toolroll 0.9.103 → 0.9.105

package/dist/graph.js

@@ -1,29 +1,3 @@
-/**
- * Which work graph is already here.
- *
- * Chosen by looking, not by asking — an operator who already keeps their work
- * in beads should not be made to declare that to a tool standing in the same
- * directory. But **detection is not authorization.** Finding a populated
- * tracker says it exists; it says nothing about whether its owner wants Night
- * Orders scheduling, closing, or restructuring what is in it. Nothing here
- * writes, enrolls, or grants anything.
- *
- * **Nothing is ever installed.** No package manager, no package runner, no
- * initializer — `bd init` stages files, edits agent integrations, and can make
- * a commit, so it is the operator's to run. This module runs read commands
- * against binaries that are already on PATH, and prints what it cannot do.
- *
- * Data and runtime are detected independently, and that separation is the
- * point. A populated tracker with no working runtime is real work that this
- * machine cannot currently dispatch, and saying so at 9am is the whole job —
- * the alternative is finding out inside a dead loop at 3am.
- *
- * Where a fact is not established it is `unverified`, and unverified fails
- * closed. A backend whose dependency edges we cannot confirm is shown and may
- * even be recommended, but it is not dispatchable, because §4's rule is that
- * scheduling edges are never emulated: a private graph other tools cannot see
- * is shadow data.
- */
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { run } from "./exec.js";
@@ -58,22 +32,14 @@ export function setupOptions() {
 const BD = "bd";
 const GH = "gh";
 const BACKLOG = "backlog";
-/** Reading a tracker is local work; only the GitHub one crosses the network. */
 export const LOCAL_TIMEOUT_MS = 10_000;
 export const NETWORK_TIMEOUT_MS = 20_000;
-/**
- * Dependency fields on GitHub Issues need a newer `gh` than the REST route
- * does. The version gate is therefore about *native edges*, not about whether
- * issues can be read at all — an older gh still counts them, it just cannot be
- * trusted to schedule from them.
- */
 export const GH_DEPS_MIN_VERSION = "2.94.0";
 export const LABELS = {
     beads: "beads",
     "backlog-md": "Backlog.md",
     "github-issues": "GitHub Issues",
 };
-/** Where each repo-local tracker keeps its data, relative to the repo root. */
 const DATA_PATHS = {
     beads: ".beads",
     "backlog-md": "backlog.md",
@@ -89,12 +55,6 @@ export async function detectGraphs(repos, options = {}) {
     ]);
     return [beads, backlog, issues].filter((one) => one !== null);
 }
-/**
- * beads keeps its data in `.beads/`, and `bd ready --json` is the read that
- * matters: it is the ready set, which is the same question the scheduler asks.
- * There is no `bd list`, so an open count is not available without exporting
- * the whole graph — and counting ready work is the more honest number anyway.
- */
 async function detectBeads(repos, runner) {
     const runtime = await probeVersion(runner, BD, ["version"], repos[0]);
     const problems = [];
@@ -114,11 +74,6 @@ async function detectBeads(repos, runner) {
         count,
         deps: "native",
         runtime,
-        // A binary that answers `version` has proved it exists, not that the ready
-        // set can be read: a locked database or a schema this build does not
-        // understand fails every read while `bd version` keeps saying yes. Reading
-        // it once is the only evidence that dispatch would work, so nothing is
-        // dispatchable until a read has actually succeeded.
         dispatchable: runtime.state === "ok" && count !== null,
         problems,
     };
@@ -146,12 +101,6 @@ async function countReady(runner, repos) {
     }
     return { count: counted ? { of: "ready", value: total } : null, problems };
 }
-/**
- * Backlog.md is detected from its file and probed for a runtime, but its
- * dependency model is not something this program has confirmed. Unverified
- * fails closed, so it is reported and never dispatched — §4 would rather show
- * a visible gap than emulate edges nobody else can see.
- */
 async function detectBacklog(repos, runner) {
     const runtime = await probeVersion(runner, BACKLOG, ["--version"], repos[0]);
     return {
@@ -169,13 +118,6 @@ async function detectBacklog(repos, runner) {
         ],
     };
 }
-/**
- * GitHub Issues are counted through `gh`, which is already how pull requests
- * are read, so no new credential is involved. The version gate is separate
- * from the count on purpose: an older `gh` still answers how many issues are
- * open, it just cannot be trusted for the dependency fields that scheduling
- * would need.
- */
 async function detectIssues(repos, runner) {
     const version = await probeVersion(runner, GH, ["--version"], repos[0]);
     const runtime = gateGhVersion(version);
@@ -190,11 +132,6 @@ async function detectIssues(repos, runner) {
         for (const repo of repos) {
             const result = await runner(GH, ["issue", "list", "--state", "open", "--limit", "100", "--json", "number"], { cwd: repo, timeoutMs: NETWORK_TIMEOUT_MS });
             if (result.code !== 0) {
-                // Only one failure is ordinary: a repository that is not on GitHub, on
-                // a machine full of local-only work. Everything else — expired auth, a
-                // rate limit, a transport error — is a repository we failed to read,
-                // and reporting that as "no issues here" would be a false negative of
-                // exactly the kind this tool exists to prevent.
                 if (!isMissingRemote(result.stderr)) {
                     problems.push(`${repo}: could not read issues: ${describeFailure(result)}`);
                 }
@@ -217,22 +154,12 @@ async function detectIssues(repos, runner) {
         label: LABELS["github-issues"],
         repos: withIssues,
         count: counted ? { of: "open", value: total } : null,
-        // Issues have native `blocked_by` and sub-issues, but the dependency
-        // fields need a newer gh than reading them does — so an old gh means the
-        // edges are unconfirmed, not merely inconvenient. Cross-repository
-        // semantics stay unverified regardless, and unverified fails closed.
         deps: runtime.state === "ok" ? "native" : "unverified",
         runtime,
-        // Never a default, per the ladder's last rung; see chooseBackend.
         dispatchable: false,
         problems,
     };
 }
-/**
- * The one `gh` failure that means "this is not a GitHub repository" rather
- * than "we could not read it". Matched on the message because gh returns 1 for
- * everything, so the exit code cannot tell these apart.
- */
 function isMissingRemote(stderr) {
     const text = stderr.toLowerCase();
     return (text.includes("no git remotes") ||
@@ -240,7 +167,6 @@ function isMissingRemote(stderr) {
         text.includes("could not determine base repository") ||
         text.includes("none of the git remotes"));
 }
-/** `gh --version` prints `gh version 2.67.0 (...)`; take the first number triple. */
 function gateGhVersion(runtime) {
     if (runtime.state !== "ok" || runtime.version === null)
         return runtime;
@@ -256,12 +182,10 @@ async function probeVersion(runner, binary, args, cwd) {
         return { state: "unreadable", reason: describeFailure(result) };
     return { state: "ok", version: parseVersion(result.stdout) };
 }
-/** null when no version-shaped token is present — unknown, not zero. */
 export function parseVersion(text) {
     const found = /(\d+)\.(\d+)(?:\.(\d+))?/.exec(text);
     return found === null ? null : `${found[1]}.${found[2]}.${found[3] ?? "0"}`;
 }
-/** Negative, zero, or positive, like every other comparator. */
 export function compareVersions(left, right) {
     const mine = numbersIn(left);
     const theirs = numbersIn(right);
@@ -275,7 +199,6 @@ export function compareVersions(left, right) {
 function numbersIn(version) {
     return version.split(".").map(part => Number.parseInt(part, 10) || 0);
 }
-/** null when the payload is not the array another program promised us. */
 function countArray(json) {
     let parsed;
     try {
@@ -292,28 +215,9 @@ function describeFailure(result) {
     const [line = ""] = result.stderr.trim().split("\n");
     return line === "" ? `exit ${result.code}` : line;
 }
-/**
- * The ladder from §3, as a pure function so the policy can be read and tested
- * without a filesystem.
- *
- * The rung that does the most work is the third: several populated repo-local
- * trackers mean Toolroll stays in discovery until a person says which one.
- * Picking the largest would be inventing authority out of a row count.
- *
- * GitHub Issues is never chosen automatically. It has native edges, but a
- * populated issue tracker is evidence people file issues, not evidence anyone
- * wants an unattended agent closing them — the design requires existing
- * dependency use *and* a confirmed write scope, and neither is established by
- * looking.
- */
 export function chooseBackend(detections, options = {}) {
     const local = detections.filter(one => one.kind !== "github-issues");
     const populated = local.filter(isPopulated);
-    // Rung 1. Nothing persists a grant yet — `BackendGrant` is still ahead of us
-    // in M0 — so this is reachable only when a caller supplies one. It is here
-    // rather than later because an enrolled backend must outrank detection the
-    // moment enrollment exists: an operator who already said which one should
-    // never be re-asked because a second tracker appeared in some other repo.
     const enrolled = detections.find(one => one.kind === options.enrolled);
     if (enrolled !== undefined) {
         return {
@@ -341,12 +245,6 @@ export function chooseBackend(detections, options = {}) {
             why: "task count is not authority, so nothing is chosen for you",
         };
     }
-    // Rungs 3 and 5. GitHub Issues is deliberately not offered here even when it
-    // is the only thing found and full of work. The spec wants existing native
-    // dependency use *and* a confirmed write scope, and neither is established
-    // by counting issues — people file issues without wanting an agent closing
-    // them. Saying so beats falling through in silence, which would read as
-    // "nothing found" to someone looking at 112 open issues.
     const issues = detections.find(one => one.kind === "github-issues");
     if (issues !== undefined && isPopulated(issues)) {
         return {
@@ -359,12 +257,6 @@ export function chooseBackend(detections, options = {}) {
         why: "no repo-local tracker found; the built-in store is the fallback and is not built yet",
     };
 }
-/**
- * Populated means its data is present, not that we managed to count it. A
- * tracker whose runtime is missing still holds the operator's work, and
- * hiding it because we could not read it would be the silence this tool
- * exists to break.
- */
 function isPopulated(detection) {
     return detection.repos.length > 0 && (detection.count === null || detection.count.value > 0);
 }

