@lifeaitools/clauth 0.3.7 → 0.3.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/.clauth-skill/SKILL.md +184 -184
  2. package/.clauth-skill/references/keys-guide.md +270 -270
  3. package/.clauth-skill/references/operator-guide.md +148 -148
  4. package/README.md +125 -125
  5. package/cli/api.js +112 -112
  6. package/cli/commands/install.js +264 -264
  7. package/cli/commands/serve.js +1207 -1101
  8. package/cli/commands/uninstall.js +164 -164
  9. package/cli/fingerprint.js +91 -91
  10. package/cli/index.js +1 -1
  11. package/install.ps1 +44 -44
  12. package/install.sh +38 -38
  13. package/package.json +1 -1
  14. package/scripts/bin/bootstrap-linux +0 -0
  15. package/scripts/bin/bootstrap-macos +0 -0
  16. package/scripts/bootstrap.cjs +43 -43
  17. package/scripts/build.sh +45 -45
  18. package/supabase/functions/auth-vault/index.ts +235 -235
  19. package/supabase/migrations/001_clauth_schema.sql +103 -103
  20. package/supabase/migrations/002_vault_helpers.sql +90 -90
  21. package/supabase/migrations/20260317_lockout.sql +26 -26
package/cli/commands/serve.js CHANGED
@@ -1,1101 +1,1207 @@
1
- // cli/commands/serve.js
2
- // Localhost-only credential daemon with daemon lifecycle management
3
- // Binds 127.0.0.1 ONLY — unreachable from outside the machine
4
- // 3 failed requests of any kind → process exits, requires manual restart
5
- // Supports: start (background daemon), stop, restart, ping, foreground
6
-
7
- import http from "http";
8
- import fs from "fs";
9
- import os from "os";
10
- import path from "path";
11
- import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
12
- import * as api from "../api.js";
13
- import chalk from "chalk";
14
-
15
- const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
16
- const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
17
-
18
- // ── PID helpers ──────────────────────────────────────────────
19
- function readPid() {
20
- try {
21
- const raw = fs.readFileSync(PID_FILE, "utf8").trim();
22
- const [pid, port] = raw.split(":");
23
- return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
24
- } catch { return null; }
25
- }
26
-
27
- function writePid(pid, port) {
28
- fs.writeFileSync(PID_FILE, `${pid}:${port}`, "utf8");
29
- }
30
-
31
- function removePid() {
32
- try { fs.unlinkSync(PID_FILE); } catch {}
33
- }
34
-
35
- function isProcessAlive(pid) {
36
- try { process.kill(pid, 0); return true; } catch { return false; }
37
- }
38
-
39
- // ── Dashboard HTML ───────────────────────────────────────────
40
- function dashboardHtml(port, whitelist) {
41
- return `<!DOCTYPE html>
42
- <html lang="en">
43
- <head>
44
- <meta charset="utf-8">
45
- <meta name="viewport" content="width=device-width,initial-scale=1">
46
- <title>clauth vault</title>
47
- <style>
48
- *{margin:0;padding:0;box-sizing:border-box}
49
- body{background:#0a0f1a;color:#e2e8f0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh}
50
- /* ── Lock screen ── */
51
- #lock-screen{display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;padding:2rem}
52
- .lock-card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:2.5rem 2rem;width:100%;max-width:380px;text-align:center}
53
- .lock-icon{font-size:2.5rem;margin-bottom:1rem}
54
- .lock-title{font-size:1.25rem;font-weight:600;color:#f8fafc;margin-bottom:.4rem}
55
- .lock-sub{font-size:.85rem;color:#64748b;margin-bottom:1.75rem}
56
- .lock-input{width:100%;background:#0f172a;border:1px solid #334155;border-radius:8px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:1rem;padding:10px 14px;outline:none;text-align:center;letter-spacing:.1em;transition:border-color .2s;margin-bottom:1rem}
57
- .lock-input:focus{border-color:#3b82f6}
58
- .lock-input.error{border-color:#ef4444;animation:shake .3s}
59
- @keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-6px)}75%{transform:translateX(6px)}}
60
- .btn-unlock{width:100%;background:#3b82f6;color:#fff;border:none;border-radius:8px;padding:10px;font-size:.95rem;font-weight:600;cursor:pointer;transition:background .15s}
61
- .btn-unlock:hover{background:#2563eb}
62
- .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
63
- .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
64
- /* ── Main view ── */
65
- #main-view{display:none;padding:2rem}
66
- .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
67
- .header h1{font-size:1.4rem;font-weight:600;flex:1}
68
- .dot{width:10px;height:10px;border-radius:50%;background:#22c55e;animation:pulse 2s infinite;flex-shrink:0}
69
- @keyframes pulse{0%,100%{opacity:1}50%{opacity:.4}}
70
- .status-bar{display:flex;gap:1.5rem;margin-bottom:1.5rem;font-size:.82rem;color:#94a3b8;flex-wrap:wrap}
71
- .status-bar span{color:#e2e8f0;font-weight:500}
72
- .toolbar{display:flex;gap:8px;margin-bottom:1rem;flex-wrap:wrap;align-items:center}
73
- .chpw-panel{display:none;background:#1a1f2e;border:1px solid #334155;border-radius:8px;padding:1.25rem;margin-bottom:1.5rem}
74
- .chpw-panel h3{font-size:.9rem;font-weight:600;color:#f8fafc;margin-bottom:1rem}
75
- .chpw-row{display:flex;gap:10px;flex-wrap:wrap;align-items:flex-end;margin-bottom:.75rem}
76
- .chpw-field{display:flex;flex-direction:column;gap:4px}
77
- .chpw-field label{font-size:.75rem;color:#64748b}
78
- .chpw-input{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s}
79
- .chpw-input:focus{border-color:#3b82f6}
80
- .chpw-foot{display:flex;gap:8px;align-items:center}
81
- .btn-chpw-save{background:#1e3a5f;color:#60a5fa;padding:7px 18px;font-size:.85rem;border-radius:6px;border:none;cursor:pointer;font-weight:500;transition:background .15s}
82
- .btn-chpw-save:hover{background:#1e4a7f}
83
- .chpw-msg{font-size:.82rem}
84
- .chpw-msg.ok{color:#4ade80} .chpw-msg.fail{color:#f87171}
85
- .btn-refresh{background:#3b82f6;color:#fff;padding:7px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:500}
86
- .btn-refresh:hover{background:#2563eb}
87
- .btn-lock{background:#1e293b;color:#f87171;border:1px solid #334155;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500}
88
- .btn-lock:hover{background:#2d1f1f;border-color:#f87171}
89
- .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:1rem}
90
- .card{background:#1e293b;border:1px solid #334155;border-radius:8px;padding:1.25rem;transition:border-color .2s}
91
- .card:hover{border-color:#3b82f6}
92
- .card-name{font-size:1rem;font-weight:600;color:#f8fafc;margin-bottom:3px}
93
- .card-type{font-size:.78rem;color:#64748b;text-transform:uppercase;letter-spacing:.5px}
94
- .card-getkey{font-size:.75rem;color:#3b82f6;text-decoration:none;opacity:.7;transition:opacity .15s}
95
- .card-getkey:hover{opacity:1;text-decoration:underline}
96
- .card-value{font-family:'Courier New',monospace;font-size:.82rem;color:#22c55e;background:#0f172a;border-radius:4px;padding:8px 10px;margin-top:10px;word-break:break-all;max-height:80px;overflow:auto;display:none}
97
- .card-actions{margin-top:10px;display:flex;gap:7px;flex-wrap:wrap}
98
- .set-panel{display:none;margin-top:10px;background:#0f172a;border-radius:6px;padding:10px;border:1px solid #1e3a5f}
99
- .set-panel label{font-size:.75rem;color:#64748b;display:block;margin-bottom:6px}
100
- .set-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;resize:vertical;min-height:58px;transition:border-color .2s}
101
- .set-input:focus{border-color:#3b82f6}
102
- .set-foot{margin-top:8px;display:flex;gap:8px;align-items:center}
103
- .set-msg{font-size:.8rem}
104
- .set-msg.ok{color:#4ade80} .set-msg.fail{color:#f87171}
105
- .btn{padding:6px 13px;border-radius:6px;border:none;cursor:pointer;font-size:.8rem;font-weight:500;transition:all .15s}
106
- .btn-reveal{background:#1e3a5f;color:#60a5fa}.btn-reveal:hover{background:#1e4a7f}
107
- .btn-copy{background:#1a3328;color:#4ade80}.btn-copy:hover{background:#1a4338}
108
- .btn-set{background:#2d1f4a;color:#a78bfa}.btn-set:hover{background:#3d2f5a}
109
- .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
110
- .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
111
- .btn-check{background:#0f2d2d;color:#34d399;border:1px solid #064e3b;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
112
- .btn-check:hover{background:#134e4a;border-color:#34d399}.btn-check:disabled{opacity:.5;cursor:not-allowed}
113
- .btn-enable{background:#14291a;color:#4ade80;border:1px solid #166534}.btn-enable:hover{background:#1a3d22;border-color:#4ade80}
114
- .btn-disable{background:#2d1f1f;color:#f87171;border:1px solid #7f1d1d}.btn-disable:hover{background:#3d2525;border-color:#f87171}
115
- .svc-badge{font-size:.7rem;font-weight:600;padding:2px 7px;border-radius:4px;letter-spacing:.4px;text-transform:uppercase}
116
- .svc-badge.on{background:rgba(74,222,128,.12);color:#4ade80;border:1px solid rgba(74,222,128,.25)}
117
- .svc-badge.off{background:rgba(248,113,113,.1);color:#f87171;border:1px solid rgba(248,113,113,.2)}
118
- .status-dot{width:8px;height:8px;border-radius:50%;flex-shrink:0;opacity:0;transition:opacity .3s;margin-top:4px;cursor:default}
119
- .status-dot.checking{background:#f59e0b;opacity:1;animation:pulse 1s infinite}
120
- .status-dot.ok{background:#22c55e;opacity:1}
121
- .status-dot.fail{background:#ef4444;opacity:1}
122
- @keyframes sdot-fade{to{opacity:0}} .status-dot.fading{animation:sdot-fade 1.5s forwards}
123
- .error-bar{background:#7f1d1d;color:#fca5a5;border:1px solid #991b1b;padding:10px 14px;border-radius:8px;margin-bottom:1rem;display:none;font-size:.85rem}
124
- .loading{color:#64748b;font-style:italic}
125
- .footer{margin-top:2rem;font-size:.75rem;color:#475569;text-align:center}
126
- </style>
127
- </head>
128
- <body>
129
-
130
- <!-- ── Lock screen ──────────────────────────── -->
131
- <div id="lock-screen">
132
- <div class="lock-card">
133
- <div class="lock-icon">🔒</div>
134
- <div class="lock-title">clauth vault</div>
135
- <div class="lock-sub">Paste your password to unlock</div>
136
- <input class="lock-input" id="lock-input" type="password" placeholder="••••••••••••" autocomplete="off">
137
- <button class="btn-unlock" id="unlock-btn" onclick="unlock()">Unlock</button>
138
- <div class="lock-err" id="lock-err"></div>
139
- </div>
140
- </div>
141
-
142
- <!-- ── Main view (shown after unlock) ──────── -->
143
- <div id="main-view">
144
- <div class="header">
145
- <div class="dot" id="dot"></div>
146
- <h1>🔐 clauth vault</h1>
147
- </div>
148
- <div id="error-bar" class="error-bar"></div>
149
- <div class="status-bar">
150
- <div>PID: <span id="s-pid">—</span></div>
151
- <div>Port: <span id="s-port">${port}</span></div>
152
- <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
153
- <div>Failures: <span id="s-fails">—</span></div>
154
- </div>
155
- <div class="toolbar">
156
- <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
157
- <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
158
- <button class="btn-lock" onclick="lockVault()">🔒 Lock</button>
159
- <button class="btn-cancel" style="margin-left:auto" onclick="toggleChangePw()">Change Password</button>
160
- </div>
161
-
162
- <div class="chpw-panel" id="chpw-panel">
163
- <h3>Change Master Password</h3>
164
- <div class="chpw-row">
165
- <div class="chpw-field">
166
- <label>New password</label>
167
- <input class="chpw-input" id="chpw-new" type="password" placeholder="min 8 chars" autocomplete="new-password">
168
- </div>
169
- <div class="chpw-field">
170
- <label>Confirm</label>
171
- <input class="chpw-input" id="chpw-confirm" type="password" placeholder="repeat" autocomplete="new-password">
172
- </div>
173
- </div>
174
- <div class="chpw-foot">
175
- <button class="btn-chpw-save" onclick="changePassword()">Update Password</button>
176
- <button class="btn-cancel" onclick="toggleChangePw()">Cancel</button>
177
- <span class="chpw-msg" id="chpw-msg"></span>
178
- </div>
179
- </div>
180
-
181
- <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
182
- <div class="footer">localhost:${port} · 127.0.0.1 only · 3-strike lockout</div>
183
- </div>
184
-
185
- <script>
186
- const BASE = "http://127.0.0.1:${port}";
187
-
188
- const SERVICE_HINTS = {
189
- "neo4j": "neo4j+s://username:password@instance.databases.neo4j.io",
190
- "supabase-db": "postgresql://postgres:password@db.ref.supabase.co:5432/postgres",
191
- "r2": "accountId:accessKeyId:secretAccessKey",
192
- "namecheap": "apiUser:apiKey",
193
- };
194
-
195
- const KEY_URLS = {
196
- "github": "https://github.com/settings/tokens",
197
- "vercel": "https://vercel.com/account/tokens",
198
- "supabase-anon": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
199
- "supabase-service":"https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
200
- "supabase-db": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/database",
201
- "anthropic": "https://console.anthropic.com/settings/keys",
202
- "cloudflare": "https://dash.cloudflare.com/profile/api-tokens",
203
- "r2": "https://dash.cloudflare.com/profile/api-tokens",
204
- "r2-bucket": "https://dash.cloudflare.com/profile/api-tokens",
205
- "rocketreach": "https://rocketreach.co/account?section=security",
206
- "namecheap": "https://ap.www.namecheap.com/settings/tools/apiaccess/",
207
- "neo4j": "https://console.neo4j.io/",
208
- "npm": "https://www.npmjs.com/settings/~/tokens",
209
- };
210
-
211
- // ── Boot: check lock state ──────────────────
212
- async function boot() {
213
- try {
214
- const ping = await fetch(BASE + "/ping").then(r => r.json());
215
- if (ping.locked) {
216
- showLockScreen();
217
- } else {
218
- showMain(ping);
219
- loadServices();
220
- }
221
- } catch {
222
- showLockScreen();
223
- }
224
- }
225
-
226
- function showLockScreen() {
227
- document.getElementById("lock-screen").style.display = "flex";
228
- document.getElementById("main-view").style.display = "none";
229
- setTimeout(() => document.getElementById("lock-input").focus(), 50);
230
- }
231
-
232
- function showMain(ping) {
233
- document.getElementById("lock-screen").style.display = "none";
234
- document.getElementById("main-view").style.display = "block";
235
- if (ping) {
236
- document.getElementById("s-pid").textContent = ping.pid || "—";
237
- document.getElementById("s-fails").textContent =
238
- ping.failures + "/" + (ping.failures + ping.failures_remaining);
239
- }
240
- }
241
-
242
- // ── Unlock ──────────────────────────────────
243
- async function unlock() {
244
- const input = document.getElementById("lock-input");
245
- const btn = document.getElementById("unlock-btn");
246
- const err = document.getElementById("lock-err");
247
- const pw = input.value;
248
-
249
- if (!pw) { err.textContent = "Password is required."; return; }
250
-
251
- btn.disabled = true; btn.textContent = "Verifying…"; err.textContent = "";
252
-
253
- try {
254
- const r = await fetch(BASE + "/auth", {
255
- method: "POST",
256
- headers: { "Content-Type": "application/json" },
257
- body: JSON.stringify({ password: pw })
258
- }).then(r => r.json());
259
-
260
- if (r.error) throw new Error(r.error);
261
-
262
- input.value = "";
263
- const ping = await fetch(BASE + "/ping").then(r => r.json());
264
- showMain(ping);
265
- loadServices();
266
- } catch (e) {
267
- input.value = "";
268
- input.className = "lock-input error";
269
- err.textContent = "✗ " + (e.message || "Invalid password");
270
- setTimeout(() => input.className = "lock-input", 600);
271
- } finally {
272
- btn.disabled = false; btn.textContent = "Unlock";
273
- }
274
- }
275
-
276
- // ── Lock ────────────────────────────────────
277
- async function lockVault() {
278
- await fetch(BASE + "/lock", { method: "POST" }).catch(() => {});
279
- showLockScreen();
280
- }
281
-
282
- // ── Load services ───────────────────────────
283
- async function loadServices() {
284
- const grid = document.getElementById("grid");
285
- const err = document.getElementById("error-bar");
286
- err.style.display = "none";
287
- grid.innerHTML = '<p class="loading">Loading…</p>';
288
-
289
- try {
290
- const status = await fetch(BASE + "/status").then(r => r.json());
291
- if (status.locked) { showLockScreen(); return; }
292
- if (status.error) throw new Error(status.error);
293
-
294
- const services = status.services || [];
295
- if (!services.length) { grid.innerHTML = '<p class="loading">No services registered.</p>'; return; }
296
-
297
- grid.innerHTML = services.map(s => \`
298
- <div class="card">
299
- <div style="display:flex;align-items:flex-start;justify-content:space-between">
300
- <div>
301
- <div class="card-name">\${s.name}</div>
302
- <div style="display:flex;align-items:center;gap:6px;margin-top:2px">
303
- <div class="card-type">\${s.key_type || "secret"}</div>
304
- <span class="svc-badge \${s.enabled === false ? "off" : "on"}" id="badge-\${s.name}">\${s.enabled === false ? "disabled" : "enabled"}</span>
305
- </div>
306
- \${KEY_URLS[s.name] ? \`<a class="card-getkey" href="\${KEY_URLS[s.name]}" target="_blank" rel="noopener">↗ Get / rotate key</a>\` : ""}
307
- </div>
308
- <div class="status-dot" id="sdot-\${s.name}" title=""></div>
309
- </div>
310
- <div class="card-value" id="val-\${s.name}"></div>
311
- <div class="card-actions">
312
- <button class="btn btn-reveal" onclick="reveal('\${s.name}', this)">Reveal</button>
313
- <button class="btn btn-copy" id="copybtn-\${s.name}" style="display:none" onclick="copyKey('\${s.name}')">Copy</button>
314
- <button class="btn btn-set" onclick="toggleSet('\${s.name}')">Set</button>
315
- <button class="btn \${s.enabled === false ? "btn-enable" : "btn-disable"}" id="togbtn-\${s.name}" onclick="toggleService('\${s.name}')">\${s.enabled === false ? "Enable" : "Disable"}</button>
316
- </div>
317
- <div class="set-panel" id="set-panel-\${s.name}">
318
- <label>New value for <strong>\${s.name}</strong> — paste here, never in chat</label>
319
- <textarea class="set-input" id="set-input-\${s.name}" placeholder="\${SERVICE_HINTS[s.name] || "Paste credential…"}" spellcheck="false"></textarea>
320
- \${SERVICE_HINTS[s.name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${SERVICE_HINTS[s.name]}</div>\` : ""}
321
- <div class="set-foot">
322
- <button class="btn btn-save" onclick="saveKey('\${s.name}')">Save</button>
323
- <button class="btn btn-cancel" onclick="toggleSet('\${s.name}')">Cancel</button>
324
- <span class="set-msg" id="set-msg-\${s.name}"></span>
325
- </div>
326
- </div>
327
- </div>
328
- \`).join("");
329
- } catch (e) {
330
- err.textContent = "⚠ " + e.message;
331
- err.style.display = "block";
332
- document.getElementById("dot").style.background = "#ef4444";
333
- grid.innerHTML = "";
334
- }
335
- }
336
-
337
- // ── Reveal ──────────────────────────────────
338
- async function reveal(name, btn) {
339
- const valEl = document.getElementById("val-" + name);
340
- const copyBtn = document.getElementById("copybtn-" + name);
341
- if (valEl.style.display === "block") {
342
- valEl.style.display = "none"; copyBtn.style.display = "none";
343
- btn.textContent = "Reveal"; return;
344
- }
345
- valEl.textContent = "fetching…"; valEl.style.display = "block"; btn.textContent = "Hide";
346
- try {
347
- const r = await fetch(BASE + "/get/" + name).then(r => r.json());
348
- if (r.locked) { showLockScreen(); return; }
349
- if (r.error) throw new Error(r.error);
350
- valEl.textContent = r.value; copyBtn.style.display = "inline-block";
351
- } catch (e) {
352
- valEl.textContent = "Error: " + e.message; valEl.style.color = "#ef4444";
353
- }
354
- }
355
-
356
- async function copyKey(name) {
357
- const val = document.getElementById("val-" + name).textContent;
358
- try {
359
- await navigator.clipboard.writeText(val);
360
- const btn = document.getElementById("copybtn-" + name);
361
- btn.textContent = "Copied!"; setTimeout(() => btn.textContent = "Copy", 1500);
362
- } catch {}
363
- }
364
-
365
- // ── Set key ─────────────────────────────────
366
- function toggleSet(name) {
367
- const panel = document.getElementById("set-panel-" + name);
368
- const input = document.getElementById("set-input-" + name);
369
- const msg = document.getElementById("set-msg-" + name);
370
- const open = panel.style.display === "block";
371
- panel.style.display = open ? "none" : "block";
372
- if (!open) { input.value = ""; msg.textContent = ""; input.focus(); }
373
- }
374
-
375
- async function saveKey(name) {
376
- const input = document.getElementById("set-input-" + name);
377
- const msg = document.getElementById("set-msg-" + name);
378
- const value = input.value.trim();
379
- if (!value) { msg.className = "set-msg fail"; msg.textContent = "Value is empty."; return; }
380
-
381
- msg.className = "set-msg"; msg.textContent = "Saving…";
382
- try {
383
- const r = await fetch(BASE + "/set/" + name, {
384
- method: "POST",
385
- headers: { "Content-Type": "application/json" },
386
- body: JSON.stringify({ value })
387
- }).then(r => r.json());
388
-
389
- if (r.locked) { showLockScreen(); return; }
390
- if (r.error) throw new Error(r.error);
391
- msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
392
- input.value = "";
393
- const dot = document.getElementById("sdot-" + name);
394
- if (dot) { dot.className = "status-dot"; dot.title = ""; }
395
- setTimeout(() => {
396
- document.getElementById("set-panel-" + name).style.display = "none";
397
- msg.textContent = "";
398
- }, 1800);
399
- } catch (e) {
400
- msg.className = "set-msg fail"; msg.textContent = "✗ " + e.message;
401
- }
402
- }
403
-
404
- // ── Enable / Disable service ────────────────
405
- async function toggleService(name) {
406
- const badge = document.getElementById("badge-" + name);
407
- const btn = document.getElementById("togbtn-" + name);
408
- const currently = badge.classList.contains("on");
409
- const newState = !currently;
410
-
411
- btn.disabled = true; btn.textContent = "…";
412
-
413
- try {
414
- const r = await fetch(BASE + "/toggle/" + name, {
415
- method: "POST",
416
- headers: { "Content-Type": "application/json" },
417
- body: JSON.stringify({ enabled: newState })
418
- }).then(r => r.json());
419
-
420
- if (r.locked) { showLockScreen(); return; }
421
- if (r.error) throw new Error(r.error);
422
-
423
- badge.className = "svc-badge " + (newState ? "on" : "off");
424
- badge.textContent = newState ? "enabled" : "disabled";
425
- btn.className = "btn " + (newState ? "btn-disable" : "btn-enable");
426
- btn.textContent = newState ? "Disable" : "Enable";
427
- } catch (e) {
428
- btn.textContent = "Error";
429
- setTimeout(() => {
430
- btn.textContent = currently ? "Disable" : "Enable";
431
- }, 2000);
432
- } finally {
433
- btn.disabled = false;
434
- }
435
- }
436
-
437
- // ── Check all credentials ───────────────────
438
- async function checkAll() {
439
- const btn = document.getElementById("check-btn");
440
- btn.disabled = true; btn.textContent = "Checking…";
441
-
442
- // Show checking state on every visible dot
443
- document.querySelectorAll(".status-dot").forEach(d => {
444
- d.className = "status-dot checking"; d.title = "Checking…";
445
- });
446
-
447
- try {
448
- const r = await fetch(BASE + "/check-all").then(r => r.json());
449
- if (r.locked) { showLockScreen(); return; }
450
- if (r.error) throw new Error(r.error);
451
-
452
- const results = r.results || {};
453
- for (const [name, result] of Object.entries(results)) {
454
- const dot = document.getElementById("sdot-" + name);
455
- if (!dot) continue;
456
- if (result.ok) {
457
- dot.className = "status-dot ok"; dot.title = "OK";
458
- } else {
459
- dot.className = "status-dot fail";
460
- dot.title = result.reason || "No key stored";
461
- }
462
- }
463
-
464
- // Fade green dots after 3 s — red dots stay until next check
465
- setTimeout(() => {
466
- document.querySelectorAll(".status-dot.ok").forEach(d => d.classList.add("fading"));
467
- }, 3000);
468
-
469
- } catch (e) {
470
- document.querySelectorAll(".status-dot").forEach(d => { d.className = "status-dot"; d.title = ""; });
471
- const errBar = document.getElementById("error-bar");
472
- errBar.textContent = "⚠ Check failed: " + e.message;
473
- errBar.style.display = "block";
474
- } finally {
475
- btn.disabled = false; btn.textContent = "⬤ Check All";
476
- }
477
- }
478
-
479
- // ── Change password ─────────────────────────
480
- function toggleChangePw() {
481
- const panel = document.getElementById("chpw-panel");
482
- const open = panel.style.display === "block";
483
- panel.style.display = open ? "none" : "block";
484
- if (!open) {
485
- document.getElementById("chpw-new").value = "";
486
- document.getElementById("chpw-confirm").value = "";
487
- document.getElementById("chpw-msg").textContent = "";
488
- document.getElementById("chpw-new").focus();
489
- }
490
- }
491
-
492
- async function changePassword() {
493
- const newPw = document.getElementById("chpw-new").value;
494
- const confPw = document.getElementById("chpw-confirm").value;
495
- const msg = document.getElementById("chpw-msg");
496
-
497
- if (!newPw) { msg.className = "chpw-msg fail"; msg.textContent = "Enter a new password."; return; }
498
- if (newPw.length < 8) { msg.className = "chpw-msg fail"; msg.textContent = "Minimum 8 characters."; return; }
499
- if (newPw !== confPw) { msg.className = "chpw-msg fail"; msg.textContent = "Passwords don't match."; return; }
500
-
501
- msg.className = "chpw-msg"; msg.textContent = "Updating…";
502
- try {
503
- const r = await fetch(BASE + "/change-pw", {
504
- method: "POST",
505
- headers: { "Content-Type": "application/json" },
506
- body: JSON.stringify({ newPassword: newPw })
507
- }).then(r => r.json());
508
-
509
- if (r.locked) { showLockScreen(); return; }
510
- if (r.error) throw new Error(r.error);
511
-
512
- msg.className = "chpw-msg ok"; msg.textContent = "✓ Password updated";
513
- document.getElementById("chpw-new").value = "";
514
- document.getElementById("chpw-confirm").value = "";
515
- setTimeout(() => {
516
- document.getElementById("chpw-panel").style.display = "none";
517
- msg.textContent = "";
518
- }, 2000);
519
- } catch (e) {
520
- msg.className = "chpw-msg fail"; msg.textContent = "✗ " + e.message;
521
- }
522
- }
523
-
524
- // Enter key on lock screen
525
- document.addEventListener("DOMContentLoaded", () => {
526
- document.getElementById("lock-input").addEventListener("keydown", e => {
527
- if (e.key === "Enter") unlock();
528
- });
529
- });
530
-
531
- boot();
532
- </script>
533
- </body>
534
- </html>`;
535
- }
536
-
537
- // ── Body parser helper ────────────────────────────────────────
538
- function readBody(req) {
539
- return new Promise((resolve, reject) => {
540
- let data = "";
541
- req.on("data", chunk => { data += chunk; if (data.length > 65536) reject(new Error("Body too large")); });
542
- req.on("end", () => { try { resolve(JSON.parse(data)); } catch { reject(new Error("Invalid JSON")); } });
543
- req.on("error", reject);
544
- });
545
- }
546
-
547
- // ── Server logic (shared by foreground + daemon) ─────────────
548
- function createServer(initPassword, whitelist, port) {
549
- const MAX_FAILS = 3;
550
- let failCount = 0;
551
- let password = initPassword || null; // null = locked; set via POST /auth
552
- const machineHash = getMachineHash();
553
-
554
- const CORS = {
555
- "Access-Control-Allow-Origin": "*",
556
- "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
557
- "Access-Control-Allow-Headers": "Content-Type",
558
- };
559
-
560
- function strike(res, code, message) {
561
- failCount++;
562
- const remaining = MAX_FAILS - failCount;
563
- const logLine = `[${new Date().toISOString()}] [FAIL ${failCount}/${MAX_FAILS}] ${message}\n`;
564
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
565
-
566
- const body = JSON.stringify({
567
- error: message,
568
- failures: failCount,
569
- failures_remaining: remaining,
570
- ...(failCount >= MAX_FAILS ? { shutdown: true } : {})
571
- });
572
-
573
- res.writeHead(code, { "Content-Type": "application/json", ...CORS });
574
- res.end(body);
575
-
576
- if (failCount >= MAX_FAILS) {
577
- const msg = `[${new Date().toISOString()}] Failure limit reached — shutting down\n`;
578
- try { fs.appendFileSync(LOG_FILE, msg); } catch {}
579
- removePid();
580
- setTimeout(() => process.exit(1), 100);
581
- }
582
- }
583
-
584
- function ok(res, data) {
585
- res.writeHead(200, { "Content-Type": "application/json", ...CORS });
586
- res.end(JSON.stringify(data));
587
- }
588
-
589
- const server = http.createServer(async (req, res) => {
590
- // Hard reject anything not from loopback
591
- const remote = req.socket.remoteAddress;
592
- const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
593
- if (!isLocal) {
594
- return strike(res, 403, `Rejected non-local address: ${remote}`);
595
- }
596
-
597
- // CORS preflight
598
- if (req.method === "OPTIONS") {
599
- res.writeHead(204, CORS);
600
- return res.end();
601
- }
602
-
603
- const url = new URL(req.url, `http://127.0.0.1:${port}`);
604
- const reqPath = url.pathname;
605
- const method = req.method;
606
-
607
- // GET / — built-in web dashboard
608
- if (method === "GET" && reqPath === "/") {
609
- res.writeHead(200, { "Content-Type": "text/html", ...CORS });
610
- return res.end(dashboardHtml(port, whitelist));
611
- }
612
-
613
- // GET /ping
614
- if (method === "GET" && reqPath === "/ping") {
615
- return ok(res, {
616
- status: "ok",
617
- pid: process.pid,
618
- locked: !password,
619
- failures: failCount,
620
- failures_remaining: MAX_FAILS - failCount,
621
- services: whitelist || "all",
622
- port
623
- });
624
- }
625
-
626
- // GET /shutdown (for daemon stop)
627
- if (method === "GET" && reqPath === "/shutdown") {
628
- ok(res, { ok: true, message: "shutting down" });
629
- removePid();
630
- setTimeout(() => process.exit(0), 100);
631
- return;
632
- }
633
-
634
- // Locked guard — returns true if locked and already responded
635
- function lockedGuard(res) {
636
- if (!password) {
637
- res.writeHead(401, { "Content-Type": "application/json", ...CORS });
638
- res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
639
- return true;
640
- }
641
- return false;
642
- }
643
-
644
- // GET /status
645
- if (method === "GET" && reqPath === "/status") {
646
- if (lockedGuard(res)) return;
647
- try {
648
- const { token, timestamp } = deriveToken(password, machineHash);
649
- const result = await api.status(password, machineHash, token, timestamp);
650
- if (result.error) return strike(res, 502, result.error);
651
- if (whitelist) {
652
- result.services = (result.services || []).filter(
653
- s => whitelist.includes(s.name.toLowerCase())
654
- );
655
- }
656
- return ok(res, result);
657
- } catch (err) {
658
- return strike(res, 502, err.message);
659
- }
660
- }
661
-
662
- // GET /get/:service
663
- const getMatch = reqPath.match(/^\/get\/([a-zA-Z0-9_-]+)$/);
664
- if (method === "GET" && getMatch) {
665
- if (lockedGuard(res)) return;
666
- const service = getMatch[1].toLowerCase();
667
-
668
- if (whitelist && !whitelist.includes(service)) {
669
- return strike(res, 403, `Service '${service}' not in whitelist`);
670
- }
671
-
672
- try {
673
- const { token, timestamp } = deriveToken(password, machineHash);
674
- const result = await api.retrieve(password, machineHash, token, timestamp, service);
675
- if (result.error) return strike(res, 502, result.error);
676
- return ok(res, { service, value: result.value, key_type: result.key_type });
677
- } catch (err) {
678
- return strike(res, 502, err.message);
679
- }
680
- }
681
-
682
- // POST /auth — unlock the vault with a password (verifies against Edge Function)
683
- if (method === "POST" && reqPath === "/auth") {
684
- let body;
685
- try { body = await readBody(req); } catch {
686
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
687
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
688
- }
689
-
690
- const pw = body.password;
691
- if (!pw || typeof pw !== "string") {
692
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
693
- return res.end(JSON.stringify({ error: "password is required" }));
694
- }
695
-
696
- try {
697
- const { token, timestamp } = deriveToken(pw, machineHash);
698
- const result = await api.test(pw, machineHash, token, timestamp);
699
- if (result.error) throw new Error(result.error);
700
- password = pw; // unlock — store in process memory only
701
- const logLine = `[${new Date().toISOString()}] Vault unlocked\n`;
702
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
703
- return ok(res, { ok: true, locked: false });
704
- } catch {
705
- // Wrong password — not a lockout strike, just a UI auth attempt
706
- res.writeHead(401, { "Content-Type": "application/json", ...CORS });
707
- return res.end(JSON.stringify({ error: "Invalid password" }));
708
- }
709
- }
710
-
711
- // POST /lock — clear password from memory
712
- if (method === "POST" && reqPath === "/lock") {
713
- password = null;
714
- const logLine = `[${new Date().toISOString()}] Vault locked\n`;
715
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
716
- return ok(res, { ok: true, locked: true });
717
- }
718
-
719
- // POST /toggle/:service — enable or disable a service
720
- const toggleMatch = reqPath.match(/^\/toggle\/([a-zA-Z0-9_-]+)$/);
721
- if (method === "POST" && toggleMatch) {
722
- if (lockedGuard(res)) return;
723
- const service = toggleMatch[1].toLowerCase();
724
-
725
- let body;
726
- try { body = await readBody(req); } catch {
727
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
728
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
729
- }
730
-
731
- const { enabled } = body;
732
- if (typeof enabled !== "boolean") {
733
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
734
- return res.end(JSON.stringify({ error: "enabled must be boolean" }));
735
- }
736
-
737
- try {
738
- const { token, timestamp } = deriveToken(password, machineHash);
739
- const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
740
- if (result.error) return strike(res, 502, result.error);
741
- return ok(res, { ok: true, service, enabled });
742
- } catch (err) {
743
- return strike(res, 502, err.message);
744
- }
745
- }
746
-
747
- // GET /check-all — soft health check, no strikes for missing/disabled keys
748
- if (method === "GET" && reqPath === "/check-all") {
749
- if (lockedGuard(res)) return;
750
- try {
751
- const { token: st, timestamp: sts } = deriveToken(password, machineHash);
752
- const statusResult = await api.status(password, machineHash, st, sts);
753
- if (statusResult.error) return strike(res, 502, statusResult.error);
754
-
755
- const services = (statusResult.services || []).filter(
756
- s => !whitelist || whitelist.includes(s.name.toLowerCase())
757
- );
758
-
759
- const results = {};
760
- for (const svc of services) {
761
- try {
762
- const { token, timestamp } = deriveToken(password, machineHash);
763
- const r = await api.retrieve(password, machineHash, token, timestamp, svc.name);
764
- results[svc.name] = r.error
765
- ? { ok: false, reason: r.error }
766
- : { ok: true };
767
- } catch (e) {
768
- results[svc.name] = { ok: false, reason: e.message };
769
- }
770
- }
771
- return ok(res, { results });
772
- } catch (err) {
773
- return strike(res, 502, err.message);
774
- }
775
- }
776
-
777
- // POST /change-pw — change master password (must be unlocked)
778
- if (method === "POST" && reqPath === "/change-pw") {
779
- if (lockedGuard(res)) return;
780
-
781
- let body;
782
- try { body = await readBody(req); } catch {
783
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
784
- return res.end(JSON.stringify({ error: "Invalid JSON body" }));
785
- }
786
-
787
- const { newPassword } = body;
788
- if (!newPassword || typeof newPassword !== "string" || newPassword.length < 8) {
789
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
790
- return res.end(JSON.stringify({ error: "newPassword must be at least 8 characters" }));
791
- }
792
-
793
- try {
794
- const { token, timestamp } = deriveToken(password, machineHash);
795
- const newSeedHash = deriveSeedHash(machineHash, newPassword);
796
- const result = await api.changePassword(password, machineHash, token, timestamp, newSeedHash);
797
- if (result.error) throw new Error(result.error);
798
- password = newPassword; // update in-memory password to new one
799
- const logLine = `[${new Date().toISOString()}] Password changed\n`;
800
- try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
801
- return ok(res, { ok: true });
802
- } catch (err) {
803
- res.writeHead(502, { "Content-Type": "application/json", ...CORS });
804
- return res.end(JSON.stringify({ error: err.message }));
805
- }
806
- }
807
-
808
- // POST /set/:service — write a new key value into vault
809
- const setMatch = reqPath.match(/^\/set\/([a-zA-Z0-9_-]+)$/);
810
- if (method === "POST" && setMatch) {
811
- if (lockedGuard(res)) return;
812
- const service = setMatch[1].toLowerCase();
813
-
814
- if (whitelist && !whitelist.includes(service)) {
815
- return strike(res, 403, `Service '${service}' not in whitelist`);
816
- }
817
-
818
- let body;
819
- try { body = await readBody(req); } catch {
820
- return strike(res, 400, "Invalid JSON body");
821
- }
822
-
823
- const value = body.value;
824
- if (!value || typeof value !== "string" || !value.trim()) {
825
- res.writeHead(400, { "Content-Type": "application/json", ...CORS });
826
- return res.end(JSON.stringify({ error: "value is required" }));
827
- }
828
-
829
- try {
830
- const { token, timestamp } = deriveToken(password, machineHash);
831
- const result = await api.write(password, machineHash, token, timestamp, service, value.trim());
832
- if (result.error) return strike(res, 502, result.error);
833
- return ok(res, { ok: true, service });
834
- } catch (err) {
835
- return strike(res, 502, err.message);
836
- }
837
- }
838
-
839
- // Unknown route
840
- return strike(res, 404, `Unknown endpoint: ${reqPath}`);
841
- });
842
-
843
- return server;
844
- }
845
-
846
- // ── Actions ──────────────────────────────────────────────────
847
-
848
- async function verifyAuth(password) {
849
- const machineHash = getMachineHash();
850
- const { token, timestamp } = deriveToken(password, machineHash);
851
- const result = await api.test(password, machineHash, token, timestamp);
852
- if (result.error) throw new Error(result.error);
853
- }
854
-
855
- async function actionStart(opts) {
856
- const port = parseInt(opts.port || "52437", 10);
857
- const password = opts.pw;
858
- const whitelist = opts.services
859
- ? opts.services.split(",").map(s => s.trim().toLowerCase())
860
- : null;
861
-
862
- // Check for existing instance
863
- const existing = readPid();
864
- if (existing && isProcessAlive(existing.pid)) {
865
- console.log(chalk.yellow(`\n clauth serve already running (PID ${existing.pid}, port ${existing.port})`));
866
- console.log(chalk.gray(` Stop it first: clauth serve stop\n`));
867
- process.exit(1);
868
- }
869
-
870
- // If we're the daemon child, run the server directly
871
- if (process.env.__CLAUTH_DAEMON === "1") {
872
- // Verify password only if one was provided at start (optional — browser can unlock later)
873
- if (password) {
874
- try {
875
- await verifyAuth(password);
876
- } catch (err) {
877
- const msg = `[${new Date().toISOString()}] Auth failed: ${err.message}\n`;
878
- fs.appendFileSync(LOG_FILE, msg);
879
- process.exit(1);
880
- }
881
- }
882
-
883
- const server = createServer(password, whitelist, port);
884
- server.listen(port, "127.0.0.1", () => {
885
- writePid(process.pid, port);
886
- const msg = `[${new Date().toISOString()}] clauth serve started — PID ${process.pid}, port ${port}, services: ${whitelist ? whitelist.join(",") : "all"}\n`;
887
- fs.appendFileSync(LOG_FILE, msg);
888
- });
889
-
890
- server.on("error", err => {
891
- const msg = `[${new Date().toISOString()}] Server error: ${err.message}\n`;
892
- fs.appendFileSync(LOG_FILE, msg);
893
- process.exit(1);
894
- });
895
-
896
- const shutdown = () => { removePid(); process.exit(0); };
897
- process.on("SIGTERM", shutdown);
898
- process.on("SIGINT", shutdown);
899
- return;
900
- }
901
-
902
- // If --pw provided, verify it before spawning (fast-fail on wrong password)
903
- if (password) {
904
- console.log(chalk.gray("\n Verifying vault credentials..."));
905
- try {
906
- await verifyAuth(password);
907
- } catch (err) {
908
- console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
909
- process.exit(1);
910
- }
911
- console.log(chalk.green(" ✓ Vault auth verified"));
912
- } else {
913
- console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
914
- }
915
-
916
- // Spawn detached daemon child via the clauth CLI entry point
917
- const { spawn } = await import("child_process");
918
- const { fileURLToPath } = await import("url");
919
- const { dirname, join } = await import("path");
920
- const __filename = fileURLToPath(import.meta.url);
921
- const cliEntry = join(dirname(__filename), "..", "index.js");
922
-
923
- // Build args: node index.js serve start --port N [--pw PW] [--services S]
924
- const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
925
- if (password) childArgs.push("--pw", password);
926
- if (opts.services) childArgs.push("--services", opts.services);
927
-
928
- const out = fs.openSync(LOG_FILE, "a");
929
- const child = spawn(process.execPath, childArgs, {
930
- detached: true,
931
- stdio: ["ignore", out, out],
932
- env: { ...process.env, __CLAUTH_DAEMON: "1" },
933
- });
934
- child.unref();
935
-
936
- // Give it time to bind and write PID file (Windows spawn is slower)
937
- // Verify via HTTP ping (process.kill(pid,0) fails on Windows for detached processes)
938
- let started = false;
939
- for (let attempt = 0; attempt < 5; attempt++) {
940
- await new Promise(r => setTimeout(r, 1000));
941
- try {
942
- const resp = await fetch(`http://127.0.0.1:${port}/ping`);
943
- if (resp.ok) { started = true; break; }
944
- } catch {}
945
- }
946
-
947
- const info = readPid();
948
- if (started && info) {
949
- console.log(chalk.green(`\n 🔐 clauth serve started`));
950
- console.log(chalk.gray(` PID: ${info.pid}`));
951
- console.log(chalk.gray(` Port: 127.0.0.1:${info.port}`));
952
- console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
953
- console.log(chalk.gray(` Log: ${LOG_FILE}`));
954
- if (!password) {
955
- console.log(chalk.cyan(`\n 👉 Open http://127.0.0.1:${info.port} to unlock the vault`));
956
- }
957
- console.log(chalk.gray(` Stop: clauth serve stop\n`));
958
- } else {
959
- console.log(chalk.red(`\n ❌ Failed to start daemon — check ${LOG_FILE}\n`));
960
- process.exit(1);
961
- }
962
- }
963
-
964
- async function actionStop() {
965
- const info = readPid();
966
- if (!info) {
967
- console.log(chalk.yellow("\n No clauth serve PID file found — not running.\n"));
968
- return;
969
- }
970
-
971
- if (!isProcessAlive(info.pid)) {
972
- console.log(chalk.yellow(`\n PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
973
- removePid();
974
- return;
975
- }
976
-
977
- // Try HTTP shutdown first (clean)
978
- try {
979
- const resp = await fetch(`http://127.0.0.1:${info.port}/shutdown`);
980
- if (resp.ok) {
981
- await new Promise(r => setTimeout(r, 300));
982
- console.log(chalk.green(`\n 🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
983
- removePid();
984
- return;
985
- }
986
- } catch {}
987
-
988
- // Fallback: kill the process
989
- try {
990
- process.kill(info.pid, "SIGTERM");
991
- await new Promise(r => setTimeout(r, 300));
992
- console.log(chalk.green(`\n 🛑 clauth serve stopped via SIGTERM (PID ${info.pid})\n`));
993
- } catch (err) {
994
- console.log(chalk.yellow(`\n Could not kill PID ${info.pid}: ${err.message}\n`));
995
- }
996
- removePid();
997
- }
998
-
999
- async function actionPing() {
1000
- const info = readPid();
1001
- if (!info) {
1002
- console.log(chalk.red("\n clauth serve is not running (no PID file)\n"));
1003
- process.exit(1);
1004
- }
1005
-
1006
- if (!isProcessAlive(info.pid)) {
1007
- console.log(chalk.red(`\n PID ${info.pid} is not alive (stale PID file)\n`));
1008
- removePid();
1009
- process.exit(1);
1010
- }
1011
-
1012
- try {
1013
- const resp = await fetch(`http://127.0.0.1:${info.port}/ping`);
1014
- const data = await resp.json();
1015
- if (data.status === "ok") {
1016
- console.log(chalk.green(`\n ✅ clauth serve running`));
1017
- console.log(chalk.gray(` PID: ${info.pid}`));
1018
- console.log(chalk.gray(` Port: ${info.port}`));
1019
- console.log(chalk.gray(` Fails: ${data.failures}/${data.failures + data.failures_remaining}`));
1020
- console.log(chalk.gray(` Services: ${Array.isArray(data.services) ? data.services.join(", ") : data.services}\n`));
1021
- } else {
1022
- console.log(chalk.yellow(`\n PID alive but /ping returned unexpected response\n`));
1023
- }
1024
- } catch (err) {
1025
- console.log(chalk.yellow(`\n PID ${info.pid} alive but HTTP failed: ${err.message}\n`));
1026
- }
1027
- }
1028
-
1029
- async function actionRestart(opts) {
1030
- const info = readPid();
1031
- if (info && isProcessAlive(info.pid)) {
1032
- await actionStop();
1033
- await new Promise(r => setTimeout(r, 500));
1034
- }
1035
- await actionStart(opts);
1036
- }
1037
-
1038
- async function actionForeground(opts) {
1039
- const port = parseInt(opts.port || "52437", 10);
1040
- const password = opts.pw || null;
1041
- const whitelist = opts.services
1042
- ? opts.services.split(",").map(s => s.trim().toLowerCase())
1043
- : null;
1044
-
1045
- if (password) {
1046
- console.log(chalk.gray("\n Verifying vault credentials..."));
1047
- try {
1048
- await verifyAuth(password);
1049
- } catch (err) {
1050
- console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1051
- process.exit(1);
1052
- }
1053
- console.log(chalk.green(" ✓ Vault auth verified"));
1054
- } else {
1055
- console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1056
- }
1057
-
1058
- console.log(chalk.gray(` Port: 127.0.0.1:${port}`));
1059
- console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1060
- console.log(chalk.gray(` Lockout: 3 failures → exit\n`));
1061
-
1062
- const server = createServer(password, whitelist, port);
1063
- server.listen(port, "127.0.0.1", () => {
1064
- writePid(process.pid, port);
1065
- console.log(chalk.green(` clauth serve → http://127.0.0.1:${port}`));
1066
- if (!password) console.log(chalk.cyan(` 👉 Open http://127.0.0.1:${port} to unlock`));
1067
- console.log(chalk.gray(" Ctrl+C to stop\n"));
1068
- });
1069
-
1070
- server.on("error", err => {
1071
- if (err.code === "EADDRINUSE") {
1072
- console.log(chalk.red(`\n Port ${port} already in use. Use --port to choose another.\n`));
1073
- } else {
1074
- console.log(chalk.red(`\n Server error: ${err.message}\n`));
1075
- }
1076
- process.exit(1);
1077
- });
1078
-
1079
- process.on("SIGINT", () => {
1080
- console.log(chalk.yellow("\n Stopping clauth serve...\n"));
1081
- removePid();
1082
- server.close(() => process.exit(0));
1083
- });
1084
- }
1085
-
1086
- // ── Export ────────────────────────────────────────────────────
1087
- export async function runServe(opts) {
1088
- const action = opts.action || "foreground";
1089
-
1090
- switch (action) {
1091
- case "start": return actionStart(opts);
1092
- case "stop": return actionStop();
1093
- case "restart": return actionRestart(opts);
1094
- case "ping": return actionPing();
1095
- case "foreground": return actionForeground(opts);
1096
- default:
1097
- console.log(chalk.red(`\n Unknown serve action: ${action}`));
1098
- console.log(chalk.gray(" Actions: start | stop | restart | ping | foreground\n"));
1099
- process.exit(1);
1100
- }
1101
- }
1
+ // cli/commands/serve.js
2
+ // Localhost-only credential daemon with daemon lifecycle management
3
+ // Binds 127.0.0.1 ONLY — unreachable from outside the machine
4
+ // 3 failed requests of any kind → process exits, requires manual restart
5
+ // Supports: start (background daemon), stop, restart, ping, foreground
6
+
7
+ import http from "http";
8
+ import fs from "fs";
9
+ import os from "os";
10
+ import path from "path";
11
+ import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
12
+ import * as api from "../api.js";
13
+ import chalk from "chalk";
14
+
15
+ const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
16
+ const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
17
+
18
+ // ── PID helpers ──────────────────────────────────────────────
19
+ function readPid() {
20
+ try {
21
+ const raw = fs.readFileSync(PID_FILE, "utf8").trim();
22
+ const [pid, port] = raw.split(":");
23
+ return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
24
+ } catch { return null; }
25
+ }
26
+
27
+ function writePid(pid, port) {
28
+ fs.writeFileSync(PID_FILE, `${pid}:${port}`, "utf8");
29
+ }
30
+
31
+ function removePid() {
32
+ try { fs.unlinkSync(PID_FILE); } catch {}
33
+ }
34
+
35
+ function isProcessAlive(pid) {
36
+ try { process.kill(pid, 0); return true; } catch { return false; }
37
+ }
38
+
39
+ // ── Dashboard HTML ───────────────────────────────────────────
40
+ function dashboardHtml(port, whitelist) {
41
+ return `<!DOCTYPE html>
42
+ <html lang="en">
43
+ <head>
44
+ <meta charset="utf-8">
45
+ <meta name="viewport" content="width=device-width,initial-scale=1">
46
+ <title>clauth vault</title>
47
+ <style>
48
+ *{margin:0;padding:0;box-sizing:border-box}
49
+ body{background:#0a0f1a;color:#e2e8f0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;min-height:100vh}
50
+ /* ── Lock screen ── */
51
+ #lock-screen{display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;padding:2rem}
52
+ .lock-card{background:#1e293b;border:1px solid #334155;border-radius:12px;padding:2.5rem 2rem;width:100%;max-width:380px;text-align:center}
53
+ .lock-icon{font-size:2.5rem;margin-bottom:1rem}
54
+ .lock-title{font-size:1.25rem;font-weight:600;color:#f8fafc;margin-bottom:.4rem}
55
+ .lock-sub{font-size:.85rem;color:#64748b;margin-bottom:1.75rem}
56
+ .lock-input{width:100%;background:#0f172a;border:1px solid #334155;border-radius:8px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:1rem;padding:10px 14px;outline:none;text-align:center;letter-spacing:.1em;transition:border-color .2s;margin-bottom:1rem}
57
+ .lock-input:focus{border-color:#3b82f6}
58
+ .lock-input.error{border-color:#ef4444;animation:shake .3s}
59
+ @keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-6px)}75%{transform:translateX(6px)}}
60
+ .btn-unlock{width:100%;background:#3b82f6;color:#fff;border:none;border-radius:8px;padding:10px;font-size:.95rem;font-weight:600;cursor:pointer;transition:background .15s}
61
+ .btn-unlock:hover{background:#2563eb}
62
+ .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
63
+ .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
64
+ /* ── Main view ── */
65
+ #main-view{display:none;padding:2rem}
66
+ .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
67
+ .header h1{font-size:1.4rem;font-weight:600;flex:1}
68
+ .dot{width:10px;height:10px;border-radius:50%;background:#22c55e;animation:pulse 2s infinite;flex-shrink:0}
69
+ @keyframes pulse{0%,100%{opacity:1}50%{opacity:.4}}
70
+ .status-bar{display:flex;gap:1.5rem;margin-bottom:1.5rem;font-size:.82rem;color:#94a3b8;flex-wrap:wrap}
71
+ .status-bar span{color:#e2e8f0;font-weight:500}
72
+ .toolbar{display:flex;gap:8px;margin-bottom:1rem;flex-wrap:wrap;align-items:center}
73
+ .chpw-panel{display:none;background:#1a1f2e;border:1px solid #334155;border-radius:8px;padding:1.25rem;margin-bottom:1.5rem}
74
+ .chpw-panel h3{font-size:.9rem;font-weight:600;color:#f8fafc;margin-bottom:1rem}
75
+ .chpw-row{display:flex;gap:10px;flex-wrap:wrap;align-items:flex-end;margin-bottom:.75rem}
76
+ .chpw-field{display:flex;flex-direction:column;gap:4px}
77
+ .chpw-field label{font-size:.75rem;color:#64748b}
78
+ .chpw-input{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s}
79
+ .chpw-input:focus{border-color:#3b82f6}
80
+ .chpw-foot{display:flex;gap:8px;align-items:center}
81
+ .btn-chpw-save{background:#1e3a5f;color:#60a5fa;padding:7px 18px;font-size:.85rem;border-radius:6px;border:none;cursor:pointer;font-weight:500;transition:background .15s}
82
+ .btn-chpw-save:hover{background:#1e4a7f}
83
+ .chpw-msg{font-size:.82rem}
84
+ .chpw-msg.ok{color:#4ade80} .chpw-msg.fail{color:#f87171}
85
+ .btn-refresh{background:#3b82f6;color:#fff;padding:7px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:500}
86
+ .btn-refresh:hover{background:#2563eb}
87
+ .btn-lock{background:#1e293b;color:#f87171;border:1px solid #334155;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500}
88
+ .btn-lock:hover{background:#2d1f1f;border-color:#f87171}
89
+ .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:1rem}
90
+ .card{background:#1e293b;border:1px solid #334155;border-radius:8px;padding:1.25rem;transition:border-color .2s}
91
+ .card:hover{border-color:#3b82f6}
92
+ .card-name{font-size:1rem;font-weight:600;color:#f8fafc;margin-bottom:3px}
93
+ .card-type{font-size:.78rem;color:#64748b;text-transform:uppercase;letter-spacing:.5px}
94
+ .card-getkey{font-size:.75rem;color:#3b82f6;text-decoration:none;opacity:.7;transition:opacity .15s}
95
+ .card-getkey:hover{opacity:1;text-decoration:underline}
96
+ .card-value{font-family:'Courier New',monospace;font-size:.82rem;color:#22c55e;background:#0f172a;border-radius:4px;padding:8px 10px;margin-top:10px;word-break:break-all;max-height:80px;overflow:auto;display:none}
97
+ .card-actions{margin-top:10px;display:flex;gap:7px;flex-wrap:wrap}
98
+ .set-panel{display:none;margin-top:10px;background:#0f172a;border-radius:6px;padding:10px;border:1px solid #1e3a5f}
99
+ .set-panel label{font-size:.75rem;color:#64748b;display:block;margin-bottom:6px}
100
+ .set-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;resize:vertical;min-height:58px;transition:border-color .2s}
101
+ .set-input:focus{border-color:#3b82f6}
102
+ .set-foot{margin-top:8px;display:flex;gap:8px;align-items:center}
103
+ .set-msg{font-size:.8rem}
104
+ .set-msg.ok{color:#4ade80} .set-msg.fail{color:#f87171}
105
+ .btn{padding:6px 13px;border-radius:6px;border:none;cursor:pointer;font-size:.8rem;font-weight:500;transition:all .15s}
106
+ .btn-reveal{background:#1e3a5f;color:#60a5fa}.btn-reveal:hover{background:#1e4a7f}
107
+ .btn-copy{background:#1a3328;color:#4ade80}.btn-copy:hover{background:#1a4338}
108
+ .btn-set{background:#2d1f4a;color:#a78bfa}.btn-set:hover{background:#3d2f5a}
109
+ .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
110
+ .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
111
+ .btn-check{background:#0f2d2d;color:#34d399;border:1px solid #064e3b;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
112
+ .btn-check:hover{background:#134e4a;border-color:#34d399}.btn-check:disabled{opacity:.5;cursor:not-allowed}
113
+ .btn-enable{background:#14291a;color:#4ade80;border:1px solid #166534}.btn-enable:hover{background:#1a3d22;border-color:#4ade80}
114
+ .btn-disable{background:#2d1f1f;color:#f87171;border:1px solid #7f1d1d}.btn-disable:hover{background:#3d2525;border-color:#f87171}
115
+ .svc-badge{font-size:.7rem;font-weight:600;padding:2px 7px;border-radius:4px;letter-spacing:.4px;text-transform:uppercase}
116
+ .svc-badge.on{background:rgba(74,222,128,.12);color:#4ade80;border:1px solid rgba(74,222,128,.25)}
117
+ .svc-badge.off{background:rgba(248,113,113,.1);color:#f87171;border:1px solid rgba(248,113,113,.2)}
118
+ .status-dot{width:8px;height:8px;border-radius:50%;flex-shrink:0;opacity:0;transition:opacity .3s;margin-top:4px;cursor:default}
119
+ .status-dot.checking{background:#f59e0b;opacity:1;animation:pulse 1s infinite}
120
+ .status-dot.ok{background:#22c55e;opacity:1}
121
+ .status-dot.fail{background:#ef4444;opacity:1}
122
+ @keyframes sdot-fade{to{opacity:0}} .status-dot.fading{animation:sdot-fade 1.5s forwards}
123
+ .error-bar{background:#7f1d1d;color:#fca5a5;border:1px solid #991b1b;padding:10px 14px;border-radius:8px;margin-bottom:1rem;display:none;font-size:.85rem}
124
+ .loading{color:#64748b;font-style:italic}
125
+ .footer{margin-top:2rem;font-size:.75rem;color:#475569;text-align:center}
126
+ .oauth-fields{display:flex;flex-direction:column;gap:8px;margin-bottom:8px}
127
+ .oauth-field{display:flex;flex-direction:column;gap:3px}
128
+ .oauth-label{font-size:.75rem;color:#94a3b8;font-weight:500}
129
+ .oauth-hint{font-size:.71rem;color:#475569;font-style:italic}
130
+ .oauth-input{width:100%;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:7px 10px;outline:none;transition:border-color .2s}
131
+ .oauth-input:focus{border-color:#3b82f6}
132
+ </style>
133
+ </head>
134
+ <body>
135
+
136
+ <!-- ── Lock screen ──────────────────────────── -->
137
+ <div id="lock-screen">
138
+ <div class="lock-card">
139
+ <div class="lock-icon">🔒</div>
140
+ <div class="lock-title">clauth vault</div>
141
+ <div class="lock-sub">Paste your password to unlock</div>
142
+ <input class="lock-input" id="lock-input" type="password" placeholder="••••••••••••" autocomplete="off">
143
+ <button class="btn-unlock" id="unlock-btn" onclick="unlock()">Unlock</button>
144
+ <div class="lock-err" id="lock-err"></div>
145
+ </div>
146
+ </div>
147
+
148
+ <!-- ── Main view (shown after unlock) ──────── -->
149
+ <div id="main-view">
150
+ <div class="header">
151
+ <div class="dot" id="dot"></div>
152
+ <h1>🔐 clauth vault</h1>
153
+ </div>
154
+ <div id="error-bar" class="error-bar"></div>
155
+ <div class="status-bar">
156
+ <div>PID: <span id="s-pid">—</span></div>
157
+ <div>Port: <span id="s-port">${port}</span></div>
158
+ <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
159
+ <div>Failures: <span id="s-fails">—</span></div>
160
+ </div>
161
+ <div class="toolbar">
162
+ <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
163
+ <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
164
+ <button class="btn-lock" onclick="lockVault()">🔒 Lock</button>
165
+ <button class="btn-cancel" style="margin-left:auto" onclick="toggleChangePw()">Change Password</button>
166
+ </div>
167
+
168
+ <div class="chpw-panel" id="chpw-panel">
169
+ <h3>Change Master Password</h3>
170
+ <div class="chpw-row">
171
+ <div class="chpw-field">
172
+ <label>New password</label>
173
+ <input class="chpw-input" id="chpw-new" type="password" placeholder="min 8 chars" autocomplete="new-password">
174
+ </div>
175
+ <div class="chpw-field">
176
+ <label>Confirm</label>
177
+ <input class="chpw-input" id="chpw-confirm" type="password" placeholder="repeat" autocomplete="new-password">
178
+ </div>
179
+ </div>
180
+ <div class="chpw-foot">
181
+ <button class="btn-chpw-save" onclick="changePassword()">Update Password</button>
182
+ <button class="btn-cancel" onclick="toggleChangePw()">Cancel</button>
183
+ <span class="chpw-msg" id="chpw-msg"></span>
184
+ </div>
185
+ </div>
186
+
187
+ <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
188
+ <div class="footer">localhost:${port} · 127.0.0.1 only · 3-strike lockout</div>
189
+ </div>
190
+
191
+ <script>
192
+ const BASE = "http://127.0.0.1:${port}";
193
+
194
+ const SERVICE_HINTS = {
195
+ "neo4j": "neo4j+s://username:password@instance.databases.neo4j.io",
196
+ "supabase-db": "postgresql://postgres:password@db.ref.supabase.co:5432/postgres",
197
+ "r2": "accountId:accessKeyId:secretAccessKey",
198
+ "namecheap": "apiUser:apiKey",
199
+ };
200
+
201
+ const KEY_URLS = {
202
+ "github": "https://github.com/settings/tokens",
203
+ "vercel": "https://vercel.com/account/tokens",
204
+ "supabase-anon": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
205
+ "supabase-service":"https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/api",
206
+ "supabase-db": "https://supabase.com/dashboard/project/uvojezuorjgqzmhhgluu/settings/database",
207
+ "anthropic": "https://console.anthropic.com/settings/keys",
208
+ "cloudflare": "https://dash.cloudflare.com/profile/api-tokens",
209
+ "r2": "https://dash.cloudflare.com/profile/api-tokens",
210
+ "r2-bucket": "https://dash.cloudflare.com/profile/api-tokens",
211
+ "rocketreach": "https://rocketreach.co/account?section=security",
212
+ "namecheap": "https://ap.www.namecheap.com/settings/tools/apiaccess/",
213
+ "neo4j": "https://console.neo4j.io/",
214
+ "npm": "https://www.npmjs.com/settings/~/tokens",
215
+ "gmail": "https://console.cloud.google.com/apis/credentials",
216
+ };
217
+
218
+ // ── OAuth import config ─────────────────────
219
+ // Services where Google downloads a JSON file. jsonFields = keys to extract
220
+ // from the downloaded JSON (top-level or under an "installed"/"web" wrapper).
221
+ // extra = additional fields the user must provide separately.
222
+ const OAUTH_IMPORT = {
223
+ "gmail": {
224
+ jsonFields: ["client_id", "client_secret"],
225
+ extra: [{ key: "refresh_token", label: "Refresh Token", hint: "From Google OAuth Playground or your app's auth callback" }]
226
+ }
227
+ };
228
+
229
+ function renderSetPanel(name) {
230
+ const imp = OAUTH_IMPORT[name];
231
+ if (imp) {
232
+ const extraHtml = imp.extra.map(f => \`
233
+ <div class="oauth-field">
234
+ <label class="oauth-label">\${f.label}</label>
235
+ \${f.hint ? \`<div class="oauth-hint">\${f.hint}</div>\` : ""}
236
+ <input type="text" class="oauth-input" id="ofield-\${name}-\${f.key}" placeholder="Paste \${f.label}…" spellcheck="false" autocomplete="off">
237
+ </div>
238
+ \`).join("");
239
+ return \`
240
+ <div class="set-panel" id="set-panel-\${name}">
241
+ <label>Set <strong>\${name}</strong> credentials — paste directly from Google, never in chat</label>
242
+ <div class="oauth-fields">
243
+ <div class="oauth-field">
244
+ <label class="oauth-label">OAuth JSON from Google Cloud Console</label>
245
+ <div class="oauth-hint">Download from APIs & Services → Credentials → your OAuth client → ↓ Download JSON</div>
246
+ <textarea class="set-input" id="ofield-\${name}-json" placeholder='{"installed":{"client_id":"…","client_secret":"…",...}}' spellcheck="false" rows="3"></textarea>
247
+ </div>
248
+ \${extraHtml}
249
+ </div>
250
+ <div class="set-foot">
251
+ <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
252
+ <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
253
+ <span class="set-msg" id="set-msg-\${name}"></span>
254
+ </div>
255
+ </div>
256
+ \`;
257
+ }
258
+ return \`
259
+ <div class="set-panel" id="set-panel-\${name}">
260
+ <label>New value for <strong>\${name}</strong> — paste here, never in chat</label>
261
+ <textarea class="set-input" id="set-input-\${name}" placeholder="\${SERVICE_HINTS[name] || "Paste credential…"}" spellcheck="false"></textarea>
262
+ \${SERVICE_HINTS[name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${SERVICE_HINTS[name]}</div>\` : ""}
263
+ <div class="set-foot">
264
+ <button class="btn btn-save" onclick="saveKey('\${name}')">Save</button>
265
+ <button class="btn btn-cancel" onclick="toggleSet('\${name}')">Cancel</button>
266
+ <span class="set-msg" id="set-msg-\${name}"></span>
267
+ </div>
268
+ </div>
269
+ \`;
270
+ }
271
+
272
+ // ── Boot: check lock state ──────────────────
273
+ async function boot() {
274
+ try {
275
+ const ping = await fetch(BASE + "/ping").then(r => r.json());
276
+ if (ping.locked) {
277
+ showLockScreen();
278
+ } else {
279
+ showMain(ping);
280
+ loadServices();
281
+ }
282
+ } catch {
283
+ showLockScreen();
284
+ }
285
+ }
286
+
287
+ function showLockScreen() {
288
+ document.getElementById("lock-screen").style.display = "flex";
289
+ document.getElementById("main-view").style.display = "none";
290
+ setTimeout(() => document.getElementById("lock-input").focus(), 50);
291
+ }
292
+
293
+ function showMain(ping) {
294
+ document.getElementById("lock-screen").style.display = "none";
295
+ document.getElementById("main-view").style.display = "block";
296
+ if (ping) {
297
+ document.getElementById("s-pid").textContent = ping.pid || "—";
298
+ document.getElementById("s-fails").textContent =
299
+ ping.failures + "/" + (ping.failures + ping.failures_remaining);
300
+ }
301
+ }
302
+
303
+ // ── Unlock ──────────────────────────────────
304
+ async function unlock() {
305
+ const input = document.getElementById("lock-input");
306
+ const btn = document.getElementById("unlock-btn");
307
+ const err = document.getElementById("lock-err");
308
+ const pw = input.value;
309
+
310
+ if (!pw) { err.textContent = "Password is required."; return; }
311
+
312
+ btn.disabled = true; btn.textContent = "Verifying…"; err.textContent = "";
313
+
314
+ try {
315
+ const r = await fetch(BASE + "/auth", {
316
+ method: "POST",
317
+ headers: { "Content-Type": "application/json" },
318
+ body: JSON.stringify({ password: pw })
319
+ }).then(r => r.json());
320
+
321
+ if (r.error) throw new Error(r.error);
322
+
323
+ input.value = "";
324
+ const ping = await fetch(BASE + "/ping").then(r => r.json());
325
+ showMain(ping);
326
+ loadServices();
327
+ } catch (e) {
328
+ input.value = "";
329
+ input.className = "lock-input error";
330
+ err.textContent = "✗ " + (e.message || "Invalid password");
331
+ setTimeout(() => input.className = "lock-input", 600);
332
+ } finally {
333
+ btn.disabled = false; btn.textContent = "Unlock";
334
+ }
335
+ }
336
+
337
+ // ── Lock ────────────────────────────────────
338
+ async function lockVault() {
339
+ await fetch(BASE + "/lock", { method: "POST" }).catch(() => {});
340
+ showLockScreen();
341
+ }
342
+
343
+ // ── Load services ───────────────────────────
344
+ async function loadServices() {
345
+ const grid = document.getElementById("grid");
346
+ const err = document.getElementById("error-bar");
347
+ err.style.display = "none";
348
+ grid.innerHTML = '<p class="loading">Loading…</p>';
349
+
350
+ try {
351
+ const status = await fetch(BASE + "/status").then(r => r.json());
352
+ if (status.locked) { showLockScreen(); return; }
353
+ if (status.error) throw new Error(status.error);
354
+
355
+ const services = status.services || [];
356
+ if (!services.length) { grid.innerHTML = '<p class="loading">No services registered.</p>'; return; }
357
+
358
+ grid.innerHTML = services.map(s => \`
359
+ <div class="card">
360
+ <div style="display:flex;align-items:flex-start;justify-content:space-between">
361
+ <div>
362
+ <div class="card-name">\${s.name}</div>
363
+ <div style="display:flex;align-items:center;gap:6px;margin-top:2px">
364
+ <div class="card-type">\${s.key_type || "secret"}</div>
365
+ <span class="svc-badge \${s.enabled === false ? "off" : "on"}" id="badge-\${s.name}">\${s.enabled === false ? "disabled" : "enabled"}</span>
366
+ </div>
367
+ \${KEY_URLS[s.name] ? \`<a class="card-getkey" href="\${KEY_URLS[s.name]}" target="_blank" rel="noopener">↗ Get / rotate key</a>\` : ""}
368
+ </div>
369
+ <div class="status-dot" id="sdot-\${s.name}" title=""></div>
370
+ </div>
371
+ <div class="card-value" id="val-\${s.name}"></div>
372
+ <div class="card-actions">
373
+ <button class="btn btn-reveal" onclick="reveal('\${s.name}', this)">Reveal</button>
374
+ <button class="btn btn-copy" id="copybtn-\${s.name}" style="display:none" onclick="copyKey('\${s.name}')">Copy</button>
375
+ <button class="btn btn-set" onclick="toggleSet('\${s.name}')">Set</button>
376
+ <button class="btn \${s.enabled === false ? "btn-enable" : "btn-disable"}" id="togbtn-\${s.name}" onclick="toggleService('\${s.name}')">\${s.enabled === false ? "Enable" : "Disable"}</button>
377
+ </div>
378
+ \${renderSetPanel(s.name)}
379
+ </div>
380
+ \`).join("");
381
+ } catch (e) {
382
+ err.textContent = "⚠ " + e.message;
383
+ err.style.display = "block";
384
+ document.getElementById("dot").style.background = "#ef4444";
385
+ grid.innerHTML = "";
386
+ }
387
+ }
388
+
389
+ // ── Reveal ──────────────────────────────────
390
+ async function reveal(name, btn) {
391
+ const valEl = document.getElementById("val-" + name);
392
+ const copyBtn = document.getElementById("copybtn-" + name);
393
+ if (valEl.style.display === "block") {
394
+ valEl.style.display = "none"; copyBtn.style.display = "none";
395
+ btn.textContent = "Reveal"; return;
396
+ }
397
+ valEl.textContent = "fetching…"; valEl.style.display = "block"; btn.textContent = "Hide";
398
+ try {
399
+ const r = await fetch(BASE + "/get/" + name).then(r => r.json());
400
+ if (r.locked) { showLockScreen(); return; }
401
+ if (r.error) throw new Error(r.error);
402
+ const imp = OAUTH_IMPORT[name];
403
+ if (imp) {
404
+ try {
405
+ const parsed = JSON.parse(r.value);
406
+ const allKeys = [...imp.jsonFields, ...imp.extra.map(f => f.key)];
407
+ valEl.innerHTML = allKeys.map(k =>
408
+ '<div style="margin-bottom:6px"><span style="color:#64748b;font-size:.72rem;text-transform:uppercase;letter-spacing:.4px">' + k.replace(/_/g," ") + '</span><br>' + (parsed[k] || "—") + '</div>'
409
+ ).join("");
410
+ } catch { valEl.textContent = r.value; }
411
+ } else {
412
+ valEl.textContent = r.value;
413
+ }
414
+ copyBtn.style.display = "inline-block";
415
+ } catch (e) {
416
+ valEl.textContent = "Error: " + e.message; valEl.style.color = "#ef4444";
417
+ }
418
+ }
419
+
420
+ async function copyKey(name) {
421
+ const val = document.getElementById("val-" + name).textContent;
422
+ try {
423
+ await navigator.clipboard.writeText(val);
424
+ const btn = document.getElementById("copybtn-" + name);
425
+ btn.textContent = "Copied!"; setTimeout(() => btn.textContent = "Copy", 1500);
426
+ } catch {}
427
+ }
428
+
429
+ // ── Set key ─────────────────────────────────
430
+ function toggleSet(name) {
431
+ const panel = document.getElementById("set-panel-" + name);
432
+ const msg = document.getElementById("set-msg-" + name);
433
+ const open = panel.style.display === "block";
434
+ panel.style.display = open ? "none" : "block";
435
+ if (!open) {
436
+ if (msg) msg.textContent = "";
437
+ const imp = OAUTH_IMPORT[name];
438
+ if (imp) {
439
+ const jsonEl = document.getElementById("ofield-" + name + "-json");
440
+ if (jsonEl) { jsonEl.value = ""; jsonEl.focus(); }
441
+ imp.extra.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
442
+ } else {
443
+ const input = document.getElementById("set-input-" + name);
444
+ if (input) { input.value = ""; input.focus(); }
445
+ }
446
+ }
447
+ }
448
+
449
+ async function saveKey(name) {
450
+ const msg = document.getElementById("set-msg-" + name);
451
+ const imp = OAUTH_IMPORT[name];
452
+ let value;
453
+
454
+ if (imp) {
455
+ const jsonEl = document.getElementById("ofield-" + name + "-json");
456
+ const raw = jsonEl ? jsonEl.value.trim() : "";
457
+ if (!raw) { msg.className = "set-msg fail"; msg.textContent = "Paste the OAuth JSON first."; return; }
458
+ let parsed;
459
+ try { parsed = JSON.parse(raw); } catch { msg.className = "set-msg fail"; msg.textContent = "Invalid JSON — copy the full file content."; return; }
460
+ // Google wraps fields under "installed" or "web"
461
+ const src = parsed.installed || parsed.web || parsed;
462
+ const obj = {};
463
+ for (const k of imp.jsonFields) {
464
+ if (!src[k]) { msg.className = "set-msg fail"; msg.textContent = k + " not found in JSON."; return; }
465
+ obj[k] = src[k];
466
+ }
467
+ for (const f of imp.extra) {
468
+ const el = document.getElementById("ofield-" + name + "-" + f.key);
469
+ const v = el ? el.value.trim() : "";
470
+ if (!v) { msg.className = "set-msg fail"; msg.textContent = f.label + " is required."; return; }
471
+ obj[f.key] = v;
472
+ }
473
+ value = JSON.stringify(obj);
474
+ } else {
475
+ const input = document.getElementById("set-input-" + name);
476
+ value = input ? input.value.trim() : "";
477
+ if (!value) { msg.className = "set-msg fail"; msg.textContent = "Value is empty."; return; }
478
+ }
479
+
480
+ msg.className = "set-msg"; msg.textContent = "Saving…";
481
+ try {
482
+ const r = await fetch(BASE + "/set/" + name, {
483
+ method: "POST",
484
+ headers: { "Content-Type": "application/json" },
485
+ body: JSON.stringify({ value })
486
+ }).then(r => r.json());
487
+
488
+ if (r.locked) { showLockScreen(); return; }
489
+ if (r.error) throw new Error(r.error);
490
+ msg.className = "set-msg ok"; msg.textContent = "✓ Saved";
491
+ if (imp) {
492
+ const jsonEl = document.getElementById("ofield-" + name + "-json");
493
+ if (jsonEl) jsonEl.value = "";
494
+ imp.extra.forEach(f => { const el = document.getElementById("ofield-" + name + "-" + f.key); if (el) el.value = ""; });
495
+ } else {
496
+ const inp = document.getElementById("set-input-" + name);
497
+ if (inp) inp.value = "";
498
+ }
499
+ const dot = document.getElementById("sdot-" + name);
500
+ if (dot) { dot.className = "status-dot"; dot.title = ""; }
501
+ setTimeout(() => {
502
+ document.getElementById("set-panel-" + name).style.display = "none";
503
+ msg.textContent = "";
504
+ }, 1800);
505
+ } catch (e) {
506
+ msg.className = "set-msg fail"; msg.textContent = "✗ " + e.message;
507
+ }
508
+ }
509
+
510
+ // ── Enable / Disable service ────────────────
511
+ async function toggleService(name) {
512
+ const badge = document.getElementById("badge-" + name);
513
+ const btn = document.getElementById("togbtn-" + name);
514
+ const currently = badge.classList.contains("on");
515
+ const newState = !currently;
516
+
517
+ btn.disabled = true; btn.textContent = "…";
518
+
519
+ try {
520
+ const r = await fetch(BASE + "/toggle/" + name, {
521
+ method: "POST",
522
+ headers: { "Content-Type": "application/json" },
523
+ body: JSON.stringify({ enabled: newState })
524
+ }).then(r => r.json());
525
+
526
+ if (r.locked) { showLockScreen(); return; }
527
+ if (r.error) throw new Error(r.error);
528
+
529
+ badge.className = "svc-badge " + (newState ? "on" : "off");
530
+ badge.textContent = newState ? "enabled" : "disabled";
531
+ btn.className = "btn " + (newState ? "btn-disable" : "btn-enable");
532
+ btn.textContent = newState ? "Disable" : "Enable";
533
+ } catch (e) {
534
+ btn.textContent = "Error";
535
+ setTimeout(() => {
536
+ btn.textContent = currently ? "Disable" : "Enable";
537
+ }, 2000);
538
+ } finally {
539
+ btn.disabled = false;
540
+ }
541
+ }
542
+
543
+ // ── Check all credentials ───────────────────
544
+ async function checkAll() {
545
+ const btn = document.getElementById("check-btn");
546
+ btn.disabled = true; btn.textContent = "Checking…";
547
+
548
+ // Show checking state on every visible dot
549
+ document.querySelectorAll(".status-dot").forEach(d => {
550
+ d.className = "status-dot checking"; d.title = "Checking…";
551
+ });
552
+
553
+ try {
554
+ const r = await fetch(BASE + "/check-all").then(r => r.json());
555
+ if (r.locked) { showLockScreen(); return; }
556
+ if (r.error) throw new Error(r.error);
557
+
558
+ const results = r.results || {};
559
+ for (const [name, result] of Object.entries(results)) {
560
+ const dot = document.getElementById("sdot-" + name);
561
+ if (!dot) continue;
562
+ if (result.ok) {
563
+ dot.className = "status-dot ok"; dot.title = "OK";
564
+ } else {
565
+ dot.className = "status-dot fail";
566
+ dot.title = result.reason || "No key stored";
567
+ }
568
+ }
569
+
570
+ // Fade green dots after 3 s — red dots stay until next check
571
+ setTimeout(() => {
572
+ document.querySelectorAll(".status-dot.ok").forEach(d => d.classList.add("fading"));
573
+ }, 3000);
574
+
575
+ } catch (e) {
576
+ document.querySelectorAll(".status-dot").forEach(d => { d.className = "status-dot"; d.title = ""; });
577
+ const errBar = document.getElementById("error-bar");
578
+ errBar.textContent = "⚠ Check failed: " + e.message;
579
+ errBar.style.display = "block";
580
+ } finally {
581
+ btn.disabled = false; btn.textContent = "⬤ Check All";
582
+ }
583
+ }
584
+
585
+ // ── Change password ─────────────────────────
586
+ function toggleChangePw() {
587
+ const panel = document.getElementById("chpw-panel");
588
+ const open = panel.style.display === "block";
589
+ panel.style.display = open ? "none" : "block";
590
+ if (!open) {
591
+ document.getElementById("chpw-new").value = "";
592
+ document.getElementById("chpw-confirm").value = "";
593
+ document.getElementById("chpw-msg").textContent = "";
594
+ document.getElementById("chpw-new").focus();
595
+ }
596
+ }
597
+
598
+ async function changePassword() {
599
+ const newPw = document.getElementById("chpw-new").value;
600
+ const confPw = document.getElementById("chpw-confirm").value;
601
+ const msg = document.getElementById("chpw-msg");
602
+
603
+ if (!newPw) { msg.className = "chpw-msg fail"; msg.textContent = "Enter a new password."; return; }
604
+ if (newPw.length < 8) { msg.className = "chpw-msg fail"; msg.textContent = "Minimum 8 characters."; return; }
605
+ if (newPw !== confPw) { msg.className = "chpw-msg fail"; msg.textContent = "Passwords don't match."; return; }
606
+
607
+ msg.className = "chpw-msg"; msg.textContent = "Updating…";
608
+ try {
609
+ const r = await fetch(BASE + "/change-pw", {
610
+ method: "POST",
611
+ headers: { "Content-Type": "application/json" },
612
+ body: JSON.stringify({ newPassword: newPw })
613
+ }).then(r => r.json());
614
+
615
+ if (r.locked) { showLockScreen(); return; }
616
+ if (r.error) throw new Error(r.error);
617
+
618
+ msg.className = "chpw-msg ok"; msg.textContent = "✓ Password updated";
619
+ document.getElementById("chpw-new").value = "";
620
+ document.getElementById("chpw-confirm").value = "";
621
+ setTimeout(() => {
622
+ document.getElementById("chpw-panel").style.display = "none";
623
+ msg.textContent = "";
624
+ }, 2000);
625
+ } catch (e) {
626
+ msg.className = "chpw-msg fail"; msg.textContent = "✗ " + e.message;
627
+ }
628
+ }
629
+
630
+ // Enter key on lock screen
631
+ document.addEventListener("DOMContentLoaded", () => {
632
+ document.getElementById("lock-input").addEventListener("keydown", e => {
633
+ if (e.key === "Enter") unlock();
634
+ });
635
+ });
636
+
637
+ boot();
638
+ </script>
639
+ </body>
640
+ </html>`;
641
+ }
642
+
643
+ // ── Body parser helper ────────────────────────────────────────
644
+ function readBody(req) {
645
+ return new Promise((resolve, reject) => {
646
+ let data = "";
647
+ req.on("data", chunk => { data += chunk; if (data.length > 65536) reject(new Error("Body too large")); });
648
+ req.on("end", () => { try { resolve(JSON.parse(data)); } catch { reject(new Error("Invalid JSON")); } });
649
+ req.on("error", reject);
650
+ });
651
+ }
652
+
653
+ // ── Server logic (shared by foreground + daemon) ─────────────
654
+ function createServer(initPassword, whitelist, port) {
655
+ const MAX_FAILS = 3;
656
+ let failCount = 0;
657
+ let password = initPassword || null; // null = locked; set via POST /auth
658
+ const machineHash = getMachineHash();
659
+
660
+ const CORS = {
661
+ "Access-Control-Allow-Origin": "*",
662
+ "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
663
+ "Access-Control-Allow-Headers": "Content-Type",
664
+ };
665
+
666
+ function strike(res, code, message) {
667
+ failCount++;
668
+ const remaining = MAX_FAILS - failCount;
669
+ const logLine = `[${new Date().toISOString()}] [FAIL ${failCount}/${MAX_FAILS}] ${message}\n`;
670
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
671
+
672
+ const body = JSON.stringify({
673
+ error: message,
674
+ failures: failCount,
675
+ failures_remaining: remaining,
676
+ ...(failCount >= MAX_FAILS ? { shutdown: true } : {})
677
+ });
678
+
679
+ res.writeHead(code, { "Content-Type": "application/json", ...CORS });
680
+ res.end(body);
681
+
682
+ if (failCount >= MAX_FAILS) {
683
+ const msg = `[${new Date().toISOString()}] Failure limit reached — shutting down\n`;
684
+ try { fs.appendFileSync(LOG_FILE, msg); } catch {}
685
+ removePid();
686
+ setTimeout(() => process.exit(1), 100);
687
+ }
688
+ }
689
+
690
+ function ok(res, data) {
691
+ res.writeHead(200, { "Content-Type": "application/json", ...CORS });
692
+ res.end(JSON.stringify(data));
693
+ }
694
+
695
+ const server = http.createServer(async (req, res) => {
696
+ // Hard reject anything not from loopback
697
+ const remote = req.socket.remoteAddress;
698
+ const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
699
+ if (!isLocal) {
700
+ return strike(res, 403, `Rejected non-local address: ${remote}`);
701
+ }
702
+
703
+ // CORS preflight
704
+ if (req.method === "OPTIONS") {
705
+ res.writeHead(204, CORS);
706
+ return res.end();
707
+ }
708
+
709
+ const url = new URL(req.url, `http://127.0.0.1:${port}`);
710
+ const reqPath = url.pathname;
711
+ const method = req.method;
712
+
713
+ // GET / — built-in web dashboard
714
+ if (method === "GET" && reqPath === "/") {
715
+ res.writeHead(200, { "Content-Type": "text/html", ...CORS });
716
+ return res.end(dashboardHtml(port, whitelist));
717
+ }
718
+
719
+ // GET /ping
720
+ if (method === "GET" && reqPath === "/ping") {
721
+ return ok(res, {
722
+ status: "ok",
723
+ pid: process.pid,
724
+ locked: !password,
725
+ failures: failCount,
726
+ failures_remaining: MAX_FAILS - failCount,
727
+ services: whitelist || "all",
728
+ port
729
+ });
730
+ }
731
+
732
+ // GET /shutdown (for daemon stop)
733
+ if (method === "GET" && reqPath === "/shutdown") {
734
+ ok(res, { ok: true, message: "shutting down" });
735
+ removePid();
736
+ setTimeout(() => process.exit(0), 100);
737
+ return;
738
+ }
739
+
740
+ // Locked guard — returns true if locked and already responded
741
+ function lockedGuard(res) {
742
+ if (!password) {
743
+ res.writeHead(401, { "Content-Type": "application/json", ...CORS });
744
+ res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
745
+ return true;
746
+ }
747
+ return false;
748
+ }
749
+
750
+ // GET /status
751
+ if (method === "GET" && reqPath === "/status") {
752
+ if (lockedGuard(res)) return;
753
+ try {
754
+ const { token, timestamp } = deriveToken(password, machineHash);
755
+ const result = await api.status(password, machineHash, token, timestamp);
756
+ if (result.error) return strike(res, 502, result.error);
757
+ if (whitelist) {
758
+ result.services = (result.services || []).filter(
759
+ s => whitelist.includes(s.name.toLowerCase())
760
+ );
761
+ }
762
+ return ok(res, result);
763
+ } catch (err) {
764
+ return strike(res, 502, err.message);
765
+ }
766
+ }
767
+
768
+ // GET /get/:service
769
+ const getMatch = reqPath.match(/^\/get\/([a-zA-Z0-9_-]+)$/);
770
+ if (method === "GET" && getMatch) {
771
+ if (lockedGuard(res)) return;
772
+ const service = getMatch[1].toLowerCase();
773
+
774
+ if (whitelist && !whitelist.includes(service)) {
775
+ return strike(res, 403, `Service '${service}' not in whitelist`);
776
+ }
777
+
778
+ try {
779
+ const { token, timestamp } = deriveToken(password, machineHash);
780
+ const result = await api.retrieve(password, machineHash, token, timestamp, service);
781
+ if (result.error) return strike(res, 502, result.error);
782
+ return ok(res, { service, value: result.value, key_type: result.key_type });
783
+ } catch (err) {
784
+ return strike(res, 502, err.message);
785
+ }
786
+ }
787
+
788
+ // POST /auth — unlock the vault with a password (verifies against Edge Function)
789
+ if (method === "POST" && reqPath === "/auth") {
790
+ let body;
791
+ try { body = await readBody(req); } catch {
792
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
793
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
794
+ }
795
+
796
+ const pw = body.password;
797
+ if (!pw || typeof pw !== "string") {
798
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
799
+ return res.end(JSON.stringify({ error: "password is required" }));
800
+ }
801
+
802
+ try {
803
+ const { token, timestamp } = deriveToken(pw, machineHash);
804
+ const result = await api.test(pw, machineHash, token, timestamp);
805
+ if (result.error) throw new Error(result.error);
806
+ password = pw; // unlock — store in process memory only
807
+ const logLine = `[${new Date().toISOString()}] Vault unlocked\n`;
808
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
809
+ return ok(res, { ok: true, locked: false });
810
+ } catch {
811
+ // Wrong password — not a lockout strike, just a UI auth attempt
812
+ res.writeHead(401, { "Content-Type": "application/json", ...CORS });
813
+ return res.end(JSON.stringify({ error: "Invalid password" }));
814
+ }
815
+ }
816
+
817
+ // POST /lock — clear password from memory
818
+ if (method === "POST" && reqPath === "/lock") {
819
+ password = null;
820
+ const logLine = `[${new Date().toISOString()}] Vault locked\n`;
821
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
822
+ return ok(res, { ok: true, locked: true });
823
+ }
824
+
825
+ // POST /toggle/:service — enable or disable a service
826
+ const toggleMatch = reqPath.match(/^\/toggle\/([a-zA-Z0-9_-]+)$/);
827
+ if (method === "POST" && toggleMatch) {
828
+ if (lockedGuard(res)) return;
829
+ const service = toggleMatch[1].toLowerCase();
830
+
831
+ let body;
832
+ try { body = await readBody(req); } catch {
833
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
834
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
835
+ }
836
+
837
+ const { enabled } = body;
838
+ if (typeof enabled !== "boolean") {
839
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
840
+ return res.end(JSON.stringify({ error: "enabled must be boolean" }));
841
+ }
842
+
843
+ try {
844
+ const { token, timestamp } = deriveToken(password, machineHash);
845
+ const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
846
+ if (result.error) return strike(res, 502, result.error);
847
+ return ok(res, { ok: true, service, enabled });
848
+ } catch (err) {
849
+ return strike(res, 502, err.message);
850
+ }
851
+ }
852
+
853
+ // GET /check-all — soft health check, no strikes for missing/disabled keys
854
+ if (method === "GET" && reqPath === "/check-all") {
855
+ if (lockedGuard(res)) return;
856
+ try {
857
+ const { token: st, timestamp: sts } = deriveToken(password, machineHash);
858
+ const statusResult = await api.status(password, machineHash, st, sts);
859
+ if (statusResult.error) return strike(res, 502, statusResult.error);
860
+
861
+ const services = (statusResult.services || []).filter(
862
+ s => !whitelist || whitelist.includes(s.name.toLowerCase())
863
+ );
864
+
865
+ const results = {};
866
+ for (const svc of services) {
867
+ try {
868
+ const { token, timestamp } = deriveToken(password, machineHash);
869
+ const r = await api.retrieve(password, machineHash, token, timestamp, svc.name);
870
+ results[svc.name] = r.error
871
+ ? { ok: false, reason: r.error }
872
+ : { ok: true };
873
+ } catch (e) {
874
+ results[svc.name] = { ok: false, reason: e.message };
875
+ }
876
+ }
877
+ return ok(res, { results });
878
+ } catch (err) {
879
+ return strike(res, 502, err.message);
880
+ }
881
+ }
882
+
883
+ // POST /change-pw — change master password (must be unlocked)
884
+ if (method === "POST" && reqPath === "/change-pw") {
885
+ if (lockedGuard(res)) return;
886
+
887
+ let body;
888
+ try { body = await readBody(req); } catch {
889
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
890
+ return res.end(JSON.stringify({ error: "Invalid JSON body" }));
891
+ }
892
+
893
+ const { newPassword } = body;
894
+ if (!newPassword || typeof newPassword !== "string" || newPassword.length < 8) {
895
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
896
+ return res.end(JSON.stringify({ error: "newPassword must be at least 8 characters" }));
897
+ }
898
+
899
+ try {
900
+ const { token, timestamp } = deriveToken(password, machineHash);
901
+ const newSeedHash = deriveSeedHash(machineHash, newPassword);
902
+ const result = await api.changePassword(password, machineHash, token, timestamp, newSeedHash);
903
+ if (result.error) throw new Error(result.error);
904
+ password = newPassword; // update in-memory password to new one
905
+ const logLine = `[${new Date().toISOString()}] Password changed\n`;
906
+ try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
907
+ return ok(res, { ok: true });
908
+ } catch (err) {
909
+ res.writeHead(502, { "Content-Type": "application/json", ...CORS });
910
+ return res.end(JSON.stringify({ error: err.message }));
911
+ }
912
+ }
913
+
914
+ // POST /set/:service — write a new key value into vault
915
+ const setMatch = reqPath.match(/^\/set\/([a-zA-Z0-9_-]+)$/);
916
+ if (method === "POST" && setMatch) {
917
+ if (lockedGuard(res)) return;
918
+ const service = setMatch[1].toLowerCase();
919
+
920
+ if (whitelist && !whitelist.includes(service)) {
921
+ return strike(res, 403, `Service '${service}' not in whitelist`);
922
+ }
923
+
924
+ let body;
925
+ try { body = await readBody(req); } catch {
926
+ return strike(res, 400, "Invalid JSON body");
927
+ }
928
+
929
+ const value = body.value;
930
+ if (!value || typeof value !== "string" || !value.trim()) {
931
+ res.writeHead(400, { "Content-Type": "application/json", ...CORS });
932
+ return res.end(JSON.stringify({ error: "value is required" }));
933
+ }
934
+
935
+ try {
936
+ const { token, timestamp } = deriveToken(password, machineHash);
937
+ const result = await api.write(password, machineHash, token, timestamp, service, value.trim());
938
+ if (result.error) return strike(res, 502, result.error);
939
+ return ok(res, { ok: true, service });
940
+ } catch (err) {
941
+ return strike(res, 502, err.message);
942
+ }
943
+ }
944
+
945
+ // Unknown route
946
+ return strike(res, 404, `Unknown endpoint: ${reqPath}`);
947
+ });
948
+
949
+ return server;
950
+ }
951
+
952
+ // ── Actions ──────────────────────────────────────────────────
953
+
954
+ async function verifyAuth(password) {
955
+ const machineHash = getMachineHash();
956
+ const { token, timestamp } = deriveToken(password, machineHash);
957
+ const result = await api.test(password, machineHash, token, timestamp);
958
+ if (result.error) throw new Error(result.error);
959
+ }
960
+
961
+ async function actionStart(opts) {
962
+ const port = parseInt(opts.port || "52437", 10);
963
+ const password = opts.pw;
964
+ const whitelist = opts.services
965
+ ? opts.services.split(",").map(s => s.trim().toLowerCase())
966
+ : null;
967
+
968
+ // Check for existing instance
969
+ const existing = readPid();
970
+ if (existing && isProcessAlive(existing.pid)) {
971
+ console.log(chalk.yellow(`\n clauth serve already running (PID ${existing.pid}, port ${existing.port})`));
972
+ console.log(chalk.gray(` Stop it first: clauth serve stop\n`));
973
+ process.exit(1);
974
+ }
975
+
976
+ // If we're the daemon child, run the server directly
977
+ if (process.env.__CLAUTH_DAEMON === "1") {
978
+ // Verify password only if one was provided at start (optional — browser can unlock later)
979
+ if (password) {
980
+ try {
981
+ await verifyAuth(password);
982
+ } catch (err) {
983
+ const msg = `[${new Date().toISOString()}] Auth failed: ${err.message}\n`;
984
+ fs.appendFileSync(LOG_FILE, msg);
985
+ process.exit(1);
986
+ }
987
+ }
988
+
989
+ const server = createServer(password, whitelist, port);
990
+ server.listen(port, "127.0.0.1", () => {
991
+ writePid(process.pid, port);
992
+ const msg = `[${new Date().toISOString()}] clauth serve started — PID ${process.pid}, port ${port}, services: ${whitelist ? whitelist.join(",") : "all"}\n`;
993
+ fs.appendFileSync(LOG_FILE, msg);
994
+ });
995
+
996
+ server.on("error", err => {
997
+ const msg = `[${new Date().toISOString()}] Server error: ${err.message}\n`;
998
+ fs.appendFileSync(LOG_FILE, msg);
999
+ process.exit(1);
1000
+ });
1001
+
1002
+ const shutdown = () => { removePid(); process.exit(0); };
1003
+ process.on("SIGTERM", shutdown);
1004
+ process.on("SIGINT", shutdown);
1005
+ return;
1006
+ }
1007
+
1008
+ // If --pw provided, verify it before spawning (fast-fail on wrong password)
1009
+ if (password) {
1010
+ console.log(chalk.gray("\n Verifying vault credentials..."));
1011
+ try {
1012
+ await verifyAuth(password);
1013
+ } catch (err) {
1014
+ console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1015
+ process.exit(1);
1016
+ }
1017
+ console.log(chalk.green(" ✓ Vault auth verified"));
1018
+ } else {
1019
+ console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1020
+ }
1021
+
1022
+ // Spawn detached daemon child via the clauth CLI entry point
1023
+ const { spawn } = await import("child_process");
1024
+ const { fileURLToPath } = await import("url");
1025
+ const { dirname, join } = await import("path");
1026
+ const __filename = fileURLToPath(import.meta.url);
1027
+ const cliEntry = join(dirname(__filename), "..", "index.js");
1028
+
1029
+ // Build args: node index.js serve start --port N [--pw PW] [--services S]
1030
+ const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
1031
+ if (password) childArgs.push("--pw", password);
1032
+ if (opts.services) childArgs.push("--services", opts.services);
1033
+
1034
+ const out = fs.openSync(LOG_FILE, "a");
1035
+ const child = spawn(process.execPath, childArgs, {
1036
+ detached: true,
1037
+ stdio: ["ignore", out, out],
1038
+ env: { ...process.env, __CLAUTH_DAEMON: "1" },
1039
+ });
1040
+ child.unref();
1041
+
1042
+ // Give it time to bind and write PID file (Windows spawn is slower)
1043
+ // Verify via HTTP ping (process.kill(pid,0) fails on Windows for detached processes)
1044
+ let started = false;
1045
+ for (let attempt = 0; attempt < 5; attempt++) {
1046
+ await new Promise(r => setTimeout(r, 1000));
1047
+ try {
1048
+ const resp = await fetch(`http://127.0.0.1:${port}/ping`);
1049
+ if (resp.ok) { started = true; break; }
1050
+ } catch {}
1051
+ }
1052
+
1053
+ const info = readPid();
1054
+ if (started && info) {
1055
+ console.log(chalk.green(`\n 🔐 clauth serve started`));
1056
+ console.log(chalk.gray(` PID: ${info.pid}`));
1057
+ console.log(chalk.gray(` Port: 127.0.0.1:${info.port}`));
1058
+ console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1059
+ console.log(chalk.gray(` Log: ${LOG_FILE}`));
1060
+ if (!password) {
1061
+ console.log(chalk.cyan(`\n 👉 Open http://127.0.0.1:${info.port} to unlock the vault`));
1062
+ }
1063
+ console.log(chalk.gray(` Stop: clauth serve stop\n`));
1064
+ } else {
1065
+ console.log(chalk.red(`\n ❌ Failed to start daemon — check ${LOG_FILE}\n`));
1066
+ process.exit(1);
1067
+ }
1068
+ }
1069
+
1070
+ async function actionStop() {
1071
+ const info = readPid();
1072
+ if (!info) {
1073
+ console.log(chalk.yellow("\n No clauth serve PID file found — not running.\n"));
1074
+ return;
1075
+ }
1076
+
1077
+ if (!isProcessAlive(info.pid)) {
1078
+ console.log(chalk.yellow(`\n PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
1079
+ removePid();
1080
+ return;
1081
+ }
1082
+
1083
+ // Try HTTP shutdown first (clean)
1084
+ try {
1085
+ const resp = await fetch(`http://127.0.0.1:${info.port}/shutdown`);
1086
+ if (resp.ok) {
1087
+ await new Promise(r => setTimeout(r, 300));
1088
+ console.log(chalk.green(`\n 🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
1089
+ removePid();
1090
+ return;
1091
+ }
1092
+ } catch {}
1093
+
1094
+ // Fallback: kill the process
1095
+ try {
1096
+ process.kill(info.pid, "SIGTERM");
1097
+ await new Promise(r => setTimeout(r, 300));
1098
+ console.log(chalk.green(`\n 🛑 clauth serve stopped via SIGTERM (PID ${info.pid})\n`));
1099
+ } catch (err) {
1100
+ console.log(chalk.yellow(`\n Could not kill PID ${info.pid}: ${err.message}\n`));
1101
+ }
1102
+ removePid();
1103
+ }
1104
+
1105
+ async function actionPing() {
1106
+ const info = readPid();
1107
+ if (!info) {
1108
+ console.log(chalk.red("\n clauth serve is not running (no PID file)\n"));
1109
+ process.exit(1);
1110
+ }
1111
+
1112
+ if (!isProcessAlive(info.pid)) {
1113
+ console.log(chalk.red(`\n PID ${info.pid} is not alive (stale PID file)\n`));
1114
+ removePid();
1115
+ process.exit(1);
1116
+ }
1117
+
1118
+ try {
1119
+ const resp = await fetch(`http://127.0.0.1:${info.port}/ping`);
1120
+ const data = await resp.json();
1121
+ if (data.status === "ok") {
1122
+ console.log(chalk.green(`\n ✅ clauth serve running`));
1123
+ console.log(chalk.gray(` PID: ${info.pid}`));
1124
+ console.log(chalk.gray(` Port: ${info.port}`));
1125
+ console.log(chalk.gray(` Fails: ${data.failures}/${data.failures + data.failures_remaining}`));
1126
+ console.log(chalk.gray(` Services: ${Array.isArray(data.services) ? data.services.join(", ") : data.services}\n`));
1127
+ } else {
1128
+ console.log(chalk.yellow(`\n PID alive but /ping returned unexpected response\n`));
1129
+ }
1130
+ } catch (err) {
1131
+ console.log(chalk.yellow(`\n PID ${info.pid} alive but HTTP failed: ${err.message}\n`));
1132
+ }
1133
+ }
1134
+
1135
+ async function actionRestart(opts) {
1136
+ const info = readPid();
1137
+ if (info && isProcessAlive(info.pid)) {
1138
+ await actionStop();
1139
+ await new Promise(r => setTimeout(r, 500));
1140
+ }
1141
+ await actionStart(opts);
1142
+ }
1143
+
1144
+ async function actionForeground(opts) {
1145
+ const port = parseInt(opts.port || "52437", 10);
1146
+ const password = opts.pw || null;
1147
+ const whitelist = opts.services
1148
+ ? opts.services.split(",").map(s => s.trim().toLowerCase())
1149
+ : null;
1150
+
1151
+ if (password) {
1152
+ console.log(chalk.gray("\n Verifying vault credentials..."));
1153
+ try {
1154
+ await verifyAuth(password);
1155
+ } catch (err) {
1156
+ console.log(chalk.red(`\n Auth failed: ${err.message}\n`));
1157
+ process.exit(1);
1158
+ }
1159
+ console.log(chalk.green(" ✓ Vault auth verified"));
1160
+ } else {
1161
+ console.log(chalk.yellow("\n Starting in locked state — open browser to unlock"));
1162
+ }
1163
+
1164
+ console.log(chalk.gray(` Port: 127.0.0.1:${port}`));
1165
+ console.log(chalk.gray(` Services: ${whitelist ? whitelist.join(", ") : "all"}`));
1166
+ console.log(chalk.gray(` Lockout: 3 failures → exit\n`));
1167
+
1168
+ const server = createServer(password, whitelist, port);
1169
+ server.listen(port, "127.0.0.1", () => {
1170
+ writePid(process.pid, port);
1171
+ console.log(chalk.green(` clauth serve → http://127.0.0.1:${port}`));
1172
+ if (!password) console.log(chalk.cyan(` 👉 Open http://127.0.0.1:${port} to unlock`));
1173
+ console.log(chalk.gray(" Ctrl+C to stop\n"));
1174
+ });
1175
+
1176
+ server.on("error", err => {
1177
+ if (err.code === "EADDRINUSE") {
1178
+ console.log(chalk.red(`\n Port ${port} already in use. Use --port to choose another.\n`));
1179
+ } else {
1180
+ console.log(chalk.red(`\n Server error: ${err.message}\n`));
1181
+ }
1182
+ process.exit(1);
1183
+ });
1184
+
1185
+ process.on("SIGINT", () => {
1186
+ console.log(chalk.yellow("\n Stopping clauth serve...\n"));
1187
+ removePid();
1188
+ server.close(() => process.exit(0));
1189
+ });
1190
+ }
1191
+
1192
+ // ── Export ────────────────────────────────────────────────────
1193
+ export async function runServe(opts) {
1194
+ const action = opts.action || "foreground";
1195
+
1196
+ switch (action) {
1197
+ case "start": return actionStart(opts);
1198
+ case "stop": return actionStop();
1199
+ case "restart": return actionRestart(opts);
1200
+ case "ping": return actionPing();
1201
+ case "foreground": return actionForeground(opts);
1202
+ default:
1203
+ console.log(chalk.red(`\n Unknown serve action: ${action}`));
1204
+ console.log(chalk.gray(" Actions: start | stop | restart | ping | foreground\n"));
1205
+ process.exit(1);
1206
+ }
1207
+ }