@lifeaitools/clauth 1.30.19 → 1.30.20

package/cli/commands/serve.js

@@ -1556,7 +1556,7 @@ function renderSupervisorSurface(surface) {
   return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
+    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.plugin_id + ":" + surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
 }
 
 async function rescanSupervisorPlugins() {

package/cli/supervisor-ui.test.js

@@ -1,16 +1,94 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const serveSource = fs.readFileSync(path.join(here, 'commands', 'serve.js'), 'utf8');
-
-test('clauth supervisor UI exposes every lifecycle action and receipt feedback', () => {
-  for (const action of ['start', 'stop', 'restart', 'reconcile', 'test', 'promote', 'rollback']) {
-    assert.match(serveSource, new RegExp('"' + action + '"'));
-  }
-  assert.match(serveSource, /supervisorFeedback\(/);
-  assert.match(serveSource, /supervisor-feedback/);
-});
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listSurfaces, listPlugins, runSurfaceAction, runPluginAction } from './supervisor-registry.js';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const serveSource = fs.readFileSync(path.join(here, 'commands', 'serve.js'), 'utf8');
+
+// Regression coverage for the 2026-08-06 incident: every surface across every
+// plugin shares the bare id "primary", and the dashboard's onclick handlers
+// sent that bare id instead of the plugin-qualified "plugin_id:id" that
+// findSurface() already supported. The server-side .find() always resolved
+// to the FIRST surface in the array (codeflow-mcp), which unconditionally
+// rejects every action as self-owned -- so all 49 buttons (7 surfaces x 7
+// actions) silently hit the same surface and appeared to do nothing, on
+// every surface, for every action. The prior test in this file only
+// regex-matched that the action-name strings existed in source; it would
+// pass under this exact bug. These tests exercise the real resolution path
+// through the same exported functions the HTTP routes call (POST
+// /v1/surfaces/:id/actions -> runSurfaceAction; POST /v1/plugins/:id/:action
+// -> runPluginAction), which is the same simulate-a-button-click contract as
+// the dashboard onclick handlers use, without needing a browser.
+
+test('the dashboard encodes a plugin-qualified surface id, not the bare (colliding) surface.id', () => {
+  assert.match(
+    serveSource,
+    /jsArg\(surface\.plugin_id \+ ":" \+ surface\.id\)/,
+    'renderSupervisorSurface must send plugin_id:id, not the bare surface.id shared by every surface'
+  );
+});
+
+test('every real surface exists and every surface id collides with at least one other (documents why plugin_id is required)', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length > 1, 'expected more than one discovered surface to make this regression possible');
+  const bareIds = new Set(surfaces.map((s) => s.id));
+  assert.equal(bareIds.size, 1, 'expected every discovered surface to share the same bare id ("primary") -- if this ever stops being true, the plugin_id qualifier is still correct but this documentation test should be updated');
+});
+
+test('runSurfaceAction resolves the plugin-qualified id to that exact surface, not a different one', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length >= 1, 'no surfaces discovered -- cannot verify resolution');
+  for (const surface of surfaces) {
+    const compositeId = surface.plugin_id + ':' + surface.id;
+    // action "test" is the designed no-op/safe action -- it never touches a
+    // real process, it only records a receipt, which is exactly what a
+    // verification harness should use.
+    const receipt = runSurfaceAction(compositeId, 'test', 'supervisor-ui.test.js');
+    assert.ok(!receipt.error, 'surface ' + compositeId + ' resolution failed: ' + receipt.error);
+    assert.equal(
+      receipt.prior_state?.plugin_id,
+      surface.plugin_id,
+      'requested surface ' + compositeId + ' but runSurfaceAction resolved a different surface owned by "' + receipt.prior_state?.plugin_id + '" -- this is the exact 2026-08-06 regression'
+    );
+    assert.equal(receipt.target.surface_id, compositeId);
+  }
+});
+
+test('bare (unqualified) surface id is ambiguous: it always resolves to the same single surface regardless of which surface was intended', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length > 1, 'need multiple surfaces to demonstrate ambiguity');
+  const bareId = surfaces[0].id;
+  const receiptsByBareId = surfaces.map(() => runSurfaceAction(bareId, 'test', 'supervisor-ui.test.js'));
+  const resolvedOwners = new Set(receiptsByBareId.map((r) => r.prior_state?.plugin_id));
+  assert.equal(
+    resolvedOwners.size,
+    1,
+    'expected the bare id to be ambiguous (always resolve to one surface) -- if this now resolves multiple owners, the collision this test guards against has already been fixed at the id level and this test can be removed'
+  );
+});
+
+test('every one of the 7 button actions is exercised end-to-end through runSurfaceAction for every discovered surface', () => {
+  const actions = ['start', 'stop', 'restart', 'reconcile', 'test', 'promote', 'rollback'];
+  const surfaces = listSurfaces();
+  for (const surface of surfaces) {
+    const compositeId = surface.plugin_id + ':' + surface.id;
+    for (const action of actions) {
+      const receipt = runSurfaceAction(compositeId, action, 'supervisor-ui.test.js');
+      assert.notEqual(receipt.error, 'surface_not_found', compositeId + ' / ' + action + ' could not resolve the surface');
+      assert.notEqual(receipt.error, 'invalid_action', compositeId + ' / ' + action + ' is not a recognized action');
+      assert.equal(receipt.prior_state?.plugin_id, surface.plugin_id, compositeId + ' / ' + action + ' resolved the wrong surface');
+    }
+  }
+});
+
+test('every plugin-level action is reachable through runPluginAction for every discovered plugin', () => {
+  const plugins = listPlugins();
+  assert.ok(plugins.length > 0, 'no plugins discovered');
+  for (const plugin of plugins) {
+    const receipt = runPluginAction(plugin.id, 'test', 'supervisor-ui.test.js');
+    assert.notEqual(receipt.error, 'plugin_not_found', plugin.id + ' could not be resolved by its own id');
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.19",
+  "version": "1.30.20",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js cli/supervisor-registry.test.js cli/supervisor-ui.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
     "test:studio-debug": "node --test test/studio-debug.test.mjs",
     "test:agent-pool": "node test/agent-pool.test.mjs",
     "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",