co-maintainer 0.4.2 → 0.4.4

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "co-maintainer",
-    "version": "0.4.2",
+    "version": "0.4.4",
     "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
     "license": "MIT",
     "repository": {

package/dist/src/cli/commands/serve.d.ts

@@ -1,9 +1,12 @@
 import type { UserConfig } from "../../config.ts";
-import type { AuthMethods } from "../../server/auth.ts";
+import type { AuthMethods, PasswordStore } from "../../server/auth.ts";
 import { type Platform } from "../../util/runtime.ts";
 /** `undefined` on Linux, otherwise one line naming the platform (a pure
  * function so it is testable without actually being off Linux). */
 export declare function platformWarning(os: Platform): string | undefined;
+/** `--password=` replaces the stored password. With no flag the stored one is
+ * kept, and a first start generates one, returned so the caller can print it. */
+export declare function ensureDashboardPassword(args: string[], hasStoredPassword: boolean, store: PasswordStore): Promise<string | undefined>;
 /** `--disable-auth=password` / `--enable-auth=github` always win over the
  * config defaults `co-maintainer set` persisted; dies if the result would
  * leave no sign-in method active. Pure so it is testable without a server. */

package/dist/src/cli/commands/serve.js

@@ -1,12 +1,15 @@
 import { readConfig } from "../../config.js";
 import { appDbPath, closeAppDb, openAppDb } from "../../store/app_db.js";
 import { createApp } from "../../server/app.js";
+import { configPasswordStore } from "../../server/auth.js";
 import { recoverOrphans, startWorkerLoop, stopWorkerLoop, } from "../../services/jobs.js";
 import { registerSetupJobHandler } from "../../services/setup.js";
 import { registerReviewJobHandler } from "../../services/review.js";
 import { recoverReplyRequests, registerReplyJobHandler, } from "../../services/replies.js";
+import { startRemakeScheduler, stopRemakeScheduler, } from "../../services/remake_cron.js";
 import { registerRemoteReviewHandler } from "../../services/remote_review.js";
 import { startRemoteWatchdog } from "../../remote/server/sessions.js";
+import { passwordProblem } from "../../util/password.js";
 import { serveHttp } from "../../server/http.js";
 import { currentPlatform, getEnv } from "../../util/runtime.js";
 /** `undefined` on Linux, otherwise one line naming the platform (a pure
@@ -24,6 +27,25 @@ function generatePassword() {
     crypto.getRandomValues(bytes);
     return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+/** `--password=` replaces the stored password. With no flag the stored one is
+ * kept, and a first start generates one, returned so the caller can print it. */
+export async function ensureDashboardPassword(args, hasStoredPassword, store) {
+    const flag = args
+        .find((arg) => arg.startsWith("--password="))
+        ?.slice("--password=".length);
+    if (flag !== undefined) {
+        const problem = passwordProblem(flag);
+        if (problem)
+            die(`--password: ${problem}`);
+        await store.set(flag);
+        return undefined;
+    }
+    if (hasStoredPassword)
+        return undefined;
+    const generated = generatePassword();
+    await store.set(generated);
+    return generated;
+}
 /** `--disable-auth=password` / `--enable-auth=github` always win over the
  * config defaults `co-maintainer set` persisted; dies if the result would
  * leave no sign-in method active. Pure so it is testable without a server. */
@@ -117,6 +139,13 @@ export async function runServe(args) {
             allowedUser: config.githubOAuthAllowedUser,
         };
     }
+    const passwordStore = configPasswordStore();
+    if (auth.password) {
+        const generated = await ensureDashboardPassword(args, Boolean(config.dashboardPasswordHash), passwordStore);
+        console.log(generated
+            ? `[serve] dashboard password: ${generated}`
+            : "[serve] dashboard password is stored in config.json, change it in Settings");
+    }
     const warning = platformWarning(currentPlatform());
     if (warning)
         console.log(`[serve] warning: ${warning}`);
@@ -136,13 +165,7 @@ export async function runServe(args) {
         console.log(`[serve] requeued ${recoveredReplies} unfinished conversation repl${recoveredReplies === 1 ? "y" : "ies"}`);
     }
     startWorkerLoop();
-    const password = auth.password
-        ? (args
-            .find((arg) => arg.startsWith("--password="))
-            ?.slice("--password=".length) ?? generatePassword())
-        : "";
-    if (auth.password)
-        console.log(`[serve] dashboard password: ${password}`);
+    startRemakeScheduler();
     if (auth.github)
         console.log(`[serve] GitHub sign-in enabled for ${githubOAuth.allowedUser}`);
     const inject500 = args.includes("--inject-500") || getEnv("CM_INJECT_500") === "1";
@@ -150,7 +173,8 @@ export async function runServe(args) {
         console.log("[serve] --inject-500 is on. Mutating /api requests return 500.");
     }
     const app = createApp({
-        password,
+        password: "",
+        passwordStore,
         webhookUrl,
         inject500,
         auth,
@@ -166,6 +190,7 @@ export async function runServe(args) {
             return;
         shuttingDown = true;
         console.log(`[serve] received ${signal}, stopping new requests and closing app.db`);
+        stopRemakeScheduler();
         await stopWorkerLoop();
         await server.shutdown();
         await closeAppDb();

package/dist/src/cli/commands/set.js

@@ -1,4 +1,5 @@
 import { writeUserConfig } from "../../config.js";
+import { hashPassword, passwordProblem } from "../../util/password.js";
 import { readTextFile } from "../../util/runtime.js";
 function die(message) {
     throw new Error(message);
@@ -15,6 +16,7 @@ const secretFields = new Set([
     "githubWebhookSecret",
     "githubOAuthClientSecret",
     "remoteToken",
+    "dashboardPasswordHash",
 ]);
 /** `co-maintainer set --token=... --ai=... --low-model=... --high-model=...
  * --auth=... --github-app-id=... --github-app-private-key=... (or
@@ -28,7 +30,7 @@ export async function runSet(args) {
         console.log("                        --github-app-id=... --github-app-private-key=... | --github-app-private-key-file=path");
         console.log("                        --github-webhook-secret=...");
         console.log("                        --github-oauth-client-id=... --github-oauth-client-secret=... --github-oauth-allowed-user=...");
-        console.log("                        --disable-auth=password --enable-auth=github");
+        console.log("                        --password=... --disable-auth=password --enable-auth=github");
         console.log("Writes to the user config file; unset an entry with --unset=name (e.g. --unset=token).");
         return;
     }
@@ -50,6 +52,7 @@ export async function runSet(args) {
         "enable-auth",
         "remote-host",
         "remote-token",
+        "password",
         "unset",
     ];
     for (const arg of args) {
@@ -87,6 +90,7 @@ export async function runSet(args) {
         "enable-auth": "githubAuthEnabled",
         "remote-host": "remoteHost",
         "remote-token": "remoteToken",
+        password: "dashboardPasswordHash",
     };
     const unset = new Set(args
         .filter((arg) => arg.startsWith("--unset="))
@@ -157,11 +161,18 @@ export async function runSet(args) {
     const remoteToken = text(args, "remote-token");
     if (remoteToken)
         patch.remoteToken = remoteToken;
+    const password = text(args, "password");
+    if (password) {
+        const problem = passwordProblem(password);
+        if (problem)
+            die(`--password: ${problem}`);
+        patch.dashboardPasswordHash = await hashPassword(password);
+    }
     if (Object.keys(patch).length === 0) {
         die("Nothing to set; pass --token=, --ai=, --low-model=, --high-model=, --auth=, --github-pat=, " +
             "--github-app-id=, --github-app-private-key(-file)=, --github-webhook-secret=, " +
             "--github-oauth-client-id=, --github-oauth-client-secret=, --github-oauth-allowed-user=, " +
-            "--disable-auth=password, --enable-auth=github, or --unset=name");
+            "--password=, --disable-auth=password, --enable-auth=github, or --unset=name");
     }
     await writeUserConfig(patch);
     const summary = Object.entries(patch).map(([key, value]) => value === undefined

package/dist/src/config.d.ts

@@ -17,6 +17,8 @@ export type RepoConfig = {
     includePullRequestChanges?: boolean;
     includeCommitHistory?: boolean;
     includeHowRepoWorks?: boolean;
+    /** Five field cron in UTC, checked by `serve` to queue a remake. */
+    remakeCron?: string;
 };
 export type UserConfig = {
     auth?: "gh" | "pat";
@@ -45,6 +47,8 @@ export type UserConfig = {
      * `--enable-auth` flag on the `serve` command overrides these per run. */
     passwordAuthDisabled?: boolean;
     githubAuthEnabled?: boolean;
+    /** scrypt hash of the dashboard password, never the password itself. */
+    dashboardPasswordHash?: string;
     defaults?: {
         maxCommits?: number;
         maxPrMonths?: number;

package/dist/src/server/api/repos.js

@@ -2,6 +2,7 @@ import { errorResponse } from "../errors.js";
 import { findInstallationForRepo } from "../../github/app.js";
 import { activateRepo, deactivateRepo, listActiveRepos, updateRepoSettings, } from "../../store/repos.js";
 import { writeRepoConfig } from "../../config.js";
+import { parseRemakeCron } from "../../services/remake_cron.js";
 import { enqueueSetup } from "../../services/setup.js";
 import { enqueueManualReview } from "../../services/review.js";
 import { prDetail, repoKnowledge, RepoNotFound, repoOverview, repoPulls, requireActiveRepo, } from "../../services/dashboard.js";
@@ -64,6 +65,25 @@ export async function handleReposRoute(request, url, githubApp) {
             catch {
                 return errorResponse(400, "bad_request", "expected a JSON body");
             }
+            const cronPatch = {};
+            if ("remakeCron" in body) {
+                const raw = body.remakeCron;
+                if (raw === null || raw === "") {
+                    cronPatch.remakeCron = undefined;
+                }
+                else if (typeof raw === "string") {
+                    try {
+                        parseRemakeCron(raw);
+                    }
+                    catch (error) {
+                        return errorResponse(422, "invalid_cron", error instanceof Error ? error.message : String(error));
+                    }
+                    cronPatch.remakeCron = raw.trim();
+                }
+                else {
+                    return errorResponse(422, "invalid_cron", "remakeCron must be text or null");
+                }
+            }
             const patch = {};
             if (typeof body.autoReview === "boolean") {
                 patch.auto_review = body.autoReview ? 1 : 0;
@@ -93,8 +113,9 @@ export async function handleReposRoute(request, url, githubApp) {
                     init[key] = body[key];
                 }
             }
-            if (Object.keys(init).length > 0)
-                await writeRepoConfig(fullName, init);
+            if (Object.keys(init).length > 0 || "remakeCron" in cronPatch) {
+                await writeRepoConfig(fullName, { ...init, ...cronPatch });
+            }
             return Response.json({ ok: true });
         }
         if (!sub && request.method === "DELETE") {

package/dist/src/server/api/settings.d.ts

@@ -1 +1,2 @@
-export declare function handleSettingsRoute(request: Request, url: URL, webhookUrl: string): Promise<Response>;
+import type { PasswordStore } from "../auth.ts";
+export declare function handleSettingsRoute(request: Request, url: URL, webhookUrl: string, passwords: PasswordStore, ip: string): Promise<Response>;

package/dist/src/server/api/settings.js

@@ -1,6 +1,9 @@
 import { errorResponse } from "../errors.js";
 import { readConfig, writeUserConfig } from "../../config.js";
 import { testAppAccess, testGithubAccess } from "../../services/credentials.js";
+import { checkPassword, readSessionToken, revokeOtherSessions, } from "../auth.js";
+import { passwordProblem } from "../../util/password.js";
+import { readJsonObject } from "./json_body.js";
 function validateWebhookUrl(value) {
     if (typeof value !== "string" || !value.trim()) {
         return "webhook URL is required";
@@ -16,7 +19,28 @@ function validateWebhookUrl(value) {
     }
     return undefined;
 }
-export async function handleSettingsRoute(request, url, webhookUrl) {
+async function changePassword(request, passwords, ip) {
+    const body = await readJsonObject(request);
+    if (body instanceof Response)
+        return body;
+    const next = typeof body.newPassword === "string" ? body.newPassword : "";
+    const problem = passwordProblem(next);
+    if (problem)
+        return errorResponse(422, "weak_password", problem);
+    const current = String(body.currentPassword ?? "");
+    if (!(await checkPassword(current, passwords, ip))) {
+        return errorResponse(403, "wrong_password", "the current password is wrong");
+    }
+    await passwords.set(next);
+    const token = readSessionToken(request);
+    if (token)
+        await revokeOtherSessions(token);
+    return Response.json({ ok: true });
+}
+export async function handleSettingsRoute(request, url, webhookUrl, passwords, ip) {
+    if (url.pathname === "/api/settings/password" && request.method === "POST") {
+        return await changePassword(request, passwords, ip);
+    }
     if (url.pathname === "/api/settings" && request.method === "GET") {
         const config = readConfig();
         return Response.json({

package/dist/src/server/app.d.ts

@@ -1,8 +1,9 @@
-import type { AuthMethods } from "./auth.ts";
-/** `password` is the dashboard password `serve` generates or takes via
- * `--password`. */
+import type { AuthMethods, PasswordStore } from "./auth.ts";
+/** `password` seeds an in-memory store. `serve` passes `passwordStore` so the
+ * password lives in config.json instead. */
 export type AppDeps = {
     password: string;
+    passwordStore?: PasswordStore;
     webhookUrl?: string;
     secureCookie?: boolean;
     inject500?: boolean;

package/dist/src/server/app.js

@@ -3,6 +3,7 @@
 import { VERSION } from "../version.js";
 import { errorResponse } from "./errors.js";
 import { hasCsrfHeader, login, logout, readSessionToken, sessionCookieHeader, verifySession, } from "./auth.js";
+import { memoryPasswordStore } from "./auth.js";
 import { readConfig } from "../config.js";
 import { listJobs } from "../store/jobs.js";
 import { handleJobsRoute } from "./api/jobs.js";
@@ -33,7 +34,7 @@ async function requireSession(request) {
         return undefined;
     return await verifySession(token);
 }
-async function handleLogin(request, deps, ip) {
+async function handleLogin(request, deps, passwords, ip) {
     if (deps.auth?.password === false) {
         return errorResponse(403, "password_disabled", "password sign-in is disabled");
     }
@@ -44,7 +45,7 @@ async function handleLogin(request, deps, ip) {
     catch {
         return errorResponse(400, "bad_request", "expected a JSON body");
     }
-    const result = await login(String(body.password ?? ""), deps.password, ip);
+    const result = await login(String(body.password ?? ""), passwords, ip);
     if (!result)
         return errorResponse(401, "unauthorized", "wrong password");
     return Response.json(result, {
@@ -93,6 +94,7 @@ function liveGithubConfig() {
     };
 }
 export function createApp(deps) {
+    const passwords = deps.passwordStore ?? memoryPasswordStore(deps.password);
     return {
         async fetch(request, remoteAddr = "unknown") {
             const url = new URL(request.url);
@@ -104,7 +106,7 @@ export function createApp(deps) {
             if (url.pathname === "/github/webhook" && request.method === "POST") {
                 return await handleWebhookRequest(request, webhookSecret);
             }
-            const page = await handlePageRequest(request, { ...deps, githubApp }, remoteAddr);
+            const page = await handlePageRequest(request, { ...deps, githubApp, passwordStore: passwords }, remoteAddr);
             if (page)
                 return page;
             if (url.pathname.startsWith("/api/remote/")) {
@@ -115,7 +117,7 @@ export function createApp(deps) {
                     return errorResponse(403, "csrf", `every mutating request needs the X-Requested-With header`);
                 }
                 if (url.pathname === "/api/login" && request.method === "POST") {
-                    return await handleLogin(request, deps, remoteAddr);
+                    return await handleLogin(request, deps, passwords, remoteAddr);
                 }
                 const session = await requireSession(request);
                 if (!session) {
@@ -143,7 +145,7 @@ export function createApp(deps) {
                     return await handleInstallationsRoute(request, githubApp);
                 }
                 if (url.pathname.startsWith("/api/settings")) {
-                    return await handleSettingsRoute(request, url, deps.webhookUrl ?? "");
+                    return await handleSettingsRoute(request, url, deps.webhookUrl ?? "", passwords, remoteAddr);
                 }
                 if (url.pathname.startsWith("/api/activity")) {
                     return handleActivityRoute(request, url);

package/dist/src/server/auth.d.ts

@@ -19,9 +19,21 @@ export type LoginResult = {
     username: string;
     expiresAt: string;
 };
+export type PasswordStore = {
+    verify(password: string): Promise<boolean>;
+    set(password: string): Promise<void>;
+};
+/** Holds the password in memory only: what `createApp` uses when `serve` did
+ * not hand it a config-backed store. */
+export declare function memoryPasswordStore(initial: string): PasswordStore;
+/** Reads the hash on every check, so a change made from the dashboard or
+ * `co-maintainer set` applies without restarting `serve`. */
+export declare function configPasswordStore(): PasswordStore;
 /** A locked-out attempt is indistinguishable from a wrong password to the
- * caller — both return `undefined` — so a probe gains nothing either way. */
-export declare function login(password: string, expected: string, ip: string): Promise<LoginResult | undefined>;
+ * caller, so a probe gains nothing either way. */
+export declare function checkPassword(password: string, store: PasswordStore, ip: string): Promise<boolean>;
+export declare function login(password: string, store: PasswordStore, ip: string): Promise<LoginResult | undefined>;
+export declare function revokeOtherSessions(keepToken: string): Promise<void>;
 /** Issues a session for the one dashboard identity, bypassing the password
  * check — used after GitHub OAuth has already verified the caller. */
 export declare function createSession(): Promise<LoginResult>;

package/dist/src/server/auth.js

@@ -1,6 +1,8 @@
 /** Only a token's hash ever reaches `store/sessions.ts`; the raw token is
  * handed back once, at login, and never stored. */
-import { deleteSession, getSession, insertSession } from "../store/sessions.js";
+import { readConfig, writeUserConfig } from "../config.js";
+import { hashPassword, verifyPasswordHash } from "../util/password.js";
+import { deleteOtherSessions, deleteSession, getSession, insertSession, } from "../store/sessions.js";
 const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 const LOCKOUT_THRESHOLD = 5;
 const LOCKOUT_WINDOW_MS = 10 * 60 * 1000;
@@ -69,16 +71,50 @@ function recordSuccess(ip) {
 export function hasCsrfHeader(request) {
     return request.headers.get(CSRF_HEADER) === CSRF_VALUE;
 }
+/** Holds the password in memory only: what `createApp` uses when `serve` did
+ * not hand it a config-backed store. */
+export function memoryPasswordStore(initial) {
+    let current = initial;
+    return {
+        verify: async (password) => current !== "" && (await constantTimeEqual(password, current)),
+        set: async (password) => {
+            current = password;
+        },
+    };
+}
+/** Reads the hash on every check, so a change made from the dashboard or
+ * `co-maintainer set` applies without restarting `serve`. */
+export function configPasswordStore() {
+    return {
+        verify: async (password) => {
+            const stored = readConfig().dashboardPasswordHash;
+            return stored ? await verifyPasswordHash(password, stored) : false;
+        },
+        set: async (password) => {
+            await writeUserConfig({
+                dashboardPasswordHash: await hashPassword(password),
+            });
+        },
+    };
+}
 /** A locked-out attempt is indistinguishable from a wrong password to the
- * caller — both return `undefined` — so a probe gains nothing either way. */
-export async function login(password, expected, ip) {
-    if (isLockedOut(ip) || !(await constantTimeEqual(password, expected))) {
+ * caller, so a probe gains nothing either way. */
+export async function checkPassword(password, store, ip) {
+    if (isLockedOut(ip) || !(await store.verify(password))) {
         recordFailure(ip);
-        return undefined;
+        return false;
     }
     recordSuccess(ip);
+    return true;
+}
+export async function login(password, store, ip) {
+    if (!(await checkPassword(password, store, ip)))
+        return undefined;
     return await createSession();
 }
+export async function revokeOtherSessions(keepToken) {
+    deleteOtherSessions(await sha256Hex(keepToken));
+}
 /** Issues a session for the one dashboard identity, bypassing the password
  * check — used after GitHub OAuth has already verified the caller. */
 export async function createSession() {

package/dist/src/server/pages/repo_settings.js

@@ -1,4 +1,24 @@
 import { html, layout, repoNav, skSlot, text } from "./layout.js";
+import { parseRemakeCron } from "../../services/remake_cron.js";
+import { nextCronRun } from "../../util/cron.js";
+function cronHint(repo, expression) {
+    const notBuilt = repo.knowledge_built_at
+        ? ""
+        : " A schedule only runs after the first setup has finished.";
+    if (!expression) {
+        return `Leave blank to turn it off. For example, 0 3 * * 1 runs every Monday at 03:00.${notBuilt}`;
+    }
+    try {
+        const next = nextCronRun(parseRemakeCron(expression), new Date());
+        if (!next)
+            return `This schedule has no run in the next year.${notBuilt}`;
+        return `Next run ${next.toISOString().slice(0, 16).replace("T", " ")} UTC.${notBuilt}`;
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        return `This schedule is ignored, ${reason}.${notBuilt}`;
+    }
+}
 export function renderRepoSettings(username, repo, config) {
     const name = repo.full_name;
     const skip = repo.skip_drafts && repo.skip_bots
@@ -68,6 +88,17 @@ export function renderRepoSettings(username, repo, config) {
       </div>
       <div class="ft"><button class="primary" id="save-init">Save</button></div>
     </div>
+    <div class="card" data-async>
+      ${skSlot()}
+      <div class="hd"><h2>Scheduled remake</h2></div>
+      <div class="bd">
+        <p class="muted" style="margin:0 0 18px">Rebuild the knowledge for this repository on a schedule. Times are UTC and a remake runs at most once an hour.</p>
+        <div class="field wide"><label>Cron schedule</label>
+          <input id="cron" placeholder="0 3 * * 1" value="${text(config.remakeCron ?? "")}">
+          <div class="hint">${text(cronHint(repo, config.remakeCron))}</div></div>
+      </div>
+      <div class="ft"><button class="primary" id="save-cron">Save</button></div>
+    </div>
     <div class="card" data-async>
       ${skSlot()}
       <div class="hd"><h2>Remove</h2></div>
@@ -114,6 +145,9 @@ document.getElementById("save-init").addEventListener("click", function() {
     maxComments: num("comments")
   });
 });
+document.getElementById("save-cron").addEventListener("click", function() {
+  save(this, { remakeCron: document.getElementById("cron").value.trim() });
+});
 document.getElementById("remove").addEventListener("click", function() {
   if (!confirm("Stop reviewing this repository?")) return;
   var btn = this;

package/dist/src/server/pages/router.d.ts

@@ -1,6 +1,6 @@
-import type { AuthMethods } from "../auth.ts";
+import type { AuthMethods, PasswordStore } from "../auth.ts";
 export type PageDeps = {
-    password: string;
+    passwordStore: PasswordStore;
     webhookUrl?: string;
     secureCookie?: boolean;
     githubApp?: {

package/dist/src/server/pages/router.js

@@ -266,7 +266,7 @@ async function handleLoginForm(request, deps, ip, auth) {
             showGithub: auth.github,
         });
     }
-    const result = await login(password, deps.password, ip);
+    const result = await login(password, deps.passwordStore, ip);
     if (!result) {
         return renderLogin({
             next,

package/dist/src/server/pages/settings.js

@@ -144,7 +144,7 @@ Leave blank to keep the current key"></textarea></div>
       <div class="bd">
         <p class="muted" style="margin:0 0 16px">A <code>--disable-auth</code>/<code>--enable-auth</code> flag on <code>serve</code> overrides these for that run.</p>
         <div class="field wide"><label><input type="checkbox" id="password-auth"${config.passwordAuthDisabled ? "" : " checked"}> Password sign-in</label>
-          <div class="hint">Set with <code>--password</code> when you start serve, or printed to the console if you omit the flag.</div></div>
+          <div class="hint">The first start prints a generated password to the console. Change it in the Password card below.</div></div>
         <div class="field wide"><label><input type="checkbox" id="github-auth"${config.githubAuthEnabled ? " checked" : ""}> GitHub sign-in</label></div>
         <div class="two" style="max-width:none">
           <div class="field"><label>OAuth client ID</label>
@@ -160,6 +160,23 @@ Leave blank to keep the current key"></textarea></div>
       </div>
       <div class="ft"><button class="primary" id="save-access">Save</button></div>
     </div>
+    <div class="card" id="password" data-async>
+      ${skSlot()}
+      <div class="hd"><h2>Password</h2></div>
+      <div class="bd">
+        <p class="muted" style="margin:0 0 16px">Changing it signs out every other browser session.</p>
+        <div class="field wide"><label>Current password</label>
+          <input id="pw-current" type="password" autocomplete="current-password"></div>
+        <div class="two" style="max-width:none">
+          <div class="field"><label>New password</label>
+            <input id="pw-new" type="password" autocomplete="new-password">
+            <div class="hint">8 to 200 characters.</div></div>
+          <div class="field"><label>Repeat new password</label>
+            <input id="pw-repeat" type="password" autocomplete="new-password"></div>
+        </div>
+      </div>
+      <div class="ft"><button class="primary" id="save-password">Change password</button></div>
+    </div>
     <div class="card" id="about">
       <div class="hd"><h2>About</h2></div>
       <div class="bd">
@@ -215,6 +232,25 @@ document.getElementById("save-access").addEventListener("click", function() {
     githubOAuthAllowedUser: document.getElementById("oauth-allowed-user").value
   });
 });
+document.getElementById("save-password").addEventListener("click", function() {
+  var btn = this;
+  var card = btn.closest("[data-async]");
+  var next = document.getElementById("pw-new").value;
+  if (next !== document.getElementById("pw-repeat").value) {
+    fail(card, "The two new passwords do not match.", function () {});
+    return;
+  }
+  run(btn, card, async function() {
+    await api("POST", "/api/settings/password", {
+      currentPassword: document.getElementById("pw-current").value,
+      newPassword: next
+    });
+    ["pw-current", "pw-new", "pw-repeat"].forEach(function(id) {
+      document.getElementById(id).value = "";
+    });
+    toast("Password changed");
+  });
+});
 function positiveOrNull(raw, label) {
   if (raw === "") return { ok: true, value: null };
   var n = Number(raw);

package/dist/src/services/remake_cron.d.ts

@@ -0,0 +1,8 @@
+import type { Cron } from "../util/cron.ts";
+/** A remake costs model tokens, so a schedule may fire at most once an hour. */
+export declare function parseRemakeCron(expression: string): Cron;
+/** Each minute is handled once however often the ticker is called. A minute
+ * the process slept through is not made up. */
+export declare function createRemakeCronTicker(): (now: Date) => string[];
+export declare function startRemakeScheduler(intervalMs?: number): void;
+export declare function stopRemakeScheduler(): void;

package/dist/src/services/remake_cron.js

@@ -0,0 +1,63 @@
+import { readConfig } from "../config.js";
+import { getQueuedJobByKey, getRunningJobByKey } from "../store/jobs.js";
+import { listActiveRepos } from "../store/repos.js";
+import { cronMatches, parseCron } from "../util/cron.js";
+import { enqueueSetup } from "./setup.js";
+/** A remake costs model tokens, so a schedule may fire at most once an hour. */
+export function parseRemakeCron(expression) {
+    const cron = parseCron(expression);
+    if (cron.minutes.size !== 1) {
+        throw new Error("the minute field must be a single value, so a remake runs at most once an hour");
+    }
+    return cron;
+}
+/** Each minute is handled once however often the ticker is called. A minute
+ * the process slept through is not made up. */
+export function createRemakeCronTicker() {
+    let lastMinute = -1;
+    return (now) => {
+        const minute = Math.floor(now.getTime() / 60_000);
+        if (minute === lastMinute)
+            return [];
+        lastMinute = minute;
+        const config = readConfig();
+        const queued = [];
+        for (const repo of listActiveRepos()) {
+            const expression = config.repos?.[repo.full_name]?.remakeCron;
+            if (!expression || !repo.knowledge_built_at)
+                continue;
+            let cron;
+            try {
+                cron = parseRemakeCron(expression);
+            }
+            catch {
+                continue;
+            }
+            if (!cronMatches(cron, now))
+                continue;
+            const key = `setup:${repo.full_name}`;
+            if (getQueuedJobByKey(key) || getRunningJobByKey(key))
+                continue;
+            enqueueSetup(repo.full_name, "remake");
+            queued.push(repo.full_name);
+        }
+        return queued;
+    };
+}
+let timer;
+export function startRemakeScheduler(intervalMs = 15_000) {
+    if (timer !== undefined)
+        return;
+    const ticker = createRemakeCronTicker();
+    timer = setInterval(() => {
+        for (const repo of ticker(new Date())) {
+            console.log(`[cron] queued a scheduled remake for ${repo}`);
+        }
+    }, intervalMs);
+}
+export function stopRemakeScheduler() {
+    if (timer === undefined)
+        return;
+    clearInterval(timer);
+    timer = undefined;
+}

package/dist/src/store/sessions.d.ts

@@ -6,3 +6,4 @@ export declare function insertSession(tokenHash: string, username: string, expir
 export declare function getSession(tokenHash: string): SessionRow | undefined;
 export declare function deleteSession(tokenHash: string): void;
 export declare function deleteExpiredSessions(): void;
+export declare function deleteOtherSessions(keepTokenHash: string): void;

package/dist/src/store/sessions.js

@@ -32,3 +32,8 @@ export function deleteExpiredSessions() {
         .prepare(`DELETE FROM sessions WHERE expires_at <= ?`)
         .run(nowIso());
 }
+export function deleteOtherSessions(keepTokenHash) {
+    getAppDb()
+        .prepare(`DELETE FROM sessions WHERE token_hash != ?`)
+        .run(keepTokenHash);
+}

package/dist/src/util/cron.d.ts

@@ -0,0 +1,14 @@
+export type Cron = {
+    minutes: Set<number>;
+    hours: Set<number>;
+    daysOfMonth: Set<number>;
+    months: Set<number>;
+    daysOfWeek: Set<number>;
+    anyDayOfMonth: boolean;
+    anyDayOfWeek: boolean;
+};
+export declare function parseCron(expression: string): Cron;
+/** All times are UTC. When both day fields are restricted a date matches if
+ * either one does, as in classic cron. */
+export declare function cronMatches(cron: Cron, date: Date): boolean;
+export declare function nextCronRun(cron: Cron, after: Date): Date | undefined;

package/dist/src/util/cron.js

@@ -0,0 +1,85 @@
+const FIELDS = [
+    { name: "minute", min: 0, max: 59 },
+    { name: "hour", min: 0, max: 23 },
+    { name: "day of month", min: 1, max: 31 },
+    { name: "month", min: 1, max: 12 },
+    { name: "day of week", min: 0, max: 7 },
+];
+function parseNumber(value, name) {
+    if (!/^\d+$/.test(value)) {
+        throw new Error(`${name} has an invalid value "${value}"`);
+    }
+    return Number(value);
+}
+function parseField(text, name, min, max) {
+    const values = new Set();
+    for (const part of text.split(",")) {
+        const [range, stepText, extra] = part.split("/");
+        if (extra !== undefined)
+            throw new Error(`${name} has an invalid step`);
+        const step = stepText === undefined ? 1 : parseNumber(stepText, name);
+        if (step < 1)
+            throw new Error(`${name} step must be at least 1`);
+        let from;
+        let to;
+        if (range === "*") {
+            from = min;
+            to = max;
+        }
+        else if (range.includes("-")) {
+            const [start, end, more] = range.split("-");
+            if (more !== undefined)
+                throw new Error(`${name} has an invalid range`);
+            from = parseNumber(start, name);
+            to = parseNumber(end ?? "", name);
+        }
+        else {
+            from = parseNumber(range, name);
+            to = stepText === undefined ? from : max;
+        }
+        if (from < min || to > max || from > to) {
+            throw new Error(`${name} must be between ${min} and ${max}`);
+        }
+        for (let value = from; value <= to; value += step)
+            values.add(value);
+    }
+    return values;
+}
+export function parseCron(expression) {
+    const fields = expression.trim().split(/\s+/);
+    if (fields.length !== 5) {
+        throw new Error("a cron expression needs 5 fields: minute, hour, day of month, month, day of week");
+    }
+    const [minutes, hours, daysOfMonth, months, daysOfWeek] = FIELDS.map((field, index) => parseField(fields[index], field.name, field.min, field.max));
+    return {
+        minutes,
+        hours,
+        daysOfMonth,
+        months,
+        daysOfWeek: new Set([...daysOfWeek].map((day) => day % 7)),
+        anyDayOfMonth: fields[2].startsWith("*"),
+        anyDayOfWeek: fields[4].startsWith("*"),
+    };
+}
+/** All times are UTC. When both day fields are restricted a date matches if
+ * either one does, as in classic cron. */
+export function cronMatches(cron, date) {
+    if (!cron.minutes.has(date.getUTCMinutes()) ||
+        !cron.hours.has(date.getUTCHours()) ||
+        !cron.months.has(date.getUTCMonth() + 1)) {
+        return false;
+    }
+    const dayOfMonth = cron.daysOfMonth.has(date.getUTCDate());
+    const dayOfWeek = cron.daysOfWeek.has(date.getUTCDay());
+    return cron.anyDayOfMonth || cron.anyDayOfWeek
+        ? dayOfMonth && dayOfWeek
+        : dayOfMonth || dayOfWeek;
+}
+const SEARCH_MINUTES = 366 * 24 * 60;
+export function nextCronRun(cron, after) {
+    let time = Math.floor(after.getTime() / 60_000) * 60_000 + 60_000;
+    for (let step = 0; step < SEARCH_MINUTES; step++, time += 60_000) {
+        if (cronMatches(cron, new Date(time)))
+            return new Date(time);
+    }
+}

package/dist/src/util/password.d.ts

@@ -0,0 +1,3 @@
+export declare function passwordProblem(password: string): string | undefined;
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPasswordHash(password: string, stored: string): Promise<boolean>;

package/dist/src/util/password.js

@@ -0,0 +1,29 @@
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+const KEY_LENGTH = 32;
+const MIN_LENGTH = 8;
+const MAX_LENGTH = 200;
+function derive(password, salt, length) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, length, (error, key) => error ? reject(error) : resolve(key));
+    });
+}
+export function passwordProblem(password) {
+    if (password.length < MIN_LENGTH || password.length > MAX_LENGTH) {
+        return `the password must be ${MIN_LENGTH} to ${MAX_LENGTH} characters`;
+    }
+}
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await derive(password, salt, KEY_LENGTH);
+    return `scrypt$${salt.toString("hex")}$${key.toString("hex")}`;
+}
+export async function verifyPasswordHash(password, stored) {
+    const [scheme, saltHex, keyHex] = stored.split("$");
+    if (scheme !== "scrypt" || !saltHex || !keyHex)
+        return false;
+    const expected = Buffer.from(keyHex, "hex");
+    if (expected.length === 0)
+        return false;
+    const key = await derive(password, Buffer.from(saltHex, "hex"), expected.length);
+    return timingSafeEqual(key, expected);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "co-maintainer",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Analyzes a GitHub repository and writes repository-specific contribution guidance.",
   "license": "MIT",
   "repository": {