@lifeaitools/clauth 1.30.21 → 1.30.23

package/cli/served-script-syntax.test.mjs

@@ -0,0 +1,54 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import vm from 'node:vm';
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const cliEntry = path.join(here, 'index.js');
+const PORT = 52499;
+
+function waitForPort(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const attempt = async () => {
+    try {
+      const r = await fetch(url);
+      if (r.ok) return true;
+    } catch {}
+    if (Date.now() > deadline) throw new Error('timed out waiting for ' + url);
+    await new Promise((r) => setTimeout(r, 200));
+    return attempt();
+  };
+  return attempt();
+}
+
+// Regression coverage for the 2026-08-06 incident: a stray tool-authoring
+// artifact ("[char]0x2192" -- PowerShell character-literal syntax, never
+// evaluated because it was written inside a single-quoted PowerShell string)
+// landed as literal text inside the embedded dashboard <script> block. That
+// produced a real SyntaxError in every browser that loaded the page, so the
+// ENTIRE inline script failed to parse -- meaning unlock(), unlockWrites(),
+// runSupervisorSurface(), and every other function on the page silently
+// never existed. `node --check` on serve.js itself never catches this class
+// of bug: the broken text lives inside a JS string/template FOR the browser,
+// which is opaque to Node's own parser. This test extracts the actual served
+// script -- the same bytes a real browser executes -- and parses it for real.
+test('the served dashboard script has no syntax errors (would have caught the 2026-08-06 incident)', async () => {
+  const child = spawn(process.execPath, [cliEntry, 'serve', 'start', '--isolated', '--port', String(PORT)], {
+    stdio: 'ignore',
+    windowsHide: true,
+  });
+  try {
+    await waitForPort('http://127.0.0.1:' + PORT + '/ping', 15000);
+    const html = await fetch('http://127.0.0.1:' + PORT + '/').then((r) => r.text());
+    const start = html.indexOf('<script>');
+    const end = html.lastIndexOf('</script>');
+    assert.ok(start !== -1 && end !== -1, 'expected an inline <script> block in the served dashboard');
+    const js = html.slice(start + 8, end);
+    assert.doesNotThrow(() => new vm.Script(js), 'the served dashboard script must be syntactically valid JavaScript');
+  } finally {
+    await fetch('http://127.0.0.1:' + PORT + '/shutdown').catch(() => {});
+    child.kill();
+  }
+});

package/package.json

@@ -1,69 +1,69 @@
-{
-  "name": "@lifeaitools/clauth",
-  "version": "1.30.21",
-  "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
-  "type": "module",
-  "bin": {
-    "clauth": "./cli/index.js"
-  },
-  "scripts": {
-    "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js cli/supervisor-registry.test.js cli/supervisor-ui.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
-    "test:studio-debug": "node --test test/studio-debug.test.mjs",
-    "test:agent-pool": "node test/agent-pool.test.mjs",
-    "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",
-    "test:call-agent-guard": "node test/call-agent-guard.test.mjs",
-    "test:tintin-settings": "node test/tintin-settings.test.mjs",
-    "postinstall": "node scripts/postinstall.js",
-    "worker:start": "node cli/index.js serve",
-    "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
-    "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
-  },
-  "dependencies": {
-    "@vscode/ripgrep": "^1.15.9",
-    "chalk": "^5.3.0",
-    "commander": "^12.1.0",
-    "conf": "^13.0.0",
-    "fast-glob": "^3.3.2",
-    "inquirer": "^10.1.0",
-    "node-fetch": "^3.3.2",
-    "ora": "^8.1.0",
-    "regen-root": "file:../../regen-root.wt/x-claude-sv",
-    "typescript": "^5.9.3"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "keywords": [
-    "lifeai",
-    "credentials",
-    "vault",
-    "cli",
-    "prt"
-  ],
-  "author": "Dave Ladouceur <dave@life.ai>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/LIFEAI/clauth.git"
-  },
-  "devDependencies": {
-    "javascript-obfuscator": "^5.3.0"
-  },
-  "files": [
-    "cli/",
-    "scripts/bin/",
-    "scripts/bootstrap.cjs",
-    "scripts/build.sh",
-    "scripts/postinstall.js",
-    "supabase/",
-    ".clauth-skill/",
-    "install.sh",
-    "install.ps1",
-    "README.md"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "homepage": "https://github.com/LIFEAI/clauth"
-}
+{
+  "name": "@lifeaitools/clauth",
+  "version": "1.30.23",
+  "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
+  "type": "module",
+  "bin": {
+    "clauth": "./cli/index.js"
+  },
+  "scripts": {
+    "build": "bash scripts/build.sh",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js cli/supervisor-registry.test.js cli/supervisor-ui.test.js cli/served-script-syntax.test.mjs test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
+    "test:studio-debug": "node --test test/studio-debug.test.mjs",
+    "test:agent-pool": "node test/agent-pool.test.mjs",
+    "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",
+    "test:call-agent-guard": "node test/call-agent-guard.test.mjs",
+    "test:tintin-settings": "node test/tintin-settings.test.mjs",
+    "postinstall": "node scripts/postinstall.js",
+    "worker:start": "node cli/index.js serve",
+    "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
+    "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
+  },
+  "dependencies": {
+    "@vscode/ripgrep": "^1.15.9",
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "conf": "^13.0.0",
+    "fast-glob": "^3.3.2",
+    "inquirer": "^10.1.0",
+    "node-fetch": "^3.3.2",
+    "ora": "^8.1.0",
+    "regen-root": "file:../../regen-root.wt/x-claude-sv",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "keywords": [
+    "lifeai",
+    "credentials",
+    "vault",
+    "cli",
+    "prt"
+  ],
+  "author": "Dave Ladouceur <dave@life.ai>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/LIFEAI/clauth.git"
+  },
+  "devDependencies": {
+    "javascript-obfuscator": "^5.3.0"
+  },
+  "files": [
+    "cli/",
+    "scripts/bin/",
+    "scripts/bootstrap.cjs",
+    "scripts/build.sh",
+    "scripts/postinstall.js",
+    "supabase/",
+    ".clauth-skill/",
+    "install.sh",
+    "install.ps1",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/LIFEAI/clauth"
+}