@lifeaitools/clauth 1.30.3 → 1.30.5

package/cli/enrollment-script.js

@@ -0,0 +1,82 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+function shellSingleQuote(value) {
+  return `'${String(value ?? "").replace(/'/g, "''")}'`;
+}
+
+function posixShellQuote(value) {
+  return `'${String(value ?? "").replace(/'/g, "'\\\"'\\\"'")}'`;
+}
+
+export function enrollmentScriptName(label, target = "windows") {
+  const slug = String(label || "new-computer")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40) || "new-computer";
+  return `clauth-enroll-${slug}${target === "linux" ? ".sh" : ".ps1"}`;
+}
+
+function windowsScript({ supabaseUrl, anonKey, enrollmentCode }) {
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    "$label = $env:COMPUTERNAME",
+    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
+    "npm install -g @lifeaitools/clauth@latest",
+    ["clauth setup", `--supabase-url ${shellSingleQuote(supabaseUrl)}`, `--anon-key ${shellSingleQuote(anonKey)}`, `--enrollment-code ${shellSingleQuote(enrollmentCode)}`, "--label \"$label\""].join(" "),
+    "clauth serve install",
+    "$self = $PSCommandPath",
+    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; & ('Remove' + '-Item') -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
+  ].join("\r\n");
+}
+
+function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
+  return [
+    "#!/usr/bin/env sh",
+    "set -eu",
+    "label=$(hostname)",
+    "as_root() { if [ \"$(id -u)\" -eq 0 ]; then \"$@\"; elif command -v sudo >/dev/null; then sudo \"$@\"; else echo 'Root or sudo is required to install prerequisites.' >&2; exit 1; fi; }",
+    "install_prerequisites() {",
+    "  if command -v apt-get >/dev/null; then as_root apt-get update; as_root apt-get install -y nodejs npm openssl;",
+    "  elif command -v dnf >/dev/null; then as_root dnf install -y nodejs npm openssl;",
+    "  else echo 'Headless enrollment supports systemd hosts with apt-get or dnf. Install Node.js 18+, npm, and openssl, then rerun this script.' >&2; exit 1; fi",
+    "}",
+    "if ! command -v systemctl >/dev/null || ! command -v loginctl >/dev/null; then echo 'Headless enrollment requires systemd and loginctl.' >&2; exit 1; fi",
+    "if ! command -v node >/dev/null || ! command -v npm >/dev/null || ! command -v openssl >/dev/null; then install_prerequisites; fi",
+    "node_major=$(node -p \"process.versions.node.split('.')[0]\")",
+    "if [ \"$node_major\" -lt 18 ]; then echo 'Node.js 18+ is required.' >&2; exit 1; fi",
+    "if ! npm install -g @lifeaitools/clauth@latest; then as_root npm install -g @lifeaitools/clauth@latest; fi",
+    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
+    "user_name=$(id -un)",
+    "if loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; elif as_root loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; else echo 'Could not enable linger for unattended restart.' >&2; exit 1; fi",
+    "if ! test -t 0; then echo 'Headless enrollment requires an interactive TTY to set the vault password.' >&2; exit 1; fi",
+    "restore_echo() { stty echo 2>/dev/null || true; }",
+    "trap restore_echo EXIT HUP INT TERM",
+    "printf 'Re-enter the vault password to enable unattended restart: ' >&2",
+    "stty -echo",
+    "IFS= read -r vault_password",
+    "stty echo",
+    "trap - EXIT HUP INT TERM",
+    "printf '\\n' >&2",
+    "[ -n \"$vault_password\" ] || { echo 'A vault password is required for unattended restart.' >&2; exit 1; }",
+    "printf %s \"$vault_password\" | clauth serve install --pw-stdin",
+    "unset vault_password",
+    "rm -f -- \"$0\"",
+  ].join("\n");
+}
+
+export function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label, target = "windows", appDir } = {}) {
+  if (!["windows", "linux"].includes(target)) throw new Error(`Unsupported enrollment target: ${target}`);
+  const outputDir = appDir || (process.platform === "win32"
+    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
+    : path.join(os.homedir(), ".config", "clauth"));
+  fs.mkdirSync(outputDir, { recursive: true });
+  const scriptPath = path.join(outputDir, enrollmentScriptName(label, target));
+  const script = target === "linux"
+    ? linuxScript({ supabaseUrl, anonKey, enrollmentCode })
+    : windowsScript({ supabaseUrl, anonKey, enrollmentCode });
+  fs.writeFileSync(scriptPath, `${script}\n`, { encoding: "utf8", mode: target === "linux" ? 0o700 : undefined });
+  return scriptPath;
+}

