toolroll 0.9.49 → 0.9.51

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.9.51 — 2026-10-07
+
+- **No lockout by username.** Wrong passwords slow the source that sent them,
+  not the account. A device you've signed in on always gets through.
+- **Guessing stays bounded.** Rotating addresses can't buy more guesses at an
+  account, and IPv6 addresses count per /64.
+- **Usernames stay private.** Real and made-up names answer the same way,
+  even after a flood.
+
+## 0.9.50 — 2026-10-07
+
+- **One route policy table.** Every route's access rules live in one table,
+  checked before any handler runs. Undeclared routes are refused, approvals
+  are browser-only, and read tokens can't change anything.
+- **Server split by area.** The server code now lives in smaller modules.
+  No behaviour change for users.
+
 ## 0.9.49 — 2026-10-07
 
 - **Tokens keep their limits.** A token's scope and project limits now hold

package/dist/cli-http.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 import { limitWords } from './request-budget.js';
 /** Inlined file contents, summed as UTF-8 bytes. */
@@ -105,6 +106,8 @@ export async function handleCliHttp(request, response, options) {
         request.resume();
         return true;
     }
+    if (!adapterPolicy({ caller: "bearer", capability: principal.scope, token: true }).ok)
+        return reject(403, "read-only", "Your token reads only. Use an act token for this.");
     let value;
     try {
         value = await body(request);

package/dist/flow-triggers.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * Flow triggers (v82): what starts cards in a flow without someone adding
  * them by hand.
@@ -944,6 +945,8 @@ export function receiveFlowHook(store, token, delivery, dir, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config === null || !takesDeliveries(config))
         return { status: 404, said: "No such address." };
+    if (!adapterPolicy({ caller: "service", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, said: "No access to this flow." };
     if (delivery.body.length > HOOK_BYTES)
         return { status: 413, said: "Too large." };
     const note = (said) => { store.updateFlowTrigger(trigger.id, { lastAt: now.toISOString(), lastOutcome: said }, now); };
@@ -1069,6 +1072,8 @@ export function flowFormPage(store, token, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return { status: 404, html: formHtml("Not found", "<p>This form isn't available. Ask whoever shared it for a new link.</p>") };
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const fields = config.questions.map((question, index) => `<label>${esc(question)}${index === 0 ? `<input name="a${index}" required maxlength="200" autocomplete="off">` : `<textarea name="a${index}" maxlength="3000"></textarea>`}</label>`).join("");
     return { status: 200, html: formHtml(config.label, `<form method="post">${fields}<div class="trap" aria-hidden="true"><label>Leave this empty<input name="website" tabindex="-1" autocomplete="off"></label></div><input type="hidden" name="t" value="${now.getTime()}"><button>Send</button></form>`) };
 }
@@ -1078,6 +1083,8 @@ export function receiveFlowForm(store, token, fields, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return flowFormPage(store, token, now);
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const again = `<p><a href="${esc(FORM_PATH + token)}">Send another</a></p>`;
     const thanks = formHtml(config.label, `<p>Thanks — it's been sent.</p>${again}`);
     // A filled trap, or a page posted faster than a person could, gets thanks and makes nothing.

package/dist/mcp-http.js

@@ -1,14 +1,4 @@
-/**
- * The MCP gateway over streamable HTTP, served at /mcp by the console (serve.ts). Stateless: one JSON-RPC message per
- * POST, answered with one JSON body (a notification gets 202 and no body); there is no session and no event stream.
- * The modern revision carries its version in `_meta` as on stdio; a handshake-era client may initialize, and because
- * nothing is kept between requests its tools work without the stdio lifecycle.
- *
- * Every POST signs in again. The caller is a coordinator credential (the coordinator registry, exactly as on stdio) or
- * a person's own API token `so_…` (mcp-person.ts: their role, project grants and token scope). A password
- * (`name:password`) and cookies sign in nothing here, a request carrying a browser Origin is refused, and the console's
- * Host check runs before this route. A revoked or expired token answers 401 on its next request.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
 import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
@@ -122,6 +112,11 @@ export function createMcpHttp(options) {
                 return send(response, 429, { jsonrpc: "2.0", id: null, error: { code: -32000, message: limitWords(admitted.limit, admitted.retryAfter), data: { limit: admitted.limit, retryAfter: admitted.retryAfter } } }, { "retry-after": String(admitted.retryAfter) });
             }
         }
+        const policy = caller.kind === "coordinator"
+            ? adapterPolicy({ caller: "coordinator", capability: "act" })
+            : adapterPolicy({ caller: oauthProjects(store, caller.person.principal.tokenId) === null ? "bearer" : "oauth", capability: caller.person.principal.scope, token: true });
+        if (!policy.ok)
+            return refuse(response, 403, "this credential cannot call this route");
         if (!/^application\/json\s*(;|$)/i.test(request.headers["content-type"] ?? ""))
             return refuse(response, 415, "send the JSON-RPC message as application/json");
         if (Number(request.headers["content-length"] ?? 0) > MAX_REQUEST)

package/dist/mcp-oauth.d.ts

@@ -62,7 +62,7 @@ export type OAuthHttpOptions = {
     clock: () => Date;
     /** This console's canonical origin for the request (the https public address, or this computer's loopback one); null: no sign-in here. */
     originOf: (request: IncomingMessage) => string | null;
-    /** Trusted direct peer, or the last hop appended by the console's loopback proxy. */
+    /** Trusted direct peer, or the last hop appended by the console's loopback proxy (native IPv6 counted by its /64). */
     requesterKey: (request: IncomingMessage) => string;
     /** The browser session signed in by cookie, or null. A bearer never consents. */
     session: (request: IncomingMessage) => OAuthSession | null;

package/dist/mcp-oauth.js

@@ -1,27 +1,8 @@
-/**
- * MCP sign-in: OAuth 2.1 for /mcp, as the MCP authorization spec describes, so an engineer's MCP client connects
- * without a pasted token. This console is both the authorization server and the protected resource.
- *
- *   /mcp's 401 names /.well-known/oauth-protected-resource/mcp (RFC 9728), which names this console's
- *   /.well-known/oauth-authorization-server (RFC 8414). A client registers itself (RFC 7591, public clients only),
- *   sends the person to /oauth/authorize with a S256 PKCE challenge and resource=<origin>/mcp, and trades the code
- *   at /oauth/token for a short-lived access token and a refresh secret that rotates on every use.
- *
- * The person signs in with the console's own sign-in (password or identity provider, unchanged), then consents on
- * one page: read or act, and which of their projects, confirmed with their password or a fresh provider check, the
- * same step-up as making an API token. Nothing is granted without that form, its session CSRF value and a same-site
- * post.
- *
- * A grant is an ordinary API token (api-tokens.ts): its access token is `so_<id>_<secret>`, it is listed and revoked
- * with every other token (console Sessions & tokens, `toolroll tokens`), and /mcp runs it through the same person
- * path. Its v113 binding (store.oauthGrant) adds what an ordinary token doesn't have: it works only at /mcp, its
- * access secret lasts an hour, it is tied to the account generation that consented, and it reaches only the projects
- * chosen (still intersected with the person's live access on every call). Only hashes are kept: of codes, access
- * secrets and refresh secrets. Approvals, people and policy are never reachable: those have no tool and no scope.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
 import { limitWords } from "./request-budget.js";
+import { sourceKey } from "./source-key.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -196,7 +177,7 @@ export function createOAuthHttp(options) {
         const name = clean(read.value.client_name ?? "") || "MCP client";
         const now = options.clock();
         prune(now.getTime());
-        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(options.requesterKey(request)) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
+        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(sourceKey(options.requesterKey(request))) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
         if (kept === null) {
             response.setHeader("retry-after", "600");
             return oauthError(response, 429, "temporarily_unavailable", "Too many clients are waiting to connect. Try again later.");
@@ -234,7 +215,7 @@ export function createOAuthHttp(options) {
         const scopes = (params.get("scope") ?? "").split(" ").filter(one => one !== "");
         if (!scopes.every(one => OAUTH_SCOPES.includes(one)))
             return fail("The client requested access Toolroll doesn't offer.");
-        const source = sha256(options.requesterKey(request));
+        const source = sha256(sourceKey(options.requesterKey(request)));
         if (waiting.size >= OAUTH_LIMITS.requests || [...waiting.values()].filter(one => one.source === source).length >= OAUTH_LIMITS.requestsPerSource) {
             response.setHeader("retry-after", "600");
             return problemPage(response, 429, "Too many sign-ins waiting", "Try again in ten minutes from your MCP client.");
@@ -339,6 +320,8 @@ export function createOAuthHttp(options) {
         // Never named back: a project outside the person's access is refused without saying whether it exists.
         if (!chosen.every(path => mine.includes(path)))
             return again(403, "Choose from your own projects.");
+        if (!adapterPolicy({ caller: "cookie", capability: account.role === "approver" ? "act" : "read", viewer: account.role === "viewer" }, "step-up", source => source === "none" && chosen.every(path => mine.includes(path))).ok)
+            return again(403, "Choose from your own projects.");
         if (!options.confirm(session, form.get("password") ?? ""))
             return again(403, "Enter your Toolroll password to allow access.");
         waiting.delete(id);
@@ -368,6 +351,8 @@ export function createOAuthHttp(options) {
             const unsupported = !("repeated" in read) && read.issues.some(one => one.path === "grant_type");
             return unsupported ? oauthError(response, 400, "unsupported_grant_type", "Use authorization_code or refresh_token.") : oauthError(response, 400, "invalid_request", "The token request isn't complete.");
         }
+        if (!adapterPolicy({ caller: "oauth", capability: "none" }).ok)
+            return oauthError(response, 403, "access_denied", "This credential cannot call this route.");
         const ask = read.value;
         const now = options.clock();
         const resource = `${origin}${RESOURCE_PATH}`;

package/dist/mcp-person.d.ts

@@ -1,12 +1,3 @@
-/**
- * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
- * is the exact `toolroll` command line they could type, run on the server under their principal through
- * `runOperateAs` with source "mcp": the command's own authorization, project grants and attribution apply, and its
- * `--json` envelope is the answer. Nothing here reads data directly — a coordinator handler would skip the person's
- * project grants — and nothing here approves, answers or changes people or policy: those verbs have no tool.
- *
- * tools/list follows the account's role and the token's scope; dispatch checks again, independent of the list.
- */
 import { type PersonToolName } from "./contracts/gateway-tools.js";
 import { type CallOutcome, type Json } from "./mcp-core.js";
 import type { Store } from "./store.js";

package/dist/mcp-person.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
  * is the exact `toolroll` command line they could type, run on the server under their principal through
@@ -67,7 +68,7 @@ export async function callPersonTool(person, store, runAs, params) {
     const read = parseContract(PERSON_TOOL_INPUTS[tool], rawArgs);
     if (!read.ok)
         return { kind: "error", code: -32602, message: read.issues.map(one => one.line).join("; "), fatal: false };
-    if (!mayCall(person, tool)) {
+    if (!adapterPolicy({ caller: "bearer", capability: person.principal.scope, token: true }, TOOLS[tool].acts ? "act" : "read").ok || !mayCall(person, tool)) {
         const why = person.principal.scope === "read" ? "this token reads only — make an act token in the console to file work" : "your account can watch, not act";
         return refused(`${tool}: ${why}`);
     }

package/dist/operate.d.ts

@@ -124,7 +124,7 @@ export declare const OPERATE_BOOLEAN_FLAGS: ReadonlySet<string>;
 export declare function parseOperateArgs(argv: readonly string[], ownValues?: ReadonlySet<string>): Args | {
     error: string;
 };
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export declare function runOperate(command: string, argv: readonly string[], write: Write, options?: OperateOptions): Promise<number>;
 export type { Principal };
 /**

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
 import { leadNameOf } from "./lead-identity.js";
@@ -97,6 +98,7 @@ import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, namedPath, taskBranches } from "./names.js";
 import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
 import { createServer as createNetServer } from "node:net";
@@ -759,8 +761,11 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
     }
     return { positional, flags, repoList };
 }
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
+    return withPasswordSource(CLI_PASSWORD_SOURCE, () => runOperateLocal(command, argv, write, options));
+}
+async function runOperateLocal(command, argv, write, options = {}) {
     const parsed = parseOperateArgs(argv, command === "flows" ? FLOWS_VALUE_FLAGS : undefined);
     // A parse error precedes the flags map, so JSON mode is read from the raw
     // argv — the envelope contract holds even for the earliest refusal.
@@ -977,7 +982,7 @@ export async function runOperateAs(argv, opts) {
     // The parser's positionals must spell the same row (a value flag can't hide a subcommand).
     if (remoteRowOf(root, parsed.positional)?.invocation !== row.invocation)
         return refuse("not-remote", REMOTE_MESSAGES.unknown);
-    if (proved.scope === "read" && row.mutation !== "none")
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, row.mutation !== "none" ? "act" : "read").ok || proved.scope === "read" && row.mutation !== "none")
         return refuse("read-only", REMOTE_MESSAGES.read);
     if ([...parsed.flags.keys()].some(name => REMOTE_REFUSED_FLAGS.has(name)))
         return refuse("usage", REMOTE_MESSAGES.credential);
@@ -985,6 +990,8 @@ export async function runOperateAs(argv, opts) {
     const project = remoteProjectOf(store, { allows }, scope, parsed.positional, parsed.repoList, row.invocation, parsed.flags, opts.files ?? {});
     if (!project.ok)
         return refuse(project.reason, project.message);
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, undefined, source => source === "adapter" && (project.repo === null || allows(project.repo))).ok)
+        return refuse("forbidden", REMOTE_MESSAGES.no);
     // The local mutation cache has a global key namespace. A token must not use a chosen key to read
     // another person's/project's cached result. Revision keys already bind the actor and result in
     // task-outcome-cli.ts, which also validates their public 32-hex format; leave those intact.

package/dist/request-budget.d.ts

@@ -107,18 +107,21 @@ export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export declare class SourceAdmission {
     private readonly perMinute;
     private readonly clock;
     private readonly tracked;
     private readonly usage;
+    private readonly keyMode;
     constructor(options: {
         perMinute: number;
         clock?: () => number;
         tracked?: number;
+        keyMode?: "source" | "exact";
     });
     get size(): number;
-    admit(source: string): Admission;
+    admit(key: string): Admission;
 }

package/dist/request-budget.js

@@ -1,3 +1,4 @@
+import { sourceKey } from "./source-key.js";
 export const REQUEST_BUDGET_SCHEMA = `
 CREATE TABLE IF NOT EXISTS request_budget_limit (
   target          TEXT PRIMARY KEY CHECK (target = '*' OR (length(target) = 12 AND target NOT GLOB '*[^0-9a-f]*')),
@@ -237,21 +238,24 @@ export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken:
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export class SourceAdmission {
     perMinute;
     clock;
     tracked;
     usage = new Map();
+    keyMode;
     constructor(options) {
+        this.keyMode = options.keyMode ?? "source";
         this.perMinute = Math.max(1, Math.min(PER_MINUTE_MAX, options.perMinute));
         this.clock = options.clock ?? Date.now;
         this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
     }
     get size() { return this.usage.size; }
-    admit(source) {
-        const now = this.clock();
+    admit(key) {
+        const now = this.clock(), source = this.keyMode === "exact" ? key : sourceKey(key);
         let times = this.usage.get(source);
         if (times === undefined) {
             if (this.usage.size >= this.tracked) {

package/dist/scope.d.ts

@@ -498,6 +498,7 @@ export declare function authenticateAccount(store: Store, by: string, secret: st
 } | {
     ok: false;
     reason: "no-approvers" | "unknown" | "revoked" | "locked";
+    retryAfterMs?: number;
 };
 /**
  * v100: someone who signed in with the identity provider moments ago has no

package/dist/scope.js

@@ -1,6 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
-import { passwordGuardOf } from "./sign-in-guard.js";
+import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
@@ -725,16 +725,26 @@ export function authenticateAccount(store, by, secret) {
             return { ok: false, reason: "unknown" };
         return { ok: true, role: account.role, generation: account.generation };
     }
-    // v99: wrong passwords in a row lock the name for a while, whatever road they came by.
-    const guard = passwordGuardOf(store), now = Date.now();
-    if (guard.lockedFor(by, now) > 0)
-        return { ok: false, reason: "locked" };
-    const account = store.accountOf(by);
-    if (account === null || !verifyCredential(account.credentialHash, secret)) {
-        guard.failed(by, now);
+    // v99: wrong passwords in a row lock the name for a while from where they came, whatever road they came by. A
+    // locked or held-back source is refused before the password is checked.
+    const guard = passwordGuardOf(store), now = Date.now(), source = currentPasswordSource();
+    const account = store.accountOf(by), proof = provenPasswordAccount.getStore();
+    const proven = proof?.name === by && account !== null && account.revokedAt === null && proof.generation === account.generation;
+    const wait = guard.preflight(by, now, source, proven);
+    if (wait > 0)
+        return { ok: false, reason: "locked", retryAfterMs: wait };
+    // Unknown names and legacy minted-token/SSO accounts do the same one KDF as a password account. Throttled
+    // attempts above do none, for either name class; never disclose account existence through password work.
+    const dummy = `scrypt$${"0".repeat(32)}$${"0".repeat(64)}`;
+    const hash = account?.credentialHash ?? dummy;
+    if (!hash.startsWith("scrypt$"))
+        verifyCredential(dummy, secret);
+    const matches = verifyCredential(hash, secret);
+    if (account === null || !matches) {
+        guard.failed(by, now, source, account !== null);
         return { ok: false, reason: "unknown" };
     }
-    guard.succeeded(by);
+    guard.succeeded(by, source);
     if (account.revokedAt !== null)
         return { ok: false, reason: "revoked" };
     // Inside a command, the person who signed in is who acted (their own acts never ping them).