@lifeaitools/clauth 1.18.1 → 1.19.2

package/cli/commands/serve.js

@@ -3337,6 +3337,80 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     });
   }
 
+  // Self-heal: mint a connector run-token from the Cloudflare API using the
+  // vault's `cloudflare` token, so `cloudflared tunnel run --token` can start
+  // the tunnel with ZERO local files (~/.cloudflared/config.yml + creds JSON).
+  // This survives a home-dir wipe — clauth has the keys, so it rebuilds the
+  // connector itself. Returns null on any failure so startTunnel() can fall
+  // back to the legacy file-based `tunnel run`.
+  async function getTunnelRunToken() {
+    try {
+      if (!password) return null;
+      const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+      const sbKey = api.getAnonKey();
+
+      // Resolve tunnelId: clauth_config.tunnel_id, else config.yml `tunnel:` line
+      let tid = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.tunnel_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              tid = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!tid) {
+        try {
+          const yml = fs.readFileSync(path.join(os.homedir(), ".cloudflared", "config.yml"), "utf8");
+          const m = yml.match(/^\s*tunnel:\s*(\S+)/m);
+          if (m) tid = m[1];
+        } catch {}
+      }
+      if (!tid) return null;
+
+      // CF API token from the vault
+      const { token, timestamp } = deriveToken(password, machineHash);
+      const cr = await api.retrieve(password, machineHash, token, timestamp, "cloudflare");
+      const cfToken = cr?.value;
+      if (!cfToken) return null;
+
+      // accountId: clauth_config.cf_account_id, else first account on the token
+      let accountId = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              accountId = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!accountId) {
+        const ar = await fetch("https://api.cloudflare.com/client/v4/accounts",
+          { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+        const ad = await ar.json();
+        accountId = ad?.result?.[0]?.id || null;
+      }
+      if (!accountId) return null;
+
+      // Mint the connector run-token
+      const tr = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel/${tid}/token`,
+        { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+      const td = await tr.json();
+      if (td?.success && td.result) return td.result;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
   async function startTunnel() {
     if (tunnelProc) {
       // Already running — ensure status reflects reality (caller may have reset it to "starting")
@@ -3387,9 +3461,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // Named tunnel (fixed subdomain) or quick tunnel (random URL)
       let args;
       if (tunnelHostname) {
-        // Named tunnel: cloudflared tunnel run (uses ~/.cloudflared/config.yml)
-        // Config maps hostname → local service, so no --url needed
-        args = ["tunnel", "run"];
+        // Self-heal first: mint a connector token from the CF API (clauth has
+        // the keys) and run `--token` — no local config.yml/creds needed.
+        // Fall back to the legacy file-based `tunnel run` only if minting fails.
+        const runToken = await getTunnelRunToken();
+        if (runToken) {
+          args = ["tunnel", "run", "--token", runToken];
+        } else {
+          args = ["tunnel", "run"];
+        }
         tunnelUrl = `https://${tunnelHostname}`;
       } else {
         // Quick tunnel — random URL each session
@@ -3777,6 +3857,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
     const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+    const localTrustedHost = ["127.0.0.1", "localhost", "::1", "[::1]"].includes(requestHost);
 
     // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
     // Suppress OAuth discovery on noauth hosts — prevents claude.ai from entering OAuth flow
@@ -3995,7 +4076,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const authHeader = req.headers.authorization;
       const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
 
-      if (!noAuthHost && (!token || !oauthTokens.has(token))) {
+      if (!noAuthHost && !localTrustedHost && (!token || !oauthTokens.has(token))) {
         // No valid Bearer token → return 401 with discovery hint
         const base = oauthBase();
         const resourcePath = isMcpPath ? reqPath.slice(1) : "sse"; // "mcp", "gws", "clauth", or "sse"
@@ -4012,8 +4093,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         }));
       }
 
-      // Valid token — mark as remote and fall through to MCP handling
-      req._clauthRemote = true;
+      // Valid token or trusted localhost — mark remote status and fall through to MCP handling
+      req._clauthRemote = !localTrustedHost;
     }
 
     // ── MCP Streamable HTTP transport ──
@@ -5257,6 +5338,29 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return;
     }
 
+    // POST /terminal/show — reveal/focus an active terminal session or open a visible inspector
+    if (method === "POST" && reqPath === "/terminal/show") {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { session_id } = JSON.parse(body);
+          if (!session_id) {
+            res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+            return res.end(JSON.stringify({ error: "session_id required" }));
+          }
+          const result = showTerminalSession(session_id);
+          const status = result.error === 'not_found' ? 404 : result.error ? 500 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+    }
+
     // POST /terminal/stop — stop a terminal session
     if (method === "POST" && reqPath === "/terminal/stop") {
       let body = "";
@@ -6220,6 +6324,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
         });
 
+        // Persist tunnel_id too — required for token-based self-heal after a
+        // daemon restart or a ~/.cloudflared wipe (getTunnelRunToken reads it).
+        if (tunnelId) {
+          await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+            method: "POST",
+            headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+            body: JSON.stringify({ key: "tunnel_id", value: JSON.stringify(tunnelId) }),
+          });
+        }
+
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
@@ -7899,7 +8013,18 @@ function generateSessionId() {
   return crypto.randomUUID();
 }
 
-function startTerminalSession(name, knowledge_tier, context_md, cwd) {
+function defaultTerminalCwd() {
+  const dir = process.env.CLAUTH_TERMINAL_CWD || path.join(os.tmpdir(), "clauth-tintin-terminal");
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+  } catch {
+    // If the neutral directory cannot be created, fall back to the user's home.
+    return os.homedir();
+  }
+  return dir;
+}
+
+function startTerminalSession(name, knowledge_tier, context_md, cwd, use_warm = false) {
   const binary = findClaudeBinary();
   if (!binary) {
     return { error: 'binary_not_found', message: 'claude CLI not found in PATH or AppData/npm' };
@@ -7908,7 +8033,7 @@ function startTerminalSession(name, knowledge_tier, context_md, cwd) {
   const preamble = context_md
     ? `${context_md}\n\n---\n`
     : '';
-  const initialContext = `${preamble}Session: ${name}, Tier: ${knowledge_tier}\nReady. Await instructions.`;
+  const initialContext = `${preamble}Session: ${name}, Tier: ${knowledge_tier}\nConversation transcript follows. Respond only to the final User message.`;
   const session = {
     session_id,
     name,
@@ -7918,26 +8043,31 @@ function startTerminalSession(name, knowledge_tier, context_md, cwd) {
     context: initialContext,
     activeProc: null,
     warmWorker: null,
-    cwd: cwd || CHITCHAT_FALLBACK_CWD,
+    use_warm,
+    cwd: cwd || defaultTerminalCwd(),
   };
 
-  // Try to acquire a warm worker from the agent pool for low-latency turns
-  try {
-    const pool = getAgentPool();
-    if (pool) {
-      const worker = pool.acquireForSession(session_id);
-      if (worker) {
-        session.warmWorker = worker;
-        console.log(`[terminal] session ${session_id} acquired warm worker`);
+  // Try to acquire a warm worker only when explicitly requested. The warm pool
+  // is optimized for call_agent one-shots; TinTin browser chat needs reliable
+  // repeated turns more than experimental low-latency pinning.
+  if (use_warm) {
+    try {
+      const pool = getAgentPool();
+      if (pool) {
+        const worker = pool.acquireForSession(session_id);
+        if (worker) {
+          session.warmWorker = worker;
+          console.log(`[terminal] session ${session_id} acquired warm worker`);
+        }
       }
+    } catch (e) {
+      console.log(`[terminal] session ${session_id} warm pool unavailable, will use cold path: ${e.message}`);
     }
-  } catch (e) {
-    console.log(`[terminal] session ${session_id} warm pool unavailable, will use cold path: ${e.message}`);
   }
 
   terminalSessions.set(session_id, session);
   console.log(`[terminal] started session ${session_id} name=${name} cwd=${session.cwd} warm=${!!session.warmWorker}`);
-  return { session_id, status: 'ready' };
+  return { session_id, status: 'ready', warm: !!session.warmWorker };
 }
 
 function sendTerminalMessage(session_id, message) {
@@ -7946,6 +8076,11 @@ function sendTerminalMessage(session_id, message) {
   if (session.status === 'stopped') return { error: 'stopped', message: 'Session is stopped' };
   if (session.status === 'busy') return { error: 'session_busy', message: 'Session is busy — try again shortly' };
 
