@lifeaitools/clauth 1.30.4 → 1.30.6

package/cli/commands/serve.js

@@ -627,8 +627,9 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-reveal{background:#1e3a5f;color:#60a5fa}.btn-reveal:hover{background:#1e4a7f}
   .btn-copy{background:#1a3328;color:#4ade80}.btn-copy:hover{background:#1a4338}
   .btn-set{background:#2d1f4a;color:#a78bfa}.btn-set:hover{background:#3d2f5a}
-  .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
-  .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
+  .btn-save{background:#1e3a5f;color:#60a5fa;padding:6px 16px}.btn-save:hover{background:#1e4a7f}
+  .btn-generate{background:#3b2f0d;color:#facc15;padding:6px 12px}.btn-generate:hover{background:#56420d}
+  .btn-cancel{background:transparent;color:#64748b;padding:6px 10px}.btn-cancel:hover{color:#94a3b8}
   .btn-check{background:#0f2d2d;color:#34d399;border:1px solid #064e3b;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
   .btn-check:hover{background:#134e4a;border-color:#34d399}.btn-check:disabled{opacity:.5;cursor:not-allowed}
   .btn-enable{background:#14291a;color:#4ade80;border:1px solid #166534}.btn-enable:hover{background:#1a3d22;border-color:#4ade80}
@@ -1198,10 +1199,11 @@ function renderSetPanel(serviceOrName) {
   return \`
     <div class="set-panel" id="set-panel-\${id}">
       <label>New value for <strong>\${displayName}</strong> — paste here, never in chat</label>
-      <textarea class="set-input" id="set-input-\${id}" placeholder="\${htmlEscape(SERVICE_HINTS[name] || "Paste credential…")}" spellcheck="false"></textarea>
-      \${SERVICE_HINTS[name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${htmlEscape(SERVICE_HINTS[name])}</div>\` : ""}
-      <div class="set-foot">
-        <button class="btn btn-save" type="button" onclick='saveKey(\${arg})'>Save</button>
+      <textarea class="set-input" id="set-input-\${id}" placeholder="\${htmlEscape(SERVICE_HINTS[name] || "Paste credential…")}" spellcheck="false"></textarea>
+      \${SERVICE_HINTS[name] ? \`<div style="font-size:.72rem;color:#475569;margin-top:4px;font-family:'Courier New',monospace">\${htmlEscape(SERVICE_HINTS[name])}</div>\` : ""}
+      <div class="set-foot">
+        <button class="btn btn-generate" type="button" onclick='generateSecretKey(\${arg})'>Generate 32-byte key</button>
+        <button class="btn btn-save" type="button" onclick='saveKey(\${arg})'>Save</button>
         <button class="btn btn-cancel" type="button" onclick='toggleSet(\${arg})'>Cancel</button>
         <span class="set-msg" id="set-msg-\${id}"></span>
       </div>
@@ -2026,10 +2028,19 @@ function toggleSet(name) {
   }
 }
 
-function getServiceKeyType(name) {
-  const svc = allServices.find(s => s.name === name);
-  return String(svc?.key_type || "").toLowerCase();
-}
+function getServiceKeyType(name) {
+  const svc = allServices.find(s => s.name === name);
+  return String(svc?.key_type || "").toLowerCase();
+}
+
+function generateSecretKey(name) {
+  const input = document.getElementById("set-input-" + serviceDomId(name));
+  if (!input) return;
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  input.value = Array.from(bytes, byte => byte.toString(16).padStart(2, "0")).join("");
+  input.focus();
+  input.select();
+}
 
 async function saveKey(name) {
   const id = serviceDomId(name);
@@ -12610,14 +12621,14 @@ async function actionInstall(opts) {
   //   2. No password → install watchdog that starts daemon in locked mode
   //      The browser dashboard opens, user enters password there.
   //      For passwordless restart, user can later run: clauth serve seal
-  const pw = opts.pw || null;
+  const pw = opts.pw || (opts.pwStdin ? fs.readFileSync(0, "utf8").replace(/\r?\n$/, "") : null);
 
   if (platform === "win32") {
     await installWindows(pw, tunnelHostname, execSync);
   } else if (platform === "darwin") {
     await installMacOS(pw, tunnelHostname, execSync);
   } else {
-    await installLinux(pw, tunnelHostname, execSync);
+    await installLinux(pw, tunnelHostname, execSync, opts.pwStdin === true);
   }
 }
 
