@lifeaitools/clauth 1.30.6 → 1.30.7

package/cli/fingerprint.js

@@ -32,6 +32,16 @@ function writeCache(primary, secondary) {
 }
 
 function getMachineId() {
+  // Containers do not have a durable /etc/machine-id. Coolify supplies this
+  // value as a private runtime secret so a redeploy remains the same enrolled
+  // clauth machine. Accept the lowercase-dash form used by Coolify too.
+  const containerMachineId = process.env.CLAUTH_MACHINE_ID || process.env["clauth-machine-id"];
+  if (containerMachineId) {
+    const value = containerMachineId.trim();
+    if (!value) throw new Error("CLAUTH_MACHINE_ID must not be empty");
+    return { primary: value, secondary: value, platform: os.platform() };
+  }
+
   // Fast path: use cached IDs if available (avoids WMI/PowerShell on every restart)
   const cached = readCache();
   if (cached) return { ...cached, platform: os.platform() };

package/cli/index.js

@@ -13,11 +13,53 @@ import { writeCredentialWithRecovery } from "./recovery.js";
 import os from "os";
 import fs from "fs";
 import path from "path";
-import { writeEnrollmentScript } from "./enrollment-script.js";
 
 const config = new Conf(getConfOptions());
 const VERSION = JSON.parse(fs.readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
+function shellSingleQuote(value) {
+  return `'${String(value ?? "").replace(/'/g, "''")}'`;
+}
+
+function enrollmentScriptName(label) {
+  const slug = String(label || "new-computer")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 40) || "new-computer";
+  return `clauth-enroll-${slug}.ps1`;
+}
+
+function writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode, label }) {
+  const appDir = process.platform === "win32"
+    ? path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), "clauth")
+    : path.join(os.homedir(), ".config", "clauth");
+  fs.mkdirSync(appDir, { recursive: true });
+  const scriptPath = path.join(appDir, enrollmentScriptName(label));
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "$label = $env:COMPUTERNAME",
+    "if (-not $label) { $label = [System.Net.Dns]::GetHostName() }",
+    "Write-Host 'Installing clauth...'",
+    "npm install -g @lifeaitools/clauth@latest",
+    "Write-Host 'Enrolling this computer with clauth...'",
+    [
+      "clauth setup",
+      `--supabase-url ${shellSingleQuote(supabaseUrl)}`,
+      `--anon-key ${shellSingleQuote(anonKey)}`,
+      `--enrollment-code ${shellSingleQuote(enrollmentCode)}`,
+      "--label \"$label\"",
+    ].join(" "),
+    "Write-Host 'Installing clauth startup service...'",
+    "clauth serve install",
+    "Write-Host 'clauth enrollment complete.'",
+    "$self = $PSCommandPath",
+    "Start-Process powershell.exe -WindowStyle Hidden -ArgumentList @('-NoProfile','-Command',\"Start-Sleep -Seconds 2; Remove-Item -LiteralPath '$self' -Force -ErrorAction SilentlyContinue\")",
+  ].join("\r\n");
+  fs.writeFileSync(scriptPath, `${script}\r\n`, "utf8");
+  return scriptPath;
+}
+
 // ============================================================
 // Password prompt helper
 // ============================================================
@@ -119,7 +161,7 @@ async function searchServices(auth, query, opts = {}) {
       .map(([field]) => field);
 
     let addressHints = [];
-    if (opts.addresses === true && ADDRESS_KEY_TYPES.has(String(s.key_type || "").toLowerCase()) && s.vault_key) {
+    if (opts.addresses !== false && ADDRESS_KEY_TYPES.has(String(s.key_type || "").toLowerCase()) && s.vault_key) {
       const secret = await api.retrieve(auth.password, auth.machineHash, auth.token, auth.timestamp, s.name);
       if (!secret.error) {
         addressHints = collectAddressHints(secret.value, s.key_type);
@@ -349,7 +391,6 @@ program
   .option("--label <label>", "Suggested label for the new computer")
   .option("--ttl-minutes <minutes>", "Enrollment lifetime, 5 to 1440 minutes", "60")
   .option("--install-id <id>", "Override install id; default is current machine's install id")
-  .option("--target <target>", "Enrollment target: windows or linux", "windows")
   .option("-p, --pw <password>", "Password (or will prompt)")
   .action(async (opts) => {
     console.log(chalk.cyan("\n🔐 clauth enroll\n"));
@@ -373,7 +414,6 @@ program
         anonKey,
         enrollmentCode: result.enrollment_code,
         label: opts.label,
-        target: opts.target,
       });
       spinner.succeed(chalk.green(`Enrollment created for install_id=${result.install_id}`));
       console.log("");
@@ -635,15 +675,15 @@ program
 
 program
   .command("search <query>")
-  .description("Search services by name, label, project, description, or type")
+  .description("Search services by name, label, project, description, type, or redacted address hints")
   .option("-p, --pw <password>")
   .option("--project <name>", "Filter by project scope")
-  .option("--addresses", "Also search redacted address hints from address-bearing secrets (may retrieve multiple secrets)")
+  .option("--no-addresses", "Skip address-bearing secret metadata scans")
   .action(async (query, opts) => {
     const auth = await getAuth(opts.pw);
     const spinner = ora("Searching services...").start();
     try {
-      const rows = await searchServices(auth, query, { project: opts.project, addresses: opts.addresses === true });
+      const rows = await searchServices(auth, query, { project: opts.project, addresses: opts.addresses });
       spinner.stop();
       console.log(chalk.cyan(`\n Search results for "${query}":\n`));
       if (!rows.length) {
@@ -746,13 +786,9 @@ program
   .addHelpText("after", `
 Examples:
   clauth scrub              Scrub the most recent (active) transcript
-  clauth scrub <file>       Scrub a specific file
-  clauth scrub all          Scrub every transcript + tool-result sidecar (.jsonl + .txt)
+  clauth scrub <file>       Scrub a specific .jsonl file
+  clauth scrub all          Scrub every transcript in ~/.claude/projects/
   clauth scrub all --force  Rescrub all files (ignore markers)
-  clauth scrub session      Scrub ONLY the ending session (transcript + sidecars); reads SessionEnd hook JSON on stdin
-
-  Redacts: built-in token patterns, your ~/.clauth/scrub-patterns.json,
-  and this machine's live vault values (best-effort via the daemon).
 `)
   .action(async (target, opts) => {
     await runScrub(target, opts);
@@ -1000,16 +1036,14 @@ program.addHelpText("beforeAll", chalk.cyan(`
 // ──────────────────────────────────────────────
 program
   .command("serve [action]")
-  .description("Manage localhost HTTP vault daemon (start|stop|restart|ping|install|uninstall)")
+  .description("Manage localhost HTTP vault daemon and supervisor (start|stop|restart|ping|supervisor|install|uninstall)")
   .option("--port <n>", "Port (default: 52437)")
   .option("-p, --pw <password>", "clauth password (optional — omit to start locked, unlock in browser)")
   .option("--services <list>", "Comma-separated service whitelist (default: all)")
   .option("--tunnel <hostname>", "Fixed tunnel hostname (e.g. clauth.prtrust.fund) — uses named Cloudflare Tunnel instead of random URL")
   .option("--staged", "Start on staging port (52438) for blue-green verification before make-live")
   .option("--isolated", "Run on a non-live port without touching live PID files, browser, or boot-key credentials")
-  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
-  .option("--pw-env", "Internal: read the daemon password from CLAUTH_BOOT_PASSWORD")
-  .option("--pw-stdin", "Internal: read the installer password from standard input")
+  .option("--from-boot-key", "Internal: password came from boot.key auto-unlock (degrade gracefully on verify failure)")
   .option("--action <action>", "Internal: action override for daemon child")
   .addHelpText("after", `
 Actions:
@@ -1018,8 +1052,9 @@ Actions:
   restart     Stop + start
   ping        Check if the daemon is running
   foreground  Run in foreground (Ctrl+C to stop) — default if no action given
-  mcp         Run as MCP stdio server for Claude Code (JSON-RPC over stdin/stdout)
-  install     Store password securely + register auto-start service (cross-platform)
+  mcp         Run as MCP stdio server for Claude Code (JSON-RPC over stdin/stdout)
+  supervisor  Run localhost-only supervisor control plane on port 52439
+  install     Store password securely + register auto-start service (cross-platform)
               Windows: DPAPI + HKCU\\Run | macOS: Keychain + LaunchAgent | Linux: libsecret/openssl + systemd
   uninstall   Remove auto-start service + delete stored password
   upgrade     Blue-green upgrade: start new version on staging port, verify, then make live
@@ -1035,9 +1070,10 @@ Examples:
   clauth serve ping                      Check status
   clauth serve restart                   Restart (stays locked until browser unlock)
   clauth serve start --services github,vercel
-  clauth serve mcp                       Start MCP server for Claude Code
-  clauth serve mcp -p mypass             Start MCP server pre-unlocked
-  clauth serve foreground --port 53137 --isolated
+  clauth serve mcp                       Start MCP server for Claude Code
+  clauth serve mcp -p mypass             Start MCP server pre-unlocked
+  clauth serve supervisor                Start supervisor API on http://127.0.0.1:52439
+  clauth serve foreground --port 53137 --isolated
                                           Start isolated passwordless server for route tests
   clauth serve install                   Set up auto-start on login (DPAPI/Keychain/libsecret)
   clauth serve install --tunnel host     Auto-start with Cloudflare Tunnel