toolroll 0.9.50 → 0.9.51

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.9.51 — 2026-10-07
+
+- **No lockout by username.** Wrong passwords slow the source that sent them,
+  not the account. A device you've signed in on always gets through.
+- **Guessing stays bounded.** Rotating addresses can't buy more guesses at an
+  account, and IPv6 addresses count per /64.
+- **Usernames stay private.** Real and made-up names answer the same way,
+  even after a flood.
+
 ## 0.9.50 — 2026-10-07
 
 - **One route policy table.** Every route's access rules live in one table,

package/dist/mcp-oauth.d.ts

@@ -62,7 +62,7 @@ export type OAuthHttpOptions = {
     clock: () => Date;
     /** This console's canonical origin for the request (the https public address, or this computer's loopback one); null: no sign-in here. */
     originOf: (request: IncomingMessage) => string | null;
-    /** Trusted direct peer, or the last hop appended by the console's loopback proxy. */
+    /** Trusted direct peer, or the last hop appended by the console's loopback proxy (native IPv6 counted by its /64). */
     requesterKey: (request: IncomingMessage) => string;
     /** The browser session signed in by cookie, or null. A bearer never consents. */
     session: (request: IncomingMessage) => OAuthSession | null;

package/dist/mcp-oauth.js

@@ -2,6 +2,7 @@ import { adapterPolicy } from "./server/route-policy.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
 import { limitWords } from "./request-budget.js";
+import { sourceKey } from "./source-key.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -176,7 +177,7 @@ export function createOAuthHttp(options) {
         const name = clean(read.value.client_name ?? "") || "MCP client";
         const now = options.clock();
         prune(now.getTime());
-        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(options.requesterKey(request)) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
+        const kept = store.registerOAuthClient({ id: randomBytes(16).toString("hex"), name, redirectUris: redirects, source: sha256(sourceKey(options.requesterKey(request))) }, now, OAUTH_LIMITS.clients, OAUTH_LIMITS.clientsPerSource, [...waiting.values()].map(one => one.client));
         if (kept === null) {
             response.setHeader("retry-after", "600");
             return oauthError(response, 429, "temporarily_unavailable", "Too many clients are waiting to connect. Try again later.");
@@ -214,7 +215,7 @@ export function createOAuthHttp(options) {
         const scopes = (params.get("scope") ?? "").split(" ").filter(one => one !== "");
         if (!scopes.every(one => OAUTH_SCOPES.includes(one)))
             return fail("The client requested access Toolroll doesn't offer.");
-        const source = sha256(options.requesterKey(request));
+        const source = sha256(sourceKey(options.requesterKey(request)));
         if (waiting.size >= OAUTH_LIMITS.requests || [...waiting.values()].filter(one => one.source === source).length >= OAUTH_LIMITS.requestsPerSource) {
             response.setHeader("retry-after", "600");
             return problemPage(response, 429, "Too many sign-ins waiting", "Try again in ten minutes from your MCP client.");

package/dist/operate.d.ts

@@ -124,7 +124,7 @@ export declare const OPERATE_BOOLEAN_FLAGS: ReadonlySet<string>;
 export declare function parseOperateArgs(argv: readonly string[], ownValues?: ReadonlySet<string>): Args | {
     error: string;
 };
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export declare function runOperate(command: string, argv: readonly string[], write: Write, options?: OperateOptions): Promise<number>;
 export type { Principal };
 /**

package/dist/operate.js

@@ -98,6 +98,7 @@ import { pushPass } from "./push.js";
 import { chmodSync, closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, openSync, readFileSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, writeFileSync, mkdirSync } from "node:fs";
 import { BRANCH_PREFIX, envTwins, envValue, existingOrFirst, namedPath, taskBranches } from "./names.js";
 import { claimActor, currentActor, parseLeadToken, withActor } from "./actor.js";
+import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
 import { createServer as createNetServer } from "node:net";
@@ -760,8 +761,11 @@ export function parseOperateArgs(argv, ownValues = new Set()) {
     }
     return { positional, flags, repoList };
 }
-/** Route an `operate` command. Returns the process exit code. */
+/** Route a native command and return its exit code. Its password source cannot be selected by an HTTP request. */
 export async function runOperate(command, argv, write, options = {}) {
+    return withPasswordSource(CLI_PASSWORD_SOURCE, () => runOperateLocal(command, argv, write, options));
+}
+async function runOperateLocal(command, argv, write, options = {}) {
     const parsed = parseOperateArgs(argv, command === "flows" ? FLOWS_VALUE_FLAGS : undefined);
     // A parse error precedes the flags map, so JSON mode is read from the raw
     // argv — the envelope contract holds even for the earliest refusal.

package/dist/request-budget.d.ts

@@ -107,18 +107,21 @@ export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export declare class SourceAdmission {
     private readonly perMinute;
     private readonly clock;
     private readonly tracked;
     private readonly usage;
+    private readonly keyMode;
     constructor(options: {
         perMinute: number;
         clock?: () => number;
         tracked?: number;
+        keyMode?: "source" | "exact";
     });
     get size(): number;
-    admit(source: string): Admission;
+    admit(key: string): Admission;
 }

package/dist/request-budget.js

@@ -1,3 +1,4 @@
+import { sourceKey } from "./source-key.js";
 export const REQUEST_BUDGET_SCHEMA = `
 CREATE TABLE IF NOT EXISTS request_budget_limit (
   target          TEXT PRIMARY KEY CHECK (target = '*' OR (length(target) = 12 AND target NOT GLOB '*[^0-9a-f]*')),
@@ -237,21 +238,24 @@ export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken:
 /**
  * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
  * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
- * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above. An address
+ * key counts by sourceKey (a native IPv6 caller by its /64). Verified identities must explicitly use exact keys.
  */
 export class SourceAdmission {
     perMinute;
     clock;
     tracked;
     usage = new Map();
+    keyMode;
     constructor(options) {
+        this.keyMode = options.keyMode ?? "source";
         this.perMinute = Math.max(1, Math.min(PER_MINUTE_MAX, options.perMinute));
         this.clock = options.clock ?? Date.now;
         this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
     }
     get size() { return this.usage.size; }
-    admit(source) {
-        const now = this.clock();
+    admit(key) {
+        const now = this.clock(), source = this.keyMode === "exact" ? key : sourceKey(key);
         let times = this.usage.get(source);
         if (times === undefined) {
             if (this.usage.size >= this.tracked) {

package/dist/scope.d.ts

@@ -498,6 +498,7 @@ export declare function authenticateAccount(store: Store, by: string, secret: st
 } | {
     ok: false;
     reason: "no-approvers" | "unknown" | "revoked" | "locked";
+    retryAfterMs?: number;
 };
 /**
  * v100: someone who signed in with the identity provider moments ago has no

package/dist/scope.js

@@ -1,6 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
-import { passwordGuardOf } from "./sign-in-guard.js";
+import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { projectAuthority } from "./project-access.js";
@@ -725,16 +725,26 @@ export function authenticateAccount(store, by, secret) {
             return { ok: false, reason: "unknown" };
         return { ok: true, role: account.role, generation: account.generation };
     }
-    // v99: wrong passwords in a row lock the name for a while, whatever road they came by.
-    const guard = passwordGuardOf(store), now = Date.now();
-    if (guard.lockedFor(by, now) > 0)
-        return { ok: false, reason: "locked" };
-    const account = store.accountOf(by);
-    if (account === null || !verifyCredential(account.credentialHash, secret)) {
-        guard.failed(by, now);
+    // v99: wrong passwords in a row lock the name for a while from where they came, whatever road they came by. A
+    // locked or held-back source is refused before the password is checked.
+    const guard = passwordGuardOf(store), now = Date.now(), source = currentPasswordSource();
+    const account = store.accountOf(by), proof = provenPasswordAccount.getStore();
+    const proven = proof?.name === by && account !== null && account.revokedAt === null && proof.generation === account.generation;
+    const wait = guard.preflight(by, now, source, proven);
+    if (wait > 0)
+        return { ok: false, reason: "locked", retryAfterMs: wait };
+    // Unknown names and legacy minted-token/SSO accounts do the same one KDF as a password account. Throttled
+    // attempts above do none, for either name class; never disclose account existence through password work.
+    const dummy = `scrypt$${"0".repeat(32)}$${"0".repeat(64)}`;
+    const hash = account?.credentialHash ?? dummy;
+    if (!hash.startsWith("scrypt$"))
+        verifyCredential(dummy, secret);
+    const matches = verifyCredential(hash, secret);
+    if (account === null || !matches) {
+        guard.failed(by, now, source, account !== null);
         return { ok: false, reason: "unknown" };
     }
-    guard.succeeded(by);
+    guard.succeeded(by, source);
     if (account.revokedAt !== null)
         return { ok: false, reason: "revoked" };
     // Inside a command, the person who signed in is who acted (their own acts never ping them).

package/dist/serve.js

@@ -117,7 +117,8 @@ import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
 import { beatScript, BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
 import { createTasksHandlers } from './server/tasks.js';
-import { DEFAULT_GUARD_POLICY, passwordGuardOf, SourceBudget } from "./sign-in-guard.js";
+import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
+import { sourceKey } from "./source-key.js";
 import { readSsoSettings } from "./sso-settings.js";
 import { LEAD_THREAD } from "./store.js";
 import { waitingUpdate } from "./toolroll-update.js";
@@ -247,7 +248,7 @@ export function createDecisionServer(options) {
     // Sessions from before a restart that ran out, or whose account changed since, go now.
     store.sweepWebSessions(Date.now(), SESSION_IDLE_MS, SESSION_ABSOLUTE_MS);
     /** Where a new session signs in from: the browser (its user agent, short) and the address. */
-    const arrival = (request) => ({ agent: (request.headers["user-agent"] ?? "").slice(0, 300) || null, address: joinSourceOf(request).replace(/^fwd:/, "") });
+    const arrival = (request) => ({ agent: (request.headers["user-agent"] ?? "").slice(0, 300) || null, address: forwardedSourceOf(request).replace(/^fwd:/, "") });
     /** Wrong setup codes left before the first-account road closes. */
     let setupAttemptsLeft = 5;
     // The /join road's limiter (D6; Codex people round 1, finding 4):
@@ -262,7 +263,7 @@ export function createDecisionServer(options) {
      * share the proxy's one bucket. A LOOPBACK peer is that proxy, and only
      * then is the forwarded chain believed, taking the LAST hop (the one
      * the trusted proxy itself appended; earlier entries are client-typed). */
-    function joinSourceOf(request) {
+    function forwardedSourceOf(request) {
         const peer = request.socket.remoteAddress ?? "unknown";
         const loopback = LOOPBACK_PEERS.has(peer);
         if (!loopback)
@@ -272,6 +273,8 @@ export function createDecisionServer(options) {
         const lastHop = chain.split(",").pop()?.trim() ?? "";
         return lastHop === "" ? peer : `fwd:${lastHop.slice(0, 64)}`;
     }
+    /** That source as every per-source budget counts it: a native IPv6 caller by its /64 (source-key.ts). */
+    function joinSourceOf(request) { return sourceKey(forwardedSourceOf(request)); }
     const signInBudget = new SourceBudget();
     const ssoVisits = new Map();
     const ssoHandoffs = new Map();
@@ -455,7 +458,7 @@ export function createDecisionServer(options) {
     // Unproved password attempts share a source budget. Only successful proof spends an account budget.
     const sourceClock = options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock };
     const passwordSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
-    const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
+    const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, keyMode: "exact", ...sourceClock });
     const teamsSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsSource, ...sourceClock });
     const teamsTenantBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsTenant, ...sourceClock });
     const oauthTokenBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.oauthToken, ...sourceClock });
@@ -476,7 +479,8 @@ export function createDecisionServer(options) {
     };
     const server = createServer((request, response) => {
         instrumentRequest(store.telemetry, request, response);
-        void handle(request, response).catch(error => {
+        // Every password checked while answering counts against where this request came from (sign-in-guard.ts).
+        void withPasswordSource(joinSourceOf(request), () => handle(request, response)).catch(error => {
             // Every unhandled error is logged (v99): the path and the message, never the request's body or query.
             logEvent("error", "serve.error", { method: request.method, path: redactedPath(new URL(request.url ?? "/", "http://placeholder").pathname), error: error instanceof Error ? error.message : String(error) });
             if (envValue(process.env, "SERVE_DEBUG") === "1")
@@ -604,7 +608,7 @@ export function createDecisionServer(options) {
         }
         // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
         // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
-        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: joinSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
+        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: forwardedSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
         const hsts = hstsFor(publicOrigin?.host ?? null, request.headers.host, transport);
         if (hsts !== null)
             response.setHeader("Strict-Transport-Security", hsts);
@@ -651,8 +655,9 @@ export function createDecisionServer(options) {
         }
         if (who?.via === "bearer" && refuseBudget(admitBearer(request, who)))
             return;
+        const passwordProof = who?.via === 'cookie' ? { name: who.name, generation: who.session.generation } : null;
         if (edgeRoute?.domain === 'people')
-            return dispatchEdge(edgeRoute, { url, who, request, response, method });
+            return provenPasswordAccount.run(passwordProof, () => dispatchEdge(edgeRoute, { url, who, request, response, method }));
         if (who === null) {
             // A GET to an exact task or result (a phone's deep link) signs in and
             // comes back to it — the destination is a same-site path only.
@@ -679,7 +684,7 @@ export function createDecisionServer(options) {
         };
         // An empty password stands for a fresh identity-provider sign-in, for this person only (v100).
         if (method === "GET" || method === "POST")
-            return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => requestContext.run(requestFacts, async () => {
+            return freshIdentitySignIn.run({ actor: requestFacts.sso?.fresh === true ? who.name : null }, () => provenPasswordAccount.run(passwordProof, () => requestContext.run(requestFacts, async () => {
                 const taskTextForm = url.pathname === "/tasks/add" || /^\/t\/[^/]+\/scope$/.test(url.pathname);
                 const body = method === "POST" ? await form(request, url.pathname === "/settings/skills/import" ? 2 * 1024 * 1024 : url.pathname === "/flows/import" ? 1024 * 1024 : taskTextForm ? TASK_FORM_BODY_CAP : BODY_CAP) : null;
                 const target = actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget));
@@ -749,7 +754,7 @@ export function createDecisionServer(options) {
                     store.recordAction({ ...entry, at: clock().toISOString(), outcome: "error" });
                     throw error;
                 }
-            }));
+            })));
         return respond(response, 405, "text/plain; charset=utf-8", "no such method here");
     }
     function actionTarget(url, who, request, body = null) {