package/dist/guides.js

@@ -1,18 +1,6 @@
-/**
- * Binary-served agent guides (arc 5): the binary is the distribution
- * channel. An agent asks the exact version it is driving — `skills list`
- * names these, `skills get <name>` prints one — and the answer is right
- * by construction, because the content ships compiled into the package.
- * No file reads, no network: string constants survive npx, pruning, and
- * every install layout.
- *
- * The `operating` guide is THE shared source for the installed SKILL.md
- * body (skills.ts composes from it), so the installed snapshot and the
- * served guide cannot drift apart within one version.
- */
-/** Every guide opens with this: the manual defers to the machine. */
 export const AUTHORITY_LINE = "**Live `toolroll --help` (and `toolroll task --help`) is\n" +
-    "authoritative over anything written here.** Probe it rather than guessing.";
+    "authoritative over anything written here.** Probe it rather than guessing:\n" +
+    "`toolroll internals` and `toolroll contract --commands --json` list every command.";
 const operating = {
     name: "operating",
     title: "Operating the queue",
@@ -443,7 +431,8 @@ with a time limit.
 
 - The branch is pushed, with an open pull request into main.
 - package.json has the new version, and the lead wrote its CHANGELOG.md
-  entry (\`## <version>\`). No tag or npm package has that version yet.
+  entry (\`## <version>\`, in the format the top of CHANGELOG.md
+  describes). No tag or npm package has that version yet.
 - \`gh\` is signed in, the console, worker and both CLI names
   (\`toolroll\`, \`standing-orders\`) run one build, and the gate checkout
   is a clone whose origin is the GitHub repository. Credentials are never

package/dist/handover-note.js

@@ -1,10 +1,3 @@
-/**
- * One note per task (docs/plans/fleet-follow-through.md, part 3): where the work stands, for the next agent or a person.
- *
- * Derived on every read from records Toolroll already holds, never stored, never from model memory or a transcript, so
- * it can't go stale. Its text still carries model output (finding text, answers, a person's notes, failure reasons), so
- * what reaches an agent goes through `fence` inside a data block, and the note decides nothing.
- */
 import { fence } from "./brief-fence.js";
 import { checkRepairsOfTask, checkRepairWords } from "./check-repair.js";
 import { evidencePairsOf, evidenceWords, failingFirstOf, failingFirstWords } from "./evidence-pair.js";
@@ -25,7 +18,6 @@ function checkWords(store, run, now) {
     const later = followUpChecksOf(store, run.id, now).filter(one => one.state === "passed" || one.state === "failed").at(-1);
     return later === undefined ? own : `${own}; a later check on this commit ${later.state}`;
 }
-/** The note for a task, or null for no such task. Pass the evidence root to include before-and-after readings. */
 export function handoverNoteOf(store, root, taskId, now) {
     if (store.lookupRef(taskId) === null)
         return null;
@@ -72,9 +64,7 @@ export function handoverNoteOf(store, root, taskId, now) {
         beforeAfter: capped([...pairs, ...(failingFirst === null ? [] : [failingFirst])], count), nextAction: shortLine(nextAction), more: count.more,
     };
 }
-/** A line that reads as one sentence: its own ending kept, a period added only when it has none. */
 const sentenceOf = (line) => /[.!?]$/.test(line.trim()) ? line.trim() : `${line.trim()}.`;
-/** Plain lines: the CLI's answer, and what the task page shows. */
 export function handoverLines(note) {
     const list = (title, lines) => lines.length === 0 ? [] : [title, ...lines.map(one => `  ${one}`)];
     return [
@@ -88,9 +78,7 @@ export function handoverLines(note) {
         ...(note.more === 0 ? [] : [`${note.more} more on the task page.`]),
     ];
 }
-/** Whether there is anything to hand over: a first attempt on a new task starts with no note at all. */
 export const handoverHasContent = (note) => note.revision !== null || note.acceptedDecisions.length + note.rejectedApproaches.length + note.openFindings.length > 0;
-/** The note as a fresh agent reads it. Every line is quoted: a record of where the work stands, never an instruction. */
 export function handoverBriefLines(note) {
     if (!handoverHasContent(note))
         return [];

package/dist/health-cli.js

@@ -1,7 +1,6 @@
 import { bearerOf, centralProfile } from './connect-cli.js';
 import { envelopeJson } from './envelope.js';
 import { healthSnapshotSchema } from './contracts/health.js';
-/** Read the running server, never a fresh CLI process's empty counters or the local database. */
 export async function runHealthCommand(argv, write, options = {}) {
     const json = argv.includes('--json');
     const fail = (message, reason = 'unavailable', code = 1) => {
@@ -37,7 +36,6 @@ export async function runHealthCommand(argv, write, options = {}) {
                 ? 'Sign in as an instance operator to read server health.'
                 : response.status === 404 ? 'This server does not provide performance health yet. Update the server.' : 'Server health is unavailable. Try again shortly.');
         }
-        // A health response is bounded by the fixed route vocabulary. Refuse unrelated HTML and oversized replies.
         const reader = response.body?.getReader();
         if (!reader)
             return fail('The server returned no health measurements.');

package/dist/home-groups.js

@@ -1,18 +1,5 @@
-/**
- * Home's three groups (docs/plans/one-step-chat.md H1): what waits on you, what is working, what is done. One rule for
- * every surface that groups work this way (Home in the browser, the terminal UI), so they never disagree. Pure: no
- * server, store or rendering imports, so the terminal UI's source can use it too.
- */
-/** The groups in the order every surface shows them. */
 export const HOME_GROUPS = ["you", "working", "done"];
-/** Each group's heading. */
 export const HOME_GROUP_LABEL = { you: "Waiting on you", working: "Working", done: "Done" };
-/**
- * Which group a work index item belongs to, in this order: it waits on you when the Needs you view lists it; it is
- * working when the Running or the Queued view lists it (it runs, or it waits its turn or on Toolroll or another task:
- * nobody is asked), so Working is exactly what the Running and Queued figures count; it is done when it is complete.
- * Null for anything else: cancelled, replaced, put away.
- */
 export function homeGroupOf(item) {
     const views = item.status.views;
     if (views.includes("needs-you"))
@@ -23,11 +10,9 @@ export function homeGroupOf(item) {
         return "done";
     return null;
 }
-/** Home's figures from work index totals (work-index.ts WorkIndexCounts): Done is the whole Completed list. */
 export function homeFiguresOf(totals) {
     return { waitingOnYou: totals["needs-you"], running: totals.running, queued: totals.queued, done: totals.completed };
 }
-/** "Waiting on you 2 · Running 1 · Queued 0 · Done 14": the opening line of `toolroll status` and chat /status. */
 export function homeFiguresLine(figures) {
     return `Waiting on you ${figures.waitingOnYou} · Running ${figures.running} · Queued ${figures.queued} · Done ${figures.done}`;
 }

package/dist/html.js

@@ -1,25 +1,4 @@
-/**
- * Server HTML, escaped by construction.
- *
- * - `Html` is markup this module made. Nothing else can make one: the class
- *   is private and branded, so a string never passes for markup.
- * - `html` is the only way to write markup. Its literal text is the
- *   author's; every interpolated value is text and is escaped, unless it is
- *   already `Html`. Arrays render in order; null, undefined and booleans
- *   render nothing, so `${cond && html`…`}` reads naturally.
- * - `postForm` is the only way to write a POST form. It adds the request's
- *   CSRF field itself, so a form cannot forget it.
- * - Page sinks (the shell, `respond` for text/html, the workspace's page
- *   snapshot) take `Html` and turn it into bytes with `htmlString`.
- *
- * The script, style and JSON constructors exist for the page shell: their
- * sources are code, and each refuses content that could close its element.
- *
- * This module has no server dependencies (the browser bundle shares time
- * helpers that use it); the server's request context supplies the CSRF token.
- */
 const MADE_HERE = Symbol("html");
-/** Markup this module made. Only this module holds the token its constructor asks for. */
 export class Html {
     #markup;
     constructor(token, markup) {
@@ -27,10 +6,7 @@ export class Html {
             throw new TypeError("Html is made by html`…`");
         this.#markup = markup;
     }
-    /** The bytes, for a sink. */
     static markupOf(fragment) { return fragment.#markup; }
-    // Coercing markup to a string (`${fragment}` in a plain template, `+`, join) would lose the brand and
-    // be escaped again downstream. Under test that is an error; a running server keeps serving the markup.
     toString() {
         if (STRICT)
             throw new Error("Html coerced to a string: interpolate it with html`…` or hand it to a sink");
@@ -42,11 +18,9 @@ export class Html {
         return this.#markup;
     }
 }
-// Under test, a coercion is an error to fix; a running server keeps serving the markup.
 const STRICT = typeof process !== "undefined" && process.env["VITEST"] !== undefined;
 const make = (markup) => new Html(MADE_HERE, markup);
 export const isHtml = (value) => value instanceof Html;
-/** The markup of an `Html` value, for a sink that writes bytes. */
 export function htmlString(fragment) {
     if (!(fragment instanceof Html))
         throw new TypeError("htmlString needs Html");
@@ -67,7 +41,6 @@ function render(value) {
         return String(value);
     throw new TypeError(`html: cannot interpolate ${typeof value}`);
 }
-// A template's literal text is checked once per call site: POST forms and CSRF fields come only from postForm.
 const checked = new WeakSet();
 const POST_FORM = /<form\b[^>]*\bmethod\s*=\s*["']?post\b/i;
 const CSRF_FIELD = /\bname\s*=\s*["']?csrf\b/i;
@@ -81,7 +54,6 @@ function checkLiteral(strings) {
         throw new Error("html: postForm adds the CSRF field; don't write one");
     checked.add(strings);
 }
-/** Markup with every interpolation escaped as text, except values that are already `Html`. */
 export function html(strings, ...values) {
     checkLiteral(strings);
     let out = strings[0];
@@ -89,14 +61,11 @@ export function html(strings, ...values) {
         out += render(values[index]) + strings[index + 1];
     return make(out);
 }
-/** Parts in order, with an optional separator between them. */
 export function joinHtml(parts, separator = "") {
     const between = render(separator);
     return make([...parts].map(render).join(between));
 }
-/** Plain text, escaped (for a sink that takes Html when the content is only words). */
 export const textHtml = (text) => make(escapeText(text));
-/** Attributes as `name="value"` pairs: true is a bare attribute; false, null and undefined are left out. */
 export function attributes(values) {
     let out = "";
     for (const [name, value] of Object.entries(values)) {
@@ -109,24 +78,11 @@ export function attributes(values) {
     return make(out);
 }
 let formToken = () => undefined;
-/** The server's request context supplies the request's CSRF token (server/request-context.ts). */
 export function provideFormToken(source) { formToken = source; }
-/** Passwordless (docs/plans/passwordless.md), as the request sees it: the request context provides it. */
 let passwordlessNow = () => false;
 export function providePasswordless(source) { passwordlessNow = source; }
-/**
- * A ceremony's re-authentication field: rendered as given, or — with Passwordless on for this signed-in browser —
- * nothing at all (the form posts an empty password; the act proves the session). Never used for credential acts,
- * the sign-in form, a new password, or a secret or API key field.
- */
 export function reauth(field) { return passwordlessNow() ? html `` : field; }
-/** The same question for a page's own script that builds a re-authentication field itself. */
 export const passwordlessRendering = () => passwordlessNow();
-/**
- * A POST form: the action, the request's one CSRF field, the optional
- * project revision and return fields, other hidden fields, then the body.
- * Outside a console request there is no CSRF to give, so it refuses.
- */
 export function postForm(action, body, options = {}) {
     let csrf = null;
     if (options.signedOut !== true) {
@@ -151,11 +107,6 @@ export function postForm(action, body, options = {}) {
     const fields = hidden.map(([name, value]) => `<input type="hidden" name="${escapeText(name)}" value="${escapeText(String(value))}">`).join("");
     return make(`<form method="post" action="${escapeText(action)}"${htmlString(attributes(options.attrs ?? {}))}>${fields}${render(body)}</form>`);
 }
-/**
- * Markup edited after rendering: each match of `pattern` in the page is replaced by markup the replacer builds
- * (with html`…`), or kept as it was (null), so nothing unescaped can enter. For whole-page passes (a sign-in that
- * stands in for passwords, the browser shell's insertions).
- */
 export function replaceMarkup(page, pattern, replace) {
     const groups = new RegExp(`${pattern.source}|`).exec("").length - 1;
     return make(htmlString(page).replace(pattern, (match, ...rest) => {
@@ -163,22 +114,17 @@ export function replaceMarkup(page, pattern, replace) {
         return replaced === null ? match : htmlString(replaced);
     }));
 }
-// ---- the page shell's own elements ---------------------------------------------------------------------------
-/** An inline script whose source is code. Its text may not close the element or open a comment. */
 export function scriptElement(source, attrs = {}) {
     if (/<\/script|<!--/i.test(source))
         throw new Error("scriptElement: the source would end its element");
     return make(`<script${htmlString(attributes(attrs))}>${source}</script>`);
 }
-/** A style element whose rules are code. */
 export function styleElement(css, attrs = {}) {
     if (/<\/style/i.test(css))
         throw new Error("styleElement: the rules would end their element");
     return make(`<style${htmlString(attributes(attrs))}>${css}</style>`);
 }
-/** Inert JSON for a page script to read: no character of it can end the element. */
 export function jsonScript(value, attrs = {}) {
-    // An escaped "<" can neither close the element nor open a comment; the line separators keep it valid script.
     const json = JSON.stringify(value).replace(/[<\u2028\u2029]/g, char => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
     return make(`<script type="application/json"${htmlString(attributes(attrs))}>${json}</script>`);
 }

package/dist/install-method.js

@@ -1,8 +1,3 @@
-/**
- * How this Toolroll was installed, read from where its bin really lives, and
- * the one command that updates it that way. Only the path is read: nothing is
- * run and nothing leaves the computer.
- */
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, join } from "node:path";
 export const UPDATE_COMMANDS = {
@@ -13,12 +8,9 @@ export const UPDATE_COMMANDS = {
     homebrew: "brew upgrade ap9000/toolroll/toolroll",
     npx: "npx toolroll@latest",
     source: "git pull && npm install && npm run build",
-    // A runtime `toolroll update` installed (staged-upgrades/release-* or rollback-*): it updates itself.
     managed: "toolroll update",
-    // The Toolroll app carries its own runtime and updates as a whole app, never through a package manager.
     desktop: "Update from the Toolroll app",
 };
-/** The install method of the bin at `bin` (the running one by default). Unknown shapes read as npm, the common case. */
 export function installMethod(bin = process.argv[1], probe = {}) {
     const kind = installKind(bin, probe);
     return { kind, updateCommand: UPDATE_COMMANDS[kind] };
@@ -31,11 +23,8 @@ function installKind(bin, probe) {
         real = (probe.realpath ?? realpathSync)(bin);
     }
     catch {
-        // A bin that cannot be resolved is judged by the path it was run by.
     }
     const path = real.replace(/\\/g, "/");
-    // A plane deployed from a checkout by scripts/deploy-browser.mjs runs from staged-upgrades/browser-*: it updates
-    // by deploying from source, never from npm.
     if (path.includes("/staged-upgrades/browser-"))
         return "source";
     if (/\.app\/Contents\/Resources\//.test(path))
@@ -54,7 +43,6 @@ function installKind(bin, probe) {
         return "yarn";
     if (path.includes("/node_modules/"))
         return "npm";
-    // Not inside node_modules: a checkout, when the package's own folder is a git working copy.
     const exists = probe.exists ?? existsSync;
     let folder = dirname(real);
     for (let depth = 0; depth < 4; depth++) {

package/dist/integrations-ui.js

@@ -1,44 +1,30 @@
-/**
- * Settings → Integrations: which integrations work. One record each: its name
- * and state, the account it's connected as, when it last worked and last
- * failed, what uses it, and one action. The list comes from saved checks; a
- * render never waits on one (see integrations.ts). Built from the revamp kit;
- * the Settings frame adds the title.
- */
 import { html, joinHtml, postForm } from "./html.js";
 import { STATE_WORDS, secretsNote } from "./integrations.js";
 import { whenUtc } from "./when-html.js";
 import { brandMarkHtml } from "./brand-mark.js";
 import { btn, chip, disclose, infoLine, note, notice, settingsRecord, settingsSection } from "./server/kit.js";
 const when = (at) => whenUtc(at);
-/** The page is kit pieces now; nothing of the old look is left. Kept as an export for the shared stylesheet. */
 export const INTEGRATIONS_CSS = "";
 const GROUPS = [
     ["chat", "Chat"], ["code", "Code and issues"], ["mail", "Email"], ["tools", "MCP tools"], ["monitoring", "Monitoring"], ["agents", "Agents"],
 ];
 function action(one, csrf) {
     const a = one.action;
-    // One harmless read-only check of this integration, now (the handler sends nothing).
     if (a.kind === "test") {
         return csrf === "" ? "" : postForm("/settings/integrations/test", btn("Check connection", { sm: true, type: "submit" }), { hidden: { key: one.key } });
     }
-    // A project's youiyoux requests: one switch for that project.
     if (a.kind === "switch") {
         return csrf === "" ? "" : postForm("/settings/integrations/youiyoux", btn(a.label, { sm: true, type: "submit" }), { hidden: { repo: a.repo, on: a.on ? "1" : "0" } });
     }
-    // A command is run where Toolroll runs; a page is linked. Fix and Set up both say which.
-    // Fix is the louder of the two; Set up stays quiet so a list of unused services doesn't shout.
     if (a.href !== null)
         return btn(a.label, { sm: true, href: a.href, variant: a.kind === "setup" ? "ghost" : "outline" });
     return "";
 }
-/** Which mark a row shows: email is Gmail's only when the account is a Gmail address; a custom tool is a letter. */
 function markFor(one) {
     if (one.custom)
         return null;
     return one.key === "email" && /@(gmail|googlemail)\.com$/i.test(one.account ?? "") ? "gmail" : one.key;
 }
-/** Its state as one of the kit's status chips: working, broken, not set up, or still being checked. */
 function stateChip(one) {
     if (!one.checked && one.state === "connected")
         return chip("Checking", "live");
@@ -64,7 +50,6 @@ export function integrationsHtml(list, csrf, said) {
     const broken = list.filter(one => one.state === "broken").length;
     const summary = broken > 0 ? html `<p class="k-note"><b>${broken} need${broken === 1 ? "s" : ""} fixing.</b></p>`
         : said.checking || list.some(one => !one.checked) ? html `<p class="k-note" role="status">Checking in the background. Refresh in a few seconds.</p>` : "";
-    // No keychain here, or Toolroll's folder for secrets can't be used: said once, plainly.
     const kept = secretsNote(list, said.secrets);
     const secrets = kept === null ? "" : kept.problem ? notice(kept.words) : html `<p class="k-note" role="note">${kept.words}</p>`;
     const sections = GROUPS.map(([group, title]) => {