@lifeaitools/clauth 1.30.26 → 1.31.1

package/cli/commands/serve.js

@@ -14,7 +14,7 @@ import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
 import * as api from "../api.js";
 import chalk from "chalk";
 import ora from "ora";
-import { execFileSync, execSync as execSyncTop, spawn } from "child_process";
+import { execFileSync, execSync as execSyncTop } from "child_process";
 import Conf from "conf";
 import { getConfOptions } from "../conf-path.js";
 import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises";
@@ -30,24 +30,6 @@ import {
   readWatchdogEvents,
   restartWatchdogService,
 } from "../watchdog-registry.js";
-import {
-  discoverPlugins,
-  getSupervisorDir,
-  getSupervisorPort,
-  loadSupervisorState,
-  listPlugins,
-  listRoutes,
-  listSurfaces,
-  listTunnels,
-  readSupervisorEvents,
-  addTunnelRoute,
-  removeTunnelRoute,
-  reconcileSurfaceHealth,
-  runPluginAction,
-  runSurfaceAction,
-  setPluginEnabled,
-  supervisorHealth,
-} from "../supervisor-registry.js";
 import {
   AgentPool,
   DelegationLane,
@@ -58,14 +40,6 @@ import {
   DEFAULT_BOOTSTRAP,
 } from "./agent-pool.js";
 import { AgentCron, cronEnabled, nextRun } from "./agent-cron.js";
-import pm2 from "pm2";
-import { createPm2Adapter, PM2_OPERATION_CATALOG } from "../ops/pm2-adapter.js";
-import { createOperationPolicy } from "../ops/operation-policy.js";
-import { createJobStore } from "../ops/job-store.js";
-import { createCoolifyAdapter, deploymentUuidFrom } from "../ops/coolify-adapter.js";
-import { createDeploymentAdapter, parseDeploymentRegistry } from "../ops/deployment-adapter.js";
-import { createSerializedExecutor } from "../ops/serialized-executor.js";
-import { requestOps } from "./ops.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../package.json"), "utf8"));
@@ -489,7 +463,6 @@ function createRotationEngine(password, machineHash, logFile) {
 
 const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
 const STAGED_PID_FILE = path.join(os.tmpdir(), "clauth-serve-staged.pid");
-const SUPERVISOR_PID_FILE = path.join(os.tmpdir(), "clauth-supervisor.pid");
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 const LIVE_PORT = 52437;
 const STAGED_PORT = 52438;
@@ -514,74 +487,6 @@ function validateWriteToken(req, writeSession) {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 
-export function isLoopbackAddress(remote) {
-  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
-}
-
-function summarizeSupervisorTarget(target) {
-  if (!target || typeof target !== "object") return null;
-  return {
-    plugin_id: typeof target.plugin_id === "string" ? target.plugin_id : undefined,
-    surface_id: typeof target.surface_id === "string" ? target.surface_id : undefined,
-    tunnel_id: typeof target.tunnel_id === "string" ? target.tunnel_id : undefined,
-    route_id: typeof target.route_id === "string" ? target.route_id : undefined,
-  };
-}
-
-function summarizeSupervisorState(value) {
-  if (!value || typeof value !== "object") return null;
-  return {
-    ok: typeof value.ok === "boolean" ? value.ok : undefined,
-    state: typeof value.state === "string" ? value.state : undefined,
-    reason: typeof value.reason === "string" ? value.reason : undefined,
-    status: typeof value.status === "number" ? value.status : undefined,
-    private: typeof value.private === "boolean" ? value.private : undefined,
-    public_route: typeof value.public_route === "boolean" ? value.public_route : undefined,
-    evidence: Array.isArray(value.evidence) ? value.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
-  };
-}
-
-export function supervisorLogDto(event) {
-  if (!event || typeof event !== "object") return { kind: "unknown" };
-  if (event.kind === "operation") {
-    return {
-      ts: event.ts || event.created_at,
-      kind: "operation",
-      operationId: event.operationId,
-      actor: event.actor,
-      action: event.action,
-      target: summarizeSupervisorTarget(event.target),
-      resulting_state: summarizeSupervisorState(event.resulting_state),
-      completed_at: event.completed_at,
-    };
-  }
-  return {
-    ts: event.ts,
-    kind: event.kind,
-    plugin_id: event.plugin_id,
-    source: event.source,
-    state: event.state,
-  };
-}
-
-function supervisorOperationDto(receipt) {
-  return {
-    operationId: receipt.operationId,
-    actor: receipt.actor,
-    action: receipt.action,
-    target: summarizeSupervisorTarget(receipt.target),
-    resulting_state: summarizeSupervisorState(receipt.resulting_state),
-    evidence: Array.isArray(receipt.evidence) ? receipt.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
-    created_at: receipt.created_at,
-    completed_at: receipt.completed_at,
-  };
-}
-
-export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
-  if (port !== getSupervisorPort()) return true;
-  return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
-}
-
 // ── PID helpers ──────────────────────────────────────────────
 function readPid() {
   try {
@@ -607,18 +512,6 @@ function writeStagedPid(pid, port) {
   fs.writeFileSync(STAGED_PID_FILE, `${pid}:${port}`, "utf8");
 }
 
-function readSupervisorPid() {
-  try {
-    const raw = fs.readFileSync(SUPERVISOR_PID_FILE, "utf8").trim();
-    const [pid, port] = raw.split(":");
-    return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
-  } catch { return null; }
-}
-
-function writeSupervisorPid(pid, port) {
-  fs.writeFileSync(SUPERVISOR_PID_FILE, `${pid}:${port}`, "utf8");
-}
-
 function removeStagedPid() {
   try { fs.unlinkSync(STAGED_PID_FILE); } catch {}
 }
@@ -627,10 +520,6 @@ function removePid() {
   try { fs.unlinkSync(PID_FILE); } catch {}
 }
 
-function removeSupervisorPid() {
-  try { fs.unlinkSync(SUPERVISOR_PID_FILE); } catch {}
-}
-
 function isProcessAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
 }
@@ -685,9 +574,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-unlock:hover{background:#2563eb}
   .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
   .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
-  #write-unlock-overlay{display:none;position:fixed;inset:0;background:rgba(2,6,23,.72);z-index:9999;align-items:center;justify-content:center;padding:2rem}
-  .write-unlock-cancel{width:100%;background:transparent;color:#94a3b8;border:1px solid #334155;border-radius:8px;padding:8px;font-size:.85rem;cursor:pointer;margin-top:.6rem;transition:border-color .15s}
-  .write-unlock-cancel:hover{border-color:#64748b;color:#cbd5e1}
   /* ── Main view ── */
   #main-view{display:none;padding:2rem}
   .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
@@ -919,30 +805,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .wiz-test-result{padding:12px 14px;border-radius:8px;font-size:.85rem;margin-top:10px;display:none}
   .wiz-test-result.ok{background:rgba(74,222,128,.08);border:1px solid rgba(74,222,128,.2);color:#4ade80}
   .wiz-test-result.fail{background:rgba(248,113,113,.08);border:1px solid rgba(248,113,113,.2);color:#f87171}
-  .supervisor-panel{margin:14px 16px;border:1px solid #233249;background:linear-gradient(135deg,rgba(15,23,42,.96),rgba(10,15,26,.98));border-radius:12px;padding:14px}
-  .supervisor-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;margin-bottom:12px}
-  .supervisor-title{font-size:.95rem;font-weight:700;color:#e2e8f0}
-  .supervisor-sub{font-size:.76rem;color:#94a3b8;margin-top:3px;line-height:1.35}
-  .supervisor-actions{display:flex;gap:8px;flex-wrap:wrap}
-  .supervisor-action{background:#0f172a;color:#cbd5e1;border:1px solid #334155;border-radius:6px;padding:6px 10px;font-size:.75rem;cursor:pointer}
-  .supervisor-action:hover{border-color:#38bdf8;color:#e0f2fe}
-  .supervisor-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:10px}
-  .supervisor-card{border:1px solid #1e293b;background:rgba(2,6,23,.52);border-radius:10px;padding:10px;min-width:0}
-  .supervisor-card h4{margin:0 0 8px;color:#cbd5e1;font-size:.75rem;letter-spacing:.08em;text-transform:uppercase}
-  .supervisor-kpi{font-size:1.35rem;font-weight:700;color:#f8fafc}
-  .supervisor-meta{font-size:.72rem;color:#94a3b8;font-family:'Courier New',monospace;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-  .supervisor-pill{display:inline-flex;align-items:center;border-radius:999px;padding:2px 7px;margin:2px 4px 2px 0;font-size:.68rem;border:1px solid #334155;color:#cbd5e1;background:#0f172a}
-  .supervisor-pill.ok{border-color:rgba(74,222,128,.35);color:#86efac;background:rgba(34,197,94,.08)}
-  .supervisor-pill.warn{border-color:rgba(250,204,21,.35);color:#fde68a;background:rgba(250,204,21,.08)}
-  .supervisor-pill.bad{border-color:rgba(248,113,113,.35);color:#fecaca;background:rgba(248,113,113,.08)}
-  .supervisor-list{display:flex;flex-direction:column;gap:8px;max-height:320px;overflow:auto}
-  .supervisor-row{border:1px solid #1e293b;border-radius:8px;padding:8px;background:rgba(15,23,42,.45)}
-  .supervisor-row-top{display:flex;justify-content:space-between;gap:8px;align-items:center}
-  .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-  .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
-  .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
-  .supervisor-feedback{margin-top:8px;padding:7px 9px;border-radius:6px;font-family:'Courier New',monospace;font-size:.72rem;color:#86efac;background:rgba(34,197,94,.08);border:1px solid rgba(74,222,128,.22);display:none}
-  .supervisor-feedback.bad{color:#fecaca;background:rgba(248,113,113,.08);border-color:rgba(248,113,113,.25)}
 </style>
 </head>
 <body>
@@ -962,24 +824,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   </div>
 </div>
 
-<!-- Write-unlock modal (replaces window.prompt(), which silently no-ops in
-     embedded/webview browser contexts and after a browser suppresses repeated
-     native dialogs) -->
-<div id="write-unlock-overlay">
-  <div class="lock-card">
-    <div class="lock-icon">🔒</div>
-    <div class="lock-title">Enable writes</div>
-    <div class="lock-sub">Enter your vault password to enable saving changes (30-minute write session)</div>
-    <form onsubmit="submitWriteUnlock();return false;" autocomplete="on">
-      <input type="text" name="username" value="clauth" autocomplete="username" style="display:none">
-      <input class="lock-input" id="write-unlock-input" type="password" placeholder="••••••••••••" autocomplete="current-password">
-      <button class="btn-unlock" id="write-unlock-btn" type="submit">Unlock Writes</button>
-    </form>
-    <div class="lock-err" id="write-unlock-err"></div>
-    <button type="button" class="write-unlock-cancel" onclick="closeWriteUnlockModal()">Cancel</button>
-  </div>
-</div>
-
 <!-- ── Main view (shown after unlock) ──────── -->
 <div id="main-view">
   <div id="upgrade-banner" style="display:none" class="upgrade-banner">
@@ -1181,35 +1025,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </div>
   </div>
 
-  <section class="supervisor-panel" id="supervisor-panel">
-    <div class="supervisor-head">
-      <div>
-        <div class="supervisor-title">Local Software Factory Supervisor</div>
-        <div class="supervisor-sub">clauth owns local LIFEAI plugin discovery, candidate tests, clauth-owned surface operations, receipts, and supervisor event logs. Dev Center should call this surface instead of PM2 directly.</div>
-      </div>
-      <div class="supervisor-actions">
-        <button class="supervisor-action" onclick="loadSupervisorCockpit()">Refresh</button>
-        <button class="supervisor-action" onclick="rescanSupervisorPlugins()">Rescan plugins</button>
-      </div>
-    </div>
-    <div id="supervisor-status" class="supervisor-sub">Loading supervisor state…</div>
-    <div id="supervisor-feedback" class="supervisor-feedback" role="status"></div>
-    <div class="supervisor-grid" style="margin-top:10px">
-      <div class="supervisor-card">
-        <h4>Surfaces</h4>
-        <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
-        <div class="supervisor-meta" id="supervisor-surface-meta">destination + owner matrix</div>
-        <div class="supervisor-list" id="supervisor-surfaces" style="margin-top:8px"></div>
-      </div>
-      <div class="supervisor-card">
-        <h4>Operations + log</h4>
-        <div class="supervisor-kpi" id="supervisor-operation-count">—</div>
-        <div class="supervisor-meta" id="supervisor-log-path">events.jsonl</div>
-        <div class="supervisor-log" id="supervisor-events" style="margin-top:8px">No events loaded.</div>
-      </div>
-    </div>
-  </section>
-
 
   <div class="tunnel-panel" id="webdav-panel" style="flex-direction:column;align-items:stretch;gap:8px">
     <div style="display:flex;align-items:center;gap:10px;width:100%">
@@ -1254,16 +1069,11 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <span id="service-search-count" class="service-search-count"></span>
   </div>
   <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
-  <div class="footer" id="originFooter">checking origin… · 10-strike lockout</div>
+  <div class="footer">localhost:${port} · 127.0.0.1 only · 10-strike lockout</div>
 </div>
 
 <script>
-const BASE = location.origin;
-(function reportOrigin() {
-  const isLocal = /^(127\\.0\\.0\\.1|localhost|\\[::1\\])$/.test(location.hostname);
-  const el = document.getElementById("originFooter");
-  if (el) el.textContent = (isLocal ? "LOCAL" : "REMOTE") + " · " + BASE + " · 10-strike lockout";
-})();
+const BASE = "http://127.0.0.1:${port}";
 
 const SERVICE_HINTS = {
   "neo4j":           "neo4j+s://username:password@instance.databases.neo4j.io",
@@ -1495,81 +1305,9 @@ function showMain(ping) {
   pollTunnel();
   loadWebdavMounts();
   updateBuildStatus();
-  loadSupervisorCockpit();
   refreshWriteLockUi();
 }
 
-function supervisorBadge(text, kind) {
-  return '<span class="supervisor-pill ' + (kind || '') + '">' + htmlEscape(text) + '</span>';
-}
-
-async function supervisorJson(path, options) {
-  const response = await fetch(BASE + path, { cache: "no-store", ...(options || {}) });
-  const data = await response.json().catch(() => ({}));
-  if (!response.ok || data.error) throw new Error(data.error || ("HTTP " + response.status));
-  return data;
-}
-
-function supervisorFeedback(text, bad) {
-  const el = document.getElementById("supervisor-feedback");
-  if (!el) return;
-  el.textContent = text || "";
-  el.className = "supervisor-feedback" + (bad ? " bad" : "");
-  el.style.display = text ? "block" : "none";
-}
-
-async function loadSupervisorCockpit() {
-  const status = document.getElementById("supervisor-status");
-  if (status) status.textContent = "Loading supervisor state…";
-  try {
-    const [health, surfaces, logs] = await Promise.all([
-      supervisorJson("/health"),
-      supervisorJson("/v1/surfaces"),
-      supervisorJson("/v1/logs?limit=40"),
-    ]);
-    const surfaceRows = surfaces.surfaces || [];
-    document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length);
-    document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
-    document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
-    document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
-    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.length ? surfaceRows.map(renderSupervisorSurface).join("") : '<div class="supervisor-sub">No surfaces declared.</div>';
-    document.getElementById("supervisor-events").textContent = (logs.events || []).slice(-20).reverse().map(e => {
-      const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
-      return (e.ts || e.created_at || "") + "  " + label;
-    }).join("\\n") || "No events yet.";
-    if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status === "ok" ? "healthy" : (health.status || "unknown")), health.status === "ok" ? "ok" : "warn") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
-  } catch (err) {
-    if (status) status.innerHTML = supervisorBadge("supervisor unreachable", "bad") + " " + htmlEscape(err.message || err);
-    supervisorFeedback("Supervisor unavailable — actions are disabled until the local control plane returns.", true);
-  }
-}
-
-function renderSupervisorSurface(surface) {
-  const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
-  const stateKind = surface.state === "current" || surface.status === "healthy" ? "ok" : (surface.state === "unavailable" ? "bad" : "warn");
-  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) + '</div>' +
-    '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
-    '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
-    '<div class="supervisor-row-actions">' + ["start","stop","restart","reconcile","test","promote","rollback"].map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
-}
-
-async function rescanSupervisorPlugins() {
-  try {
-    await supervisorJson("/v1/plugins/rescan", { method: "POST", headers: writeHeaders() });
-    supervisorFeedback("Plugin rescan completed.", false);
-    await loadSupervisorCockpit();
-  } catch (err) { supervisorFeedback("Plugin rescan failed: " + (err.message || err), true); }
-}
-
-async function runSupervisorSurface(id, action) {
-  try {
-    const receipt = await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
-    const result = receipt.resulting_state || {};
-    supervisorFeedback("Surface " + action + " receipt " + (receipt.operationId || "recorded") + " · " + (result.state || "completed"), result.ok === false);
-    await loadSupervisorCockpit();
-  } catch (err) { supervisorFeedback("Surface " + action + " failed: " + (err.message || err), true); }
-}
-
 // ── Unlock ──────────────────────────────────
 async function unlock() {
   const input = document.getElementById("lock-input");
@@ -1651,51 +1389,21 @@ async function lockVault() {
 // ── Unlock writes (re-establish write scope without locking) ──
 // Needed when the daemon auto-unlocks via --pw/boot.key: the page never sees the
 // unlock screen, so it holds no write token. POST /auth mints one (10-min TTL).
-function unlockWrites() {
-  openWriteUnlockModal();
-}
-
-function openWriteUnlockModal() {
-  const overlay = document.getElementById("write-unlock-overlay");
-  const input = document.getElementById("write-unlock-input");
-  const err = document.getElementById("write-unlock-err");
-  if (err) err.textContent = "";
-  if (input) { input.value = ""; input.className = "lock-input"; }
-  if (overlay) overlay.style.display = "flex";
-  if (input) setTimeout(() => input.focus(), 50);
-}
-
-function closeWriteUnlockModal() {
-  const overlay = document.getElementById("write-unlock-overlay");
-  if (overlay) overlay.style.display = "none";
-}
-
-async function submitWriteUnlock() {
-  const input = document.getElementById("write-unlock-input");
-  const btn = document.getElementById("write-unlock-btn");
-  const err = document.getElementById("write-unlock-err");
-  const pw = input ? input.value : "";
-  if (!pw) { if (err) err.textContent = "Password is required."; return; }
-  if (btn) { btn.disabled = true; btn.textContent = "Verifying..."; }
+async function unlockWrites() {
+  if (writeToken && !confirm("Writes are already unlocked this session. Re-unlock?")) return;
+  const pw = prompt("Enter your vault password to enable saving changes (10-minute write session):");
+  if (!pw) return;
   try {
     const r = await fetch(BASE + "/auth", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ password: pw }),
     }).then(r => r.json());
-    if (r.error) {
-      if (input) { input.className = "lock-input error"; setTimeout(() => input.className = "lock-input", 600); }
-      if (err) err.textContent = "Invalid: " + (r.error || "Invalid password");
-      return;
-    }
+    if (r.error) { alert("Unlock failed: " + r.error); return; }
     writeToken = r.write_token || null;
     refreshWriteLockUi();
-    closeWriteUnlockModal();
-  } catch (e) {
-    if (err) err.textContent = "Unlock error: " + (e.message || e);
-  } finally {
-    if (btn) { btn.disabled = false; btn.textContent = "Unlock Writes"; }
-  }
+    alert(writeToken ? "Writes unlocked for 10 minutes." : "Unlock did not return a write token.");
+  } catch (e) { alert("Unlock error: " + (e.message || e)); }
 }
 
 // Reflect write-lock state on the button so it is obvious when a save will fail.
@@ -4062,187 +3770,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       });
     },
   });
-  const isSupervisorPort = port === getSupervisorPort();
-  const supervisorTestNoToken = process.env.CLAUTH_SUPERVISOR_TEST_NO_TOKEN === "1";
-  const opsAdapter = createPm2Adapter(pm2);
-  const executePm2 = createSerializedExecutor();
-  const opsPolicy = createOperationPolicy({
-    enabled: String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).filter(Boolean),
-    applications: (() => { try { return JSON.parse(process.env.CLAUTH_OPS_APPLICATIONS || "{}"); } catch { return {}; } })(),
-    adminEnabled: String(process.env.CLAUTH_OPS_ADMIN_ENABLED || "").split(",").map((item) => item.trim()).filter(Boolean),
-    adminApplications: (() => { try { return JSON.parse(process.env.CLAUTH_OPS_ADMIN_APPLICATIONS || "{}"); } catch { return {}; } })(),
-    allowHostWide: process.env.CLAUTH_OPS_ALLOW_HOST_WIDE === "1",
-  });
-  const opsJobs = createJobStore({
-    filePath: process.env.CLAUTH_OPS_JOB_STORE_PATH || path.join(getSupervisorDir(), "ops-jobs.json"),
-  });
-
-  async function getLoopbackSecret(service) {
-    const response = await fetch(`http://127.0.0.1:${LIVE_PORT}/v/${encodeURIComponent(service)}`, { signal: AbortSignal.timeout(5000) });
-    if (!response.ok) throw new Error(`${service} unavailable from local clauth`);
-    const value = (await response.text()).trim();
-    if (!value) throw new Error(`${service} is empty`);
-    return value;
-  }
-  const coolify = createCoolifyAdapter({
-    baseUrl: process.env.CLAUTH_COOLIFY_BASE_URL || "https://deploy.regendevcorp.com",
-    getToken: () => getLoopbackSecret("coolify-api"),
-  });
-  const deployments = (() => { try { return parseDeploymentRegistry(process.env.CLAUTH_OPS_DEPLOYMENTS || "{}"); } catch { return {}; } })();
-  const deploymentAdapter = createDeploymentAdapter({
-    deployments,
-    reload: async (target) => {
-      await executePm2(async () => {
-        await opsAdapter.connect();
-        try { await opsAdapter.execute("reload", { target, options: { updateEnv: true } }); } finally { await opsAdapter.disconnect(); }
-      });
-    },
-  });
-
-  /**
-   * Record an ops failure's upstream message to the LOCAL log only.
-   *
-   * job-store's sanitizer deliberately drops free-form `error` text so an
-   * upstream message cannot carry a credential into the persisted job file or
-   * the API response. That protection left every failure with an empty detail,
-   * so jobs reported `failed` with no reason at all. Jobs now carry an
-   * enumerated `code`; the underlying message goes here, to the same
-   * operator-only log as the rest of the daemon's diagnostics.
-   */
-  function logOpsFailure(kind, operation, error) {
-    const message = String(error?.message || error || "unknown");
-    try {
-      fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] [OPS ${kind}/${operation}] ${message}\n`);
-    } catch {}
-  }
-
-  async function opsBearerRole(req) {
-    const header = req.headers.authorization;
-    const supplied = Array.isArray(header) ? header[0] : header;
-    if (!supplied || !String(supplied).startsWith("Bearer ")) return null;
-    const actual = String(supplied).slice(7).trim();
-    let admin; let agent;
-    try { admin = await getLoopbackSecret(process.env.CLAUTH_OPS_ADMIN_TOKEN_SERVICE || "vultr-ops-admin-token"); } catch {}
-    try { agent = await getLoopbackSecret(process.env.CLAUTH_OPS_AGENT_TOKEN_SERVICE || "vultr-ops-api-token"); } catch {}
-    if (admin && agent && admin === agent) return null;
-    for (const [role, expected] of [["admin", admin], ["agent", agent]]) {
-      if (!expected) continue;
-      const a = Buffer.from(actual); const b = Buffer.from(expected);
-      if (a.length === b.length && crypto.timingSafeEqual(a, b)) return role;
-    }
-    return null;
-  }
-
-  async function requireOpsBearer(req, res) {
-    const role = await opsBearerRole(req);
-    if (role) { req._opsRole = role; return true; }
-    res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-    res.end(JSON.stringify({ error: "ops_bearer_required" }));
-    return false;
-  }
-
-  function submitOpsJob(operation, input, role = "agent") {
-    const authorization = opsPolicy.authorize(operation, input, role);
-    const job = opsJobs.create({ kind: "pm2", operation, target: input.target || input.name || null });
-    if (!authorization.ok) {
-      return opsJobs.event(job.id, "rejected", { code: authorization.code });
-    }
-    void (async () => {
-      opsJobs.event(job.id, "running");
-      try {
-        const result = await executePm2(async () => {
-          await opsAdapter.connect();
-          try { return await opsAdapter.execute(operation, input); } finally { await opsAdapter.disconnect(); }
-        });
-        opsJobs.event(job.id, "succeeded", operationReceipt(operation, result, authorization.allowed_targets || []));
-      } catch (error) {
-        // `error` alone is dropped by job-store's sanitizer (it refuses
-        // free-form upstream text so a credential cannot ride along), which
-        // left every failure with an empty detail. Emit an enumerated code so
-        // the failure has a reason; keep the message for the local log only.
-        logOpsFailure("pm2", operation, error);
-        opsJobs.event(job.id, "failed", { code: "pm2_operation_failed" });
-      }
-    })();
-    return opsJobs.get(job.id);
-  }
-
-  function operationReceipt(operation, result, allowedTargets) {
-    if (["list", "describe", "logs"].includes(operation)) {
-      const processes = Array.isArray(result)
-        ? result.filter((process) => allowedTargets.includes("*") || allowedTargets.includes(process?.name))
-        : [];
-      return { processes };
-    }
-    if (operation === "ping") return { status: "connected" };
-    return { status: "completed" };
-  }
-
-  function submitPromotionJob(applicationUuid) {
-    const job = opsJobs.create({ kind: "coolify", operation: "promote", target: applicationUuid });
-    const enabled = String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).includes("coolify_promote");
-    const allowlist = (() => { try { return JSON.parse(process.env.CLAUTH_COOLIFY_PROMOTE_UUIDS || "[]"); } catch { return []; } })();
-    if (!enabled || !Array.isArray(allowlist) || !allowlist.includes(applicationUuid)) {
-      return opsJobs.event(job.id, "rejected", { code: "service_not_available" });
-    }
-    void (async () => {
-      opsJobs.event(job.id, "running");
-      try {
-        const deployment = await coolify.promote(applicationUuid);
-        // Coolify answers with a `deployments` ARRAY, not a flat object — see
-        // deploymentUuidFrom. Reading the flat field alone marked the job failed
-        // while the deployment was actually running.
-        const deploymentUuid = deploymentUuidFrom(deployment);
-        if (!deploymentUuid) {
-          // The deploy request itself SUCCEEDED (no throw); only the UUID was
-          // unreadable, so the deployment may well be RUNNING. The code says so
-          // explicitly rather than a bare "failed", because a plain failure
-          // invites a retry and a duplicate production deploy.
-          //
-          // An enumerated code, not a free-form error: job-store's sanitizer
-          // drops `error` on purpose to keep upstream text (and any credential
-          // inside it) out of the persisted job.
-          return opsJobs.event(job.id, "failed", { code: "coolify_deploy_accepted_uuid_unreadable" });
-        }
-        opsJobs.event(job.id, "waiting", { deployment_uuid: deploymentUuid });
-        const terminal = await coolify.poll(deploymentUuid, { attempts: Number(process.env.CLAUTH_COOLIFY_POLL_ATTEMPTS || 60), delay: () => new Promise((resolve) => setTimeout(resolve, 5000)) });
-        opsJobs.event(job.id, terminal.state === "succeeded" ? "succeeded" : terminal.state, { deployment_uuid: deploymentUuid, status: terminal.deployment?.status || null });
-      } catch (error) {
-        // The throw may have happened AFTER Coolify accepted the deploy (e.g.
-        // the poll lost the network), so this is not proof nothing shipped.
-        logOpsFailure("coolify", "promote", error);
-        opsJobs.event(job.id, "failed", { code: "coolify_promote_failed" });
-      }
-    })();
-    return opsJobs.get(job.id);
-  }
-
-  function submitDeploymentJob(application, ref) {
-    const job = opsJobs.create({ kind: "deployment", operation: "deploy", target: application });
-    const enabled = String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).includes("deploy");
-    if (!enabled || !deployments[application]) return opsJobs.event(job.id, "rejected", { code: "service_not_available" });
-    void (async () => {
-      opsJobs.event(job.id, "running");
-      try { opsJobs.event(job.id, "building"); opsJobs.event(job.id, "succeeded", { result: await deploymentAdapter.deploy({ application, ref }) }); }
-      catch (error) { logOpsFailure("deployment", "deploy", error); opsJobs.event(job.id, "failed", { code: "deployment_failed" }); }
-    })();
-    return opsJobs.get(job.id);
-  }
-
-  function hasSupervisorWrite(req) {
-    if (validateWriteToken(req, writeSession)) return true;
-    if (!isSupervisorPort) return false;
-    if (!isLoopbackAddress(req.socket?.remoteAddress)) return false;
-    return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
-  }
-
-  function rejectSupervisorWrite(res) {
-    res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-    return res.end(JSON.stringify({
-      error: "write_token_required",
-      hint: "Unlock clauth writes, unset CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN for localhost supervisor operations, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
-    }));
-  }
 
