@lifeaitools/clauth 1.30.26 → 1.31.1

package/cli/commands/uninstall.js

@@ -1,164 +1,164 @@
-// cli/commands/uninstall.js
-// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
-//
-// Reverses everything `clauth install` does:
-//   1. Drops clauth tables, policies, triggers, functions from Supabase
-//   2. Deletes auth-vault Edge Function
-//   3. Removes CLAUTH_* secrets
-//   4. Removes Claude skill directory
-//   5. Clears local config (Conf store)
-
-import { existsSync, rmSync } from 'fs';
-import { join } from 'path';
-import Conf from 'conf';
-import chalk from 'chalk';
-import ora from 'ora';
-
-const MGMT = 'https://api.supabase.com/v1';
-const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
-  (process.platform === 'win32'
-    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
-    : join(process.env.HOME || '', '.claude', 'skills'));
-
-// ─────────────────────────────────────────────
-// Supabase Management API helper
-// ─────────────────────────────────────────────
-async function mgmt(pat, method, path, body) {
-  const res = await fetch(`${MGMT}${path}`, {
-    method,
-    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-    body: body ? JSON.stringify(body) : undefined,
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => res.statusText);
-    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
-  }
-  if (res.status === 204) return {};
-  const text = await res.text();
-  if (!text) return {};
-  return JSON.parse(text);
-}
-
-// ─────────────────────────────────────────────
-// Main uninstall command
-// ─────────────────────────────────────────────
-export async function runUninstall(opts = {}) {
-  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
-
-  const config = new Conf({ projectName: 'clauth' });
-
-  // ── Collect credentials ────────────────────
-  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
-  const pat = opts.pat;
-
-  if (!ref) {
-    console.log(chalk.red('  Cannot determine Supabase project ref.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-  if (!pat) {
-    console.log(chalk.red('  Supabase PAT required for teardown.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-
-  console.log(chalk.gray(`  Project: ${ref}\n`));
-
-  // ── Step 1: Drop database objects ──────────
-  const s1 = ora('Dropping clauth database objects...').start();
-  const teardownSQL = `
-    -- Drop triggers
-    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
-
-    -- Drop tables (CASCADE drops policies automatically)
-    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
-    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
-    DROP TABLE IF EXISTS public.clauth_services CASCADE;
-
-    -- Drop functions
-    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
-  `;
-
-  try {
-    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
-    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
-  } catch (e) {
-    s1.fail(`Database teardown failed: ${e.message}`);
-    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
-  }
-
-  // ── Step 2: Delete Edge Function ───────────
-  const s2 = ora('Deleting auth-vault Edge Function...').start();
-  try {
-    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}` },
-    });
-    if (res.ok || res.status === 404) {
-      s2.succeed(res.status === 404
-        ? 'Edge Function not found (already deleted)'
-        : 'Edge Function deleted');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s2.fail(`Edge Function delete failed: ${e.message}`);
-    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
-  }
-
-  // ── Step 3: Remove secrets ─────────────────
-  const s3 = ora('Removing clauth secrets...').start();
-  try {
-    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
-    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
-    });
-    if (res.ok) {
-      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s3.warn(`Secret removal failed: ${e.message}`);
-    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
-  }
-
-  // ── Step 4: Remove Claude skill ────────────
-  const s4 = ora('Removing Claude skill...').start();
-  const skillDir = join(SKILLS_DIR, 'clauth');
-  if (existsSync(skillDir)) {
-    try {
-      rmSync(skillDir, { recursive: true, force: true });
-      s4.succeed(`Skill removed: ${skillDir}`);
-    } catch (e) {
-      s4.warn(`Could not remove skill: ${e.message}`);
-    }
-  } else {
-    s4.succeed('Skill directory not found (already removed)');
-  }
-
-  // ── Step 5: Clear local config ─────────────
-  const s5 = ora('Clearing local config...').start();
-  try {
-    config.clear();
-    s5.succeed('Local config cleared');
-  } catch (e) {
-    s5.warn(`Could not clear config: ${e.message}`);
-  }
-
-  // ── Done ───────────────────────────────────
-  console.log('');
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log('');
-  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
-  console.log('');
-}
+// cli/commands/uninstall.js
+// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
+//
+// Reverses everything `clauth install` does:
+//   1. Drops clauth tables, policies, triggers, functions from Supabase
+//   2. Deletes auth-vault Edge Function
+//   3. Removes CLAUTH_* secrets
+//   4. Removes Claude skill directory
+//   5. Clears local config (Conf store)
+
+import { existsSync, rmSync } from 'fs';
+import { join } from 'path';
+import Conf from 'conf';
+import chalk from 'chalk';
+import ora from 'ora';
+
+const MGMT = 'https://api.supabase.com/v1';
+const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
+  (process.platform === 'win32'
+    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
+    : join(process.env.HOME || '', '.claude', 'skills'));
+
+// ─────────────────────────────────────────────
+// Supabase Management API helper
+// ─────────────────────────────────────────────
+async function mgmt(pat, method, path, body) {
+  const res = await fetch(`${MGMT}${path}`, {
+    method,
+    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => res.statusText);
+    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
+  }
+  if (res.status === 204) return {};
+  const text = await res.text();
+  if (!text) return {};
+  return JSON.parse(text);
+}
+
+// ─────────────────────────────────────────────
+// Main uninstall command
+// ─────────────────────────────────────────────
+export async function runUninstall(opts = {}) {
+  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
+
+  const config = new Conf({ projectName: 'clauth' });
+
+  // ── Collect credentials ────────────────────
+  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
+  const pat = opts.pat;
+
+  if (!ref) {
+    console.log(chalk.red('  Cannot determine Supabase project ref.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+  if (!pat) {
+    console.log(chalk.red('  Supabase PAT required for teardown.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+
+  console.log(chalk.gray(`  Project: ${ref}\n`));
+
+  // ── Step 1: Drop database objects ──────────
+  const s1 = ora('Dropping clauth database objects...').start();
+  const teardownSQL = `
+    -- Drop triggers
+    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
+
+    -- Drop tables (CASCADE drops policies automatically)
+    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
+    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
+    DROP TABLE IF EXISTS public.clauth_services CASCADE;
+
+    -- Drop functions
+    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
+  `;
+
+  try {
+    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
+    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
+  } catch (e) {
+    s1.fail(`Database teardown failed: ${e.message}`);
+    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
+  }
+
+  // ── Step 2: Delete Edge Function ───────────
+  const s2 = ora('Deleting auth-vault Edge Function...').start();
+  try {
+    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}` },
+    });
+    if (res.ok || res.status === 404) {
+      s2.succeed(res.status === 404
+        ? 'Edge Function not found (already deleted)'
+        : 'Edge Function deleted');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s2.fail(`Edge Function delete failed: ${e.message}`);
+    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
+  }
+
+  // ── Step 3: Remove secrets ─────────────────
+  const s3 = ora('Removing clauth secrets...').start();
+  try {
+    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
+    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
+    });
+    if (res.ok) {
+      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s3.warn(`Secret removal failed: ${e.message}`);
+    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
+  }
+
+  // ── Step 4: Remove Claude skill ────────────
+  const s4 = ora('Removing Claude skill...').start();
+  const skillDir = join(SKILLS_DIR, 'clauth');
+  if (existsSync(skillDir)) {
+    try {
+      rmSync(skillDir, { recursive: true, force: true });
+      s4.succeed(`Skill removed: ${skillDir}`);
+    } catch (e) {
+      s4.warn(`Could not remove skill: ${e.message}`);
+    }
+  } else {
+    s4.succeed('Skill directory not found (already removed)');
+  }
+
+  // ── Step 5: Clear local config ─────────────
+  const s5 = ora('Clearing local config...').start();
+  try {
+    config.clear();
+    s5.succeed('Local config cleared');
+  } catch (e) {
+    s5.warn(`Could not clear config: ${e.message}`);
+  }
+
+  // ── Done ───────────────────────────────────
+  console.log('');
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log('');
+  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
+  console.log('');
+}

package/cli/commands/watchdog.js

@@ -131,7 +131,7 @@ export async function runWatchdog(action, opts = {}) {
       console.log("Usage: clauth watchdog restart <service-id>");
       return;
     }
-    const result = await restartWatchdogService(serviceId);
+    const result = restartWatchdogService(serviceId);
     console.log(JSON.stringify(result, null, 2));
     return;
   }

package/cli/index.js

@@ -150,10 +150,37 @@ import { runInstall } from './commands/install.js';
 import { runUninstall } from './commands/uninstall.js';
 import { runScrub } from './commands/scrub.js';
 import { runServe } from './commands/serve.js';
-import { runOps } from './commands/ops.js';
-import { runOpsInstall } from './commands/ops-install.js';
 import { runCodevelop } from './commands/codevelop.js';
 import { runNpm, runPublish } from './commands/npm.js';
+import { runLogin } from './commands/login.js';
+
+// ──────────────────────────────────────────────
+// clauth login <target>
+// THE global login directive — the one sanctioned way to SSH into any
+// clauth-managed box. Never hand-fetch a private key (clauth get <ssh-service>)
+// and hand-roll ssh-agent/ssh yourself; add the box to LOGIN_TARGETS in
+// cli/commands/login.js instead and use this command.
+// ──────────────────────────────────────────────
+program
+  .command('login [target]')
+  .description('SSH into a clauth-managed box by name (e.g. vultr) — run with no target to list them')
+  .option('-c, --command <cmd>', 'Run one command instead of opening an interactive shell')
+  .option('--host <user@host>', 'Override the target\'s default host')
+  .option('--native-windows', 'Human-only: use native Windows OpenSSH instead of Git Bash (blocked for agent sessions)')
+  .addHelpText('after', `
+Examples:
+  clauth login                          List known login targets
+  clauth login vultr                    Interactive shell on the Vultr dev box
+  clauth login vultr -c "pm2 list"      Run one command, non-interactive
+  clauth login vultr --host root@1.2.3.4   Override the default host for this target
+`)
+  .action(async (target, opts) => {
+    await runLogin(target, {
+      command: opts.command,
+      host: opts.host,
+      nativeWindows: opts.nativeWindows,
+    });
+  });
 
 program
   .command('install')
@@ -1052,22 +1079,4 @@ Examples:
     await runServe({ ...opts, action: resolvedAction });
   });
 
-program
-  .command("ops <action>")
-  .description("Call the bearer-authenticated PM2 and Coolify operations control plane")
-  .option("--endpoint <url>", "HTTPS control-plane endpoint (or CLAUTH_OPS_ENDPOINT)")
-  .option("--target <name>", "PM2 process name or id")
-  .option("--script <path>", "PM2 script path for start")
-  .option("--instances <n>", "PM2 scale target")
-  .option("--operation <name>", "PM2 operation for run")
-  .option("--args-json <json>", "JSON positional arguments for a raw pm2_* operation")
-  .option("--options-json <json>", "JSON PM2 options for a typed operation")
-  .option("--application <uuid>", "registered Coolify application UUID for promote")
-  .option("--ref <name>", "registered Git ref for deploy")
-  .option("--job <id>", "job id for status lookup")
-  .option("--config <path>", "server-side JSON policy for ops install")
-  .option("--dry-run", "validate and print ops install configuration without changing PM2")
-  .addHelpText("after", `\nActions: catalog | list | describe | run | deploy | promote | job | install\n\nInstall: clauth ops install --config /etc/clauth/ops-control-plane.json\nThe installer creates or updates a PM2-managed local control plane, then proves /health and the bearer gate without reading a token.\n\nThe bearer is retrieved only from local clauth service vultr-ops-api-token and is never printed.\n`)
-  .action(async (action, opts) => { if (action === "install") await runOpsInstall(opts); else await runOps(action, opts); });
-
 program.parse(process.argv);

package/cli/supervisor-registry.js

@@ -7,12 +7,7 @@ import { spawnSync } from "node:child_process";
 const SCHEMA = "lifeai.plugin.v1";
 const DEFAULT_TIMEOUT_MS = 3000;
 const DEFAULT_SUPERVISOR_PORT = 52439;
-// local/clauth/daemon: for a surface that is not a separately-startable
-// process at all, but literally embedded in the clauth daemon itself (e.g.
-// fs-mcp) — distinct from local/clauth/pm2 (a separate local process clauth
-// manages via pm2) because there is nothing for a surface action to
-// start/stop/restart; the daemon's own lifecycle IS the surface's lifecycle.
-const DESTINATIONS = new Set(["local/clauth/pm2", "local/clauth/daemon", "vultr/clauth/pm2", "coolify/clauth/docker"]);
+const DESTINATIONS = new Set(["local/clauth/pm2", "vultr/clauth/pm2", "coolify/clauth/docker"]);
 const OWNERS = new Set(["clauth", "plugin", "external"]);
 const ACTIONS = new Set(["start", "stop", "restart", "reconcile", "test", "promote", "rollback"]);
 const DEFAULT_HEALTH_RECONCILE_INTERVAL_MS = 10000;

package/cli/watchdog-registry.js

@@ -178,30 +178,7 @@ export function readWatchdogEvents(limit = 100) {
   }
 }
 
-async function verifyRestartHealth(service) {
-  if (!service.health?.url) return { ok: true, health_status: "not_configured" };
-
-  const attempts = Number(service.health.readyAttempts || 20);
-  const delayMs = Number(service.health.readyDelayMs || 250);
-  let observed;
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    observed = await evaluateWatchdogService(service);
-    if (observed.status === "healthy") {
-      return { ok: true, health_status: observed.status, health_http_status: observed.httpStatus, attempts: attempt };
-    }
-    if (attempt < attempts) await new Promise((resolve) => setTimeout(resolve, delayMs));
-  }
-  return {
-    ok: false,
-    error: "restart_health_unreachable",
-    health_status: observed?.status || "unknown",
-    health_http_status: observed?.httpStatus,
-    health_error: observed?.error,
-    attempts,
-  };
-}
-
-export async function restartWatchdogService(id) {
+export function restartWatchdogService(id) {
   const service = loadRegistry().services.find((candidate) => candidate.id === id);
   if (!service) return { ok: false, error: "service_not_registered" };
   if (!service.restart) return { ok: false, error: "restart_not_configured" };
@@ -215,23 +192,18 @@ export async function restartWatchdogService(id) {
     encoding: "utf8",
     timeout: Number(service.restart.timeoutMs || 30000),
   });
-  const health = result.status === 0 ? await verifyRestartHealth(service) : { ok: false, health_status: "not_checked" };
   const event = {
     kind: "restart",
     service_id: id,
     status: result.status,
-    health_status: health.health_status,
-    health_http_status: health.health_http_status,
-    health_error: health.health_error,
     error: result.error ? result.error.message : undefined,
   };
   appendEvent(event);
   return {
-    ok: result.status === 0 && health.ok,
+    ok: result.status === 0,
     status: result.status,
     stdout: result.stdout,
     stderr: result.stderr,
     error: result.error ? result.error.message : undefined,
-    ...health,
   };
 }

package/cli/watchdog-registry.test.js

@@ -13,12 +13,12 @@ import {
   validateWatchdogService,
 } from "./watchdog-registry.js";
 
-async function withTempRegistry(fn) {
+function withTempRegistry(fn) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-watchdog-"));
   const old = process.env.CLAUTH_WATCHDOG_DIR;
   process.env.CLAUTH_WATCHDOG_DIR = dir;
   try {
-    return await fn(dir);
+    return fn(dir);
   } finally {
     if (old === undefined) delete process.env.CLAUTH_WATCHDOG_DIR;
     else process.env.CLAUTH_WATCHDOG_DIR = old;
@@ -78,35 +78,12 @@ test("registerWatchdogManifest upserts services by id", () => withTempRegistry((
   assert.equal(registry.services.find((service) => service.id === "codeflow").label, "CodeFlow Updated");
 }));
 
-test("restartWatchdogService rejects missing and unapproved services", async () => withTempRegistry(async () => {
-  assert.deepEqual(await restartWatchdogService("missing"), { ok: false, error: "service_not_registered" });
+test("restartWatchdogService rejects missing and unapproved services", () => withTempRegistry(() => {
+  assert.deepEqual(restartWatchdogService("missing"), { ok: false, error: "service_not_registered" });
   registerWatchdogManifest({
     services: [
       { id: "dev-center", label: "Dev Center", kind: "process", restart: { cmd: "node", args: ["--version"] } },
     ],
   });
-  assert.deepEqual(await restartWatchdogService("dev-center"), { ok: false, error: "approval_required" });
-}));
-
-test("restartWatchdogService requires registered health after launching", async () => withTempRegistry(async () => {
-  registerWatchdogManifest({
-    services: [{
-      id: "health-gated",
-      label: "Health gated",
-      kind: "http",
-      health: { url: "http://127.0.0.1:3109/health", readyAttempts: 2, readyDelayMs: 0 },
-      restart: { cmd: process.execPath, args: ["--version"] },
-      approvalRequired: false,
-    }],
-  });
-  const originalFetch = globalThis.fetch;
-  globalThis.fetch = async () => ({ ok: false, status: 503 });
-  try {
-    const result = await restartWatchdogService("health-gated");
-    assert.equal(result.ok, false);
-    assert.equal(result.error, "restart_health_unreachable");
-    assert.equal(result.health_status, "degraded");
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
+  assert.deepEqual(restartWatchdogService("dev-center"), { ok: false, error: "approval_required" });
 }));