@lifeaitools/clauth 1.30.12 → 1.30.14

package/cli/supervisor-registry.js

@@ -140,6 +140,10 @@ export function validatePluginManifest(manifest, sourcePath = "") {
     id,
     version,
     publisher: String(manifest.publisher || "unknown"),
+    // Only trusted managed manifests may opt into automatic startup. User
+    // plugins remain awaiting_enable until an operator explicitly enables them.
+    core: manifest.core === true,
+    enable_default: manifest.enable_default === true,
     sourcePath,
     destination: normalizeDestination(manifest.destination),
     lifecycle_owner: normalizeLifecycleOwner(manifest.lifecycle_owner),
@@ -226,15 +230,17 @@ export function discoverPlugins() {
           throw new Error("user plugin cannot silently shadow a managed plugin id");
         }
         const prior = byId.get(manifest.id);
-        const state = prior?.enabled ? (prior.manifest_hash === hash ? "current" : "version_drift") : "awaiting_enable";
-        const plugin = { ...manifest, source, discovery_root: root, manifest_hash: hash, state, enabled: Boolean(prior?.enabled), discovered_at: now() };
+        const autoEnabled = source === "managed" && manifest.core === true && manifest.enable_default === true;
+        const enabled = Boolean(prior?.enabled || autoEnabled);
+        const state = enabled ? (prior?.manifest_hash === hash || autoEnabled ? "current" : "version_drift") : "awaiting_enable";
+        const plugin = { ...manifest, source, discovery_root: root, manifest_hash: hash, state, enabled, discovered_at: now() };
         plugins.push(plugin);
         for (const surface of plugin.surfaces) surfaces.push({ ...surface, enabled: plugin.enabled, state });
         for (const credential of plugin.credentials) {
           events.push({ kind: "credential_required", plugin_id: plugin.id, credential, value_set: false });
         }
         seen.add(plugin.id);
-        events.push({ kind: "plugin_discovered", plugin_id: plugin.id, state, source, manifest_hash: hash });
+        events.push({ kind: autoEnabled && !prior?.enabled ? "core_plugin_auto_enabled" : "plugin_discovered", plugin_id: plugin.id, state, source, manifest_hash: hash });
       } catch (error) {
         const id = path.basename(path.dirname(manifestPath));
         plugins.push({

package/cli/supervisor-registry.test.js

@@ -109,6 +109,24 @@ test("discovery merges managed and user roots without silent managed-id shadowin
   assert.match(invalid.error, /shadow/);
 }));
 
+test("trusted managed core plugins auto-enable while user plugins remain opt-in", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  const user = path.join(root, "user");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = user;
+  writePlugin(root, "managed", "core-mcp", baseManifest("core-mcp", { core: true, enable_default: true }));
+  writePlugin(root, "user", "user-mcp", baseManifest("user-mcp", { core: true, enable_default: true }));
+
+  const result = discoverPlugins();
+  const core = result.plugins.find((plugin) => plugin.id === "core-mcp");
+  const userPlugin = result.plugins.find((plugin) => plugin.id === "user-mcp");
+  assert.equal(core.enabled, true);
+  assert.equal(core.state, "current");
+  assert.equal(result.events.some((event) => event.kind === "core_plugin_auto_enabled" && event.plugin_id === "core-mcp"), true);
+  assert.equal(userPlugin.enabled, false);
+  assert.equal(userPlugin.state, "awaiting_enable");
+}));
+
 test("plugin test marks a private candidate and never creates a public route", () => withTempSupervisor((root) => {
   const managed = path.join(root, "managed");
   process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;

package/cli/webdav-service.js

@@ -0,0 +1,339 @@
+// cli/webdav-service.js
+// WebDAV child-process supervisor — rclone serve webdav
+//
+// ISOLATION: This module has zero coupling to existing fs_* tool handlers.
+// Rollback: set webdav.enabled=false in the config block (or remove it)
+//           + delete this file + remove the two-line import in serve.js.
+//
+// Design: lazy-start. The rclone child spawns on the first fs_dav_setup call.
+// Subsequent calls return the running child's status without restarting.
+// On child crash: exponential-backoff restart loop (2s → 5s → 15s → 60s).
+
+import { spawn, execSync } from "child_process";
+import { writeFileSync, readFileSync, unlinkSync, mkdirSync, readdirSync } from "fs";
+import { tmpdir, homedir } from "os";
+import { join } from "path";
+import crypto from "crypto";
+import * as api from "./api.js";
+import { deriveToken } from "./fingerprint.js";
+
+const WEBDAV_PORT = 8620;
+const WEBDAV_USER = "claude";
+const CRED_NAME   = "webdav-claude";
+const RESTART_DELAYS = [2000, 5000, 15000, 60000];
+
+const APPDATA      = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+const CONFIG_PATH  = join(APPDATA, "clauth", "webdav-config.json");
+
+const DEFAULT_CONFIG = {
+  enabled: true,
+  port: WEBDAV_PORT,
+  credential: CRED_NAME,
+  upstreams: [],
+};
+
+// ── Config persistence ──────────────────────────────────────────
+
+export function loadConfig() {
+  try {
+    const raw = readFileSync(CONFIG_PATH, "utf8");
+    const cfg = JSON.parse(raw);
+    if (!Array.isArray(cfg.upstreams)) cfg.upstreams = [];
+    return { ...DEFAULT_CONFIG, ...cfg };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+
+export function saveConfig(cfg) {
+  const dir = join(APPDATA, "clauth");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), "utf8");
+  _fsCfgCache = null;
+}
+
+export function addMount(name, mountPath) {
+  const cfg = loadConfig();
+  if (cfg.upstreams.some(u => u.name === name)) return { error: `Mount '${name}' already exists` };
+  cfg.upstreams.push({ name, path: mountPath });
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function removeMount(name) {
+  const cfg = loadConfig();
+  const before = cfg.upstreams.length;
+  cfg.upstreams = cfg.upstreams.filter(u => u.name !== name);
+  if (cfg.upstreams.length === before) return { error: `Mount '${name}' not found` };
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function updateMount(name, updates) {
+  const cfg = loadConfig();
+  const mount = cfg.upstreams.find(u => u.name === name);
+  if (!mount) return { error: `Mount '${name}' not found` };
+  if (updates.credential !== undefined) cfg.credential = updates.credential;
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+let _fsCfgCache = null;
+
+// ── Module state ────────────────────────────────────────────────
+let _child       = null;
+let _configPath  = null;
+let _status      = "stopped";  // stopped | starting | running | error
+let _error       = null;
+let _restartCount = 0;
+let _startedAt   = null;
+let _vaultFn     = null;       // () => { password, machineHash }
+let _cfg         = null;
+
+// ── Public API ───────────────────────────────────────────────────
+
+/**
+ * Ensure the rclone WebDAV child is running.
+ * Idempotent — safe to call multiple times.
+ * Returns { ok: true } or { error: string }.
+ */
+export async function ensureRunning(vaultFn, config) {
+  if (vaultFn) _vaultFn = vaultFn;
+  if (config)  _cfg     = config;
+  if (!_cfg)   _cfg     = loadConfig();
+
+  if (_status === "running" && _child) return { ok: true };
+  if (_status === "starting")          return { ok: true, message: "still starting" };
+
+  return _startChild();
+}
+
+/** Current supervisor status — safe to call at any time. */
+export function getStatus() {
+  return {
+    status:        _status,
+    port:          WEBDAV_PORT,
+    url:           _status === "running" ? `http://127.0.0.1:${WEBDAV_PORT}` : null,
+    error:         _error || null,
+    restart_count: _restartCount,
+    started_at:    _startedAt || null,
+  };
+}
+
+/** Kill the child and clean up the temp config file. */
+export function shutdown() {
+  if (_child) {
+    _child.removeAllListeners();
+    _child.kill("SIGTERM");
+    _child = null;
+  }
+  _cleanupConfig();
+  _status = "stopped";
+}
+
+/**
+ * rclone-compatible AES-CTR "obscure" — same algorithm as `rclone obscure`.
+ * Used by fs_dav_setup to embed a non-plaintext credential in the mount script.
+ * The result can be passed as RCLONE_CONFIG_xxx_PASS.
+ */
+export function rcloneObscure(password) {
+  // Key from rclone source: lib/obscure/obscure.go  cryptKey
+  const key = Buffer.from([
+    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
+    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
+    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
+    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
+  ]);
+  const iv     = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv("aes-256-ctr", key, iv);
+  const ct     = Buffer.concat([cipher.update(Buffer.from(password, "utf8")), cipher.final()]);
+  return Buffer.concat([iv, ct]).toString("base64url");
+}
+
+// ── Internal ─────────────────────────────────────────────────────
+
+async function _startChild() {
+  _status = "starting";
+  _error  = null;
+
+  if (!_cfg?.upstreams?.length) {
+    _status = "error";
+    _error  = "No mount points configured — add them in the clauth dashboard";
+    return { error: _error };
+  }
+
+  // 1. Resolve credential from vault
+  let pass;
+  try {
+    const vault = _vaultFn?.();
+    if (!vault?.password) {
+      _status = "error";
+      _error  = "Vault is locked — unlock clauth first";
+      return { error: _error };
+    }
+    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+    const credName = _cfg.credential || CRED_NAME;
+    const result   = await api.retrieve(vault.password, vault.machineHash, token, timestamp, credName);
+    if (!result.value) {
+      _status = "error";
+      _error  = `Credential '${credName}' not found — register it in the vault first`;
+      return { error: _error };
+    }
+    pass = result.value;
+  } catch (err) {
+    _status = "error";
+    _error  = `Credential fetch failed: ${err.message}`;
+    return { error: _error };
+  }
+
+  // 2. Locate rclone
+  const rclonePath = _findRclone();
+  if (!rclonePath) {
+    _status = "error";
+    _error  = "rclone not found — install with: winget install Rclone.Rclone";
+    return { error: _error };
+  }
+
+  // 3. Write rclone config — combine backend with quoted entries for paths with spaces.
+  //    Per rclone docs: "dir=remote:path with space" (quote the whole entry).
+  const mounts = _cfg.upstreams || [];
+  const combineUpstreams = mounts
+    .map(u => `"${u.name}=${u.path.replace(/\\/g, "/")}"`)
+    .join(" ");
+  const configContent = `[srv]\ntype = combine\nupstreams = ${combineUpstreams}\n`;
+  _cleanupConfig();
+  _configPath = join(tmpdir(), `.rclone-webdav-${process.pid}.conf`);
+  try {
+    writeFileSync(_configPath, configContent, { mode: 0o600 });
+  } catch (err) {
+    _status = "error";
+    _error  = `Config write failed: ${err.message}`;
+    return { error: _error };
+  }
+
+  // 4. Spawn rclone
+  return new Promise(resolve => {
+    let settled = false;
+    const settle = (val) => { if (!settled) { settled = true; resolve(val); } };
+
+    try {
+      _child = spawn(rclonePath, [
+        "serve", "webdav", "srv:",
+        "--config",   _configPath,
+        "--addr",     `127.0.0.1:${WEBDAV_PORT}`,
+        "--user",     WEBDAV_USER,
+        "--pass",     pass,
+        "--no-modtime",
+        "--vfs-cache-mode", "full",
+        "--vfs-write-back", "0s",
+        "--ignore-size",
+        "--cache-dir", join(process.env.TEMP || tmpdir(), "rclone-dav-cache"),
+        "--transfers", "4",
+      ], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+
+    } catch (spawnErr) {
+      _child = null;
+      _status = "error";
+      _error  = spawnErr.message;
+      _cleanupConfig();
+      settle({ error: spawnErr.message });
+      return;
+    }
+
+    _child.stdout.on("data", () => {});
+
+    _child.stderr.on("data", (chunk) => {
+      const line = chunk.toString().trim();
+      if (line.includes("Serving WebDAV") || line.includes("Listening on")) {
+        _status    = "running";
+        _startedAt = new Date().toISOString();
+        settle({ ok: true });
+      }
+      // Surface errors but don't stop on every stderr line — rclone logs normally to stderr
+      if (/\berror\b/i.test(line) || /\bfatal\b/i.test(line)) {
+        _error = line.slice(0, 300);
+      }
+    });
+
+    _child.on("error", (err) => {
+      _child  = null;
+      _status = "error";
+      _error  = err.message;
+      _cleanupConfig();
+      settle({ error: err.message });
+      _scheduleRestart();
+    });
+
+    _child.on("exit", (code, signal) => {
+      _child = null;
+      if (signal === "SIGTERM" || signal === "SIGKILL" || code === 0) {
+        _status = "stopped";
+        _cleanupConfig();
+        return;
+      }
+      _status = "error";
+      _error  = `rclone exited unexpectedly (code=${code} signal=${signal})`;
+      _cleanupConfig();
+      settle({ error: _error });
+      _scheduleRestart();
+    });
+
+    // Optimistic fallback: if rclone doesn't print "Serving WebDAV" within 2s, assume running
+    setTimeout(() => {
+      if (_status === "starting") {
+        _status    = "running";
+        _startedAt = _startedAt || new Date().toISOString();
+      }
+      settle({ ok: true });
+    }, 2000);
+  });
+}
+
+function _scheduleRestart() {
+  const delay = RESTART_DELAYS[Math.min(_restartCount, RESTART_DELAYS.length - 1)];
+  _restartCount++;
+  setTimeout(() => {
+    if (_status === "stopped") return; // intentionally stopped, don't restart
+    _startChild();
+  }, delay);
+}
+
+function _cleanupConfig() {
+  if (_configPath) {
+    try { unlinkSync(_configPath); } catch {}
+    _configPath = null;
+  }
+}
+
+function _findRclone() {
+  const home = homedir();
+  const wingetBase = process.env.LOCALAPPDATA
+    ? join(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Packages")
+    : null;
+  const execOpts = { stdio: "pipe", timeout: 4000, windowsHide: true };
+
+  const candidates = [
+    "rclone",
+    "C:\\Program Files\\rclone\\rclone.exe",
+    join(home, "scoop", "apps", "rclone", "current", "rclone.exe"),
+    "C:\\ProgramData\\scoop\\apps\\rclone\\current\\rclone.exe",
+  ];
+
+  // Winget installs into a version-stamped subdirectory — glob for it
+  if (wingetBase) {
+    const wingetPkg = join(wingetBase, "Rclone.Rclone_Microsoft.Winget.Source_8wekyb3d8bbwe");
+    try {
+      for (const d of readdirSync(wingetPkg)) {
+        if (d.startsWith("rclone-")) candidates.push(join(wingetPkg, d, "rclone.exe"));
+      }
+    } catch {}
+  }
+
+  for (const c of candidates) {
+    try {
+      execSync(`"${c}" version`, execOpts);
+      return c;
+    } catch {}
+  }
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.12",
+  "version": "1.30.14",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,20 +8,28 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
+    "test:studio-debug": "node --test test/studio-debug.test.mjs",
+    "test:agent-pool": "node test/agent-pool.test.mjs",
+    "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",
+    "test:call-agent-guard": "node test/call-agent-guard.test.mjs",
+    "test:tintin-settings": "node test/tintin-settings.test.mjs",
     "postinstall": "node scripts/postinstall.js",
     "worker:start": "node cli/index.js serve",
     "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
     "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
   },
   "dependencies": {
+    "@vscode/ripgrep": "^1.15.9",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "conf": "^13.0.0",
+    "fast-glob": "^3.3.2",
     "inquirer": "^10.1.0",
     "node-fetch": "^3.3.2",
     "ora": "^8.1.0",
-    "@vscode/ripgrep": "^1.15.9",
-    "fast-glob": "^3.3.2"
+    "regen-root": "file:../../regen-root.wt/x-claude-sv",
+    "typescript": "^5.9.3"
   },
   "engines": {
     "node": ">=18.0.0"

package/scripts/postinstall.js

@@ -158,6 +158,31 @@ async function main() {
     installCodevelopTerminalProfiles();
   }
 
+  // Windows: install dependencies via winget if not already present
+  if (os.platform() === "win32") {
+    const deps = [
+      { cmd: "rclone", args: ["version"], wingetId: "Rclone.Rclone", label: "rclone (WebDAV bridge)" },
+      { cmd: "pwsh", args: ["--version"], wingetId: "Microsoft.PowerShell", label: "PowerShell 7 (fs_exec shell)" },
+    ];
+    for (const dep of deps) {
+      const check = spawnSync(dep.cmd, dep.args, { stdio: "pipe", timeout: 5000, windowsHide: true });
+      if (check.status === 0) {
+        console.log(`  ✓ ${dep.label} already installed`);
+      } else {
+        console.log(`  Installing ${dep.label}...`);
+        const r = spawnSync("winget", [
+          "install", "--id", dep.wingetId,
+          "--silent", "--accept-package-agreements", "--accept-source-agreements",
+        ], { stdio: "inherit", timeout: 120000 });
+        if (r.status === 0) {
+          console.log(`  ✓ ${dep.label} installed`);
+        } else {
+          console.log(`  ! ${dep.label} install skipped — install manually: winget install ${dep.wingetId}`);
+        }
+      }
+    }
+  }
+
   console.log("  Run 'clauth doctor' to verify installation\n");
 }