@lifeaitools/clauth 0.3.11 → 0.3.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/.clauth-skill/SKILL.md +184 -184
  2. package/.clauth-skill/references/keys-guide.md +270 -270
  3. package/.clauth-skill/references/operator-guide.md +148 -148
  4. package/README.md +125 -125
  5. package/cli/api.js +113 -112
  6. package/cli/commands/install.js +265 -264
  7. package/cli/commands/scrub.js +231 -231
  8. package/cli/commands/serve.js +1213 -1213
  9. package/cli/commands/uninstall.js +164 -164
  10. package/cli/conf-path.js +21 -0
  11. package/cli/fingerprint.js +91 -91
  12. package/cli/index.js +493 -492
  13. package/install.ps1 +44 -44
  14. package/install.sh +38 -38
  15. package/package.json +54 -54
  16. package/scripts/bin/bootstrap-linux +0 -0
  17. package/scripts/bin/bootstrap-macos +0 -0
  18. package/scripts/bootstrap.cjs +43 -43
  19. package/scripts/build.sh +45 -45
  20. package/supabase/functions/auth-vault/index.ts +235 -235
  21. package/supabase/migrations/001_clauth_schema.sql +103 -103
  22. package/supabase/migrations/002_vault_helpers.sql +90 -90
  23. package/supabase/migrations/20260317_lockout.sql +26 -26
package/cli/commands/serve.js CHANGED
@@ -1,1213 +1,1213 @@
1
- // cli/commands/serve.js
2
- // Localhost-only credential daemon with daemon lifecycle management
3
- // Binds 127.0.0.1 ONLY — unreachable from outside the machine
4
- // 3 failed requests of any kind → process exits, requires manual restart
5
- // Supports: start (background daemon), stop, restart, ping, foreground
6
-
7
- import http from "http";
8
- import fs from "fs";
9
- import os from "os";
10
- import path from "path";
11
- import { fileURLToPath } from "url";
12
- import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
13
- import * as api from "../api.js";
14
- import chalk from "chalk";
15
-
16
- const __dirname = path.dirname(fileURLToPath(import.meta.url));
17
- const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../package.json"), "utf8"));
18
- const VERSION = pkg.version;
19
-
20
- const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
21
- const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
22
-
23
- // ── PID helpers ──────────────────────────────────────────────
24
- function readPid() {
25
- try {
26
- const raw = fs.readFileSync(PID_FILE, "utf8").trim();
27
- const [pid, port] = raw.split(":");
28
- return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
29
- } catch { return null; }
30
- }
31
-
32
- function writePid(pid, port) {
33
- fs.writeFileSync(PID_FILE, `${pid}:${port}`, "utf8");
34
- }
35
-
36
- function removePid() {
37
- try { fs.unlinkSync(PID_FILE); } catch {}
38
- }
39
-
40
- function isProcessAlive(pid) {
41
- try { process.kill(pid, 0); return true; } catch { return false; }
42
- }
43
-
44
- // ── Dashboard HTML ───────────────────────────────────────────
45
- function dashboardHtml(port, whitelist) {
46
- return `<!DOCTYPE html>
47
- <html lang="en">
48
- <head>
49
- <meta charset="utf-8">
50
- <meta name="viewport" content="width=device-width,initial-scale=1">
51
- <title>clauth vault v${VERSION}</title>
52
- <style>
53
- *{margin:0;padding:0;box-sizing:border-box}
54
- body{background:#0a0f1a;color:#e2e8f0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh}
55
- /* ── Lock screen ── */
56
- #lock-screen{display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;padding:2rem}
57
- .lock-card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:2.5rem 2rem;width:100%;max-width:380px;text-align:center}
58
- .lock-icon{font-size:2.5rem;margin-bottom:1rem}
59
- .lock-title{font-size:1.25rem;font-weight:600;color:#f8fafc;margin-bottom:.4rem}
60
- .lock-sub{font-size:.85rem;color:#64748b;margin-bottom:1.75rem}
61
- .lock-input{width:100%;background:#0f172a;border:1px solid #334155;border-radius:8px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:1rem;padding:10px 14px;outline:none;text-align:center;letter-spacing:.1em;transition:border-color .2s;margin-bottom:1rem}
62
- .lock-input:focus{border-color:#3b82f6}
63
- .lock-input.error{border-color:#ef4444;animation:shake .3s}
64
- @keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-6px)}75%{transform:translateX(6px)}}
65
- .btn-unlock{width:100%;background:#3b82f6;color:#fff;border:none;border-radius:8px;padding:10px;font-size:.95rem;font-weight:600;cursor:pointer;transition:background .15s}
66
- .btn-unlock:hover{background:#2563eb}
67
- .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
68
- .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
69
- /* ── Main view ── */
70
- #main-view{display:none;padding:2rem}
71
- .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
72
- .header h1{font-size:1.4rem;font-weight:600;flex:1}
73
- .dot{width:10px;height:10px;border-radius:50%;background:#22c55e;animation:pulse 2s infinite;flex-shrink:0}
74
- @keyframes pulse{0%,100%{opacity:1}50%{opacity:.4}}
75
- .status-bar{display:flex;gap:1.5rem;margin-bottom:1.5rem;font-size:.82rem;color:#94a3b8;flex-wrap:wrap}
76
- .status-bar span{color:#e2e8f0;font-weight:500}
77
- .toolbar{display:flex;gap:8px;margin-bottom:1rem;flex-wrap:wrap;align-items:center}
78
- .chpw-panel{display:none;background:#1a1f2e;border:1px solid #334155;border-radius:8px;padding:1.25rem;margin-bottom:1.5rem}
79
- .chpw-panel h3{font-size:.9rem;font-weight:600;color:#f8fafc;margin-bottom:1rem}
80
- .chpw-row{display:flex;gap:10px;flex-wrap:wrap;align-items:flex-end;margin-bottom:.75rem}
81
- .chpw-field{display:flex;flex-direction:column;gap:4px}
82
- .chpw-field label{font-size:.75rem;color:#64748b}
83
- .chpw-input{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s}
84
- .chpw-input:focus{border-color:#3b82f6}
85
- .chpw-foot{display:flex;gap:8px;align-items:center}
86
- .btn-chpw-save{background:#1e3a5f;color:#60a5fa;padding:7px 18px;font-size:.85rem;border-radius:6px;border:none;cursor:pointer;font-weight:500;transition:background .15s}
87
- .btn-chpw-save:hover{background:#1e4a7f}
88
- .chpw-msg{font-size:.82rem}
89
- .chpw-msg.ok{color:#4ade80} .chpw-msg.fail{color:#f87171}
90
- .btn-refresh{background:#3b82f6;color:#fff;padding:7px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:500}
91
- .btn-refresh:hover{background:#2563eb}
92
- .btn-lock{background:#1e293b;color:#f87171;border:1px solid #334155;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500}
93
- .btn-lock:hover{background:#2d1f1f;border-color:#f87171}
94
- .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:1rem}
95
- .card{background:#1e293b;border:1px solid #334155;border-radius:8px;padding:1.25rem;transition:border-color .2s}
96
- .card:hover{border-color:#3b82f6}
97
- .card-name{font-size:1rem;font-weight:600;color:#f8fafc;margin-bottom:3px}
98
- .card-type{font-size:.78rem;color:#64748b;text-transform:uppercase;letter-spacing:.5px}
99
- .card-getkey{font-size:.75rem;color:#3b82f6;text-decoration:none;opacity:.7;transition:opacity .15s}
100
- .card-getkey:hover{opacity:1;text-decoration:underline}
101
- .card-value{font-family:'Courier New',monospace;font-size:.82rem;color:#22c55e;background:#0f172a;border-radius:4px;padding:8px 10px;margin-top:10px;word-break:break-all;max-height:80px;overflow:auto;display:none}
102
- .card-actions{margin-top:10px;display:flex;gap:7px;flex-wrap:wrap}
103
- .set-panel{display:none;margin-top:10px;background:#0f172a;border-radius:6px;padding:10px;border:1px solid #1e3a5f}
104
- .set-panel label{font-size:.75rem;color:#64748b;display:block;margin-bottom:6px}
105
- .set-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;resize:vertical;min-height:58px;transition:border-color .2s}
106
- .set-input:focus{border-color:#3b82f6}
107
- .set-foot{margin-top:8px;display:flex;gap:8px;align-items:center}
108
- .set-msg{font-size:.8rem}
109
- .set-msg.ok{color:#4ade80} .set-msg.fail{color:#f87171}
110
- .btn{padding:6px 13px;border-radius:6px;border:none;cursor:pointer;font-size:.8rem;font-weight:500;transition:all .15s}
111
- .btn-reveal{background:#1e3a5f;color:#60a5fa}.btn-reveal:hover{background:#1e4a7f}
112
- .btn-copy{background:#1a3328;color:#4ade80}.btn-copy:hover{background:#1a4338}
113
- .btn-set{background:#2d1f4a;color:#a78bfa}.btn-set:hover{background:#3d2f5a}
114
- .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
115
- .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
116
- .btn-check{background:#0f2d2d;color:#34d399;border:1px solid #064e3b;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
117
- .btn-check:hover{background:#134e4a;border-color:#34d399}.btn-check:disabled{opacity:.5;cursor:not-allowed}
118
- .btn-enable{background:#14291a;color:#4ade80;border:1px solid #166534}.btn-enable:hover{background:#1a3d22;border-color:#4ade80}
119
- .btn-disable{background:#2d1f1f;color:#f87171;border:1px solid #7f1d1d}.btn-disable:hover{background:#3d2525;border-color:#f87171}
120
- .svc-badge{font-size:.7rem;font-weight:600;padding:2px 7px;border-radius:4px;letter-spacing:.4px;text-transform:uppercase}
121
- .svc-badge.on{background:rgba(74,222,128,.12);color:#4ade80;border:1px solid rgba(74,222,128,.25)}
122
- .svc-badge.off{background:rgba(248,113,113,.1);color:#f87171;border:1px solid rgba(248,113,113,.2)}
123
- .status-dot{width:8px;height:8px;border-radius:50%;flex-shrink:0;opacity:0;transition:opacity .3s;margin-top:4px;cursor:default}
124
- .status-dot.checking{background:#f59e0b;opacity:1;animation:pulse 1s infinite}
125
- .status-dot.ok{background:#22c55e;opacity:1}
126
- .status-dot.fail{background:#ef4444;opacity:1}
127
- @keyframes sdot-fade{to{opacity:0}} .status-dot.fading{animation:sdot-fade 1.5s forwards}
128
- .error-bar{background:#7f1d1d;color:#fca5a5;border:1px solid #991b1b;padding:10px 14px;border-radius:8px;margin-bottom:1rem;display:none;font-size:.85rem}
129
- .loading{color:#64748b;font-style:italic}
130
- .footer{margin-top:2rem;font-size:.75rem;color:#475569;text-align:center}
131
- .oauth-fields{display:flex;flex-direction:column;gap:8px;margin-bottom:8px}
132
- .oauth-field{display:flex;flex-direction:column;gap:3px}
133
- .oauth-label{font-size:.75rem;color:#94a3b8;font-weight:500}
134
- .oauth-hint{font-size:.71rem;color:#475569;font-style:italic}
135
- .oauth-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;transition:border-color .2s}
136
- .oauth-input:focus{border-color:#3b82f6}
137
- </style>
138
- </head>
139
- <body>
140
-
141
- <!-- ── Lock screen ──────────────────────────── -->
142
- <div id="lock-screen">
143
- <div class="lock-card">
144
- <div class="lock-icon">🔒</div>
145
- <div class="lock-title">clauth vault</div>
146
- <div class="lock-sub">Paste your password to unlock</div>
147
- <input class="lock-input" id="lock-input" type="password" placeholder="••••••••••••" autocomplete="off">
148
- <button class="btn-unlock" id="unlock-btn" onclick="unlock()">Unlock</button>
149
- <div class="lock-err" id="lock-err"></div>
150
- </div>
151
- </div>
152
-
153
- <!-- ── Main view (shown after unlock) ──────── -->
154
- <div id="main-view">
155
- <div class="header">
156
- <div class="dot" id="dot"></div>
157
- <h1>🔐 clauth vault <span style="font-size:0.55em;opacity:0.45;font-weight:400">v${VERSION}</span></h1>
158
- </div>
159
- <div id="error-bar" class="error-bar"></div>
160
- <div class="status-bar">
161
- <div>PID: <span id="s-pid">—</span></div>
162
- <div>Port: <span id="s-port">${port}</span></div>
163
- <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
164
- <div>Failures: <span id="s-fails">—</span></div>
165
- </div>
166
- <div class="toolbar">
167
- <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
168
- <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
169
- <button class="btn-lock" onclick="lockVault()">🔒 Lock</button>
170
- <button class="btn-cancel" style="margin-left:auto" onclick="toggleChangePw()">Change Password</button>
171
- </div>
172
-
173
- <div class="chpw-panel" id="chpw-panel">
174
- <h3>Change Master Password</h3>
175
- <div class="chpw-row">
176
- <div class="chpw-field">
177
- <label>New password</label>
178
- <input class="chpw-input" id="chpw-new" type="password" placeholder="min 8 chars" autocomplete="new-password">
179
- </div>
180
- <div class="chpw-field">
181
- <label>Confirm</label>
182
- <input class="chpw-input" id="chpw-confirm" type="password" placeholder="repeat" autocomplete="new-password">
183
- </div>
184
- </div>
185
- <div class="chpw-foot">
186
- <button class="btn-chpw-save" onclick="changePassword()">Update Password</button>
187
- <button class="btn-cancel" onclick="toggleChangePw()">Cancel</button>
188
- <span class="chpw-msg" id="chpw-msg"></span>
189
- </div>
190
- </div>
191
-
192
- <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
193
- <div class="footer">localhost:${port} · 127.0.0.1 only · 3-strike lockout</div>
194
- </div>
195
-
196
- <script>
197
- const BASE = "http://127.0.0.1:${port}";
198
-
199
- const SERVICE_HINTS = {
200
- "neo4j": "neo4j+s://username:password@instance.databases.neo4j.io",
201
- "supabase-db": "postgresql://postgres:password@db.ref.supabase.co:5432/postgres",
202
- "r2": "accountId:accessKeyId:secretAccessKey",
203
- "namecheap": "apiUser:apiKey",
204
- };
205
-
206
- const KEY_URLS = {
207
- "github": "https://github.com/settings/tokens",
208
- "vercel": "https://vercel.com/account/tokens",
209
- "supabase-anon": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
210
- "supabase-service":"https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
211
- "supabase-db": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/database",
212
- "anthropic": "https://console.anthropic.com/settings/keys",
213
- "cloudflare": "https://dash.cloudflare.com/profile/api-tokens",
214
- "r2": "https://dash.cloudflare.com/profile/api-tokens",
215
- "r2-bucket": "https://dash.cloudflare.com/profile/api-tokens",
216
- "rocketreach": "https://rocketreach.co/account?section=security",
217
- "namecheap": "https://ap.www.namecheap.com/settings/tools/apiaccess/",
218
- "neo4j": "https://console.neo4j.io/",
219
- "npm": "https://www.npmjs.com/settings/~/tokens",
220
- "gmail": "https://console.cloud.google.com/apis/credentials",
221
- };
222
-
223
- // ── OAuth import config ─────────────────────
224
- // OAuth services with atomic fields — each field saved as clauth.<service>.<key>
225
- // No JSON blob parsing. Each field is its own vault secret.
226
- const OAUTH_FIELDS = {
227
- "gmail": [
228
- { key: "client_id", label: "Client ID", hint: "From Google Cloud Console → APIs & Services → Credentials → OAuth client", required: true },
229
- { key: "client_secret", label: "Client Secret", hint: "From Google Cloud Console OAuth client", required: true },
230
- { key: "refresh_token", label: "Refresh Token", hint: "From Google OAuth Playground or your app's auth callback", required: true },
231
- { key: "from_address", label: "From Address", hint: "Gmail address to send from (e.g. dave@life.ai)", required: false },
232
- ]
233
- };
234
-
235
- function renderSetPanel(name) {
236
- const fields = OAUTH_FIELDS[name];
237
- if (fields) {
238
- const fieldsHtml = fields.map(f => \`
239
- <div class="oauth-field">
240
- <label class="oauth-label">\${f.label}\${f.required ? "" : " <span style='color:#475569'>(optional)</span>"}</label>
241
- \${f.hint ? \`<div class="oauth-hint">\${f.hint}</div>\` : ""}
242
- <input type="text" class="oauth-input" id="ofield-\${name}-\${f.key}" placeholder="Paste \${f.label}…" spellcheck="false" autocomplete="off">
243
- </div>
244
- \`).join("");
245
- return \`
246
- <div class="set-panel" id="set-panel-\${name}">
247
- <label>Set <strong>\${name}</strong> credentials — paste directly from source, never in chat</label>
248
- <div class="oauth-fields">
249
- \${fieldsHtml}
250
- </div>
251
- <div class="set-foot">
252
- <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
253
- <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
254
- <span class="set-msg" id="set-msg-\${name}"></span>
255
- </div>
256
- </div>
257
- \`;
258
- }
259
- return \`
260
- <div class="set-panel" id="set-panel-\${name}">
261
- <label>New value for <strong>\${name}</strong> — paste here, never in chat</label>
262
- <textarea class="set-input" id="set-input-\${name}" placeholder="\${SERVICE_HINTS[name] || "Paste credential…"}" spellcheck="false"></textarea>
263
- \${SERVICE_HINTS[name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${SERVICE_HINTS[name]}</div>\` : ""}
264
- <div class="set-foot">
265
- <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
266
- <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
267
- <span class="set-msg" id="set-msg-\${name}"></span>
268
- </div>
269
- </div>
270
- \`;
271
- }
272
-
273
- // ── Boot: check lock state ──────────────────
274
- async function boot() {
275
- try {
276
- const ping = await fetch(BASE + "/ping").then(r => r.json());
277
- if (ping.locked) {
278
- showLockScreen();
279
- } else {
280
- showMain(ping);
281
- loadServices();
282
- }
283
- } catch {
284
- showLockScreen();
285
- }
286
- }
287
-
288
- function showLockScreen() {
289
- document.getElementById("lock-screen").style.display = "flex";
290
- document.getElementById("main-view").style.display = "none";
291
- setTimeout(() => document.getElementById("lock-input").focus(), 50);
292
- }
293
-
294
- function showMain(ping) {
295
- document.getElementById("lock-screen").style.display = "none";
296
- document.getElementById("main-view").style.display = "block";
297
- if (ping) {
298
- document.getElementById("s-pid").textContent = ping.pid || "—";
299
- document.getElementById("s-fails").textContent =
300
- ping.failures + "/" + (ping.failures + ping.failures_remaining);
301
- }
302
- }
303
-
304
- // ── Unlock ──────────────────────────────────
305
- async function unlock() {
306
- const input = document.getElementById("lock-input");
307
- const btn = document.getElementById("unlock-btn");
308
- const err = document.getElementById("lock-err");
309
- const pw = input.value;
310
-
311
- if (!pw) { err.textContent = "Password is required."; return; }
312
-
313
- btn.disabled = true; btn.textContent = "Verifying…"; err.textContent = "";
314
-
315
- try {
316
- const r = await fetch(BASE + "/auth", {
317
- method: "POST",
318
- headers: { "Content-Type": "application/json" },
319
- body: JSON.stringify({ password: pw })
320
- }).then(r => r.json());
321
-
322
- if (r.error) throw new Error(r.error);
323
-
324
- input.value = "";
325
- const ping = await fetch(BASE + "/ping").then(r => r.json());
326
- showMain(ping);
327
- loadServices();
328
- } catch (e) {
329
- input.value = "";
330
- input.className = "lock-input error";
331
- err.textContent = "✗ " + (e.message || "Invalid password");
332
- setTimeout(() => input.className = "lock-input", 600);
333
- } finally {
334
- btn.disabled = false; btn.textContent = "Unlock";
335
- }
336
- }
337
-
338
- // ── Lock ────────────────────────────────────
339
- async function lockVault() {
340
- await fetch(BASE + "/lock", { method: "POST" }).catch(() => {});
341
- showLockScreen();
342
- }
343
-
344
- // ── Load services ───────────────────────────
345
- async function loadServices() {
346
- const grid = document.getElementById("grid");
347
- const err = document.getElementById("error-bar");
348
- err.style.display = "none";
349
- grid.innerHTML = '<p class="loading">Loading…</p>';
350
-
351
- try {
352
- const status = await fetch(BASE + "/status").then(r => r.json());
353
- if (status.locked) { showLockScreen(); return; }
354
- if (status.error) throw new Error(status.error);
355
-
356
- const services = status.services || [];
357
- if (!services.length) { grid.innerHTML = '<p class="loading">No services registered.</p>'; return; }
358
-
359
- grid.innerHTML = services.map(s => \`
360
- <div class="card">
361
- <div style="display:flex;align-items:flex-start;justify-content:space-between">
362
- <div>
363
- <div class="card-name">\${s.name}</div>
364
- <div style="display:flex;align-items:center;gap:6px;margin-top:2px">
365
- <div class="card-type">\${s.key_type || "secret"}</div>
366
- <span class="svc-badge \${s.enabled === false ? "off" : "on"}" id="badge-\${s.name}">\${s.enabled === false ? "disabled" : "enabled"}</span>
367
- </div>
368
- \${KEY_URLS[s.name] ? \`<a class="card-getkey" href="\${KEY_URLS[s.name]}" target="_blank" rel="noopener">↗ Get / rotate key</a>\` : ""}
369
- </div>
370
- <div class="status-dot" id="sdot-\${s.name}" title=""></div>
371
- </div>
372
- <div class="card-value" id="val-\${s.name}"></div>
373
- <div class="card-actions">
374
- <button class="btn btn-reveal" onclick="reveal('\${s.name}', this)">Reveal</button>
375
- <button class="btn btn-copy" id="copybtn-\${s.name}" style="display:none" onclick="copyKey('\${s.name}')">Copy</button>
376
- <button class="btn btn-set" onclick="toggleSet('\${s.name}')">Set</button>
377
- <button class="btn \${s.enabled === false ? "btn-enable" : "btn-disable"}" id="togbtn-\${s.name}" onclick="toggleService('\${s.name}')">\${s.enabled === false ? "Enable" : "Disable"}</button>
378
- </div>
379
- \${renderSetPanel(s.name)}
380
- </div>
381
- \`).join("");
382
- } catch (e) {
383
- err.textContent = "⚠ " + e.message;
384
- err.style.display = "block";
385
- document.getElementById("dot").style.background = "#ef4444";
386
- grid.innerHTML = "";
387
- }
388
- }
389
-
390
- // ── Reveal ──────────────────────────────────
391
- async function reveal(name, btn) {
392
- const valEl = document.getElementById("val-" + name);
393
- const copyBtn = document.getElementById("copybtn-" + name);
394
- if (valEl.style.display === "block") {
395
- valEl.style.display = "none"; copyBtn.style.display = "none";
396
- btn.textContent = "Reveal"; return;
397
- }
398
- valEl.textContent = "fetching…"; valEl.style.display = "block"; btn.textContent = "Hide";
399
- try {
400
- const r = await fetch(BASE + "/get/" + name).then(r => r.json());
401
- if (r.locked) { showLockScreen(); return; }
402
- if (r.error) throw new Error(r.error);
403
- const imp = OAUTH_IMPORT[name];
404
- if (imp) {
405
- try {
406
- const parsed = JSON.parse(r.value);
407
- const allKeys = [...imp.jsonFields, ...imp.extra.map(f => f.key)];
408
- valEl.innerHTML = allKeys.map(k =>
409
- '<div style="margin-bottom:6px"><span style="color:#64748b;font-size:.72rem;text-transform:uppercase;letter-spacing:.4px">' + k.replace(/_/g," ") + '</span><br>' + (parsed[k] || "—") + '</div>'
410
- ).join("");
411
- } catch { valEl.textContent = r.value; }
412
- } else {
413
- valEl.textContent = r.value;
414
- }
415
- copyBtn.style.display = "inline-block";
416
- } catch (e) {
417
- valEl.textContent = "Error: " + e.message; valEl.style.color = "#ef4444";
418
- }
419
- }
420
-
421
- async function copyKey(name) {
422
- const val = document.getElementById("val-" + name).textContent;
423
- try {
424
- await navigator.clipboard.writeText(val);
425
- const btn = document.getElementById("copybtn-" + name);
426
- btn.textContent = "Copied!"; setTimeout(() => btn.textContent = "Copy", 1500);
427
- } catch {}
428
- }
429
-
430
- // ── Set key ─────────────────────────────────
431
- function toggleSet(name) {
432
- const panel = document.getElementById("set-panel-" + name);
433
- const msg = document.getElementById("set-msg-" + name);
434
- const open = panel.style.display === "block";
435
- panel.style.display = open ? "none" : "block";
436
- if (!open) {
437
- if (msg) msg.textContent = "";
438
- const imp = OAUTH_IMPORT[name];
439
- if (imp) {
440
- const jsonEl = document.getElementById("ofield-" + name + "-json");
441
- if (jsonEl) { jsonEl.value = ""; jsonEl.focus(); }
442
- imp.extra.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
443
- } else {
444
- const input = document.getElementById("set-input-" + name);
445
- if (input) { input.value = ""; input.focus(); }
446
- }
447
- }
448
- }
449
-
450
- async function saveKey(name) {
451
- const msg = document.getElementById("set-msg-" + name);
452
- const fields = OAUTH_FIELDS[name];
453
-
454
- if (fields) {
455
- // Validate required fields first
456
- for (const f of fields) {
457
- if (!f.required) continue;
458
- const el = document.getElementById("ofield-" + name + "-" + f.key);
459
- if (!el || !el.value.trim()) {
460
- msg.className = "set-msg fail"; msg.textContent = f.label + " is required."; return;
461
- }
462
- }
463
- // Save each field as an atomic vault key: clauth.<service>.<key>
464
- msg.className = "set-msg"; msg.textContent = "Saving…";
465
- try {
466
- for (const f of fields) {
467
- const el = document.getElementById("ofield-" + name + "-" + f.key);
468
- const v = el ? el.value.trim() : "";
469
- if (!v) continue; // skip optional empty fields
470
- const r = await fetch(BASE + "/set/" + name + "." + f.key, {
471
- method: "POST",
472
- headers: { "Content-Type": "application/json" },
473
- body: JSON.stringify({ value: v })
474
- }).then(r => r.json());
475
- if (r.locked) { showLockScreen(); return; }
476
- if (r.error) throw new Error(r.error);
477
- }
478
- msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
479
- fields.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
480
- } catch (e) {
481
- msg.className = "set-msg fail"; msg.textContent = e.message || "Save failed";
482
- return;
483
- }
484
- } else {
485
- const input = document.getElementById("set-input-" + name);
486
- const value = input ? input.value.trim() : "";
487
- if (!value) { msg.className = "set-msg fail"; msg.textContent = "Value is empty."; return; }
488
-
489
- msg.className = "set-msg"; msg.textContent = "Saving…";
490
- try {
491
- const r = await fetch(BASE + "/set/" + name, {
492
- method: "POST",
493
- headers: { "Content-Type": "application/json" },
494
- body: JSON.stringify({ value })
495
- }).then(r => r.json());
496
-
497
- if (r.locked) { showLockScreen(); return; }
498
- if (r.error) throw new Error(r.error);
499
- msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
500
- const inp = document.getElementById("set-input-" + name);
501
- if (inp) inp.value = "";
502
- } catch (e) {
503
- msg.className = "set-msg fail"; msg.textContent = e.message || "Save failed";
504
- return;
505
- }
506
- }
507
-
508
- const dot = document.getElementById("sdot-" + name);
509
- if (dot) { dot.className = "status-dot"; dot.title = ""; }
510
- setTimeout(() => {
511
- document.getElementById("set-panel-" + name).style.display = "none";
512
- msg.textContent = "";
513
- }, 1800);
514
- }
515
-
516
- // ── Enable / Disable service ────────────────
517
- async function toggleService(name) {
518
- const badge = document.getElementById("badge-" + name);
519
- const btn = document.getElementById("togbtn-" + name);
520
- const currently = badge.classList.contains("on");
521
- const newState = !currently;
522
-
523
- btn.disabled = true; btn.textContent = "…";
524
-
525
- try {
526
- const r = await fetch(BASE + "/toggle/" + name, {
527
- method: "POST",
528
- headers: { "Content-Type": "application/json" },
529
- body: JSON.stringify({ enabled: newState })
530
- }).then(r => r.json());
531
-
532
- if (r.locked) { showLockScreen(); return; }
533
- if (r.error) throw new Error(r.error);
534
-
535
- badge.className = "svc-badge " + (newState ? "on" : "off");
536
- badge.textContent = newState ? "enabled" : "disabled";
537
- btn.className = "btn " + (newState ? "btn-disable" : "btn-enable");
538
- btn.textContent = newState ? "Disable" : "Enable";
539
- } catch (e) {
540
- btn.textContent = "Error";
541
- setTimeout(() => {
542
- btn.textContent = currently ? "Disable" : "Enable";
543
- }, 2000);
544
- } finally {
545
- btn.disabled = false;
546
- }
547
- }
548
-
549
- // ── Check all credentials ───────────────────
550
- async function checkAll() {
551
- const btn = document.getElementById("check-btn");
552
- btn.disabled = true; btn.textContent = "Checking…";
553
-
554
- // Show checking state on every visible dot
555
- document.querySelectorAll(".status-dot").forEach(d => {
556
- d.className = "status-dot checking"; d.title = "Checking…";
557
- });
558
-
559
- try {
560
- const r = await fetch(BASE + "/check-all").then(r => r.json());
561
- if (r.locked) { showLockScreen(); return; }
562
- if (r.error) throw new Error(r.error);
563
-
564
- const results = r.results || {};
565
- for (const [name, result] of Object.entries(results)) {
566
- const dot = document.getElementById("sdot-" + name);
567
- if (!dot) continue;
568
- if (result.ok) {
569
- dot.className = "status-dot ok"; dot.title = "OK";
570
- } else {
571
- dot.className = "status-dot fail";
572
- dot.title = result.reason || "No key stored";
573
- }
574
- }
575
-
576
- // Fade green dots after 3 s — red dots stay until next check
577
- setTimeout(() => {
578
- document.querySelectorAll(".status-dot.ok").forEach(d => d.classList.add("fading"));
579
- }, 3000);
580
-
581
- } catch (e) {
582
- document.querySelectorAll(".status-dot").forEach(d => { d.className = "status-dot"; d.title = ""; });
583
- const errBar = document.getElementById("error-bar");
584
- errBar.textContent = "⚠ Check failed: " + e.message;
585
- errBar.style.display = "block";
586
- } finally {
587
- btn.disabled = false; btn.textContent = "⬤ Check All";
588
- }
589
- }
590
-
591
- // ── Change password ─────────────────────────
592
- function toggleChangePw() {
593
- const panel = document.getElementById("chpw-panel");
594
- const open = panel.style.display === "block";
595
- panel.style.display = open ? "none" : "block";
596
- if (!open) {
597
- document.getElementById("chpw-new").value = "";
598
- document.getElementById("chpw-confirm").value = "";
599
- document.getElementById("chpw-msg").textContent = "";
600
- document.getElementById("chpw-new").focus();
601
- }
602
- }
603
-
604
- async function changePassword() {
605
- const newPw = document.getElementById("chpw-new").value;
606
- const confPw = document.getElementById("chpw-confirm").value;
607
- const msg = document.getElementById("chpw-msg");
608
-
609
- if (!newPw) { msg.className = "chpw-msg fail"; msg.textContent = "Enter a new password."; return; }
610
- if (newPw.length < 8) { msg.className = "chpw-msg fail"; msg.textContent = "Minimum 8 characters."; return; }
611
- if (newPw !== confPw) { msg.className = "chpw-msg fail"; msg.textContent = "Passwords don't match."; return; }
612
-
613
- msg.className = "chpw-msg"; msg.textContent = "Updating…";
614
- try {
615
- const r = await fetch(BASE + "/change-pw", {
616
- method: "POST",
617
- headers: { "Content-Type": "application/json" },
618
- body: JSON.stringify({ newPassword: newPw })
619
- }).then(r => r.json());
620
-
621
- if (r.locked) { showLockScreen(); return; }
622
- if (r.error) throw new Error(r.error);
623
-
624
- msg.className = "chpw-msg ok"; msg.textContent = "✓ Password updated";
625
- document.getElementById("chpw-new").value = "";
626
- document.getElementById("chpw-confirm").value = "";
627
- setTimeout(() => {
628
- document.getElementById("chpw-panel").style.display = "none";
629
- msg.textContent = "";
630
- }, 2000);
631
- } catch (e) {
632
- msg.className = "chpw-msg fail"; msg.textContent = "✗ " + e.message;
633
- }
634
- }
635
-
636
- // Enter key on lock screen
637
- document.addEventListener("DOMContentLoaded", () => {
638
- document.getElementById("lock-input").addEventListener("keydown", e => {
639
- if (e.key === "Enter") unlock();
640
- });
641
- });
642
-
643
- boot();
644
- </script>
645
- </body>
646
- </html>`;
647
- }
648
-
649
- // ── Body parser helper ────────────────────────────────────────
650
- function readBody(req) {
651
- return new Promise((resolve, reject) => {
652
- let data = "";
653
- req.on("data", chunk => { data += chunk; if (data.length > 65536) reject(new Error("Body too large")); });
654
- req.on("end", () => { try { resolve(JSON.parse(data)); } catch { reject(new Error("Invalid JSON")); } });
655
- req.on("error", reject);
656
- });
657
- }
658
-
659
- // ── Server logic (shared by foreground + daemon) ─────────────
660
- function createServer(initPassword, whitelist, port) {
661
- const MAX_FAILS = 3;
662
- let failCount = 0;
663
- let password = initPassword || null; // null = locked; set via POST /auth
664
- const machineHash = getMachineHash();
665
-
666
- const CORS = {
667
- "Access-Control-Allow-Origin": "*",
668
- "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
669
- "Access-Control-Allow-Headers": "Content-Type",
670
- };
671
-
672
- function strike(res, code, message) {
673
- failCount++;
674
- const remaining = MAX_FAILS - failCount;
675
- const logLine = `[${new Date().toISOString()}] [FAIL ${failCount}/${MAX_FAILS}] ${message}\n`;
676
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
677
-
678
- const body = JSON.stringify({
679
- error: message,
680
- failures: failCount,
681
- failures_remaining: remaining,
682
- ...(failCount >= MAX_FAILS ? { shutdown: true } : {})
683
- });
684
-
685
- res.writeHead(code, { "Content-Type": "application/json", ...CORS });
686
- res.end(body);
687
-
688
- if (failCount >= MAX_FAILS) {
689
- const msg = `[${new Date().toISOString()}] Failure limit reached — shutting down\n`;
690
- try { fs.appendFileSync(LOG_FILE, msg); } catch {}
691
- removePid();
692
- setTimeout(() => process.exit(1), 100);
693
- }
694
- }
695
-
696
- function ok(res, data) {
697
- res.writeHead(200, { "Content-Type": "application/json", ...CORS });
698
- res.end(JSON.stringify(data));
699
- }
700
-
701
- const server = http.createServer(async (req, res) => {
702
- // Hard reject anything not from loopback
703
- const remote = req.socket.remoteAddress;
704
- const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
705
- if (!isLocal) {
706
- return strike(res, 403, `Rejected non-local address: ${remote}`);
707
- }
708
-
709
- // CORS preflight
710
- if (req.method === "OPTIONS") {
711
- res.writeHead(204, CORS);
712
- return res.end();
713
- }
714
-
715
- const url = new URL(req.url, `http://127.0.0.1:${port}`);
716
- const reqPath = url.pathname;
717
- const method = req.method;
718
-
719
- // GET / — built-in web dashboard
720
- if (method === "GET" && reqPath === "/") {
721
- res.writeHead(200, { "Content-Type": "text/html", ...CORS });
722
- return res.end(dashboardHtml(port, whitelist));
723
- }
724
-
725
- // GET /ping
726
- if (method === "GET" && reqPath === "/ping") {
727
- return ok(res, {
728
- status: "ok",
729
- pid: process.pid,
730
- locked: !password,
731
- failures: failCount,
732
- failures_remaining: MAX_FAILS - failCount,
733
- services: whitelist || "all",
734
- port
735
- });
736
- }
737
-
738
- // GET /shutdown (for daemon stop)
739
- if (method === "GET" && reqPath === "/shutdown") {
740
- ok(res, { ok: true, message: "shutting down" });
741
- removePid();
742
- setTimeout(() => process.exit(0), 100);
743
- return;
744
- }
745
-
746
- // Locked guard — returns true if locked and already responded
747
- function lockedGuard(res) {
748
- if (!password) {
749
- res.writeHead(401, { "Content-Type": "application/json", ...CORS });
750
- res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
751
- return true;
752
- }
753
- return false;
754
- }
755
-
756
- // GET /status
757
- if (method === "GET" && reqPath === "/status") {
758
- if (lockedGuard(res)) return;
759
- try {
760
- const { token, timestamp } = deriveToken(password, machineHash);
761
- const result = await api.status(password, machineHash, token, timestamp);
762
- if (result.error) return strike(res, 502, result.error);
763
- if (whitelist) {
764
- result.services = (result.services || []).filter(
765
- s => whitelist.includes(s.name.toLowerCase())
766
- );
767
- }
768
- return ok(res, result);
769
- } catch (err) {
770
- return strike(res, 502, err.message);
771
- }
772
- }
773
-
774
- // GET /get/:service
775
- const getMatch = reqPath.match(/^\/get\/([a-zA-Z0-9_.-]+)$/);
776
- if (method === "GET" && getMatch) {
777
- if (lockedGuard(res)) return;
778
- const service = getMatch[1].toLowerCase();
779
-
780
- if (whitelist && !whitelist.includes(service)) {
781
- return strike(res, 403, `Service '${service}' not in whitelist`);
782
- }
783
-
784
- try {
785
- const { token, timestamp } = deriveToken(password, machineHash);
786
- const result = await api.retrieve(password, machineHash, token, timestamp, service);
787
- if (result.error) return strike(res, 502, result.error);
788
- return ok(res, { service, value: result.value, key_type: result.key_type });
789
- } catch (err) {
790
- return strike(res, 502, err.message);
791
- }
792
- }
793
-
794
- // POST /auth — unlock the vault with a password (verifies against Edge Function)
795
- if (method === "POST" && reqPath === "/auth") {
796
- let body;
797
- try { body = await readBody(req); } catch {
798
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
799
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
800
- }
801
-
802
- const pw = body.password;
803
- if (!pw || typeof pw !== "string") {
804
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
805
- return res.end(JSON.stringify({ error: "password is required" }));
806
- }
807
-
808
- try {
809
- const { token, timestamp } = deriveToken(pw, machineHash);
810
- const result = await api.test(pw, machineHash, token, timestamp);
811
- if (result.error) throw new Error(result.error);
812
- password = pw; // unlock — store in process memory only
813
- const logLine = `[${new Date().toISOString()}] Vault unlocked\n`;
814
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
815
- return ok(res, { ok: true, locked: false });
816
- } catch {
817
- // Wrong password — not a lockout strike, just a UI auth attempt
818
- res.writeHead(401, { "Content-Type": "application/json", ...CORS });
819
- return res.end(JSON.stringify({ error: "Invalid password" }));
820
- }
821
- }
822
-
823
- // POST /lock — clear password from memory
824
- if (method === "POST" && reqPath === "/lock") {
825
- password = null;
826
- const logLine = `[${new Date().toISOString()}] Vault locked\n`;
827
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
828
- return ok(res, { ok: true, locked: true });
829
- }
830
-
831
- // POST /toggle/:service — enable or disable a service
832
- const toggleMatch = reqPath.match(/^\/toggle\/([a-zA-Z0-9_-]+)$/);
833
- if (method === "POST" && toggleMatch) {
834
- if (lockedGuard(res)) return;
835
- const service = toggleMatch[1].toLowerCase();
836
-
837
- let body;
838
- try { body = await readBody(req); } catch {
839
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
840
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
841
- }
842
-
843
- const { enabled } = body;
844
- if (typeof enabled !== "boolean") {
845
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
846
- return res.end(JSON.stringify({ error: "enabled must be boolean" }));
847
- }
848
-
849
- try {
850
- const { token, timestamp } = deriveToken(password, machineHash);
851
- const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
852
- if (result.error) return strike(res, 502, result.error);
853
- return ok(res, { ok: true, service, enabled });
854
- } catch (err) {
855
- return strike(res, 502, err.message);
856
- }
857
- }
858
-
859
- // GET /check-all — soft health check, no strikes for missing/disabled keys
860
- if (method === "GET" && reqPath === "/check-all") {
861
- if (lockedGuard(res)) return;
862
- try {
863
- const { token: st, timestamp: sts } = deriveToken(password, machineHash);
864
- const statusResult = await api.status(password, machineHash, st, sts);
865
- if (statusResult.error) return strike(res, 502, statusResult.error);
866
-
867
- const services = (statusResult.services || []).filter(
868
- s => !whitelist || whitelist.includes(s.name.toLowerCase())
869
- );
870
-
871
- const results = {};
872
- for (const svc of services) {
873
- try {
874
- const { token, timestamp } = deriveToken(password, machineHash);
875
- const r = await api.retrieve(password, machineHash, token, timestamp, svc.name);
876
- results[svc.name] = r.error
877
- ? { ok: false, reason: r.error }
878
- : { ok: true };
879
- } catch (e) {
880
- results[svc.name] = { ok: false, reason: e.message };
881
- }
882
- }
883
- return ok(res, { results });
884
- } catch (err) {
885
- return strike(res, 502, err.message);
886
- }
887
- }
888
-
889
- // POST /change-pw — change master password (must be unlocked)
890
- if (method === "POST" && reqPath === "/change-pw") {
891
- if (lockedGuard(res)) return;
892
-
893
- let body;
894
- try { body = await readBody(req); } catch {
895
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
896
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
897
- }
898
-
899
- const { newPassword } = body;
900
- if (!newPassword || typeof newPassword !== "string" || newPassword.length < 8) {
901
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
902
- return res.end(JSON.stringify({ error: "newPassword must be at least 8 characters" }));
903
- }
904
-
905
- try {
906
- const { token, timestamp } = deriveToken(password, machineHash);
907
- const newSeedHash = deriveSeedHash(machineHash, newPassword);
908
- const result = await api.changePassword(password, machineHash, token, timestamp, newSeedHash);
909
- if (result.error) throw new Error(result.error);
910
- password = newPassword; // update in-memory password to new one
911
- const logLine = `[${new Date().toISOString()}] Password changed\n`;
912
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
913
- return ok(res, { ok: true });
914
- } catch (err) {
915
- res.writeHead(502, { "Content-Type": "application/json", ...CORS });
916
- return res.end(JSON.stringify({ error: err.message }));
917
- }
918
- }
919
-
920
- // POST /set/:service — write a new key value into vault
921
- const setMatch = reqPath.match(/^\/set\/([a-zA-Z0-9_.-]+)$/);
922
- if (method === "POST" && setMatch) {
923
- if (lockedGuard(res)) return;
924
- const service = setMatch[1].toLowerCase();
925
-
926
- if (whitelist && !whitelist.includes(service)) {
927
- return strike(res, 403, `Service '${service}' not in whitelist`);
928
- }
929
-
930
- let body;
931
- try { body = await readBody(req); } catch {
932
- return strike(res, 400, "Invalid JSON body");
933
- }
934
-
935
- const value = body.value;
936
- if (!value || typeof value !== "string" || !value.trim()) {
937
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
938
- return res.end(JSON.stringify({ error: "value is required" }));
939
- }
940
-
941
- try {
942
- const { token, timestamp } = deriveToken(password, machineHash);
943
- const result = await api.write(password, machineHash, token, timestamp, service, value.trim());
944
- if (result.error) return strike(res, 502, result.error);
945
- return ok(res, { ok: true, service });
946
- } catch (err) {
947
- return strike(res, 502, err.message);
948
- }
949
- }
950
-
951
- // Unknown route
952
- return strike(res, 404, `Unknown endpoint: ${reqPath}`);
953
- });
954
-
955
- return server;
956
- }
957
-
958
- // ── Actions ──────────────────────────────────────────────────
959
-
960
- async function verifyAuth(password) {
961
- const machineHash = getMachineHash();
962
- const { token, timestamp } = deriveToken(password, machineHash);
963
- const result = await api.test(password, machineHash, token, timestamp);
964
- if (result.error) throw new Error(result.error);
965
- }
966
-
967
- async function actionStart(opts) {
968
- const port = parseInt(opts.port || "52437", 10);
969
- const password = opts.pw;
970
- const whitelist = opts.services
971
- ? opts.services.split(",").map(s => s.trim().toLowerCase())
972
- : null;
973
-
974
- // Check for existing instance
975
- const existing = readPid();
976
- if (existing && isProcessAlive(existing.pid)) {
977
- console.log(chalk.yellow(`\n clauth serve already running (PID ${existing.pid}, port ${existing.port})`));
978
- console.log(chalk.gray(` Stop it first: clauth serve stop\n`));
979
- process.exit(1);
980
- }
981
-
982
- // If we're the daemon child, run the server directly
983
- if (process.env.__CLAUTH_DAEMON === "1") {
984
- // Verify password only if one was provided at start (optional — browser can unlock later)
985
- if (password) {
986
- try {
987
- await verifyAuth(password);
988
- } catch (err) {
989
- const msg = `[${new Date().toISOString()}] Auth failed: ${err.message}\n`;
990
- fs.appendFileSync(LOG_FILE, msg);
991
- process.exit(1);
992
- }
993
- }
994
-
995
- const server = createServer(password, whitelist, port);
996
- server.listen(port, "127.0.0.1", () => {
997
- writePid(process.pid, port);
998
- const msg = `[${new Date().toISOString()}] clauth serve started — PID ${process.pid}, port ${port}, services: ${whitelist ? whitelist.join(",") : "all"}\n`;
999
- fs.appendFileSync(LOG_FILE, msg);
1000
- });
1001
-
1002
- server.on("error", err => {
1003
- const msg = `[${new Date().toISOString()}] Server error: ${err.message}\n`;
1004
- fs.appendFileSync(LOG_FILE, msg);
1005
- process.exit(1);
1006
- });
1007
-
1008
- const shutdown = () => { removePid(); process.exit(0); };
1009
- process.on("SIGTERM", shutdown);
1010
- process.on("SIGINT", shutdown);
1011
- return;
1012
- }
1013
-
1014
- // If --pw provided, verify it before spawning (fast-fail on wrong password)
1015
- if (password) {
1016
- console.log(chalk.gray("\n Verifying vault credentials..."));
1017
- try {
1018
- await verifyAuth(password);
1019
- } catch (err) {
1020
- console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1021
- process.exit(1);
1022
- }
1023
- console.log(chalk.green(" ✓ Vault auth verified"));
1024
- } else {
1025
- console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1026
- }
1027
-
1028
- // Spawn detached daemon child via the clauth CLI entry point
1029
- const { spawn } = await import("child_process");
1030
- const { fileURLToPath } = await import("url");
1031
- const { dirname, join } = await import("path");
1032
- const __filename = fileURLToPath(import.meta.url);
1033
- const cliEntry = join(dirname(__filename), "..", "index.js");
1034
-
1035
- // Build args: node index.js serve start --port N [--pw PW] [--services S]
1036
- const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
1037
- if (password) childArgs.push("--pw", password);
1038
- if (opts.services) childArgs.push("--services", opts.services);
1039
-
1040
- const out = fs.openSync(LOG_FILE, "a");
1041
- const child = spawn(process.execPath, childArgs, {
1042
- detached: true,
1043
- stdio: ["ignore", out, out],
1044
- env: { ...process.env, __CLAUTH_DAEMON: "1" },
1045
- });
1046
- child.unref();
1047
-
1048
- // Give it time to bind and write PID file (Windows spawn is slower)
1049
- // Verify via HTTP ping (process.kill(pid,0) fails on Windows for detached processes)
1050
- let started = false;
1051
- for (let attempt = 0; attempt < 5; attempt++) {
1052
- await new Promise(r => setTimeout(r, 1000));
1053
- try {
1054
- const resp = await fetch(`http://127.0.0.1:${port}/ping`);
1055
- if (resp.ok) { started = true; break; }
1056
- } catch {}
1057
- }
1058
-
1059
- const info = readPid();
1060
- if (started && info) {
1061
- console.log(chalk.green(`\n 🔐 clauth serve started`));
1062
- console.log(chalk.gray(` PID: ${info.pid}`));
1063
- console.log(chalk.gray(` Port: 127.0.0.1:${info.port}`));
1064
- console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1065
- console.log(chalk.gray(` Log: ${LOG_FILE}`));
1066
- if (!password) {
1067
- console.log(chalk.cyan(`\n 👉 Open http://127.0.0.1:${info.port} to unlock the vault`));
1068
- }
1069
- console.log(chalk.gray(` Stop: clauth serve stop\n`));
1070
- } else {
1071
- console.log(chalk.red(`\n ❌ Failed to start daemon — check ${LOG_FILE}\n`));
1072
- process.exit(1);
1073
- }
1074
- }
1075
-
1076
- async function actionStop() {
1077
- const info = readPid();
1078
- if (!info) {
1079
- console.log(chalk.yellow("\n No clauth serve PID file found — not running.\n"));
1080
- return;
1081
- }
1082
-
1083
- if (!isProcessAlive(info.pid)) {
1084
- console.log(chalk.yellow(`\n PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
1085
- removePid();
1086
- return;
1087
- }
1088
-
1089
- // Try HTTP shutdown first (clean)
1090
- try {
1091
- const resp = await fetch(`http://127.0.0.1:${info.port}/shutdown`);
1092
- if (resp.ok) {
1093
- await new Promise(r => setTimeout(r, 300));
1094
- console.log(chalk.green(`\n 🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
1095
- removePid();
1096
- return;
1097
- }
1098
- } catch {}
1099
-
1100
- // Fallback: kill the process
1101
- try {
1102
- process.kill(info.pid, "SIGTERM");
1103
- await new Promise(r => setTimeout(r, 300));
1104
- console.log(chalk.green(`\n 🛑 clauth serve stopped via SIGTERM (PID ${info.pid})\n`));
1105
- } catch (err) {
1106
- console.log(chalk.yellow(`\n Could not kill PID ${info.pid}: ${err.message}\n`));
1107
- }
1108
- removePid();
1109
- }
1110
-
1111
- async function actionPing() {
1112
- const info = readPid();
1113
- if (!info) {
1114
- console.log(chalk.red("\n clauth serve is not running (no PID file)\n"));
1115
- process.exit(1);
1116
- }
1117
-
1118
- if (!isProcessAlive(info.pid)) {
1119
- console.log(chalk.red(`\n PID ${info.pid} is not alive (stale PID file)\n`));
1120
- removePid();
1121
- process.exit(1);
1122
- }
1123
-
1124
- try {
1125
- const resp = await fetch(`http://127.0.0.1:${info.port}/ping`);
1126
- const data = await resp.json();
1127
- if (data.status === "ok") {
1128
- console.log(chalk.green(`\n ✅ clauth serve running`));
1129
- console.log(chalk.gray(` PID: ${info.pid}`));
1130
- console.log(chalk.gray(` Port: ${info.port}`));
1131
- console.log(chalk.gray(` Fails: ${data.failures}/${data.failures + data.failures_remaining}`));
1132
- console.log(chalk.gray(` Services: ${Array.isArray(data.services) ? data.services.join(", ") : data.services}\n`));
1133
- } else {
1134
- console.log(chalk.yellow(`\n PID alive but /ping returned unexpected response\n`));
1135
- }
1136
- } catch (err) {
1137
- console.log(chalk.yellow(`\n PID ${info.pid} alive but HTTP failed: ${err.message}\n`));
1138
- }
1139
- }
1140
-
1141
- async function actionRestart(opts) {
1142
- const info = readPid();
1143
- if (info && isProcessAlive(info.pid)) {
1144
- await actionStop();
1145
- await new Promise(r => setTimeout(r, 500));
1146
- }
1147
- await actionStart(opts);
1148
- }
1149
-
1150
- async function actionForeground(opts) {
1151
- const port = parseInt(opts.port || "52437", 10);
1152
- const password = opts.pw || null;
1153
- const whitelist = opts.services
1154
- ? opts.services.split(",").map(s => s.trim().toLowerCase())
1155
- : null;
1156
-
1157
- if (password) {
1158
- console.log(chalk.gray("\n Verifying vault credentials..."));
1159
- try {
1160
- await verifyAuth(password);
1161
- } catch (err) {
1162
- console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1163
- process.exit(1);
1164
- }
1165
- console.log(chalk.green(" ✓ Vault auth verified"));
1166
- } else {
1167
- console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1168
- }
1169
-
1170
- console.log(chalk.gray(` Port: 127.0.0.1:${port}`));
1171
- console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1172
- console.log(chalk.gray(` Lockout: 3 failures → exit\n`));
1173
-
1174
- const server = createServer(password, whitelist, port);
1175
- server.listen(port, "127.0.0.1", () => {
1176
- writePid(process.pid, port);
1177
- console.log(chalk.green(` clauth serve → http://127.0.0.1:${port}`));
1178
- if (!password) console.log(chalk.cyan(` 👉 Open http://127.0.0.1:${port} to unlock`));
1179
- console.log(chalk.gray(" Ctrl+C to stop\n"));
1180
- });
1181
-
1182
- server.on("error", err => {
1183
- if (err.code === "EADDRINUSE") {
1184
- console.log(chalk.red(`\n Port ${port} already in use. Use --port to choose another.\n`));
1185
- } else {
1186
- console.log(chalk.red(`\n Server error: ${err.message}\n`));
1187
- }
1188
- process.exit(1);
1189
- });
1190
-
1191
- process.on("SIGINT", () => {
1192
- console.log(chalk.yellow("\n Stopping clauth serve...\n"));
1193
- removePid();
1194
- server.close(() => process.exit(0));
1195
- });
1196
- }
1197
-
1198
- // ── Export ────────────────────────────────────────────────────
1199
- export async function runServe(opts) {
1200
- const action = opts.action || "foreground";
1201
-
1202
- switch (action) {
1203
- case "start": return actionStart(opts);
1204
- case "stop": return actionStop();
1205
- case "restart": return actionRestart(opts);
1206
- case "ping": return actionPing();
1207
- case "foreground": return actionForeground(opts);
1208
- default:
1209
- console.log(chalk.red(`\n Unknown serve action: ${action}`));
1210
- console.log(chalk.gray(" Actions: start | stop | restart | ping | foreground\n"));
1211
- process.exit(1);
1212
- }
1213
- }
1
+ // cli/commands/serve.js
2
+ // Localhost-only credential daemon with daemon lifecycle management
3
+ // Binds 127.0.0.1 ONLY — unreachable from outside the machine
4
+ // 3 failed requests of any kind → process exits, requires manual restart
5
+ // Supports: start (background daemon), stop, restart, ping, foreground
6
+
7
+ import http from "http";
8
+ import fs from "fs";
9
+ import os from "os";
10
+ import path from "path";
11
+ import { fileURLToPath } from "url";
12
+ import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
13
+ import * as api from "../api.js";
14
+ import chalk from "chalk";
15
+
16
+ const __dirname = path.dirname(fileURLToPath(import.meta.url));
17
+ const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../package.json"), "utf8"));
18
+ const VERSION = pkg.version;
19
+
20
+ const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
21
+ const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
22
+
23
+ // ── PID helpers ──────────────────────────────────────────────
24
+ function readPid() {
25
+ try {
26
+ const raw = fs.readFileSync(PID_FILE, "utf8").trim();
27
+ const [pid, port] = raw.split(":");
28
+ return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
29
+ } catch { return null; }
30
+ }
31
+
32
+ function writePid(pid, port) {
33
+ fs.writeFileSync(PID_FILE, `${pid}:${port}`, "utf8");
34
+ }
35
+
36
+ function removePid() {
37
+ try { fs.unlinkSync(PID_FILE); } catch {}
38
+ }
39
+
40
+ function isProcessAlive(pid) {
41
+ try { process.kill(pid, 0); return true; } catch { return false; }
42
+ }
43
+
44
+ // ── Dashboard HTML ───────────────────────────────────────────
45
+ function dashboardHtml(port, whitelist) {
46
+ return `<!DOCTYPE html>
47
+ <html lang="en">
48
+ <head>
49
+ <meta charset="utf-8">
50
+ <meta name="viewport" content="width=device-width,initial-scale=1">
51
+ <title>clauth vault v${VERSION}</title>
52
+ <style>
53
+ *{margin:0;padding:0;box-sizing:border-box}
54
+ body{background:#0a0f1a;color:#e2e8f0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh}
55
+ /* ── Lock screen ── */
56
+ #lock-screen{display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;padding:2rem}
57
+ .lock-card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:2.5rem 2rem;width:100%;max-width:380px;text-align:center}
58
+ .lock-icon{font-size:2.5rem;margin-bottom:1rem}
59
+ .lock-title{font-size:1.25rem;font-weight:600;color:#f8fafc;margin-bottom:.4rem}
60
+ .lock-sub{font-size:.85rem;color:#64748b;margin-bottom:1.75rem}
61
+ .lock-input{width:100%;background:#0f172a;border:1px solid #334155;border-radius:8px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:1rem;padding:10px 14px;outline:none;text-align:center;letter-spacing:.1em;transition:border-color .2s;margin-bottom:1rem}
62
+ .lock-input:focus{border-color:#3b82f6}
63
+ .lock-input.error{border-color:#ef4444;animation:shake .3s}
64
+ @keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-6px)}75%{transform:translateX(6px)}}
65
+ .btn-unlock{width:100%;background:#3b82f6;color:#fff;border:none;border-radius:8px;padding:10px;font-size:.95rem;font-weight:600;cursor:pointer;transition:background .15s}
66
+ .btn-unlock:hover{background:#2563eb}
67
+ .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
68
+ .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
69
+ /* ── Main view ── */
70
+ #main-view{display:none;padding:2rem}
71
+ .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
72
+ .header h1{font-size:1.4rem;font-weight:600;flex:1}
73
+ .dot{width:10px;height:10px;border-radius:50%;background:#22c55e;animation:pulse 2s infinite;flex-shrink:0}
74
+ @keyframes pulse{0%,100%{opacity:1}50%{opacity:.4}}
75
+ .status-bar{display:flex;gap:1.5rem;margin-bottom:1.5rem;font-size:.82rem;color:#94a3b8;flex-wrap:wrap}
76
+ .status-bar span{color:#e2e8f0;font-weight:500}
77
+ .toolbar{display:flex;gap:8px;margin-bottom:1rem;flex-wrap:wrap;align-items:center}
78
+ .chpw-panel{display:none;background:#1a1f2e;border:1px solid #334155;border-radius:8px;padding:1.25rem;margin-bottom:1.5rem}
79
+ .chpw-panel h3{font-size:.9rem;font-weight:600;color:#f8fafc;margin-bottom:1rem}
80
+ .chpw-row{display:flex;gap:10px;flex-wrap:wrap;align-items:flex-end;margin-bottom:.75rem}
81
+ .chpw-field{display:flex;flex-direction:column;gap:4px}
82
+ .chpw-field label{font-size:.75rem;color:#64748b}
83
+ .chpw-input{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s}
84
+ .chpw-input:focus{border-color:#3b82f6}
85
+ .chpw-foot{display:flex;gap:8px;align-items:center}
86
+ .btn-chpw-save{background:#1e3a5f;color:#60a5fa;padding:7px 18px;font-size:.85rem;border-radius:6px;border:none;cursor:pointer;font-weight:500;transition:background .15s}
87
+ .btn-chpw-save:hover{background:#1e4a7f}
88
+ .chpw-msg{font-size:.82rem}
89
+ .chpw-msg.ok{color:#4ade80} .chpw-msg.fail{color:#f87171}
90
+ .btn-refresh{background:#3b82f6;color:#fff;padding:7px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:500}
91
+ .btn-refresh:hover{background:#2563eb}
92
+ .btn-lock{background:#1e293b;color:#f87171;border:1px solid #334155;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500}
93
+ .btn-lock:hover{background:#2d1f1f;border-color:#f87171}
94
+ .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:1rem}
95
+ .card{background:#1e293b;border:1px solid #334155;border-radius:8px;padding:1.25rem;transition:border-color .2s}
96
+ .card:hover{border-color:#3b82f6}
97
+ .card-name{font-size:1rem;font-weight:600;color:#f8fafc;margin-bottom:3px}
98
+ .card-type{font-size:.78rem;color:#64748b;text-transform:uppercase;letter-spacing:.5px}
99
+ .card-getkey{font-size:.75rem;color:#3b82f6;text-decoration:none;opacity:.7;transition:opacity .15s}
100
+ .card-getkey:hover{opacity:1;text-decoration:underline}
101
+ .card-value{font-family:'Courier New',monospace;font-size:.82rem;color:#22c55e;background:#0f172a;border-radius:4px;padding:8px 10px;margin-top:10px;word-break:break-all;max-height:80px;overflow:auto;display:none}
102
+ .card-actions{margin-top:10px;display:flex;gap:7px;flex-wrap:wrap}
103
+ .set-panel{display:none;margin-top:10px;background:#0f172a;border-radius:6px;padding:10px;border:1px solid #1e3a5f}
104
+ .set-panel label{font-size:.75rem;color:#64748b;display:block;margin-bottom:6px}
105
+ .set-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;resize:vertical;min-height:58px;transition:border-color .2s}
106
+ .set-input:focus{border-color:#3b82f6}
107
+ .set-foot{margin-top:8px;display:flex;gap:8px;align-items:center}
108
+ .set-msg{font-size:.8rem}
109
+ .set-msg.ok{color:#4ade80} .set-msg.fail{color:#f87171}
110
+ .btn{padding:6px 13px;border-radius:6px;border:none;cursor:pointer;font-size:.8rem;font-weight:500;transition:all .15s}
111
+ .btn-reveal{background:#1e3a5f;color:#60a5fa}.btn-reveal:hover{background:#1e4a7f}
112
+ .btn-copy{background:#1a3328;color:#4ade80}.btn-copy:hover{background:#1a4338}
113
+ .btn-set{background:#2d1f4a;color:#a78bfa}.btn-set:hover{background:#3d2f5a}
114
+ .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
115
+ .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
116
+ .btn-check{background:#0f2d2d;color:#34d399;border:1px solid #064e3b;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
117
+ .btn-check:hover{background:#134e4a;border-color:#34d399}.btn-check:disabled{opacity:.5;cursor:not-allowed}
118
+ .btn-enable{background:#14291a;color:#4ade80;border:1px solid #166534}.btn-enable:hover{background:#1a3d22;border-color:#4ade80}
119
+ .btn-disable{background:#2d1f1f;color:#f87171;border:1px solid #7f1d1d}.btn-disable:hover{background:#3d2525;border-color:#f87171}
120
+ .svc-badge{font-size:.7rem;font-weight:600;padding:2px 7px;border-radius:4px;letter-spacing:.4px;text-transform:uppercase}
121
+ .svc-badge.on{background:rgba(74,222,128,.12);color:#4ade80;border:1px solid rgba(74,222,128,.25)}
122
+ .svc-badge.off{background:rgba(248,113,113,.1);color:#f87171;border:1px solid rgba(248,113,113,.2)}
123
+ .status-dot{width:8px;height:8px;border-radius:50%;flex-shrink:0;opacity:0;transition:opacity .3s;margin-top:4px;cursor:default}
124
+ .status-dot.checking{background:#f59e0b;opacity:1;animation:pulse 1s infinite}
125
+ .status-dot.ok{background:#22c55e;opacity:1}
126
+ .status-dot.fail{background:#ef4444;opacity:1}
127
+ @keyframes sdot-fade{to{opacity:0}} .status-dot.fading{animation:sdot-fade 1.5s forwards}
128
+ .error-bar{background:#7f1d1d;color:#fca5a5;border:1px solid #991b1b;padding:10px 14px;border-radius:8px;margin-bottom:1rem;display:none;font-size:.85rem}
129
+ .loading{color:#64748b;font-style:italic}
130
+ .footer{margin-top:2rem;font-size:.75rem;color:#475569;text-align:center}
131
+ .oauth-fields{display:flex;flex-direction:column;gap:8px;margin-bottom:8px}
132
+ .oauth-field{display:flex;flex-direction:column;gap:3px}
133
+ .oauth-label{font-size:.75rem;color:#94a3b8;font-weight:500}
134
+ .oauth-hint{font-size:.71rem;color:#475569;font-style:italic}
135
+ .oauth-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;transition:border-color .2s}
136
+ .oauth-input:focus{border-color:#3b82f6}
137
+ </style>
138
+ </head>
139
+ <body>
140
+
141
+ <!-- ── Lock screen ──────────────────────────── -->
142
+ <div id="lock-screen">
143
+ <div class="lock-card">
144
+ <div class="lock-icon">🔒</div>
145
+ <div class="lock-title">clauth vault</div>
146
+ <div class="lock-sub">Paste your password to unlock</div>
147
+ <input class="lock-input" id="lock-input" type="password" placeholder="••••••••••••" autocomplete="off">
148
+ <button class="btn-unlock" id="unlock-btn" onclick="unlock()">Unlock</button>
149
+ <div class="lock-err" id="lock-err"></div>
150
+ </div>
151
+ </div>
152
+
153
+ <!-- ── Main view (shown after unlock) ──────── -->
154
+ <div id="main-view">
155
+ <div class="header">
156
+ <div class="dot" id="dot"></div>
157
+ <h1>🔐 clauth vault <span style="font-size:0.55em;opacity:0.45;font-weight:400">v${VERSION}</span></h1>
158
+ </div>
159
+ <div id="error-bar" class="error-bar"></div>
160
+ <div class="status-bar">
161
+ <div>PID: <span id="s-pid">—</span></div>
162
+ <div>Port: <span id="s-port">${port}</span></div>
163
+ <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
164
+ <div>Failures: <span id="s-fails">—</span></div>
165
+ </div>
166
+ <div class="toolbar">
167
+ <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
168
+ <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
169
+ <button class="btn-lock" onclick="lockVault()">🔒 Lock</button>
170
+ <button class="btn-cancel" style="margin-left:auto" onclick="toggleChangePw()">Change Password</button>
171
+ </div>
172
+
173
+ <div class="chpw-panel" id="chpw-panel">
174
+ <h3>Change Master Password</h3>
175
+ <div class="chpw-row">
176
+ <div class="chpw-field">
177
+ <label>New password</label>
178
+ <input class="chpw-input" id="chpw-new" type="password" placeholder="min 8 chars" autocomplete="new-password">
179
+ </div>
180
+ <div class="chpw-field">
181
+ <label>Confirm</label>
182
+ <input class="chpw-input" id="chpw-confirm" type="password" placeholder="repeat" autocomplete="new-password">
183
+ </div>
184
+ </div>
185
+ <div class="chpw-foot">
186
+ <button class="btn-chpw-save" onclick="changePassword()">Update Password</button>
187
+ <button class="btn-cancel" onclick="toggleChangePw()">Cancel</button>
188
+ <span class="chpw-msg" id="chpw-msg"></span>
189
+ </div>
190
+ </div>
191
+
192
+ <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
193
+ <div class="footer">localhost:${port} · 127.0.0.1 only · 3-strike lockout</div>
194
+ </div>
195
+
196
+ <script>
197
+ const BASE = "http://127.0.0.1:${port}";
198
+
199
+ const SERVICE_HINTS = {
200
+ "neo4j": "neo4j+s://username:password@instance.databases.neo4j.io",
201
+ "supabase-db": "postgresql://postgres:password@db.ref.supabase.co:5432/postgres",
202
+ "r2": "accountId:accessKeyId:secretAccessKey",
203
+ "namecheap": "apiUser:apiKey",
204
+ };
205
+
206
+ const KEY_URLS = {
207
+ "github": "https://github.com/settings/tokens",
208
+ "vercel": "https://vercel.com/account/tokens",
209
+ "supabase-anon": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
210
+ "supabase-service":"https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
211
+ "supabase-db": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/database",
212
+ "anthropic": "https://console.anthropic.com/settings/keys",
213
+ "cloudflare": "https://dash.cloudflare.com/profile/api-tokens",
214
+ "r2": "https://dash.cloudflare.com/profile/api-tokens",
215
+ "r2-bucket": "https://dash.cloudflare.com/profile/api-tokens",
216
+ "rocketreach": "https://rocketreach.co/account?section=security",
217
+ "namecheap": "https://ap.www.namecheap.com/settings/tools/apiaccess/",
218
+ "neo4j": "https://console.neo4j.io/",
219
+ "npm": "https://www.npmjs.com/settings/~/tokens",
220
+ "gmail": "https://console.cloud.google.com/apis/credentials",
221
+ };
222
+
223
+ // ── OAuth import config ─────────────────────
224
+ // OAuth services with atomic fields — each field saved as clauth.<service>.<key>
225
+ // No JSON blob parsing. Each field is its own vault secret.
226
+ const OAUTH_FIELDS = {
227
+ "gmail": [
228
+ { key: "client_id", label: "Client ID", hint: "From Google Cloud Console → APIs & Services → Credentials → OAuth client", required: true },
229
+ { key: "client_secret", label: "Client Secret", hint: "From Google Cloud Console OAuth client", required: true },
230
+ { key: "refresh_token", label: "Refresh Token", hint: "From Google OAuth Playground or your app's auth callback", required: true },
231
+ { key: "from_address", label: "From Address", hint: "Gmail address to send from (e.g. dave@life.ai)", required: false },
232
+ ]
233
+ };
234
+
235
+ function renderSetPanel(name) {
236
+ const fields = OAUTH_FIELDS[name];
237
+ if (fields) {
238
+ const fieldsHtml = fields.map(f => \`
239
+ <div class="oauth-field">
240
+ <label class="oauth-label">\${f.label}\${f.required ? "" : " <span style='color:#475569'>(optional)</span>"}</label>
241
+ \${f.hint ? \`<div class="oauth-hint">\${f.hint}</div>\` : ""}
242
+ <input type="text" class="oauth-input" id="ofield-\${name}-\${f.key}" placeholder="Paste \${f.label}…" spellcheck="false" autocomplete="off">
243
+ </div>
244
+ \`).join("");
245
+ return \`
246
+ <div class="set-panel" id="set-panel-\${name}">
247
+ <label>Set <strong>\${name}</strong> credentials — paste directly from source, never in chat</label>
248
+ <div class="oauth-fields">
249
+ \${fieldsHtml}
250
+ </div>
251
+ <div class="set-foot">
252
+ <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
253
+ <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
254
+ <span class="set-msg" id="set-msg-\${name}"></span>
255
+ </div>
256
+ </div>
257
+ \`;
258
+ }
259
+ return \`
260
+ <div class="set-panel" id="set-panel-\${name}">
261
+ <label>New value for <strong>\${name}</strong> — paste here, never in chat</label>
262
+ <textarea class="set-input" id="set-input-\${name}" placeholder="\${SERVICE_HINTS[name] || "Paste credential…"}" spellcheck="false"></textarea>
263
+ \${SERVICE_HINTS[name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${SERVICE_HINTS[name]}</div>\` : ""}
264
+ <div class="set-foot">
265
+ <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
266
+ <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
267
+ <span class="set-msg" id="set-msg-\${name}"></span>
268
+ </div>
269
+ </div>
270
+ \`;
271
+ }
272
+
273
+ // ── Boot: check lock state ──────────────────
274
+ async function boot() {
275
+ try {
276
+ const ping = await fetch(BASE + "/ping").then(r => r.json());
277
+ if (ping.locked) {
278
+ showLockScreen();
279
+ } else {
280
+ showMain(ping);
281
+ loadServices();
282
+ }
283
+ } catch {
284
+ showLockScreen();
285
+ }
286
+ }
287
+
288
+ function showLockScreen() {
289
+ document.getElementById("lock-screen").style.display = "flex";
290
+ document.getElementById("main-view").style.display = "none";
291
+ setTimeout(() => document.getElementById("lock-input").focus(), 50);
292
+ }
293
+
294
+ function showMain(ping) {
295
+ document.getElementById("lock-screen").style.display = "none";
296
+ document.getElementById("main-view").style.display = "block";
297
+ if (ping) {
298
+ document.getElementById("s-pid").textContent = ping.pid || "—";
299
+ document.getElementById("s-fails").textContent =
300
+ ping.failures + "/" + (ping.failures + ping.failures_remaining);
301
+ }
302
+ }
303
+
304
+ // ── Unlock ──────────────────────────────────
305
+ async function unlock() {
306
+ const input = document.getElementById("lock-input");
307
+ const btn = document.getElementById("unlock-btn");
308
+ const err = document.getElementById("lock-err");
309
+ const pw = input.value;
310
+
311
+ if (!pw) { err.textContent = "Password is required."; return; }
312
+
313
+ btn.disabled = true; btn.textContent = "Verifying…"; err.textContent = "";
314
+
315
+ try {
316
+ const r = await fetch(BASE + "/auth", {
317
+ method: "POST",
318
+ headers: { "Content-Type": "application/json" },
319
+ body: JSON.stringify({ password: pw })
320
+ }).then(r => r.json());
321
+
322
+ if (r.error) throw new Error(r.error);
323
+
324
+ input.value = "";
325
+ const ping = await fetch(BASE + "/ping").then(r => r.json());
326
+ showMain(ping);
327
+ loadServices();
328
+ } catch (e) {
329
+ input.value = "";
330
+ input.className = "lock-input error";
331
+ err.textContent = "✗ " + (e.message || "Invalid password");
332
+ setTimeout(() => input.className = "lock-input", 600);
333
+ } finally {
334
+ btn.disabled = false; btn.textContent = "Unlock";
335
+ }
336
+ }
337
+
338
+ // ── Lock ────────────────────────────────────
339
+ async function lockVault() {
340
+ await fetch(BASE + "/lock", { method: "POST" }).catch(() => {});
341
+ showLockScreen();
342
+ }
343
+
344
+ // ── Load services ───────────────────────────
345
+ async function loadServices() {
346
+ const grid = document.getElementById("grid");
347
+ const err = document.getElementById("error-bar");
348
+ err.style.display = "none";
349
+ grid.innerHTML = '<p class="loading">Loading…</p>';
350
+
351
+ try {
352
+ const status = await fetch(BASE + "/status").then(r => r.json());
353
+ if (status.locked) { showLockScreen(); return; }
354
+ if (status.error) throw new Error(status.error);
355
+
356
+ const services = status.services || [];
357
+ if (!services.length) { grid.innerHTML = '<p class="loading">No services registered.</p>'; return; }
358
+
359
+ grid.innerHTML = services.map(s => \`
360
+ <div class="card">
361
+ <div style="display:flex;align-items:flex-start;justify-content:space-between">
362
+ <div>
363
+ <div class="card-name">\${s.name}</div>
364
+ <div style="display:flex;align-items:center;gap:6px;margin-top:2px">
365
+ <div class="card-type">\${s.key_type || "secret"}</div>
366
+ <span class="svc-badge \${s.enabled === false ? "off" : "on"}" id="badge-\${s.name}">\${s.enabled === false ? "disabled" : "enabled"}</span>
367
+ </div>
368
+ \${KEY_URLS[s.name] ? \`<a class="card-getkey" href="\${KEY_URLS[s.name]}" target="_blank" rel="noopener">↗ Get / rotate key</a>\` : ""}
369
+ </div>
370
+ <div class="status-dot" id="sdot-\${s.name}" title=""></div>
371
+ </div>
372
+ <div class="card-value" id="val-\${s.name}"></div>
373
+ <div class="card-actions">
374
+ <button class="btn btn-reveal" onclick="reveal('\${s.name}', this)">Reveal</button>
375
+ <button class="btn btn-copy" id="copybtn-\${s.name}" style="display:none" onclick="copyKey('\${s.name}')">Copy</button>
376
+ <button class="btn btn-set" onclick="toggleSet('\${s.name}')">Set</button>
377
+ <button class="btn \${s.enabled === false ? "btn-enable" : "btn-disable"}" id="togbtn-\${s.name}" onclick="toggleService('\${s.name}')">\${s.enabled === false ? "Enable" : "Disable"}</button>
378
+ </div>
379
+ \${renderSetPanel(s.name)}
380
+ </div>
381
+ \`).join("");
382
+ } catch (e) {
383
+ err.textContent = "⚠ " + e.message;
384
+ err.style.display = "block";
385
+ document.getElementById("dot").style.background = "#ef4444";
386
+ grid.innerHTML = "";
387
+ }
388
+ }
389
+
390
+ // ── Reveal ──────────────────────────────────
391
+ async function reveal(name, btn) {
392
+ const valEl = document.getElementById("val-" + name);
393
+ const copyBtn = document.getElementById("copybtn-" + name);
394
+ if (valEl.style.display === "block") {
395
+ valEl.style.display = "none"; copyBtn.style.display = "none";
396
+ btn.textContent = "Reveal"; return;
397
+ }
398
+ valEl.textContent = "fetching…"; valEl.style.display = "block"; btn.textContent = "Hide";
399
+ try {
400
+ const r = await fetch(BASE + "/get/" + name).then(r => r.json());
401
+ if (r.locked) { showLockScreen(); return; }
402
+ if (r.error) throw new Error(r.error);
403
+ const imp = OAUTH_IMPORT[name];
404
+ if (imp) {
405
+ try {
406
+ const parsed = JSON.parse(r.value);
407
+ const allKeys = [...imp.jsonFields, ...imp.extra.map(f => f.key)];
408
+ valEl.innerHTML = allKeys.map(k =>
409
+ '<div style="margin-bottom:6px"><span style="color:#64748b;font-size:.72rem;text-transform:uppercase;letter-spacing:.4px">' + k.replace(/_/g," ") + '</span><br>' + (parsed[k] || "—") + '</div>'
410
+ ).join("");
411
+ } catch { valEl.textContent = r.value; }
412
+ } else {
413
+ valEl.textContent = r.value;
414
+ }
415
+ copyBtn.style.display = "inline-block";
416
+ } catch (e) {
417
+ valEl.textContent = "Error: " + e.message; valEl.style.color = "#ef4444";
418
+ }
419
+ }
420
+
421
+ async function copyKey(name) {
422
+ const val = document.getElementById("val-" + name).textContent;
423
+ try {
424
+ await navigator.clipboard.writeText(val);
425
+ const btn = document.getElementById("copybtn-" + name);
426
+ btn.textContent = "Copied!"; setTimeout(() => btn.textContent = "Copy", 1500);
427
+ } catch {}
428
+ }
429
+
430
+ // ── Set key ─────────────────────────────────
431
+ function toggleSet(name) {
432
+ const panel = document.getElementById("set-panel-" + name);
433
+ const msg = document.getElementById("set-msg-" + name);
434
+ const open = panel.style.display === "block";
435
+ panel.style.display = open ? "none" : "block";
436
+ if (!open) {
437
+ if (msg) msg.textContent = "";
438
+ const imp = OAUTH_IMPORT[name];
439
+ if (imp) {
440
+ const jsonEl = document.getElementById("ofield-" + name + "-json");
441
+ if (jsonEl) { jsonEl.value = ""; jsonEl.focus(); }
442
+ imp.extra.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
443
+ } else {
444
+ const input = document.getElementById("set-input-" + name);
445
+ if (input) { input.value = ""; input.focus(); }
446
+ }
447
+ }
448
+ }
449
+
450
+ async function saveKey(name) {
451
+ const msg = document.getElementById("set-msg-" + name);
452
+ const fields = OAUTH_FIELDS[name];
453
+
454
+ if (fields) {
455
+ // Validate required fields first
456
+ for (const f of fields) {
457
+ if (!f.required) continue;
458
+ const el = document.getElementById("ofield-" + name + "-" + f.key);
459
+ if (!el || !el.value.trim()) {
460
+ msg.className = "set-msg fail"; msg.textContent = f.label + " is required."; return;
461
+ }
462
+ }
463
+ // Save each field as an atomic vault key: clauth.<service>.<key>
464
+ msg.className = "set-msg"; msg.textContent = "Saving…";
465
+ try {
466
+ for (const f of fields) {
467
+ const el = document.getElementById("ofield-" + name + "-" + f.key);
468
+ const v = el ? el.value.trim() : "";
469
+ if (!v) continue; // skip optional empty fields
470
+ const r = await fetch(BASE + "/set/" + name + "." + f.key, {
471
+ method: "POST",
472
+ headers: { "Content-Type": "application/json" },
473
+ body: JSON.stringify({ value: v })
474
+ }).then(r => r.json());
475
+ if (r.locked) { showLockScreen(); return; }
476
+ if (r.error) throw new Error(r.error);
477
+ }
478
+ msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
479
+ fields.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
480
+ } catch (e) {
481
+ msg.className = "set-msg fail"; msg.textContent = e.message || "Save failed";
482
+ return;
483
+ }
484
+ } else {
485
+ const input = document.getElementById("set-input-" + name);
486
+ const value = input ? input.value.trim() : "";
487
+ if (!value) { msg.className = "set-msg fail"; msg.textContent = "Value is empty."; return; }
488
+
489
+ msg.className = "set-msg"; msg.textContent = "Saving…";
490
+ try {
491
+ const r = await fetch(BASE + "/set/" + name, {
492
+ method: "POST",
493
+ headers: { "Content-Type": "application/json" },
494
+ body: JSON.stringify({ value })
495
+ }).then(r => r.json());
496
+
497
+ if (r.locked) { showLockScreen(); return; }
498
+ if (r.error) throw new Error(r.error);
499
+ msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
500
+ const inp = document.getElementById("set-input-" + name);
501
+ if (inp) inp.value = "";
502
+ } catch (e) {
503
+ msg.className = "set-msg fail"; msg.textContent = e.message || "Save failed";
504
+ return;
505
+ }
506
+ }
507
+
508
+ const dot = document.getElementById("sdot-" + name);
509
+ if (dot) { dot.className = "status-dot"; dot.title = ""; }
510
+ setTimeout(() => {
511
+ document.getElementById("set-panel-" + name).style.display = "none";
512
+ msg.textContent = "";
513
+ }, 1800);
514
+ }
515
+
516
+ // ── Enable / Disable service ────────────────
517
+ async function toggleService(name) {
518
+ const badge = document.getElementById("badge-" + name);
519
+ const btn = document.getElementById("togbtn-" + name);
520
+ const currently = badge.classList.contains("on");
521
+ const newState = !currently;
522
+
523
+ btn.disabled = true; btn.textContent = "…";
524
+
525
+ try {
526
+ const r = await fetch(BASE + "/toggle/" + name, {
527
+ method: "POST",
528
+ headers: { "Content-Type": "application/json" },
529
+ body: JSON.stringify({ enabled: newState })
530
+ }).then(r => r.json());
531
+
532
+ if (r.locked) { showLockScreen(); return; }
533
+ if (r.error) throw new Error(r.error);
534
+
535
+ badge.className = "svc-badge " + (newState ? "on" : "off");
536
+ badge.textContent = newState ? "enabled" : "disabled";
537
+ btn.className = "btn " + (newState ? "btn-disable" : "btn-enable");
538
+ btn.textContent = newState ? "Disable" : "Enable";
539
+ } catch (e) {
540
+ btn.textContent = "Error";
541
+ setTimeout(() => {
542
+ btn.textContent = currently ? "Disable" : "Enable";
543
+ }, 2000);
544
+ } finally {
545
+ btn.disabled = false;
546
+ }
547
+ }
548
+
549
+ // ── Check all credentials ───────────────────
550
+ async function checkAll() {
551
+ const btn = document.getElementById("check-btn");
552
+ btn.disabled = true; btn.textContent = "Checking…";
553
+
554
+ // Show checking state on every visible dot
555
+ document.querySelectorAll(".status-dot").forEach(d => {
556
+ d.className = "status-dot checking"; d.title = "Checking…";
557
+ });
558
+
559
+ try {
560
+ const r = await fetch(BASE + "/check-all").then(r => r.json());
561
+ if (r.locked) { showLockScreen(); return; }
562
+ if (r.error) throw new Error(r.error);
563
+
564
+ const results = r.results || {};
565
+ for (const [name, result] of Object.entries(results)) {
566
+ const dot = document.getElementById("sdot-" + name);
567
+ if (!dot) continue;
568
+ if (result.ok) {
569
+ dot.className = "status-dot ok"; dot.title = "OK";
570
+ } else {
571
+ dot.className = "status-dot fail";
572
+ dot.title = result.reason || "No key stored";
573
+ }
574
+ }
575
+
576
+ // Fade green dots after 3 s — red dots stay until next check
577
+ setTimeout(() => {
578
+ document.querySelectorAll(".status-dot.ok").forEach(d => d.classList.add("fading"));
579
+ }, 3000);
580
+
581
+ } catch (e) {
582
+ document.querySelectorAll(".status-dot").forEach(d => { d.className = "status-dot"; d.title = ""; });
583
+ const errBar = document.getElementById("error-bar");
584
+ errBar.textContent = "⚠ Check failed: " + e.message;
585
+ errBar.style.display = "block";
586
+ } finally {
587
+ btn.disabled = false; btn.textContent = "⬤ Check All";
588
+ }
589
+ }
590
+
591
+ // ── Change password ─────────────────────────
592
+ function toggleChangePw() {
593
+ const panel = document.getElementById("chpw-panel");
594
+ const open = panel.style.display === "block";
595
+ panel.style.display = open ? "none" : "block";
596
+ if (!open) {
597
+ document.getElementById("chpw-new").value = "";
598
+ document.getElementById("chpw-confirm").value = "";
599
+ document.getElementById("chpw-msg").textContent = "";
600
+ document.getElementById("chpw-new").focus();
601
+ }
602
+ }
603
+
604
+ async function changePassword() {
605
+ const newPw = document.getElementById("chpw-new").value;
606
+ const confPw = document.getElementById("chpw-confirm").value;
607
+ const msg = document.getElementById("chpw-msg");
608
+
609
+ if (!newPw) { msg.className = "chpw-msg fail"; msg.textContent = "Enter a new password."; return; }
610
+ if (newPw.length < 8) { msg.className = "chpw-msg fail"; msg.textContent = "Minimum 8 characters."; return; }
611
+ if (newPw !== confPw) { msg.className = "chpw-msg fail"; msg.textContent = "Passwords don't match."; return; }
612
+
613
+ msg.className = "chpw-msg"; msg.textContent = "Updating…";
614
+ try {
615
+ const r = await fetch(BASE + "/change-pw", {
616
+ method: "POST",
617
+ headers: { "Content-Type": "application/json" },
618
+ body: JSON.stringify({ newPassword: newPw })
619
+ }).then(r => r.json());
620
+
621
+ if (r.locked) { showLockScreen(); return; }
622
+ if (r.error) throw new Error(r.error);
623
+
624
+ msg.className = "chpw-msg ok"; msg.textContent = "✓ Password updated";
625
+ document.getElementById("chpw-new").value = "";
626
+ document.getElementById("chpw-confirm").value = "";
627
+ setTimeout(() => {
628
+ document.getElementById("chpw-panel").style.display = "none";
629
+ msg.textContent = "";
630
+ }, 2000);
631
+ } catch (e) {
632
+ msg.className = "chpw-msg fail"; msg.textContent = "✗ " + e.message;
633
+ }
634
+ }
635
+
636
+ // Enter key on lock screen
637
+ document.addEventListener("DOMContentLoaded", () => {
638
+ document.getElementById("lock-input").addEventListener("keydown", e => {
639
+ if (e.key === "Enter") unlock();
640
+ });
641
+ });
642
+
643
+ boot();
644
+ </script>
645
+ </body>
646
+ </html>`;
647
+ }
648
+
649
+ // ── Body parser helper ────────────────────────────────────────
650
+ function readBody(req) {
651
+ return new Promise((resolve, reject) => {
652
+ let data = "";
653
+ req.on("data", chunk => { data += chunk; if (data.length > 65536) reject(new Error("Body too large")); });
654
+ req.on("end", () => { try { resolve(JSON.parse(data)); } catch { reject(new Error("Invalid JSON")); } });
655
+ req.on("error", reject);
656
+ });
657
+ }
658
+
659
+ // ── Server logic (shared by foreground + daemon) ─────────────
660
+ function createServer(initPassword, whitelist, port) {
661
+ const MAX_FAILS = 3;
662
+ let failCount = 0;
663
+ let password = initPassword || null; // null = locked; set via POST /auth
664
+ const machineHash = getMachineHash();
665
+
666
+ const CORS = {
667
+ "Access-Control-Allow-Origin": "*",
668
+ "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
669
+ "Access-Control-Allow-Headers": "Content-Type",
670
+ };
671
+
672
+ function strike(res, code, message) {
673
+ failCount++;
674
+ const remaining = MAX_FAILS - failCount;
675
+ const logLine = `[${new Date().toISOString()}] [FAIL ${failCount}/${MAX_FAILS}] ${message}\n`;
676
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
677
+
678
+ const body = JSON.stringify({
679
+ error: message,
680
+ failures: failCount,
681
+ failures_remaining: remaining,
682
+ ...(failCount >= MAX_FAILS ? { shutdown: true } : {})
683
+ });
684
+
685
+ res.writeHead(code, { "Content-Type": "application/json", ...CORS });
686
+ res.end(body);
687
+
688
+ if (failCount >= MAX_FAILS) {
689
+ const msg = `[${new Date().toISOString()}] Failure limit reached — shutting down\n`;
690
+ try { fs.appendFileSync(LOG_FILE, msg); } catch {}
691
+ removePid();
692
+ setTimeout(() => process.exit(1), 100);
693
+ }
694
+ }
695
+
696
+ function ok(res, data) {
697
+ res.writeHead(200, { "Content-Type": "application/json", ...CORS });
698
+ res.end(JSON.stringify(data));
699
+ }
700
+
701
+ const server = http.createServer(async (req, res) => {
702
+ // Hard reject anything not from loopback
703
+ const remote = req.socket.remoteAddress;
704
+ const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
705
+ if (!isLocal) {
706
+ return strike(res, 403, `Rejected non-local address: ${remote}`);
707
+ }
708
+
709
+ // CORS preflight
710
+ if (req.method === "OPTIONS") {
711
+ res.writeHead(204, CORS);
712
+ return res.end();
713
+ }
714
+
715
+ const url = new URL(req.url, `http://127.0.0.1:${port}`);
716
+ const reqPath = url.pathname;
717
+ const method = req.method;
718
+
719
+ // GET / — built-in web dashboard
720
+ if (method === "GET" && reqPath === "/") {
721
+ res.writeHead(200, { "Content-Type": "text/html", ...CORS });
722
+ return res.end(dashboardHtml(port, whitelist));
723
+ }
724
+
725
+ // GET /ping
726
+ if (method === "GET" && reqPath === "/ping") {
727
+ return ok(res, {
728
+ status: "ok",
729
+ pid: process.pid,
730
+ locked: !password,
731
+ failures: failCount,
732
+ failures_remaining: MAX_FAILS - failCount,
733
+ services: whitelist || "all",
734
+ port
735
+ });
736
+ }
737
+
738
+ // GET /shutdown (for daemon stop)
739
+ if (method === "GET" && reqPath === "/shutdown") {
740
+ ok(res, { ok: true, message: "shutting down" });
741
+ removePid();
742
+ setTimeout(() => process.exit(0), 100);
743
+ return;
744
+ }
745
+
746
+ // Locked guard — returns true if locked and already responded
747
+ function lockedGuard(res) {
748
+ if (!password) {
749
+ res.writeHead(401, { "Content-Type": "application/json", ...CORS });
750
+ res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
751
+ return true;
752
+ }
753
+ return false;
754
+ }
755
+
756
+ // GET /status
757
+ if (method === "GET" && reqPath === "/status") {
758
+ if (lockedGuard(res)) return;
759
+ try {
760
+ const { token, timestamp } = deriveToken(password, machineHash);
761
+ const result = await api.status(password, machineHash, token, timestamp);
762
+ if (result.error) return strike(res, 502, result.error);
763
+ if (whitelist) {
764
+ result.services = (result.services || []).filter(
765
+ s => whitelist.includes(s.name.toLowerCase())
766
+ );
767
+ }
768
+ return ok(res, result);
769
+ } catch (err) {
770
+ return strike(res, 502, err.message);
771
+ }
772
+ }
773
+
774
+ // GET /get/:service
775
+ const getMatch = reqPath.match(/^\/get\/([a-zA-Z0-9_.-]+)$/);
776
+ if (method === "GET" && getMatch) {
777
+ if (lockedGuard(res)) return;
778
+ const service = getMatch[1].toLowerCase();
779
+
780
+ if (whitelist && !whitelist.includes(service)) {
781
+ return strike(res, 403, `Service '${service}' not in whitelist`);
782
+ }
783
+
784
+ try {
785
+ const { token, timestamp } = deriveToken(password, machineHash);
786
+ const result = await api.retrieve(password, machineHash, token, timestamp, service);
787
+ if (result.error) return strike(res, 502, result.error);
788
+ return ok(res, { service, value: result.value, key_type: result.key_type });
789
+ } catch (err) {
790
+ return strike(res, 502, err.message);
791
+ }
792
+ }
793
+
794
+ // POST /auth — unlock the vault with a password (verifies against Edge Function)
795
+ if (method === "POST" && reqPath === "/auth") {
796
+ let body;
797
+ try { body = await readBody(req); } catch {
798
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
799
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
800
+ }
801
+
802
+ const pw = body.password;
803
+ if (!pw || typeof pw !== "string") {
804
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
805
+ return res.end(JSON.stringify({ error: "password is required" }));
806
+ }
807
+
808
+ try {
809
+ const { token, timestamp } = deriveToken(pw, machineHash);
810
+ const result = await api.test(pw, machineHash, token, timestamp);
811
+ if (result.error) throw new Error(result.error);
812
+ password = pw; // unlock — store in process memory only
813
+ const logLine = `[${new Date().toISOString()}] Vault unlocked\n`;
814
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
815
+ return ok(res, { ok: true, locked: false });
816
+ } catch {
817
+ // Wrong password — not a lockout strike, just a UI auth attempt
818
+ res.writeHead(401, { "Content-Type": "application/json", ...CORS });
819
+ return res.end(JSON.stringify({ error: "Invalid password" }));
820
+ }
821
+ }
822
+
823
+ // POST /lock — clear password from memory
824
+ if (method === "POST" && reqPath === "/lock") {
825
+ password = null;
826
+ const logLine = `[${new Date().toISOString()}] Vault locked\n`;
827
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
828
+ return ok(res, { ok: true, locked: true });
829
+ }
830
+
831
+ // POST /toggle/:service — enable or disable a service
832
+ const toggleMatch = reqPath.match(/^\/toggle\/([a-zA-Z0-9_-]+)$/);
833
+ if (method === "POST" && toggleMatch) {
834
+ if (lockedGuard(res)) return;
835
+ const service = toggleMatch[1].toLowerCase();
836
+
837
+ let body;
838
+ try { body = await readBody(req); } catch {
839
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
840
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
841
+ }
842
+
843
+ const { enabled } = body;
844
+ if (typeof enabled !== "boolean") {
845
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
846
+ return res.end(JSON.stringify({ error: "enabled must be boolean" }));
847
+ }
848
+
849
+ try {
850
+ const { token, timestamp } = deriveToken(password, machineHash);
851
+ const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
852
+ if (result.error) return strike(res, 502, result.error);
853
+ return ok(res, { ok: true, service, enabled });
854
+ } catch (err) {
855
+ return strike(res, 502, err.message);
856
+ }
857
+ }
858
+
859
+ // GET /check-all — soft health check, no strikes for missing/disabled keys
860
+ if (method === "GET" && reqPath === "/check-all") {
861
+ if (lockedGuard(res)) return;
862
+ try {
863
+ const { token: st, timestamp: sts } = deriveToken(password, machineHash);
864
+ const statusResult = await api.status(password, machineHash, st, sts);
865
+ if (statusResult.error) return strike(res, 502, statusResult.error);
866
+
867
+ const services = (statusResult.services || []).filter(
868
+ s => !whitelist || whitelist.includes(s.name.toLowerCase())
869
+ );
870
+
871
+ const results = {};
872
+ for (const svc of services) {
873
+ try {
874
+ const { token, timestamp } = deriveToken(password, machineHash);
875
+ const r = await api.retrieve(password, machineHash, token, timestamp, svc.name);
876
+ results[svc.name] = r.error
877
+ ? { ok: false, reason: r.error }
878
+ : { ok: true };
879
+ } catch (e) {
880
+ results[svc.name] = { ok: false, reason: e.message };
881
+ }
882
+ }
883
+ return ok(res, { results });
884
+ } catch (err) {
885
+ return strike(res, 502, err.message);
886
+ }
887
+ }
888
+
889
+ // POST /change-pw — change master password (must be unlocked)
890
+ if (method === "POST" && reqPath === "/change-pw") {
891
+ if (lockedGuard(res)) return;
892
+
893
+ let body;
894
+ try { body = await readBody(req); } catch {
895
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
896
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
897
+ }
898
+
899
+ const { newPassword } = body;
900
+ if (!newPassword || typeof newPassword !== "string" || newPassword.length < 8) {
901
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
902
+ return res.end(JSON.stringify({ error: "newPassword must be at least 8 characters" }));
903
+ }
904
+
905
+ try {
906
+ const { token, timestamp } = deriveToken(password, machineHash);
907
+ const newSeedHash = deriveSeedHash(machineHash, newPassword);
908
+ const result = await api.changePassword(password, machineHash, token, timestamp, newSeedHash);
909
+ if (result.error) throw new Error(result.error);
910
+ password = newPassword; // update in-memory password to new one
911
+ const logLine = `[${new Date().toISOString()}] Password changed\n`;
912
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
913
+ return ok(res, { ok: true });
914
+ } catch (err) {
915
+ res.writeHead(502, { "Content-Type": "application/json", ...CORS });
916
+ return res.end(JSON.stringify({ error: err.message }));
917
+ }
918
+ }
919
+
920
+ // POST /set/:service — write a new key value into vault
921
+ const setMatch = reqPath.match(/^\/set\/([a-zA-Z0-9_.-]+)$/);
922
+ if (method === "POST" && setMatch) {
923
+ if (lockedGuard(res)) return;
924
+ const service = setMatch[1].toLowerCase();
925
+
926
+ if (whitelist && !whitelist.includes(service)) {
927
+ return strike(res, 403, `Service '${service}' not in whitelist`);
928
+ }
929
+
930
+ let body;
931
+ try { body = await readBody(req); } catch {
932
+ return strike(res, 400, "Invalid JSON body");
933
+ }
934
+
935
+ const value = body.value;
936
+ if (!value || typeof value !== "string" || !value.trim()) {
937
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
938
+ return res.end(JSON.stringify({ error: "value is required" }));
939
+ }
940
+
941
+ try {
942
+ const { token, timestamp } = deriveToken(password, machineHash);
943
+ const result = await api.write(password, machineHash, token, timestamp, service, value.trim());
944
+ if (result.error) return strike(res, 502, result.error);
945
+ return ok(res, { ok: true, service });
946
+ } catch (err) {
947
+ return strike(res, 502, err.message);
948
+ }
949
+ }
950
+
951
+ // Unknown route
952
+ return strike(res, 404, `Unknown endpoint: ${reqPath}`);
953
+ });
954
+
955
+ return server;
956
+ }
957
+
958
+ // ── Actions ──────────────────────────────────────────────────
959
+
960
+ async function verifyAuth(password) {
961
+ const machineHash = getMachineHash();
962
+ const { token, timestamp } = deriveToken(password, machineHash);
963
+ const result = await api.test(password, machineHash, token, timestamp);
964
+ if (result.error) throw new Error(result.error);
965
+ }
966
+
967
+ async function actionStart(opts) {
968
+ const port = parseInt(opts.port || "52437", 10);
969
+ const password = opts.pw;
970
+ const whitelist = opts.services
971
+ ? opts.services.split(",").map(s => s.trim().toLowerCase())
972
+ : null;
973
+
974
+ // Check for existing instance
975
+ const existing = readPid();
976
+ if (existing && isProcessAlive(existing.pid)) {
977
+ console.log(chalk.yellow(`\n clauth serve already running (PID ${existing.pid}, port ${existing.port})`));
978
+ console.log(chalk.gray(` Stop it first: clauth serve stop\n`));
979
+ process.exit(1);
980
+ }
981
+
982
+ // If we're the daemon child, run the server directly
983
+ if (process.env.__CLAUTH_DAEMON === "1") {
984
+ // Verify password only if one was provided at start (optional — browser can unlock later)
985
+ if (password) {
986
+ try {
987
+ await verifyAuth(password);
988
+ } catch (err) {
989
+ const msg = `[${new Date().toISOString()}] Auth failed: ${err.message}\n`;
990
+ fs.appendFileSync(LOG_FILE, msg);
991
+ process.exit(1);
992
+ }
993
+ }
994
+
995
+ const server = createServer(password, whitelist, port);
996
+ server.listen(port, "127.0.0.1", () => {
997
+ writePid(process.pid, port);
998
+ const msg = `[${new Date().toISOString()}] clauth serve started — PID ${process.pid}, port ${port}, services: ${whitelist ? whitelist.join(",") : "all"}\n`;
999
+ fs.appendFileSync(LOG_FILE, msg);
1000
+ });
1001
+
1002
+ server.on("error", err => {
1003
+ const msg = `[${new Date().toISOString()}] Server error: ${err.message}\n`;
1004
+ fs.appendFileSync(LOG_FILE, msg);
1005
+ process.exit(1);
1006
+ });
1007
+
1008
+ const shutdown = () => { removePid(); process.exit(0); };
1009
+ process.on("SIGTERM", shutdown);
1010
+ process.on("SIGINT", shutdown);
1011
+ return;
1012
+ }
1013
+
1014
+ // If --pw provided, verify it before spawning (fast-fail on wrong password)
1015
+ if (password) {
1016
+ console.log(chalk.gray("\n Verifying vault credentials..."));
1017
+ try {
1018
+ await verifyAuth(password);
1019
+ } catch (err) {
1020
+ console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1021
+ process.exit(1);
1022
+ }
1023
+ console.log(chalk.green(" ✓ Vault auth verified"));
1024
+ } else {
1025
+ console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1026
+ }
1027
+
1028
+ // Spawn detached daemon child via the clauth CLI entry point
1029
+ const { spawn } = await import("child_process");
1030
+ const { fileURLToPath } = await import("url");
1031
+ const { dirname, join } = await import("path");
1032
+ const __filename = fileURLToPath(import.meta.url);
1033
+ const cliEntry = join(dirname(__filename), "..", "index.js");
1034
+
1035
+ // Build args: node index.js serve start --port N [--pw PW] [--services S]
1036
+ const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
1037
+ if (password) childArgs.push("--pw", password);
1038
+ if (opts.services) childArgs.push("--services", opts.services);
1039
+
1040
+ const out = fs.openSync(LOG_FILE, "a");
1041
+ const child = spawn(process.execPath, childArgs, {
1042
+ detached: true,
1043
+ stdio: ["ignore", out, out],
1044
+ env: { ...process.env, __CLAUTH_DAEMON: "1" },
1045
+ });
1046
+ child.unref();
1047
+
1048
+ // Give it time to bind and write PID file (Windows spawn is slower)
1049
+ // Verify via HTTP ping (process.kill(pid,0) fails on Windows for detached processes)
1050
+ let started = false;
1051
+ for (let attempt = 0; attempt < 5; attempt++) {
1052
+ await new Promise(r => setTimeout(r, 1000));
1053
+ try {
1054
+ const resp = await fetch(`http://127.0.0.1:${port}/ping`);
1055
+ if (resp.ok) { started = true; break; }
1056
+ } catch {}
1057
+ }
1058
+
1059
+ const info = readPid();
1060
+ if (started && info) {
1061
+ console.log(chalk.green(`\n 🔐 clauth serve started`));
1062
+ console.log(chalk.gray(` PID: ${info.pid}`));
1063
+ console.log(chalk.gray(` Port: 127.0.0.1:${info.port}`));
1064
+ console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1065
+ console.log(chalk.gray(` Log: ${LOG_FILE}`));
1066
+ if (!password) {
1067
+ console.log(chalk.cyan(`\n 👉 Open http://127.0.0.1:${info.port} to unlock the vault`));
1068
+ }
1069
+ console.log(chalk.gray(` Stop: clauth serve stop\n`));
1070
+ } else {
1071
+ console.log(chalk.red(`\n ❌ Failed to start daemon — check ${LOG_FILE}\n`));
1072
+ process.exit(1);
1073
+ }
1074
+ }
1075
+
1076
+ async function actionStop() {
1077
+ const info = readPid();
1078
+ if (!info) {
1079
+ console.log(chalk.yellow("\n No clauth serve PID file found — not running.\n"));
1080
+ return;
1081
+ }
1082
+
1083
+ if (!isProcessAlive(info.pid)) {
1084
+ console.log(chalk.yellow(`\n PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
1085
+ removePid();
1086
+ return;
1087
+ }
1088
+
1089
+ // Try HTTP shutdown first (clean)
1090
+ try {
1091
+ const resp = await fetch(`http://127.0.0.1:${info.port}/shutdown`);
1092
+ if (resp.ok) {
1093
+ await new Promise(r => setTimeout(r, 300));
1094
+ console.log(chalk.green(`\n 🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
1095
+ removePid();
1096
+ return;
1097
+ }
1098
+ } catch {}
1099
+
1100
+ // Fallback: kill the process
1101
+ try {
1102
+ process.kill(info.pid, "SIGTERM");
1103
+ await new Promise(r => setTimeout(r, 300));
1104
+ console.log(chalk.green(`\n 🛑 clauth serve stopped via SIGTERM (PID ${info.pid})\n`));
1105
+ } catch (err) {
1106
+ console.log(chalk.yellow(`\n Could not kill PID ${info.pid}: ${err.message}\n`));
1107
+ }
1108
+ removePid();
1109
+ }
1110
+
1111
+ async function actionPing() {
1112
+ const info = readPid();
1113
+ if (!info) {
1114
+ console.log(chalk.red("\n clauth serve is not running (no PID file)\n"));
1115
+ process.exit(1);
1116
+ }
1117
+
1118
+ if (!isProcessAlive(info.pid)) {
1119
+ console.log(chalk.red(`\n PID ${info.pid} is not alive (stale PID file)\n`));
1120
+ removePid();
1121
+ process.exit(1);
1122
+ }
1123
+
1124
+ try {
1125
+ const resp = await fetch(`http://127.0.0.1:${info.port}/ping`);
1126
+ const data = await resp.json();
1127
+ if (data.status === "ok") {
1128
+ console.log(chalk.green(`\n ✅ clauth serve running`));
1129
+ console.log(chalk.gray(` PID: ${info.pid}`));
1130
+ console.log(chalk.gray(` Port: ${info.port}`));
1131
+ console.log(chalk.gray(` Fails: ${data.failures}/${data.failures + data.failures_remaining}`));
1132
+ console.log(chalk.gray(` Services: ${Array.isArray(data.services) ? data.services.join(", ") : data.services}\n`));
1133
+ } else {
1134
+ console.log(chalk.yellow(`\n PID alive but /ping returned unexpected response\n`));
1135
+ }
1136
+ } catch (err) {
1137
+ console.log(chalk.yellow(`\n PID ${info.pid} alive but HTTP failed: ${err.message}\n`));
1138
+ }
1139
+ }
1140
+
1141
+ async function actionRestart(opts) {
1142
+ const info = readPid();
1143
+ if (info && isProcessAlive(info.pid)) {
1144
+ await actionStop();
1145
+ await new Promise(r => setTimeout(r, 500));
1146
+ }
1147
+ await actionStart(opts);
1148
+ }
1149
+
1150
+ async function actionForeground(opts) {
1151
+ const port = parseInt(opts.port || "52437", 10);
1152
+ const password = opts.pw || null;
1153
+ const whitelist = opts.services
1154
+ ? opts.services.split(",").map(s => s.trim().toLowerCase())
1155
+ : null;
1156
+
1157
+ if (password) {
1158
+ console.log(chalk.gray("\n Verifying vault credentials..."));
1159
+ try {
1160
+ await verifyAuth(password);
1161
+ } catch (err) {
1162
+ console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1163
+ process.exit(1);
1164
+ }
1165
+ console.log(chalk.green(" ✓ Vault auth verified"));
1166
+ } else {
1167
+ console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1168
+ }
1169
+
1170
+ console.log(chalk.gray(` Port: 127.0.0.1:${port}`));
1171
+ console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1172
+ console.log(chalk.gray(` Lockout: 3 failures → exit\n`));
1173
+
1174
+ const server = createServer(password, whitelist, port);
1175
+ server.listen(port, "127.0.0.1", () => {
1176
+ writePid(process.pid, port);
1177
+ console.log(chalk.green(` clauth serve → http://127.0.0.1:${port}`));
1178
+ if (!password) console.log(chalk.cyan(` 👉 Open http://127.0.0.1:${port} to unlock`));
1179
+ console.log(chalk.gray(" Ctrl+C to stop\n"));
1180
+ });
1181
+
1182
+ server.on("error", err => {
1183
+ if (err.code === "EADDRINUSE") {
1184
+ console.log(chalk.red(`\n Port ${port} already in use. Use --port to choose another.\n`));
1185
+ } else {
1186
+ console.log(chalk.red(`\n Server error: ${err.message}\n`));
1187
+ }
1188
+ process.exit(1);
1189
+ });
1190
+
1191
+ process.on("SIGINT", () => {
1192
+ console.log(chalk.yellow("\n Stopping clauth serve...\n"));
1193
+ removePid();
1194
+ server.close(() => process.exit(0));
1195
+ });
1196
+ }
1197
+
1198
+ // ── Export ────────────────────────────────────────────────────
1199
+ export async function runServe(opts) {
1200
+ const action = opts.action || "foreground";
1201
+
1202
+ switch (action) {
1203
+ case "start": return actionStart(opts);
1204
+ case "stop": return actionStop();
1205
+ case "restart": return actionRestart(opts);
1206
+ case "ping": return actionPing();
1207
+ case "foreground": return actionForeground(opts);
1208
+ default:
1209
+ console.log(chalk.red(`\n Unknown serve action: ${action}`));
1210
+ console.log(chalk.gray(" Actions: start | stop | restart | ping | foreground\n"));
1211
+ process.exit(1);
1212
+ }
1213
+ }