@lifeaitools/clauth 1.18.0 → 1.19.0

package/cli/commands/serve.js

@@ -3337,6 +3337,80 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     });
   }
 
+  // Self-heal: mint a connector run-token from the Cloudflare API using the
+  // vault's `cloudflare` token, so `cloudflared tunnel run --token` can start
+  // the tunnel with ZERO local files (~/.cloudflared/config.yml + creds JSON).
+  // This survives a home-dir wipe — clauth has the keys, so it rebuilds the
+  // connector itself. Returns null on any failure so startTunnel() can fall
+  // back to the legacy file-based `tunnel run`.
+  async function getTunnelRunToken() {
+    try {
+      if (!password) return null;
+      const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+      const sbKey = api.getAnonKey();
+
+      // Resolve tunnelId: clauth_config.tunnel_id, else config.yml `tunnel:` line
+      let tid = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.tunnel_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              tid = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!tid) {
+        try {
+          const yml = fs.readFileSync(path.join(os.homedir(), ".cloudflared", "config.yml"), "utf8");
+          const m = yml.match(/^\s*tunnel:\s*(\S+)/m);
+          if (m) tid = m[1];
+        } catch {}
+      }
+      if (!tid) return null;
+
+      // CF API token from the vault
+      const { token, timestamp } = deriveToken(password, machineHash);
+      const cr = await api.retrieve(password, machineHash, token, timestamp, "cloudflare");
+      const cfToken = cr?.value;
+      if (!cfToken) return null;
+
+      // accountId: clauth_config.cf_account_id, else first account on the token
+      let accountId = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              accountId = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!accountId) {
+        const ar = await fetch("https://api.cloudflare.com/client/v4/accounts",
+          { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+        const ad = await ar.json();
+        accountId = ad?.result?.[0]?.id || null;
+      }
+      if (!accountId) return null;
+
+      // Mint the connector run-token
+      const tr = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel/${tid}/token`,
+        { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+      const td = await tr.json();
+      if (td?.success && td.result) return td.result;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
   async function startTunnel() {
     if (tunnelProc) {
       // Already running — ensure status reflects reality (caller may have reset it to "starting")
@@ -3387,9 +3461,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // Named tunnel (fixed subdomain) or quick tunnel (random URL)
       let args;
       if (tunnelHostname) {
-        // Named tunnel: cloudflared tunnel run (uses ~/.cloudflared/config.yml)
-        // Config maps hostname → local service, so no --url needed
-        args = ["tunnel", "run"];
+        // Self-heal first: mint a connector token from the CF API (clauth has
+        // the keys) and run `--token` — no local config.yml/creds needed.
+        // Fall back to the legacy file-based `tunnel run` only if minting fails.
+        const runToken = await getTunnelRunToken();
+        if (runToken) {
+          args = ["tunnel", "run", "--token", runToken];
+        } else {
+          args = ["tunnel", "run"];
+        }
         tunnelUrl = `https://${tunnelHostname}`;
       } else {
         // Quick tunnel — random URL each session
@@ -4657,6 +4737,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         detached: true,
         stdio: ["ignore", out, out],
         env: { ...process.env, __CLAUTH_DAEMON: "1" },
+        windowsHide: true,
       });
       child.unref();
       stopTunnel();
@@ -5412,6 +5493,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         detached: true,
         stdio: ["ignore", out, out],
         env: childEnv,
+        windowsHide: true,
       });
       child.unref();
 
@@ -6218,6 +6300,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
         });
 
+        // Persist tunnel_id too — required for token-based self-heal after a
+        // daemon restart or a ~/.cloudflared wipe (getTunnelRunToken reads it).
+        if (tunnelId) {
+          await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+            method: "POST",
+            headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+            body: JSON.stringify({ key: "tunnel_id", value: JSON.stringify(tunnelId) }),
+          });
+        }
+
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
@@ -6341,7 +6433,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const sendEvt = (data) => res.write(`data: ${JSON.stringify(data)}\n\n`);
       try {
         const { spawn } = await import("child_process");
-        const proc = spawn("cloudflared", ["tunnel", "login"], { stdio: ["ignore","pipe","pipe"] });
+        const proc = spawn("cloudflared", ["tunnel", "login"], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
         proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
         proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
         proc.on("close", code => { sendEvt({ done: true, code }); res.end(); });
@@ -6375,7 +6467,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         sendEvt({ line: `Creating tunnel "${name}"…`, step: 1 });
         let tunnelId = null;
         await new Promise((resolve, reject) => {
-          const proc = spawn("cloudflared", ["tunnel", "create", name], { stdio: ["ignore","pipe","pipe"] });
+          const proc = spawn("cloudflared", ["tunnel", "create", name], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
           let output = "";
           proc.stdout.on("data", d => { const s = d.toString(); output += s; s.split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 1 })); });
           proc.stderr.on("data", d => { const s = d.toString(); output += s; s.split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 1 })); });
@@ -6395,7 +6487,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         // Step 2: route DNS
         sendEvt({ line: `Routing DNS: ${hostname}…`, step: 2 });
         await new Promise((resolve) => {
-          const proc = spawn("cloudflared", ["tunnel", "route", "dns", name, hostname], { stdio: ["ignore","pipe","pipe"] });
+          const proc = spawn("cloudflared", ["tunnel", "route", "dns", name, hostname], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
           proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 2 })));
           proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l, step: 2 })));
           proc.on("close", () => resolve());
@@ -6877,6 +6969,7 @@ async function actionStart(opts) {
     detached: true,
     stdio: ["ignore", out, out],
     env: { ...process.env, __CLAUTH_DAEMON: "1", ...(isStaged ? { __CLAUTH_STAGED: "1" } : {}) },
+    windowsHide: true,
   });
   child.unref();
 
@@ -7101,11 +7194,18 @@ function getAgentPool() {
     defaultModel: process.env.CLAUTH_AGENT_MODEL || "claude-haiku-4-5",
   });
   _agentPool.startReaper();
+  console.log(`[agent-pool] init: binary=${_agentPool.binary ? 'found' : 'MISSING'} warmEnabled=${_agentPool.warmEnabled} available=${_agentPool.available()} poolSize=${_agentPool.poolSize} warmSize=${_agentPool.warmSize}`);
   // WP-P2: boot persistent re-targetable warm workers in the background so the
   // first real call_agent dispatch hits a hot worker (sub-boot latency). Never
   // blocks daemon startup; if warm isn't ready yet, dispatch falls back to cold.
   if (_agentPool.warmEnabled && _agentPool.available()) {
-    _agentPool.prime().catch(() => {});
+    _agentPool.prime().then((r) => {
+      console.log(`[agent-pool] prime complete: mode=${r.mode} warmed=${r.warmed} workers=${r.workers ?? 'n/a'}`);
+    }).catch((e) => {
+      console.error(`[agent-pool] prime failed: ${e.message}`);
+    });
+  } else {
+    console.log(`[agent-pool] prime skipped: warmEnabled=${_agentPool.warmEnabled} available=${_agentPool.available()}`);
   }
   return _agentPool;
 }
@@ -7945,7 +8045,7 @@ function sendTerminalMessage(session_id, message) {
         if (!terminalSessions.has(session_id)) return;
         const s = terminalSessions.get(session_id);
         const response = result.ok
-          ? (result.stdout || '').trim() || '(no output)'
+          ? (result.package || '').trim() || '(no output)'
           : `(warm dispatch error: ${result.error || 'unknown'})`;
         // Still update rolling context for terminal_recv compatibility
         const turn = `\n\nUser: ${message}\nAssistant: ${response}`;
@@ -7990,6 +8090,7 @@ function sendTerminalMessage(session_id, message) {
     env: process.env,
     stdio: ['ignore', 'pipe', 'pipe'],
     shell: true,
+    windowsHide: true,
   });
   session.activeProc = proc;
 
@@ -8205,6 +8306,7 @@ function launchVisibleChitchatTerminal(session_id, cwd = CHITCHAT_FALLBACK_CWD)
       cwd,
       detached: true,
       stdio: "ignore",
+      windowsHide: true,
     });
     child.on("error", (err) => {
       console.warn(`[ClaudeAItoCLI] visible terminal process error: ${err.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {