@lifeaitools/clauth 1.30.8 → 1.30.10

package/cli/commands/serve.js

@@ -572,16 +572,25 @@ function makeWriteToken() {
   };
 }
 
-function validateWriteToken(req, writeSession) {
-  if (!writeSession?.token || Date.now() > writeSession.expiresAt) return false;
-  const header = req.headers["x-clauth-write-token"] || req.headers.authorization;
-  const token = Array.isArray(header) ? header[0] : header;
-  if (!token) return false;
+function validateWriteToken(req, writeSession) {
+  if (!writeSession?.token || Date.now() > writeSession.expiresAt) return false;
+  const header = req.headers["x-clauth-write-token"] || req.headers.authorization;
+  const token = Array.isArray(header) ? header[0] : header;
+  if (!token) return false;
   const supplied = String(token).startsWith("Bearer ") ? String(token).slice(7) : String(token);
   const a = Buffer.from(supplied);
-  const b = Buffer.from(writeSession.token);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
+  const b = Buffer.from(writeSession.token);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+export function isLoopbackAddress(remote) {
+  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+}
+
+export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
+  if (port !== getSupervisorPort()) return true;
+  return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
+}
 
 // ── PID helpers ──────────────────────────────────────────────
 function readPid() {
@@ -3177,14 +3186,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   function hasSupervisorWrite(req) {
     if (validateWriteToken(req, writeSession)) return true;
-    return isSupervisorPort && supervisorTestNoToken;
+    if (!isSupervisorPort) return false;
+    if (!isLoopbackAddress(req.socket?.remoteAddress)) return false;
+    return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
   }
 
   function rejectSupervisorWrite(res) {
     res.writeHead(403, { "Content-Type": "application/json", ...CORS });
     return res.end(JSON.stringify({
       error: "write_token_required",
-      hint: "Unlock clauth writes, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
+      hint: "Unlock clauth writes, unset CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN for localhost supervisor operations, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
     }));
   }
 
@@ -3605,9 +3616,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
   }
 
-  const server = http.createServer(async (req, res) => {
-    const remote = req.socket.remoteAddress;
-    const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  const server = http.createServer(async (req, res) => {
+    const remote = req.socket.remoteAddress;
+    const isLocal = isLoopbackAddress(remote);
 
     const url    = new URL(req.url, `http://127.0.0.1:${port}`);
     const reqPath = url.pathname;

package/cli/supervisor-registry.js

@@ -372,10 +372,22 @@ export function runSurfaceAction(id, action, actor = "localhost") {
     const port = surface.port === "auto" || !surface.port ? 0 : surface.port;
     return operation(action, { surface_id: id }, surface, { ok: true, state: "candidate_testing", port, private: true, public_route: false, evidence: ["candidate surfaces bind localhost only"] }, actor);
   }
-  const command = action === "stop" ? surface.stop : action === "start" ? surface.start : surface.restart;
   if (surface.lifecycle_owner === "plugin") {
     return operation(action, { surface_id: id }, surface, { ok: true, state: "delegated_to_plugin_adapter", evidence: ["plugin lifecycle owner retained"] }, actor);
   }
+  if (action === "promote" || action === "rollback") {
+    return operation(action, { surface_id: id }, surface, {
+      ok: false,
+      state: "unsupported_surface_action",
+      reason: `${action}_is_plugin_candidate_lifecycle`,
+      evidence: ["surface action did not execute a process command"],
+    }, actor);
+  }
+  let command = null;
+  if (action === "stop") command = surface.stop;
+  else if (action === "start") command = surface.start;
+  else if (action === "restart") command = surface.restart;
+  else if (action === "reconcile") command = surface.enabled === false ? surface.stop : (surface.restart || surface.start);
   if (!command || command.length === 0) {
     return operation(action, { surface_id: id }, surface, { ok: false, state: "command_missing" }, actor);
   }

package/cli/supervisor-registry.test.js

@@ -17,6 +17,7 @@ import {
   supervisorHealth,
   validatePluginManifest,
 } from "./supervisor-registry.js";
+import { isLoopbackAddress, supervisorRequiresWriteToken } from "./commands/serve.js";
 
 function withTempSupervisor(fn) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-"));
@@ -154,6 +155,38 @@ test("surface actions use dedicated clauth PM2 home and keep CodeFlow observe-on
   assert.equal(supervisorHealth().surfaces, 2);
 }));
 
+test("surface promote and rollback never fall through to restart commands", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  writePlugin(root, "managed", "demo", baseManifest("demo", {
+    surfaces: [{
+      id: "demo-surface",
+      name: "Demo surface",
+      health: "http://127.0.0.1:3333/health",
+      restart: [process.execPath, "--version"],
+    }],
+  }));
+  discoverPlugins();
+
+  for (const action of ["promote", "rollback"]) {
+    const receipt = runSurfaceAction("demo:demo-surface", action);
+    assert.equal(receipt.resulting_state.ok, false);
+    assert.equal(receipt.resulting_state.state, "unsupported_surface_action");
+    assert.equal(receipt.resulting_state.evidence[0], "surface action did not execute a process command");
+  }
+}));
+
+test("supervisor write-token policy is temporarily relaxed only for the localhost supervisor port", () => {
+  assert.equal(supervisorRequiresWriteToken(52439, {}), false);
+  assert.equal(supervisorRequiresWriteToken(52439, { CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN: "1" }), true);
+  assert.equal(supervisorRequiresWriteToken(52437, {}), true);
+  assert.equal(isLoopbackAddress("127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("::1"), true);
+  assert.equal(isLoopbackAddress("::ffff:127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("192.168.1.25"), false);
+});
+
 test("tunnel route add and remove produce reversible operation receipts", () => withTempSupervisor((root) => {
   process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
   process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.8",
+  "version": "1.30.10",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {