@rubytech/create-maxy-code 0.1.460 → 0.1.462

package/payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js

@@ -13,14 +13,15 @@
  *
  *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
  *        stdin/stdout : untouched (JSON-RPC channel)
- *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
+ *        stderr       : process.stderr.write teed → raw sink + passthrough
  *
- * Destinations (Task 706) — unchanged:
- *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
- *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
- *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
- *     spawn) — then the per-date file is the fallback.
+ * Destinations:
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — raw stderr + lifecycle lines.
+ *     The sole raw sink. Task 1721 retired the per-date twin: its date was
+ *     pinned at spawn, no reader ever parsed it, and mcp-stderr-tee wrote the
+ *     same file, so every line landed twice.
+ *   - `${LOG_DIR}/mcp-<name>-nosession.log`      — the same, for a spawn with
+ *     no SESSION_ID (enumeration). One fixed file per server.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
@@ -49,13 +50,13 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
-// spawn) → undefined, and the per-date file is the fallback.
-const perSessionPath = LOG_DIR && SESSION_ID
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
-    : undefined;
-const perDatePath = LOG_DIR
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+// The one raw sink (Task 1721). A sessionless spawn (rc-daemon stamps
+// SESSION_ID='' — rc-daemon.ts:513 — while still stamping LOG_DIR) shares one
+// fixed file per server rather than a date-named one: the date was never read
+// by any reader and named a process lifetime, not a day. Interleaved spawns in
+// the nosession file are separated by the [mcp-helper] op=spawn pid= lines.
+const rawSinkPath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, SESSION_ID ? `mcp-${SERVER_NAME}-${SESSION_ID}.log` : `mcp-${SERVER_NAME}-nosession.log`)
     : undefined;
 // Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
@@ -66,7 +67,7 @@ let exitEmitted = false;
 let exitSignal;
 // The real stderr writer, captured before the tee replaces it. Lifecycle lines
 // and stderr passthrough both go through this so they are never re-teed into
-// the per-date sink nor recursed back into the patched writer.
+// the raw sink nor recursed back into the patched writer.
 const rawStderrWrite = process.stderr.write.bind(process.stderr);
 // LOG_DIR is created once, lazily, on the first successful append — not per
 // chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
@@ -115,7 +116,7 @@ function postToServerLog(suffix, level) {
 // log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
-    appendSafe(perSessionPath, line);
+    appendSafe(rawSinkPath, line);
     try {
         rawStderrWrite(line);
     }
@@ -127,12 +128,11 @@ if (!ENTRY) {
     process.exit(2);
 }
 // Replace process.stderr.write with a tee: mirror every server stderr byte to
-// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// the raw sink, keep a rolling tail for op=exit, emit
 // op=boot on the first bytes, then pass the write through to the real stderr.
 const teeWrite = ((...args) => {
     const chunk = args[0];
-    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    appendSafe(rawSinkPath, chunk); // raw sink (Task 1721)
     const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
     stderrTail = (stderrTail + text).slice(-TAIL_CAP);
     if (!bootEmitted) {

package/payload/platform/plugins/browser/lib/mcp-spawn-tee/index.js

@@ -13,14 +13,15 @@
  *
  *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
  *        stdin/stdout : untouched (JSON-RPC channel)
- *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
+ *        stderr       : process.stderr.write teed → raw sink + passthrough
  *
- * Destinations (Task 706) — unchanged:
- *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
- *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
- *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
- *     spawn) — then the per-date file is the fallback.
+ * Destinations:
+ *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — raw stderr + lifecycle lines.
+ *     The sole raw sink. Task 1721 retired the per-date twin: its date was
+ *     pinned at spawn, no reader ever parsed it, and mcp-stderr-tee wrote the
+ *     same file, so every line landed twice.
+ *   - `${LOG_DIR}/mcp-<name>-nosession.log`      — the same, for a spawn with
+ *     no SESSION_ID (enumeration). One fixed file per server.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
  *     the [mcp-helper] lifecycle lines.
  *
@@ -49,13 +50,13 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
-// spawn) → undefined, and the per-date file is the fallback.
-const perSessionPath = LOG_DIR && SESSION_ID
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
-    : undefined;
-const perDatePath = LOG_DIR
-    ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
+// The one raw sink (Task 1721). A sessionless spawn (rc-daemon stamps
+// SESSION_ID='' — rc-daemon.ts:513 — while still stamping LOG_DIR) shares one
+// fixed file per server rather than a date-named one: the date was never read
+// by any reader and named a process lifetime, not a day. Interleaved spawns in
+// the nosession file are separated by the [mcp-helper] op=spawn pid= lines.
+const rawSinkPath = LOG_DIR
+    ? (0, node_path_1.resolve)(LOG_DIR, SESSION_ID ? `mcp-${SERVER_NAME}-${SESSION_ID}.log` : `mcp-${SERVER_NAME}-nosession.log`)
     : undefined;
 // Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
@@ -66,7 +67,7 @@ let exitEmitted = false;
 let exitSignal;
 // The real stderr writer, captured before the tee replaces it. Lifecycle lines
 // and stderr passthrough both go through this so they are never re-teed into
-// the per-date sink nor recursed back into the patched writer.
+// the raw sink nor recursed back into the patched writer.
 const rawStderrWrite = process.stderr.write.bind(process.stderr);
 // LOG_DIR is created once, lazily, on the first successful append — not per
 // chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
@@ -115,7 +116,7 @@ function postToServerLog(suffix, level) {
 // log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
-    appendSafe(perSessionPath, line);
+    appendSafe(rawSinkPath, line);
     try {
         rawStderrWrite(line);
     }
@@ -127,12 +128,11 @@ if (!ENTRY) {
     process.exit(2);
 }
 // Replace process.stderr.write with a tee: mirror every server stderr byte to
-// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// the raw sink, keep a rolling tail for op=exit, emit
 // op=boot on the first bytes, then pass the write through to the real stderr.
 const teeWrite = ((...args) => {
     const chunk = args[0];
-    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    appendSafe(rawSinkPath, chunk); // raw sink (Task 1721)
     const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
     stderrTail = (stderrTail + text).slice(-TAIL_CAP);
     if (!bootEmitted) {

package/payload/platform/plugins/cloudflare/PLUGIN.md

@@ -44,7 +44,7 @@ The plugin registers no agent-facing MCP tools. Every Cloudflare operation is th
 | [api.md](references/api.md) | Cloudflare API library — canonical docs URL + curated endpoint map (DNS, zones, tunnels, token list/create/verify/revoke), the advanced master-token creation walkthrough, the account-scoped secrets-file storage convention, the agent's reuse-a-stable-per-scope-token discipline, and the standing reconcile pass that revokes strays. |
 | [d1-data-capture.md](references/d1-data-capture.md) | Form → Pages Function → D1 store → read/sweep. The Pages-Edit **and** D1-Edit token-scope requirement, `wrangler d1 create`/`execute --remote`, the `swept` column, plus the establishment discipline: `<accountId>-<purpose>` naming, one store per purpose, and the canonical `acceptances` schema. |
 | [r2-object-storage.md](references/r2-object-storage.md) | R2 buckets under the same establishment discipline as D1: `<accountId>-<purpose>` naming via `cf-store-name.sh`, one bucket per purpose, `wrangler r2 bucket create`, and the store-provision breadcrumb. |
-| [hosting-sites.md](references/hosting-sites.md) | Deploy a static or Next.js site to Cloudflare Pages via `wrangler pages deploy`. |
+| [hosting-sites.md](references/hosting-sites.md) | Deploy a static or Next.js site to Cloudflare Pages via `wrangler pages deploy`. House/single-tenant path: on a multi-tenant install a client account is denied the `pages` scope (`reason=not-house`) and publishes with `storage-broker:storage-pages-deploy` instead. |
 | [web-analytics.md](references/web-analytics.md) | Why a registered site reports 0 visitors — the RUM API is blocked (no permission group), registered ≠ collecting, edge auto-injection is impossible for a Pages-only custom domain, and the beacon must be injected into the site HTML, rebuilt, and redeployed. Outcome: beacon present in live HTML. |
 | [dashboard-guide.md](references/dashboard-guide.md) | Click-paths for operations the operator prefers to do by hand — sign in, switch accounts, add a site, edit an apex CNAME, verify nameservers, delete a tunnel, manage CNAME records, author an Access policy. |
 | [reset-guide.md](references/reset-guide.md) | Decision tree for reset vs. patch, the exact `pkill` incantation for token-mode connectors, and the dashboard cleanup paths for stray records and rogue entries. |

package/payload/platform/plugins/cloudflare/bin/portal-enrol.mjs

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+// Enrol one person into a data portal: mint a passcode, hash it, print the
+// passcode once, and emit the INSERT.
+//
+// This exists because "generate a high-entropy passcode" in a skill's prose is
+// not a constraint — an agent satisfies that sentence with a six-digit number.
+// The strength now lives in code (template/functions/api/_lib/passcode.mjs), and
+// this is the entry point that applies it. Hashing a passcode any other way
+// bypasses the pinned length, so enrolment runs through here.
+//
+// It deliberately stops at emitting SQL. Running `wrangler d1 execute` itself
+// would put the script's only path behind a Cloudflare credential and a network,
+// which makes it untestable; the skill pipes stdout instead.
+//
+// The stream split is load-bearing, not cosmetic. stdout is SQL and NOTHING else,
+// so it pipes straight into wrangler. The passcode goes to stderr: the operator
+// still reads it off their terminal, but no pipe can carry it into wrangler,
+// which would echo it back inside a syntax error — a plaintext passcode in a log
+// is the one thing enrolment must never produce.
+//
+// Usage:
+//   node platform/plugins/cloudflare/bin/portal-enrol.mjs --owner <ownerId> --name <name> \
+//     | npx wrangler d1 execute <db> --remote --file=-
+
+import {
+  PASSCODE_LENGTH,
+  generatePasscode,
+  hashPasscode,
+  randomSaltHex,
+} from '../skills/data-portal/template/functions/api/_lib/passcode.mjs'
+
+/** The isolation rule is that an R2 key starts with `<ownerId>/`, so an ownerId
+ * containing a separator would let one person read another's files. The gate
+ * enforces this too; enrolment refuses rather than minting a row the gate will
+ * later reject. */
+const OWNER_ID = /^[a-z0-9-]+$/
+
+/** @param {string} message */
+function die(message) {
+  console.error(`portal-enrol: ${message}`)
+  process.exit(1)
+}
+
+/** @param {string} flag @returns {string | undefined} */
+function arg(flag) {
+  const i = process.argv.indexOf(flag)
+  return i === -1 ? undefined : process.argv[i + 1]
+}
+
+const ownerId = arg('--owner')
+const name = arg('--name')
+
+if (!ownerId) die('--owner <id> is required')
+if (!name) die('--name <name> is required')
+if (!OWNER_ID.test(/** @type {string} */ (ownerId))) {
+  die(`--owner must match ${OWNER_ID.source} — the isolation gate rejects anything else`)
+}
+// A newline in the name would split the one statement stdout promises to be.
+// It is not an injection — SQLite has no escape but '' and a newline sits inside
+// the literal harmlessly — but it breaks the pipeable contract, so refuse it.
+if (/[\r\n]/.test(/** @type {string} */ (name))) die('--name cannot contain a line break')
+
+const saltBytes = new Uint8Array(16)
+crypto.getRandomValues(saltBytes)
+const saltHex = randomSaltHex(saltBytes)
+
+const passcode = generatePasscode()
+const hash = await hashPasscode(passcode, saltHex)
+
+// Doubled single quotes: the only SQL literal here not already constrained to a
+// charset is the name, which comes from an operator.
+const sqlName = /** @type {string} */ (name).replace(/'/g, "''")
+const createdAt = new Date().toISOString()
+
+// stdout: the statement, alone, pipeable.
+//
+// An upsert, not a bare INSERT, because `ownerId` is TEXT PRIMARY KEY and
+// re-running this script for an existing person IS the rotation path — the only
+// one there is. A bare INSERT dies on the UNIQUE violation inside wrangler, a
+// separate process, AFTER this script has already printed a new passcode and
+// exited 0: the operator hands out a passcode that never worked, believing the
+// leaked one is revoked, while it and its sessions keep resolving. Rotation is
+// precisely the case where a remedy that silently no-ops is worse than none.
+//
+// `createdAt` is deliberately absent from the DO UPDATE: it records when the
+// person was enrolled, and rotating a passcode is not creating a person.
+console.log(
+  `INSERT INTO people (ownerId, name, salt, hash, createdAt) VALUES ('${ownerId}', '${sqlName}', '${saltHex}', '${hash}', '${createdAt}') ON CONFLICT(ownerId) DO UPDATE SET name=excluded.name, salt=excluded.salt, hash=excluded.hash;`,
+)
+
+// stderr: everything for the human. Never stdout — see the note at the top.
+console.error(`passcode: ${passcode}`)
+console.error('')
+console.error(
+  `Give the passcode to ${name} out of band, and do not store it anywhere. It is ${PASSCODE_LENGTH} characters and it is not recoverable — re-running this rotates it, which also revokes their live sessions.`,
+)

package/payload/platform/plugins/cloudflare/mcp/__tests__/auth-route.test.ts

@@ -1,10 +1,16 @@
 import { describe, it, expect, vi, afterEach } from 'vitest'
 import { processAuth } from '../../skills/data-portal/template/functions/api/auth'
-import { hashPasscode } from '../../skills/data-portal/template/functions/api/_lib/passcode'
+import {
+  generatePasscode,
+  hashPasscode,
+} from '../../skills/data-portal/template/functions/api/_lib/passcode.mjs'
 import type { PortalEnv } from '../../skills/data-portal/template/functions/api/_lib/types'
 
 const SALT = '000102030405060708090a0b0c0d0e0f'
-const ITER = 1000
+// Real passcodes, because hashPasscode now refuses anything below the pinned
+// strength — 'right' and 'wrong' would throw before they ever reached a route.
+const RIGHT = generatePasscode()
+const WRONG = generatePasscode()
 const IP = '203.0.113.7'
 
 async function envWith(people: Array<{ ownerId: string; passcode: string }>, attemptCount = 0) {
@@ -12,8 +18,7 @@ async function envWith(people: Array<{ ownerId: string; passcode: string }>, att
     people.map(async (p) => ({
       ownerId: p.ownerId,
       salt: SALT,
-      hash: await hashPasscode(p.passcode, SALT, ITER),
-      iterations: ITER,
+      hash: await hashPasscode(p.passcode, SALT),
     })),
   )
   const sessions: unknown[][] = []
@@ -57,10 +62,10 @@ afterEach(() => vi.restoreAllMocks())
 
 describe('processAuth', () => {
   it('accepts the right passcode and mints a session', async () => {
-    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
+    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const lines: string[] = []
     const res = await processAuth(
-      { ownerId: 'alice', passcode: 'right' },
+      { ownerId: 'alice', passcode: RIGHT },
       env,
       (l) => lines.push(l),
       () => 'sess-1',
@@ -74,10 +79,10 @@ describe('processAuth', () => {
   })
 
   it('denies the wrong passcode and mints no session', async () => {
-    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
+    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const lines: string[] = []
     const res = await processAuth(
-      { ownerId: 'alice', passcode: 'wrong' },
+      { ownerId: 'alice', passcode: WRONG },
       env,
       (l) => lines.push(l),
       () => 'sess-1',
@@ -90,9 +95,9 @@ describe('processAuth', () => {
   })
 
   it('denies an unknown owner without revealing that it is unknown', async () => {
-    const { env } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
+    const { env } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const res = await processAuth(
-      { ownerId: 'nobody', passcode: 'right' },
+      { ownerId: 'nobody', passcode: RIGHT },
       env,
       () => {},
       () => 'sess-1',
@@ -106,10 +111,10 @@ describe('processAuth', () => {
   })
 
   it('rate-limits before comparing the passcode', async () => {
-    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: 'right' }], 5)
+    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: RIGHT }], 5)
     const lines: string[] = []
     const res = await processAuth(
-      { ownerId: 'alice', passcode: 'right' },
+      { ownerId: 'alice', passcode: RIGHT },
       env,
       (l) => lines.push(l),
       () => 'sess-1',
@@ -122,63 +127,72 @@ describe('processAuth', () => {
   })
 
   it('never logs the passcode', async () => {
-    const { env } = await envWith([{ ownerId: 'alice', passcode: 'sup3rsecret' }])
+    const { env } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const lines: string[] = []
     await processAuth(
-      { ownerId: 'alice', passcode: 'sup3rsecret' },
+      { ownerId: 'alice', passcode: RIGHT },
       env,
       (l) => lines.push(l),
       () => 'sess-1',
       1_000_000,
       IP,
     )
-    expect(lines.join('\n')).not.toContain('sup3rsecret')
+    expect(lines.join('\n')).not.toContain(RIGHT)
   })
 
   it('rejects a malformed body', async () => {
-    const { env } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
+    const { env } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const res = await processAuth({} as never, env, () => {}, () => 'sess-1', 1_000_000, IP)
     expect(res.status).toBe(400)
   })
 
-  it('derives a passcode even for an unknown owner, closing the timing oracle', async () => {
+  it('hashes for an unknown owner too, closing the timing oracle', async () => {
     // The identical DENIED payload is cosmetic on its own: an unknown owner
-    // returning after one D1 read (~5ms) while a known one derives PBKDF2
-    // (~250ms) enumerates the enrolled people outright. Both paths must pay.
-    const spy = vi.spyOn(crypto.subtle, 'deriveBits')
-
-    const known = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'alice', passcode: 'x' }, known.env, () => {}, () => 's', 1_000_000, IP)
-    const derivesForKnown = spy.mock.calls.length
+    // returning after one D1 read while a known one also hashes enumerates the
+    // enrolled people outright. Both paths must pay.
+    //
+    // 1689 closed a ~5ms-vs-250ms gap here. 1708 replaced PBKDF2 with one
+    // SHA-256, shrinking the gap to a measured 43.8us — still inside the band
+    // remote timing attacks have been shown to resolve, so the dummy stays. A
+    // call count is the right instrument: it is deterministic where a clock is
+    // not, and it fails if someone drops the dummy without restoring the cost.
+    // Both envs are built BEFORE the spy: envWith hashes its own fixtures, and
+    // counting that setup work would let the two totals match without the route
+    // hashing at all.
+    const known = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    const unknown = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    const spy = vi.spyOn(crypto.subtle, 'digest')
+
+    await processAuth({ ownerId: 'alice', passcode: WRONG }, known.env, () => {}, () => 's', 1_000_000, IP)
+    const hashesForKnown = spy.mock.calls.length
     spy.mockClear()
 
