@lifeaitools/clauth 1.30.7 → 1.30.9

package/cli/commands/serve.js

@@ -572,16 +572,21 @@ function makeWriteToken() {
   };
 }
 
-function validateWriteToken(req, writeSession) {
-  if (!writeSession?.token || Date.now() > writeSession.expiresAt) return false;
-  const header = req.headers["x-clauth-write-token"] || req.headers.authorization;
-  const token = Array.isArray(header) ? header[0] : header;
-  if (!token) return false;
+function validateWriteToken(req, writeSession) {
+  if (!writeSession?.token || Date.now() > writeSession.expiresAt) return false;
+  const header = req.headers["x-clauth-write-token"] || req.headers.authorization;
+  const token = Array.isArray(header) ? header[0] : header;
+  if (!token) return false;
   const supplied = String(token).startsWith("Bearer ") ? String(token).slice(7) : String(token);
   const a = Buffer.from(supplied);
-  const b = Buffer.from(writeSession.token);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
+  const b = Buffer.from(writeSession.token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
+  if (port !== getSupervisorPort()) return true;
+  return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
+}
 
 // ── PID helpers ──────────────────────────────────────────────
 function readPid() {
@@ -3167,13 +3172,29 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
-  const NO_BROWSER_CORS = {
-    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
-  };
-  const studioDebugRuntime = createStudioDebugRuntime({ port, logFile: LOG_FILE });
-
-  // ── MCP SSE session tracking ──────────────────────────────
+  const NO_BROWSER_CORS = {
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
+  };
+  const studioDebugRuntime = createStudioDebugRuntime({ port, logFile: LOG_FILE });
+  const isSupervisorPort = port === getSupervisorPort();
+  const supervisorTestNoToken = process.env.CLAUTH_SUPERVISOR_TEST_NO_TOKEN === "1";
+
+  function hasSupervisorWrite(req) {
+    if (validateWriteToken(req, writeSession)) return true;
+    if (!isSupervisorPort) return false;
+    return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
+  }
+
+  function rejectSupervisorWrite(res) {
+    res.writeHead(403, { "Content-Type": "application/json", ...CORS });
+    return res.end(JSON.stringify({
+      error: "write_token_required",
+      hint: "Unlock clauth writes, unset CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN for localhost supervisor operations, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
+    }));
+  }
+
+  // ── MCP SSE session tracking ──────────────────────────────
   const sseSessions = new Map(); // sessionId → { res, initialized }
   let sseCounter = 0;
 
@@ -3641,19 +3662,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     if (method === "POST" && reqPath === "/v1/plugins/rescan") {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       return ok(res, discoverPlugins());
     }
 
     const pluginEnableMatch = reqPath.match(/^\/v1\/plugins\/([^/]+)\/(enable|disable|test|promote)$/);
     if (method === "POST" && pluginEnableMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       const pluginId = decodeURIComponent(pluginEnableMatch[1]);
       const op = pluginEnableMatch[2];
       const result = op === "enable"
@@ -3671,10 +3686,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const surfaceActionMatch = reqPath.match(/^\/v1\/surfaces\/([^/]+)\/actions$/);
     if (method === "POST" && surfaceActionMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3695,10 +3707,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const tunnelRoutesMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes$/);
     if (method === "POST" && tunnelRoutesMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3709,10 +3718,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     const tunnelRouteDeleteMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes\/([^/]+)$/);
     if (method === "DELETE" && tunnelRouteDeleteMatch) {
-      if (!validateWriteToken(req, writeSession)) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "write_token_required" }));
-      }
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
       return ok(res, removeTunnelRoute(decodeURIComponent(tunnelRouteDeleteMatch[1]), decodeURIComponent(tunnelRouteDeleteMatch[2]), "localhost"));
     }
 

package/cli/supervisor-registry.js

@@ -372,10 +372,22 @@ export function runSurfaceAction(id, action, actor = "localhost") {
     const port = surface.port === "auto" || !surface.port ? 0 : surface.port;
     return operation(action, { surface_id: id }, surface, { ok: true, state: "candidate_testing", port, private: true, public_route: false, evidence: ["candidate surfaces bind localhost only"] }, actor);
   }
-  const command = action === "stop" ? surface.stop : action === "start" ? surface.start : surface.restart;
   if (surface.lifecycle_owner === "plugin") {
     return operation(action, { surface_id: id }, surface, { ok: true, state: "delegated_to_plugin_adapter", evidence: ["plugin lifecycle owner retained"] }, actor);
   }
+  if (action === "promote" || action === "rollback") {
+    return operation(action, { surface_id: id }, surface, {
+      ok: false,
+      state: "unsupported_surface_action",
+      reason: `${action}_is_plugin_candidate_lifecycle`,
+      evidence: ["surface action did not execute a process command"],
+    }, actor);
+  }
+  let command = null;
+  if (action === "stop") command = surface.stop;
+  else if (action === "start") command = surface.start;
+  else if (action === "restart") command = surface.restart;
+  else if (action === "reconcile") command = surface.enabled === false ? surface.stop : (surface.restart || surface.start);
   if (!command || command.length === 0) {
     return operation(action, { surface_id: id }, surface, { ok: false, state: "command_missing" }, actor);
   }

package/cli/supervisor-registry.test.js

@@ -17,6 +17,7 @@ import {
   supervisorHealth,
   validatePluginManifest,
 } from "./supervisor-registry.js";
+import { supervisorRequiresWriteToken } from "./commands/serve.js";
 
 function withTempSupervisor(fn) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-"));
@@ -154,6 +155,34 @@ test("surface actions use dedicated clauth PM2 home and keep CodeFlow observe-on
   assert.equal(supervisorHealth().surfaces, 2);
 }));
 
+test("surface promote and rollback never fall through to restart commands", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  writePlugin(root, "managed", "demo", baseManifest("demo", {
+    surfaces: [{
+      id: "demo-surface",
+      name: "Demo surface",
+      health: "http://127.0.0.1:3333/health",
+      restart: [process.execPath, "--version"],
+    }],
+  }));
+  discoverPlugins();
+
+  for (const action of ["promote", "rollback"]) {
+    const receipt = runSurfaceAction("demo:demo-surface", action);
+    assert.equal(receipt.resulting_state.ok, false);
+    assert.equal(receipt.resulting_state.state, "unsupported_surface_action");
+    assert.equal(receipt.resulting_state.evidence[0], "surface action did not execute a process command");
+  }
+}));
+
+test("supervisor write-token policy is temporarily relaxed only for the localhost supervisor port", () => {
+  assert.equal(supervisorRequiresWriteToken(52439, {}), false);
+  assert.equal(supervisorRequiresWriteToken(52439, { CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN: "1" }), true);
+  assert.equal(supervisorRequiresWriteToken(52437, {}), true);
+});
+
 test("tunnel route add and remove produce reversible operation receipts", () => withTempSupervisor((root) => {
   process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
   process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.7",
+  "version": "1.30.9",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {