toolroll 0.9.104 → 0.9.105

package/dist/is-record.js

@@ -1,2 +1 @@
-/** A plain object: not null, not an array. */
 export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/issues.js

@@ -1,34 +1,7 @@
-/**
- * GitHub Issues, through `gh`.
- *
- * No new credential: `gh` is already authenticated on any machine where the
- * rest of this tool works, which is the same reason pull requests are read
- * that way. Nothing here holds a token.
- *
- * Two things it deliberately will not do.
- *
- * **It will not write dependency edges.** GitHub grew native `blocked_by`
- * relations and sub-issues, and the design says to use them *where a
- * capability probe confirms them* — including a `gh` new enough to expose the
- * fields. This adapter has confirmed neither the endpoint shape nor the
- * version behaviour against a live repository, so it refuses instead of
- * guessing, and refuses rather than emulating. An invented edge would make our
- * scheduler disagree with what every human on the repository can see.
- *
- * **It will not reach the network on the scheduler's hot path.** Reading is a
- * round trip per repository, and GitHub allows five thousand authenticated
- * requests an hour; a scheduler polling dependencies for a hundred issues once
- * a minute would exhaust that before doing any real work. §4's answer is a
- * materialised snapshot read out of band, which is the scheduler's job to hold
- * — this module just makes each read explicit and bounded so that when the
- * scheduler arrives it is obvious what costs a network call.
- */
 import { run } from "./exec.js";
 import { ok, no, edgesNotEmulated, describeFailure, parseJson, } from "./backend.js";
 const GH = "gh";
-/** A network round trip; bounded like the pull request read it sits beside. */
 export const ISSUE_TIMEOUT_MS = 20_000;
-/** Enough to see a backlog without paginating. */
 export const DEFAULT_LIMIT = 100;
 export function githubIssues(options) {
     const { repo, runner = run, limit = DEFAULT_LIMIT, timeoutMs = ISSUE_TIMEOUT_MS, deps = "unverified", } = options;
@@ -36,11 +9,6 @@ export function githubIssues(options) {
     return {
         name: "github-issues",
         deps,
-        /**
-         * Every open issue. Without confirmed edges there is no dependency order
-         * to apply, so "ready" here means "open" — which is exactly why a backend
-         * in this state is not an autonomous-scheduling default.
-         */
         async listReady() {
             const result = await call([
                 "issue",
@@ -61,21 +29,12 @@ export function githubIssues(options) {
         },
         async get(id) {
             const result = await call(["issue", "view", id, "--json", "number,title,state"]);
-            // gh returns non-zero for a missing issue, which is an answer rather
-            // than a fault: null means "not there", and the caller can tell that
-            // apart from "we could not ask".
             if (result.code !== 0) {
                 return isMissing(result.stderr) ? ok(null) : no("unreachable", describeFailure(result));
             }
             const task = readIssue(parseJson(result.stdout));
             return task === null ? no("unreadable", "gh returned an issue in a shape we do not know") : ok(task);
         },
-        /**
-         * `gh issue create` prints the new issue's URL and nothing else, so the
-         * number is read back off the end of it. Parsed strictly: a URL we cannot
-         * read means we do not know what was created, and reporting a made-up id
-         * would be worse than reporting the failure.
-         */
         async create(spec) {
             const result = await call([
                 "issue",
@@ -93,13 +52,6 @@ export function githubIssues(options) {
             }
             return ok(number[1]);
         },
-        /**
-         * GitHub has two states, so everything terminal closes and everything
-         * else reopens. The mapping is lossy and says so rather than inventing
-         * labels to carry the difference — a `failed` task and a `done` one look
-         * the same to GitHub, and pretending otherwise would put our vocabulary
-         * into somebody else's tracker.
-         */
         async setState(id, state) {
             const closing = state === "done" || state === "failed" || state === "cancelled";
             const result = await call(["issue", closing ? "close" : "reopen", id]);

package/dist/jsonl-discriminants.js

@@ -1,7 +1,3 @@
-/** Bounded structural metadata for an event whose text may exceed the wire
- * cap. Long JSON strings become null in a small skeleton, but every escape
- * is still validated. JSON.parse proves the remaining structure. Unknown,
- * malformed or over-complex input never earns permission to discard it. */
 export function jsonlDiscriminants() {
     const skeleton = Buffer.allocUnsafe(64 * 1024);
     const token = Buffer.allocUnsafe(256);
@@ -61,8 +57,6 @@ export function jsonlDiscriminants() {
                     escaped = true;
                 else if (byte === 34) {
                     inString = false;
-                    // A long key also becomes null, which is invalid JSON: refuse
-                    // classification rather than invent a possibly colliding key.
                     const value = longString ? Buffer.from("null") : token.subarray(0, tokenSize);
                     for (const one of value)
                         emit(one);

package/dist/keymap.js

@@ -1,14 +1,6 @@
-/** One keymap for the console and the terminal UI (docs/plans/plain-toolroll.md P1.7). A shortcut only ever presses a
- * control the page already rendered, the same press a person's click makes, so any password field or confirm it opens
- * still appears; with no such control on the page the key does nothing. Shortcuts sleep in text fields, with a
- * modifier held, and while the shortcuts list is open. Navigation keys go to a page and post nothing. */
-/** The page's ink act: Approve (the approve control itself, password popover and all) or Accept. */
 export const INK_ACT_SELECTORS = ["[data-ink-approve]", '[data-ink-act="accept"]', "[data-accept-result][data-primary-action]"];
-/** Send back: the control that opens the Send back form (never its submit: the note comes first). */
 export const SEND_BACK_SELECTORS = ['[data-act="request-changes"]', '[data-act="revise"]', 'a.result-feedback-link[href="#request-changes"]'];
-/** Retry: the result's Retry, or the failed box's own Retry form. */
 export const RETRY_SELECTORS = ['[data-act="retry"]', 'form[data-retry] button[type="submit"]', 'form[data-rebuild] button[type="submit"]'];
-/** Plan it: the task page's own plan button (local-owner slice 2). */
 export const PLAN_SELECTORS = ['form[action$="/plan"] button[type="submit"]'];
 export const SHORTCUTS = [
     { keys: "n", says: "new task", web: { kind: "go", href: "/tasks/new" }, tui: "new" },
@@ -21,13 +13,7 @@ export const SHORTCUTS = [
     { keys: "g t", says: "go to Tasks", web: { kind: "go", href: "/tasks" }, tui: "list" },
     { keys: "?", says: "these shortcuts", web: { kind: "help" }, tui: "help" },
 ];
-/** The keys typed, as the help list shows them: "g h" reads "g then h". */
 export const keyWords = (keys) => keys.split(" ").join(" then ");
-/**
- * The console's key routing, as an inline script (it runs inside chromeScript's closure, which defines `show` for the
- * jump-to palette, `toggleHelp`, `helpOpen`, `close` and `go`). Generated from SHORTCUTS, so the table is the only
- * place a key is defined.
- */
 export function webKeymapScript() {
     const single = {}, after = {};
     for (const one of SHORTCUTS) {
@@ -38,11 +24,8 @@ export function webKeymapScript() {
             after[parts[1]] = one.web;
     }
     return `var KEYS=${JSON.stringify(single)},GKEYS=${JSON.stringify(after)};` +
-        // A control a person could press right now: rendered, shown, and not disabled.
         `function pressable(el){if(!el||el.disabled||el.getAttribute("aria-disabled")==="true")return false;` +
         `if(el.closest("[hidden],[inert]"))return false;var r=el.getClientRects();return r.length>0;}` +
-        // Press it exactly as a click would; a submit whose form isn't complete (an empty password, a required reason)
-        // shows the browser's own prompt for it instead of posting.
         `function press(selectors){for(var s=0;s<selectors.length;s++){var all=document.querySelectorAll(selectors[s]);` +
         `for(var i=0;i<all.length;i++){var el=all[i];if(!pressable(el))continue;` +
         `var form=el.form||null;var submits=el.tagName.toLowerCase()==="button"&&(el.type==="submit"||el.getAttribute("type")===null)&&form;` +

package/dist/keys.js

@@ -1,36 +1,15 @@
-/**
- * Provider API keys, managed instead of ambient (the gap the gemini
- * live-auth work exposed): one 0600 file per provider under
- * ~/.toolroll/keys/ (or an older ~/.standing-orders/keys/), written from the settings card or piped into
- * the CLI — never typed into an argv, never rendered back, never stored
- * in the database a backup might carry.
- *
- * The injection contract lives in the invocation gateway: a stored key is
- * added to EXACTLY its own provider's child environment at spawn, where
- * the adapter's foreign-credential strip has already shed everybody
- * else's. The plane's own process never needs the key in its environment
- * at all — a restart or a rotation is a file write, not a relaunch — and
- * an ambient env var still works as the fallback it always was (the file,
- * being deliberate, wins).
- */
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { isAcpProvider } from "./acp-agents.js";
 import { namedPath } from "./names.js";
-/** The ONE env name each provider's own harness reads its key from —
- * where a managed key is INJECTED. */
 export const PROVIDER_KEY_ENV = {
     claude: "ANTHROPIC_API_KEY",
     codex: "OPENAI_API_KEY",
     openrouter: "OPENROUTER_API_KEY",
     gemini: "GEMINI_API_KEY",
 };
-/** EVERY env name a provider reads its OWN key from — what subscription
- * mode STRIPS so an ambient key cannot override the login. gemini reads
- * two; the rest read one. */
 export const OWN_KEY_ENV = {
-    // v105: the bearer-token and Codex-specific aliases bill a key just the same, so a sign-in run sheds them too.
     claude: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"],
     codex: ["OPENAI_API_KEY", "CODEX_API_KEY"],
     openrouter: ["OPENROUTER_API_KEY"],
@@ -39,21 +18,13 @@ export const OWN_KEY_ENV = {
 export function keysDir(home = homedir()) {
     return namedPath(home, ["keys"], { dot: true });
 }
-/** Providers that CAN authenticate without an API key (a subscription or
- * cached login). openrouter cannot — it is api-key only. */
 export const SUBSCRIPTION_CAPABLE = {
     claude: true,
     codex: true,
     gemini: true,
     openrouter: false,
 };
-/** The default when nothing is set: subscription where it exists (prefer
- * the plan the operator already pays for), api-key otherwise. */
 export const DEFAULT_AUTH_MODE = {
-    // Claude and Codex have first-class subscriptions most operators
-    // already pay for — prefer them. Gemini support here is key-based (a
-    // Google cached login is possible but not our road), and openrouter is
-    // key-only — both default to the key. Every default is switchable.
     claude: "subscription",
     codex: "subscription",
     gemini: "api-key",
@@ -75,13 +46,6 @@ export function readAuthMode(provider, home = homedir()) {
         return DEFAULT_AUTH_MODE[provider];
     }
 }
-/**
- * The auth mode as an AUTHORITY reads it (raw authority repair): an absent
- * file is the provider's default, but a file that is present and says
- * neither `subscription` nor `api-key` is a stated problem — never the
- * subscription default a lenient read would coerce it to. A provider with
- * no subscription login is the key, whatever the file says.
- */
 export function readAuthModeStrict(provider, home = homedir()) {
     if (isAcpProvider(provider))
         return { ok: true, mode: "agent-login" };
@@ -92,9 +56,6 @@ export function readAuthModeStrict(provider, home = homedir()) {
         raw = readFileSync(authModeFileFor(provider, home), "utf8");
     }
     catch (error) {
-        // Inside the agents' fence the keys folder is out of reach: Linux masks it (the file reads as absent), and macOS
-        // refuses it (EPERM), which reads the same way — a Toolroll a flow's check zone starts has only its CLIs' own sign-ins.
-        // Any other unreadable file (EACCES: its permissions) is still a stated problem.
         if (error.code === "ENOENT" || error.code === "EPERM")
             return { ok: true, mode: DEFAULT_AUTH_MODE[provider] };
         return { ok: false, problem: `the ${provider} auth-mode file cannot be read (${error.code ?? "error"}) — run \`keys auth ${provider} subscription|api-key\` to restate it` };
@@ -116,8 +77,6 @@ export function setAuthMode(provider, mode, home = homedir()) {
 export function keyFileFor(provider, home = homedir()) {
     return join(keysDir(home), provider);
 }
-/** Shape check only — never a validity claim. A key is printable ASCII
- * without whitespace, bounded; anything else is a paste accident. */
 export function plausibleKey(value) {
     return value.length >= 8 && value.length <= 512 && /^[\x21-\x7e]+$/.test(value);
 }
@@ -127,7 +86,6 @@ export function saveProviderKey(provider, value, home = homedir()) {
         return { ok: false, reason: "implausible" };
     mkdirSync(keysDir(home), { recursive: true, mode: 0o700 });
     writeFileSync(keyFileFor(provider, home), trimmed, { mode: 0o600 });
-    // An existing file keeps its old mode through writeFileSync — restate it.
     chmodSync(keyFileFor(provider, home), 0o600);
     return { ok: true };
 }
@@ -149,9 +107,6 @@ export function clearProviderKey(provider, home = homedir()) {
 }
 const VERIFY_ENDPOINT = {
     gemini: {
-        // The key rides the x-goog-api-key HEADER (round 2, finding 6):
-        // Google's current guidance, and it keeps the secret out of the URL
-        // where a diagnostic or intermediary could surface it.
         url: "https://generativelanguage.googleapis.com/v1beta/models",
         headers: key => ({ "x-goog-api-key": key }),
     },
@@ -187,11 +142,6 @@ export async function verifyProviderKey(provider, value, fetcher = fetch, timeou
     }
     if (response.status === 200)
         return { ok: true };
-    // 401/403 are the auth boundary saying no, on every provider (round 2,
-    // finding 6). A 400 is AMBIGUOUS — malformed request vs a bad key — so
-    // it is a rejection ONLY when the body names a key/auth failure; our
-    // request is a trivial GET, so a 400 that is NOT about the key is a
-    // genuine surprise and reads as `unexpected`, not a false rejection.
     if (response.status === 401 || response.status === 403) {
         return { ok: false, reason: "rejected", status: response.status };
     }
@@ -203,9 +153,6 @@ export async function verifyProviderKey(provider, value, fetcher = fetch, timeou
         catch {
             body = "";
         }
-        // A 400 is a rejection ONLY with an actual NEGATIVE marker near the
-        // key/auth phrase (round 3, finding 6) — "API key not valid" rejects,
-        // but "API key accepted; malformed page size" does not.
         const negativeAuth = /(api[ _]?key[^.]{0,30}(invalid|not valid|expired|missing|revoked))|((invalid|expired|missing|revoked)[^.]{0,20}api[ _]?key)|unauthenticated|permission[ _]denied|invalid authentication|api_key_invalid/;
         if (negativeAuth.test(body)) {
             return { ok: false, reason: "rejected", status: 400 };
@@ -214,7 +161,6 @@ export async function verifyProviderKey(provider, value, fetcher = fetch, timeou
     }
     return { ok: false, reason: "unexpected", status: response.status };
 }
-/** Words for a verdict, safe to render on any surface (never the key). */
 export function verdictWords(provider, verdict) {
     if (verdict.ok)
         return `the ${provider} key works`;
@@ -224,8 +170,6 @@ export function verdictWords(provider, verdict) {
         return `couldn't reach ${provider} to check the key — it is stored; verify later`;
     return `${provider} gave an unexpected response (${verdict.status}) — the key is stored, but unverified`;
 }
-/** What a surface may say about a key: that it exists and when it last
- * changed — NEVER the value, never a prefix, never a length. */
 export function keyStatus(provider, home = homedir()) {
     try {
         const stat = statSync(keyFileFor(provider, home));

package/dist/kits-ui.js

@@ -11,7 +11,6 @@ export const KITS_CSS = `.fl-kit-steps{list-style:none;padding:0;margin:0;displa
 const subagentWords = (kit) => { const template = SUBAGENT_TEMPLATES.find(one => one.id === kit.subagent.template); return template === undefined ? kit.subagent.handle : template.label.toLowerCase(); };
 const agentName = (kit) => kit.subagent.handle.charAt(0).toUpperCase() + kit.subagent.handle.slice(1);
 const kitHref = (kit, repo) => `/kits/${kit.id}?repo=${encodeURIComponent(repo)}`;
-/** "With an agent": every kit as a row; Set it up (or Open, once it's there) goes to the kit's page for `repo`. */
 export function kitRowsHtml(store, repo) {
     const rows = KITS.map(kit => {
         const here = repo !== null && kitInstalled(store, kit, repo) !== null;
@@ -21,7 +20,6 @@ export function kitRowsHtml(store, repo) {
     });
     return html `${group("With an agent", count(KITS.length))}<div data-group="kits">${rows}</div>`;
 }
-/** A kit's own page: what it sets up, Set up (once), then the next step on each line. */
 export function kitPageHtml(store, kit, repo, dir, canSetUp, notice_, projectName = one => one) {
     const steps = kitChecklist(store, kit, repo, dir);
     const set = kitInstalled(store, kit, repo);
@@ -30,7 +28,6 @@ export function kitPageHtml(store, kit, repo, dir, canSetUp, notice_, projectNam
         const go = step.done ? (step.href === null ? "" : btn("Open", { sm: true, href: step.href }))
             : step.action === "sample" || step.action === "github"
                 ? (canSetUp ? postForm(`/kits/${kit.id}/${step.action}`, step.action === "sample" ? btn("Try it", { sm: true, type: "submit" })
-                    // Issues from anyone come in: it takes your password (an ordinary step-up; a session does under Passwordless).
                     : html `${reauth(input({ id: `fl-kit-${step.id}-password`, name: "password", type: "password", attrs: { autocomplete: "current-password", "aria-label": "Your password", placeholder: "Your password" } }))}${btn("Bring them in", { sm: true, type: "submit" })}`, { hidden: { repo } }) : "")
                 : step.href === null ? "" : btn(step.action === "connect" ? "Connect" : "Set up", { sm: true, href: step.href });
         return html `<li data-step="${step.id}" data-done="${String(step.done)}">${step.done ? icon("check", true) : html `<span class="fl-kit-ring" aria-hidden="true"></span>`}<span class="fl-kit-said">${step.said}</span>${go}</li>`;

package/dist/kits.js

@@ -1,14 +1,3 @@
-/**
- * Starter kits: a working setup in one click — a subagent, the flow
- * it works, and the triggers that are safe to add straight away — plus a
- * checklist of what's left (connect email, connect a tool) and a sample card
- * that shows the subagent at work within seconds.
- *
- * A kit adds nothing a person couldn't add by hand, and nothing that acts
- * outside: replies go out only after you approve them, a code change is filed
- * as an ordinary task you approve, and tools start with reading free and
- * writing asking first.
- */
 import { addCardToFlow, flowCardHref, flowDefinitionOf } from "./flow-engine.js";
 import { flowFromSteps } from "./flows.js";
 import { addFlowTriggerTo, githubRepoOf, triggerConfigOf } from "./flow-triggers.js";
@@ -104,20 +93,13 @@ export const KITS = [
     },
 ];
 export const kitOf = (id) => KITS.find(one => one.id === id) ?? null;
-/** A kit set up in a project: its flow (by name) and its subagent, when both are there. */
 export function kitInstalled(store, kit, repo) {
     const mate = store.subagentByHandle(repo, kit.subagent.handle);
     const flow = store.listFlows([repo]).find(one => one.name === kit.flowName && one.state === "active") ?? null;
     return mate === null || flow === null ? null : { flow, mate };
 }
-/**
- * Set a kit up: its subagent (kept if one of that name is already there), its
- * flow, and its button triggers; then its subagent may use whichever of the
- * kit's tools the project already has (reading free, writing asking first).
- */
 export async function setUpKit(store, kit, repo, by, now, dir, io = {}, options = {}) {
     const made = setUpKitNow(store, kit, repo, by, now, dir);
-    // Its tools only with the person's proof (chat-management.md §0a.3); without it, the checklist says to let it use each.
     if (!made.ok || made.said.endsWith("already set up here.") || options.widening !== "proved")
         return made;
     const mate = store.getSubagent(made.subagent);
@@ -126,11 +108,10 @@ export async function setUpKit(store, kit, repo, by, now, dir, io = {}, options
         try {
             await grantTool(store, mate, tool.tool, by, now, io, options);
         }
-        catch { /* it can be given the tool on its page */ }
+        catch { }
     }
     return made;
 }
-/** The same, all at once and without its tools (a chat confirmation is never a grant's proof): its subagent, its flow and its buttons. */
 export function setUpKitNow(store, kit, repo, by, now, dir) {
     const had = kitInstalled(store, kit, repo);
     if (had !== null)
@@ -158,7 +139,6 @@ export function setUpKitNow(store, kit, repo, by, now, dir) {
         addFlowTriggerTo(store, flow, { kind: "button", label: button.label, questions: button.questions, zone: definition.start }, by, now, dir);
     return { ok: true, said: `${kit.name} is ready: ${nameOf(mate)} works its ${kit.flowName} flow.`, flow: flowId, subagent: mate.id };
 }
-/** What's set up and what's left, read fresh each time. */
 export function kitChecklist(store, kit, repo, dir) {
     const set = kitInstalled(store, kit, repo);
     if (set === null)
@@ -169,7 +149,6 @@ export function kitChecklist(store, kit, repo, dir) {
         { id: "flow", done: true, said: `The ${kit.flowName} flow is ready`, href: `/flows/${set.flow.id}` },
     ];
     if (kit.email === true) {
-        // (flow-actions' sendingReady, without its imports: kits load beside the chat actions.)
         const ready = (googleConnected(dir) !== null || readEmailSettings(dir) !== null) && mailboxReady(dir);
         steps.push({ id: "email", done: ready, said: ready ? "Email is connected" : "Connect your email so replies go out and answers come back", href: "/settings/alerts#email" });
     }
@@ -193,7 +172,6 @@ export function kitChecklist(store, kit, repo, dir) {
     steps.push({ id: "sample", done: tried, said: tried ? `${name} has worked a card` : `See ${name} work a sample card`, href: tried ? `/flows/${set.flow.id}` : null, ...(tried ? {} : { action: "sample" }) });
     return steps;
 }
-/** A sample card in the kit's first zone, so its subagent starts on it at once. */
 export function addKitSample(store, kit, repo, by, now) {
     const set = kitInstalled(store, kit, repo);
     if (set === null)
@@ -202,7 +180,6 @@ export function addKitSample(store, kit, repo, by, now) {
     const added = addCardToFlow(store, set.flow, { title: kit.sample.title, description: kit.sample.description, stage: definition?.start ?? null }, by, now);
     return added.ok ? { ok: true, href: flowCardHref(set.flow.id, added.card) } : { ok: false, said: added.message };
 }
-/** Bring new issues from the project's GitHub repository into the kit's flow (issues from anyone, polled). */
 export function addKitGithubTrigger(store, kit, repo, by, now, dir, proved = null) {
     const set = kitInstalled(store, kit, repo);
     const github = githubRepoOf(repo);

package/dist/knowledge-cli.js

@@ -1,4 +1,3 @@
-/** Local source retrieval uses local-file authority. Explicit coordinator credentials narrow it. */
 import { readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { homedir } from 'node:os';
@@ -26,10 +25,8 @@ export const KNOWLEDGE_DESCRIPTORS = [
     { action: 'search', synopsis: 'find bounded source excerpts and relevant code symbols', mutation: 'none', takesQuery: true, flags },
     { action: 'impact', synopsis: 'inspect static imports affected by one file or unambiguous symbol', mutation: 'none', takesQuery: true, flags },
     { action: 'refresh', synopsis: 'refresh the optional local code index; never starts a model or task', mutation: 'identity-idempotent', takesQuery: false, flags },
-    // A person's action: the approver carries saved knowledge from before a project change forward.
     { action: 'apply', synopsis: "carry this project's saved knowledge from before a change forward as a new revision; an approver's --as/--token", mutation: 'identity-idempotent', takesQuery: false, flags: applyFlags, audience: 'operator' },
 ];
-/** `knowledge apply`: the caller has verified `actor` as an approver of `repo` (never the lead). */
 export function runKnowledgeApply(options, context) {
     const command = 'knowledge apply';
     const fail = (reason, message) => { context.write(context.json ? envelopeJson({ ok: false, command, reason, message }) : message); return reason === 'usage' ? 2 : 3; };
@@ -106,7 +103,6 @@ export async function runKnowledgeCommand(positional, options, context) {
         const auth = authenticateCoordinator(context.store, token);
         if (!auth.ok)
             return fail('unauthenticated', 'The coordinator credential is invalid or revoked.');
-        // Compare admitted path identity before any repository/source filesystem read.
         if (!auth.who.repos.includes(resolve(repo)))
             return fail('not-found', 'That project is unavailable to this coordinator.');
         admittedToken = token;

