toolroll 0.9.104 → 0.9.105

package/dist/orphan-sweep.js

@@ -1,28 +1,10 @@
-/**
- * Orphans Toolroll left running (the daily storage sweep, storage-sweep.ts): a process whose parent is gone (parent
- * pid 1) that runs from inside a task checkout whose run has ended, or from inside a test temp root whose suite is
- * gone — a preview server a run started and never stopped (Oct 4: `astro preview --port 4399` from a toolroll-site
- * checkout, 4 days on), a browser a killed journey left. It is stopped with whatever it started (SIGTERM, then
- * SIGKILL after the grace), and each one is in the ledger.
- *
- * "Runs from inside" is its working folder or its executable, read from the OS (lsof on macOS, /proc on Linux) —
- * never its arguments, which can carry private provider inputs. An observation that can't be read stops nothing.
- *
- * Never touched: anything whose parent is alive (a person's shell, the lead's deploy), anything at a terminal, the
- * live service and its ancestry, anything in a checkout leased or with a live run, a process born after its
- * checkout was let go (somebody started it since), anything in a temp root whose owner still runs or that something
- * touched within the day, and anything outside Toolroll's checkouts and test temp roots. Each target is looked at
- * again right before the signal: the same process (pid and birth), still an orphan, still inside.
- */
 import { execFileSync } from "node:child_process";
 import { existsSync, readlinkSync, realpathSync } from "node:fs";
 import { basename, sep } from "node:path";
 import { processCensus, protectedProcesses, stopProcesses } from "./run-closeout.js";
 import { tempOwner, testTempFolders } from "./test-temp.js";
 const DAY_MS = 86_400_000;
-/** `ps` ages are whole seconds. */
 const BIRTH_SLACK_MS = 2_000;
-/** Working folder and executable of each pid: /proc on Linux, lsof on macOS. Throws when the OS can't be asked. */
 export function locateProcesses(pids) {
     const found = new Map();
     if (pids.length === 0 || process.platform === "win32")
@@ -33,11 +15,11 @@ export function locateProcesses(pids) {
             try {
                 one.cwd = readlinkSync(`/proc/${pid}/cwd`);
             }
-            catch { /* gone, or not ours */ }
+            catch { }
             try {
                 one.exe = readlinkSync(`/proc/${pid}/exe`);
             }
-            catch { /* gone, or not ours */ }
+            catch { }
             if (one.cwd !== undefined || one.exe !== undefined)
                 found.set(pid, one);
         }
@@ -49,7 +31,6 @@ export function locateProcesses(pids) {
             text = execFileSync("lsof", ["-nP", "-a", "-p", pids.slice(at, at + 400).join(","), "-d", "cwd,txt", "-Fpfn"], { encoding: "utf8", timeout: 30_000, maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
         }
         catch (error) {
-            // lsof exits 1 when some pid has gone or can't be read; what it printed still stands. No output at all: unreadable.
             const out = error.stdout;
             if (typeof out !== "string" || error.status !== 1)
                 throw new Error("lsof could not list working folders");
@@ -66,7 +47,6 @@ export function locateProcesses(pids) {
                 fd = line.slice(1);
             else if (line.startsWith("n") && pid > 0) {
                 const one = found.get(pid) ?? {};
-                // The first txt is the executable; the rest are libraries it loaded.
                 if (fd === "cwd")
                     one.cwd = line.slice(1);
                 else if (fd === "txt" && one.exe === undefined)
@@ -82,10 +62,9 @@ function canonical(path) {
     try {
         real = realpathSync(path);
     }
-    catch { /* gone */ }
+    catch { }
     return [...new Set([path, real])];
 }
-/** The root `located` runs from inside of, if any (its working folder first, then its executable). */
 export function rootOf(located, roots) {
     if (located === undefined)
         return null;
@@ -99,10 +78,6 @@ export function rootOf(located, roots) {
     }
     return null;
 }
-/**
- * Which processes go: each orphan (parent 1, no terminal, not protected) running from inside a root — for a checkout,
- * born before it was let go — and every process descending from one that goes (none at a terminal or protected).
- */
 export function orphanTargets(census, located, roots, guard) {
     const safe = (row) => row.pid > 1 && !row.terminal && !guard.pids.has(row.pid) && !guard.groups.has(row.pgid);
     const out = new Map();
@@ -116,7 +91,6 @@ export function orphanTargets(census, located, roots, guard) {
             continue;
         out.set(row.pid, { row, root, orphan: row.pid });
     }
-    // Whatever an orphan that goes started goes with it.
     const children = new Map();
     for (const row of census)
         children.set(row.ppid, [...(children.get(row.ppid) ?? []), row]);
@@ -132,15 +106,10 @@ export function orphanTargets(census, located, roots, guard) {
     }
     return [...out.values()];
 }
-/** Whether a temp root's owner (pid and start) is still the running process. */
 export function ownerRunning(census) {
     const byPid = new Map(census.map(row => [row.pid, row]));
     return owner => { const now = byPid.get(owner.pid); return now !== undefined && Math.abs(now.bornAt - owner.startedAt) <= BIRTH_SLACK_MS; };
 }
-/**
- * The roots orphans may be stopped from now: every checkout let go with no live run on its task and not held, and
- * every test temp root whose owner is gone or that nothing touched for a day.
- */
 export function sweepRoots(store, pool, census, tempRoots, now) {
     const roots = [];
     const live = store.handle.prepare("SELECT 1 FROM run WHERE task_ref = ? AND finished_at IS NULL LIMIT 1");
@@ -166,7 +135,6 @@ export function sweepRoots(store, pool, census, tempRoots, now) {
     }
     return roots;
 }
-/** Stop the orphans Toolroll left (see the top of this file), each in the ledger. */
 export async function sweepOrphans(store, now, options = {}) {
     if (process.platform === "win32")
         return { stopped: [], failed: [] };
@@ -196,8 +164,6 @@ export async function sweepOrphans(store, now, options = {}) {
     const first = orphanTargets(census, located, roots, guard);
     if (first.length === 0)
         return { stopped: [], failed };
-    // Right before the signal, everything again: the same process, still an orphan (or under one), still inside a root
-    // that is still one (no run or lease took its checkout since, nothing live uses it).
     let again;
     try {
         const fresh = read();

package/dist/page-work-contract.js

@@ -1,5 +1,2 @@
-/** The work the app and the server agree on. A workspace read says it with `x-toolroll-work`; a reader that does not
- * say exactly this version (an older tab) gets the page as a document with its script string, as before. A hint, never
- * authority. It moves whenever a kind is added: 2 added `result`. */
 export const PAGE_WORK_VERSION = 2;
 export const PAGE_WORK_HEADER = "x-toolroll-work";

package/dist/password-bearer.js

@@ -1,18 +1,13 @@
 import { PACKAGE_VERSION } from "./version.js";
-/** The one replacement every machine-credential refusal names. */
 export const TOKEN_REPLACEMENT = "Create an API token with `toolroll tokens create`";
-/** The first release that refuses a password on a request; 0.9.58 deprecated it with a warning. */
 export const PASSWORD_BEARER_REFUSED_FROM = "0.10.0";
 export const PASSWORD_BEARER_WARNING = `Signing in with a password on each request is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
-/** What the CLI says on stderr when a saved connection signs in with a password instead of an API token. */
 export const PASSWORD_PROFILE_WARNING = `Warning: this connection signs in with your password on each request, which is deprecated and stops working in Toolroll ${PASSWORD_BEARER_REFUSED_FROM}. ${TOKEN_REPLACEMENT}, then connect again with --token-stdin.`;
 export const PASSWORD_BEARER_REFUSED = `Toolroll no longer accepts a password on a request. ${TOKEN_REPLACEMENT} and send it as the bearer instead.`;
-/** Whether an Authorization header is a password bearer: a name and a secret, never an API token. */
 export function isPasswordBearer(authorization) {
     return authorization !== undefined && /^Bearer (.+):(.+)$/.test(authorization) && !/^Bearer so_/.test(authorization);
 }
 const parts = (version) => (/^(\d+)\.(\d+)\.(\d+)/.exec(version) ?? [0, 0, 0, 0]).slice(1).map(Number);
-/** Whether this build still accepts a password bearer: only a release before PASSWORD_BEARER_REFUSED_FROM does. */
 export function passwordBearerAccepted(version = PACKAGE_VERSION) {
     const have = parts(version), limit = parts(PASSWORD_BEARER_REFUSED_FROM);
     for (let index = 0; index < 3; index++)
@@ -20,11 +15,6 @@ export function passwordBearerAccepted(version = PACKAGE_VERSION) {
             return have[index] < limit[index];
     return false;
 }
-/**
- * The refusal boundary for one password-bearer request, whichever adapter answers it: the deprecation is announced in
- * headers (RFC 9745 Deprecation, and a Warning naming the replacement), and any refusal's words, plain text or a JSON
- * `message`, gain the replacement. Successful answers are left byte for byte.
- */
 export function announcePasswordBearer(response) {
     response.setHeader("Deprecation", "true");
     response.setHeader("Warning", `299 toolroll "${PASSWORD_BEARER_WARNING.replace(/"/g, "'")}"`);
@@ -48,7 +38,7 @@ function annotated(body) {
                     return JSON.stringify({ ...row, error_description: `${row["error_description"]} ${PASSWORD_BEARER_WARNING}` });
             }
         }
-        catch { /* not JSON after all: plain text below */ }
+        catch { }
         return body;
     }
     return body.trimStart().startsWith("<") ? body : `${body.replace(/\s+$/, "")}\n${PASSWORD_BEARER_WARNING}`;

package/dist/passwordless.js

@@ -1,7 +1,5 @@
 export const PASSWORDLESS_ACTION = "passwordless changed";
-/** Read live at every act: a change takes effect on the next one. */
 export function passwordlessSetting(store) {
-    // Fail closed: a setting that can't be read is off (a step-up then asks for the password, as it always did).
     let row;
     try {
         row = store.handle.prepare("SELECT actor, at, outcome FROM action_ledger WHERE repo IS NULL AND task_id IS NULL AND action = ? ORDER BY id DESC LIMIT 1").get(PASSWORDLESS_ACTION);
@@ -14,7 +12,6 @@ export function passwordlessSetting(store) {
     return { on: row["outcome"] === "on", setBy: String(row["actor"]), at: String(row["at"]) };
 }
 export const passwordlessOn = (store) => passwordlessSetting(store).on;
-/** An operator's act (the caller proves it: on takes a typed password, off is one click). The ledger keeps before → after. */
 export function setPasswordless(store, on, by, now) {
     if (passwordlessOn(store) === on)
         return { changed: false };

package/dist/peek-cli.js

@@ -1,19 +1,3 @@
-/**
- * `toolroll peek` — the terminal multiplexer over live agents.
- *
- * One pane per open run: its task, worker, role, stage word, elapsed
- * clock, and the tail of its live transcript (the same per-run file the
- * console's run page follows: what the agent said and each step it took —
- * a command's text only where its project shows commands, never file
- * contents, credential shapes redacted at write and again at read). Digits focus one pane, `a` shows all, `q`
- * leaves. No dependency: the screen is the alternate buffer and a
- * handful of escape sequences. `--tmux` opens a real tmux session with one
- * window per run for people who live there. Outside a TTY (or with
- * `--json`) it prints one snapshot and exits — the same data, an envelope.
- *
- * Read-only by construction: nothing here writes to the store or the
- * files; a peek is a look.
- */
 import { spawn } from "node:child_process";
 import { liveWindowLines, readLiveWindow } from "./live.js";
 import { validKeyTail } from "./live-records.js";
@@ -22,17 +6,6 @@ import { sleep } from "./sleep.js";
 export const PEEK_TAIL_LINES = 400;
 const ESC = "\u001b";
 const REPLACED = { offset: 0, lines: ["[the live view was replaced — starting over]"], state: "replaced" };
-/**
- * Advance one run's tail from its offset; `replaced` resets visibly. The
- * offset always moves by the bytes read, even when nothing in them shows
- * (a finished step, a skipped line), and an offset is only ever used
- * against the file it came from. `commands` is the run's own captured
- * "Show commands" answer (store.ts runLiveCommands), read now: lines cached
- * under any other answer (off, on, or unknown) are dropped and the file is
- * read again from its start under this one, on every path — nothing
- * projected with command detail outlives the answer turning off, and a
- * recovered answer shows the detail again.
- */
 export function advanceTail(root, runId, previous, commands) {
     const tail = previous.commands !== commands && (previous.lines.length > 0 || previous.offset > 0)
         ? { offset: 0, lines: [], state: "not-yet" }
@@ -50,7 +23,6 @@ export function advanceTail(root, runId, previous, commands) {
     const lines = [...tail.lines, ...fresh].slice(-PEEK_TAIL_LINES);
     return { offset: read.nextOffset, lines, state: lines.length === 0 ? "not-yet" : "live", gen: read.gen, inKey: keys.inKey, keyTail: keys.tail, commands };
 }
-/** The stage word for a pane: the machine's own phase, or what precedes it. */
 export function stageWord(run) {
     if (run.phase !== null)
         return run.phase.replace(/-/g, " ");
@@ -62,7 +34,6 @@ export function elapsedWords(startedAt, now) {
     const seconds = Math.floor((ms % 60_000) / 1000);
     return minutes >= 60 ? `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m` : `${minutes}m${String(seconds).padStart(2, "0")}s`;
 }
-/** One snapshot of every live run — the envelope's body, and the TUI's first frame. */
 export function snapshotLiveRuns(store, root, now, tails = new Map()) {
     const panes = [];
     for (const run of store.liveRuns(now)) {
@@ -90,7 +61,6 @@ export function snapshotLiveRuns(store, root, now, tails = new Map()) {
     }
     return panes;
 }
-// ---- the frame --------------------------------------------------------------
 function fit(text, width) {
     const chars = [...text];
     if (chars.length <= width)
@@ -104,11 +74,6 @@ function header(pane, index, now, width, focused) {
     const line = `${fit(left, room)} ${right}`;
     return `${ESC}[7m${focused ? `${ESC}[1m` : ""}${fit(line, width)}${ESC}[0m`;
 }
-/**
- * Compose one frame: panes stacked, each with a header and as many tail
- * lines as its share of the rows allows; the focused pane takes the whole
- * screen. Pure — the loop paints what this returns.
- */
 export function composeFrame(panes, size, focus, now) {
     const columns = Math.max(20, size.columns);
     const rows = Math.max(4, size.rows);
@@ -140,10 +105,6 @@ export function composeFrame(panes, size, focus, now) {
     out.push(footer);
     return out.slice(0, rows).join("\n");
 }
-/**
- * Follow live runs until `q` (or, watching one run, until it finishes).
- * Resolves with the exit code.
- */
 export async function runPeek(store, root, options) {
     const { io } = options;
     const clock = options.clock ?? (() => new Date());
@@ -200,12 +161,6 @@ export async function runPeek(store, root, options) {
     }
     return 0;
 }
-// ---- tmux -------------------------------------------------------------------
-/**
- * A real tmux session, one window per live run, each running `peek <run>`
- * — for people who already live in tmux. The plane never becomes tmux's
- * dependant: liveness stays in the store's leases, and this is a view.
- */
 export async function openInTmux(panes, command, run, session = "toolroll") {
     if (panes.length === 0)
         return { ok: false, message: "no run is open — nothing to open a window for" };
@@ -223,7 +178,6 @@ export async function openInTmux(panes, command, run, session = "toolroll") {
     }
     return { ok: true, windows: panes.length };
 }
-/** Hand the terminal to tmux and wait for it to come back. */
 export function attachTmux(session = "toolroll") {
     return new Promise(resolve => {
         const child = spawn("tmux", ["attach", "-t", session], { stdio: "inherit" });

package/dist/peek.js

@@ -1,32 +1,7 @@
-/**
- * The live peek's NATIVE reader (attended finding 7, CRITICAL): the whole
- * point of this module is what it does not do. No git invocation ever has
- * the agent's worktree as its working tree; nothing here consults
- * gitattributes, hooks, clean/process filters, or external diff drivers —
- * the mechanisms finding 7 proved can execute repository-configured
- * commands. Change detection is a git-blob sha1 computed IN PROCESS against
- * the frozen base tree.
- *
- * Two layers, deliberately separated: the PURE core (sha1, parsers,
- * aggregation — bytes in, structures out) and ONE I/O function,
- * observeWorktree — descriptor-DISCIPLINED, not descriptor-confined: Node
- * has no openat, so traversal is by pathname and a same-UID attacker
- * renaming ancestors mid-walk can misdirect it (round-3 finding 44 owns
- * the honest disclosure). What IS held: files open O_NOFOLLOW|O_NONBLOCK
- * and must fstat as regular files on the root's device before a byte is
- * read; reads go through that descriptor, bounded to the accepted size,
- * with growth re-checked after; directories must prove the root's device
- * before descent; symlinks are never followed; `.git` is never entered;
- * every cap is explicit; unreadable corners make the look PARTIAL rather
- * than silently narrower. Guarding, caching, and serving stay with their
- * owners (serve.ts).
- */
 import { createHash } from "node:crypto";
 import { open, opendir, readlink } from "node:fs/promises";
 import { constants } from "node:fs";
 import { join } from "node:path";
-/** git's own blob identity: sha1 over "blob <len>\0" + bytes. Computing it
- * here is what lets change detection never ask git about a working tree. */
 export function gitBlobSha1(bytes) {
     return createHash("sha1")
         .update(`blob ${bytes.length}\0`)
@@ -41,10 +16,6 @@ export function aggregateNewNames(paths, groupAt = 10, rowCap = 200) {
         bucket.push(path);
         bySegment.set(segment, bucket);
     }
-    // The HARD row cap covers grouped rows too (round-2 finding 31): many
-    // eleven-file groups must saturate the cap exactly like loose names —
-    // an agent choosing segment names cannot amplify the output. Largest
-    // groups first, so saturation drops the least information.
     const grouped = [];
     const loose = [];
     for (const [segment, bucket] of bySegment.entries()) {
@@ -149,21 +120,9 @@ export const PEEK_LIMITS = {
     maxHashedBytes: 64 * 1_048_576,
     deadlineMs: 3_000,
 };
-/** The lease marker every occupied checkout carries — ours, never news. */
 const LEASE_MARKER = ".standing-orders-lease";
-/**
- * One best-effort observation of a working tree against its frozen base
- * (v2 brief §2). Descriptor-confined throughout: directories via opendir
- * handles, files via O_NOFOLLOW descriptors, sizes from fstat on the OPEN
- * descriptor (never a path-racy stat), bytes hashed through the same
- * descriptor. Symlinks are typed by lstat-equivalent dirent info and never
- * opened. Nothing here writes, spawns, or evaluates anything.
- */
 export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
     const started = Date.now();
-    // Device pinning (round-2 finding 27 mitigation): the root's filesystem
-    // is the only one this walk will ever read from — a symlinked or
-    // bind-mounted escape onto another device is reported, never read.
     let rootDevice;
     try {
         const rootHandle = await open(root, constants.O_RDONLY | constants.O_DIRECTORY);
@@ -182,8 +141,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
     const seen = new Set();
     const rows = [];
     let rowOverflow = 0;
-    // ONE combined bound over every row kind (finding 38): past it, rows are
-    // counted, not collected — the fragment states the exact overflow.
     const push = (row) => {
         if (rows.length >= limits.maxRows)
             rowOverflow += 1;
@@ -206,9 +163,7 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
         }
         const relative = stack.pop();
         if (gitlinks.has(relative))
-            continue; // a vendored repo is opaque, like git treats it