package/cli/index.js

@@ -13,53 +13,11 @@ import { writeCredentialWithRecovery } from "./recovery.js";
 import os from "os";
 import fs from "fs";
 import path from "path";
+import { writeEnrollmentScript } from "./enrollment-script.js";
 
 const config = new Conf(getConfOptions());
 const VERSION = JSON.parse(fs.readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
-function shellSingleQuote(value) {
-  return `'${String(value ?? "").replace(/'/g, "''")}'`;
-}
-
-function enrollmentScriptName(label) {
-  const slug = String(label || "new-computer")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40) || "new-computer";
-  return `clauth-enroll-${slug}.ps1`;
-}
-
-function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label }) {
-  const appDir = process.platform === "win32"
-    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
-    : path.join(os.homedir(), ".config", "clauth");
-  fs.mkdirSync(appDir, { recursive: true });
-  const scriptPath = path.join(appDir, enrollmentScriptName(label));
-  const script = [
-    "$ErrorActionPreference = 'Stop'",
-    "$label = $env:COMPUTERNAME",
-    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
-    "Write-Host 'Installing clauth...'",
-    "npm install -g @lifeaitools/clauth@latest",
-    "Write-Host 'Enrolling this computer with clauth...'",
-    [
-      "clauth setup",
-      `--supabase-url ${shellSingleQuote(supabaseUrl)}`,
-      `--anon-key ${shellSingleQuote(anonKey)}`,
-      `--enrollment-code ${shellSingleQuote(enrollmentCode)}`,
-      "--label \"$label\"",
-    ].join(" "),
-    "Write-Host 'Installing clauth startup service...'",
-    "clauth serve install",
-    "Write-Host 'clauth enrollment complete.'",
-    "$self = $PSCommandPath",
-    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; Remove-Item -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
-  ].join("\r\n");
-  fs.writeFileSync(scriptPath, `${script}\r\n`, "utf8");
-  return scriptPath;
-}
-
 // ============================================================
 // Password prompt helper
 // ============================================================
@@ -391,6 +349,7 @@ program
   .option("--label <label>", "Suggested label for the new computer")
   .option("--ttl-minutes <minutes>", "Enrollment lifetime, 5 to 1440 minutes", "60")
   .option("--install-id <id>", "Override install id; default is current machine's install id")
+  .option("--target <target>", "Enrollment target: windows or linux", "windows")
   .option("-p, --pw <password>", "Password (or will prompt)")
   .action(async (opts) => {
     console.log(chalk.cyan("\n🔐 clauth enroll\n"));
@@ -414,6 +373,7 @@ program
         anonKey,
         enrollmentCode: result.enrollment_code,
         label: opts.label,
+        target: opts.target,
       });
       spinner.succeed(chalk.green(`Enrollment created for install_id=${result.install_id}`));
       console.log("");
@@ -1047,7 +1007,9 @@ program
   .option("--tunnel <hostname>", "Fixed tunnel hostname (e.g. clauth.prtrust.fund) — uses named Cloudflare Tunnel instead of random URL")
   .option("--staged", "Start on staging port (52438) for blue-green verification before make-live")
   .option("--isolated", "Run on a non-live port without touching live PID files, browser, or boot-key credentials")
-  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
+  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
+  .option("--pw-env", "Internal: read the daemon password from CLAUTH_BOOT_PASSWORD")
+  .option("--pw-stdin", "Internal: read the installer password from standard input")
   .option("--action <action>", "Internal: action override for daemon child")
   .addHelpText("after", `
 Actions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.3",
+  "version": "1.30.5",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {