patchwork-os 1.2.0-beta.2.canary.650 → 1.2.0-beta.2.canary.652

package/dist/identity/credentials.js

@@ -0,0 +1,140 @@
+/**
+ * Per-member local credentials — ADR-0020 Phase A.
+ *
+ * ## Why this exists
+ *
+ * `canApproveAction` is referenced by nothing in production, and not because
+ * anyone forgot. The bridge authenticates ONE shared bearer token, and the
+ * dashboard session cookie's signed payload is literally `v1.${expiresAt}` —
+ * not "no subject field" but no field except expiry. Every approver is
+ * indistinguishable at the auth layer, so segregation of duties is
+ * unenforceable rather than merely unimplemented, and no decision record can
+ * honestly name a person.
+ *
+ * ## `crypto.scrypt`, from the standard library
+ *
+ * The dependency audit is unambiguous: no bcrypt, argon2, passport, next-auth
+ * or jose in this tree, direct or dev. Adding a native-compilation
+ * password-hashing dependency to a project that installs globally on macOS,
+ * Linux and Windows — and which already documents a macOS TCC symlink footgun
+ * around global installs — buys a marginally better KDF for a real
+ * cross-platform install risk. scrypt is memory-hard, in the standard library,
+ * and present in every runtime the bridge already targets.
+ *
+ * ## What this module does NOT do
+ *
+ * It does not read the roster, does not decide authorisation, and does not
+ * touch the dashboard cookie. Verifying a secret and deciding what somebody
+ * may do are different questions, and the cookie change touches ten consumers
+ * and wants its own review. This is the half with no blast radius.
+ */
+import { randomBytes, scrypt as scryptCb, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+const scrypt = promisify(scryptCb);
+/**
+ * scrypt parameters, stored per-hash rather than assumed.
+ *
+ * Encoding them in the record is what makes them changeable later: a stored
+ * hash that does not say how it was derived can only be verified by a
+ * constant, so raising the cost would silently invalidate every existing
+ * credential instead of upgrading it.
+ *
+ * N=2^15 with r=8, p=1 is ~32 MB of memory per verification. `maxmem` must be
+ * raised above Node's 32 MB default or scrypt throws at these parameters —
+ * a footgun that presents as "the correct password is rejected".
+ */
+export const SCRYPT_PARAMS = { N: 32768, r: 8, p: 1 };
+const KEYLEN = 64;
+const MAXMEM = 192 * 1024 * 1024;
+const PREFIX = "scrypt";
+/** Hash a password for storage. A fresh 16-byte salt per call. */
+export async function hashPassword(password, params = SCRYPT_PARAMS) {
+    if (typeof password !== "string" || password.length === 0) {
+        throw new Error("password must be a non-empty string");
+    }
+    const salt = randomBytes(16);
+    const derived = await scrypt(password, salt, KEYLEN, {
+        ...params,
+        maxmem: MAXMEM,
+    });
+    return [
+        PREFIX,
+        params.N,
+        params.r,
+        params.p,
+        salt.toString("base64"),
+        derived.toString("base64"),
+    ].join("$");
+}
+/** Parsed form of a stored record, or null when it is not one. */
+function parseRecord(record) {
+    if (typeof record !== "string")
+        return null;
+    const parts = record.split("$");
+    if (parts.length !== 6 || parts[0] !== PREFIX)
+        return null;
+    const [, nRaw, rRaw, pRaw, saltRaw, hashRaw] = parts;
+    const N = Number(nRaw);
+    const r = Number(rRaw);
+    const p = Number(pRaw);
+    if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) {
+        return null;
+    }
+    // Bound the work a stored record can demand. Without this, anyone who can
+    // write members.json can make one verification consume unbounded CPU and
+    // memory — a denial of service authored in a config file.
+    if (N < 16384 || N > 1 << 20 || r < 1 || r > 32 || p < 1 || p > 16) {
+        return null;
+    }
+    let salt;
+    let hash;
+    try {
+        salt = Buffer.from(saltRaw ?? "", "base64");
+        hash = Buffer.from(hashRaw ?? "", "base64");
+    }
+    catch {
+        return null;
+    }
+    if (salt.length === 0 || hash.length !== KEYLEN)
+        return null;
+    return { N, r, p, salt, hash };
+}
+/**
+ * Verify a password against a stored record.
+ *
+ * Returns false for a malformed record rather than throwing: a corrupt
+ * credential must read as "this password is wrong", not as an exception a
+ * caller might catch and treat as a pass. It is the same fail-closed reasoning
+ * as ADR-0016 — deciding whether an action happens defaults to no.
+ *
+ * The comparison is `timingSafeEqual` on the derived key. Lengths are checked
+ * first because it throws on a length mismatch, and a thrown comparison is a
+ * timing signal of its own.
+ */
+export async function verifyPassword(password, record) {
+    const parsed = parseRecord(record);
+    if (!parsed)
+        return false;
+    if (typeof password !== "string" || password.length === 0)
+        return false;
+    let derived;
+    try {
+        derived = await scrypt(password, parsed.salt, KEYLEN, {
+            N: parsed.N,
+            r: parsed.r,
+            p: parsed.p,
+            maxmem: MAXMEM,
+        });
+    }
+    catch {
+        return false;
+    }
+    if (derived.length !== parsed.hash.length)
+        return false;
+    return timingSafeEqual(derived, parsed.hash);
+}
+/** True when a string is a well-formed credential record. */
+export function isCredentialRecord(value) {
+    return typeof value === "string" && parseRecord(value) !== null;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/identity/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/identity/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAKb,CAAC;AAErB;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAC/D,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAKjC,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAA8C,aAAa;IAE3D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;QACnD,GAAG,MAAM;QACT,MAAM,EAAE,MAAM;KACf,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,MAAM,CAAC,CAAC;QACR,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,SAAS,WAAW,CAAC,MAAc;IAOjC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,MAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;YACpD,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAClE,CAAC"}

package/dist/index.js

@@ -4253,6 +4253,56 @@ if (process.argv[2] === "butler") {
                 }
                 process.exit(0);
             }
+            if (args[0] === "observe") {
+                // The cron entry point: look up live task state, grade it, append
+                // shadow rows. Operator path only — a recipe step runs AS the worker,
+                // and a worker that could observe its own filings could report them
+                // completed.
+                //
+                // Refs are supplied, not discovered. Deriving them from the run log is
+                // a separate piece of work, and inventing a task id here would be the
+                // same class of error as inventing an observation.
+                const fileIdx = args.indexOf("--file");
+                const src = fileIdx !== -1 && args[fileIdx + 1] ? args[fileIdx + 1] : "-";
+                const { readFileSync } = await import("node:fs");
+                const raw = src === "-"
+                    ? readFileSync(0, "utf-8")
+                    : readFileSync(src, "utf-8");
+                let refs;
+                try {
+                    refs = JSON.parse(raw);
+                }
+                catch (err) {
+                    process.stderr.write(`[butler] refs are not valid JSON: ${err.message}\n`);
+                    process.exit(2);
+                }
+                if (!Array.isArray(refs)) {
+                    process.stderr.write("[butler] expected a JSON array of {taskId, ref, recipe?}\n");
+                    process.exit(2);
+                }
+                const { getTodoistConnector } = await import("./connectors/todoist.js");
+                const { observeTodoistErrands } = await import("./butler/todoistObservation.js");
+                const run = await observeTodoistErrands(getTodoistConnector(), refs);
+                const res = ingestErrandOutcomes(run.observations, {
+                    now: Date.now(),
+                });
+                if (args.includes("--json")) {
+                    process.stdout.write(`${JSON.stringify({ ...res, unavailable: run.unavailable }, null, 2)}\n`);
+                }
+                else {
+                    process.stdout.write(`[butler] observed ${run.observations.length}, ` +
+                        `could not read ${run.unavailable.length}.\n`);
+                    for (const u of run.unavailable) {
+                        // Printed, never silent: an unread errand is not a graded one, and
+                        // a run that quietly skipped half its refs must not look clean.
+                        process.stdout.write(`[butler]   unavailable ${u.ref}: ${u.reason}\n`);
+                    }
+                    process.stdout.write(`[butler] graded ${res.graded}: ${res.batch.confirmed} confirmed, ` +
+                        `${res.batch.junk} junk, ${res.batch.unknown} unknown.\n`);
+                    process.stdout.write(`\n${formatShadowSummary(res.ledger)}\n`);
+                }
+                process.exit(0);
+            }
             if (args[0] === "ingest") {
                 // Observations come from a file or stdin as a JSON array. They are NOT
                 // gathered here: reading the operator's trackers is a connector
@@ -4300,9 +4350,10 @@ if (process.argv[2] === "butler") {
                 }
                 process.exit(0);
             }
-            process.stderr.write("Usage: patchwork butler <shadow|ingest> [--json]\n\n" +
+            process.stderr.write("Usage: patchwork butler <shadow|ingest|observe> [--json]\n\n" +
                 "  shadow                       summarise the graded shadow ledger\n" +
                 "  ingest [--file <path>|-]     grade a JSON array of observations\n" +
+                "  observe [--file <path>|-]    look up live Todoist state, then grade\n" +
                 "         [--stale-after-days N]\n\n" +
                 "  Shadow-only: nothing here writes the trust ledger.\n");
             process.exit(2);