package/dist/server/people-tokens.js

@@ -19,7 +19,6 @@ import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcA
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
 import { hashPassword } from "../scope.js";
-import { passwordGuardOf } from "../sign-in-guard.js";
 import { form, HANDOFF_STYLE, joinDeadPage, joinFormPage, loginHref, loginPage, loginReturn, page, SESSION_COOKIE, SIGN_IN_COOKIE, SIGN_IN_LINK_PATH, signInSpent, signupPage, startedHere } from "./shared.js";
 export function createPeopleHandlers(runtime) {
     const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
@@ -474,7 +473,7 @@ export function createPeopleHandlers(runtime) {
             const authenticated = name !== null && token !== null ? authenticateAccount(store, name, token) : null;
             if (authenticated === null || !authenticated.ok) {
                 if (authenticated?.reason === "locked") {
-                    const locked = passwordGuardOf(store).lockedFor(name ?? "", at);
+                    const locked = authenticated.retryAfterMs;
                     recordSignIn(signInActor(name), "sign-in refused", "locked");
                     response.setHeader("Retry-After", String(Math.ceil(locked / 1000)));
                     return page(response, 429, loginPage(`Too many wrong passwords. Try again in ${minutesWords(locked)}.`, returnTo));

package/dist/server/remote.js

@@ -10,7 +10,7 @@ import { RequestBudget, SourceAdmission } from "../request-budget.js";
 import { authenticateAccount } from "../scope.js";
 import { createSessionEndpoint } from '../session-server.js';
 import {} from "../store.js";
-import { handleTeamHttp } from '../team-http.js';
+import { handleTeamHttp, TEAM_PASSWORD_REVERIFY_MS } from '../team-http.js';
 import { handleTeamsHttp } from "../teams.js";
 import { flowHook, telegramHook } from "./remote-hooks.js";
 import { respond } from "./shared.js";
@@ -26,6 +26,8 @@ export function createRemoteHandlers(runtime) {
         return who?.via === "bearer" ? who.principal ?? null : null;
     };
     const presentsToken = (request) => /^Bearer so_\S+$/.test(request.headers.authorization ?? "");
+    /** When each live request's password bearer last proved its password: kept only while the request is. */
+    const passwordProvedAt = new WeakMap();
     const teamEndpoint = (request, response) => handleTeamHttp(request, response, {
         authenticate: request => {
             if (presentsToken(request)) {
@@ -34,7 +36,11 @@ export function createRemoteHandlers(runtime) {
             }
             const who = identify(request, request.method === 'POST');
             const account = who === null ? null : store.accountOf(who.name);
-            return who && account && account.revokedAt === null ? { name: who.name, generation: account.generation, role: account.role } : null;
+            if (!who || !account || account.revokedAt !== null)
+                return null;
+            if (who.via === 'bearer')
+                passwordProvedAt.set(request, clock().getTime());
+            return { name: who.name, generation: account.generation, role: account.role };
         },
         admit: admitPasswordSource,
         admitAuthenticated: admitBearer,
@@ -51,10 +57,19 @@ export function createRemoteHandlers(runtime) {
                 actor.principal = { ...actor.principal, scope: live.scope };
                 return true;
             }
-            // A password bearer was proved when this connection opened. Cookie expiry/revocation
+            // A password bearer was proved when this connection opened, and is proved again (the password checked, through
+            // the same per-source tries and locks) once TEAM_PASSWORD_REVERIFY_MS has passed since. Cookie expiry/revocation
             // is rechecked without allowing a passive stream to extend its lifetime.
-            if (request.headers.authorization)
+            if (request.headers.authorization) {
+                const now = clock().getTime(), provedAt = passwordProvedAt.get(request);
+                if (provedAt !== undefined && now - provedAt < TEAM_PASSWORD_REVERIFY_MS)
+                    return true;
+                const who = identify(request, false);
+                if (who?.via !== 'bearer' || who.name !== actor.name || who.generation !== actor.generation)
+                    return false;
+                passwordProvedAt.set(request, now);
                 return true;
+            }
             const who = identify(request, false);
             return who?.name === actor.name && who.via === 'cookie' && who.session.generation === actor.generation;
         },

package/dist/sign-in-guard.d.ts

@@ -1,31 +1,56 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 /**
- * Password guessing (v99). Five wrong passwords in a row lock that account
- * for 15 minutes, doubling with each further lock up to a day; a right one
- * clears the count. Every password check counts: signing in, a request that
- * carries a password, and each step-up inside the console. Unknown names
- * count too, so guessing names gains nothing.
- *
- * Kept in memory, per database: a restart forgives, which someone locked out
- * by another's guessing may need. The console reports each lock to the
- * action ledger through onLock.
+ * Five failures lock a source/account pair, with exponential backoff. Across sources, failures slow an account and
+ * admit only a few unproven checks per minute before password derivation. A validated same-account browser session
+ * bypasses that shared admission budget, never a source's own lock. Fabricated names follow the same admission path.
+ * Source and name records expire by time. Both use bounded, non-evicting keyed storage, regardless of whether the
+ * account exists. Saturation shares overflow buckets without displacing or changing individually tracked state.
  */
 export type GuardPolicy = {
     failuresBeforeLock: number;
     firstLockMs: number;
     maxLockMs: number;
+    firstSlowMs: number;
 };
 export declare const DEFAULT_GUARD_POLICY: GuardPolicy;
+/** Default/loopback source for callers without an explicit native CLI context. */
+export declare const LOCAL_SOURCE = "local";
+/** Native CLI only: no HTTP peer or forwarded header can select this source. */
+export declare const CLI_PASSWORD_SOURCE = "local-cli";
+export declare const ACCOUNT_PASSWORD_TRIES = 3;
+export declare const ACCOUNT_PASSWORD_WINDOW_MS = 60000;
+/** Run `work` with every password check inside it counted against `source`. */
+export declare const withPasswordSource: <T>(source: string, work: () => T) => T;
+/** Where the password being checked now came from (LOCAL_SOURCE outside a request). */
+export declare const currentPasswordSource: () => string;
+/** Set only after the server validates a browser session, never from submitted form fields. */
+export declare const provenPasswordAccount: AsyncLocalStorage<{
+    name: string;
+    generation: number;
+} | null>;
 export declare class PasswordGuard {
     readonly policy: GuardPolicy;
-    private readonly accounts;
+    private readonly secret;
+    private readonly sources;
+    private readonly slowdowns;
+    private nextPruneAt;
     /** Told once per lock: the account (as typed), and for how long. */
     onLock: ((account: string, lockMs: number) => void) | null;
     constructor(policy?: GuardPolicy);
     private static key;
-    /** Milliseconds this account stays locked (0: it may try). */
-    lockedFor(account: string, now: number): number;
-    failed(account: string, now: number): void;
-    succeeded(account: string): void;
+    private static pair;
+    /** Prune by the supplied time, even below capacity; retain a lock's escalation history for a day. */
+    private prune;
+    /** Source-local snapshot for existing callers. Authentication must use preflight to spend the shared budget. */
+    lockedFor(account: string, now: number, source?: string): number;
+    /** Reserve one password check, or return its wait. No password derivation may precede this call. */
+    preflight(account: string, now: number, source?: string, proven?: boolean): number;
+    /** A wrong password; only a database lookup may establish `exists`. */
+    failed(account: string, now: number, source?: string, exists?: boolean): void;
+    /** The right password clears individually tracked state; shared overflow buckets must expire by time. */
+    succeeded(account: string, source?: string): void;
+    /** Individually tracked source-and-name entries (at most TRACKED), excluding fixed shared overflow buckets. */
+    get size(): number;
 }
 /** The guard for one database (a store): every password check against it counts. */
 export declare function passwordGuardOf(owner: object): PasswordGuard;
@@ -40,6 +65,6 @@ export declare class SourceBudget {
     private readonly sources;
     constructor(tries?: number, windowMs?: number);
     /** Milliseconds until this address may try again (0: it may). */
-    waitFor(source: string, now: number): number;
-    failed(source: string, now: number): void;
+    waitFor(address: string, now: number): number;
+    failed(address: string, now: number): void;
 }

package/dist/sign-in-guard.js

@@ -1,39 +1,161 @@
-export const DEFAULT_GUARD_POLICY = { failuresBeforeLock: 5, firstLockMs: 15 * 60_000, maxLockMs: 24 * 60 * 60_000 };
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHmac, randomBytes } from "node:crypto";
+import { sourceKey } from "./source-key.js";
+export const DEFAULT_GUARD_POLICY = { failuresBeforeLock: 5, firstLockMs: 15 * 60_000, maxLockMs: 24 * 60 * 60_000, firstSlowMs: 60_000 };
 const TRACKED = 10_000;
+/** Default/loopback source for callers without an explicit native CLI context. */
+export const LOCAL_SOURCE = "local";
+/** Native CLI only: no HTTP peer or forwarded header can select this source. */
+export const CLI_PASSWORD_SOURCE = "local-cli";
+export const ACCOUNT_PASSWORD_TRIES = 3;
+export const ACCOUNT_PASSWORD_WINDOW_MS = 60_000;
+const LOCAL_PEERS = new Set(["127.0.0.1", "::1"]);
+const passwordSource = new AsyncLocalStorage();
+/** Run `work` with every password check inside it counted against `source`. */
+export const withPasswordSource = (source, work) => passwordSource.run(source, work);
+/** Where the password being checked now came from (LOCAL_SOURCE outside a request). */
+export const currentPasswordSource = () => passwordSource.getStore() ?? LOCAL_SOURCE;
+/** Set only after the server validates a browser session, never from submitted form fields. */
+export const provenPasswordAccount = new AsyncLocalStorage();
+/**
+ * Keep the first TRACKED live keys exactly; further keys share TRACKED overflow buckets. Hashes use the guard's
+ * private secret, so callers cannot choose collisions. Neither tier evicts live state. Overflow never mutates the
+ * exact tier, and cannot move into a freed exact slot until all overflow state expires: moving would reset budgets.
+ * A success may clear its exact record, but never a shared bucket (which could also hold another name's failures).
+ */
+class KeyedGuardState {
+    secret;
+    domain;
+    entries = new Map();
+    overflow = new Map();
+    constructor(secret, domain) {
+        this.secret = secret;
+        this.domain = domain;
+    }
+    hash(key) { return createHmac("sha256", this.secret).update(this.domain).update("\0").update(key).digest("hex"); }
+    bucket(hash) { return parseInt(hash.slice(0, 8), 16) % TRACKED; }
+    get(key) {
+        const hash = this.hash(key);
+        return this.entries.get(hash) ?? this.overflow.get(this.bucket(hash));
+    }
+    retain(key, create) {
+        const hash = this.hash(key), kept = this.entries.get(hash);
+        if (kept !== undefined)
+            return kept;
+        if (this.overflow.size === 0 && this.entries.size < TRACKED) {
+            const entry = create();
+            this.entries.set(hash, entry);
+            return entry;
+        }
+        const bucket = this.bucket(hash), shared = this.overflow.get(bucket);
+        if (shared !== undefined)
+            return shared;
+        const entry = create();
+        this.overflow.set(bucket, entry);
+        return entry;
+    }
+    clear(key) { this.entries.delete(this.hash(key)); }
+    prune(now, lifetime) {
+        let next = Infinity;
+        const pruneEntries = (entries) => {
+            for (const [key, entry] of entries) {
+                const expires = entry.lastAt + lifetime;
+                if (expires <= now)
+                    entries.delete(key);
+                else
+                    next = Math.min(next, expires);
+            }
+        };
+        pruneEntries(this.entries);
+        pruneEntries(this.overflow);
+        return next;
+    }
+    /** Individual source/name records; shared overflow storage has its own fixed TRACKED-bucket bound. */
+    get size() { return this.entries.size; }
+}
 export class PasswordGuard {
     policy;
-    accounts = new Map();
+    secret = randomBytes(32);
+    sources = new KeyedGuardState(this.secret, "source/name");
+    slowdowns = new KeyedGuardState(this.secret, "name");
+    nextPruneAt = Infinity;
     /** Told once per lock: the account (as typed), and for how long. */
     onLock = null;
     constructor(policy = DEFAULT_GUARD_POLICY) {
         this.policy = policy;
     }
     static key(account) { return account.trim().toLowerCase().slice(0, 64); }
-    /** Milliseconds this account stays locked (0: it may try). */
-    lockedFor(account, now) {
-        const state = this.accounts.get(PasswordGuard.key(account));
-        return state === undefined ? 0 : Math.max(0, state.lockedUntil - now);
+    static pair(account, source) {
+        const key = sourceKey(source);
+        return `${LOCAL_PEERS.has(key) ? LOCAL_SOURCE : key}\u0000${PasswordGuard.key(account)}`;
+    }
+    /** Prune by the supplied time, even below capacity; retain a lock's escalation history for a day. */
+    prune(now) {
+        if (now < this.nextPruneAt)
+            return;
+        this.nextPruneAt = Math.min(this.sources.prune(now, this.policy.maxLockMs), this.slowdowns.prune(now, this.policy.maxLockMs));
     }
-    failed(account, now) {
+    /** Source-local snapshot for existing callers. Authentication must use preflight to spend the shared budget. */
+    lockedFor(account, now, source = currentPasswordSource()) {
+        this.prune(now);
+        const pair = PasswordGuard.pair(account, source);
+        const tries = this.sources.get(pair);
+        if (tries === undefined)
+            return 0;
+        const slowdown = this.slowdowns.get(PasswordGuard.key(account));
+        // Legacy observation only: account existence never affects authentication or state retention.
+        return Math.max(0, tries.lockedUntil - now, slowdown?.observedAccount === true ? slowdown.until - now : 0);
+    }
+    /** Reserve one password check, or return its wait. No password derivation may precede this call. */
+    preflight(account, now, source = currentPasswordSource(), proven = false) {
+        this.prune(now);
+        const tries = this.sources.get(PasswordGuard.pair(account, source));
         const key = PasswordGuard.key(account);
-        const state = this.accounts.get(key) ?? { failures: 0, lockedUntil: 0, locks: 0 };
-        this.accounts.delete(key);
-        state.failures += 1;
-        if (state.failures >= this.policy.failuresBeforeLock) {
-            const lockMs = Math.min(this.policy.maxLockMs, this.policy.firstLockMs * 2 ** state.locks);
-            state.lockedUntil = now + lockMs;
-            state.locks += 1;
-            state.failures = 0;
+        const slowdown = this.slowdowns.get(key);
+        const sourceWait = Math.max(0, (tries?.lockedUntil ?? 0) - now, tries === undefined ? 0 : (slowdown?.until ?? 0) - now);
+        if (sourceWait > 0)
+            return sourceWait;
+        if (proven || slowdown === undefined || slowdown.until <= now)
+            return 0;
+        slowdown.admissions = slowdown.admissions.filter(at => at > now - ACCOUNT_PASSWORD_WINDOW_MS);
+        if (slowdown.admissions.length >= ACCOUNT_PASSWORD_TRIES) {
+            return slowdown.admissions[0] + ACCOUNT_PASSWORD_WINDOW_MS - now;
+        }
+        slowdown.admissions.push(now);
+        return 0;
+    }
+    /** A wrong password; only a database lookup may establish `exists`. */
+    failed(account, now, source = currentPasswordSource(), exists = false) {
+        this.prune(now);
+        const pair = PasswordGuard.pair(account, source);
+        const tries = this.sources.retain(pair, () => ({ failures: 0, lockedUntil: 0, locks: 0, lastAt: now }));
+        tries.failures += 1;
+        tries.lastAt = now;
+        this.nextPruneAt = Math.min(this.nextPruneAt, now + this.policy.maxLockMs);
+        if (tries.failures >= this.policy.failuresBeforeLock) {
+            const lockMs = Math.min(this.policy.maxLockMs, this.policy.firstLockMs * 2 ** tries.locks);
+            tries.lockedUntil = now + lockMs;
+            tries.locks += 1;
+            tries.failures = 0;
             this.onLock?.(account.trim().slice(0, 64), lockMs);
         }
-        this.accounts.set(key, state);
-        // Bounded: the oldest tracked names go first.
-        while (this.accounts.size > TRACKED)
-            this.accounts.delete(this.accounts.keys().next().value);
+        const key = PasswordGuard.key(account);
+        const slowdown = this.slowdowns.retain(key, () => ({ failures: 0, until: 0, lastAt: now, admissions: [], observedAccount: false }));
+        slowdown.observedAccount = exists;
+        slowdown.failures += 1;
+        slowdown.lastAt = now;
+        const over = slowdown.failures - this.policy.failuresBeforeLock;
+        if (over >= 0)
+            slowdown.until = now + Math.min(this.policy.maxLockMs, this.policy.firstSlowMs * 2 ** Math.min(over, 32));
     }
-    succeeded(account) {
-        this.accounts.delete(PasswordGuard.key(account));
+    /** The right password clears individually tracked state; shared overflow buckets must expire by time. */
+    succeeded(account, source = currentPasswordSource()) {
+        const pair = PasswordGuard.pair(account, source);
+        this.sources.clear(pair);
+        this.slowdowns.clear(PasswordGuard.key(account));
     }
+    /** Individually tracked source-and-name entries (at most TRACKED), excluding fixed shared overflow buckets. */
+    get size() { return this.sources.size; }
 }
 const guards = new WeakMap();
 /** The guard for one database (a store): every password check against it counts. */
@@ -59,11 +181,12 @@ export class SourceBudget {
         this.windowMs = windowMs;
     }
     /** Milliseconds until this address may try again (0: it may). */
-    waitFor(source, now) {
-        const recent = (this.sources.get(source) ?? []).filter(at => now - at < this.windowMs);
+    waitFor(address, now) {
+        const recent = (this.sources.get(sourceKey(address)) ?? []).filter(at => now - at < this.windowMs);
         return recent.length < this.tries ? 0 : this.windowMs - (now - recent[0]);
     }
-    failed(source, now) {
+    failed(address, now) {
+        const source = sourceKey(address);
         const recent = (this.sources.get(source) ?? []).filter(at => now - at < this.windowMs);
         recent.push(now);
         this.sources.delete(source);

package/dist/source-key.d.ts

@@ -0,0 +1,2 @@
+/** The budget key for one address, as described above. */
+export declare function sourceKey(source: string): string;

package/dist/source-key.js

@@ -0,0 +1,49 @@
+/**
+ * The key a per-source budget counts under. One IPv6 subscriber is usually handed a whole /64, so keying by the full
+ * address would give one caller 2^64 fresh budgets: a native IPv6 address counts as its /64 (`2001:db8:1:2::/64`),
+ * however it is spelled. IPv4 stays exact, and an IPv4-mapped IPv6 address (`::ffff:203.0.113.5`) is that IPv4 address.
+ * `::1` stays itself, so this computer is never pooled with anything else. The trusted proxy's `fwd:` marker is kept,
+ * and anything that isn't an address ("unknown", a tenant id) is returned unchanged.
+ */
+const IPV4 = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+/** The eight 16-bit groups of an IPv6 address (brackets and a zone ignored), or null when it isn't one. */
+function ipv6Groups(text) {
+    let bare = text.trim().replace(/^\[(.*)\]$/, "$1").replace(/%.*$/, "").toLowerCase();
+    if (!bare.includes(":") || !/^[0-9a-f:.]+$/.test(bare))
+        return null;
+    // An embedded IPv4 tail is two groups.
+    const tail = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(bare);
+    if (tail !== null) {
+        if (!IPV4.test(tail[2]))
+            return null;
+        const [a, b, c, d] = tail[2].split(".").map(Number);
+        bare = `${tail[1]}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
+    }
+    const halves = bare.split("::");
+    if (halves.length > 2)
+        return null;
+    const part = (one) => one === "" ? [] : one.split(":").every(group => /^[0-9a-f]{1,4}$/.test(group)) ? one.split(":") : null;
+    const head = part(halves[0]), rest = halves.length === 2 ? part(halves[1]) : [];
+    if (head === null || rest === null)
+        return null;
+    const missing = 8 - head.length - rest.length;
+    if (halves.length === 2 ? missing < 1 : missing !== 0)
+        return null;
+    return [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest].map(group => parseInt(group, 16));
+}
+/** The budget key for one address, as described above. */
+export function sourceKey(source) {
+    if (source.startsWith("fwd:"))
+        return `fwd:${sourceKey(source.slice(4))}`;
+    if (IPV4.test(source))
+        return source;
+    const groups = ipv6Groups(source);
+    if (groups === null)
+        return source;
+    if (groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff) {
+        return `${groups[6] >> 8}.${groups[6] & 0xff}.${groups[7] >> 8}.${groups[7] & 0xff}`;
+    }
+    if (groups.slice(0, 7).every(group => group === 0) && groups[7] === 1)
+        return "::1";
+    return `${groups.slice(0, 4).map(group => group.toString(16)).join(":")}::/64`;
+}

package/dist/team-http.d.ts

@@ -2,6 +2,9 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type TeamActor, type TeamExecute } from './team-contract.js';
 import { type Admission } from './request-budget.js';
 export declare const TEAM_REQUEST_BYTES: number;
+/** How long a password bearer's proof stands on a long /api/team/events stream before its password is checked again.
+ * The account, its revocation and its credential generation are still rechecked on every tick. */
+export declare const TEAM_PASSWORD_REVERIFY_MS: number;
 /** Account role belongs to HTTP authentication; API tokens carry their own scope. */
 export type TeamHttpActor = TeamActor & {
     role?: 'approver' | 'viewer';

package/dist/team-http.js

@@ -2,6 +2,9 @@ import { adapterPolicy } from "./server/route-policy.js";
 import { TEAM_OPERATIONS, TEAM_MUTATIONS, teamScopeAllows } from './team-contract.js';
 import { limitWords } from './request-budget.js';
 export const TEAM_REQUEST_BYTES = 64 * 1024;
+/** How long a password bearer's proof stands on a long /api/team/events stream before its password is checked again.
+ * The account, its revocation and its credential generation are still rechecked on every tick. */
+export const TEAM_PASSWORD_REVERIFY_MS = 5 * 60_000;
 const failure = (code, message) => ({ version: 1, ok: false, code, message });
 function send(response, status, value, headers = {}) {
     if (response.destroyed || response.writableEnded)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.50",
+  "version": "0.9.51",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"