security(sharing): share-link password handling falls short of the platform's credential rules (response shape, hashing strength, transport) — detail withheld pending maintainer

[objectstack-fleet]

Found while verifying an authorization-class candidate from the 17.7 pre-release console run #21782 (access-security.share-link-landing-page area, outside the item's clauses), by an independent verifier (RUNNER rule 7) on current main.

• Class: credential handling. Three related shortfalls in how a password-protected share link's password is returned, stored and transmitted. No disclosure to a principal other than the one who set the password was found. Under RUNNER rule 2 the detail is withheld pending maintainer and held in the PM session (Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6).
• Direction: the password never travels back out of the server in any form; its stored form uses a slow password hash; the console sends it in a header, not in the request URL.
• Side issue (UX, not security): the landing page shows a password prompt for a link that requires sign-in.
• Severity as judged by the verifier: low. Predates 17.6.0.
• Owning repos: objectstack (server) and objectui (console transport). No open card covers it.

---

Generated by Claude Code

[objectstack-fleet]

Path: permissions that actually hold — share links that can be revoked and do not leak | access-security.share-link-capability-tokens | P2

Triage: first grade — bug · security · priority:p3 · domain:services · area:access · pm:queue. The server half here; the console half is filed in objectui

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T07:55Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only. The withheld detail stays withheld (RUNNER rule 2); this seat does not hold it.

Triage: lands in the share-link service (by class, domain:services) for the response shape and the stored form; the console transport lands in objectui; rationale: the card names two owning repos, and each card lives where its fix lands.

• Direction, as the card states (no boundary moves):
  • the password never travels back out of the server in any form;
  • its stored form uses a slow password hash;
  • the server accepts it in a header.
• Why p3. The verifier graded it low: no disclosure to a principal other than the one who set the password was found. It predates 17.6.0.
• The console half (send the password in a header, not the URL, plus the side issue on the landing page's prompt) is filed in objectstack-ai/objectui, blocked on this card.
• The withheld detail goes to the claiming seat from session_018zT8d8NpiQ1ExhuNd5TxY6 on the maintainer's word.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21839-share-link-password
Worktree: objectstack-issue-21839
Domain: domain:services (card label, as triage set it)
File surface: packages/plugins/plugin-sharing/src, .changeset/ (+ objectui console transport, separate PR there)
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 5990403270
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「都开单派发」; landing per the standing order 「开发完整就进队列合并」. Dispatched one at a time within the session's load cap. Where the card withholds detail, this session holds it and the dispatch carries it privately.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21839,
  "status": "done",
  "branch": "claude/issue-21839-share-link-password",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21890",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Server half implemented in packages/plugins/plugin-sharing/src. (1) ShareLinkService.createLink returned the inserted row hash included (both POST mounts echo it); every service exit now goes through one projection (withoutPasswordHash): createLink, listLinks, resolveToken. (2) New share-link-password.ts: scrypt at the platform account-password parameters (N=16384 r=16 p=1, 64-byte key, hex salt, NFKC) on node:crypto, no new dependency; legacy sha256$ and weak$ forms still verify and are re-hashed on the first successful redemption after all later gates pass; all comparisons timingSafeEqual; a refused upgrade is reported once at error and never blocks the read; injected hasher pairs untouched. (3) One presentedPassword helper for both public routes; /messages on this mount now takes the x-share-password header (resolve already did; runtime twin already did); ?password= kept for compatibility and named in the changeset; nothing on the path logs either form. Premise partly pre-satisfied: the header was already accepted on /resolve on both mounts, so point 3 reduced to /messages plus the shared helper. Outside the claimed file surface, one derived artefact moved: the upgrade write is one more engine write site, so the tenant-audit census page and counts file were regenerated (232 to 233) to keep check:tenant-audit-census green. PR body: Fixes #21839, Clause-② line copied from the claim. CI state at report time: in_progress (not awaited, per contract).",
  "tests": "Head 1fec589929 (package sources byte-identical since 99dee29775). New src/share-link-password.test.ts: 18 cases on real ObjectQL + driver-sql + better-sqlite3, 18 passed. pnpm --filter @objectstack/plugin-sharing test: Test Files 39 passed, Tests 972 passed. pnpm --filter @objectstack/plugin-sharing typecheck (tsc src + scripts + check:test-typecheck): exit 0, test layer holds existing 2 files / 3 pinned signatures. Downstream twin: pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 src/domains/share-links: 2 files / 29 passed (against rebuilt plugin dist). Narrowed lint: eslint --no-inline-config --format json over the 4 changed .ts files reports 4 files / 0 errors / 0 warnings; population read from eslint.config.mjs (glob covers all four); invariance: no typed linting (no parserOptions.project), so untouched files cannot move. dispatch-gates --repo objectstack-ai/objectstack --ran: 97 derived, 95 run all exit 0; NOT MEASURED: check:dual-build-cjs-loads and check:i18n, reason: PREREQUISITE NOT MET exit 3 (whole-repo build / CLI build closure), declared to CI; diff touches no object, label or translation source. check:tenant-audit-census was red on the new write site and is green after --write plus the hand-written prose figures. Ablations via scripts/ablation-replace.mjs (anchor hit x1 to x0, blob moved, then restored; HEAD blob hash re-matched, git diff HEAD empty, marker count 0): createLink returning the raw row: 1 failed / 17 passed; legacy upgrade disabled: 3 failed / 15 passed; header read removed: 4 failed / 14 passed. Subjects import ./share-link-*.js relatively (src, not dist), so no rebuild leg was needed for the ablation reads.",
  "mcp_calls": "0",
  "api_writes": "3 relayed writes, each sent as one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]: pr_create POST /repos/objectstack-ai/objectstack/pulls (PR 21890, draft, body read back byte-identical 7178/7178); assign POST /repos/objectstack-ai/objectstack/issues/21890/assignees (hotlong, read back matched); comment POST /repos/objectstack-ai/objectstack/issues/21839/comments (this report). Labels: zero writes (dispatch named none; a changeset exists so skip-changeset does not apply).",
  "open_questions": [
    {
      "question": "Clause-② for this PR. The claim says no; the changeset is patch. Two readings could argue otherwise: (a) the runtime value returned by createLink / the POST response no longer carries password_hash, but the published ShareLink type in packages/spec keeps it as an optional member and no exported type or schema changes, so no published surface narrows by type; (b) /messages on the plugin mount now accepts the x-share-password header, a widened accept set on one mount, but it converges on what the runtime twin (the designed primary surface) and /resolve already accept.",
      "options": ["A keep Clause-②: no, patch (as filed)", "B Clause-②: yes (widening), minor, for the /messages header on the plugin mount", "C Clause-②: yes (narrowing), minor + BREAKING banner + ADR-0087 marker, for the dropped response field"],
      "recommendation": "A, because no exported type, schema or contract text changes, the dropped field was never a value any consumer could use, and the header acceptance only converges one mount on its twin; if the PM reads (b) as widening, B is the only other coherent line and needs only the PR body line and a minor bump."
    },
    {
      "question": "Header precedence. Both mounts read ?password= first when both forms arrive (runtime twin unchanged, outside the file surface). Should the header win instead?",
      "options": ["A leave query-first on both mounts until the objectui header change lands, then retire the query form", "B flip both mounts to header-first now (needs packages/runtime/src/domains/share-links.ts added to the file surface)"],
      "recommendation": "A, because the order only matters when a client sends both, no client does, and flipping one mount alone would make the twins answer the same request differently."
    }
  ],
  "out_of_scope_findings": [
    "carrier: objectui console share-link transport card (blocked on 21839) · runtime twin share-links.ts reads ?password= before the header; retire or reorder when the console stops sending the query form · noted, not filed"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21839,
  "status": "done",
  "branch": "claude/issue-21839-share-link-password",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21890",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Resume run after a container restart; this report supersedes the earlier os-dev-report on this card (one was already posted, contrary to the resume brief). I reviewed the pushed diff against the three asks. (1) Every service exit (createLink, listLinks, resolveToken) goes through withoutPasswordHash; both POST mounts and the runtime twin's list/resolve answer from those values; the audit writer omits internal fields and sys_share_link has trackHistory off. (2) The new rows use scrypt at the account-password parameters on node:crypto (no new dependency; plugin-auth's hasher is a private method in a package plugin-sharing does not depend on, so no reusable helper exists). Legacy sha256 and weak forms still verify and are re-hashed after a successful redemption once later gates pass. All comparisons are timingSafeEqual. (3) The header is accepted on both public routes, ?password= is kept and named in the changeset, and nothing on the path logs either form (the hono adapter logs method and path only). One gap fixed: the list and redemption no-hash pins stayed green with the projection removed, because the engine strip already held them. New commit eacae6b6be adds a case on an engine whose reads return the hash, with a control assertion that they do, so the projection itself is pinned. PR assignee hotlong already present, so no label-write was needed. The PR body is not edited. Its test counts are now stale; see open_questions.",
  "tests": "Final head eacae6b6be. pnpm --filter @objectstack/plugin-sharing test: Test Files 39 passed (39), Tests 973 passed (973). pnpm --filter @objectstack/plugin-sharing typecheck (tsc src + tsconfig.scripts + check:test-typecheck): exit 0, 'check:test-typecheck: OK ... 2 file(s) / 3 error(s) / 3 pinned signature(s) held'; tsc --listFiles -p tsconfig.test.json lists share-link-password.test.ts, so the test layer compiles the new pins. Dependency closure built first (plugin-sharing and its deps, VERDICT command-exit 0). Projection ablation via scripts/ablation-replace.mjs on share-link-service.ts. Anchor: the withoutPasswordHash guard line, replaced by 'return link'. Before the fix (on 1fec589929): anchor x1 to x0, blob 6b680a6cb8 to 8b41cd5b54, 1 failed / 17 passed (mint pin only; list and redemption pins stayed green, which was the gap). After the fix, from committed eacae6b6be: the same mutation landed (anchor 1 to 0, blob 6b680a6cb8 to 8b41cd5b54) and gave 2 failed / 17 passed (the mint pin and the new non-stripping-engine pin). Restore: blob == HEAD 6b680a6cb8, git diff HEAD empty, marker count 0. The subject is imported relatively from src, with no dist in the path, so no rebuild leg was needed. Narrowed lint over the 4 changed .ts files: eslint --no-inline-config --format json gives 4 files / 0 errors / 0 warnings. Population: eslint.config.mjs files globs '**/*.{ts,...}' and 'packages/**/*.{ts,...}' cover all four, and 0 warnings means none was ignored. Invariance: the config uses no parserOptions.project and no typed rules, so the diff cannot move a verdict on an untouched file. dispatch-gates --repo objectstack-ai/objectstack --ran (exit codes recorded, run after the final commit at eacae6b6be): 97 derived, 94 run (all exit 0), 3 NOT MEASURED, 0 UNRUN. NOT MEASURED: check:skill-examples (client SDK dist), check:dual-build-cjs-loads (whole-repo build) and check:i18n (CLI build closure); reason PREREQUISITE NOT MET, exit 3; declared to CI. The diff changes no skill, object, label or translation source. CI: not awaited, per contract.",
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/21839/comments (this report). Plus one git push (eacae6b6be), which is not a REST write. No label or assignee write: the PR assignee read back as hotlong. Reads were gh api GETs only (issue comments, PR 21890).",
  "open_questions": [
    {
      "question": "Clause-② for PR 21890: no (patch), as claimed, or a narrowing?",
      "options": [
        "A Clause-②: no, patch. No published type or schema loses a field: ShareLink.password_hash stays declared optional in packages/spec/src/contracts/share-link-service.ts (the persisted-shape mirror), and plugin-sharing's index.ts exports are byte-unchanged (ShareLinkServiceOptions changes only in doc comments). Only the runtime value drops a key that no consumer could use.",
        "B Clause-②: yes (narrowing), minor, with a BREAKING banner and an ADR-0087 marker. This applies only if the dropped key in the mint response counts as a published response narrowing, which the instruction's test (a published type, schema or export losing a field) does not meet."
      ],
      "recommendation": "A. By the stated test, nothing published in spec or in the package exports loses a field. The claim, PR body line and patch changeset already agree."
    },
    {
      "question": "The PR body test figures are stale after eacae6b6be. Who writes the correction? Dev does not PATCH the body.",
      "options": [
        "A Seat edits the Tests section. New text: 'New src/share-link-password.test.ts, 19 cases'. Add a bullet: 'The list and the redemption result carry no hash even from an engine that does not strip it (control asserts the engine returns it)'. Local runs at final head eacae6b6be: 39 files / 973 tests. The createLink ablation line becomes: projection removed: 2 failed / 17 passed (the mint pin and the non-stripping-engine pin).",
        "B Leave the body as is; this report and the commit message carry the figures."
      ],
      "recommendation": "A, because reviewers read the body, and its current ablation line understates what the pins catch."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · the request-throttling posture of the two public share-link routes under the new slow hash is unreviewed (inference, no measured repro, so not filed). Detail is withheld under this card's security handling and available from this session on request; the Acceptance-notes home is next to the existing cost-per-redemption note · dedupe words: share link throttling, public share route rate limit, slow hash public route"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
"issue": 21839,
"status": "done",
"branch": "claude/issue-21839-share-link-password",
"pr": "#21890",
"session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
"premise_still_valid": true,
"summary": "Round 2 on PR #21890, the three security-review follow-ups. (1) X-Share-Password is now in DEFAULT_CORS_ALLOW_HEADERS (plugin-hono-server adapter.ts), which hono-plugin.ts and the @objectstack/hono adapter both use; the docs page content/docs/protocol/kernel/http-protocol.mdx shows the same list and got the matching row. (2) Both public share-link routes (/:token/resolve, /:token/messages) now send Cache-Control: no-store and Vary: X-Share-Password on every outcome (success, refusal, thrown error), on both mounts: plugin-sharing share-link-routes.ts sets them at handler entry, and runtime domains/share-links.ts wraps the body so every public-route result carries them. The create, list and revoke routes are unchanged. (3) On WebContainer (detected the same way plugin-auth's isWebContainerRuntime does), share-link-password.ts derives the key with @noble/hashes/scrypt.js scryptAsync, loaded lazily and only on that host, with the same N/r/p/dkLen/maxmem, NFKC input, hex-salt input and stored form; elsewhere it uses node:crypto. @noble/hashes ^2.4.0 is a new plugin-sharing dependency, at the version plugin-auth already resolves (lockfile +3 lines, importer entry only); check-undeclared-dep-imports is green. The query-vs-header precedence is untouched. The branch had fallen 10 commits behind main, so origin/main was merged in (merge commit, clean). The changeset is still patch and now also names plugin-hono-server and runtime. The PR body was not edited. Deviations: the claim's file surface was plugin-sharing, but this round also touches plugin-hono-server (adapter.ts plus hono-plugin.test.ts, as the dispatch said), runtime/src/domains/share-links.ts plus a new runtime test, and the docs page. The pre-push hook check:commit-card-trailers refused the first push because the trailer named a model. Both commits were still unpublished, so I reworded them to the model-free trailer pair with commit-tree; the trees were byte-identical to the measured commit (ae8b75d6aa), so this was a fast-forward push, not a force-push. The remote head is c3791ea.",
"tests": "All measured on tree ae8b75d6aa (commit 40238dacca, reworded to c3791ea with no tree change). Build: pnpm --filter for the dependency closures of plugin-sharing, plugin-hono-server and runtime, then the packages themselves: VERDICT command-exit 0. plugin-sharing vitest: Test Files 40 passed (40), Tests 979 passed (979). plugin-hono-server pnpm test: Test Files 27 passed (27), Tests 325 passed (325), including the new 'should allow X-Share-Password by default'. runtime share-link suites (share-links-public-cache-headers [new], share-links-internal-hash-probe, share-links-enforcement-context): Test Files 3 passed (3), Tests 32 passed (32). Typecheck: pnpm run typecheck for plugin-sharing, plugin-hono-server and runtime (tsc plus check:test-typecheck): VERDICT command-exit 0; each package's test-typecheck line reads OK and the debt counts did not move (plugin-sharing 2 files/3 errors, hono-server 0/0, runtime 27/190). Ablation, run once and not kept as a test file: after the commit, ablation-replace (anchors hit; grep -c of each injected text = 1) removed (a) the plugin-sharing header loop, (b) the runtime header wrap, and (c) the WebContainer branch. Result: 4 failed in plugin-sharing (2 no-store tests, 2 WebContainer interchange tests) and 2 failed in runtime (resolve and messages). The tests import the package source by relative path, so no dist rebuild was needed. Restore was git checkout HEAD -- on all three paths under an EXIT trap; git diff HEAD = 0 bytes and git status was clean. The byte-identity test (pure-JS key vs node scryptSync) stayed green under (c), as expected, because it compares the two implementations directly. Lint, narrowed: eslint --no-inline-config --format json over the 9 changed .ts files in the merge-base diff: 9 files reported, 0 errors, 0 warnings, none ignored. Invariance: eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules; its own comment near line 328 says so), so this diff cannot change the verdict on any untouched file. dispatch-gates --repo objectstack-ai/objectstack: 108 derived. Every command was run with its exit captured before any pipe; --ran verdict: 108 accounted, 106 run, 2 NOT-MEASURED, 0 UNRUN. All 106 run gates exited 0, including check:nul-bytes, check:engine-double-contract, check:undeclared-dep-imports, check:type-check-debt (re-measured, 26 raw errors, none above the record) and check:query-options-erasure (none new). check:skill-examples first refused with exit 3 (client-react not built); after building the client-react closure it exited 0. NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET exit 3 (needs dist for about 37 packages outside this diff). NOT MEASURED: check:i18n, reason: PREREQUISITE NOT MET exit 3 (needs the CLI build closure). Both are left to CI. CI on c3791ea: in_progress (not waited on).",
"mcp_calls": "0",
"api_writes": "1 — POST /repos//issues/21839/comments (this os-dev-report, through the scripts/pm/fleet-write relay). git push is not counted. No label write and no PR body edit this round. One REST read: GET /repos/objectstack-ai/objectstack/pulls/21890.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed — the WebContainer detection predicate now has three copies (plugin-auth auth-manager.ts, service-settings local-crypto-provider.ts, and plugin-sharing share-link-password.ts). This PR copied the existing pattern instead of promoting a shared helper, which would add a new export surface. Dedupe words: isWebContainerRuntime, webcontainer detection, STACKBLITZ, jsh"
]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21839,
  "status": "done",
  "branch": "claude/issue-21839-share-link-password",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21890",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Round 3, the three review findings. (1) packages/runtime/src/domains/share-links.ts: the public-route header wrapper now catches a throw from outside the body's own try (service resolution, engine lookup), maps it through deps.errorFromThrown(err, 500), and only then adds the no-store / Vary pair, so the docblock's 'every outcome, thrown error included' claim holds. Authenticated routes keep propagating a throw unchanged, so their behaviour is untouched. (2) share-link-password-webcontainer.test.ts gains a case whose NFKC form differs from its input (decomposed e + combining acute, a fullwidth A): hashed on the pure-JS path and verified on the native one, and the reverse, each with both spellings accepted and a near-miss refused. (3) The changeset frontmatter now lists '@objectstack/hono': patch; no Clause-② line was added or changed. Before the fixes, origin/main (3 commits ahead) was merged in with a merge commit (f592f64ff8, clean, no os-regen debt). Pushed head c852449b1b. PR body not edited.",
  "tests": "All on head c852449b1b. Build closure (lock): pnpm --filter '@objectstack/runtime...' --filter '@objectstack/plugin-hono-server...' --filter '@objectstack/plugin-sharing...' build, VERDICT command-exit 0. Tests (lock, VERDICT command-exit 0): plugin-sharing 40 files / 980 tests passed; plugin-hono-server 27 files / 325 tests passed; runtime share-link suites (public-cache-headers, enforcement-context, internal-hash-probe) 3 files / 34 tests passed. Typecheck (lock, VERDICT command-exit 0): runtime, plugin-sharing, plugin-hono-server typecheck, including check:test-typecheck: OK for each (runtime 27 files / 190 errors / 68 pinned signatures held, unchanged ledger; plugin-sharing 2/3/3 held; hono-server 0/0/0). Ablation 1, finding 1 fix (committed first, via scripts/ablation-replace.mjs, src-relative import so no dist leg): anchor 'if (!isPublic) throw err;' 1 to 0, blob 74298831652a to 5221362f4249; the new resolveService-throws test went red (1 failed / 4 passed); restored blob == HEAD 74298831652a, git diff HEAD empty. Ablation 2, finding 2: removed NFKC normalisation on the pure-JS derive path, anchor 1 to 0; the new NFKC-differing case went red (1 failed / 3 passed) while the existing byte-identical case stayed green, which is the gap the review named; restored blob == HEAD de6486d6c29f, diff empty. Lint narrowed: the population is eslint.config.mjs, which enables no type-aware linting (no parserOptions.project, no typed rules, stated in its own header at line 327), so the diff cannot move any untouched file's verdict; eslint --no-inline-config --format json over all 9 .ts files the PR changes vs merge base cab6396715: files 9, errors 0, warnings 0 (the 3 files this round touched included). Gates: dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (derived at c852449b1b, 15 paths vs merge base cab6396715) gave 108 commands; 104 exit 0, including check-adr-0087-registration (--base + --self-test), check-changeset-fixed, check-changeset-no-major (--base + --self-test; the Clause-② level axis reads NOT APPLICABLE locally, no pull_request input), check-empty-changeset (--base + --self-test), check:changeset-gate-self-tests, check:objectui-changeset, check:pm-changeset-deadline-census, check:nul-bytes, check:cross-package-test-inputs, check:test-source-alias, check:type-check-coverage. NOT MEASURED, 4: spec check:skill-examples, check:dual-build-cjs-loads, check:i18n (each exit 3 PREREQUISITE NOT MET: needs the whole-repo dist, and only the three closures were built); check:type-check-debt (exit 124, my 240 s per-gate timeout, a repo-wide tsc measurement). All four are left to CI. Package-level typecheck above is green with unchanged debt counts.",
  "mcp_calls": "0",
  "api_writes": "1 — this os-dev-report comment on #21839 via scripts/pm/post-stamped.mjs (fleet relay). git push is not a REST write. No label, PR-body or assignee writes this round.",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code