-        // Directories prove the root's device BEFORE descent (finding 44): a
-        // swapped ancestor pointing cross-device is typed, never enumerated.
+            continue;
         if (relative !== "") {
             try {
                 const gate = await open(join(root, relative), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -263,9 +218,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                     else if (inBase.mode !== "120000")
                         push({ kind: "changed", path, detail: "became a link" });
                     else {
-                        // The link's TARGET is the tracked content: readlink never
-                        // follows, and a 120000 blob's bytes are exactly the target
-                        // string — so the in-process sha decides (finding 34).
                         try {
                             const target = await readlink(join(root, path));
                             if (gitBlobSha1(Buffer.from(target, "utf8")) !== inBase.sha) {
@@ -276,7 +228,7 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                             push({ kind: "unchecked", path, detail: "link target could not be read" });
                         }
                     }
-                    continue; // never opened, never followed
+                    continue;
                 }
                 if (!entry.isFile()) {
                     seen.add(path);
@@ -293,9 +245,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                     push({ kind: "changed", path, detail: "was a link, now a file" });
                     continue;
                 }
-                // The file: O_NOFOLLOW descriptor; size and mode from fstat ON that
-                // descriptor; bytes through it. A path swapped underneath yields a
-                // typed miss, never a follow.
                 let handle;
                 try {
                     handle = await open(join(root, path), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -311,8 +260,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                         continue;
                     }
                     if (!stat.isFile()) {
-                        // A FIFO or device node planted at a tracked path: opened
-                        // non-blocking, typed, and never read (finding 44).
                         push({ kind: "unchecked", path, detail: "not a regular file — not read" });
                         continue;
                     }
@@ -327,7 +274,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                         continue;
                     }
                     if (stat.size > limits.maxFileBytes) {
-                        // Same size, too big to hash: SAID, never silently "unchanged".
                         push({ kind: "unchecked", path, detail: "same size, too large to verify live" });
                         sizeOnly += 1;
                         continue;
@@ -337,8 +283,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
                         unverified += 1;
                         continue;
                     }
-                    // Read AT MOST the size fstat accepted (finding 33): a file
-                    // growing underneath is a change, not an unbounded read.
                     const hash = createHash("sha1").update(`blob ${stat.size}\0`);
                     const buffer = Buffer.alloc(65_536);
                     let position = 0;
@@ -374,8 +318,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
             }
         }
         catch {
-            // Iteration died mid-stream: this corner was not fully seen, so the
-            // look is partial and the deleted sweep must not run (finding 44).
             push({ kind: "unchecked", path: relative, detail: "directory could not be fully read" });
             partialDirs += 1;
         }
@@ -388,7 +330,6 @@ export async function observeWorktree(root, base, limits = PEEK_LIMITS) {
         }
     }
     else {
-        // A timed-out walk cannot distinguish "deleted" from "not reached".
     }
     const notes = [];
     if (partial !== null)

package/dist/people-audit-ui.js

@@ -1,15 +1,9 @@
-/**
- * People → a person: their API tokens, each with its standing and last use, and their recent remote actions
- * (remote-audit.ts). A token's name filters the actions to it (`token-name`: a `token` query is always refused). Read-only: making, revoking and rotating tokens stay
- * in Settings → Sessions & tokens. Never a token's secret or a ledger line's raw detail.
- */
 import { settingsSubPage } from "./settings-groups-ui.js";
 import { basename } from "node:path";
 import { tokenStatus } from "./remote-audit.js";
 import { html, joinHtml } from "./html.js";
 import { acts, btn, chip, note, settingsRecord, settingsSection } from "./server/kit.js";
 const stamp = (value) => `${value.slice(0, 16).replace("T", " ")} UTC`;
-/** The old look; the page is built from the kit now. Kept for chrome.ts, which still concatenates it. */
 export const PEOPLE_AUDIT_CSS = "";
 export const personHref = (name, more = {}) => `/people?${new URLSearchParams({ person: name, ...more }).toString()}`;
 export function personAuditHtml(view) {

package/dist/person-proof.js

@@ -1,15 +1,9 @@
-/** Every credential method, classified: a person proved now (or by their own remembered sign-in), or a machine
- * credential standing in for them. A new method fails to compile here until someone decides which it is. */
 const METHOD_IS_PERSON = {
     "password-now": true, "sso-now": true, "fresh-password": true, "fresh-sso": true, "session": true, "cli-login": true,
     "remote-token": false, "lead-token": false,
-    // Easy-start C1: the laptop's own owner in an allowlisted act — a person, standing only while local mode stays on at
-    // the generation it was given under (approval-authority.ts localSealStandsSql).
     "local-owner": true,
 };
-/** Proofs that aren't credential methods: the paired-chat tap, and the phone plan's passkey ceremony. */
 const OTHER_PERSON_PROOFS = new Set(["chat", "passkey"]);
-/** Whether a recorded proof is a person's. A runtime string: a missing, corrupt or future value is never a person. */
 export function personProof(proof) {
     if (typeof proof !== "string")
         return false;