconnected server connects on demand: adding one
-        // mid-session must not need a restart
         if (st.status !== "connected" || !st.connection) {
             try {
                 await this.connect(parts.server);
@@ -277,14 +179,6 @@ export class McpRegistry {
             return { ok: r.ok, text: r.text };
         }
         catch (err) {
-            /**
-             * A failed call means the transport is suspect, not just this one call.
-             *
-             * Leaving `status: "connected"` made the next attempt reuse the same dead connection, so one
-             * server restart broke every subsequent call until the process restarted. Dropping the
-             * connection here lets `connect()` rebuild it on the next attempt — and the tools list is
-             * cleared with it, because a stale list is what let the UI show tools that could not be called.
-             */
             const st = this.servers.get(parts.server);
             if (st) {
                 st.connection = undefined;
@@ -296,24 +190,8 @@ export class McpRegistry {
             return { ok: false, text: `MCP call failed: ${err.message}` };
         }
     }
-    /**
-     * Start an OAuth flow.
-     *
-     * Opens the loopback listener, points the provider at it, and makes a connect attempt
-     * so the SDK performs discovery and produces the authorization URL. The returned URL is
-     * what the UI opens; the promise behind it settles when the browser comes back.
-     */
-    /**
-     * Register a server that is not in the saved config yet, so a flow can run against it.
-     *
-     * The settings panel lets the operator authorize a server before saving it — the alternative was
-     * save → the dialog closes → reopen → authorize → save again. The grant lives in the OAuth store
-     * keyed by NAME, so nothing here needs to reach `config.mcpServers`; a later `apply()` with the
-     * saved list replaces this entry.
-     */
     registerUnsaved(cfg) {
         const existing = this.servers.get(cfg.name);
-        // never clobber a live connection with a draft
         if (existing?.connection)
             return;
         if (existing)
@@ -331,7 +209,6 @@ export class McpRegistry {
         if (existing)
             await this.finishFlow(name, existing);
         const loop = await listenForCallback();
-        // a provider bound to THIS listener's port
         const auth = new ServerAuth(name, loop.redirectUrl, (server, data) => this.store.set(server, data));
         if (this.store)
             await auth.hydrate(await this.store.get(name));
@@ -343,26 +220,10 @@ export class McpRegistry {
             close: loop.close,
         };
         this.flows.set(name, pending);
-        // A connect attempt is what drives the SDK: it discovers the authorization server,
-        // registers a client if needed, and calls redirectToAuthorization before throwing.
         st.oauthRequired = true;
-        /**
-         * KEEP the connection from the 401, not just its side effects.
-         *
-         * `connectMcp` throws on the 401 that starts the flow, but the transport inside it is the ONE
-         * that will redeem the code — a transport cannot be re-started ("already started"), so building
-         * a second one here and calling `finishAuth` on it is not equivalent. MEASURED: calling
-         * `connectMcp` again in the callback handler produced another Unauthorized (no token yet) and
-         * the exchange never ran, which is why BOTH Notion and Canva reported
-         * `UnauthorizedError: Unauthorized`.
-         *
-         * `pendingConn` holds the instance whose provider already did discovery; the callback leg
-         * finishes the exchange on it and gets a fresh, usable connection back.
-         */
         let pendingConn = null;
         try {
             const conn = await connectMcp(st.config, { provider: auth });
-            // already authorized (a stored refresh token was good): no flow needed
             st.connection = conn;
             st.tools = await conn.tools();
             st.status = "connected";
@@ -371,10 +232,6 @@ export class McpRegistry {
             return { url: "" };
         }
         catch (err) {
-            /**
-             * The failed attempt still produced a connection object with a live provider. `connectMcp`
-             * only closes the client when NO provider was supplied, precisely so this path can continue.
-             */
             pendingConn = err.connection ?? null;
             const url = auth.pendingUrl();
             if (!url) {
@@ -384,44 +241,12 @@ export class McpRegistry {
                 throw new Error(`could not start the authorization flow: ${message}`);
             }
             st.status = "authorizing";
-            // complete in the background once the browser arrives
             void (async () => {
                 try {
                     const { code, iss } = await loop.wait(FLOW_TIMEOUT_MS);
-                    /**
-                     * THE CONNECTION FROM THE 401, not a new one.
-                     *
-                     * This used to call `connectMcp` again, which — with no token yet — 401s a SECOND time.
-                     * `finishAuth` therefore never ran, and both Notion and Canva surfaced
-                     * `UnauthorizedError: Unauthorized` after a completed browser authorization. The
-                     * exchange could only ever happen on the transport that started the flow.
-                     */
                     const conn = pendingConn;
                     if (!conn)
                         throw new Error("the authorization flow lost its connection");
-                    /**
-                     * Supply `iss` from OUR discovery record when the callback omitted it.
-                     *
-                     * RFC 9207 §2 says a server that advertises
-                     * `authorization_response_iss_parameter_supported: true` MUST include `iss` in the
-                     * response, and §2.4 says clients MUST reject a response without it. Notion advertises
-                     * `true` and then sends only `code` and `state`, so a strictly-conforming client discards
-                     * every completed authorization — which is "Notionがコールバック踏んだのに Unauthorized".
-                     *
-                     * §2.4 also allows the opposite: "clients ... MAY accept authorization responses that do
-                     * not contain the iss parameter ... Local policy or configuration can determine whether to
-                     * accept such responses". We accept them, using the issuer we recorded BEFORE sending the
-                     * browser out, because that is the value the mix-up check needs.
-                     *
-                     *   no iss      -> IssuerMismatchError "received undefined"   (the reported failure)
-                     *   correct iss -> the token endpoint is reached (invalid_grant for a dummy code)
-                     *   wrong iss   -> IssuerMismatchError "received https://evil.example"
-                     * so the check is not disabled — a genuinely mismatched issuer is still rejected.
-                     */
-                    /**
-                     * `finishAuth` returns a NEW connection: the instance that redeemed the code cannot serve
-                     * requests (a transport is one-shot), so storing `conn` here would leave a dead handle.
-                     */
                     const live = await conn.finishAuth(code, iss ?? auth.expectedIssuer());
                     await conn.close().catch(() => { });
                     st.connection = live;
@@ -432,15 +257,6 @@ export class McpRegistry {
                     await this.finishFlow(name, pending);
                 }
                 catch (e) {
-                    /**
-                     * Report the CAUSE, not just the message.
-                     *
-                     * `UnauthorizedError` defaults its message to the bare string "Unauthorized" when the SDK
-                     * constructs it without one (measured in the SDK source: `super(message ?? "Unauthorized")`).
-                     * That is what the panel was showing, and it says nothing about which step failed — the
-                     * exchange, the reconnect after it, or the original 401. The class name and any `cause`
-                     * are the difference between "try again" and a diagnosis.
-                     */
                     const err = e;
                     const name = err.constructor?.name ?? "Error";
                     const cause = err.cause instanceof Error ? err.cause.message : String(err.cause ?? "");
@@ -458,13 +274,11 @@ export class McpRegistry {
             return { url };
         }
     }
-    /** close a flow's listener and record its outcome */
     async finishFlow(name, f) {
         if (this.flows.get(name) === f)
             this.flows.delete(name);
         await f.close().catch(() => { });
     }
-    /** forget a grant (disconnect) */
     async disconnect(name) {
         const auth = this.auths.get(name);
         if (auth)
@@ -490,5 +304,4 @@ export class McpRegistry {
         }
     }
 }
-/** process-wide registry: one connection per server, shared by every agent */
 export const mcp = new McpRegistry();

package/dist/agent/mcp.js

@@ -1,30 +1,4 @@
-/**
- * MCP client (#67), on `@modelcontextprotocol/client` v2.
- *
- * The hand-written protocol layer is GONE. It had been carrying Streamable HTTP, legacy
- * HTTP+SSE and stdio, each with its own JSON-RPC framing, session-id handling and SSE
- * parsing — which is exactly the surface the official client now owns, and protocol
- * details (new protocol versions, new transports, task-based calls) move under it.
- *
- * What teapot keeps is the part that is NOT protocol: which servers are configured, how
- * one connection is shared across agents, tool-name namespacing, and the OAuth STORE
- * (where the grant lives). The SDK supplies the discovery and the flow.
- *
- * Discovery deliberately uses the SDK's own `buildDiscoveryUrls` order rather than a
- * hand-rolled one. MEASURED against the live servers before the rewrite:
- *
- *   GitHub (issuer https://github.com/login/oauth) serves ONLY
- *     https://github.com/.well-known/oauth-authorization-server/login/oauth   200
- *     https://github.com/login/oauth/.well-known/oauth-authorization-server   404
- *   Notion (issuer https://mcp.notion.com, no path) serves the root form.
- *
- * and the SDK tries exactly: RFC 8414 pre-path oauth → pre-path OIDC → post-path OIDC.
- * It does NOT try the post-path `oauth-authorization-server` shape, which is correct —
- * no MCP server is known to publish it, and guessing more shapes risks accepting a
- * document from a different issuer.
- */
 let sdkPromise;
-/** resolved once, on the first connection attempt */
 async function mcpSdk() {
     if (!sdkPromise) {
         sdkPromise = (async () => {
@@ -37,34 +11,26 @@ async function mcpSdk() {
     }
     return sdkPromise;
 }
-/** pull the text out of an MCP tool result's content array */
 function resultText(result) {
     const parts = [];
     for (const c of result?.content ?? []) {
         if (c?.type === "text" && typeof c.text === "string")
             parts.push(c.text);
-        // name the parts we cannot render rather than dropping them silently: a json or
-        // image part vanishing would look like an empty answer
         else if (c?.type)
             parts.push(`[${c.type} content omitted]`);
     }
     return { text: parts.join("\n") || "(no content)", ok: result?.isError !== true };
 }
-/** normalise what a server reports into teapot's tool shape */
 function toTools(list, server) {
     const out = [];
     for (const t of list?.tools ?? []) {
         const name = typeof t.name === "string" ? t.name : "";
         if (!name)
-            continue; // a nameless tool is unusable either way
+            continue;
         const schema = t.inputSchema;
         out.push({
             name,
             description: typeof t.description === "string" ? t.description : "",
-            // The SDK VALIDATES that every tool carries an object `inputSchema`, so this
-            // fallback is only a type guard — a server that omits it fails at `tools()` before
-            // reaching here. Kept so a future protocol version that makes it optional does not
-            // hand the model an undefined schema.
             inputSchema: schema && typeof schema === "object" && !Array.isArray(schema)
                 ? schema
                 : { type: "object", properties: {} },
@@ -73,17 +39,9 @@ function toTools(list, server) {
     }
     return out;
 }
-/**
- * Connect to one configured server.
- *
- * `auth` is optional: without it the transports send only the static headers, which is
- * the common case (a local server, or a static API key).
- */
 function buildConnection(cfg, client, session, auth) {
     return {
         async tools() {
-            // one page is the norm; follow the cursor so a server that paginates is not
-            // silently truncated
             const all = [];
             let cursor;
             const seen = new Set();
@@ -105,25 +63,9 @@ function buildConnection(cfg, client, session, auth) {
             return resultText(res);
         },
         async finishAuth(code, iss) {
-            // a capability test, not `instanceof`: the SDK classes do not exist until the import has run
             if (typeof session.finishAuth !== "function")
                 throw new Error("this transport has no OAuth flow");
-            /**
-             * Exchange on THIS transport — the PKCE verifier and the discovery record are read from the
-             * provider, but the request is issued with this instance's fetch/init.
-             */
             await session.finishAuth(iss === undefined ? code : new URLSearchParams({ code, iss }));
-            /**
-             * …then build a FRESH connection, because this one cannot be revived.
-             *
-             * A transport is one-shot: after the 401 that started the flow, connecting again throws
-             * "already started" even without `close()`. MEASURED, and it is why the flow appeared to
-             * complete and then report `UnauthorizedError: Unauthorized` — `client.connect` on a spent
-             * transport fails with no message of its own, and the SDK's UnauthorizedError defaults its
-             * text to the word "Unauthorized".
-             *
-             * The provider is shared, so the new instance reads the tokens the exchange just stored.