   // ── MCP SSE session tracking ──────────────────────────────
   const sseSessions = new Map(); // sessionId → { res, initialized }
@@ -4783,7 +4310,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   const server = http.createServer(async (req, res) => {
     const remote = req.socket.remoteAddress;
-    const isLocal = isLoopbackAddress(remote);
+    const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
 
     const url    = new URL(req.url, `http://127.0.0.1:${port}`);
     const reqPath = url.pathname;
@@ -4823,205 +4350,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end(JSON.stringify(result));
     }
 
-    if (method === "GET" && reqPath === "/health") {
-      return ok(res, { ...supervisorHealth(), listening_port: port, process_id: process.pid, vault_locked: !password, clauth_version: VERSION });
-    }
-
-    // Bearer-gated remote operations surface. It remains loopback-only at this
-    // layer; ingress/tunnel policy decides whether it is reachable remotely.
-    if (method === "GET" && reqPath === "/v1/ops/catalog") {
-      if (!await requireOpsBearer(req, res)) return;
-      return ok(res, { schema: "clauth.ops.v1", operations: PM2_OPERATION_CATALOG });
-    }
-
-    if (method === "GET" && reqPath === "/v1/ops/processes") {
-      if (!await requireOpsBearer(req, res)) return;
-      const job = submitOpsJob("list", {}, req._opsRole);
-      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
-    const opsProcessMatch = reqPath.match(/^\/v1\/ops\/processes\/([^/]+)$/);
-    if (method === "GET" && opsProcessMatch) {
-      if (!await requireOpsBearer(req, res)) return;
-      const job = submitOpsJob("describe", { target: decodeURIComponent(opsProcessMatch[1]) }, req._opsRole);
-      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
-    if (method === "POST" && reqPath === "/v1/ops/operations") {
-      if (!await requireOpsBearer(req, res)) return;
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "invalid_json" }));
-      }
-      const operation = String(body?.operation || "");
-      if (!PM2_OPERATION_CATALOG[operation]) {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "unknown_operation" }));
-      }
-      const job = submitOpsJob(operation, body?.input && typeof body.input === "object" ? body.input : {}, req._opsRole);
-      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
-    if (method === "POST" && reqPath === "/v1/ops/promotions") {
-      if (!await requireOpsBearer(req, res)) return;
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "invalid_json" }));
-      }
-      const applicationUuid = String(body?.application_uuid || "").trim();
-      if (!applicationUuid) {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "application_uuid_required" }));
-      }
-      const job = submitPromotionJob(applicationUuid);
-      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
-    if (method === "POST" && reqPath === "/v1/ops/deployments") {
-      if (!await requireOpsBearer(req, res)) return;
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "invalid_json" }));
-      }
-      const application = String(body?.application || "").trim();
-      if (!application) {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "application_required" }));
-      }
-      const job = submitDeploymentJob(application, body?.ref ? String(body.ref) : undefined);
-      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
-    }
-
-    const opsJobMatch = reqPath.match(/^\/v1\/ops\/jobs\/([^/]+)$/);
-    if (method === "GET" && opsJobMatch) {
-      if (!await requireOpsBearer(req, res)) return;
-      const job = opsJobs.get(decodeURIComponent(opsJobMatch[1]));
-      res.writeHead(job ? 200 : 404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job || { error: "job_not_found" }));
-    }
-
-    const opsJobEventsMatch = reqPath.match(/^\/v1\/ops\/jobs\/([^/]+)\/events$/);
-    if (method === "GET" && opsJobEventsMatch) {
-      if (!await requireOpsBearer(req, res)) return;
-      const jobId = decodeURIComponent(opsJobEventsMatch[1]);
-      if (!opsJobs.get(jobId)) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "job_not_found" }));
-      }
-      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive", ...CORS });
-      const unsubscribe = opsJobs.subscribe(jobId, (job) => {
-        if (!res.writableEnded) res.write(`event: job\ndata: ${JSON.stringify(job)}\n\n`);
-      });
-      req.on("close", unsubscribe);
-      return;
-    }
-
-    if (method === "GET" && reqPath === "/v1/plugins") {
-      return ok(res, { plugins: listPlugins() });
-    }
-
-    if (method === "POST" && reqPath === "/v1/plugins/rescan") {
-      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
-      return ok(res, discoverPlugins());
-    }
-
-    const pluginEnableMatch = reqPath.match(/^\/v1\/plugins\/([^/]+)\/(enable|disable|test|promote)$/);
-    if (method === "POST" && pluginEnableMatch) {
-      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
-      const pluginId = decodeURIComponent(pluginEnableMatch[1]);
-      const op = pluginEnableMatch[2];
-      const result = op === "enable"
-        ? setPluginEnabled(pluginId, true)
-        : op === "disable"
-          ? setPluginEnabled(pluginId, false)
-          : runPluginAction(pluginId, op);
-      res.writeHead(result.error ? 400 : 200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(result));
-    }
-
-    if (method === "GET" && reqPath === "/v1/surfaces") {
-      return ok(res, { surfaces: listSurfaces() });
-    }
-
-    const surfaceActionMatch = reqPath.match(/^\/v1\/surfaces\/([^/]+)\/actions$/);
-    if (method === "POST" && surfaceActionMatch) {
-      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON" }));
-      }
-      const result = runSurfaceAction(decodeURIComponent(surfaceActionMatch[1]), body?.action || "reconcile");
-      res.writeHead(result.error ? 400 : 200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(result));
-    }
-
-    if (method === "GET" && reqPath === "/v1/routes") {
-      return ok(res, { routes: listRoutes() });
-    }
-
-    if (method === "GET" && reqPath === "/v1/tunnels") {
-      return ok(res, { tunnels: listTunnels() });
-    }
-
-    if (method === "GET" && reqPath === "/v1/logs") {
-      const limit = Number(url.searchParams.get("limit") || 100);
-      const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(limit, 500)) : 100;
-      const state = loadSupervisorState();
-      return ok(res, {
-        schema: "clauth.supervisor.logs.v1",
-        log_path: path.join(getSupervisorDir(), "events.jsonl"),
-        events: readSupervisorEvents(boundedLimit).map(supervisorLogDto),
-        operations: (state.operations || []).slice(0, boundedLimit).map(supervisorOperationDto),
-      });
-    }
-
-    const tunnelRoutesMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes$/);
-    if (method === "POST" && tunnelRoutesMatch) {
-      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON" }));
-      }
-      return ok(res, addTunnelRoute(decodeURIComponent(tunnelRoutesMatch[1]), body, "localhost"));
-    }
-
-    const tunnelRouteDeleteMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes\/([^/]+)$/);
-    if (method === "DELETE" && tunnelRouteDeleteMatch) {
-      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
-      return ok(res, removeTunnelRoute(decodeURIComponent(tunnelRouteDeleteMatch[1]), decodeURIComponent(tunnelRouteDeleteMatch[2]), "localhost"));
-    }
-
-    if (method === "GET" && reqPath.startsWith("/v1/operations/")) {
-      const id = decodeURIComponent(reqPath.split("/").pop());
-      const operation = (supervisorHealth(), readSupervisorEvents(500)).find((event) => event.operationId === id);
-      res.writeHead(operation ? 200 : 404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(operation ? supervisorLogDto(operation) : { error: "operation_not_found" }));
-    }
-
-    if (method === "GET" && reqPath === "/v1/events") {
-      res.writeHead(200, {
-        "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        "Connection": "keep-alive",
-        ...CORS,
-      });
-      for (const event of readSupervisorEvents(Number(url.searchParams.get("limit") || 100))) {
-        res.write(`event: supervisor\ndata: ${JSON.stringify(supervisorLogDto(event))}\n\n`);
-      }
-      res.end();
-      return;
-    }
-
     // ── Hosts that bypass OAuth (fresh domains for claude.ai compatibility) ──
     const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
@@ -8137,27 +7465,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     });
   }
 
-  // The localhost supervisor is the only process allowed to repair clauth-owned
-  // local surfaces. Keep this loop out of the vault/staged instances and make
-  // the cadence configurable for deterministic tests.
-  if (port === getSupervisorPort() && process.env.CLAUTH_SUPERVISOR_HEALTH_RECONCILE !== "0") {
-    const configuredInterval = Number(process.env.CLAUTH_SUPERVISOR_HEALTH_INTERVAL_MS || 10000);
-    const intervalMs = Number.isFinite(configuredInterval) ? Math.max(1000, Math.min(configuredInterval, 300000)) : 10000;
-    let healthReconcileInFlight = false;
-    const runHealthReconcile = () => {
-      if (healthReconcileInFlight) return;
-      healthReconcileInFlight = true;
-      reconcileSurfaceHealth().catch((err) => {
-        try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] supervisor health reconcile failed: ${err.message}\n`); } catch {}
-      }).finally(() => { healthReconcileInFlight = false; });
-    };
-    const healthTimer = setInterval(runHealthReconcile, intervalMs);
-    healthTimer.unref?.();
-    server.__supervisorHealthTimer = healthTimer;
-    server.on("close", () => clearInterval(healthTimer));
-    setImmediate(runHealthReconcile);
-  }
-
   return server;
 }
 
@@ -8173,61 +7480,6 @@ async function verifyAuth(password) {
   }
 }
 
-async function supervisorResponds(port = getSupervisorPort()) {
-  try {
-    const resp = await fetch(`http://127.0.0.1:${port}/health`);
-    return resp.ok;
-  } catch {
-    return false;
-  }
-}
-
-async function ensureSupervisorStarted(cliEntry) {
-  const port = getSupervisorPort();
-  const existing = readSupervisorPid();
-  if (existing && isProcessAlive(existing.pid) && await supervisorResponds(existing.port)) {
-    return { started: false, pid: existing.pid, port: existing.port, state: "already_running" };
-  }
-  if (existing && !isProcessAlive(existing.pid)) removeSupervisorPid();
-  if (await supervisorResponds(port)) {
-    return { started: false, pid: existing?.pid || null, port, state: "port_already_live" };
-  }
-
-  const out = fs.openSync(LOG_FILE, "a");
-  const child = spawn(process.execPath, [cliEntry, "serve", "supervisor", "--port", String(port)], {
-    detached: true,
-    stdio: ["ignore", out, out],
-    env: { ...process.env, __CLAUTH_SUPERVISOR_DAEMON: "1" },
-  });
-  child.unref();
-  writeSupervisorPid(child.pid, port);
-
-  for (let attempt = 0; attempt < 5; attempt++) {
-    await new Promise(r => setTimeout(r, 500));
-    if (await supervisorResponds(port)) {
-      return { started: true, pid: child.pid, port, state: "started" };
-    }
-  }
-  return { started: true, pid: child.pid, port, state: "start_unverified" };
-}
-
-async function stopSupervisorSibling() {
-  const info = readSupervisorPid();
-  if (!info) return null;
-  if (!isProcessAlive(info.pid)) {
-    removeSupervisorPid();
-    return { stopped: false, pid: info.pid, port: info.port, state: "stale" };
-  }
-  try {
-    process.kill(info.pid, "SIGTERM");
-    await new Promise(r => setTimeout(r, 300));
-    removeSupervisorPid();
-    return { stopped: true, pid: info.pid, port: info.port, state: "stopped" };
-  } catch (err) {
-    return { stopped: false, pid: info.pid, port: info.port, state: "stop_failed", error: err.message };
-  }
-}
-
 async function actionStart(opts) {
   if (opts.isolated) {
     return actionForeground(opts);
@@ -8429,11 +7681,6 @@ async function actionStart(opts) {
     console.log(chalk.gray(`  Port:     127.0.0.1:${info.port}`));
     console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
     console.log(chalk.gray(`  Log:      ${LOG_FILE}`));
-    if (!isStaged) {
-      const supervisor = await ensureSupervisorStarted(cliEntry);
-      const verb = supervisor.started ? "started" : "available";
-      console.log(chalk.gray(`  Supervisor: ${verb} on 127.0.0.1:${supervisor.port}${supervisor.pid ? ` (PID ${supervisor.pid})` : ""}`));
-    }
     if (isStaged) {
       console.log(chalk.yellow(`\n  ⚡ Staged on port ${port} — open dashboard to verify, then click "Make Live"`));
     } else if (!password) {
@@ -8451,7 +7698,6 @@ async function actionStart(opts) {
 async function actionStop() {
   const info = readPid();
   if (!info) {
-    await stopSupervisorSibling();
     console.log(chalk.yellow("\n  No clauth serve PID file found — not running.\n"));
     return;
   }
@@ -8459,7 +7705,6 @@ async function actionStop() {
   if (!isProcessAlive(info.pid)) {
     console.log(chalk.yellow(`\n  PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
     removePid();
-    await stopSupervisorSibling();
     return;
   }
 
@@ -8470,7 +7715,6 @@ async function actionStop() {
       await new Promise(r => setTimeout(r, 300));
       console.log(chalk.green(`\n  🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
       removePid();
-      await stopSupervisorSibling();
       return;
     }
   } catch {}
@@ -8484,7 +7728,6 @@ async function actionStop() {
     console.log(chalk.yellow(`\n  Could not kill PID ${info.pid}: ${err.message}\n`));
   }
   removePid();
-  await stopSupervisorSibling();
 }
 
 async function actionPing() {
@@ -8529,9 +7772,7 @@ async function actionRestart(opts) {
 async function actionForeground(opts) {
   const port      = parseInt(opts.port || "52437", 10);
   const isolated  = !!opts.isolated;
-  const containerPassword = process.env.CLAUTH_MASTER_PASSWORD || process.env["clauth-master-password"] || null;
-  const password  = isolated ? null : (opts.pw || containerPassword);
-  const bindHost  = process.env.CLAUTH_BIND_HOST || "127.0.0.1";
+  const password  = isolated ? null : (opts.pw || null);
   const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())
@@ -8557,14 +7798,14 @@ async function actionForeground(opts) {
     console.log(chalk.yellow("\n  Starting in locked state — open browser to unlock"));
   }
 
-  console.log(chalk.gray(`  Port:     ${bindHost}:${port}`));
+  console.log(chalk.gray(`  Port:     127.0.0.1:${port}`));
   console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
   console.log(chalk.gray(`  Lockout:  3 failures → exit\n`));
 
   const server = createServer(password, whitelist, port, tunnelHostname);
-  server.listen(port, bindHost, () => {
+  server.listen(port, "127.0.0.1", () => {
     if (!isolated) writePid(process.pid, port);
-    console.log(chalk.green(`  clauth serve → http://${bindHost}:${port}`));
+    console.log(chalk.green(`  clauth serve → http://127.0.0.1:${port}`));
     if (tunnelHostname) {
       console.log(chalk.cyan(`  Tunnel:   https://${tunnelHostname}/sse`));
       console.log("");
@@ -11641,41 +10882,6 @@ const MCP_TOOLS = [
       additionalProperties: false,
     },
   },
-  {
-    name: "clauth_ops_catalog",
-    description: "Return the Vultr deployment-control API catalog. Availability is still decided on Vultr.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_processes",
-    description: "Submit a scoped PM2 process-status query to the Vultr control plane. Only server-approved applications are returned.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_describe",
-    description: "Submit a scoped PM2 status query for one server-approved application.",
-    inputSchema: { type: "object", properties: { application: { type: "string" } }, required: ["application"], additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_deploy",
-    description: "Submit one manifest-scoped development deployment to Vultr. The server chooses the repository, build, PM2 process, and allowed ref.",
-    inputSchema: { type: "object", properties: { application: { type: "string" }, ref: { type: "string" } }, required: ["application"], additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_promote",
-    description: "Submit one server-allowlisted Coolify promotion and return its asynchronous job receipt.",
-    inputSchema: { type: "object", properties: { application_uuid: { type: "string" } }, required: ["application_uuid"], additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_job",
-    description: "Read the terminal or in-progress receipt for a deployment-control job.",
-    inputSchema: { type: "object", properties: { job_id: { type: "string" } }, required: ["job_id"], additionalProperties: false },
-  },
-  {
-    name: "clauth_ops_run",
-    description: "Submit one PM2 operation through the Vultr control plane. The remote agent/admin profile decides whether the operation and target are available.",
-    inputSchema: { type: "object", properties: { operation: { type: "string" }, input: { type: "object" } }, required: ["operation"], additionalProperties: false },
-  },
 ];
 
 const MCP_WRITE_TOOL_NAMES = new Set([
@@ -11683,9 +10889,6 @@ const MCP_WRITE_TOOL_NAMES = new Set([
   "clauth_disable",
   "clauth_set_project",
   "clauth_generate_token",
-  "clauth_ops_deploy",
-  "clauth_ops_promote",
-  "clauth_ops_run",
 ]);
 
 function filterMcpToolsForWriteMode(tools) {
@@ -11719,24 +10922,6 @@ function mcpError(text) {
   return { content: [{ type: "text", text }], isError: true };
 }
 
-async function callOpsFromMcp(vault, method, requestPath, body, { write = false } = {}) {
-  if (write && !vault.writeEnabled) return mcpError("MCP write tools are disabled by default. Launch clauth with CLAUTH_MCP_WRITE=1 for an explicit write-capable session.");
-  if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
-    const endpoint = process.env.CLAUTH_OPS_APPROVED_ORIGIN;
-    if (!endpoint) return mcpError("service_not_available");
-  try {
-    const url = new URL(endpoint);
-    if (url.protocol !== "https:") return mcpError("service_not_available");
-    const service = process.env.CLAUTH_OPS_TOKEN_SERVICE || "vultr-ops-api-token";
-    const credential = await vaultRetrieveValue(vault, service);
-    if (credential.error || !credential.value) return mcpError("service_not_available");
-    const payload = await requestOps({ endpoint: url.toString().replace(/\/$/, ""), token: String(credential.value), method, path: requestPath, body });
-    return mcpResult(JSON.stringify(payload, null, 2));
-  } catch {
-    return mcpError("service_not_available");
-  }
-}
-
 // Windows cmd.exe doesn't support single quotes — use bash for gws JSON args
 const GWS_EXEC_OPTS = { encoding: "utf8", timeout: 30000, windowsHide: true, shell: os.platform() === "win32" ? "bash" : undefined };
 
@@ -11747,13 +10932,6 @@ async function handleMcpTool(vault, name, args) {
   };
 
   switch (name) {
-    case "clauth_ops_catalog": return callOpsFromMcp(vault, "GET", "/v1/ops/catalog");
-    case "clauth_ops_processes": return callOpsFromMcp(vault, "GET", "/v1/ops/processes");
-    case "clauth_ops_describe": return callOpsFromMcp(vault, "GET", `/v1/ops/processes/${encodeURIComponent(args.application || "")}`);
-    case "clauth_ops_deploy": return callOpsFromMcp(vault, "POST", "/v1/ops/deployments", { application: args.application, ...(args.ref ? { ref: args.ref } : {}) }, { write: true });
-    case "clauth_ops_promote": return callOpsFromMcp(vault, "POST", "/v1/ops/promotions", { application_uuid: args.application_uuid }, { write: true });
-    case "clauth_ops_job": return callOpsFromMcp(vault, "GET", `/v1/ops/jobs/${encodeURIComponent(args.job_id || "")}`);
-    case "clauth_ops_run": return callOpsFromMcp(vault, "POST", "/v1/ops/operations", { operation: args.operation, input: args.input && typeof args.input === "object" ? args.input : {} }, { write: true });
     case "clauth_ping": {
       return mcpResult(
         vault.password
@@ -13954,13 +13132,6 @@ async function actionUpgrade(opts) {
   return actionStart(opts);
 }
 
-async function actionSupervisor(opts) {
-  opts.isolated = true;
-  opts.port = String(opts.port || getSupervisorPort());
-  discoverPlugins();
-  return actionForeground(opts);
-}
-
 export async function runServe(opts) {
   const action = opts.action || "foreground";
 
@@ -13971,13 +13142,12 @@ export async function runServe(opts) {
     case "ping":       return actionPing();
     case "foreground": return actionForeground(opts);
     case "mcp":        return actionMcp(opts);
-    case "supervisor": return actionSupervisor(opts);
     case "install":    return actionInstall(opts);
     case "uninstall":  return actionUninstall();
     case "upgrade":    return actionUpgrade(opts);
     default:
       console.log(chalk.red(`\n  Unknown serve action: ${action}`));
-      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp | supervisor | install | uninstall | upgrade\n"));
+      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp | install | uninstall | upgrade\n"));
       process.exit(1);
   }
 }