@lifeaitools/clauth 1.30.6 → 1.30.7

package/cli/supervisor-registry.js

@@ -0,0 +1,440 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const SCHEMA = "lifeai.plugin.v1";
+const DEFAULT_TIMEOUT_MS = 3000;
+const DEFAULT_SUPERVISOR_PORT = 52439;
+const DESTINATIONS = new Set(["local/clauth/pm2", "vultr/clauth/pm2", "coolify/clauth/docker"]);
+const OWNERS = new Set(["clauth", "plugin", "external"]);
+const ACTIONS = new Set(["start", "stop", "restart", "reconcile", "test", "promote", "rollback"]);
+
+export function getSupervisorPort() {
+  return Number(process.env.CLAUTH_SUPERVISOR_PORT || DEFAULT_SUPERVISOR_PORT);
+}
+
+export function getSupervisorDir() {
+  if (process.env.CLAUTH_SUPERVISOR_DIR) return process.env.CLAUTH_SUPERVISOR_DIR;
+  const appdata = process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+  return path.join(appdata, "clauth", "supervisor");
+}
+
+export function getClauthPm2Home() {
+  if (process.env.CLAUTH_PM2_HOME) return process.env.CLAUTH_PM2_HOME;
+  return path.join(getSupervisorDir(), "pm2-home");
+}
+
+function file(name) {
+  return path.join(getSupervisorDir(), name);
+}
+
+function readJson(filePath, fallback) {
+  try {
+    if (!fs.existsSync(filePath)) return fallback;
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJson(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function appendJsonl(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.appendFileSync(filePath, `${JSON.stringify(value)}\n`, "utf8");
+}
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function now() {
+  return new Date().toISOString();
+}
+
+function normalizeCommand(command, field) {
+  if (!command) return [];
+  if (!Array.isArray(command)) throw new Error(`${field} must be a command array`);
+  if (command.length === 0) return [];
+  const [cmd, ...args] = command;
+  if (typeof cmd !== "string" || !cmd.trim()) throw new Error(`${field}[0] is required`);
+  if (/[;&|<>]/.test(cmd)) throw new Error(`${field}[0] must be an executable path/name, not shell syntax`);
+  return [cmd, ...args.map(String)];
+}
+
+function expandPathToken(value) {
+  if (!value) return null;
+  const root = process.env.REGEN_ROOT || process.env.LIFEAI_REPO_ROOT || "C:/Dev/regen-root";
+  return String(value)
+    .replace(/\$\{REGEN_ROOT\}/g, root)
+    .replace(/\$REGEN_ROOT/g, root)
+    .replace(/%REGEN_ROOT%/gi, root)
+    .replace(/\$\{LIFEAI_REPO_ROOT\}/g, root)
+    .replace(/\$LIFEAI_REPO_ROOT/g, root)
+    .replace(/%LIFEAI_REPO_ROOT%/gi, root);
+}
+
+function normalizeLifecycleOwner(owner) {
+  const value = owner || "clauth";
+  if (!OWNERS.has(value)) throw new Error(`lifecycle_owner must be one of ${[...OWNERS].join(", ")}`);
+  return value;
+}
+
+function normalizeDestination(destination) {
+  const value = destination || "local/clauth/pm2";
+  if (!DESTINATIONS.has(value)) throw new Error(`destination must be one of ${[...DESTINATIONS].join(", ")}`);
+  return value;
+}
+
+function localhostHealth(pathOrUrl, port) {
+  if (!pathOrUrl) return null;
+  if (/^https?:\/\//i.test(pathOrUrl)) {
+    const url = new URL(pathOrUrl);
+    if (!["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname)) {
+      throw new Error("health URLs must be localhost-only");
+    }
+    return url.toString();
+  }
+  const safePath = String(pathOrUrl).startsWith("/") ? String(pathOrUrl) : `/${pathOrUrl}`;
+  return port ? `http://127.0.0.1:${port}${safePath}` : safePath;
+}
+
+function normalizeSurface(surface, plugin) {
+  if (!surface || typeof surface !== "object") throw new Error("surface must be an object");
+  const id = String(surface.id || "").trim();
+  if (!/^[a-zA-Z0-9_.-]+$/.test(id)) throw new Error("surface.id may contain only letters, numbers, dot, underscore, and dash");
+  const destination = normalizeDestination(surface.destination || plugin.destination);
+  const lifecycle_owner = normalizeLifecycleOwner(surface.lifecycle_owner || plugin.lifecycle_owner);
+  const port = surface.port === undefined || surface.port === null || surface.port === "auto" ? surface.port ?? null : Number(surface.port);
+  if (port !== null && port !== "auto" && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new Error("surface.port must be auto or a TCP port");
+  return {
+    id,
+    plugin_id: plugin.id,
+    name: surface.name || id,
+    destination,
+    lifecycle_owner,
+    port,
+    health: localhostHealth(surface.health || "/health", port === "auto" ? null : port),
+    cwd: expandPathToken(surface.cwd || plugin.cwd),
+    start: normalizeCommand(surface.start || plugin.start, "surface.start"),
+    stop: normalizeCommand(surface.stop || plugin.stop, "surface.stop"),
+    restart: normalizeCommand(surface.restart || plugin.restart, "surface.restart"),
+    routes: Array.isArray(surface.routes) ? surface.routes : [],
+  };
+}
+
+export function validatePluginManifest(manifest, sourcePath = "") {
+  if (!manifest || typeof manifest !== "object") throw new Error("manifest must be an object");
+  if (manifest.schema !== SCHEMA) throw new Error(`schema must be ${SCHEMA}`);
+  const id = String(manifest.id || "").trim();
+  if (!/^[a-zA-Z0-9_.-]+$/.test(id)) throw new Error("id may contain only letters, numbers, dot, underscore, and dash");
+  const version = String(manifest.version || "").trim();
+  if (!version) throw new Error("version is required");
+  const plugin = {
+    schema: SCHEMA,
+    id,
+    version,
+    publisher: String(manifest.publisher || "unknown"),
+    sourcePath,
+    destination: normalizeDestination(manifest.destination),
+    lifecycle_owner: normalizeLifecycleOwner(manifest.lifecycle_owner),
+    credentials: Array.isArray(manifest.credentials) ? manifest.credentials.map((c) => ({
+      name: String(c.name || c.id || "").trim(),
+      key_type: String(c.key_type || c.type || "secret"),
+      description: String(c.description || ""),
+      required: c.required !== false,
+    })).filter((c) => /^[a-zA-Z0-9_.-]+$/.test(c.name)) : [],
+    surfaces: [],
+    routes: Array.isArray(manifest.routes) ? manifest.routes : [],
+    test: manifest.test && typeof manifest.test === "object" ? {
+      command: normalizeCommand(manifest.test.command, "test.command"),
+      port: manifest.test.port || "auto",
+      health: manifest.test.health || "/health",
+      selfTest: Array.isArray(manifest.test.selfTest) ? manifest.test.selfTest.map((cmd, i) => normalizeCommand(cmd, `test.selfTest[${i}]`)) : [],
+    } : null,
+  };
+  plugin.surfaces = (Array.isArray(manifest.surfaces) ? manifest.surfaces : []).map((surface) => normalizeSurface(surface, plugin));
+  return plugin;
+}
+
+function rootEntries() {
+  const managed = (process.env.CLAUTH_MANAGED_PLUGIN_ROOTS || "").split(path.delimiter).filter(Boolean);
+  const user = (process.env.CLAUTH_USER_PLUGIN_ROOTS || "").split(path.delimiter).filter(Boolean);
+  if (managed.length === 0) managed.push(path.join(getSupervisorDir(), "managed-plugins"));
+  if (user.length === 0) user.push(path.join(getSupervisorDir(), "user-plugins"));
+  return [
+    ...managed.map((root) => ({ root, source: "managed" })),
+    ...user.map((root) => ({ root, source: "user" })),
+  ];
+}
+
+function findManifestFiles(root) {
+  const out = [];
+  if (!fs.existsSync(root)) return out;
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) {
+      const candidate = path.join(full, "clauth-plugin.json");
+      if (fs.existsSync(candidate)) out.push(candidate);
+    } else if (entry.isFile() && entry.name === "clauth-plugin.json") {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+export function loadSupervisorState() {
+  return readJson(file("state.json"), { plugins: [], surfaces: [], routes: [], observations: [], operations: [] });
+}
+
+function saveSupervisorState(state) {
+  writeJson(file("state.json"), state);
+  writeJson(file("last-known-good.json"), {
+    signed_at: now(),
+    hash: sha256(JSON.stringify(state)),
+    state,
+  });
+}
+
+function existingById(state) {
+  return new Map((state.plugins || []).map((plugin) => [plugin.id, plugin]));
+}
+
+export function discoverPlugins() {
+  const previous = loadSupervisorState();
+  const seen = new Set();
+  const byId = existingById(previous);
+  const plugins = [];
+  const surfaces = [];
+  const events = [];
+  const managedIds = new Set();
+
+  for (const { root, source } of rootEntries()) {
+    fs.mkdirSync(root, { recursive: true });
+    for (const manifestPath of findManifestFiles(root)) {
+      const raw = fs.readFileSync(manifestPath, "utf8");
+      const hash = sha256(raw);
+      try {
+        const manifest = validatePluginManifest(JSON.parse(raw), manifestPath);
+        if (source === "managed") managedIds.add(manifest.id);
+        if (source === "user" && managedIds.has(manifest.id)) {
+          throw new Error("user plugin cannot silently shadow a managed plugin id");
+        }
+        const prior = byId.get(manifest.id);
+        const state = prior?.enabled ? (prior.manifest_hash === hash ? "current" : "version_drift") : "awaiting_enable";
+        const plugin = { ...manifest, source, discovery_root: root, manifest_hash: hash, state, enabled: Boolean(prior?.enabled), discovered_at: now() };
+        plugins.push(plugin);
+        for (const surface of plugin.surfaces) surfaces.push({ ...surface, enabled: plugin.enabled, state });
+        for (const credential of plugin.credentials) {
+          events.push({ kind: "credential_required", plugin_id: plugin.id, credential, value_set: false });
+        }
+        seen.add(plugin.id);
+        events.push({ kind: "plugin_discovered", plugin_id: plugin.id, state, source, manifest_hash: hash });
+      } catch (error) {
+        const id = path.basename(path.dirname(manifestPath));
+        plugins.push({
+          id,
+          source,
+          sourcePath: manifestPath,
+          manifest_hash: hash,
+          state: "manifest_invalid",
+          enabled: false,
+          error: error instanceof Error ? error.message : String(error),
+          discovered_at: now(),
+        });
+        events.push({ kind: "plugin_quarantined", plugin_id: id, source, error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+  }
+
+  for (const prior of previous.plugins || []) {
+    if (!seen.has(prior.id) && prior.state !== "manifest_invalid") {
+      plugins.push({ ...prior, enabled: false, state: prior.source === "managed" ? "missing_default" : "missing", missing_since: now() });
+      events.push({ kind: "plugin_missing", plugin_id: prior.id, source: prior.source });
+    }
+  }
+
+  const next = { ...previous, plugins, surfaces, routes: previous.routes || [], observations: previous.observations || [], operations: previous.operations || [] };
+  saveSupervisorState(next);
+  for (const event of events) appendJsonl(file("events.jsonl"), { ts: now(), ...event });
+  return { plugins, surfaces, events };
+}
+
+export function listPlugins() {
+  return loadSupervisorState().plugins || [];
+}
+
+export function listSurfaces() {
+  return loadSupervisorState().surfaces || [];
+}
+
+export function listRoutes() {
+  return loadSupervisorState().routes || [];
+}
+
+export function listTunnels() {
+  return readJson(file("tunnels.json"), { tunnels: [] }).tunnels;
+}
+
+function writeTunnels(tunnels) {
+  writeJson(file("tunnels.json"), { tunnels });
+}
+
+export function readSupervisorEvents(limit = 100) {
+  const p = file("events.jsonl");
+  if (!fs.existsSync(p)) return [];
+  return fs.readFileSync(p, "utf8").split(/\r?\n/).filter(Boolean).slice(-limit).map((line) => {
+    try { return JSON.parse(line); } catch { return { raw: line }; }
+  });
+}
+
+function operation(action, target, prior, result, actor = "localhost") {
+  const receipt = {
+    operationId: crypto.randomUUID(),
+    actor,
+    action,
+    target,
+    prior_state: prior || null,
+    resulting_state: result,
+    evidence: result?.evidence || [],
+    created_at: now(),
+    completed_at: now(),
+  };
+  const state = loadSupervisorState();
+  state.operations = [receipt, ...(state.operations || [])].slice(0, 500);
+  saveSupervisorState(state);
+  appendJsonl(file("events.jsonl"), { ts: now(), kind: "operation", ...receipt });
+  return receipt;
+}
+
+export function setPluginEnabled(id, enabled, actor = "localhost") {
+  const state = loadSupervisorState();
+  const prior = (state.plugins || []).find((plugin) => plugin.id === id);
+  if (!prior) return { error: "plugin_not_found" };
+  if (prior.state === "manifest_invalid") return { error: "manifest_invalid" };
+  const nextPlugin = { ...prior, enabled: Boolean(enabled), state: enabled ? "current" : "awaiting_enable" };
+  state.plugins = state.plugins.map((plugin) => plugin.id === id ? nextPlugin : plugin);
+  state.surfaces = (state.surfaces || []).map((surface) => surface.plugin_id === id ? { ...surface, enabled: Boolean(enabled), state: nextPlugin.state } : surface);
+  saveSupervisorState(state);
+  return operation(enabled ? "enable" : "disable", { plugin_id: id }, prior, nextPlugin, actor);
+}
+
+export function runPluginAction(id, action, actor = "localhost") {
+  if (!["test", "promote"].includes(action)) return { error: "invalid_action" };
+  const state = loadSupervisorState();
+  const prior = (state.plugins || []).find((plugin) => plugin.id === id);
+  if (!prior) return { error: "plugin_not_found" };
+  if (prior.state === "manifest_invalid") return { error: "manifest_invalid" };
+  const resultingState = action === "test" ? "candidate_testing" : "promotion_ready";
+  const nextPlugin = {
+    ...prior,
+    state: resultingState,
+    candidate: action === "test"
+      ? {
+          port: prior.test?.port === "auto" || !prior.test?.port ? 0 : prior.test.port,
+          public_route: false,
+          bind: "127.0.0.1",
+          tested_at: now(),
+        }
+      : prior.candidate || null,
+  };
+  state.plugins = state.plugins.map((plugin) => plugin.id === id ? nextPlugin : plugin);
+  saveSupervisorState(state);
+  return operation(action, { plugin_id: id }, prior, {
+    ok: true,
+    state: resultingState,
+    private: true,
+    public_route: false,
+    evidence: ["plugin candidate context does not create a Cloudflare route"],
+  }, actor);
+}
+
+function findSurface(id) {
+  return (loadSupervisorState().surfaces || []).find((surface) => surface.id === id || `${surface.plugin_id}:${surface.id}` === id);
+}
+
+export function runSurfaceAction(id, action, actor = "localhost") {
+  if (!ACTIONS.has(action)) return { error: "invalid_action" };
+  const surface = findSurface(id);
+  if (!surface) return { error: "surface_not_found" };
+  if (surface.lifecycle_owner === "external") {
+    return operation(action, { surface_id: id }, surface, { ok: false, state: "observed_only", reason: "external_owner" }, actor);
+  }
+  if (surface.plugin_id === "codeflow" || surface.tags?.includes("codeflow")) {
+    return operation(action, { surface_id: id }, surface, { ok: false, state: "observed_only", reason: "codeflow_self_owned" }, actor);
+  }
+  if (action === "test") {
+    const port = surface.port === "auto" || !surface.port ? 0 : surface.port;
+    return operation(action, { surface_id: id }, surface, { ok: true, state: "candidate_testing", port, private: true, public_route: false, evidence: ["candidate surfaces bind localhost only"] }, actor);
+  }
+  const command = action === "stop" ? surface.stop : action === "start" ? surface.start : surface.restart;
+  if (surface.lifecycle_owner === "plugin") {
+    return operation(action, { surface_id: id }, surface, { ok: true, state: "delegated_to_plugin_adapter", evidence: ["plugin lifecycle owner retained"] }, actor);
+  }
+  if (!command || command.length === 0) {
+    return operation(action, { surface_id: id }, surface, { ok: false, state: "command_missing" }, actor);
+  }
+  const [cmd, ...args] = command;
+  const result = spawnSync(cmd, args, {
+    cwd: surface.cwd || undefined,
+    env: { ...process.env, CLAUTH_PM2_HOME: getClauthPm2Home(), PM2_HOME: getClauthPm2Home() },
+    windowsHide: true,
+    encoding: "utf8",
+    timeout: Number(surface.timeoutMs || 30000),
+  });
+  return operation(action, { surface_id: id }, surface, {
+    ok: result.status === 0,
+    state: result.status === 0 ? "operation_completed" : "operation_failed",
+    status: result.status,
+    stderr: result.stderr?.slice(0, 2000),
+    evidence: [`CLAUTH_PM2_HOME=${getClauthPm2Home()}`],
+  }, actor);
+}
+
+export function addTunnelRoute(tunnelId, route, actor = "localhost") {
+  const tunnels = listTunnels();
+  const tunnel = tunnels.find((item) => item.id === tunnelId);
+  const prior = tunnel || { id: tunnelId, provider: "cloudflare", routes: [] };
+  const routeId = String(route?.routeId || route?.id || crypto.randomUUID());
+  const nextRoute = {
+    id: routeId,
+    hostname: String(route?.hostname || "").trim(),
+    service_url: String(route?.service_url || route?.serviceUrl || "").trim(),
+    desired_state: "enabled",
+    public_route: true,
+  };
+  if (!nextRoute.hostname || !nextRoute.service_url) {
+    return operation("tunnel_route_add", { tunnel_id: tunnelId }, prior, { ok: false, state: "invalid_route" }, actor);
+  }
+  const nextTunnel = { ...prior, routes: [nextRoute, ...(prior.routes || []).filter((item) => item.id !== routeId)] };
+  writeTunnels([nextTunnel, ...tunnels.filter((item) => item.id !== tunnelId)]);
+  return operation("tunnel_route_add", { tunnel_id: tunnelId, route_id: routeId }, prior, { ok: true, state: "route_recorded", route: nextRoute }, actor);
+}
+
+export function removeTunnelRoute(tunnelId, routeId, actor = "localhost") {
+  const tunnels = listTunnels();
+  const tunnel = tunnels.find((item) => item.id === tunnelId);
+  if (!tunnel) return operation("tunnel_route_remove", { tunnel_id: tunnelId, route_id: routeId }, {}, { ok: false, state: "tunnel_not_found" }, actor);
+  const prior = tunnel;
+  const nextTunnel = { ...tunnel, routes: (tunnel.routes || []).filter((item) => item.id !== routeId) };
+  writeTunnels([nextTunnel, ...tunnels.filter((item) => item.id !== tunnelId)]);
+  return operation("tunnel_route_remove", { tunnel_id: tunnelId, route_id: routeId }, prior, { ok: true, state: "route_removed", route_id: routeId }, actor);
+}
+
+export function supervisorHealth() {
+  const state = loadSupervisorState();
+  return {
+    status: "ok",
+    port: getSupervisorPort(),
+    schema: "clauth.supervisor.v1",
+    pm2_home: getClauthPm2Home(),
+    plugins: (state.plugins || []).length,
+    surfaces: (state.surfaces || []).length,
+    operations: (state.operations || []).length,
+  };
+}

package/cli/supervisor-registry.test.js

@@ -0,0 +1,173 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import {
+  addTunnelRoute,
+  discoverPlugins,
+  getClauthPm2Home,
+  listPlugins,
+  listSurfaces,
+  runPluginAction,
+  runSurfaceAction,
+  removeTunnelRoute,
+  setPluginEnabled,
+  supervisorHealth,
+  validatePluginManifest,
+} from "./supervisor-registry.js";
+
+function withTempSupervisor(fn) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-"));
+  const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
+  const oldManaged = process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+  const oldUser = process.env.CLAUTH_USER_PLUGIN_ROOTS;
+  const oldPm2 = process.env.CLAUTH_PM2_HOME;
+  process.env.CLAUTH_SUPERVISOR_DIR = root;
+  delete process.env.CLAUTH_PM2_HOME;
+  try {
+    return fn(root);
+  } finally {
+    if (oldDir === undefined) delete process.env.CLAUTH_SUPERVISOR_DIR;
+    else process.env.CLAUTH_SUPERVISOR_DIR = oldDir;
+    if (oldManaged === undefined) delete process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+    else process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = oldManaged;
+    if (oldUser === undefined) delete process.env.CLAUTH_USER_PLUGIN_ROOTS;
+    else process.env.CLAUTH_USER_PLUGIN_ROOTS = oldUser;
+    if (oldPm2 === undefined) delete process.env.CLAUTH_PM2_HOME;
+    else process.env.CLAUTH_PM2_HOME = oldPm2;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function writePlugin(root, source, id, manifest) {
+  const dir = path.join(root, source, id);
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, "clauth-plugin.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+  return dir;
+}
+
+function baseManifest(id, overrides = {}) {
+  return {
+    schema: "lifeai.plugin.v1",
+    id,
+    version: "1.0.0",
+    publisher: "LIFEAI",
+    credentials: [{ name: `${id}-secret`, key_type: "secret", description: "fixture key" }],
+    surfaces: [{
+      id: `${id}-surface`,
+      destination: "local/clauth/pm2",
+      lifecycle_owner: "clauth",
+      port: 39111,
+      health: "/health",
+      restart: ["node", "--version"],
+    }],
+    test: { command: ["node", "--version"], port: "auto", health: "/health", selfTest: [["node", "--version"]] },
+    ...overrides,
+  };
+}
+
+test("validatePluginManifest accepts LIFEAI plugin contract with isolated test context", () => {
+  const plugin = validatePluginManifest(baseManifest("regen-media-local"), "clauth-plugin.json");
+  assert.equal(plugin.schema, "lifeai.plugin.v1");
+  assert.equal(plugin.test.port, "auto");
+  assert.equal(plugin.surfaces[0].destination, "local/clauth/pm2");
+  assert.equal(plugin.surfaces[0].lifecycle_owner, "clauth");
+  assert.equal(plugin.surfaces[0].health, "http://127.0.0.1:39111/health");
+});
+
+test("validatePluginManifest accepts empty test command arrays from the v1 template", () => {
+  const plugin = validatePluginManifest(baseManifest("empty-test-command", {
+    test: { command: [], port: "auto", health: "/health", selfTest: [] },
+  }), "clauth-plugin.json");
+  assert.deepEqual(plugin.test.command, []);
+  assert.equal(plugin.test.port, "auto");
+});
+
+test("validatePluginManifest rejects invalid manifests and non-local health URLs", () => {
+  assert.throws(() => validatePluginManifest({ ...baseManifest("bad"), schema: "bad" }), /schema/);
+  assert.throws(() => validatePluginManifest(baseManifest("bad", {
+    surfaces: [{ id: "bad", health: "https://example.com/health" }],
+  })), /localhost-only/);
+});
+
+test("discovery merges managed and user roots without silent managed-id shadowing", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  const user = path.join(root, "user");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = user;
+  writePlugin(root, "managed", "regen-media-local", baseManifest("regen-media-local"));
+  writePlugin(root, "user", "regen-media-local", baseManifest("regen-media-local", { version: "2.0.0" }));
+
+  const result = discoverPlugins();
+  const managedPlugin = result.plugins.find((plugin) => plugin.id === "regen-media-local" && plugin.source === "managed");
+  const invalid = result.plugins.find((plugin) => plugin.id === "regen-media-local" && plugin.source === "user");
+  assert.equal(managedPlugin.state, "awaiting_enable");
+  assert.equal(invalid.state, "manifest_invalid");
+  assert.match(invalid.error, /shadow/);
+}));
+
+test("plugin test marks a private candidate and never creates a public route", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  writePlugin(root, "managed", "regen-media-local", baseManifest("regen-media-local"));
+  discoverPlugins();
+