+  const nextTurn = (session.turn || 0) + 1;
+  session.lastResponse = undefined;
+  session.lastResponseAt = null;
+  session.pendingTurn = nextTurn;
+
   // ── Warm-pool path: dispatch to the pinned worker (maintains its own context) ──
   if (session.warmWorker && !session.warmWorker.isDead()) {
     session.status = 'busy';
@@ -7963,7 +8098,8 @@ function sendTerminalMessage(session_id, message) {
         s.context = combined.length > 8000 ? combined.slice(combined.length - 8000) : combined;
         s.lastResponse = response;
         s.lastResponseAt = new Date().toISOString();
-        s.turn = (s.turn || 0) + 1;
+        s.turn = s.pendingTurn || ((s.turn || 0) + 1);
+        s.pendingTurn = null;
         s.status = 'ready';
         s.activeProc = null;
         console.log(`[terminal] session ${session_id} turn=${s.turn} complete (warm) ok=${result.ok}`);
@@ -7979,13 +8115,14 @@ function sendTerminalMessage(session_id, message) {
         const s = terminalSessions.get(session_id);
         s.lastResponse = `(warm dispatch failed: ${err.message})`;
         s.lastResponseAt = new Date().toISOString();
-        s.turn = (s.turn || 0) + 1;
+        s.turn = s.pendingTurn || ((s.turn || 0) + 1);
+        s.pendingTurn = null;
         s.status = 'ready';
         s.activeProc = null;
         s.warmWorker = null; // fall back to cold on next turn
         console.log(`[terminal] session ${session_id} warm dispatch threw, falling back to cold: ${err.message}`);
       });
-    return { queued: true, session_id, warm: true };
+    return { queued: true, session_id, warm: true, turn: nextTurn };
   }
 
   // ── Cold-spawn fallback: original path ──
@@ -7993,13 +8130,16 @@ function sendTerminalMessage(session_id, message) {
   if (!binary) return { error: 'binary_not_found', message: 'claude CLI not found in PATH or AppData/npm' };
 
   session.status = 'busy';
-  const fullPrompt = `${session.context}\n\n---\nUser: ${message}`;
-
-  const proc = spawnProc(binary, ['-p', fullPrompt, '--dangerously-skip-permissions'], {
+  const isCmdShim = process.platform === "win32" && /\.cmd$/i.test(binary);
+  const command = isCmdShim ? "cmd" : binary;
+  const args = isCmdShim
+    ? ["/d", "/s", "/c", `"${binary}"`, "-p", message, "--system-prompt", session.context, "--setting-sources", "user", "--dangerously-skip-permissions"]
+    : ["-p", message, "--system-prompt", session.context, "--setting-sources", "user", "--dangerously-skip-permissions"];
+  const proc = spawnProc(command, args, {
     cwd: session.cwd || CHITCHAT_FALLBACK_CWD,
     env: process.env,
     stdio: ['ignore', 'pipe', 'pipe'],
-    shell: true,
+    shell: false,
     windowsHide: true,
   });
   session.activeProc = proc;
@@ -8018,14 +8158,15 @@ function sendTerminalMessage(session_id, message) {
       s.context = combined.length > 8000 ? combined.slice(combined.length - 8000) : combined;
       s.lastResponse = response;
       s.lastResponseAt = new Date().toISOString();
-      s.turn = (s.turn || 0) + 1;
+      s.turn = s.pendingTurn || ((s.turn || 0) + 1);
+      s.pendingTurn = null;
       s.status = 'ready';
       s.activeProc = null;
       console.log(`[terminal] session ${session_id} turn=${s.turn} complete code=${code}`);
     }
   });
 
-  return { queued: true, session_id, warm: false };
+  return { queued: true, session_id, warm: false, turn: nextTurn };
 }
 
 function recvTerminalResponse(session_id, timeout_ms = 30000) {
@@ -8067,6 +8208,101 @@ function listTerminalSessions() {
   return sessions;
 }
 
