chore(webapp): drop the comments the tests already say

apps/webapp/app/components/dashboard-agent/investigation-winners.test.ts

@@ -1,13 +1,9 @@
-// The map itself is built in `DashboardAgentMessages.tsx`, which can't be imported
-// here (it pulls the chart components and an unbuilt package). What matters for the
-// re-render is the identity rule, which is this module's job.
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 import { reuseWinners, sameOccurrences } from "./investigation-winners";
 
 const source = readFileSync(new URL("./DashboardAgentMessages.tsx", import.meta.url), "utf8");
 
-/** A recompute over a fresh `messages` array: same content, new Map. */
 function recompute(entries: Array<[string, string]>): Map<string, string> {
   return new Map(entries.map(([id, occurrence]) => [id, occurrence]));
 }
@@ -48,7 +44,6 @@ describe("investigation winners identity", () => {
     expect(source).toMatch(/useMemo\(\(\) => winningInvestigationOccurrences\(messages\)/);
     expect(source).toContain("reuseWinners(previous.current, next)");
     expect(source).toContain("useInvestigationWinners(stripped)");
-    // The unmemoized call must be gone from the render path.
     expect(source).not.toMatch(/=\s*winningInvestigationOccurrences\(stripped\)/);
   });
 });

apps/webapp/app/components/dashboard-agent/model-markdown.test.ts

@@ -1,5 +1,3 @@
-// Rendered, not just string-matched: the claim is that the markdown renderer the
-// transcript uses emits no element that fetches a URL.
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { Streamdown } from "streamdown";
@@ -22,7 +20,6 @@ describe("stripModelImages", () => {
   it("renders no fetching element for a reference-style remote image", () => {
     const markdown = `Look: ![chart][beacon]\n\n[beacon]: ${BEACON}\n`;
     const stripped = stripModelImages(markdown);
-    // The image reference is gone, so the definition below it renders nothing.
     expect(stripped).not.toContain("![");
     const html = render(stripped);
     expect(html).not.toMatch(/<img\b/i);

apps/webapp/app/components/dashboard-agent/watch-card.test.ts

@@ -344,8 +344,6 @@ describe("the persisted blocks (§2.2)", () => {
     expect(body.followUp).toEqual(["If it turns out badly, I'll investigate straight away."]);
   });
 
-  // The user asked for email and didn't get it. Saying nothing would leave them believing
-  // an alert is coming.
   it("says out loud when the email the user asked for couldn't be added", () => {
     const body = watchConfirmationBlockBody({
       spec: queueWatchRecommendation("email-sends"),

apps/webapp/test/dashboardAgentClientMetadata.test.ts

@@ -1,9 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-// The `in` proxy is the one path a browser reaches the agent through, and it injects the turn's
-// identity, tenancy and delegated token. Whatever the browser sends must not be able to set any of
-// those fields — not by overwriting them, and not by smuggling in a field the server doesn't own.
-
 const mocks = vi.hoisted(() => ({
   fetch: vi.fn(),
 }));
@@ -112,7 +108,6 @@ describe("dashboard agent `in` proxy — client metadata", () => {
     expect(metadata.environmentName).toBe("dev");
     expect(metadata.apiOrigin).toBe("https://api.trigger.dev");
     expect(metadata.userActorToken).toBe("tr_uat_real");
-    // Not resolved for this project, so the client's pointer must not stand in for it.
     expect(metadata.repoSnapshot).toBeUndefined();
   });
 

apps/webapp/test/dashboardAgentWatchInvestigate.test.ts

@@ -87,8 +87,6 @@ vi.mock("~/db.server", () => ({
   $replica: {},
   sqlDatabaseSchema: undefined,
 }));
-// Stub the lookup, not the row: the route only reads id and type, while a raw
-// Prisma row has to satisfy every column `toAuthenticated` reads.
 vi.mock("~/models/runtimeEnvironment.server", () => ({
   findEnvironmentBySlug: async () => ({ id: "env_1", type: "PRODUCTION" }),
 }));

apps/webapp/test/dashboardAgentWatchWording.test.ts

@@ -122,8 +122,6 @@ describe("renderBlockAsText", () => {
     );
   });
 
-  // The watch is active either way, so the block still confirms it; the email line states
-  // the failure rather than going missing.
   it("renders a confirmation whose email couldn't be attached", () => {
     const spec = specFor("backlog_drain");
     const block = {

apps/webapp/test/rbacFallbackBranch.test.ts

@@ -584,8 +584,6 @@ describe("RBAC fallback — branch header guards", () => {
   );
 });
 
-// A delegated user-actor token is a downgrade of its user, so the fallback must not hand it the
-// blanket ability it hands a PAT — even though neither has a role to consult without a plugin.
 const USER_ACTOR_SECRET = "test-user-actor-secret";
 
 function userActorController(prisma: PrismaClient) {
@@ -630,7 +628,6 @@ describe("RBAC fallback — user-actor tokens", () => {
 
     expect(result.ok).toBe(true);
     if (!result.ok) return;
-    // Reads still work, so the token can reach its own JWT exchange.
     expect(result.ability.can("read", { type: "apiKeys" })).toBe(true);
     expect(result.ability.can("read", { type: "runs" })).toBe(true);
     expect(result.ability.can("write", { type: "envvars" })).toBe(false);
@@ -655,7 +652,6 @@ describe("RBAC fallback — user-actor tokens", () => {
     expect(result.subject).toMatchObject({ type: "userActor", environmentId: "env_1" });
   });
 
-  // The non-UAT fallback path is unchanged: a PAT (the CLI / MCP exchange) stays permissive.
   postgresTest("leaves a personal access token permissive", async ({ prisma }) => {
     const { user } = await createTestOrgProjectWithMember(prisma);
     const rbac = userActorController(prisma);

internal-packages/tsql/src/read-only.test.ts

@@ -2,9 +2,6 @@ import { describe, expect, it } from "vitest";
 import { compileTSQL, parseTSQLSelect, SyntaxError as TSQLSyntaxError } from "./index.js";
 import { column, type TableSchema } from "./query/schema.js";
 
-// TSQL has no write statements at all, so a mutating query cannot parse.
-// These tests pin that, so extending the grammar can't quietly add a write path.
-
 const taskRunsSchema: TableSchema = {
   name: "task_runs",
   clickhouseName: "trigger_dev.task_runs_v2",
@@ -45,7 +42,6 @@ const mutating = [
   ["SYSTEM", "SYSTEM SHUTDOWN"],
 ];
 
-// Shapes that defeat a keyword deny-list but not a grammar without write statements.
 const evasions = [
   ["lower case", "delete from task_runs where id = 'run_1'"],
   ["mixed case", "DeLeTe FROM task_runs WHERE id = 'run_1'"],
@@ -68,15 +64,12 @@ describe("TSQL is read-only by construction", () => {
     expect(() => compileTSQL(query, compileOptions as never)).toThrow();
   });
 
-  // Positive control: the negatives above must fail because they mutate,
-  // not because the parser rejects everything.
+  // Positive control: the negatives must fail because they mutate, not because everything does.
   it("still parses an ordinary SELECT", () => {
     const ast = parseTSQLSelect("SELECT id, status FROM task_runs WHERE status = 'FAILED'");
     expect(ast.expression_type).toBe("select_query");
   });
 
-  // TRUNCATE is a keyword in the lexer because it is a rounding function,
-  // not because a TRUNCATE statement exists.
   it("treats TRUNCATE as a function, not a statement", () => {
     const ast = parseTSQLSelect("SELECT truncate(1.9) FROM task_runs");
     expect(ast.expression_type).toBe("select_query");
@@ -90,9 +83,6 @@ describe("a mutation cannot ride along behind a valid SELECT", () => {
     ["two semicolons", "SELECT id FROM task_runs;; TRUNCATE TABLE task_runs"],
   ];
 
-  // The parser is anchored to EOF, so a trailing statement is rejected rather
-  // than silently dropped. Silently dropping it would also be safe, but it
-  // would hide the smuggling attempt from the caller.
   it.each(smuggled)("rejects a mutation appended after a %s", (_label, query) => {
     expect(() => parseTSQLSelect(query)).toThrow(TSQLSyntaxError);
     expect(() => compileTSQL(query, compileOptions as never)).toThrow();