patchwork-os 1.2.0-beta.2.canary.656 → 1.2.0-beta.2.canary.659

package/dist/identity/credentialStore.js

@@ -0,0 +1,124 @@
+/**
+ * Where per-member password hashes live — ADR-0020 Phase A.
+ *
+ * `~/.patchwork/credentials.json`, mode 0600, keyed by member id. A separate
+ * file from `members.json`, and that separation is the decision worth
+ * recording, because two other homes were considered and are worse.
+ *
+ * ## Not on the `Member` object
+ *
+ * `Member` is what `actorSnapshot` copies from into decision records. A hash
+ * hanging off it is one careless spread away from an audit log. That is why
+ * `LocalPasswordProvider` takes `credentialFor` injected rather than reading a
+ * field — this module supplies that function and nothing else.
+ *
+ * ## Not in `members.json`
+ *
+ * The roster is a describable, reviewable document: the sort of file somebody
+ * eventually pastes into an issue or commits to share a configuration. The
+ * moment it carries hashes, that is a credential leak by ordinary helpfulness.
+ * Separate files let the roster stay boring.
+ *
+ * A member deactivated rather than deleted (the roster's rule) leaves an
+ * orphaned credential here. That is correct and deliberate: the history stays,
+ * the login does not.
+ *
+ * ## NOT in the connector token store
+ *
+ * `PATCHWORK_TOKEN_DIR` already has 0600 handling and a keychain backend, and
+ * it is the wrong home twice over. Conceptually it holds credentials the
+ * bridge uses to call OUT; these are credentials people use to call IN.
+ * Practically, that path reaches `deleteSecretJsonSync` → an unconditional
+ * `unlink`, which is why `audit-connector-test-isolation` exists at all: in
+ * #1345 a disconnect test deleted a real credential off a developer's machine.
+ * Putting member logins behind that same unlink means a stray `clearTokens()`
+ * in a test can delete them.
+ *
+ * ## Fail CLOSED — the opposite of the roster
+ *
+ * A missing roster yields one implicit owner, so a single-user machine keeps
+ * working: "who may act on your own machine" defaults to the status quo. A
+ * missing credential file yields NOTHING, so nobody authenticates: "who are
+ * you" defaults to nobody. Those defaults are deliberately opposite, and the
+ * asymmetry is the same one ADR-0016 draws — a decision about whether an
+ * action happens defaults to no.
+ *
+ * Concretely: no file, unreadable file, malformed JSON, or an entry that is
+ * not a well-formed scrypt record all produce "no credential for this member",
+ * and `LocalPasswordProvider` then returns UNATTRIBUTED. None of them throw,
+ * because a thrown lookup is something a caller might catch and treat as a
+ * pass.
+ */
+import { chmodSync, existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { patchworkHome } from "../patchworkHome.js";
+import { isCredentialRecord } from "./credentials.js";
+export const CREDENTIALS_BASENAME = "credentials.json";
+/** `~/.patchwork/credentials.json`, honouring `PATCHWORK_HOME`. */
+export function defaultCredentialsPath() {
+    const home = process.env.PATCHWORK_HOME?.trim();
+    return join(home && home !== "" ? home : patchworkHome(), CREDENTIALS_BASENAME);
+}
+const EMPTY = {
+    credentialFor: () => undefined,
+    ids: () => [],
+    malformed: [],
+    overlyPermissive: false,
+};
+/**
+ * Load the credential file.
+ *
+ * Read ONCE at startup, like the roster, and deliberately not re-read per
+ * request: a file re-read on every authentication is a file whose permissions
+ * and contents can change under a running process, and the resulting behaviour
+ * is untestable. Rotation takes a restart, same as the roster.
+ */
+export function loadCredentials(path = defaultCredentialsPath()) {
+    if (!existsSync(path))
+        return EMPTY;
+    let overlyPermissive = false;
+    try {
+        const mode = statSync(path).mode & 0o077;
+        if (mode !== 0) {
+            overlyPermissive = true;
+            // Tighten rather than merely complain. A world-readable password file is
+            // a live problem, and an operator who is told about it at startup has
+            // already been running that way for however long.
+            try {
+                chmodSync(path, 0o600);
+            }
+            catch {
+                /* reported via overlyPermissive; nothing else to do */
+            }
+        }
+    }
+    catch {
+        /* stat failed — fall through; the read below decides */
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch {
+        // Unreadable or malformed ⇒ no credentials ⇒ nobody authenticates.
+        return { ...EMPTY, overlyPermissive };
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return { ...EMPTY, overlyPermissive };
+    }
+    const usable = new Map();
+    const malformed = [];
+    for (const [id, value] of Object.entries(parsed)) {
+        if (isCredentialRecord(value))
+            usable.set(id, value);
+        else
+            malformed.push(id);
+    }
+    return {
+        credentialFor: (memberId) => usable.get(memberId),
+        ids: () => [...usable.keys()],
+        malformed,
+        overlyPermissive,
+    };
+}
+//# sourceMappingURL=credentialStore.js.map

package/dist/identity/credentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/identity/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,mEAAmE;AACnE,MAAM,UAAU,sBAAsB;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,IAAI,CACT,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,EAC5C,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAcD,MAAM,KAAK,GAAoB;IAC7B,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS;IAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE;IACb,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,KAAK;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAI,GAAG,sBAAsB,EAAE;IAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,gBAAgB,GAAG,IAAI,CAAC;YACxB,yEAAyE;YACzE,sEAAsE;YACtE,kDAAkD;YAClD,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC5E,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjD,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/identity/dashboardSession.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The dashboard session cookie format — ONE implementation, two processes.
+ *
+ * ADR-0020 Phase A. The dashboard mints these at login (`v2.<memberId>.<exp>.<HMAC>`
+ * once a real member authenticates, `v1.<exp>.<HMAC>` when only the shared
+ * password was presented). The BRIDGE now needs to read them too, so that an
+ * approval arriving over the dashboard's proxy can name the human who gave it.
+ *
+ * ## Why this moved here rather than being reimplemented
+ *
+ * The obvious shape is a second verifier on the bridge side. It is also how
+ * this subsystem has failed before: two implementations of one wire format
+ * drift, and the drift here is not a crash. A bridge verifier that is slightly
+ * more permissive than the dashboard's signer accepts a cookie the dashboard
+ * would reject, and the consequence is an audit record naming a person on a
+ * credential nobody would have issued. A format whose two halves disagree is
+ * worse than a format with no second half.
+ *
+ * So the signing and verification live here, once, and `dashboard/src/lib/session.ts`
+ * re-exports them. The dashboard remains the only thing that MINTS a cookie;
+ * the bridge only ever verifies.
+ *
+ * ## Web Crypto only — no `node:` imports in this file
+ *
+ * Load-bearing. The dashboard's consumer runs in the Edge Runtime (middleware),
+ * where `node:crypto` is unavailable. `crypto.subtle` is present in both the
+ * Edge Runtime and every Node version the bridge targets, so one implementation
+ * covers all three. Adding a `node:` import here breaks the dashboard build,
+ * and it breaks it in middleware — the one place where a failure locks every
+ * user out of the dashboard.
+ */
+export declare const SESSION_COOKIE_NAME = "patchwork_session";
+export declare const SESSION_TTL_MS: number;
+/**
+ * Member ids that are safe inside a dot-delimited cookie payload.
+ *
+ * Load-bearing, not cosmetic. The payload is split on ".", so an id
+ * containing one makes `v2.a.b.123.<sig>` ambiguous — is the subject `a` with
+ * expiry `b.123`, or `a.b` with expiry `123`? Two members could then produce
+ * cookies that parse as each other. Rejected at BOTH ends: signing throws,
+ * verifying returns invalid, because a check on only one side is a check that
+ * a hand-written cookie skips.
+ */
+export declare const MEMBER_ID_RE: RegExp;
+/**
+ * Sign a session cookie.
+ *
+ * With `memberId` → `v2.<memberId>.<expiresAt>.<HMAC>`, an ATTRIBUTED session.
+ * Without → `v1.<expiresAt>.<HMAC>`, exactly as before.
+ *
+ * v1 is still minted on purpose. The dashboard password gate authenticates a
+ * SECRET, not a person, so there is nobody to name; minting a v2 with a
+ * placeholder subject would turn "we do not know who this is" into a claim
+ * about someone. v2 appears only once a real member has authenticated.
+ */
+export declare function signSession(expiresAtOrOpts?: number | {
+    memberId?: string;
+    expiresAt?: number;
+}): Promise<string>;
+/**
+ * Verify a session cookie.
+ *
+ * `memberId` is present ONLY for a valid v2 cookie. For v1 it is `undefined`,
+ * and that is the whole point of this function's shape:
+ *
+ *   **a v1 cookie must never read as an attributed v2.**
+ *
+ * A v1 cookie means nobody was identified. If verification returned some
+ * stand-in subject there — the implicit owner, the first member, a literal
+ * "unknown" — the absence of a subject would become a CLAIM of one, and every
+ * record stamped from it would name a person on no evidence. Undefined stays
+ * undefined; callers decide, and must treat it as unattributed.
+ *
+ * The version is inside the SIGNED payload, so a v1 cookie cannot be
+ * re-spelled as a v2 one: the HMAC covers `v1.<exp>` or `v2.<id>.<exp>`, and
+ * those are different strings under the same key.
+ *
+ * With NO secret configured this returns invalid for everything. On the bridge
+ * that is the expected state — the bridge has never been given
+ * `DASHBOARD_SESSION_SECRET` — and it is the correct one: no secret means no
+ * verification means no actor, and an absent actor already means "nobody
+ * recorded this".
+ */
+export declare function verifySession(value: string | undefined | null): Promise<{
+    valid: boolean;
+    expiresAt?: number;
+    memberId?: string;
+}>;

package/dist/identity/dashboardSession.js

@@ -0,0 +1,179 @@
+/**
+ * The dashboard session cookie format — ONE implementation, two processes.
+ *
+ * ADR-0020 Phase A. The dashboard mints these at login (`v2.<memberId>.<exp>.<HMAC>`
+ * once a real member authenticates, `v1.<exp>.<HMAC>` when only the shared
+ * password was presented). The BRIDGE now needs to read them too, so that an
+ * approval arriving over the dashboard's proxy can name the human who gave it.
+ *
+ * ## Why this moved here rather than being reimplemented
+ *
+ * The obvious shape is a second verifier on the bridge side. It is also how
+ * this subsystem has failed before: two implementations of one wire format
+ * drift, and the drift here is not a crash. A bridge verifier that is slightly
+ * more permissive than the dashboard's signer accepts a cookie the dashboard
+ * would reject, and the consequence is an audit record naming a person on a
+ * credential nobody would have issued. A format whose two halves disagree is
+ * worse than a format with no second half.
+ *
+ * So the signing and verification live here, once, and `dashboard/src/lib/session.ts`
+ * re-exports them. The dashboard remains the only thing that MINTS a cookie;
+ * the bridge only ever verifies.
+ *
+ * ## Web Crypto only — no `node:` imports in this file
+ *
+ * Load-bearing. The dashboard's consumer runs in the Edge Runtime (middleware),
+ * where `node:crypto` is unavailable. `crypto.subtle` is present in both the
+ * Edge Runtime and every Node version the bridge targets, so one implementation
+ * covers all three. Adding a `node:` import here breaks the dashboard build,
+ * and it breaks it in middleware — the one place where a failure locks every
+ * user out of the dashboard.
+ */
+export const SESSION_COOKIE_NAME = "patchwork_session";
+export const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+function getSecret() {
+    return process.env.DASHBOARD_SESSION_SECRET ?? "";
+}
+function base64url(bytes) {
+    const buf = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let s = "";
+    for (let i = 0; i < buf.length; i++)
+        s += String.fromCharCode(buf[i] ?? 0);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(input) {
+    const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = "=".repeat((4 - (padded.length % 4)) % 4);
+    const raw = atob(padded + padding);
+    const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+    for (let i = 0; i < raw.length; i++)
+        bytes[i] = raw.charCodeAt(i);
+    return bytes.buffer;
+}
+async function importKey() {
+    return crypto.subtle.importKey("raw", new TextEncoder().encode(getSecret()), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+}
+async function sign(payload) {
+    const key = await importKey();
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
+    return base64url(sig);
+}
+/**
+ * Member ids that are safe inside a dot-delimited cookie payload.
+ *
+ * Load-bearing, not cosmetic. The payload is split on ".", so an id
+ * containing one makes `v2.a.b.123.<sig>` ambiguous — is the subject `a` with
+ * expiry `b.123`, or `a.b` with expiry `123`? Two members could then produce
+ * cookies that parse as each other. Rejected at BOTH ends: signing throws,
+ * verifying returns invalid, because a check on only one side is a check that
+ * a hand-written cookie skips.
+ */
+export const MEMBER_ID_RE = /^[A-Za-z0-9_-]+$/;
+/**
+ * Sign a session cookie.
+ *
+ * With `memberId` → `v2.<memberId>.<expiresAt>.<HMAC>`, an ATTRIBUTED session.
+ * Without → `v1.<expiresAt>.<HMAC>`, exactly as before.
+ *
+ * v1 is still minted on purpose. The dashboard password gate authenticates a
+ * SECRET, not a person, so there is nobody to name; minting a v2 with a
+ * placeholder subject would turn "we do not know who this is" into a claim
+ * about someone. v2 appears only once a real member has authenticated.
+ */
+export async function signSession(expiresAtOrOpts = Date.now() + SESSION_TTL_MS) {
+    const opts = typeof expiresAtOrOpts === "number"
+        ? { expiresAt: expiresAtOrOpts }
+        : expiresAtOrOpts;
+    const expiresAt = opts.expiresAt ?? Date.now() + SESSION_TTL_MS;
+    const memberId = opts.memberId;
+    if (memberId === undefined) {
+        const payload = `v1.${expiresAt}`;
+        return `${payload}.${await sign(payload)}`;
+    }
+    if (!MEMBER_ID_RE.test(memberId)) {
+        throw new Error("memberId must match /^[A-Za-z0-9_-]+$/ — a dot would make the payload ambiguous");
+    }
+    const payload = `v2.${memberId}.${expiresAt}`;
+    return `${payload}.${await sign(payload)}`;
+}
+/**
+ * Verify a session cookie.
+ *
+ * `memberId` is present ONLY for a valid v2 cookie. For v1 it is `undefined`,
+ * and that is the whole point of this function's shape:
+ *
+ *   **a v1 cookie must never read as an attributed v2.**
+ *
+ * A v1 cookie means nobody was identified. If verification returned some
+ * stand-in subject there — the implicit owner, the first member, a literal
+ * "unknown" — the absence of a subject would become a CLAIM of one, and every
+ * record stamped from it would name a person on no evidence. Undefined stays
+ * undefined; callers decide, and must treat it as unattributed.
+ *
+ * The version is inside the SIGNED payload, so a v1 cookie cannot be
+ * re-spelled as a v2 one: the HMAC covers `v1.<exp>` or `v2.<id>.<exp>`, and
+ * those are different strings under the same key.
+ *
+ * With NO secret configured this returns invalid for everything. On the bridge
+ * that is the expected state — the bridge has never been given
+ * `DASHBOARD_SESSION_SECRET` — and it is the correct one: no secret means no
+ * verification means no actor, and an absent actor already means "nobody
+ * recorded this".
+ */
+export async function verifySession(value) {
+    if (!value || !getSecret())
+        return { valid: false };
+    const parts = value.split(".");
+    const version = parts[0];
+    let memberId;
+    let expiresAtStr;
+    let sig;
+    if (version === "v1" && parts.length === 3) {
+        expiresAtStr = parts[1];
+        sig = parts[2];
+    }
+    else if (version === "v2" && parts.length === 4) {
+        memberId = parts[1];
+        expiresAtStr = parts[2];
+        sig = parts[3];
+        // Defence in depth, and honestly redundant TODAY — probed, not assumed.
+        // Removing this line leaves every test green, because an id containing a
+        // "." makes the cookie 5 parts and the arity check above rejects it, while
+        // any other malformed id can only appear in a cookie we signed — and
+        // signing refuses it. The signature stops the rest.
+        //
+        // Kept because the arity check is what currently carries it, and arity
+        // stops discriminating the moment a fifth field is added to this format.
+        // A constraint that survives a format change is worth one line.
+        if (!memberId || !MEMBER_ID_RE.test(memberId))
+            return { valid: false };
+    }
+    else {
+        return { valid: false };
+    }
+    if (!expiresAtStr || !sig)
+        return { valid: false };
+    const expiresAt = Number.parseInt(expiresAtStr, 10);
+    if (!Number.isFinite(expiresAt))
+        return { valid: false };
+    if (Date.now() > expiresAt)
+        return { valid: false };
+    const payload = memberId === undefined
+        ? `v1.${expiresAtStr}`
+        : `v2.${memberId}.${expiresAtStr}`;
+    try {
+        const key = await importKey();
+        const sigBytes = base64urlDecode(sig);
+        const ok = await crypto.subtle.verify("HMAC", key, sigBytes, new TextEncoder().encode(payload));
+        // `memberId` is spread only when defined, so a v1 result has no such key
+        // at all — not a key holding undefined that some later `in` check reads
+        // as present.
+        return ok
+            ? { valid: true, expiresAt, ...(memberId !== undefined && { memberId }) }
+            : { valid: false };
+    }
+    catch {
+        return { valid: false };
+    }
+}
+//# sourceMappingURL=dashboardSession.js.map

package/dist/identity/dashboardSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboardSession.js","sourceRoot":"","sources":["../../src/identity/dashboardSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAElE,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,KAA+B;IAChD,MAAM,GAAG,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAe;IACjC,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,kBAEgD,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;IAE3E,MAAM,IAAI,GACR,OAAO,eAAe,KAAK,QAAQ;QACjC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE;QAChC,CAAC,CAAC,eAAe,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC;QAClC,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC9C,OAAO,GAAG,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAgC,CAAC;IACrC,IAAI,GAAuB,CAAC;IAE5B,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,oDAAoD;QACpD,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAEpD,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,YAAY,EAAE;QACtB,CAAC,CAAC,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,MAAM,EACN,GAAG,EACH,QAAQ,EACR,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,cAAc;QACd,OAAO,EAAE;YACP,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -216,6 +216,7 @@ const KNOWN_SUBCOMMANDS = [
     "gate",
     "outcomes",
     "butler",
+    "members",
     // Dispatched at `process.argv[2] === "tools"` (and `help`) but absent from
     // this array until 2026-08. The comment below calls this "the dispatch
     // source", and it was not: `patchwork tool` could never be corrected to
@@ -4231,6 +4232,116 @@ if (process.argv[2] === "gate") {
         }
     })();
 }
+// Handle members subcommand — the roster and per-member credentials
+// (ADR-0020 Phase A).
+//
+// `set-password` prompts on a TTY and never takes the secret from argv:
+// argv lands in shell history and in `ps` output for every user on the box.
