@lifeaitools/clauth 1.30.23 → 1.30.24

package/cli/commands/scrub.test.js

@@ -1,115 +1,115 @@
-// node --test cli/commands/scrub.test.js
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import {
-  PATTERNS,
-  findTranscripts,
-  scrubFile,
-  isSecretLike,
-  loadExtraPatterns,
-  sessionTargets,
-} from "./scrub.js";
-
-const GH_TOKEN = "ghp_0123456789abcdefABCDEF0123456789abcd"; // ghp_ + 36 chars
-const VAULT_VALUE = "SuperSecretVaultValue_abc123XYZ";        // secret-like literal
-const CUSTOM_SECRET = "MYCORP-TOKEN-998877";                  // only an editable pattern catches it
-
-function seedProjects() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-scrub-"));
-  const sess = path.join(root, "proj", "session-uuid");
-  const sidecarDir = path.join(sess, "tool-results");
-  fs.mkdirSync(sidecarDir, { recursive: true });
-
-  const jsonl = path.join(root, "proj", "session-uuid.jsonl");
-  const txt = path.join(sidecarDir, "toolu_abc.txt");
-  const body = `token=${GH_TOKEN} value=${VAULT_VALUE} custom=${CUSTOM_SECRET}\n`;
-  fs.writeFileSync(jsonl, `{"x":"${body.trim()}"}\n`, "utf-8");
-  fs.writeFileSync(txt, body, "utf-8"); // the sidecar that the old scrubber skipped
-  return { root, jsonl, txt };
-}
-
-test("findTranscripts discovers .jsonl AND tool-results/*.txt sidecars", () => {
-  const { root, jsonl, txt } = seedProjects();
-  const found = findTranscripts(root);
-  assert.ok(found.includes(jsonl), "should find the .jsonl transcript");
-  assert.ok(found.includes(txt), "should find the .txt sidecar (the previously-skipped leak path)");
-});
-
-test("scrubFile redacts the github token in BOTH the jsonl and the sidecar", () => {
-  const { jsonl, txt } = seedProjects();
-  for (const f of [jsonl, txt]) {
-    const n = scrubFile(f, { force: true, patterns: PATTERNS, literals: [] });
-    assert.ok(n >= 1, `expected >=1 redaction in ${path.basename(f)}`);
-    const after = fs.readFileSync(f, "utf-8");
-    assert.ok(!after.includes(GH_TOKEN), "github token must be gone");
-    assert.ok(after.includes("[GITHUB_TOKEN_REDACTED]"), "redaction marker present");
-    assert.ok(after.includes("[CLAUTH-SCRUBBED]"), "file stamped as scrubbed");
-  }
-});
-
-test("vault-value (literal) redaction removes an arbitrary secret regardless of format", () => {
-  const { txt } = seedProjects();
-  const n = scrubFile(txt, { force: true, patterns: [], literals: [{ name: "test-svc", value: VAULT_VALUE }] });
-  assert.equal(n, 1, "exactly one literal occurrence redacted");
-  const after = fs.readFileSync(txt, "utf-8");
-  assert.ok(!after.includes(VAULT_VALUE), "vault value must be gone");
-  assert.ok(after.includes("[CLAUTH:test-svc_REDACTED]"), "labelled vault redaction present");
-});
-
-test("editable patterns file catches a custom secret with no clauth release", () => {
-  const cfg = path.join(os.tmpdir(), `clauth-scrub-patterns-${Date.now()}.json`);
-  fs.writeFileSync(cfg, JSON.stringify([{ pattern: "MYCORP-TOKEN-\\d+", replacement: "[MYCORP_REDACTED]" }]), "utf-8");
-  const extra = loadExtraPatterns(cfg);
-  assert.equal(extra.length, 1, "one extra pattern loaded");
-
-  const { txt } = seedProjects();
-  const n = scrubFile(txt, { force: true, patterns: extra, literals: [] });
-  assert.ok(n >= 1, "custom pattern matched");
-  const after = fs.readFileSync(txt, "utf-8");
-  assert.ok(!after.includes(CUSTOM_SECRET), "custom secret gone");
-  assert.ok(after.includes("[MYCORP_REDACTED]"), "custom replacement applied");
-  fs.rmSync(cfg, { force: true });
-});
-
-test("isSecretLike: accepts real tokens, rejects short/url/whitespace values", () => {
-  assert.ok(isSecretLike(GH_TOKEN), "long token is secret-like");
-  assert.ok(isSecretLike(VAULT_VALUE), "31-char no-space value is secret-like");
-  assert.ok(!isSecretLike("short"), "short value rejected");
