@claudecollab/cli 0.1.2 → 0.2.0

package/packages/relay/public/style.css

@@ -475,6 +475,7 @@ body {
 
 /* ── the terminal: full width, glass frame, gradient border ────────────────── */
 .workspace {
+  position: relative; /* the floating ask card anchors here (desktop) */
   flex: 1;
   min-height: 0;
   display: flex;
@@ -562,6 +563,117 @@ body {
       0 24px 60px rgba(0, 0, 0, 0.55), inset 0 1px 0 rgba(255, 255, 255, 0.05);
   }
 }
+/* the ask CARD is the real affordance now — suppress the old "click to answer" pill
+   whenever it is showing so they never overlap (the amber pulse still frames it). */
+#stage.ask.has-ask-card::after {
+  display: none;
+}
+
+/* ── permission ask card: touch-first Approve / Deny (all widths) ─────────────
+   On desktop it FLOATS over the top of the terminal (so the baseline, non-asking
+   layout is untouched); on narrow it leaves the flow and leads the card column. */
+.ask-card {
+  position: absolute;
+  z-index: 9;
+  top: 22px;
+  left: 50%;
+  transform: translateX(-50%);
+  width: min(480px, calc(100% - 48px));
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  padding: 14px 16px;
+  border-radius: 14px;
+  background: rgba(20, 15, 6, 0.92);
+  backdrop-filter: blur(14px);
+  -webkit-backdrop-filter: blur(14px);
+  box-shadow: 0 0 0 1.5px rgba(232, 163, 61, 0.6), 0 18px 44px rgba(0, 0, 0, 0.55);
+  color: var(--text);
+}
+.ask-card[hidden] {
+  display: none;
+}
+.ask-head {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 13.5px;
+  color: var(--text);
+}
+.ask-head b {
+  color: var(--amber-hi);
+  font-weight: 700;
+}
+.ask-badge {
+  flex: 0 0 auto;
+  font-family: var(--mono);
+  font-size: 10.5px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: #1a1205;
+  background: var(--amber);
+  padding: 2px 8px;
+  border-radius: 999px;
+}
+.ask-summary {
+  font-family: var(--mono);
+  font-size: 12px;
+  color: var(--text-dim);
+  background: rgba(0, 0, 0, 0.32);
+  border-radius: 8px;
+  padding: 8px 10px;
+  max-height: 4.5em;
+  overflow: auto;
+  word-break: break-word;
+  white-space: pre-wrap;
+}
+.ask-summary[hidden] {
+  display: none;
+}
+.ask-actions {
+  display: flex;
+  gap: 10px;
+}
+.ask-actions[hidden] {
+  display: none;
+}
+.ask-btn {
+  flex: 1 1 0;
+  min-height: 44px; /* a comfortable touch target */
+  font: inherit;
+  font-weight: 700;
+  font-size: 14px;
+  border: none;
+  border-radius: 10px;
+  cursor: pointer;
+  transition: transform 0.12s var(--spring), filter 0.15s ease;
+}
+.ask-btn:active {
+  transform: scale(0.97);
+}
+.ask-btn.yes {
+  color: #05130c;
+  background: var(--green);
+}
+.ask-btn.yes:hover {
+  filter: brightness(1.08);
+}
+.ask-btn.no {
+  color: var(--red);
+  background: rgba(240, 140, 140, 0.12);
+  box-shadow: inset 0 0 0 1px var(--red-ring);
+}
+.ask-btn.no:hover {
+  background: rgba(240, 140, 140, 0.2);
+}
+.ask-viewnote {
+  font-size: 12px;
+  color: var(--text-faint);
+}
+.ask-viewnote[hidden] {
+  display: none;
+}
 
 /* ── the per-user compose windows: a row beneath Claude's live terminal ──────
    Each column is one person's own space to write a prompt SEPARATELY; the
@@ -628,6 +740,9 @@ body {
 .uw-status.typing {
   color: var(--c, var(--amber));
 }
+.uw-status.waiting {
+  color: var(--blue);
+}
 .uw-body {
   flex: 1;
   min-height: 0;
@@ -637,6 +752,9 @@ body {
   font-size: 12px;
   line-height: 1.55;
   color: var(--text-dim);
+  /* selectable so prompts + responses can be copied out of the window */
+  user-select: text;
+  -webkit-user-select: text;
 }
 .uw-empty {
   color: var(--text-faint);
@@ -648,13 +766,73 @@ body {
   white-space: pre-wrap;
   word-break: break-word;
 }
-.uw-line.sent {
-  color: var(--text-dim);
-}
 .uw-line .uw-n {
   color: var(--text-faint);
   margin-right: 6px;
 }
+
+/* one turn: the person's prompt, then Claude's reply beneath it */
+.uw-turn {
+  margin: 0 0 12px;
+  padding: 0 0 10px;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.05);
+}
+.uw-turn:last-child {
+  border-bottom: none;
+}
+.uw-prompt {
+  color: var(--c, var(--text));
+  font-weight: 600;
+}
+.uw-caret {
+  opacity: 0.7;
+  margin-right: 2px;
+}
+.uw-resp {
+  margin-top: 5px;
+  padding-left: 10px;
+  border-left: 2px solid rgba(255, 255, 255, 0.12);
+  color: var(--text-dim);
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+.uw-resp.running {
+  color: var(--text-faint);
+  font-style: italic;
+  border-left-color: color-mix(in srgb, var(--blue) 50%, transparent);
+}
+.uw-more {
+  display: inline-block;
+  margin-left: 6px;
+  padding: 0;
+  font: inherit;
+  font-size: 11px;
+  color: var(--blue);
+  background: none;
+  border: none;
+  cursor: pointer;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+.uw-more:hover {
+  color: var(--text);
+}
+.uw-queued {
+  color: var(--text-faint);
+  display: flex;
+  align-items: baseline;
+  gap: 6px;
+}
+.uw-badge {
+  font-size: 9.5px;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--amber);
+  border: 1px solid color-mix(in srgb, var(--amber) 40%, transparent);
+  border-radius: 999px;
+  padding: 1px 6px;
+  margin-left: auto;
+}
 .uw-input-wrap {
   flex: 0 0 auto;
   padding: 9px 11px 11px;
@@ -1055,6 +1233,57 @@ body {
   }
 }
 
+/* ── phones (≤700px): card column is primary, the terminal is a scaled secondary
+   surface below it. The cards fingers use — ask, your compose window, and the host's
+   knock chips — lead; the mirror renders scaled-to-width (tap to zoom). ────────── */
+@media (max-width: 700px) {
+  .workspace {
+    padding: 8px;
+    gap: 8px;
+  }
+  /* the terminal steps down from flex:1 to a shorter, scaled secondary panel */
+  #stage {
+    order: 3;
+    flex: 0 0 auto;
+    height: 40vh;
+    min-height: 200px;
+  }
+  /* the ask card leaves the float and LEADS the column, full width */
+  .ask-card {
+    order: 0;
+    position: static;
+    transform: none;
+    top: auto;
+    left: auto;
+    width: 100%;
+  }
+  /* your compose window(s) become the primary surface, stacked full width */
+  .panels-grid {
+    order: 2;
+    height: auto;
+    min-height: 34vh;
+    grid-template-columns: 1fr;
+  }
+  /* bigger touch targets for the header controls fingers reach for */
+  .ctrl {
+    padding: 7px 14px;
+    font-size: 12.5px;
+  }
+  .kbtn {
+    padding: 8px 14px;
+    font-size: 13px;
+  }
+  .av {
+    width: 26px;
+    height: 26px;
+    font-size: 12px;
+    margin-left: -4px;
+  }
+  .knock-chip {
+    width: 100%;
+  }
+}
+
 /* Claude's real cursor in the mirror is the "you type HERE" indicator — but the
    mirror never holds browser focus, so xterm draws it as a hollow outline. Force
    it filled and blinking, like the terminal it mirrors. */

package/packages/relay/rooms.js

@@ -52,13 +52,16 @@ export function createRegistry(opts = {}) {
     return `${base}-${n}`;
   }
 
-  function create() {
+  // A HELLO may request a room cap; it is clamped to [1, relayCap] so a client
+  // can't ask for more seats than the relay allows. Absent request = the relay cap.
+  function create(o = {}) {
+    const roomCap = Number.isFinite(o.cap) ? Math.max(1, Math.min(cap, Math.floor(o.cap))) : cap;
     const code = makeCode();
     const room = {
       code,
       guests: new Map(), // id -> {name, fp, role}
       banned: new Set(), // banned fingerprints
-      cap,
+      cap: roomCap,
       hostPresent: true,
       createdAt: now(),
       _ttlTimer: null, // pending host-drop close timer

package/packages/relay/server.js

@@ -19,7 +19,7 @@ import { createRegistry } from './rooms.js';
 import { secretsMatch } from './auth.js';
 import { startWebDoor } from './web.js';
 import { sanitizeName } from './names.js';
-import { TYPES, encode, validate, Decoder } from '../shared/protocol.js';
+import { TYPES, encode, validate, Decoder, PROTOCOL_V } from '../shared/protocol.js';
 
 const { Server, utils } = ssh2;
 const { parseKey } = utils;
@@ -27,6 +27,12 @@ const { parseKey } = utils;
 const DEFAULT_KNOCK_TIMEOUT_MS = 60 * 1000; // spec: 60s waiting screen
 const DEFAULT_TTL_MS = 10 * 60 * 1000; // spec: hold the code 10 min on host drop
 
+// Per-room ceiling on PENDING (knocked-but-not-yet-admitted) guests. room.pending
+// is otherwise unbounded, so a script could stack knock cards forever without ever
+// being admitted. Sits well above the 8-guest room cap + normal churn; overflow is
+// refused exactly like a deny. Shared by both doors (the web door gets it via ctx).
+export const MAX_PENDING = 12;
+
 // Standard OpenSSH SHA256 fingerprint over the raw public-key blob.
 function fingerprint(keyData) {
   return 'SHA256:' + createHash('sha256').update(keyData).digest('base64').replace(/=+$/, '');
@@ -104,6 +110,10 @@ export function startRelay(opts = {}) {
     // ungated on purpose: it is already bound to the creating host's key
     // fingerprint, and must keep working mid-session if the secret rotates.
     roomSecret,
+    // Trust Fly's `Fly-Client-IP` header for per-IP knock limits. Only safe when
+    // the relay genuinely sits behind Fly's proxy (a direct-exposed relay could be
+    // spoofed by a client-sent header), so it is off unless the operator opts in.
+    trustProxy = false,
     registry: registryOpts = {},
   } = opts;
 
@@ -191,6 +201,15 @@ export function startRelay(opts = {}) {
       switch (msg.t) {
         case TYPES.HELLO: {
           if (code) return; // one room per host connection
+          // Version gate first — the cheapest refusal. A NEWER major than we
+          // speak is refused machine-readably (the CLI tells the user to update);
+          // an older or absent version is served (the relay stays back-compatible).
+          if (msg.v !== undefined && Math.floor(msg.v) > PROTOCOL_V) {
+            safeWrite(stream, encode({ t: TYPES.REFUSED, reason: 'version' }));
+            safeEnd(stream);
+            safeEnd(conn);
+            return;
+          }
           if (roomSecret && !secretsMatch(msg.secret, roomSecret)) {
             // Machine-readable refusal so the CLI can say "bad secret" instead
             // of mistaking this for a dead relay and reconnect-looping.
@@ -206,7 +225,7 @@ export function startRelay(opts = {}) {
             safeEnd(conn);
             return;
           }
-          const room = registry.create();
+          const room = registry.create({ cap: msg.cap });
           code = room.code;
           live.set(code, {
             code,
@@ -397,6 +416,15 @@ export function startRelay(opts = {}) {
       return;
     }
 
+    // Card-spam lid: a full pending queue is refused exactly like a deny, so a
+    // script can't stack knock cards without ever being admitted.
+    if (room.pending.size >= MAX_PENDING) {
+      safeWrite(stream, COPY.denied);
+      safeEnd(stream);
+      safeEnd(conn);
+      return;
+    }
+
     const rec = {
       id: randomUUID(),
       code,
@@ -634,12 +662,15 @@ export function startRelay(opts = {}) {
           address,
           webPort: web ? web.port : null,
           webAddress: web ? web.address : null,
+          // How many rooms are currently live. Lets a caller assert that a lazy host
+          // (one started without --live) dialed nothing and created no room.
+          roomCount: () => live.size,
         });
       };
       // The browser door shares this relay's live rooms + registry, so web
       // participants are real room members subject to the same knock/ban/cap.
       if (webPort == null) return done(null);
-      startWebDoor({ port: webPort, host, live, registry, knockTimeoutMs, onGuestGone, safeWrite }).then(done, (err) => {
+      startWebDoor({ port: webPort, host, live, registry, knockTimeoutMs, onGuestGone, safeWrite, trustProxy, maxPending: MAX_PENDING }).then(done, (err) => {
         try {
           close();
         } catch {

package/packages/relay/web.js

@@ -39,6 +39,10 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 const PUBLIC_DIR = path.join(here, 'public');
 const INDEX_HTML = path.join(PUBLIC_DIR, 'index.html');
 
+// How long a passworded room waits for the client's first {t:'pass'} frame
+// before closing the connection. Generous — a human may be prompted for it.
+const PASS_TIMEOUT_MS = 10000;
+
 // Resolve the vendored xterm package dir through node resolution so monorepo
 // hoisting doesn't matter. `/assets/<rest>` maps to `<xtermDir>/<rest>`.
 const require = createRequire(import.meta.url);
@@ -97,6 +101,24 @@ function wsClose(ws) {
 }
 const sendErr = (ws, reason) => wsSendText(ws, JSON.stringify({ t: 'error', reason }));
 
+/**
+ * The client IP the knock limiter keys on. Behind Fly's proxy every connection's
+ * `req.socket.remoteAddress` is the proxy, so all strangers share ONE lockout
+ * bucket. When the operator declares the deploy sits behind Fly
+ * (CLAUDE_SHARE_TRUST_PROXY=1 → trustProxy), honor the `Fly-Client-IP` header;
+ * otherwise ignore it (a direct-exposed relay must not trust a client-set header).
+ * @param {import('node:http').IncomingMessage} req
+ * @param {boolean} trustProxy
+ * @returns {string}
+ */
+export function clientIp(req, trustProxy) {
+  if (trustProxy) {
+    const h = req.headers['fly-client-ip'];
+    if (typeof h === 'string' && h.length) return h;
+  }
+  return req.socket.remoteAddress || 'unknown';
+}
+
 /**
  * Start the HTTP + WebSocket web door. Shares the live routing state and the
  * registry with the ssh relay so web participants are real room members.
@@ -109,10 +131,13 @@ const sendErr = (ws, reason) => wsSendText(ws, JSON.stringify({ t: 'error', reas
  * @param {number} ctx.knockTimeoutMs       waiting-screen timeout
  * @param {(rec:object)=>void} ctx.onGuestGone  shared guest-teardown (frees seat, LEFTs the host)
  * @param {(stream:any,data:any)=>void} ctx.safeWrite  shared fail-soft writer (to the host stream)
+ * @param {boolean} [ctx.trustProxy]        honor Fly-Client-IP for per-IP knock limits (Fly deploys only)
  * @returns {Promise<{close():void, port:number, address:object}>}
  */
 export function startWebDoor(ctx) {
-  const { port = 0, host = '127.0.0.1', live, registry, knockTimeoutMs, onGuestGone, safeWrite } = ctx;
+  // maxPending's fallback mirrors server.js's MAX_PENDING — startRelay always
+  // supplies it; the default only covers a direct startWebDoor caller (tests).
+  const { port = 0, host = '127.0.0.1', live, registry, knockTimeoutMs, onGuestGone, safeWrite, trustProxy = false, maxPending = 12 } = ctx;
 
   // ---- HTTP: index (SPA-style, room code in the path) + vendored xterm assets
 
@@ -218,7 +243,7 @@ export function startWebDoor(ctx) {
     // and the host writes it verbatim to its terminal / log / session.md and mirrors
     // it to every ssh guest — raw ESC/OSC/BEL bytes here would be escape injection.
     const name = sanitizeName(q.get('name'), isHostTab ? 'host' : 'guest');
-    const ip = req.socket.remoteAddress || 'unknown';
+    const ip = clientIp(req, trustProxy);
 
     // Same gate as the ssh door (spec: respect bans/lockouts/caps identically).
     const room = code ? live.get(code) : null;
@@ -226,14 +251,16 @@ export function startWebDoor(ctx) {
     if (!room.hostPresent) return void (sendErr(ws, 'host-gone'), wsClose(ws));
     if (fp && registry.get(code).banned.has(fp)) return void (sendErr(ws, 'banned'), wsClose(ws));
     if (!registry.tryKnock(code, ip)) return void (sendErr(ws, 'lockout'), wsClose(ws));
-    // Room password pre-gate (mirrors the ssh door's prompt). Host tabs are
-    // exempt: their credential is the host token the brain itself minted — and a
-    // forged `?host=` gains nothing, it just lands as an ordinary pending knock
-    // the host will see and deny. Wrong guesses already burned a tryKnock slot
-    // above, so brute force hits the per-ip lockout fast.
-    if (!isHostTab && room.pass && !secretsMatch(q.get('pass') ?? '', room.pass)) {
-      return void (sendErr(ws, 'password'), wsClose(ws));
-    }
+
+    // Room password pre-gate. Instead of reading `?pass=` off the URL (where it
+    // leaks into proxy/access logs and browser history), a passworded room
+    // challenges over the WIRE: it answers with {t:'pass?'} and waits for the
+    // client's FIRST message, {t:'pass', pass}. Only a match proceeds to the knock.
+    // Host tabs are exempt: their credential is the host token the brain itself
+    // minted — a forged `?host=` gains nothing, it just lands as an ordinary
+    // pending knock the host will deny. The tryKnock slot was already burned above,
+    // so brute force still hits the per-ip lockout fast.
+    const needsPass = !isHostTab && !!room.pass;
 
     const rec = {
       id: randomUUID(),
@@ -242,7 +269,9 @@ export function startWebDoor(ctx) {
       ws,
       fp,
       name,
-      phase: 'knocking', // web skips the ssh name prompt: name arrives in the query
+      // web skips the ssh name prompt (name arrives in the query); a passworded
+      // room parks in 'pass' until the client answers the wire challenge.
+      phase: needsPass ? 'pass' : 'knocking',
       cols: 80, // spec floor; refined by the browser's first {t:'resize'}
       rows: 24,
       knockTimer: null,
@@ -254,24 +283,73 @@ export function startWebDoor(ctx) {
       conn: { end: () => wsClose(ws) },
       sendText: (s) => wsSendText(ws, s), // STATE + the 'joined' signal go as text
     };
-    room.pending.set(rec.id, rec);
 
-    // Knock the host (identical shape to the ssh door). A returning token carries
-    // its prior name in `seen`; brand-new ⇒ null.
-    const priorName = room.seen.get(fp);
-    const seen = priorName !== undefined ? priorName : null;
-    room.seen.set(fp, name);
-    rec.announced = true;
-    safeWrite(room.hostStream, encode({ t: TYPES.KNOCK, id: rec.id, name: rec.name, fp: rec.fp, seen }));
-    rec.knockTimer = setTimeout(() => {
+    // Register the pending rec, KNOCK the host, and arm the admit timer. Deferred
+    // behind the password gate so a passworded room never shows a pending card (or
+    // sends a KNOCK) for a guest that hasn't proven the password yet.
+    function proceedToKnock() {
       if (rec.gone) return;
-      sendErr(ws, 'timeout');
-      wsClose(ws); // 'close' → onGuestGone: drops the seat, LEFTs the host
-    }, knockTimeoutMs);
-    rec.knockTimer.unref?.();
+      // The room may have ended (or its host dropped) while the guest sat at the
+      // password prompt — a pass-phase rec is in neither guests nor pending, so
+      // closeRoom/onHostGone can't reach it. Refuse instead of knocking a dead room.
+      if (live.get(rec.code) !== room) return void (sendErr(ws, 'no-room'), wsClose(ws));
+      if (!room.hostPresent) return void (sendErr(ws, 'host-gone'), wsClose(ws));
+      if (rec.knockTimer) {
+        clearTimeout(rec.knockTimer); // clear the pass-challenge timer, if any
+        rec.knockTimer = null;
+      }
+      // Card-spam lid (mirrors the ssh door): a full pending queue is refused like
+      // a deny, so a script can't stack knock cards without ever being admitted.
+      if (room.pending.size >= maxPending) {
+        return void (sendErr(ws, 'busy'), wsClose(ws));
+      }
+      rec.phase = 'knocking';
+      room.pending.set(rec.id, rec);
+      // A returning token carries its prior name in `seen`; brand-new ⇒ null.
+      const priorName = room.seen.get(fp);
+      const seen = priorName !== undefined ? priorName : null;
+      room.seen.set(fp, name);
+      rec.announced = true;
+      safeWrite(room.hostStream, encode({ t: TYPES.KNOCK, id: rec.id, name: rec.name, fp: rec.fp, seen }));
+      rec.knockTimer = setTimeout(() => {
+        if (rec.gone) return;
+        sendErr(ws, 'timeout');
+        wsClose(ws); // 'close' → onGuestGone: drops the seat, LEFTs the host
+      }, knockTimeoutMs);
+      rec.knockTimer.unref?.();
+    }
+
+    if (needsPass) {
+      wsSendText(ws, '{"t":"pass?"}'); // ask on the wire; client replies {t:'pass'}
+      rec.knockTimer = setTimeout(() => {
+        if (rec.gone) return;
+        sendErr(ws, 'timeout');
+        wsClose(ws);
+      }, PASS_TIMEOUT_MS);
+      rec.knockTimer.unref?.();
+    } else {
+      proceedToKnock();
+    }
 
     ws.on('message', (data, isBinary) => {
       if (isBinary) return; // browsers only send JSON text; screen flows one way
+      // Pre-knock password phase: the FIRST text frame must be {t:'pass', pass}.
+      if (rec.phase === 'pass') {
+        let pm;
+        try {
+          pm = JSON.parse(data.toString('utf8'));
+        } catch {
+          return;
+        }
+        if (!isObj(pm) || pm.t !== 'pass') return;
+        if (secretsMatch(typeof pm.pass === 'string' ? pm.pass : '', room.pass)) {
+          proceedToKnock();
+        } else {
+          sendErr(ws, 'password');
+          wsClose(ws);
+        }
+        return;
+      }
       if (rec.phase !== 'live') return; // ignore input until admitted (ssh parity)
       const r = live.get(rec.code);
       if (!r || !r.hostPresent || !r.guests.has(rec.id)) return;

package/packages/shared/protocol.js

@@ -2,9 +2,15 @@
 // Guests speak no protocol — they exchange raw terminal bytes. Only the host<->relay
 // control channel uses these messages.
 
+// Wire protocol version. Bump on breaking wire changes; the relay refuses NEWER
+// majors with REFUSED reason 'version' (an older/absent v is served — the relay
+// stays backward compatible). One source both sides import.
+export const PROTOCOL_V = 1;
+
 /** Canonical message-type strings (the `t` field of every message). */
 export const TYPES = Object.freeze({
-  HELLO: 'hello', // host->relay: {t:'hello', want:'room', secret?, pass?} — new room (secret = relay
+  HELLO: 'hello', // host->relay: {t:'hello', want:'room', v?, cap?, secret?, pass?} — new room
+  //   (v = protocol version; cap = requested room size, clamped by the relay; secret = relay
   //   room-creation credential; pass = optional per-room JOIN password guests must present)
   RECLAIM: 'reclaim', // host->relay: {t:'reclaim', code}           — take back an existing room after a drop
   ROOM: 'room', // relay->host: {t:'room', code}                    — room granted (create OR reclaim)
@@ -137,8 +143,12 @@ export function validate(obj) {
       // the relay when configured; a plain relay ignores it.
       // pass (optional): a join password for THIS room — the relay stores it and
       // pre-gates every guest (ssh prompt / web form) before the knock is sent.
+      // v/cap (optional): v = the client's protocol version (absent = a
+      // pre-versioning client); cap = a requested room size the relay clamps.
       return (
         obj.want === 'room' &&
+        (obj.v === undefined || isNum(obj.v)) &&
+        (obj.cap === undefined || isNum(obj.cap)) &&
         (obj.secret === undefined || isStr(obj.secret)) &&
         (obj.pass === undefined || isStr(obj.pass))
       );