+if (process.argv[2] === "members") {
+    const args = process.argv.slice(3);
+    (async () => {
+        try {
+            const { loadRoster, describeRoster } = await import("./identity/roster.js");
+            const { loadCredentials, defaultCredentialsPath } = await import("./identity/credentialStore.js");
+            if (args[0] === "list" || args.length === 0) {
+                const roster = loadRoster();
+                const creds = loadCredentials();
+                process.stdout.write(`${describeRoster(roster)}\n`);
+                const withCreds = new Set(creds.ids());
+                for (const m of roster.members) {
+                    process.stdout.write(`  ${m.id}  ${withCreds.has(m.id) ? "has a password" : "NO password — cannot authenticate"}\n`);
+                }
+                for (const bad of creds.malformed) {
+                    // "your record is corrupt" and "no such user" are different facts.
+                    process.stdout.write(`  ${bad}  credential present but UNREADABLE — treated as absent\n`);
+                }
+                if (creds.overlyPermissive) {
+                    process.stdout.write(`\n[members] ${defaultCredentialsPath()} was group/world-readable; tightened to 0600.\n`);
+                }
+                process.exit(0);
+            }
+            if (args[0] === "set-password") {
+                const memberId = args[1];
+                if (!memberId) {
+                    process.stderr.write("Usage: patchwork members set-password <memberId>\n");
+                    process.exit(2);
+                }
+                if (!process.stdin.isTTY) {
+                    // Refused rather than read from a pipe. A password arriving on stdin
+                    // from a script is a password in that script.
+                    process.stderr.write("[members] set-password needs an interactive terminal.\n");
+                    process.exit(2);
+                }
+                const { createInterface } = await import("node:readline");
+                const rl = createInterface({
+                    input: process.stdin,
+                    output: process.stdout,
+                });
+                const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+                // Node's readline cannot suppress echo portably; muting the output
+                // stream is the standard trick and is why this is written by hand.
+                const mute = (on) => {
+                    rl.output.write = on
+                        ? () => { }
+                        : process.stdout.write.bind(process.stdout);
+                };
+                process.stdout.write(`Password for ${memberId}: `);
+                mute(true);
+                const pw = (await ask("")).trim();
+                mute(false);
+                process.stdout.write("\nConfirm: ");
+                mute(true);
+                const again = (await ask("")).trim();
+                mute(false);
+                process.stdout.write("\n");
+                rl.close();
+                if (!pw) {
+                    process.stderr.write("[members] empty password refused.\n");
+                    process.exit(2);
+                }
+                if (pw !== again) {
+                    process.stderr.write("[members] passwords did not match.\n");
+                    process.exit(2);
+                }
+                const { hashPassword } = await import("./identity/credentials.js");
+                const { readFileSync, writeFileSync, existsSync, chmodSync } = await import("node:fs");
+                const file = defaultCredentialsPath();
+                let existing = {};
+                if (existsSync(file)) {
+                    try {
+                        const parsed = JSON.parse(readFileSync(file, "utf-8"));
+                        if (parsed &&
+                            typeof parsed === "object" &&
+                            !Array.isArray(parsed)) {
+                            existing = parsed;
+                        }
+                    }
+                    catch {
+                        // A corrupt file must not be silently replaced — that would
+                        // delete every other member's credential to store one.
+                        process.stderr.write(`[members] ${file} exists but is not readable JSON. Refusing to overwrite it.\n`);
+                        process.exit(2);
+                    }
+                }
+                existing[memberId] = await hashPassword(pw);
+                writeFileSync(file, `${JSON.stringify(existing, null, 2)}\n`, {
+                    mode: 0o600,
+                });
+                // `mode` on writeFileSync only applies at CREATION, so an existing
+                // file keeps its old permissions unless chmod'd explicitly.
+                chmodSync(file, 0o600);
+                process.stdout.write(`[members] password set for ${memberId}.\n`);
+                process.exit(0);
+            }
+            process.stderr.write("Usage: patchwork members <list|set-password <memberId>>\n");
+            process.exit(2);
+        }
+        catch (err) {
+            process.stderr.write(`[members] ${err.message}\n`);
+            process.exit(2);
+        }
+    })();
+}
 // Handle butler subcommand — SHADOW-only errand outcome grading.
 //
 // Operator path, like `outcomes` above and for the same reason: a recipe step