-  assert.ok(!isSecretLike("https://research.regendevcorp.com/mcp"), "plain URL rejected");
-  assert.ok(!isSecretLike("has spaces in it value"), "whitespace value rejected");
-  assert.ok(!isSecretLike(""), "empty rejected");
-});
-
-test("sessionTargets returns ONLY the ending session's transcript + its sidecars", () => {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-sess-"));
-  const proj = path.join(root, "C--proj");
-  const sid = "11112222-3333-4444-5555-666677778888";
-  fs.mkdirSync(path.join(proj, sid, "tool-results"), { recursive: true });
-  const transcript = path.join(proj, `${sid}.jsonl`);
-  const sidecar = path.join(proj, sid, "tool-results", "toolu_x.txt");
-  const otherSession = path.join(proj, "99990000-aaaa-bbbb-cccc-ddddeeeeffff.jsonl");
-  fs.writeFileSync(transcript, "{}\n");
-  fs.writeFileSync(sidecar, "tool output\n");
-  fs.writeFileSync(otherSession, "{}\n"); // a DIFFERENT session — must NOT be included
-
-  const targets = sessionTargets({ transcript_path: transcript, session_id: sid });
-  assert.ok(targets.includes(transcript), "includes the session transcript");
-  assert.ok(targets.includes(sidecar), "includes the session's sidecar");
-  assert.ok(!targets.includes(otherSession), "does NOT include other sessions (session-only)");
-  assert.equal(targets.length, 2, "exactly the 2 session files");
-
-  assert.deepEqual(sessionTargets(null), [], "no hook input → no targets (caller falls back)");
-  assert.deepEqual(sessionTargets({ transcript_path: path.join(root, "nope.jsonl") }), [], "missing file → none");
-});
-
-test("loadExtraPatterns tolerates a missing/malformed file", () => {
-  assert.deepEqual(loadExtraPatterns(path.join(os.tmpdir(), "does-not-exist-xyz.json")), []);
-  const bad = path.join(os.tmpdir(), `clauth-bad-${Date.now()}.json`);
-  fs.writeFileSync(bad, "{ not json", "utf-8");
-  assert.deepEqual(loadExtraPatterns(bad), [], "malformed json → empty, never throws");
-  fs.rmSync(bad, { force: true });
-});
+// node --test cli/commands/scrub.test.js
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  PATTERNS,
+  findTranscripts,
+  scrubFile,
+  isSecretLike,
+  loadExtraPatterns,
+  sessionTargets,
+} from "./scrub.js";
+
+const GH_TOKEN = "ghp_0123456789abcdefABCDEF0123456789abcd"; // ghp_ + 36 chars
+const VAULT_VALUE = "SuperSecretVaultValue_abc123XYZ";        // secret-like literal
+const CUSTOM_SECRET = "MYCORP-TOKEN-998877";                  // only an editable pattern catches it
+
+function seedProjects() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-scrub-"));
+  const sess = path.join(root, "proj", "session-uuid");
+  const sidecarDir = path.join(sess, "tool-results");
+  fs.mkdirSync(sidecarDir, { recursive: true });
+
+  const jsonl = path.join(root, "proj", "session-uuid.jsonl");
+  const txt = path.join(sidecarDir, "toolu_abc.txt");
+  const body = `token=${GH_TOKEN} value=${VAULT_VALUE} custom=${CUSTOM_SECRET}\n`;
+  fs.writeFileSync(jsonl, `{"x":"${body.trim()}"}\n`, "utf-8");
+  fs.writeFileSync(txt, body, "utf-8"); // the sidecar that the old scrubber skipped
+  return { root, jsonl, txt };
+}
+
+test("findTranscripts discovers .jsonl AND tool-results/*.txt sidecars", () => {
+  const { root, jsonl, txt } = seedProjects();
+  const found = findTranscripts(root);
+  assert.ok(found.includes(jsonl), "should find the .jsonl transcript");
+  assert.ok(found.includes(txt), "should find the .txt sidecar (the previously-skipped leak path)");
+});
+
+test("scrubFile redacts the github token in BOTH the jsonl and the sidecar", () => {
+  const { jsonl, txt } = seedProjects();
+  for (const f of [jsonl, txt]) {
+    const n = scrubFile(f, { force: true, patterns: PATTERNS, literals: [] });
+    assert.ok(n >= 1, `expected >=1 redaction in ${path.basename(f)}`);
+    const after = fs.readFileSync(f, "utf-8");
+    assert.ok(!after.includes(GH_TOKEN), "github token must be gone");
+    assert.ok(after.includes("[GITHUB_TOKEN_REDACTED]"), "redaction marker present");
+    assert.ok(after.includes("[CLAUTH-SCRUBBED]"), "file stamped as scrubbed");
+  }
+});
+
+test("vault-value (literal) redaction removes an arbitrary secret regardless of format", () => {
+  const { txt } = seedProjects();
+  const n = scrubFile(txt, { force: true, patterns: [], literals: [{ name: "test-svc", value: VAULT_VALUE }] });
+  assert.equal(n, 1, "exactly one literal occurrence redacted");
+  const after = fs.readFileSync(txt, "utf-8");
+  assert.ok(!after.includes(VAULT_VALUE), "vault value must be gone");
+  assert.ok(after.includes("[CLAUTH:test-svc_REDACTED]"), "labelled vault redaction present");
+});
+
+test("editable patterns file catches a custom secret with no clauth release", () => {
+  const cfg = path.join(os.tmpdir(), `clauth-scrub-patterns-${Date.now()}.json`);
+  fs.writeFileSync(cfg, JSON.stringify([{ pattern: "MYCORP-TOKEN-\\d+", replacement: "[MYCORP_REDACTED]" }]), "utf-8");
+  const extra = loadExtraPatterns(cfg);
+  assert.equal(extra.length, 1, "one extra pattern loaded");
+
+  const { txt } = seedProjects();
+  const n = scrubFile(txt, { force: true, patterns: extra, literals: [] });
+  assert.ok(n >= 1, "custom pattern matched");
+  const after = fs.readFileSync(txt, "utf-8");
+  assert.ok(!after.includes(CUSTOM_SECRET), "custom secret gone");
+  assert.ok(after.includes("[MYCORP_REDACTED]"), "custom replacement applied");
+  fs.rmSync(cfg, { force: true });
+});
+
+test("isSecretLike: accepts real tokens, rejects short/url/whitespace values", () => {
+  assert.ok(isSecretLike(GH_TOKEN), "long token is secret-like");
+  assert.ok(isSecretLike(VAULT_VALUE), "31-char no-space value is secret-like");
+  assert.ok(!isSecretLike("short"), "short value rejected");
+  assert.ok(!isSecretLike("https://research.regendevcorp.com/mcp"), "plain URL rejected");
+  assert.ok(!isSecretLike("has spaces in it value"), "whitespace value rejected");
+  assert.ok(!isSecretLike(""), "empty rejected");
+});
+
+test("sessionTargets returns ONLY the ending session's transcript + its sidecars", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-sess-"));
+  const proj = path.join(root, "C--proj");
+  const sid = "11112222-3333-4444-5555-666677778888";
+  fs.mkdirSync(path.join(proj, sid, "tool-results"), { recursive: true });
+  const transcript = path.join(proj, `${sid}.jsonl`);
+  const sidecar = path.join(proj, sid, "tool-results", "toolu_x.txt");
+  const otherSession = path.join(proj, "99990000-aaaa-bbbb-cccc-ddddeeeeffff.jsonl");
+  fs.writeFileSync(transcript, "{}\n");
+  fs.writeFileSync(sidecar, "tool output\n");
+  fs.writeFileSync(otherSession, "{}\n"); // a DIFFERENT session — must NOT be included
+
+  const targets = sessionTargets({ transcript_path: transcript, session_id: sid });
+  assert.ok(targets.includes(transcript), "includes the session transcript");
+  assert.ok(targets.includes(sidecar), "includes the session's sidecar");
+  assert.ok(!targets.includes(otherSession), "does NOT include other sessions (session-only)");
+  assert.equal(targets.length, 2, "exactly the 2 session files");
+
+  assert.deepEqual(sessionTargets(null), [], "no hook input → no targets (caller falls back)");
+  assert.deepEqual(sessionTargets({ transcript_path: path.join(root, "nope.jsonl") }), [], "missing file → none");
+});
+
+test("loadExtraPatterns tolerates a missing/malformed file", () => {
+  assert.deepEqual(loadExtraPatterns(path.join(os.tmpdir(), "does-not-exist-xyz.json")), []);
+  const bad = path.join(os.tmpdir(), `clauth-bad-${Date.now()}.json`);
+  fs.writeFileSync(bad, "{ not json", "utf-8");
+  assert.deepEqual(loadExtraPatterns(bad), [], "malformed json → empty, never throws");
+  fs.rmSync(bad, { force: true });
+});

package/cli/commands/serve.js

@@ -486,7 +486,7 @@ const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 const LIVE_PORT = 52437;
 const STAGED_PORT = 52438;
 const WRITE_TOKEN_BYTES = 32;
-const WRITE_TOKEN_TTL_MS = 30 * 60 * 1000;
+const WRITE_TOKEN_TTL_MS = 10 * 60 * 1000;
 
 function makeWriteToken() {
   return {
@@ -677,9 +677,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-unlock:hover{background:#2563eb}
   .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
   .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
-  #write-unlock-overlay{display:none;position:fixed;inset:0;background:rgba(2,6,23,.72);z-index:9999;align-items:center;justify-content:center;padding:2rem}
-  .write-unlock-cancel{width:100%;background:transparent;color:#94a3b8;border:1px solid #334155;border-radius:8px;padding:8px;font-size:.85rem;cursor:pointer;margin-top:.6rem;transition:border-color .15s}
-  .write-unlock-cancel:hover{border-color:#64748b;color:#cbd5e1}
   /* ── Main view ── */
   #main-view{display:none;padding:2rem}
   .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
@@ -933,7 +930,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
   .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
   .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
-  .supervisor-feedback{margin-top:8px;padding:9px 12px;border-radius:6px;font-family:'Courier New',monospace;font-size:.88rem;font-weight:600;color:#86efac;background:rgba(34,197,94,.12);border:1px solid rgba(74,222,128,.35);border-left:4px solid #4ade80;display:none}
+  .supervisor-feedback{margin-top:8px;padding:7px 9px;border-radius:6px;font-family:'Courier New',monospace;font-size:.72rem;color:#86efac;background:rgba(34,197,94,.08);border:1px solid rgba(74,222,128,.22);display:none}
   .supervisor-feedback.bad{color:#fecaca;background:rgba(248,113,113,.08);border-color:rgba(248,113,113,.25)}
 </style>
 </head>
@@ -954,24 +951,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   </div>
 </div>
 
-<!-- Write-unlock modal (replaces window.prompt(), which silently no-ops in
-     embedded/webview browser contexts and after a browser suppresses repeated
-     native dialogs) -->
-<div id="write-unlock-overlay">
-  <div class="lock-card">
-    <div class="lock-icon">🔒</div>
-    <div class="lock-title">Enable writes</div>
-    <div class="lock-sub">Enter your vault password to enable saving changes (30-minute write session)</div>
-    <form onsubmit="submitWriteUnlock();return false;" autocomplete="on">
-      <input type="text" name="username" value="clauth" autocomplete="username" style="display:none">
-      <input class="lock-input" id="write-unlock-input" type="password" placeholder="••••••••••••" autocomplete="current-password">
-      <button class="btn-unlock" id="write-unlock-btn" type="submit">Unlock Writes</button>
-    </form>
-    <div class="lock-err" id="write-unlock-err"></div>
-    <button type="button" class="write-unlock-cancel" onclick="closeWriteUnlockModal()">Cancel</button>
-  </div>
-</div>
-
 <!-- ── Main view (shown after unlock) ──────── -->
 <div id="main-view">
   <div id="upgrade-banner" style="display:none" class="upgrade-banner">
@@ -1187,6 +1166,12 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div id="supervisor-status" class="supervisor-sub">Loading supervisor state…</div>
     <div id="supervisor-feedback" class="supervisor-feedback" role="status"></div>
     <div class="supervisor-grid" style="margin-top:10px">
+      <div class="supervisor-card">
+        <h4>Plugins</h4>
+        <div class="supervisor-kpi" id="supervisor-plugin-count">—</div>
+        <div class="supervisor-meta" id="supervisor-plugin-meta">awaiting data</div>
+        <div class="supervisor-list" id="supervisor-plugins" style="margin-top:8px"></div>
+      </div>
       <div class="supervisor-card">
         <h4>Surfaces</h4>
         <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
@@ -1509,16 +1494,21 @@ async function loadSupervisorCockpit() {
   const status = document.getElementById("supervisor-status");
   if (status) status.textContent = "Loading supervisor state…";
   try {
-    const [health, surfaces, logs] = await Promise.all([
+    const [health, plugins, surfaces, logs] = await Promise.all([
       supervisorJson("/health"),
+      supervisorJson("/v1/plugins"),
       supervisorJson("/v1/surfaces"),
       supervisorJson("/v1/logs?limit=40"),
     ]);
+    const pluginRows = plugins.plugins || [];
     const surfaceRows = surfaces.surfaces || [];
+    document.getElementById("supervisor-plugin-count").textContent = String(pluginRows.length);
     document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length);
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
+    document.getElementById("supervisor-plugin-meta").textContent = "current " + (pluginRows.filter(p => p.state === "current").length) + " · awaiting " + (pluginRows.filter(p => p.state === "awaiting_enable").length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
     document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
+    document.getElementById("supervisor-plugins").innerHTML = pluginRows.length ? pluginRows.map(renderSupervisorPlugin).join("") : '<div class="supervisor-sub">No plugins discovered.</div>';
     document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.length ? surfaceRows.map(renderSupervisorSurface).join("") : '<div class="supervisor-sub">No surfaces declared.</div>';
     document.getElementById("supervisor-events").textContent = (logs.events || []).slice(-20).reverse().map(e => {
       const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
@@ -1531,13 +1521,21 @@ async function loadSupervisorCockpit() {
   }
 }
 
+function renderSupervisorPlugin(plugin) {
+  const stateKind = plugin.state === "current" ? "ok" : (plugin.state === "manifest_invalid" || plugin.state === "missing" ? "bad" : "warn");
+  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(plugin.id) + '</span>' + supervisorBadge(plugin.state || "unknown", stateKind) + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(plugin.publisher || "unknown") + ' · ' + htmlEscape(plugin.version || "—") + ' · ' + htmlEscape(plugin.source || "—") + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape((plugin.manifest_hash || "").slice(0, 12)) + '</div>' +
+    '<div class="supervisor-row-actions"><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg(plugin.enabled ? "disable" : "enable") + ')">' + (plugin.enabled ? "Disable" : "Enable") + '</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("test") + ')">Test</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("promote") + ')">Promote</button></div></div>';
+}
+
 function renderSupervisorSurface(surface) {
   const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
   const stateKind = surface.state === "current" || surface.status === "healthy" ? "ok" : (surface.state === "unavailable" ? "bad" : "warn");
   return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
     '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + '<button class="supervisor-action" data-supervisor-action="enable" onclick="toggleSurfaceEnabled(' + jsArg(surface.plugin_id) + ',' + (surface.enabled === false ? 'true' : 'false') + ',this)">' + (surface.enabled === false ? "enable" : "disable") + '</button>' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.plugin_id + ":" + surface.id) + ',' + jsArg(a) + ',this)">' + a + '</button>').join("") + '</div></div>';
+    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
 }
 
 async function rescanSupervisorPlugins() {
@@ -1548,37 +1546,21 @@ async function rescanSupervisorPlugins() {
   } catch (err) { supervisorFeedback("Plugin rescan failed: " + (err.message || err), true); }
 }
 
-async function runSupervisorSurface(id, action, btn) {
-  const originalLabel = btn ? btn.textContent : null;
-  if (btn) { btn.disabled = true; btn.textContent = "..."; btn.style.opacity = "0.6"; }
-  supervisorFeedback(action + " " + id + ": sending...", false);
+async function runSupervisorPlugin(id, action) {
   try {
-    const receipt = await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
-    const result = receipt.resulting_state || {};
-    const ok = result.ok !== false;
-    if (btn) { btn.textContent = ok ? "done" : "failed"; btn.style.background = ok ? "#14532d" : "#7f1d1d"; }
-    supervisorFeedback(id + " " + action + " " + (ok ? "succeeded" : "failed") + " -> " + (result.state || result.reason || "completed"), !ok);
-    await new Promise((resolve) => setTimeout(resolve, 700));
+    const receipt = await supervisorJson("/v1/plugins/" + encodeURIComponent(id) + "/" + encodeURIComponent(action), { method: "POST", headers: writeHeaders() });
+    supervisorFeedback("Plugin " + action + " receipt " + (receipt.operationId || "recorded") + " · " + ((receipt.resulting_state && receipt.resulting_state.state) || "completed"), false);
     await loadSupervisorCockpit();
-  } catch (err) {
-    if (btn) { btn.textContent = "failed"; btn.style.background = "#7f1d1d"; }
-    supervisorFeedback(id + " " + action + " failed: " + (err.message || err), true);
-    if (btn) { setTimeout(() => { btn.disabled = false; btn.textContent = originalLabel; btn.style.opacity = ""; btn.style.background = ""; }, 2500); }
-  }
+  } catch (err) { supervisorFeedback("Plugin " + action + " failed: " + (err.message || err), true); }
 }
 
-async function toggleSurfaceEnabled(pluginId, enable, btn) {
-  const originalLabel = btn ? btn.textContent : null;
-  if (btn) { btn.disabled = true; btn.textContent = "..."; btn.style.opacity = "0.6"; }
+async function runSupervisorSurface(id, action) {
   try {
-    const receipt = await supervisorJson("/v1/plugins/" + encodeURIComponent(pluginId) + "/" + (enable ? "enable" : "disable"), { method: "POST", headers: writeHeaders() });
-    supervisorFeedback(pluginId + " " + (enable ? "enabled" : "disabled"), receipt.error ? true : false);
-    await new Promise((resolve) => setTimeout(resolve, 500));
+    const receipt = await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
+    const result = receipt.resulting_state || {};
+    supervisorFeedback("Surface " + action + " receipt " + (receipt.operationId || "recorded") + " · " + (result.state || "completed"), result.ok === false);
     await loadSupervisorCockpit();
-  } catch (err) {
-    supervisorFeedback(pluginId + " " + (enable ? "enable" : "disable") + " failed: " + (err.message || err), true);
-    if (btn) { setTimeout(() => { btn.disabled = false; btn.textContent = originalLabel; btn.style.opacity = ""; }, 2000); }
-  }
+  } catch (err) { supervisorFeedback("Surface " + action + " failed: " + (err.message || err), true); }
 }
 
 // ── Unlock ──────────────────────────────────
@@ -1659,60 +1641,24 @@ async function lockVault() {
   showLockScreen(r.hard_locked || false);
 }
 
-// -- Unlock writes (re-establish write scope without locking) --
+// ── Unlock writes (re-establish write scope without locking) ──
 // Needed when the daemon auto-unlocks via --pw/boot.key: the page never sees the
-// unlock screen, so it holds no write token. POST /auth mints one (30-min TTL).
-//
-// Uses an in-page modal rather than window.prompt()/confirm()/alert(): those
-// native dialogs silently no-op in embedded/webview browser contexts (VS Code
-// Simple Browser, WebView2, Electron wrappers) and after a real browser
-// suppresses repeated dialogs for a tab ("prevent this page from creating
-// additional dialogs") -- both cases fail with zero visible feedback.
-function unlockWrites() {
-  openWriteUnlockModal();
-}
-
-function openWriteUnlockModal() {
-  const overlay = document.getElementById("write-unlock-overlay");
-  const input = document.getElementById("write-unlock-input");
-  const err = document.getElementById("write-unlock-err");
-  if (err) err.textContent = "";
-  if (input) { input.value = ""; input.className = "lock-input"; }
-  if (overlay) overlay.style.display = "flex";
-  if (input) setTimeout(() => input.focus(), 50);
-}
-
-function closeWriteUnlockModal() {
-  const overlay = document.getElementById("write-unlock-overlay");
-  if (overlay) overlay.style.display = "none";
-}
-
-async function submitWriteUnlock() {
-  const input = document.getElementById("write-unlock-input");
-  const btn = document.getElementById("write-unlock-btn");
-  const err = document.getElementById("write-unlock-err");
-  const pw = input ? input.value : "";
-  if (!pw) { if (err) err.textContent = "Password is required."; return; }
-  if (btn) { btn.disabled = true; btn.textContent = "Verifying..."; }
+// unlock screen, so it holds no write token. POST /auth mints one (10-min TTL).
+async function unlockWrites() {
+  if (writeToken && !confirm("Writes are already unlocked this session. Re-unlock?")) return;
+  const pw = prompt("Enter your vault password to enable saving changes (10-minute write session):");
+  if (!pw) return;
   try {
     const r = await fetch(BASE + "/auth", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ password: pw }),
     }).then(r => r.json());
-    if (r.error) {
-      if (input) { input.className = "lock-input error"; setTimeout(() => input.className = "lock-input", 600); }
-      if (err) err.textContent = "Invalid: " + (r.error || "Invalid password");
-      return;
-    }
+    if (r.error) { alert("Unlock failed: " + r.error); return; }
     writeToken = r.write_token || null;
     refreshWriteLockUi();
-    closeWriteUnlockModal();
-  } catch (e) {
-    if (err) err.textContent = "Unlock error: " + (e.message || e);
-  } finally {
-    if (btn) { btn.disabled = false; btn.textContent = "Unlock Writes"; }
-  }
+    alert(writeToken ? "Writes unlocked for 10 minutes." : "Unlock did not return a write token.");
+  } catch (e) { alert("Unlock error: " + (e.message || e)); }
 }
 
 // Reflect write-lock state on the button so it is obvious when a save will fail.