isLocalBrokerHost checks an unreachable bare ::1 form the WHATWG URL parser never produces

[JSONbored]

Context

src/orb/broker-client.ts's isLocalBrokerHost (around line 21-23) is:

function isLocalBrokerHost(hostname: string): boolean {
  return hostname === "localhost" || hostname === "127.0.0.1" || (hostname === "::1" || hostname === "[::1]");
}

hostname here is always the .hostname property of a WHATWG URL instance, and the WHATWG URL parser always yields a bracketed hostname for an IPv6 literal — new URL("http://[::1]:8787").hostname is "[::1]", never the bare "::1". test/unit/orb-broker-client.test.ts (line 96) confirms this by only ever exercising the bracketed form. The bare hostname === "::1" arm is therefore unreachable dead code given how this function is actually called in this codebase — harmless today, but misleading to a future reader who might assume both forms are genuinely possible inputs, and it would be silently dropped by any tool that prunes dead branches without a human first understanding why it was there.

Requirements

• Remove the unreachable bare "::1" comparison, simplifying the function to just the two forms that are actually reachable given how hostname is always produced by the WHATWG URL parser: hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]".
• Add a one-line comment noting why only the bracketed IPv6 form is checked (the WHATWG URL parser always brackets an IPv6 hostname), so a future reader doesn't reintroduce the bare form under the mistaken belief it's a distinct, reachable case.
• Do not change the function's externally-observable behavior — this is a dead-code cleanup, not a behavior change. Confirm the existing test at test/unit/orb-broker-client.test.ts:96 still passes unchanged.

Deliverables

• isLocalBrokerHost simplified to remove the unreachable bare "::1" branch, with an explanatory comment.

Test Coverage Requirements

This repo's Codecov patch gate requires 99%+ coverage of changed lines and branches. Since this removes a branch rather than adding one, no new test is strictly required to hit 99% patch coverage on the diff itself, but confirm the existing test/unit/orb-broker-client.test.ts:96 case (the bracketed [::1] form) still exercises the simplified line so the function's real behavior stays covered.

Expected Outcome

isLocalBrokerHost no longer carries a dead comparison arm that could mislead a future reader into thinking the bare "::1" form is a real, reachable input — the function's logic matches what the WHATWG URL parser actually produces.

Links & Resources

• src/orb/broker-client.ts — isLocalBrokerHost, around line 21-23
• test/unit/orb-broker-client.test.ts — existing coverage, line 96

[linear-code]

JSO-5799