+  const enabled = setPluginEnabled("regen-media-local", true);
+  assert.equal(enabled.resulting_state.enabled, true);
+  const receipt = runPluginAction("regen-media-local", "test");
+  assert.equal(receipt.resulting_state.state, "candidate_testing");
+  assert.equal(receipt.resulting_state.public_route, false);
+  assert.equal(listPlugins().find((plugin) => plugin.id === "regen-media-local").candidate.public_route, false);
+}));
+
+test("surface actions use dedicated clauth PM2 home and keep CodeFlow observe-only", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  process.env.REGEN_ROOT = "C:/Dev/regen-root";
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  writePlugin(root, "managed", "demo", baseManifest("demo", {
+    surfaces: [{
+      id: "demo-surface",
+      name: "Demo surface",
+      health: "http://127.0.0.1:3333/health",
+      cwd: "$REGEN_ROOT/mcp-servers/regen-media",
+      restart: [process.execPath, "--version"],
+    }],
+  }));
+  writePlugin(root, "managed", "codeflow", baseManifest("codeflow", {
+    surfaces: [{ id: "codeflow-mcp", lifecycle_owner: "clauth", destination: "local/clauth/pm2", restart: ["node", "--version"] }],
+  }));
+  discoverPlugins();
+  const receipt = runSurfaceAction("demo:demo-surface", "restart");
+  assert.equal(receipt.resulting_state.ok, true);
+  assert.match(receipt.resulting_state.evidence[0], /CLAUTH_PM2_HOME/);
+  assert.equal(receipt.prior_state.cwd.replace(/\\/g, "/"), "C:/Dev/regen-root/mcp-servers/regen-media");
+  assert.equal(getClauthPm2Home(), path.join(root, "pm2-home"));
+
+  const codeflow = runSurfaceAction("codeflow:codeflow-mcp", "restart");
+  assert.equal(codeflow.resulting_state.ok, false);
+  assert.equal(codeflow.resulting_state.reason, "codeflow_self_owned");
+  assert.equal(listSurfaces().length, 2);
+  assert.equal(supervisorHealth().surfaces, 2);
+}));
+
+test("tunnel route add and remove produce reversible operation receipts", () => withTempSupervisor((root) => {
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  discoverPlugins();
+
+  const added = addTunnelRoute("cf-main", {
+    id: "route-1",
+    hostname: "media.example.test",
+    service_url: "http://127.0.0.1:3120",
+  });
+  assert.equal(added.resulting_state.ok, true);
+  assert.equal(added.resulting_state.state, "route_recorded");
+
+  const removed = removeTunnelRoute("cf-main", "route-1");
+  assert.equal(removed.resulting_state.ok, true);
+  assert.equal(removed.resulting_state.state, "route_removed");
+}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.6",
+  "version": "1.30.7",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {
@@ -8,27 +8,20 @@
   },
   "scripts": {
     "build": "bash scripts/build.sh",
-    "test": "node --test cli/commands/scrub.test.js cli/api.classify.test.js test/studio-debug.test.mjs test/dashboard-key-generator.test.mjs && node test-auth-verdict.mjs",
-    "test:studio-debug": "node --test test/studio-debug.test.mjs",
-    "test:agent-pool": "node test/agent-pool.test.mjs",
-    "test:call-agent-10": "node test/call-agent-10-skills.test.mjs",
-    "test:call-agent-guard": "node test/call-agent-guard.test.mjs",
-    "test:tintin-settings": "node test/tintin-settings.test.mjs",
     "postinstall": "node scripts/postinstall.js",
     "worker:start": "node cli/index.js serve",
     "worker:stop": "curl -s http://127.0.0.1:52437/shutdown 2>nul || taskkill /F /IM cloudflared.exe 2>nul & exit 0",
     "worker:restart": "npm run worker:stop && timeout /t 3 /nobreak >nul && npm run worker:start"
   },
   "dependencies": {
-    "@vscode/ripgrep": "^1.15.9",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "conf": "^13.0.0",
-    "fast-glob": "^3.3.2",
     "inquirer": "^10.1.0",
     "node-fetch": "^3.3.2",
     "ora": "^8.1.0",
-    "typescript": "^5.9.3"
+    "@vscode/ripgrep": "^1.15.9",
+    "fast-glob": "^3.3.2"
   },
   "engines": {
     "node": ">=18.0.0"