@lifeaitools/clauth 1.30.23 → 1.30.24

package/cli/watchdog-registry.test.js

@@ -1,89 +1,89 @@
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import {
-  getRegistryPath,
-  loadRegistry,
-  registerWatchdogManifest,
-  restartWatchdogService,
-  validateWatchdogManifest,
-  validateWatchdogService,
-} from "./watchdog-registry.js";
-
-function withTempRegistry(fn) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-watchdog-"));
-  const old = process.env.CLAUTH_WATCHDOG_DIR;
-  process.env.CLAUTH_WATCHDOG_DIR = dir;
-  try {
-    return fn(dir);
-  } finally {
-    if (old === undefined) delete process.env.CLAUTH_WATCHDOG_DIR;
-    else process.env.CLAUTH_WATCHDOG_DIR = old;
-    fs.rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-test("validateWatchdogService accepts a localhost HTTP service", () => {
-  const service = validateWatchdogService({
-    id: "codeflow-explorer",
-    label: "CodeFlow Explorer",
-    owner: "codeflow",
-    kind: "http",
-    health: { url: "http://127.0.0.1:3109/health" },
-    restart: { cmd: "pnpm", args: ["--filter", "@regen/codeflow-explorer", "dev"] },
-  });
-  assert.equal(service.id, "codeflow-explorer");
-  assert.equal(service.approvalRequired, true);
-});
-
-test("validateWatchdogService rejects non-local health URLs and shell syntax commands", () => {
-  assert.throws(() => validateWatchdogService({
-    id: "bad",
-    label: "Bad",
-    kind: "http",
-    health: { url: "https://example.com/health" },
-  }), /localhost-only/);
-
-  assert.throws(() => validateWatchdogService({
-    id: "bad",
-    label: "Bad",
-    kind: "process",
-    restart: { cmd: "cmd.exe & del" },
-  }), /not shell syntax/);
-});
-
-test("registerWatchdogManifest upserts services by id", () => withTempRegistry(() => {
-  const manifest = validateWatchdogManifest({
-    source: "test",
-    services: [
-      { id: "clauth", label: "clauth", kind: "http", health: { url: "http://127.0.0.1:52437/ping" } },
-      { id: "codeflow", label: "CodeFlow", kind: "http", health: { url: "http://localhost:3109/health" } },
-    ],
-  });
-  const result = registerWatchdogManifest(manifest);
-  assert.equal(result.registered, 2);
-  assert.ok(fs.existsSync(getRegistryPath()));
-  assert.deepEqual(loadRegistry().services.map((service) => service.id), ["clauth", "codeflow"]);
-
-  registerWatchdogManifest({
-    services: [
-      { id: "codeflow", label: "CodeFlow Updated", kind: "http", health: { url: "http://localhost:3109/health" } },
-    ],
-  });
-  const registry = loadRegistry();
-  assert.equal(registry.services.length, 2);
-  assert.equal(registry.services.find((service) => service.id === "codeflow").label, "CodeFlow Updated");
-}));
-
-test("restartWatchdogService rejects missing and unapproved services", () => withTempRegistry(() => {
-  assert.deepEqual(restartWatchdogService("missing"), { ok: false, error: "service_not_registered" });
-  registerWatchdogManifest({
-    services: [
-      { id: "dev-center", label: "Dev Center", kind: "process", restart: { cmd: "node", args: ["--version"] } },
-    ],
-  });
-  assert.deepEqual(restartWatchdogService("dev-center"), { ok: false, error: "approval_required" });
-}));
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  getRegistryPath,
+  loadRegistry,
+  registerWatchdogManifest,
+  restartWatchdogService,
+  validateWatchdogManifest,
+  validateWatchdogService,
+} from "./watchdog-registry.js";
+
+function withTempRegistry(fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-watchdog-"));
+  const old = process.env.CLAUTH_WATCHDOG_DIR;
+  process.env.CLAUTH_WATCHDOG_DIR = dir;
+  try {
+    return fn(dir);
+  } finally {
+    if (old === undefined) delete process.env.CLAUTH_WATCHDOG_DIR;
+    else process.env.CLAUTH_WATCHDOG_DIR = old;
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test("validateWatchdogService accepts a localhost HTTP service", () => {
+  const service = validateWatchdogService({
+    id: "codeflow-explorer",
+    label: "CodeFlow Explorer",
+    owner: "codeflow",
+    kind: "http",
+    health: { url: "http://127.0.0.1:3109/health" },
+    restart: { cmd: "pnpm", args: ["--filter", "@regen/codeflow-explorer", "dev"] },
+  });
+  assert.equal(service.id, "codeflow-explorer");
+  assert.equal(service.approvalRequired, true);
+});
+
+test("validateWatchdogService rejects non-local health URLs and shell syntax commands", () => {
+  assert.throws(() => validateWatchdogService({
+    id: "bad",
+    label: "Bad",
+    kind: "http",
+    health: { url: "https://example.com/health" },
+  }), /localhost-only/);
+
+  assert.throws(() => validateWatchdogService({
+    id: "bad",
+    label: "Bad",
+    kind: "process",
+    restart: { cmd: "cmd.exe & del" },
+  }), /not shell syntax/);
+});
+
+test("registerWatchdogManifest upserts services by id", () => withTempRegistry(() => {
+  const manifest = validateWatchdogManifest({
+    source: "test",
+    services: [
+      { id: "clauth", label: "clauth", kind: "http", health: { url: "http://127.0.0.1:52437/ping" } },
+      { id: "codeflow", label: "CodeFlow", kind: "http", health: { url: "http://localhost:3109/health" } },
+    ],
+  });
+  const result = registerWatchdogManifest(manifest);
+  assert.equal(result.registered, 2);
+  assert.ok(fs.existsSync(getRegistryPath()));
+  assert.deepEqual(loadRegistry().services.map((service) => service.id), ["clauth", "codeflow"]);
+
+  registerWatchdogManifest({
+    services: [
+      { id: "codeflow", label: "CodeFlow Updated", kind: "http", health: { url: "http://localhost:3109/health" } },
+    ],
+  });
+  const registry = loadRegistry();
+  assert.equal(registry.services.length, 2);
+  assert.equal(registry.services.find((service) => service.id === "codeflow").label, "CodeFlow Updated");
+}));
+
+test("restartWatchdogService rejects missing and unapproved services", () => withTempRegistry(() => {
+  assert.deepEqual(restartWatchdogService("missing"), { ok: false, error: "service_not_registered" });
+  registerWatchdogManifest({
+    services: [
+      { id: "dev-center", label: "Dev Center", kind: "process", restart: { cmd: "node", args: ["--version"] } },
+    ],
+  });
+  assert.deepEqual(restartWatchdogService("dev-center"), { ok: false, error: "approval_required" });
+}));

