@lifeaitools/clauth 1.30.18 → 1.30.20

package/cli/commands/serve.js

@@ -41,9 +41,9 @@ import {
   listTunnels,
   readSupervisorEvents,
   addTunnelRoute,
-  removeTunnelRoute,
-  reconcileSurfaceHealth,
-  runPluginAction,
+  removeTunnelRoute,
+  reconcileSurfaceHealth,
+  runPluginAction,
   runSurfaceAction,
   setPluginEnabled,
   supervisorHealth,
@@ -486,7 +486,7 @@ const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 const LIVE_PORT = 52437;
 const STAGED_PORT = 52438;
 const WRITE_TOKEN_BYTES = 32;
-const WRITE_TOKEN_TTL_MS = 10 * 60 * 1000;
+const WRITE_TOKEN_TTL_MS = 30 * 60 * 1000;
 
 function makeWriteToken() {
   return {
@@ -677,6 +677,9 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-unlock:hover{background:#2563eb}
   .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
   .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
+  #write-unlock-overlay{display:none;position:fixed;inset:0;background:rgba(2,6,23,.72);z-index:9999;align-items:center;justify-content:center;padding:2rem}
+  .write-unlock-cancel{width:100%;background:transparent;color:#94a3b8;border:1px solid #334155;border-radius:8px;padding:8px;font-size:.85rem;cursor:pointer;margin-top:.6rem;transition:border-color .15s}
+  .write-unlock-cancel:hover{border-color:#64748b;color:#cbd5e1}
   /* ── Main view ── */
   #main-view{display:none;padding:2rem}
   .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
@@ -951,6 +954,24 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   </div>
 </div>
 
+<!-- Write-unlock modal (replaces window.prompt(), which silently no-ops in
+     embedded/webview browser contexts and after a browser suppresses repeated
+     native dialogs) -->
+<div id="write-unlock-overlay">
+  <div class="lock-card">
+    <div class="lock-icon">🔒</div>
+    <div class="lock-title">Enable writes</div>
+    <div class="lock-sub">Enter your vault password to enable saving changes (30-minute write session)</div>
+    <form onsubmit="submitWriteUnlock();return false;" autocomplete="on">
+      <input type="text" name="username" value="clauth" autocomplete="username" style="display:none">
+      <input class="lock-input" id="write-unlock-input" type="password" placeholder="••••••••••••" autocomplete="current-password">
+      <button class="btn-unlock" id="write-unlock-btn" type="submit">Unlock Writes</button>
+    </form>
+    <div class="lock-err" id="write-unlock-err"></div>
+    <button type="button" class="write-unlock-cancel" onclick="closeWriteUnlockModal()">Cancel</button>
+  </div>
+</div>
+
 <!-- ── Main view (shown after unlock) ──────── -->
 <div id="main-view">
   <div id="upgrade-banner" style="display:none" class="upgrade-banner">
@@ -1535,7 +1556,7 @@ function renderSupervisorSurface(surface) {
   return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
+    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.plugin_id + ":" + surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
 }
 
 async function rescanSupervisorPlugins() {
@@ -1641,24 +1662,63 @@ async function lockVault() {
   showLockScreen(r.hard_locked || false);
 }
 
-// ── Unlock writes (re-establish write scope without locking) ──
+// -- Unlock writes (re-establish write scope without locking) --
 // Needed when the daemon auto-unlocks via --pw/boot.key: the page never sees the
-// unlock screen, so it holds no write token. POST /auth mints one (10-min TTL).
-async function unlockWrites() {
-  if (writeToken && !confirm("Writes are already unlocked this session. Re-unlock?")) return;
-  const pw = prompt("Enter your vault password to enable saving changes (10-minute write session):");
-  if (!pw) return;
+// unlock screen, so it holds no write token. POST /auth mints one (30-min TTL).
+//
+// Uses an in-page modal rather than window.prompt()/confirm()/alert(): those
+// native dialogs silently no-op in embedded/webview browser contexts (VS Code
+// Simple Browser, WebView2, Electron wrappers) and after a real browser
+// suppresses repeated dialogs for a tab ("prevent this page from creating
+// additional dialogs") -- both cases fail with zero visible feedback.
+function unlockWrites() {
+  if (writeToken) {
+    if (!confirm("Writes are already unlocked this session. Re-unlock?")) return;
+  }
+  openWriteUnlockModal();
+}
+
+function openWriteUnlockModal() {
+  const overlay = document.getElementById("write-unlock-overlay");
+  const input = document.getElementById("write-unlock-input");
+  const err = document.getElementById("write-unlock-err");
+  if (err) err.textContent = "";
+  if (input) { input.value = ""; input.className = "lock-input"; }
+  if (overlay) overlay.style.display = "flex";
+  if (input) setTimeout(() => input.focus(), 50);
+}
+
+function closeWriteUnlockModal() {
+  const overlay = document.getElementById("write-unlock-overlay");
+  if (overlay) overlay.style.display = "none";
+}
+
+async function submitWriteUnlock() {
+  const input = document.getElementById("write-unlock-input");
+  const btn = document.getElementById("write-unlock-btn");
+  const err = document.getElementById("write-unlock-err");
+  const pw = input ? input.value : "";
+  if (!pw) { if (err) err.textContent = "Password is required."; return; }
+  if (btn) { btn.disabled = true; btn.textContent = "Verifying..."; }
   try {
     const r = await fetch(BASE + "/auth", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ password: pw }),
     }).then(r => r.json());
-    if (r.error) { alert("Unlock failed: " + r.error); return; }
+    if (r.error) {
+      if (input) { input.className = "lock-input error"; setTimeout(() => input.className = "lock-input", 600); }
+      if (err) err.textContent = "Invalid: " + (r.error || "Invalid password");
+      return;
+    }
     writeToken = r.write_token || null;
     refreshWriteLockUi();
-    alert(writeToken ? "Writes unlocked for 10 minutes." : "Unlock did not return a write token.");
-  } catch (e) { alert("Unlock error: " + (e.message || e)); }
+    closeWriteUnlockModal();
+  } catch (e) {
+    if (err) err.textContent = "Unlock error: " + (e.message || e);
+  } finally {
+    if (btn) { btn.disabled = false; btn.textContent = "Unlock Writes"; }
+  }
 }
 
 // Reflect write-lock state on the button so it is obvious when a save will fail.
@@ -7820,7 +7880,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   // If vault is already unlocked at startup (auto-unlock from boot.key skips POST /unlock),
   // mirror the tunnel-start logic that the unlock handler would have run.
-  if (initPassword) {
+  if (initPassword) {
     setImmediate(() => {
       if (tunnelHostname) {
         tunnelStatus = "starting";
@@ -7836,32 +7896,32 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           }
         }).catch(() => { tunnelStatus = "error"; });
       }
-    });
-  }
-
-  // The localhost supervisor is the only process allowed to repair clauth-owned
-  // local surfaces. Keep this loop out of the vault/staged instances and make
-  // the cadence configurable for deterministic tests.
-  if (port === getSupervisorPort() && process.env.CLAUTH_SUPERVISOR_HEALTH_RECONCILE !== "0") {
-    const configuredInterval = Number(process.env.CLAUTH_SUPERVISOR_HEALTH_INTERVAL_MS || 10000);
-    const intervalMs = Number.isFinite(configuredInterval) ? Math.max(1000, Math.min(configuredInterval, 300000)) : 10000;
-    let healthReconcileInFlight = false;
-    const runHealthReconcile = () => {
-      if (healthReconcileInFlight) return;
-      healthReconcileInFlight = true;
-      reconcileSurfaceHealth().catch((err) => {
-        try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] supervisor health reconcile failed: ${err.message}\n`); } catch {}
-      }).finally(() => { healthReconcileInFlight = false; });
-    };
-    const healthTimer = setInterval(runHealthReconcile, intervalMs);
-    healthTimer.unref?.();
-    server.__supervisorHealthTimer = healthTimer;
-    server.on("close", () => clearInterval(healthTimer));
-    setImmediate(runHealthReconcile);
-  }
-
-  return server;
-}
+    });
+  }
+
+  // The localhost supervisor is the only process allowed to repair clauth-owned
+  // local surfaces. Keep this loop out of the vault/staged instances and make
+  // the cadence configurable for deterministic tests.
+  if (port === getSupervisorPort() && process.env.CLAUTH_SUPERVISOR_HEALTH_RECONCILE !== "0") {
+    const configuredInterval = Number(process.env.CLAUTH_SUPERVISOR_HEALTH_INTERVAL_MS || 10000);
+    const intervalMs = Number.isFinite(configuredInterval) ? Math.max(1000, Math.min(configuredInterval, 300000)) : 10000;
+    let healthReconcileInFlight = false;
+    const runHealthReconcile = () => {
+      if (healthReconcileInFlight) return;
+      healthReconcileInFlight = true;
+      reconcileSurfaceHealth().catch((err) => {
+        try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] supervisor health reconcile failed: ${err.message}\n`); } catch {}
+      }).finally(() => { healthReconcileInFlight = false; });
+    };
+    const healthTimer = setInterval(runHealthReconcile, intervalMs);
+    healthTimer.unref?.();
+    server.__supervisorHealthTimer = healthTimer;
+    server.on("close", () => clearInterval(healthTimer));
+    setImmediate(runHealthReconcile);
+  }
+
+  return server;
+}
 
 // ── Actions ──────────────────────────────────────────────────