+function showTerminalSession(session_id) {
+  const session = terminalSessions.get(session_id);
+  if (!session) return { error: 'not_found', message: `Session ${session_id} not found` };
+
+  const pid = session.activeProc?.pid || null;
+  if (process.platform === "win32" && pid) {
+    try {
+      const script = [
+        "Add-Type @'",
+        "using System;",
+        "using System.Runtime.InteropServices;",
+        "public class Win32ShowWindow {",
+        "  [DllImport(\"user32.dll\")] public static extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow);",
+        "  [DllImport(\"user32.dll\")] public static extern bool SetForegroundWindow(IntPtr hWnd);",
+        "}",
+        "'@",
+        `$p = Get-Process -Id ${Number(pid)} -ErrorAction SilentlyContinue`,
+        "if ($p -and $p.MainWindowHandle -ne 0) {",
+        "  [Win32ShowWindow]::ShowWindowAsync($p.MainWindowHandle, 5) | Out-Null",
+        "  [Win32ShowWindow]::SetForegroundWindow($p.MainWindowHandle) | Out-Null",
+        "  'shown'",
+        "} else {",
+        "  'no-window'",
+        "}",
+      ].join("\n");
+      const result = spawnSync("powershell.exe", [
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        script,
+      ], {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 5000,
+      });
+      const stdout = String(result.stdout || "").trim();
+      if (stdout.includes("shown")) {
+        session.lastShownAt = new Date().toISOString();
+        return { shown: true, mode: "active_process", session_id, pid };
+      }
+    } catch (e) {
+      console.log(`[terminal] session ${session_id} active process show failed: ${e.message}`);
+    }
+  }
+
+  if (process.platform === "win32") {
+    try {
+      const title = `TinTin ${session.name || session_id}`;
+      const lines = [
+        `$Host.UI.RawUI.WindowTitle = ${JSON.stringify(title)}`,
+        `Set-Location -LiteralPath ${JSON.stringify(session.cwd || os.homedir())}`,
+        "Clear-Host",
+        `Write-Host ${JSON.stringify(`TinTin session ${session_id}`)} -ForegroundColor Cyan`,
+        `Write-Host ${JSON.stringify(`Name: ${session.name || ""}`)}`,
+        `Write-Host ${JSON.stringify(`Status: ${session.status}`)}`,
+        `Write-Host ${JSON.stringify(`CWD: ${session.cwd || ""}`)}`,
+        `Write-Host ${JSON.stringify(`Turn: ${session.turn || 0}`)}`,
+        `Write-Host ${JSON.stringify("This viewer is attached to clauth session metadata. If a Claude turn is active, terminal_show focuses it; otherwise this is the visible session inspection point.")} -ForegroundColor Yellow`,
+        "Write-Host ''",
+        "Write-Host 'Recent response preview:' -ForegroundColor Green",
+        `Write-Host ${JSON.stringify((session.lastResponse || "").slice(0, 1500))}`,
+        "Write-Host ''",
+        "Write-Host 'Leave this window open or close it when done.' -ForegroundColor DarkGray",
+      ].join("; ");
+      const child = spawnProc("powershell.exe", [
+        "-NoExit",
+        "-NoProfile",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-Command",
+        lines,
+      ], {
+        cwd: session.cwd || os.homedir(),
+        env: process.env,
+        stdio: "ignore",
+        detached: true,
+        windowsHide: false,
+      });
+      child.unref?.();
+      session.lastShownAt = new Date().toISOString();
+      return { shown: true, mode: "session_inspector", session_id, pid: child.pid || null };
+    } catch (e) {
+      return { error: "show_failed", message: e.message };
+    }
+  }
+
+  return {
+    shown: false,
+    mode: "unsupported_platform",
+    session_id,
+    message: "terminal_show currently opens/focuses local Windows sessions only.",
+  };
+}
+
 function stopTerminalSession(session_id) {
   const session = terminalSessions.get(session_id);
   if (!session) return { error: 'not_found', message: `Session ${session_id} not found` };
@@ -9227,6 +9463,8 @@ const MCP_TOOLS = [
         name:           { type: "string", description: "Human-readable session name (e.g. 'knowledgedude-prt')" },
         knowledge_tier: { type: "string", enum: ["db_only", "corpus", "project"], description: "Knowledge tier for the session. 'corpus' injects context_md as preamble." },
         context_md:     { type: "string", description: "Optional markdown preamble injected as session context (used for 'corpus' tier)" },
+        cwd:            { type: "string", description: "Optional working directory. Defaults to a neutral temp directory so browser chat avoids repo hooks." },
+        use_warm:       { type: "boolean", description: "Opt into experimental pinned warm-worker mode. Defaults to false for reliable browser chat turns." },
       },
       required: ["name"],
       additionalProperties: false,
@@ -9250,6 +9488,18 @@ const MCP_TOOLS = [
     description: "List all active terminal sessions with their status (ready/busy/stopped), knowledge tier, and start time.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
   },
+  {
+    name: "terminal_show",
+    description: "Reveal/focus a TinTin terminal session on this Windows machine. If no live Claude process window exists, opens a visible session inspector at the session cwd.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        session_id: { type: "string", description: "Session ID returned by terminal_start" },
+      },
+      required: ["session_id"],
+      additionalProperties: false,
+    },
+  },
   {
     name: "terminal_recv",
     description: "Read the last response from a terminal session. Returns response if ready, or status='busy' if still processing. Poll every 3-5 seconds until status='ready'.",
@@ -10995,10 +11245,10 @@ async function handleMcpTool(vault, name, args) {
     }
 