package/install.ps1

@@ -100,24 +100,24 @@ if (Test-Path $autostartScript) {
         $lnk.Save()
         Write-Host "  + Autostart registered via Startup folder (15s delay, crash-recovery loop active)." -ForegroundColor Green
     }
-} else {
-    Write-Host ""
-    Write-Host "  ! autostart.ps1 not found - skipping autostart registration." -ForegroundColor Yellow
-    Write-Host "    Run: clauth autostart install" -ForegroundColor Gray
-}
-
-Write-Host ""
-Write-Host "  Installing co-development Windows Terminal profiles..." -ForegroundColor Cyan
-try {
-    & clauth codevelop install-terminal --repo "C:\Dev\regen-root"
-    if ($LASTEXITCODE -eq 0) {
-        Write-Host "  + Co-development terminal profiles installed." -ForegroundColor Green
-    } else {
-        Write-Host "  ! Co-development terminal profile install returned exit code $LASTEXITCODE." -ForegroundColor Yellow
-    }
-} catch {
-    Write-Host "  ! Co-development terminal profile install skipped: $($_.Exception.Message)" -ForegroundColor Yellow
-    Write-Host "    Run later: clauth codevelop install-terminal --repo C:\Dev\regen-root" -ForegroundColor Gray
-}
-
-exit $LASTEXITCODE
+} else {
+    Write-Host ""
+    Write-Host "  ! autostart.ps1 not found - skipping autostart registration." -ForegroundColor Yellow
+    Write-Host "    Run: clauth autostart install" -ForegroundColor Gray
+}
+
+Write-Host ""
+Write-Host "  Installing co-development Windows Terminal profiles..." -ForegroundColor Cyan
+try {
+    & clauth codevelop install-terminal --repo "C:\Dev\regen-root"
+    if ($LASTEXITCODE -eq 0) {
+        Write-Host "  + Co-development terminal profiles installed." -ForegroundColor Green
+    } else {
+        Write-Host "  ! Co-development terminal profile install returned exit code $LASTEXITCODE." -ForegroundColor Yellow
+    }
+} catch {
+    Write-Host "  ! Co-development terminal profile install skipped: $($_.Exception.Message)" -ForegroundColor Yellow
+    Write-Host "    Run later: clauth codevelop install-terminal --repo C:\Dev\regen-root" -ForegroundColor Gray
+}
+
+exit $LASTEXITCODE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.23",
+  "version": "1.30.24",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js cli/supervisor-registry.test.js cli/supervisor-ui.test.js cli/served-script-syntax.test.mjs test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
     "test:studio-debug": "node --test test/studio-debug.test.mjs",
     "test:agent-pool": "node test/agent-pool.test.mjs",
     "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",

package/supabase/migrations/001_clauth_schema.sql

@@ -27,18 +27,18 @@ create table if not exists public.clauth_services (
 -- ============================================================
 -- Machine Registry (hardware fingerprints — hashed only)
 -- ============================================================
-create table if not exists public.clauth_machines (
-  id              uuid primary key default gen_random_uuid(),
-  install_id      text not null default 'default', -- logical vault install / owner group
-  machine_hash    text not null unique,          -- SHA256(machine_id + os_install_id)
-  label           text,                          -- e.g. 'Dave-Desktop-Win11'
-  hmac_seed_hash  text not null,                 -- SHA256 of the HMAC seed stored in vault
-  enabled         boolean not null default true,
-  fail_count      integer not null default 0,
-  locked          boolean not null default false,
-  created_at      timestamptz not null default now(),
-  last_seen       timestamptz
-);
+create table if not exists public.clauth_machines (
+  id              uuid primary key default gen_random_uuid(),
+  install_id      text not null default 'default', -- logical vault install / owner group
+  machine_hash    text not null unique,          -- SHA256(machine_id + os_install_id)
+  label           text,                          -- e.g. 'Dave-Desktop-Win11'
+  hmac_seed_hash  text not null,                 -- SHA256 of the HMAC seed stored in vault
+  enabled         boolean not null default true,
+  fail_count      integer not null default 0,
+  locked          boolean not null default false,
+  created_at      timestamptz not null default now(),
+  last_seen       timestamptz
+);
 
 -- ============================================================
 -- Audit Log

package/supabase/migrations/003_clauth_config.sql

@@ -1,13 +1,13 @@
--- clauth_config: key/value store for daemon configuration
--- Used to persist tunnel hostname and other daemon settings
-CREATE TABLE IF NOT EXISTS clauth_config (
-  key        text PRIMARY KEY,
-  value      jsonb NOT NULL,
-  updated_at timestamptz DEFAULT now()
-);
-
--- RLS: only service role can access (same pattern as other clauth tables)
-ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;
-
--- Seed: no tunnel by default (user must run clauth tunnel setup)
--- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');
+-- clauth_config: key/value store for daemon configuration
+-- Used to persist tunnel hostname and other daemon settings
+CREATE TABLE IF NOT EXISTS clauth_config (
+  key        text PRIMARY KEY,
+  value      jsonb NOT NULL,
+  updated_at timestamptz DEFAULT now()
+);
+
+-- RLS: only service role can access (same pattern as other clauth tables)
+ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;
+
+-- Seed: no tunnel by default (user must run clauth tunnel setup)
+-- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');

package/supabase/migrations/003_machine_enrollments.sql

@@ -1,39 +1,39 @@
--- ============================================================
--- clauth machine enrollment
--- Migration: 003_machine_enrollments.sql
--- ============================================================
-
-alter table public.clauth_machines
-  add column if not exists install_id text not null default 'default';
-
-create index if not exists clauth_machines_install_id_idx
-  on public.clauth_machines (install_id);
-
-create table if not exists public.clauth_machine_enrollments (
-  id uuid primary key default gen_random_uuid(),
-  install_id text not null default 'default',
-  token_hash text not null unique,
-  label text,
-  created_by_machine_hash text not null references public.clauth_machines(machine_hash) on delete cascade,
-  redeemed_by_machine_hash text references public.clauth_machines(machine_hash) on delete set null,
-  expires_at timestamptz not null,
-  consumed_at timestamptz,
-  created_at timestamptz not null default now()
-);
-
-create index if not exists clauth_machine_enrollments_install_idx
-  on public.clauth_machine_enrollments (install_id, expires_at);
-
-alter table public.clauth_machine_enrollments enable row level security;
-
-do $$ begin
-  if not exists (
-    select 1
-    from pg_policies
-    where policyname = 'no_anon_machine_enrollments'
-      and tablename = 'clauth_machine_enrollments'
-  ) then
-    create policy "no_anon_machine_enrollments"
-      on public.clauth_machine_enrollments for all using (false);
-  end if;
-end $$;
+-- ============================================================
+-- clauth machine enrollment
+-- Migration: 003_machine_enrollments.sql
+-- ============================================================
+
+alter table public.clauth_machines
+  add column if not exists install_id text not null default 'default';
+
+create index if not exists clauth_machines_install_id_idx
+  on public.clauth_machines (install_id);
+
+create table if not exists public.clauth_machine_enrollments (
+  id uuid primary key default gen_random_uuid(),
+  install_id text not null default 'default',
+  token_hash text not null unique,
+  label text,
+  created_by_machine_hash text not null references public.clauth_machines(machine_hash) on delete cascade,
+  redeemed_by_machine_hash text references public.clauth_machines(machine_hash) on delete set null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz,
+  created_at timestamptz not null default now()
+);
+
+create index if not exists clauth_machine_enrollments_install_idx
+  on public.clauth_machine_enrollments (install_id, expires_at);
+
+alter table public.clauth_machine_enrollments enable row level security;
+
+do $$ begin
+  if not exists (
+    select 1
+    from pg_policies
+    where policyname = 'no_anon_machine_enrollments'
+      and tablename = 'clauth_machine_enrollments'
+  ) then
+    create policy "no_anon_machine_enrollments"
+      on public.clauth_machine_enrollments for all using (false);
+  end if;
+end $$;

package/cli/served-script-syntax.test.mjs

@@ -1,54 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import vm from 'node:vm';
-import { spawn } from 'node:child_process';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const cliEntry = path.join(here, 'index.js');
-const PORT = 52499;
-
-function waitForPort(url, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  const attempt = async () => {
-    try {
-      const r = await fetch(url);
-      if (r.ok) return true;
-    } catch {}
-    if (Date.now() > deadline) throw new Error('timed out waiting for ' + url);
-    await new Promise((r) => setTimeout(r, 200));
-    return attempt();
-  };
-  return attempt();
-}
-
-// Regression coverage for the 2026-08-06 incident: a stray tool-authoring
-// artifact ("[char]0x2192" -- PowerShell character-literal syntax, never
-// evaluated because it was written inside a single-quoted PowerShell string)
-// landed as literal text inside the embedded dashboard <script> block. That
-// produced a real SyntaxError in every browser that loaded the page, so the
-// ENTIRE inline script failed to parse -- meaning unlock(), unlockWrites(),
-// runSupervisorSurface(), and every other function on the page silently
-// never existed. `node --check` on serve.js itself never catches this class
-// of bug: the broken text lives inside a JS string/template FOR the browser,
-// which is opaque to Node's own parser. This test extracts the actual served
-// script -- the same bytes a real browser executes -- and parses it for real.
-test('the served dashboard script has no syntax errors (would have caught the 2026-08-06 incident)', async () => {
-  const child = spawn(process.execPath, [cliEntry, 'serve', 'start', '--isolated', '--port', String(PORT)], {
-    stdio: 'ignore',
-    windowsHide: true,
-  });
-  try {
-    await waitForPort('http://127.0.0.1:' + PORT + '/ping', 15000);
-    const html = await fetch('http://127.0.0.1:' + PORT + '/').then((r) => r.text());
-    const start = html.indexOf('<script>');
-    const end = html.lastIndexOf('</script>');
-    assert.ok(start !== -1 && end !== -1, 'expected an inline <script> block in the served dashboard');
-    const js = html.slice(start + 8, end);
-    assert.doesNotThrow(() => new vm.Script(js), 'the served dashboard script must be syntactically valid JavaScript');
-  } finally {
-    await fetch('http://127.0.0.1:' + PORT + '/shutdown').catch(() => {});
-    child.kill();
-  }
-});