@cryptiklemur/lattice 5.1.1 → 5.3.0

package/dist/server/daemon.js

@@ -404,12 +404,27 @@ export async function startDaemon(portOverride, tlsOverride) {
                 cert: readFileSync(certs.cert),
                 key: readFileSync(certs.key),
             };
-            log.server("TLS enabled");
+            log.server("TLS enabled (cert: %s)", certs.cert);
         }
         catch (err) {
-            console.error("[lattice] Failed to load TLS certs, falling back to HTTP:", err);
+            if (err?.code === "EACCES") {
+                console.error("[lattice] Permission denied reading TLS certs. Run 'lattice setup-tls' to fix permissions.");
+            }
+            else {
+                console.error("[lattice] Failed to load TLS certs, falling back to HTTP:", err);
+            }
         }
     }
+    if (tlsOptions) {
+        var certsDir = join(getLatticeHome(), "certs");
+        log.server("TLS cert: %s", join(certsDir, "cert.pem"));
+        log.server("To trust the self-signed cert:");
+        log.server("  Linux:  sudo cp %s /usr/local/share/ca-certificates/lattice.crt && sudo update-ca-certificates", join(certsDir, "cert.pem"));
+        log.server("  macOS:  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain %s", join(certsDir, "cert.pem"));
+        log.server("  Or use Tailscale HTTPS (no trust needed):");
+        log.server("  tailscale cert $(tailscale status --json | jq -r '.Self.DNSName' | sed 's/\\.$//')");
+        log.server("  Then copy: cp <hostname>.crt %s && cp <hostname>.key %s", join(certsDir, "cert.pem"), join(certsDir, "key.pem"));
+    }
     var protocol = tlsOptions ? "https" : "http";
     var httpServer = tlsOptions
         ? createHttpsServer(tlsOptions, app)

package/dist/server/index.js

@@ -18,7 +18,7 @@ function getCurrentVersion() {
     }
 }
 var args = process.argv.slice(2);
-var command = "start";
+var command = "help";
 var portOverride = null;
 var tlsOverride = null;
 for (var i = 0; i < args.length; i++) {
@@ -92,11 +92,11 @@ function spawnDaemon(port, tls) {
         var pkgRoot = join(__dirname_local, "..");
         var localTsx = join(pkgRoot, "node_modules", ".bin", "tsx");
         spawnCmd = existsSync(localTsx) ? localTsx : "tsx";
-        spawnArgs = ["--tsconfig", join(pkgRoot, "tsconfig.json"), __filename_local, "daemon", "--port", String(port)];
+        spawnArgs = ["--tsconfig", join(pkgRoot, "tsconfig.json"), __filename_local, "run", "--port", String(port)];
     }
     else {
         spawnCmd = process.execPath;
-        spawnArgs = [__filename_local, "daemon", "--port", String(port)];
+        spawnArgs = [__filename_local, "run", "--port", String(port)];
     }
     if (tls === true)
         spawnArgs.push("--tls");
@@ -111,6 +111,7 @@ function spawnDaemon(port, tls) {
     return child.pid;
 }
 switch (command) {
+    case "run":
     case "daemon":
         await runDaemon();
         break;
@@ -141,6 +142,9 @@ switch (command) {
     case "config":
         runConfigInfo();
         break;
+    case "setup-tls":
+        await runSetupTls();
+        break;
     case "help":
     case "--help":
     case "-h":
@@ -260,7 +264,8 @@ function runHelp() {
     console.log("  Usage: lattice [command] [options]");
     console.log("");
     console.log("  Commands:");
-    console.log("    start      Start the daemon and open the UI (default)");
+    console.log("    start      Start the daemon and open the UI");
+    console.log("    run        Run the daemon in the foreground");
     console.log("    stop       Stop the running daemon");
     console.log("    restart    Stop and restart the daemon");
     console.log("    status     Show daemon status and connection info");
@@ -269,7 +274,8 @@ function runHelp() {
     console.log("    logs       Tail the daemon log");
     console.log("    open       Open the UI in the browser");
     console.log("    config     Show configuration paths and settings");
-    console.log("    help       Show this help message");
+    console.log("    setup-tls  Set up HTTPS (Tailscale or self-signed)");
+    console.log("    help       Show this help message (default)");
     console.log("");
     console.log("  Options:");
     console.log("    --port=N   Override the server port");
@@ -281,6 +287,165 @@ function runHelp() {
     console.log("    DEBUG          Enable debug logging (e.g. DEBUG=lattice:*)");
     console.log("");
 }
+async function runSetupTls() {
+    var { spawnSync } = await import("node:child_process");
+    var { createInterface } = await import("node:readline");
+    var { mkdirSync, chmodSync, chownSync, statSync } = await import("node:fs");
+    var certsDir = join(getLatticeHome(), "certs");
+    var certPath = join(certsDir, "cert.pem");
+    var keyPath = join(certsDir, "key.pem");
+    function prompt(question) {
+        var rl = createInterface({ input: process.stdin, output: process.stdout });
+        return new Promise(function (resolve) {
+            rl.question(question, function (answer) {
+                rl.close();
+                resolve(answer.trim().toLowerCase());
+            });
+        });
+    }
+    console.log("");
+    console.log("  lattice — TLS Setup");
+    console.log("");
+    var hasTailscale = false;
+    var hostname = "";
+    try {
+        spawnSync("tailscale", ["version"], { stdio: "ignore" });
+        hasTailscale = true;
+        var statusResult = spawnSync("tailscale", ["status", "--json"], { encoding: "utf-8" });
+        if (statusResult.status === 0) {
+            hostname = JSON.parse(statusResult.stdout).Self.DNSName.replace(/\.$/, "");
+        }
+    }
+    catch { }
+    if (hasTailscale && hostname) {
+        console.log("  Tailscale detected: " + hostname);
+        console.log("");
+        var answer = await prompt("  Set up Tailscale HTTPS certs automatically? [Y/n] ");
+        if (answer !== "n" && answer !== "no") {
+            if (!existsSync(certsDir)) {
+                mkdirSync(certsDir, { recursive: true });
+            }
+            console.log("");
+            console.log("  Generating Tailscale cert (sudo required)...");
+            console.log("");
+            var certResult = spawnSync("sudo", ["tailscale", "cert", "--cert-file", certPath, "--key-file", keyPath, hostname], { stdio: "inherit" });
+            if (certResult.status !== 0) {
+                console.error("");
+                console.error("  Failed to generate Tailscale certs.");
+                console.error("  You can run manually:");
+                console.error("    sudo tailscale cert --cert-file " + certPath + " --key-file " + keyPath + " " + hostname);
+                process.exit(1);
+            }
+            var uid = process.getuid ? process.getuid() : 0;
+            var gid = process.getgid ? process.getgid() : 0;
+            try {
+                chownSync(certPath, uid, gid);
+                chownSync(keyPath, uid, gid);
+                chmodSync(certPath, 0o644);
+                chmodSync(keyPath, 0o600);
+            }
+            catch {
+                console.log("  Fixing permissions with sudo...");
+                spawnSync("sudo", ["chown", uid + ":" + gid, certPath, keyPath], { stdio: "inherit" });
+                spawnSync("sudo", ["chmod", "644", certPath], { stdio: "inherit" });
+                spawnSync("sudo", ["chmod", "600", keyPath], { stdio: "inherit" });
+            }
+            console.log("");
+            console.log("  Certs installed and permissions fixed.");
+            var config = loadConfig();
+            if (!config.tls) {
+                var { saveConfig: saveCfg } = await import("./config.js");
+                config.tls = true;
+                saveCfg(config);
+                console.log("  TLS enabled in config.");
+            }
+            var pid = readPid();
+            if (pid !== null && isDaemonRunning(pid)) {
+                var restartAnswer = await prompt("  Daemon is running. Restart with TLS? [Y/n] ");
+                if (restartAnswer !== "n" && restartAnswer !== "no") {
+                    console.log("  Restarting daemon...");
+                    try {
+                        process.kill(pid, "SIGTERM");
+                    }
+                    catch { }
+                    removePid();
+                    await new Promise(function (r) { setTimeout(r, 1500); });
+                    var port = portOverride ?? config.port;
+                    var childPid = spawnDaemon(port, true);
+                    writePid(childPid);
+                    console.log("  Daemon restarted (PID " + childPid + ")");
+                }
+            }
+            console.log("");
+            console.log("  Access at: https://" + hostname + ":" + loadConfig().port);
+            console.log("");
+            return;
+        }
+    }
+    else if (hasTailscale) {
+        console.log("  Tailscale detected but could not determine hostname.");
+        console.log("  Run 'tailscale status' to verify your connection.");
+        console.log("");
+    }
+    console.log("  ── Self-signed certificate ──");
+    console.log("");
+    if (existsSync(certPath) && existsSync(keyPath)) {
+        console.log("  Cert exists: " + certPath);
+        console.log("  To regenerate: rm -rf " + certsDir + " && lattice setup-tls");
+    }
+    else {
+        var selfSignAnswer = await prompt("  Generate a self-signed certificate? [Y/n] ");
+        if (selfSignAnswer !== "n" && selfSignAnswer !== "no") {
+            var { ensureCerts } = await import("./tls.js");
+            try {
+                var certs = ensureCerts();
+                console.log("  Certificate generated: " + certs.cert);
+                var config = loadConfig();
+                if (!config.tls) {
+                    var { saveConfig: saveCfg } = await import("./config.js");
+                    config.tls = true;
+                    saveCfg(config);
+                    console.log("  TLS enabled in config.");
+                }
+                var pid = readPid();
+                if (pid !== null && isDaemonRunning(pid)) {
+                    var restartAnswer = await prompt("  Daemon is running. Restart with TLS? [Y/n] ");
+                    if (restartAnswer !== "n" && restartAnswer !== "no") {
+                        console.log("  Restarting daemon...");
+                        try {
+                            process.kill(pid, "SIGTERM");
+                        }
+                        catch { }
+                        removePid();
+                        await new Promise(function (r) { setTimeout(r, 1500); });
+                        var port = portOverride ?? config.port;
+                        var childPid = spawnDaemon(port, true);
+                        writePid(childPid);
+                        console.log("  Daemon restarted (PID " + childPid + ")");
+                    }
+                }
+            }
+            catch (err) {
+                console.error("  Failed to generate certificate:", err);
+                process.exit(1);
+            }
+        }
+    }
+    console.log("");
+    console.log("  To trust the self-signed cert (removes browser warnings):");
+    console.log("");
+    console.log("  Linux:");
+    console.log("    sudo cp " + certPath + " /usr/local/share/ca-certificates/lattice.crt");
+    console.log("    sudo update-ca-certificates");
+    console.log("");
+    console.log("  macOS:");
+    console.log("    sudo security add-trusted-cert -d -r trustRoot \\");
+    console.log("      -k /Library/Keychains/System.keychain " + certPath);
+    console.log("");
+    console.log("  Windows (PowerShell as admin):");
+    console.log("    Import-Certificate -FilePath " + certPath + " -CertStoreLocation Cert:\\LocalMachine\\Root");
+    console.log("");
+}
 async function runRestart() {
     var pid = readPid();
     if (pid !== null && isDaemonRunning(pid)) {

package/dist/server/tls.js

@@ -1,6 +1,7 @@
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { networkInterfaces } from "node:os";
 import { getLatticeHome } from "./config.js";
 export function getCertsDir() {
     var certsDir = join(getLatticeHome(), "certs");
@@ -33,6 +34,20 @@ export function ensureCerts() {
         return { cert: certPath, key: keyPath };
     }
     console.log("[lattice] Generating self-signed TLS certificate...");
+    var sans = ["DNS:lattice", "DNS:localhost", "IP:127.0.0.1", "IP:::1"];
+    var ifaces = networkInterfaces();
+    for (var name in ifaces) {
+        var addrs = ifaces[name];
+        if (!addrs)
+            continue;
+        for (var i = 0; i < addrs.length; i++) {
+            if (!addrs[i].internal) {
+                sans.push("IP:" + addrs[i].address);
+            }
+        }
+    }
+    var extFile = join(certsDir, "openssl-san.cnf");
+    writeFileSync(extFile, "[req]\ndistinguished_name=dn\nx509_extensions=v3\nprompt=no\n[dn]\nCN=lattice\n[v3]\nsubjectAltName=" + sans.join(",") + "\n");
     var result = spawnSync("openssl", [
         "req", "-x509",
         "-newkey", "rsa:2048",
@@ -40,7 +55,7 @@ export function ensureCerts() {
         "-out", certPath,
         "-days", "365",
         "-nodes",
-        "-subj", "/CN=lattice",
+        "-config", extFile,
     ], { encoding: "utf-8" });
     if (result.status !== 0) {
         throw new Error("[lattice] Failed to generate TLS certificates: " + (result.stderr || result.error?.message || "unknown error"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cryptiklemur/lattice",
-  "version": "5.1.1",
+  "version": "5.3.0",
   "description": "Multi-machine agentic dashboard for Claude Code. Monitor sessions, manage MCP servers and skills, orchestrate across mesh-networked nodes.",
   "license": "MIT",
   "author": "Aaron Scherer <me@aaronscherer.me>",