@@ -12851,7 +12862,7 @@ async function installMacOS(pw, tunnelHostname, execSync) {
 }
 
 // ── Linux: encrypted file + systemd user service ───────────
-async function installLinux(pw, tunnelHostname, execSync) {
+async function installLinux(pw, tunnelHostname, execSync, forceBootKey = false) {
   const configDir = path.join(os.homedir(), ".config", "clauth");
   const bootKeyPath = path.join(configDir, "boot.key");
   const systemdDir = path.join(os.homedir(), ".config", "systemd", "user");
@@ -12864,7 +12875,7 @@ async function installLinux(pw, tunnelHostname, execSync) {
   let useSecretTool = false;
   const spinner = ora("Storing password securely...").start();
 
-  if (pw) {
+  if (pw && !forceBootKey) {
     try {
       execSync("which secret-tool", { encoding: "utf8", stdio: "pipe" });
       execFileSync("secret-tool", ["store", "--label=clauth daemon password", "service", "clauth", "account", "daemon"], {
@@ -12874,23 +12885,25 @@ async function installLinux(pw, tunnelHostname, execSync) {
       });
       useSecretTool = true;
       spinner.succeed(chalk.green("Password stored via secret-tool (GNOME Keyring)"));
-    } catch {
-      // Fallback: encrypt with openssl and store in file.
-      try {
-        const machineId = fs.readFileSync("/etc/machine-id", "utf8").trim();
-        const encrypted = execFileSync("openssl", ["enc", "-aes-256-cbc", "-pbkdf2", "-iter", "100000", "-pass", `pass:${machineId}`, "-base64"], {
-          input: pw,
-          encoding: "utf8",
-          stdio: ["pipe", "pipe", "pipe"],
-        }).trim();
-        fs.writeFileSync(bootKeyPath, encrypted, { mode: 0o600 });
-        spinner.succeed(chalk.green("Password encrypted -> boot.key (openssl fallback)"));
-      } catch (err) {
-        spinner.fail(chalk.red(`Password storage failed: ${err.message}`));
-        process.exit(1);
-      }
-    }
-  } else {
+    } catch {}
+  }
+
+  if (pw && !useSecretTool) {
+    // A desktop keyring cannot reliably unlock for a headless systemd service.
+    try {
+      const machineId = fs.readFileSync("/etc/machine-id", "utf8").trim();
+      const encrypted = execFileSync("openssl", ["enc", "-aes-256-cbc", "-pbkdf2", "-iter", "100000", "-pass", `pass:${machineId}`, "-base64"], {
+        input: pw,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+      }).trim();
+      fs.writeFileSync(bootKeyPath, encrypted, { mode: 0o600 });
+      spinner.succeed(chalk.green(`Password encrypted -> boot.key (${forceBootKey ? "headless mode" : "openssl fallback"})`));
+    } catch (err) {
+      spinner.fail(chalk.red(`Password storage failed: ${err.message}`));
+      process.exit(1);
+    }
+  } else if (!pw) {
     spinner.succeed(chalk.yellow("No password supplied; daemon will start locked"));
   }
 

package/cli/enrollment-script.js

@@ -32,20 +32,40 @@ function windowsScript({ supabaseUrl, anonKey, enrollmentCode }) {
   ].join("\r\n");
 }
 
-function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
-  return [
-    "#!/usr/bin/env sh",
-    "set -eu",
-    "label=$(hostname)",
-    "command -v node >/dev/null || { echo 'Node.js 18+ is required.' >&2; exit 1; }",
-    "command -v npm >/dev/null || { echo 'npm is required.' >&2; exit 1; }",
-    "npm install -g @lifeaitools/clauth@latest",
-    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
-    "clauth serve install",
-    "echo 'For reboot persistence on a headless host, run: loginctl enable-linger \"$USER\"'",
+function linuxScript({ supabaseUrl, anonKey, enrollmentCode }) {
+  return [
+    "#!/usr/bin/env sh",
+    "set -eu",
+    "label=$(hostname)",
+    "as_root() { if [ \"$(id -u)\" -eq 0 ]; then \"$@\"; elif command -v sudo >/dev/null; then sudo \"$@\"; else echo 'Root or sudo is required to install prerequisites.' >&2; exit 1; fi; }",
+    "install_prerequisites() {",
+    "  if command -v apt-get >/dev/null; then as_root apt-get update; as_root apt-get install -y nodejs npm openssl;",
+    "  elif command -v dnf >/dev/null; then as_root dnf install -y nodejs npm openssl;",
+    "  else echo 'Headless enrollment supports systemd hosts with apt-get or dnf. Install Node.js 18+, npm, and openssl, then rerun this script.' >&2; exit 1; fi",
+    "}",
+    "if ! command -v systemctl >/dev/null || ! command -v loginctl >/dev/null; then echo 'Headless enrollment requires systemd and loginctl.' >&2; exit 1; fi",
+    "if ! command -v node >/dev/null || ! command -v npm >/dev/null || ! command -v openssl >/dev/null; then install_prerequisites; fi",
+    "node_major=$(node -p \"process.versions.node.split('.')[0]\")",
+    "if [ \"$node_major\" -lt 18 ]; then echo 'Node.js 18+ is required.' >&2; exit 1; fi",
+    "if ! npm install -g @lifeaitools/clauth@latest; then as_root npm install -g @lifeaitools/clauth@latest; fi",
+    ["clauth setup", `--supabase-url ${posixShellQuote(supabaseUrl)}`, `--anon-key ${posixShellQuote(anonKey)}`, `--enrollment-code ${posixShellQuote(enrollmentCode)}`, '--label "$label"'].join(" "),
+    "user_name=$(id -un)",
+    "if loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; elif as_root loginctl enable-linger \"$user_name\"; then echo \"Linger enabled for $user_name.\"; else echo 'Could not enable linger for unattended restart.' >&2; exit 1; fi",
+    "if ! test -t 0; then echo 'Headless enrollment requires an interactive TTY to set the vault password.' >&2; exit 1; fi",
+    "restore_echo() { stty echo 2>/dev/null || true; }",
+    "trap restore_echo EXIT HUP INT TERM",
+    "printf 'Re-enter the vault password to enable unattended restart: ' >&2",
+    "stty -echo",
+    "IFS= read -r vault_password",
+    "stty echo",
+    "trap - EXIT HUP INT TERM",
+    "printf '\\n' >&2",
+    "[ -n \"$vault_password\" ] || { echo 'A vault password is required for unattended restart.' >&2; exit 1; }",
+    "printf %s \"$vault_password\" | clauth serve install --pw-stdin",
+    "unset vault_password",
     "rm -f -- \"$0\"",
-  ].join("\n");
-}
+  ].join("\n");
+}
 
 export function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label, target = "windows", appDir } = {}) {
   if (!["windows", "linux"].includes(target)) throw new Error(`Unsupported enrollment target: ${target}`);

package/cli/index.js

@@ -1007,8 +1007,9 @@ program
   .option("--tunnel <hostname>", "Fixed tunnel hostname (e.g. clauth.prtrust.fund) — uses named Cloudflare Tunnel instead of random URL")
   .option("--staged", "Start on staging port (52438) for blue-green verification before make-live")
   .option("--isolated", "Run on a non-live port without touching live PID files, browser, or boot-key credentials")
-  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
-  .option("--pw-env", "Internal: read the daemon password from CLAUTH_BOOT_PASSWORD")
+  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
+  .option("--pw-env", "Internal: read the daemon password from CLAUTH_BOOT_PASSWORD")
+  .option("--pw-stdin", "Internal: read the installer password from standard input")
   .option("--action <action>", "Internal: action override for daemon child")
   .addHelpText("after", `
 Actions:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.4",
+  "version": "1.30.6",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs && node test-auth-verdict.mjs",
+    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
     "test:studio-debug": "node --test test/studio-debug.test.mjs",
     "test:agent-pool": "node test/agent-pool.test.mjs",
     "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",