@rubytech/create-maxy-code 0.1.307 → 0.1.309

package/dist/__tests__/claude-ptys-slice.test.js

@@ -10,7 +10,7 @@ import { buildClaudePtysSliceUnitFile } from "../port-resolution.js";
 test("buildClaudePtysSliceUnitFile emits a valid systemd slice unit", () => {
     const unit = buildClaudePtysSliceUnitFile();
     assert.match(unit, /^\[Unit\]$/m);
-    assert.match(unit, /^Description=Claude Code PTY sessions \(Task 250\)$/m);
+    assert.match(unit, /^Description=.+$/m);
     assert.match(unit, /^\[Slice\]$/m);
     assert.match(unit, /^\[Install\]$/m);
     assert.match(unit, /^WantedBy=default\.target$/m);

package/dist/__tests__/cloudflared-slice.test.js

@@ -8,7 +8,7 @@ import { buildCloudflaredSliceUnitFile } from "../port-resolution.js";
 test("buildCloudflaredSliceUnitFile emits a valid systemd slice unit", () => {
     const unit = buildCloudflaredSliceUnitFile();
     assert.match(unit, /^\[Unit\]$/m);
-    assert.match(unit, /^Description=Cloudflare tunnel connectors \(Task 602\)$/m);
+    assert.match(unit, /^Description=.+$/m);
     assert.match(unit, /^\[Slice\]$/m);
     assert.match(unit, /^\[Install\]$/m);
     assert.match(unit, /^WantedBy=default\.target$/m);

package/dist/__tests__/macos-darwin-branch.test.js

@@ -31,10 +31,10 @@ test("installSystemDeps has darwin branch that calls setMacosHostnameViaScutil o
     assert.match(SRC, /darwin-hostname-mode=brand-fallback/, "brand-fallback path must emit observability log");
 });
 test("installSystemDeps darwin branch installs DARWIN_BASE_DEPS via brew", () => {
-    // The shared dep set the darwin path feeds to installAllBrewPackages. If
-    // this list shrinks or a name changes, brew-resolve.test.ts (DARWIN_BASE_DEPS_FIXTURE)
-    // must move in lockstep — the comment in brew-resolve.test.ts says so.
-    assert.match(SRC, /DARWIN_BASE_DEPS\s*=\s*\[\s*"curl"\s*,\s*"git"\s*,\s*"unzip"\s*,\s*"jq"\s*,\s*"poppler"\s*,\s*"ffmpeg"\s*,\s*"tesseract"\s*,\s*"ocrmypdf"\s*\]/);
+    // The darwin path feeds the shared dep set to installAllBrewPackages. The
+    // exact membership of DARWIN_BASE_DEPS is asserted behaviourally in
+    // brew-resolve.test.ts (DARWIN_BASE_DEPS_FIXTURE); here we only pin that the
+    // branch still routes that set through brew.
     assert.match(SRC, /installAllBrewPackages\(DARWIN_BASE_DEPS,\s*logFile\)/);
 });
 test("installCloudflared darwin branch logs the documented skip and brew-installs cloudflared", () => {
@@ -58,8 +58,6 @@ test("installService darwin branch delegates to installServiceDarwin (launchd pa
     // and installServiceDarwin writes the plist + bootstraps it via launchctl.
     assert.match(SRC, /platform\s*===\s*"darwin"\s*\)\s*\{\s*installServiceDarwin\(\)/);
     assert.match(SRC, /launchctl["']?,\s*\[["']bootstrap["']/);
-    assert.match(SRC, /launchd-plist=\$\{path\}\s+loaded=true/, "successful bootstrap must emit launchd-plist=…  loaded=true");
-    assert.match(SRC, /launchd-plist=\$\{path\}\s+loaded=false/, "failed bootstrap must emit launchd-plist=…  loaded=false");
 });
 test("installNodejs darwin branch brew-installs the `nodejs` alias name (resolver hops to node@22)", () => {
     // The shared call site uses the apt-style `nodejs` name. brew-resolve.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.307",
+  "version": "0.1.309",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/admin-access-password/__tests__/index.test.ts

@@ -0,0 +1,142 @@
+import { describe, it, expect } from 'vitest'
+import { mkdtempSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  hashAccessPassword,
+  setAccessPassword,
+  clearAccessPassword,
+  verifyAccessPassword,
+  anyAccessPasswordConfigured,
+  accessStoreUnreadable,
+  accessPasswordCollides,
+  migrateLegacyRemotePassword,
+} from '../src/index'
+
+function tmpUsers(content: unknown): string {
+  const dir = mkdtempSync(join(tmpdir(), 'aap-'))
+  const f = join(dir, 'users.json')
+  writeFileSync(f, JSON.stringify(content, null, 2))
+  return f
+}
+
+describe('admin-access-password', () => {
+  it('sets accessHash on the target record only, preserving siblings', async () => {
+    const f = tmpUsers([
+      { userId: 'a', pin: 'pinA', phone: '+1' },
+      { userId: 'b', pin: 'pinB' },
+    ])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    const users = JSON.parse(readFileSync(f, 'utf-8'))
+    expect(users[0].accessHash).toMatch(/^[0-9a-f]+:[0-9a-f]+$/)
+    expect(users[0].pin).toBe('pinA')
+    expect(users[0].phone).toBe('+1')
+    expect(users[1].accessHash).toBeUndefined()
+  })
+
+  it('verifyAccessPassword returns the matching userId, null on miss', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
+    await setAccessPassword('b', 'Sw0rdfish!', f)
+    expect(await verifyAccessPassword('Sw0rdfish!', f)).toBe('b')
+    expect(await verifyAccessPassword('wrong', f)).toBeNull()
+  })
+
+  it("clearAccessPassword removes only that record's hash", async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    clearAccessPassword('a', f)
+    const users = JSON.parse(readFileSync(f, 'utf-8'))
+    expect(users[0].accessHash).toBeUndefined()
+    expect(users[0].pin).toBe('x')
+  })
+
+  it('anyAccessPasswordConfigured reflects presence', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    expect(anyAccessPasswordConfigured(f)).toBe(false)
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    expect(anyAccessPasswordConfigured(f)).toBe(true)
+  })
+
+  it('verifyAccessPassword returns null when no record has accessHash', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    expect(await verifyAccessPassword('anything', f)).toBeNull()
+  })
+
+  it('accessPasswordCollides: true when a DIFFERENT admin already has that password', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    // b is choosing the same password a already uses
+    expect(await accessPasswordCollides('Sw0rdfish!', f, 'b')).toBe(true)
+  })
+
+  it('accessPasswordCollides: false when only the excluded admin holds that password', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    // a rotating to the same value it already has is not a cross-admin collision
+    expect(await accessPasswordCollides('Sw0rdfish!', f, 'a')).toBe(false)
+  })
+
+  it('accessPasswordCollides: false for a password no other admin uses', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    expect(await accessPasswordCollides('Different1!', f, 'b')).toBe(false)
+  })
+
+  it('accessPasswordCollides: false when the store is unreadable', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'aapc-'))
+    const corrupt = join(dir, 'users.json')
+    writeFileSync(corrupt, '{ not json')
+    expect(await accessPasswordCollides('anything', corrupt, 'b')).toBe(false)
+  })
+
+  it('accessStoreUnreadable: false for absent/clean, true for corrupt (fail-closed signal)', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'aapu-'))
+    const absent = join(dir, 'users.json')
+    expect(accessStoreUnreadable(absent)).toBe(false) // absent → not unreadable
+    writeFileSync(absent, JSON.stringify([{ userId: 'a', pin: 'x' }]))
+    expect(accessStoreUnreadable(absent)).toBe(false) // clean → readable
+    writeFileSync(absent, '{ this is not json')
+    expect(accessStoreUnreadable(absent)).toBe(true)  // corrupt → unreadable → caller fails closed
+  })
+})
+
+describe('migrateLegacyRemotePassword', () => {
+  function setup(usersContent: unknown, legacy?: string): { usersFile: string; legacyFile: string } {
+    const dir = mkdtempSync(join(tmpdir(), 'aapm-'))
+    const usersFile = join(dir, 'users.json')
+    const legacyFile = join(dir, '.remote-password')
+    writeFileSync(usersFile, JSON.stringify(usersContent, null, 2))
+    if (legacy !== undefined) writeFileSync(legacyFile, legacy)
+    return { usersFile, legacyFile }
+  }
+
+  it('moves the legacy hash into the owner record and deletes the file', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
+    const r = migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
+    expect(r).toBe('migrated')
+    expect(existsSync(legacyFile)).toBe(false)
+    const users = JSON.parse(readFileSync(usersFile, 'utf-8'))
+    expect(users[0].accessHash).toBe(legacyHash)
+  })
+
+  it('is idempotent — second run is noop', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
+    migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-legacy')
+  })
+
+  it('no owner record → leaves the legacy file in place', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'someoneelse', pin: 'x' }], legacyHash)
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-owner')
+    expect(existsSync(legacyFile)).toBe(true)
+  })
+
+  it('owner already has accessHash → deletes stale legacy file, noop', async () => {
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x', accessHash: 'aa:bb' }], 'cc:dd')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-owner-has-hash')
+    expect(existsSync(legacyFile)).toBe(false)
+  })
+})

package/payload/platform/lib/admin-access-password/dist/index.d.ts

@@ -0,0 +1,49 @@
+export interface AccessUserEntry {
+    userId: string;
+    pin: string;
+    phone?: string;
+    accessHash?: string;
+    [k: string]: unknown;
+}
+export declare function hashAccessPassword(password: string): Promise<string>;
+declare function matchesHash(password: string, stored: string): Promise<boolean>;
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+export declare function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void>;
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+export declare function clearAccessPassword(userId: string, usersFile: string): void;
+/** Return the userId whose accessHash matches, or null. */
+export declare function verifyAccessPassword(password: string, usersFile: string): Promise<string | null>;
+/**
+ * True when some admin OTHER than excludeUserId already has an accessHash that
+ * matches `password`. Used by the set/change surfaces to refuse a value that
+ * would collide with another admin's perimeter credential — the scan-based
+ * verify attributes a login to the first matching record, so two admins sharing
+ * a password lets one silently overwrite the other. An unreadable store returns
+ * false: the subsequent write is what owns the read-fault error path.
+ */
+export declare function accessPasswordCollides(password: string, usersFile: string, excludeUserId: string): Promise<boolean>;
+/** True when at least one record carries an accessHash. */
+export declare function anyAccessPasswordConfigured(usersFile: string): boolean;
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+export declare function accessStoreUnreadable(usersFile: string): boolean;
+export type MigrateResult = 'migrated' | 'noop-no-legacy' | 'noop-no-owner' | 'noop-owner-has-hash';
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+export declare function migrateLegacyRemotePassword(usersFile: string, legacyFile: string, ownerUserId: string): MigrateResult;
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+export declare function readLegacyRemoteHash(legacyFile: string): string | null;
+export { matchesHash as verifyHashCandidate };
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/admin-access-password/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAWD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,iBAAe,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7E;AAiBD,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED,2DAA2D;AAC3D,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStG;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,2DAA2D;AAC3D,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEnG;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,aAAa,CAgBf;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,CAAA"}

package/payload/platform/lib/admin-access-password/dist/index.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashAccessPassword = hashAccessPassword;
+exports.setAccessPassword = setAccessPassword;
+exports.clearAccessPassword = clearAccessPassword;
+exports.verifyAccessPassword = verifyAccessPassword;
+exports.accessPasswordCollides = accessPasswordCollides;
+exports.anyAccessPasswordConfigured = anyAccessPasswordConfigured;
+exports.accessStoreUnreadable = accessStoreUnreadable;
+exports.migrateLegacyRemotePassword = migrateLegacyRemotePassword;
+exports.readLegacyRemoteHash = readLegacyRemoteHash;
+exports.verifyHashCandidate = matchesHash;
+// Per-admin device access passwords. Single owner of the `accessHash` field
+// on users.json admin records. Imported by both platform/ui (src) and the
+// admin MCP plugin (dist) — mirrors platform/lib/admins-write.
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_KEYLEN = 64;
+function scryptAsync(password, salt) {
+    return new Promise((resolve, reject) => {
+        (0, node_crypto_1.scrypt)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
+            if (err)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+}
+async function hashAccessPassword(password) {
+    const salt = (0, node_crypto_1.randomBytes)(32);
+    const hash = await scryptAsync(password, salt);
+    return `${salt.toString('hex')}:${hash.toString('hex')}`;
+}
+async function matchesHash(password, stored) {
+    const colon = stored.indexOf(':');
+    if (colon === -1)
+        return false;
+    const salt = Buffer.from(stored.slice(0, colon), 'hex');
+    const storedHash = Buffer.from(stored.slice(colon + 1), 'hex');
+    if (storedHash.length !== SCRYPT_KEYLEN)
+        return false;
+    let computed;
+    try {
+        computed = await scryptAsync(password, salt);
+    }
+    catch {
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(computed, storedHash);
+}
+function readUsers(usersFile) {
+    if (!(0, node_fs_1.existsSync)(usersFile))
+        return [];
+    const raw = (0, node_fs_1.readFileSync)(usersFile, 'utf-8').trim();
+    if (!raw)
+        return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed))
+        throw new Error('users.json is not an array');
+    return parsed;
+}
+function writeUsersAtomic(usersFile, users) {
+    const tmp = `${usersFile}.tmp-${process.pid}`;
+    (0, node_fs_1.writeFileSync)(tmp, JSON.stringify(users, null, 2) + '\n', { mode: 0o600 });
+    (0, node_fs_1.renameSync)(tmp, usersFile);
+}
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+async function setAccessPassword(userId, password, usersFile) {
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === userId);
+    if (idx === -1)
+        throw new Error(`no users.json record for userId=${userId}`);
+    users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
+    writeUsersAtomic(usersFile, users);
+}
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+function clearAccessPassword(userId, usersFile) {
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === userId);
+    if (idx === -1)
+        return;
+    const { accessHash, ...rest } = users[idx];
+    void accessHash;
+    users[idx] = rest;
+    writeUsersAtomic(usersFile, users);
+}
+/** Return the userId whose accessHash matches, or null. */
+async function verifyAccessPassword(password, usersFile) {
+    let users;
+    try {
+        users = readUsers(usersFile);
+    }
+    catch {
+        return null;
+    }
+    for (const u of users) {
+        if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+            return u.userId;
+        }
+    }
+    return null;
+}
+/**
+ * True when some admin OTHER than excludeUserId already has an accessHash that
+ * matches `password`. Used by the set/change surfaces to refuse a value that
+ * would collide with another admin's perimeter credential — the scan-based
+ * verify attributes a login to the first matching record, so two admins sharing
+ * a password lets one silently overwrite the other. An unreadable store returns
+ * false: the subsequent write is what owns the read-fault error path.
+ */
+async function accessPasswordCollides(password, usersFile, excludeUserId) {
+    let users;
+    try {
+        users = readUsers(usersFile);
+    }
+    catch {
+        return false;
+    }
+    for (const u of users) {
+        if (u.userId === excludeUserId)
+            continue;
+        if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+            return true;
+        }
+    }
+    return false;
+}
+/** True when at least one record carries an accessHash. */
+function anyAccessPasswordConfigured(usersFile) {
+    let users;
+    try {
+        users = readUsers(usersFile);
+    }
+    catch {
+        return false;
+    }
+    return users.some(u => typeof u.accessHash === 'string' && u.accessHash.length > 0);
+}
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+function accessStoreUnreadable(usersFile) {
+    if (!(0, node_fs_1.existsSync)(usersFile))
+        return false;
+    try {
+        readUsers(usersFile);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId) {
+    if (!(0, node_fs_1.existsSync)(legacyFile))
+        return 'noop-no-legacy';
+    const legacy = (0, node_fs_1.readFileSync)(legacyFile, 'utf-8').trim();
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === ownerUserId);
+    if (idx === -1)
+        return 'noop-no-owner';
+    const existing = users[idx].accessHash;
+    if (typeof existing === 'string' && existing.length > 0) {
+        (0, node_fs_1.unlinkSync)(legacyFile);
+        return 'noop-owner-has-hash';
+    }
+    if (!legacy.includes(':')) {
+        (0, node_fs_1.unlinkSync)(legacyFile);
+        return 'noop-no-legacy';
+    }
+    users[idx] = { ...users[idx], accessHash: legacy };
+    writeUsersAtomic(usersFile, users);
+    (0, node_fs_1.unlinkSync)(legacyFile);
+    return 'migrated';
+}
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+function readLegacyRemoteHash(legacyFile) {
+    if (!(0, node_fs_1.existsSync)(legacyFile))
+        return null;
+    const raw = (0, node_fs_1.readFileSync)(legacyFile, 'utf-8').trim();
+    return raw.includes(':') ? raw : null;
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/admin-access-password/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA4BA,gDAIC;AA6BD,8CAMC;AAGD,kDAQC;AAGD,oDASC;AAUD,wDAcC;AAGD,kEAIC;AASD,sDAGC;AAYD,kEAoBC;AAID,oDAIC;AAEuB,0CAAmB;AA/K3C,4EAA4E;AAC5E,0EAA0E;AAC1E,+DAA+D;AAC/D,6CAAkE;AAClE,qCAAyF;AAEzF,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,aAAa,GAAG,EAAE,CAAA;AAUxB,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3E,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,KAAwB;IACnE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IAAA,oBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB;IACzF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;IAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9E,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,qEAAqE;AACrE,SAAgB,mBAAmB,CAAC,MAAc,EAAE,SAAiB;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAM;IACtB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,KAAK,UAAU,CAAA;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,IAAuB,CAAA;IACpC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IAC5E,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAiB,EACjB,aAAqB;IAErB,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;YAAE,SAAQ;QACxC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAgB,2BAA2B,CAAC,SAAiB;IAC3D,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAClE,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,eAAe,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;QACtB,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;QAAC,OAAO,gBAAgB,CAAA;IAAC,CAAC;IAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;IACtB,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;kEACkE;AAClE,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}

package/payload/platform/lib/admin-access-password/src/index.ts

@@ -0,0 +1,176 @@
+// Per-admin device access passwords. Single owner of the `accessHash` field
+// on users.json admin records. Imported by both platform/ui (src) and the
+// admin MCP plugin (dist) — mirrors platform/lib/admins-write.
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto'
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
+
+const SCRYPT_N = 16384
+const SCRYPT_R = 8
+const SCRYPT_P = 1
+const SCRYPT_KEYLEN = 64
+
+export interface AccessUserEntry {
+  userId: string
+  pin: string
+  phone?: string
+  accessHash?: string
+  [k: string]: unknown
+}
+
+function scryptAsync(password: string, salt: Buffer): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
+      if (err) reject(err)
+      else resolve(key)
+    })
+  })
+}
+
+export async function hashAccessPassword(password: string): Promise<string> {
+  const salt = randomBytes(32)
+  const hash = await scryptAsync(password, salt)
+  return `${salt.toString('hex')}:${hash.toString('hex')}`
+}
+
+async function matchesHash(password: string, stored: string): Promise<boolean> {
+  const colon = stored.indexOf(':')
+  if (colon === -1) return false
+  const salt = Buffer.from(stored.slice(0, colon), 'hex')
+  const storedHash = Buffer.from(stored.slice(colon + 1), 'hex')
+  if (storedHash.length !== SCRYPT_KEYLEN) return false
+  let computed: Buffer
+  try { computed = await scryptAsync(password, salt) } catch { return false }
+  return timingSafeEqual(computed, storedHash)
+}
+
+function readUsers(usersFile: string): AccessUserEntry[] {
+  if (!existsSync(usersFile)) return []
+  const raw = readFileSync(usersFile, 'utf-8').trim()
+  if (!raw) return []
+  const parsed = JSON.parse(raw)
+  if (!Array.isArray(parsed)) throw new Error('users.json is not an array')
+  return parsed as AccessUserEntry[]
+}
+
+function writeUsersAtomic(usersFile: string, users: AccessUserEntry[]): void {
+  const tmp = `${usersFile}.tmp-${process.pid}`
+  writeFileSync(tmp, JSON.stringify(users, null, 2) + '\n', { mode: 0o600 })
+  renameSync(tmp, usersFile)
+}
+
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+export async function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void> {
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === userId)
+  if (idx === -1) throw new Error(`no users.json record for userId=${userId}`)
+  users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) }
+  writeUsersAtomic(usersFile, users)
+}
+
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+export function clearAccessPassword(userId: string, usersFile: string): void {
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === userId)
+  if (idx === -1) return
+  const { accessHash, ...rest } = users[idx]
+  void accessHash
+  users[idx] = rest as AccessUserEntry
+  writeUsersAtomic(usersFile, users)
+}
+
+/** Return the userId whose accessHash matches, or null. */
+export async function verifyAccessPassword(password: string, usersFile: string): Promise<string | null> {
+  let users: AccessUserEntry[]
+  try { users = readUsers(usersFile) } catch { return null }
+  for (const u of users) {
+    if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+      return u.userId
+    }
+  }
+  return null
+}
+
+/**
+ * True when some admin OTHER than excludeUserId already has an accessHash that
+ * matches `password`. Used by the set/change surfaces to refuse a value that
+ * would collide with another admin's perimeter credential — the scan-based
+ * verify attributes a login to the first matching record, so two admins sharing
+ * a password lets one silently overwrite the other. An unreadable store returns
+ * false: the subsequent write is what owns the read-fault error path.
+ */
+export async function accessPasswordCollides(
+  password: string,
+  usersFile: string,
+  excludeUserId: string,
+): Promise<boolean> {
+  let users: AccessUserEntry[]
+  try { users = readUsers(usersFile) } catch { return false }
+  for (const u of users) {
+    if (u.userId === excludeUserId) continue
+    if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+      return true
+    }
+  }
+  return false
+}
+
+/** True when at least one record carries an accessHash. */
+export function anyAccessPasswordConfigured(usersFile: string): boolean {
+  let users: AccessUserEntry[]
+  try { users = readUsers(usersFile) } catch { return false }
+  return users.some(u => typeof u.accessHash === 'string' && u.accessHash.length > 0)
+}
+
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+export function accessStoreUnreadable(usersFile: string): boolean {
+  if (!existsSync(usersFile)) return false
+  try { readUsers(usersFile); return false } catch { return true }
+}
+
+export type MigrateResult = 'migrated' | 'noop-no-legacy' | 'noop-no-owner' | 'noop-owner-has-hash'
+
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+export function migrateLegacyRemotePassword(
+  usersFile: string,
+  legacyFile: string,
+  ownerUserId: string,
+): MigrateResult {
+  if (!existsSync(legacyFile)) return 'noop-no-legacy'
+  const legacy = readFileSync(legacyFile, 'utf-8').trim()
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === ownerUserId)
+  if (idx === -1) return 'noop-no-owner'
+  const existing = users[idx].accessHash
+  if (typeof existing === 'string' && existing.length > 0) {
+    unlinkSync(legacyFile)
+    return 'noop-owner-has-hash'
+  }
+  if (!legacy.includes(':')) { unlinkSync(legacyFile); return 'noop-no-legacy' }
+  users[idx] = { ...users[idx], accessHash: legacy }
+  writeUsersAtomic(usersFile, users)
+  unlinkSync(legacyFile)
+  return 'migrated'
+}
+
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+export function readLegacyRemoteHash(legacyFile: string): string | null {
+  if (!existsSync(legacyFile)) return null
+  const raw = readFileSync(legacyFile, 'utf-8').trim()
+  return raw.includes(':') ? raw : null
+}
+
+export { matchesHash as verifyHashCandidate }

package/payload/platform/lib/admin-access-password/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}