-    const unknown = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'nobody', passcode: 'x' }, unknown.env, () => {}, () => 's', 1_000_000, IP)
-    const derivesForUnknown = spy.mock.calls.length
+    await processAuth({ ownerId: 'nobody', passcode: WRONG }, unknown.env, () => {}, () => 's', 1_000_000, IP)
+    const hashesForUnknown = spy.mock.calls.length
 
-    expect(derivesForKnown).toBeGreaterThan(0)
-    expect(derivesForUnknown).toBe(derivesForKnown)
+    expect(hashesForKnown).toBeGreaterThan(0)
+    expect(hashesForUnknown).toBe(hashesForKnown)
   })
 
   it('scopes the rate limiter on owner AND ip, so one caller cannot lock out another', async () => {
     // Keyed on the owner alone the counter is a weapon: six unauthenticated
     // requests naming a person lock that person out of their own portal.
-    const { env, scopes } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'alice', passcode: 'right' }, env, () => {}, () => 's', 1_000_000, IP)
+    const { env, scopes } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    await processAuth({ ownerId: 'alice', passcode: RIGHT }, env, () => {}, () => 's', 1_000_000, IP)
     expect(scopes[0]).toBe(`alice|${IP}`)
     expect(String(scopes[0])).toContain(IP)
   })
 
   it('clears the counter on a successful sign-in, so a person cannot self-lock', async () => {
-    const { env, cleared } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'alice', passcode: 'right' }, env, () => {}, () => 's', 1_000_000, IP)
+    const { env, cleared } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    await processAuth({ ownerId: 'alice', passcode: RIGHT }, env, () => {}, () => 's', 1_000_000, IP)
     expect(cleared.length).toBe(1)
     expect(cleared[0][0]).toBe(`alice|${IP}`)
   })
 
   it('does not clear the counter on a failed sign-in', async () => {
-    const { env, cleared } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'alice', passcode: 'wrong' }, env, () => {}, () => 's', 1_000_000, IP)
+    const { env, cleared } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    await processAuth({ ownerId: 'alice', passcode: WRONG }, env, () => {}, () => 's', 1_000_000, IP)
     expect(cleared.length).toBe(0)
   })
 
@@ -186,18 +200,18 @@ describe('processAuth', () => {
     // sessions carries pcCheck; resolveSession joins people and requires it to
     // still match. Rotation changes the hash, so old sessions die by
     // construction rather than by an operator remembering a cleanup step.
-    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
-    await processAuth({ ownerId: 'alice', passcode: 'right' }, env, () => {}, () => 's', 1_000_000, IP)
-    const expected = (await hashPasscode('right', SALT, ITER)).slice(0, 16)
+    const { env, sessions } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
+    await processAuth({ ownerId: 'alice', passcode: RIGHT }, env, () => {}, () => 's', 1_000_000, IP)
+    const expected = (await hashPasscode(RIGHT, SALT)).slice(0, 16)
     // bind order: sessionId, ownerId, pcCheck, expiresAt, createdAt
     expect(sessions[0][2]).toBe(expected)
   })
 
   it('quotes the owner in log lines, so a crafted ownerId cannot forge one', async () => {
-    const { env } = await envWith([{ ownerId: 'alice', passcode: 'right' }])
+    const { env } = await envWith([{ ownerId: 'alice', passcode: RIGHT }])
     const lines: string[] = []
     const forged = 'x result=ok\n[data-portal] op=auth owner=alice result=ok'
-    await processAuth({ ownerId: forged, passcode: 'y' }, env, (l) => lines.push(l), () => 's', 1_000_000, IP)
+    await processAuth({ ownerId: forged, passcode: WRONG }, env, (l) => lines.push(l), () => 's', 1_000_000, IP)
     // Exactly one line, and the injected newline must not have started another.
     expect(lines.length).toBe(1)
     expect(lines[0].split('\n').length).toBe(1)