-             */
             await client.close().catch(() => { });
             return await connectMcp(cfg, auth);
         },
@@ -146,8 +88,6 @@ export async function connectMcp(cfg, auth) {
             args: cfg.args ?? [],
             env: { ...process.env, ...(cfg.env ?? {}) },
             ...(cfg.cwd ? { cwd: cfg.cwd } : {}),
-            // a server that logs to stdout can corrupt the frame stream; the SDK's stderr
-            // option ("inherit" by default) is the place to say otherwise
             stderr: "inherit",
         });
     }
@@ -158,8 +98,6 @@ export async function connectMcp(cfg, auth) {
         if (!["http:", "https:"].includes(url.protocol))
             throw new Error(`MCP server "${cfg.name}" must use http(s), not ${url.protocol}`);
         session = new sdk.SSEClientTransport(url, {
-            // `manual`, NOT follow: an MCP endpoint that redirects is nearly always an HTML
-            // login page, and following it replaces a clear auth problem with a parse error
             redirectPolicy: "same-origin",
             ...(cfg.headers ? { requestInit: { headers: cfg.headers } } : {}),
             ...(auth ? { authProvider: auth.provider } : {}),
@@ -181,30 +119,8 @@ export async function connectMcp(cfg, auth) {
         await client.connect(session);
     }
     catch (err) {
-        /**
-         * A 401 is NOT a dead connection — it is the first half of the OAuth flow.
-         *
-         * `client.connect()` failing with UnauthorizedError means the server wants a grant. Closing the
-         * client here used to destroy the only transport that could complete it: a transport cannot be
-         * re-started ("StreamableHTTPClientTransport already started!") and `finishAuth()` exchanges the
-         * code through THIS instance's provider, so the second `connect()` after `finishAuth` always
-         * threw — surfacing as a bare `UnauthorizedError: Unauthorized` even though the browser had
-         * completed the authorization and the token WAS saved.
-         *
-         * MEASURED: connect → 401; close; connect again → "already started". And with the exchange
-         * succeeding, the tokens were present and the connection still failed.
-         *
-         * So the client stays open when the caller supplied an auth provider (it may need to finish the
-         * flow on it). Without a provider there is nothing to complete, so it is closed as before.
-         */
         if (!auth)
             await client.close().catch(() => { });
-        /**
-         * Attach the connection so the OAuth caller can CONTINUE on this exact instance.
-         *
-         * The transport that received the 401 is the one that must redeem the code (a transport cannot
-         * be restarted), so the caller needs a handle to it — rebuilding one loses the flow.
-         */
         if (auth) {
             const conn = buildConnection(cfg, client, session, auth);
             throw Object.assign(err, { connection: conn });

package/dist/agent/meta-tools.js

@@ -1,27 +1,3 @@
-/**
- * The META tools: the ones the AGENT LOOP handles itself instead of dispatching to
- * `executeTool` (finish, the goal/todo/memory/feedback tools, ask_user…).
- *
- * ## Why this is a table and not two lists
- *
- * A meta tool used to be declared in TWO hand-maintained places: a 389-line block of
- * `if (call.function.name === "…")` in `runTurnsUntilIdle`, and its spec among the
- * literals in `allToolSpecs`. Nothing connected them, so the failure modes were silent:
- *
- *   - a spec with no branch → the model calls a tool that falls through to
- *     `executeTool`, which answers "unknown tool" even though the prompt advertised it;
- *   - a branch with no spec → dead code, and the model never learns the tool exists.
- *
- * Named in one place, both mistakes become a missing key rather than a runtime surprise.
- * `META_TOOL_NAMES` is derived from this table, so `allToolSpecs()` cannot advertise a
- * meta tool the loop does not handle (see `test/meta-tools.test.ts`).
- */
-/**
- * Every meta tool, in the order the model sees them.
- *
- * Adding one: add the entry here AND the matching branch in `runTurnsUntilIdle`. The test
- * asserts the two agree, so a half-done addition fails rather than shipping.
- */
 export const META_TOOLS = [
     {
         name: "finish",
@@ -310,9 +286,7 @@ export const META_TOOLS = [
         },
     },
 ];
-/** the names the tool loop must handle itself, in wire order */
 export const META_TOOL_NAMES = META_TOOLS.map((t) => t.name);
-/** just the specs, for splicing into the full tool list */
 export function metaToolSpecs() {
     return META_TOOLS.map((t) => t.spec);
 }