package/dist/knowledge-ui.js

@@ -2,10 +2,7 @@ import { STALE_KNOWLEDGE } from './project-knowledge.js';
 import { html, joinHtml, postForm } from './html.js';
 import { lastIncludedWords } from './memory-use.js';
 import { acts, btn, codeLine, disclose, formRow, input, note, notice, radios, settingsLink, settingsRecord, settingsSection, textarea } from './server/kit.js';
-// Hidden fields as they always were: a missing value is an empty field.
 const fields = (data) => Object.fromEntries(Object.entries(data).map(([k, v]) => [k, String(v ?? '')]));
-/** A section as a frame (after ReUI's Frame, MIT): its heading on the raised well, its body one paper panel. The
- * cards inside become hairline-divided rows of that panel, never cards in a card. */
 export function framedSection(heading, body, extra = '') {
     return html `<section class="${`knowledge frame${extra ? ` ${extra}` : ''}`}"><div class="frame-head"><h2>${heading}</h2></div><div class="frame-panel">${body}</div></section>`;
 }
@@ -35,7 +32,6 @@ export function knowledgeHtml(view, csrf, canManage, draft, error, use = new Map
     const history = view.history.map(h => settingsLink({ href: `/settings/knowledge?repo=${encodeURIComponent(view.repo)}&version=${h.revision}`, title: `Version ${h.revision}`, status: `${h.actor} · ${h.at.slice(0, 16).replace('T', ' ')} UTC` }));
     const problem = error ? notice(error) : '';
     if (view.stale) {
-        // One notice, the saved knowledge on demand, one approver action. Editing waits until it is applied.
         const saved = view.stale.knowledge;
         const review = disclose('Review saved knowledge', joinHtml([html `<pre class="k-scode">${saved.instructions || 'No project instructions.'}</pre>`, ...saved.references.map(ref => disclose(ref.title, html `<pre class="k-scode">${ref.content}</pre>`))]));
         return joinHtml([problem, settingsSection({ id: 'knowledge-stale', title: 'Saved knowledge', body: joinHtml([
@@ -101,7 +97,6 @@ export function proposalsHtml(repo, proposals, status, csrf, canManage, who = ''
         disclose('Read new sessions', joinHtml([note('Run this on this computer:'), codeLine(`toolroll memory propose --repo ${repo}`)])),
     ]);
     const decide = (p, decision, label) => postForm('/settings/knowledge/proposal', btn(label, { sm: true, variant: decision === 'accept' ? 'outline' : 'ghost', type: 'submit' }), { hidden: fields({ repo, proposal: p.id, decision }) });
-    // A lesson note: the facts, the failure line as output, and the person's own words in an edit box that starts as a draft.
     const lessonNote = (p) => settingsRecord({
         title: p.title, sub: html `<span class="k-num">#${p.id}</span> · Lesson note`,
         more: joinHtml([
@@ -131,7 +126,6 @@ export function proposalsHtml(repo, proposals, status, csrf, canManage, who = ''
 const CLEANUP_TITLES = { retire: 'Retire unused', merge: 'Merge duplicates', contradiction: 'Contradiction', 'note-failing': 'Note keeps failing', restore: 'Restore', unmerge: 'Undo merge' };
 const cleanupItem = (p, item) => item.kind === 'decision' ? `Decision #${item.id} · version ${item.revision} · ${item.status}${p.titles[`decision:${item.id}`] ? ` · ${p.titles[`decision:${item.id}`]}` : ''}`
     : item.kind === 'lesson' ? `Lesson #${item.id} · version ${item.version}` : `Reference · knowledge version ${item.revision}`;
-/** Radio choices for a proposal with no default: nothing is pre-selected. */
 const choices = (name, options) => radios({ name, legend: 'Choose one', current: '', items: options.map(([value, label]) => ({ value, label })) });
 export function cleanUpHtml(repo, proposals, manage) {
     const form = (body, hidden) => postForm('/settings/knowledge/tidy', body, { hidden: fields({ repo, ...hidden }) });
@@ -158,14 +152,12 @@ export function cleanUpHtml(repo, proposals, manage) {
             manage ? form(acts(btn('Clean up', { sm: true, type: 'submit' })), { action: 'propose' }) : '',
         ]) });
 }
-/** On a saved version's page: the references that aren't in current knowledge, each back as a new version. */
 export function referenceRestoreHtml(repo, revision, references, manage) {
     if (!manage || references.length === 0)
         return '';
     return settingsSection({ id: 'reference-restore', title: 'References no longer in use', body: joinHtml(references.map(ref => settingsRecord({ title: ref.title,
             action: postForm('/settings/knowledge/tidy', btn('Restore', { sm: true, variant: 'ghost', type: 'submit' }), { hidden: fields({ repo, action: 'reference', target: ref.id, revision }) }) }))) });
 }
-/** Retired decisions, undoable merges and disabled lessons, each with its way back. */
 export function restoreHtml(repo, retired, merges, lessons, manage) {
     if (retired.length + merges.length + lessons.length === 0)
         return '';