style: Cleaned up some minor styling issues

src/sandbox/mcp_credentials.rs

@@ -387,10 +387,6 @@ pub(crate) fn collect_server_allow_entries(
     out.into_iter().collect()
 }
 
-/// The single definition of the sbx kit v2 allow-list entry grammar: https on
-/// the default port yields a bare host, anything else is spelled `host:port`.
-/// Bracketed IPv6 hosts and non-http(s) schemes have no representation in the
-/// grammar and yield `None`.
 pub(crate) fn allow_entry_for_url(raw: &str) -> Option<String> {
     let url = Url::parse(raw).ok()?;
     let scheme = url.scheme();
@@ -465,12 +461,6 @@ struct Network {
     allow: Vec<String>,
 }
 
-/// Serializes one sbx kit v2 mixin document.
-///
-/// Every `inject[].domain` is unioned into `permissions.network.allow`: sbx
-/// does not derive allow entries from inject rules, so a rule whose domain is
-/// not allowed would be dead. Enforcing it here keeps the invariant in one
-/// place for every mixin Coyote generates.
 pub(crate) fn render_mixin_document(
     name: &str,
     description: &str,

src/sandbox/mixins.rs

@@ -73,10 +73,6 @@ pub fn discover() -> Result<Vec<DiscoveredMixin>> {
     for path in collect_subdir_mixins(&paths::agents_data_dir()) {
         out.push(read_mixin(path)?);
     }
-    // RAG sidecars are FLAT files named `<rag>.sbx-mixin.yaml` inside rags/, not
-    // the `<subdir>/sbx-mixin.yaml` shape the two scans above walk. Loaded
-    // unconditionally, mirroring agents/*: a RAG mixin only adds an outbound
-    // allowlist entry for that RAG's host and opens no inbound rules.
     for path in collect_flat_mixins(&paths::rags_dir()) {
         out.push(read_mixin(path)?);
     }
@@ -184,8 +180,6 @@ fn collect_subdir_mixins(dir: &Path) -> Vec<PathBuf> {
     result
 }
 
-/// Mixins stored as flat `<name>.sbx-mixin.yaml` files directly inside `dir`,
-/// matched by suffix rather than by exact filename.
 fn collect_flat_mixins(dir: &Path) -> Vec<PathBuf> {
     let mut result = Vec::new();
     let Ok(rd) = read_dir(dir) else { return result };
@@ -516,16 +510,13 @@ network:
         }
     }
 
-    /// RAG sidecars are flat `<name>.sbx-mixin.yaml` files, matched by SUFFIX.
     #[test]
     fn collect_flat_mixins_matches_rag_sidecars_by_suffix() {
         let root = unique_root("flat-mixins");
         fs::write(root.join("company-docs.sbx-mixin.yaml"), "kind: mixin\n").unwrap();
         fs::write(root.join("alpha.sbx-mixin.yaml"), "kind: mixin\n").unwrap();
-        // The RAGs themselves must not be picked up, only their sidecars.
         fs::write(root.join("company-docs.yaml"), "driver: qdrant\n").unwrap();
         fs::write(root.join("notes.yaml"), "driver: yaml\n").unwrap();
-        // A directory whose name ends in the suffix is not a mixin file.
         fs::create_dir_all(root.join("decoy.sbx-mixin.yaml")).unwrap();
 
         let found = collect_flat_mixins(&root);
@@ -533,7 +524,6 @@ network:
             .iter()
             .map(|p| p.file_name().unwrap().to_str().unwrap())
             .collect();
-        // Sorted by file name, so the order is deterministic.
         assert_eq!(
             names,
             vec!["alpha.sbx-mixin.yaml", "company-docs.sbx-mixin.yaml"]

src/sandbox/mod.rs

@@ -314,11 +314,6 @@ fn inject_mcp_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<Opt
     )?))
 }
 
-/// Registers the API key of every attached RAG with the sbx proxy.
-///
-/// `launch()` has no notion of an active RAG — that is runtime state set by
-/// `--rag` / `.rag` and never persisted — so every attached RAG is scanned
-/// unconditionally, exactly as `inject_mcp_secrets` does for MCP servers.
 fn inject_rag_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<()> {
     let rags_dir = paths::rags_dir();
     if !rags_dir.exists() {
@@ -330,7 +325,6 @@ fn inject_rag_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<()>
             continue;
         }
         let stem = match path.file_stem().and_then(|s| s.to_str()) {
-            // Skip sidecars ("myrag.sbx-mixin.yaml" has stem "myrag.sbx-mixin").
             Some(s) if !paths::is_rag_sidecar_name(s) => s.to_string(),
             _ => continue,
         };
@@ -346,10 +340,6 @@ fn inject_rag_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<()>
         let Some(placeholder) = data.driver_config.get("api_key") else {
             continue;
         };
-        // The sidecar mixin declares `credentials[].service` under the same
-        // derivation, so the bound value and the inject rule that consumes it
-        // always name the same service. Passing the raw stem here would produce
-        // an id sbx rejects for any RAG whose name is not already a valid id.
         let service_id = mcp_credentials::secret_service_id(&stem);
         if service_id.is_empty() || registered.contains(&service_id) {
             continue;
@@ -358,9 +348,7 @@ fn inject_rag_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<()>
             .trim_start_matches("{{")
             .trim_end_matches("}}")
             .trim();
-        // Degrade rather than abort: one stale RAG key must not block the whole
-        // sandbox launch. Queries to that RAG fail with a 401 at runtime, which
-        // is recoverable without a restart.
+
         match vault.get_secret(secret_name, false) {
             Ok(secret_value) => {
                 sbx_secret_set(&service_id, &secret_value)
@@ -375,6 +363,7 @@ fn inject_rag_secrets(vault: &Vault, registered: &HashSet<String>) -> Result<()>
             }
         }
     }
+
     Ok(())
 }