@lifeaitools/clauth 1.30.19 → 1.30.21

package/cli/commands/serve.js

@@ -933,7 +933,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
   .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
   .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
-  .supervisor-feedback{margin-top:8px;padding:7px 9px;border-radius:6px;font-family:'Courier New',monospace;font-size:.72rem;color:#86efac;background:rgba(34,197,94,.08);border:1px solid rgba(74,222,128,.22);display:none}
+  .supervisor-feedback{margin-top:8px;padding:9px 12px;border-radius:6px;font-family:'Courier New',monospace;font-size:.88rem;font-weight:600;color:#86efac;background:rgba(34,197,94,.12);border:1px solid rgba(74,222,128,.35);border-left:4px solid #4ade80;display:none}
   .supervisor-feedback.bad{color:#fecaca;background:rgba(248,113,113,.08);border-color:rgba(248,113,113,.25)}
 </style>
 </head>
@@ -1187,12 +1187,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div id="supervisor-status" class="supervisor-sub">Loading supervisor state…</div>
     <div id="supervisor-feedback" class="supervisor-feedback" role="status"></div>
     <div class="supervisor-grid" style="margin-top:10px">
-      <div class="supervisor-card">
-        <h4>Plugins</h4>
-        <div class="supervisor-kpi" id="supervisor-plugin-count">—</div>
-        <div class="supervisor-meta" id="supervisor-plugin-meta">awaiting data</div>
-        <div class="supervisor-list" id="supervisor-plugins" style="margin-top:8px"></div>
-      </div>
       <div class="supervisor-card">
         <h4>Surfaces</h4>
         <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
@@ -1515,21 +1509,16 @@ async function loadSupervisorCockpit() {
   const status = document.getElementById("supervisor-status");
   if (status) status.textContent = "Loading supervisor state…";
   try {
-    const [health, plugins, surfaces, logs] = await Promise.all([
+    const [health, surfaces, logs] = await Promise.all([
       supervisorJson("/health"),
-      supervisorJson("/v1/plugins"),
       supervisorJson("/v1/surfaces"),
       supervisorJson("/v1/logs?limit=40"),
     ]);
-    const pluginRows = plugins.plugins || [];
     const surfaceRows = surfaces.surfaces || [];
-    document.getElementById("supervisor-plugin-count").textContent = String(pluginRows.length);
     document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length);
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
-    document.getElementById("supervisor-plugin-meta").textContent = "current " + (pluginRows.filter(p => p.state === "current").length) + " · awaiting " + (pluginRows.filter(p => p.state === "awaiting_enable").length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
     document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
-    document.getElementById("supervisor-plugins").innerHTML = pluginRows.length ? pluginRows.map(renderSupervisorPlugin).join("") : '<div class="supervisor-sub">No plugins discovered.</div>';
     document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.length ? surfaceRows.map(renderSupervisorSurface).join("") : '<div class="supervisor-sub">No surfaces declared.</div>';
     document.getElementById("supervisor-events").textContent = (logs.events || []).slice(-20).reverse().map(e => {
       const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
@@ -1542,21 +1531,13 @@ async function loadSupervisorCockpit() {
   }
 }
 
-function renderSupervisorPlugin(plugin) {
-  const stateKind = plugin.state === "current" ? "ok" : (plugin.state === "manifest_invalid" || plugin.state === "missing" ? "bad" : "warn");
-  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(plugin.id) + '</span>' + supervisorBadge(plugin.state || "unknown", stateKind) + '</div>' +
-    '<div class="supervisor-meta">' + htmlEscape(plugin.publisher || "unknown") + ' · ' + htmlEscape(plugin.version || "—") + ' · ' + htmlEscape(plugin.source || "—") + '</div>' +
-    '<div class="supervisor-meta">' + htmlEscape((plugin.manifest_hash || "").slice(0, 12)) + '</div>' +
-    '<div class="supervisor-row-actions"><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg(plugin.enabled ? "disable" : "enable") + ')">' + (plugin.enabled ? "Disable" : "Enable") + '</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("test") + ')">Test</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("promote") + ')">Promote</button></div></div>';
-}
-
 function renderSupervisorSurface(surface) {
   const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
   const stateKind = surface.state === "current" || surface.status === "healthy" ? "ok" : (surface.state === "unavailable" ? "bad" : "warn");
   return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
+    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.plugin_id + ":" + surface.id) + ',' + jsArg(a) + ',this)">' + a + '</button>').join("") + '</div></div>';
 }
 
 async function rescanSupervisorPlugins() {
@@ -1567,21 +1548,23 @@ async function rescanSupervisorPlugins() {
   } catch (err) { supervisorFeedback("Plugin rescan failed: " + (err.message || err), true); }
 }
 
-async function runSupervisorPlugin(id, action) {
-  try {
-    const receipt = await supervisorJson("/v1/plugins/" + encodeURIComponent(id) + "/" + encodeURIComponent(action), { method: "POST", headers: writeHeaders() });
-    supervisorFeedback("Plugin " + action + " receipt " + (receipt.operationId || "recorded") + " · " + ((receipt.resulting_state && receipt.resulting_state.state) || "completed"), false);
-    await loadSupervisorCockpit();
-  } catch (err) { supervisorFeedback("Plugin " + action + " failed: " + (err.message || err), true); }
-}
-
-async function runSupervisorSurface(id, action) {
+async function runSupervisorSurface(id, action, btn) {
+  const originalLabel = btn ? btn.textContent : null;
+  if (btn) { btn.disabled = true; btn.textContent = "..."; btn.style.opacity = "0.6"; }
+  supervisorFeedback(action + " " + id + ": sending...", false);
   try {
     const receipt = await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
     const result = receipt.resulting_state || {};
-    supervisorFeedback("Surface " + action + " receipt " + (receipt.operationId || "recorded") + " · " + (result.state || "completed"), result.ok === false);
+    const ok = result.ok !== false;
+    if (btn) { btn.textContent = ok ? "done" : "failed"; btn.style.background = ok ? "#14532d" : "#7f1d1d"; }
+    supervisorFeedback(id + " " + action + " " + (ok ? "succeeded" : "failed") + " " + [char]0x2192 + " " + (result.state || result.reason || "completed"), !ok);
+    await new Promise((resolve) => setTimeout(resolve, 700));
     await loadSupervisorCockpit();
-  } catch (err) { supervisorFeedback("Surface " + action + " failed: " + (err.message || err), true); }
+  } catch (err) {
+    if (btn) { btn.textContent = "failed"; btn.style.background = "#7f1d1d"; }
+    supervisorFeedback(id + " " + action + " failed: " + (err.message || err), true);
+    if (btn) { setTimeout(() => { btn.disabled = false; btn.textContent = originalLabel; btn.style.opacity = ""; btn.style.background = ""; }, 2500); }
+  }
 }
 
 // ── Unlock ──────────────────────────────────

package/cli/supervisor-ui.test.js

@@ -1,16 +1,94 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const serveSource = fs.readFileSync(path.join(here, 'commands', 'serve.js'), 'utf8');
-
-test('clauth supervisor UI exposes every lifecycle action and receipt feedback', () => {
-  for (const action of ['start', 'stop', 'restart', 'reconcile', 'test', 'promote', 'rollback']) {
-    assert.match(serveSource, new RegExp('"' + action + '"'));
-  }
-  assert.match(serveSource, /supervisorFeedback\(/);
-  assert.match(serveSource, /supervisor-feedback/);
-});
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listSurfaces, listPlugins, runSurfaceAction, runPluginAction } from './supervisor-registry.js';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const serveSource = fs.readFileSync(path.join(here, 'commands', 'serve.js'), 'utf8');
+
+// Regression coverage for the 2026-08-06 incident: every surface across every
+// plugin shares the bare id "primary", and the dashboard's onclick handlers
+// sent that bare id instead of the plugin-qualified "plugin_id:id" that
+// findSurface() already supported. The server-side .find() always resolved
+// to the FIRST surface in the array (codeflow-mcp), which unconditionally
+// rejects every action as self-owned -- so all 49 buttons (7 surfaces x 7
+// actions) silently hit the same surface and appeared to do nothing, on
+// every surface, for every action. The prior test in this file only
+// regex-matched that the action-name strings existed in source; it would
+// pass under this exact bug. These tests exercise the real resolution path
+// through the same exported functions the HTTP routes call (POST
+// /v1/surfaces/:id/actions -> runSurfaceAction; POST /v1/plugins/:id/:action
+// -> runPluginAction), which is the same simulate-a-button-click contract as
+// the dashboard onclick handlers use, without needing a browser.
+
+test('the dashboard encodes a plugin-qualified surface id, not the bare (colliding) surface.id', () => {
+  assert.match(
+    serveSource,
+    /jsArg\(surface\.plugin_id \+ ":" \+ surface\.id\)/,
+    'renderSupervisorSurface must send plugin_id:id, not the bare surface.id shared by every surface'
+  );
+});
+
+test('every real surface exists and every surface id collides with at least one other (documents why plugin_id is required)', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length > 1, 'expected more than one discovered surface to make this regression possible');
+  const bareIds = new Set(surfaces.map((s) => s.id));
+  assert.equal(bareIds.size, 1, 'expected every discovered surface to share the same bare id ("primary") -- if this ever stops being true, the plugin_id qualifier is still correct but this documentation test should be updated');
+});
+
+test('runSurfaceAction resolves the plugin-qualified id to that exact surface, not a different one', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length >= 1, 'no surfaces discovered -- cannot verify resolution');
+  for (const surface of surfaces) {
+    const compositeId = surface.plugin_id + ':' + surface.id;
+    // action "test" is the designed no-op/safe action -- it never touches a
+    // real process, it only records a receipt, which is exactly what a
+    // verification harness should use.
+    const receipt = runSurfaceAction(compositeId, 'test', 'supervisor-ui.test.js');
+    assert.ok(!receipt.error, 'surface ' + compositeId + ' resolution failed: ' + receipt.error);
+    assert.equal(
+      receipt.prior_state?.plugin_id,
+      surface.plugin_id,
+      'requested surface ' + compositeId + ' but runSurfaceAction resolved a different surface owned by "' + receipt.prior_state?.plugin_id + '" -- this is the exact 2026-08-06 regression'
+    );
+    assert.equal(receipt.target.surface_id, compositeId);
+  }
+});
+
+test('bare (unqualified) surface id is ambiguous: it always resolves to the same single surface regardless of which surface was intended', () => {
+  const surfaces = listSurfaces();
+  assert.ok(surfaces.length > 1, 'need multiple surfaces to demonstrate ambiguity');
+  const bareId = surfaces[0].id;
+  const receiptsByBareId = surfaces.map(() => runSurfaceAction(bareId, 'test', 'supervisor-ui.test.js'));
+  const resolvedOwners = new Set(receiptsByBareId.map((r) => r.prior_state?.plugin_id));
+  assert.equal(
+    resolvedOwners.size,
+    1,
+    'expected the bare id to be ambiguous (always resolve to one surface) -- if this now resolves multiple owners, the collision this test guards against has already been fixed at the id level and this test can be removed'
+  );
+});
+
+test('every one of the 7 button actions is exercised end-to-end through runSurfaceAction for every discovered surface', () => {
+  const actions = ['start', 'stop', 'restart', 'reconcile', 'test', 'promote', 'rollback'];
+  const surfaces = listSurfaces();
+  for (const surface of surfaces) {
+    const compositeId = surface.plugin_id + ':' + surface.id;
+    for (const action of actions) {
+      const receipt = runSurfaceAction(compositeId, action, 'supervisor-ui.test.js');
+      assert.notEqual(receipt.error, 'surface_not_found', compositeId + ' / ' + action + ' could not resolve the surface');
+      assert.notEqual(receipt.error, 'invalid_action', compositeId + ' / ' + action + ' is not a recognized action');
+      assert.equal(receipt.prior_state?.plugin_id, surface.plugin_id, compositeId + ' / ' + action + ' resolved the wrong surface');
+    }
+  }
+});
+
+test('every plugin-level action is reachable through runPluginAction for every discovered plugin', () => {
+  const plugins = listPlugins();
+  assert.ok(plugins.length > 0, 'no plugins discovered');
+  for (const plugin of plugins) {
+    const receipt = runPluginAction(plugin.id, 'test', 'supervisor-ui.test.js');
+    assert.notEqual(receipt.error, 'plugin_not_found', plugin.id + ' could not be resolved by its own id');
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.19",
+  "version": "1.30.21",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js cli/supervisor-registry.test.js cli/supervisor-ui.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
     "test:studio-debug": "node --test test/studio-debug.test.mjs",
     "test:agent-pool": "node test/agent-pool.test.mjs",
     "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",