     case "terminal_start": {
-      const { name, knowledge_tier, context_md } = args;
+      const { name, knowledge_tier, context_md, use_warm, cwd: requestedCwd } = args;
       if (!name) return mcpError("name required");
-      const cwd = await resolveChitchatRoot(vault);
-      const result = startTerminalSession(name, knowledge_tier || 'db_only', context_md || null, cwd);
+      const cwd = requestedCwd ? path.resolve(String(requestedCwd)) : defaultTerminalCwd();
+      const result = startTerminalSession(name, knowledge_tier || 'db_only', context_md || null, cwd, use_warm === true);
       if (result.error) return mcpError(`${result.error}: ${result.message}`);
       return mcpResult(JSON.stringify(result));
     }
@@ -11015,6 +11265,14 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(JSON.stringify(listTerminalSessions()));
     }
 
+    case "terminal_show": {
+      const { session_id } = args;
+      if (!session_id) return mcpError("session_id required");
+      const result = showTerminalSession(session_id);
+      if (result.error) return mcpError(`${result.error}: ${result.message}`);
+      return mcpResult(JSON.stringify(result));
+    }
+
     case "terminal_recv": {
       const { session_id } = args;
       if (!session_id) return mcpError("session_id required");

package/cli/studio-debug.js

@@ -9,6 +9,7 @@ const MAX_POLL_TIMEOUT = 600_000;
 const MAX_EVENT_QUEUE = 100;
 const MAX_SNIPPET = 2_000;
 const STYLE_WRITE_EXTENSIONS = new Set([".css", ".scss", ".sass", ".less", ".html", ".jsx", ".tsx"]);
+const TEXT_WRITE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".html", ".md", ".txt", ".css", ".scss"]);
 
 const APP_TARGETS = {
   studio_test: {
@@ -99,16 +100,34 @@ function writeJson(res, status, data, cors) {
   res.end(JSON.stringify(data));
 }
 
-function resolveSourceFile(session, file) {
+function resolveSourceFile(session, file, allowedExtensions = STYLE_WRITE_EXTENSIONS) {
   if (!file || typeof file !== "string") return null;
   const root = path.resolve(session.repoRoot || session.cwd || process.cwd());
   const candidate = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file);
   const rel = path.relative(root, candidate);
   if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
-  if (!STYLE_WRITE_EXTENSIONS.has(path.extname(candidate).toLowerCase())) return null;
+  if (!allowedExtensions.has(path.extname(candidate).toLowerCase())) return null;
   return { root, path: candidate, relativePath: rel.replace(/\\/g, "/") };
 }
 
+function applyTextRangeEdit(sourceText, textEdit) {
+  const source = textEdit.source;
+  if (!source || !source.range || typeof source.range.start !== "number" || typeof source.range.end !== "number") {
+    throw new Error("text-write requires source.range.start and source.range.end.");
+  }
+  const { start, end } = source.range;
+  if (start < 0 || end < start || end > sourceText.length) {
+    throw new Error(`text-write source range [${start}, ${end}] is out of bounds (file length: ${sourceText.length}).`);
+  }
+  if (textEdit.oldText !== undefined) {
+    const oldSlice = sourceText.slice(start, end);
+    if (oldSlice !== textEdit.oldText) {
+      throw new Error(`text-write oldText mismatch at [${start}, ${end}]: expected "${String(textEdit.oldText).slice(0, 80)}", found "${oldSlice.slice(0, 80)}".`);
+    }
+  }
+  return `${sourceText.slice(0, start)}${textEdit.newText}${sourceText.slice(end)}`;
+}
+
 function escapeRegExp(value) {
   return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -451,6 +470,40 @@ export class StudioDebugSessionStore {
     return { ok: true, status: session.status, reply };
   }
 
+  writeText(sessionId, body) {
+    const auth = this.authenticate(sessionId, body.token);
+    if (auth.error) return auth;
+    const session = auth.session;
+    const textEdit = body.textEdit && typeof body.textEdit === "object" ? body.textEdit : {};
+    const source = textEdit.source && typeof textEdit.source === "object" ? textEdit.source : {};
+    const file = source.file || textEdit.file || body.file;
+    const fileInfo = resolveSourceFile(session, file, TEXT_WRITE_EXTENSIONS);
+    if (!fileInfo) {
+      return { error: "invalid_source", message: `text-write requires a source file inside the debug session repo (got: ${file || "(none)"}).` };
+    }
+    if (typeof textEdit.newText !== "string") {
+      return { error: "invalid_body", message: "text-write requires textEdit.newText." };
+    }
+    try {
+      const original = fs.readFileSync(fileInfo.path, "utf8");
+      const updated = applyTextRangeEdit(original, { ...textEdit, source });
+      fs.writeFileSync(fileInfo.path, updated, "utf8");
+      const reply = {
+        eventId: body.id || `text_${crypto.randomUUID()}`,
+        status: "done",
+        message: `Direct text write (source_replace [${source.range?.start}, ${source.range?.end}])`,
+        filesChanged: [fileInfo.relativePath],
+        createdAt: nowIso(),
+      };
+      session.replies.push(reply);
+      session.status = "done";
+      session.updatedAt = nowIso();
+      return { ok: true, status: "done", eventId: reply.eventId, filesChanged: reply.filesChanged };
+    } catch (err) {
+      return { error: "text_write_failed", message: err instanceof Error ? err.message : String(err) };
+    }
+  }
+
   writeStyle(sessionId, body) {
     const auth = this.authenticate(sessionId, body.token);
     if (auth.error) return auth;
@@ -551,7 +604,7 @@ export function createStudioDebugRuntime(options) {
       }
     }
 
-    const debugMatch = reqPath.match(/^\/studio\/debug\/([^/]+)\/(events|style-write|status|stop)$/);
+    const debugMatch = reqPath.match(/^\/studio\/debug\/([^/]+)\/(events|style-write|text-write|status|stop)$/);
     const claudeMatch = reqPath.match(/^\/studio\/claude\/([^/]+)\/(poll|reply|status)$/);
     if (!debugMatch && !claudeMatch) return false;
     const [, sessionId, action] = debugMatch || claudeMatch;
@@ -565,6 +618,10 @@ export function createStudioDebugRuntime(options) {
         const result = store.writeStyle(sessionId, await readBody(req));
         return writeJson(res, result.error === "unauthorized" ? 401 : result.error ? 400 : 200, result, cors);
       }
+      if (method === "POST" && action === "text-write") {
+        const result = store.writeText(sessionId, await readBody(req));
+        return writeJson(res, result.error === "unauthorized" ? 401 : result.error ? 400 : 200, result, cors);
+      }
       if (method === "GET" && action === "poll") {
         const result = await store.poll(sessionId, url.searchParams.get("token"), url.searchParams.get("timeout"));
         return writeJson(res, result.error === "unauthorized" ? 401 : result.error ? 404 : 200, result, cors);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.18.1",
+  "version": "1.19.2",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {