toolroll 0.9.104 → 0.9.105

package/dist/server/signup-gate.js

@@ -1,21 +1,12 @@
-/** The first-account form's same-site gate and setup-code comparison (Settings revamp S3, Codex round 1).
- *
- * The form is signed out, so it has no session CSRF token. Instead, the page that shows it sets a signed, HttpOnly,
- * SameSite=Strict cookie scoped to /signup; a browser never sends it on a post from another site. A post must carry
- * it, and its provenance must name this console: same-origin Fetch Metadata, or an Origin (or Referer) on an allowed
- * host. Neither (`Origin: null`, nothing else) fails closed; the form's page is served `Referrer-Policy: same-origin`
- * so its own post carries the real Origin. A refusal here never spends a setup-code try. */
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 export const SIGNUP_COOKIE = "so-signup";
 const SECRET = randomBytes(32);
 const NONCE = /^[A-Za-z0-9_-]{24}$/;
 const macOf = (nonce) => createHmac("sha256", SECRET).update(`signup:${nonce}`).digest();
-/** A fresh Set-Cookie value for the page that shows the form. */
 export function signupCookie(secure) {
     const nonce = randomBytes(18).toString("base64url");
     return `${SIGNUP_COOKIE}=${nonce}.${macOf(nonce).toString("base64url")}; HttpOnly; SameSite=Strict; Path=/signup${secure}`;
 }
-/** Whether this post came from the console's own first-account page. */
 export function signupFromHere(request, allowedHost) {
     const site = request.headers["sec-fetch-site"];
     if (site !== undefined && site !== "same-origin" && site !== "none")
@@ -32,8 +23,6 @@ export function signupFromHere(request, allowedHost) {
     const given = Buffer.from(held[2], "base64url"), wanted = macOf(held[1]);
     return given.length === wanted.length && timingSafeEqual(given, wanted);
 }
-/** The typed code against the printed one, in constant time over fixed-length digests: any input (empty, too long,
- * non-ASCII) is an ordinary wrong code, never a throw. */
 export function setupCodeMatches(typed, printed) {
     const digest = (text) => createHash("sha256").update(text, "utf8").digest();
     return typed !== "" && timingSafeEqual(digest(typed), digest(printed));

package/dist/server/sweeps.js

@@ -1,8 +1,3 @@
-/**
- * A lead sweep's table (docs/plans/lead-fan-out.md): every child with its state, its verdict and its result, read from
- * facts on each look (the page follows the console's live beat). The only sweep-wide act is "cancel the rest"; steer,
- * cancel or retry one child is that task's own page.
- */
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { html, postForm } from "../html.js";
 import { cancelSweepRest, sweepLine, sweepOpen, sweepOpenDigest, sweepTable } from "../lead-sweep.js";
@@ -30,7 +25,6 @@ export function createSweepHandlers(runtime) {
       <td>${row.verdict === null ? html `<span class="meta">—</span>` : html `<strong>${row.verdict.verdict}</strong> <span class="meta">${row.verdict.why}</span>`}</td>
       <td>${row.result === null ? "" : html `<a href="/t/${encodeURIComponent(row.result.taskId)}">Result →</a>`}</td>
     </tr>`);
-        // The form names exactly what it would act on (each item's active task, state and attempt): a change is refused.
         const open = sweepOpen(store, table, clock());
         const running = open.filter(one => one.run !== null).length;
         const cancel = who.role !== "approver" || open.length === 0 ? "" : html `<details class="card"><summary>Cancel the rest (${open.length})</summary>${postForm(`/sweeps/${id}/cancel-rest`, html `<p>Cancels ${open.length - running} unfinished item${open.length - running === 1 ? "" : "s"}${running === 0 ? "" : ` and stops ${running} running build${running === 1 ? "" : "s"}`}: ${open.map(one => one.label).join(", ")}. Finished results stay.</p><label class="arm"><input type="checkbox" name="confirm" value="yes" required> Cancel the rest</label><button class="danger">Cancel the rest</button>`, { hidden: { snapshot: sweepOpenDigest(open) } })}</details>`;