@lifeaitools/clauth 1.30.9 → 1.30.11

package/cli/commands/serve.js

@@ -30,7 +30,9 @@ import {
 } from "../watchdog-registry.js";
 import {
   discoverPlugins,
+  getSupervisorDir,
   getSupervisorPort,
+  loadSupervisorState,
   listPlugins,
   listRoutes,
   listSurfaces,
@@ -583,6 +585,69 @@ function validateWriteToken(req, writeSession) {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 
+export function isLoopbackAddress(remote) {
+  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+}
+
+function summarizeSupervisorTarget(target) {
+  if (!target || typeof target !== "object") return null;
+  return {
+    plugin_id: typeof target.plugin_id === "string" ? target.plugin_id : undefined,
+    surface_id: typeof target.surface_id === "string" ? target.surface_id : undefined,
+    tunnel_id: typeof target.tunnel_id === "string" ? target.tunnel_id : undefined,
+    route_id: typeof target.route_id === "string" ? target.route_id : undefined,
+  };
+}
+
+function summarizeSupervisorState(value) {
+  if (!value || typeof value !== "object") return null;
+  return {
+    ok: typeof value.ok === "boolean" ? value.ok : undefined,
+    state: typeof value.state === "string" ? value.state : undefined,
+    reason: typeof value.reason === "string" ? value.reason : undefined,
+    status: typeof value.status === "number" ? value.status : undefined,
+    private: typeof value.private === "boolean" ? value.private : undefined,
+    public_route: typeof value.public_route === "boolean" ? value.public_route : undefined,
+    evidence: Array.isArray(value.evidence) ? value.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
+  };
+}
+
+export function supervisorLogDto(event) {
+  if (!event || typeof event !== "object") return { kind: "unknown" };
+  if (event.kind === "operation") {
+    return {
+      ts: event.ts || event.created_at,
+      kind: "operation",
+      operationId: event.operationId,
+      actor: event.actor,
+      action: event.action,
+      target: summarizeSupervisorTarget(event.target),
+      resulting_state: summarizeSupervisorState(event.resulting_state),
+      completed_at: event.completed_at,
+    };
+  }
+  return {
+    ts: event.ts,
+    kind: event.kind,
+    plugin_id: event.plugin_id,
+    source: event.source,
+    state: event.state,
+  };
+}
+
+function supervisorOperationDto(receipt) {
+  return {
+    operationId: receipt.operationId,
+    actor: receipt.actor,
+    action: receipt.action,
+    target: summarizeSupervisorTarget(receipt.target),
+    resulting_state: summarizeSupervisorState(receipt.resulting_state),
+    evidence: Array.isArray(receipt.evidence) ? receipt.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
+    created_at: receipt.created_at,
+    completed_at: receipt.completed_at,
+  };
+}
+
 export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
   if (port !== getSupervisorPort()) return true;
   return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
@@ -901,8 +966,30 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .wiz-link:hover{text-decoration:underline}
   .wiz-test-result{padding:12px 14px;border-radius:8px;font-size:.85rem;margin-top:10px;display:none}
   .wiz-test-result.ok{background:rgba(74,222,128,.08);border:1px solid rgba(74,222,128,.2);color:#4ade80}
-  .wiz-test-result.fail{background:rgba(248,113,113,.08);border:1px solid rgba(248,113,113,.2);color:#f87171}
-</style>
+  .wiz-test-result.fail{background:rgba(248,113,113,.08);border:1px solid rgba(248,113,113,.2);color:#f87171}
+  .supervisor-panel{margin:14px 16px;border:1px solid #233249;background:linear-gradient(135deg,rgba(15,23,42,.96),rgba(10,15,26,.98));border-radius:12px;padding:14px}
+  .supervisor-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;margin-bottom:12px}
+  .supervisor-title{font-size:.95rem;font-weight:700;color:#e2e8f0}
+  .supervisor-sub{font-size:.76rem;color:#94a3b8;margin-top:3px;line-height:1.35}
+  .supervisor-actions{display:flex;gap:8px;flex-wrap:wrap}
+  .supervisor-action{background:#0f172a;color:#cbd5e1;border:1px solid #334155;border-radius:6px;padding:6px 10px;font-size:.75rem;cursor:pointer}
+  .supervisor-action:hover{border-color:#38bdf8;color:#e0f2fe}
+  .supervisor-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:10px}
+  .supervisor-card{border:1px solid #1e293b;background:rgba(2,6,23,.52);border-radius:10px;padding:10px;min-width:0}
+  .supervisor-card h4{margin:0 0 8px;color:#cbd5e1;font-size:.75rem;letter-spacing:.08em;text-transform:uppercase}
+  .supervisor-kpi{font-size:1.35rem;font-weight:700;color:#f8fafc}
+  .supervisor-meta{font-size:.72rem;color:#94a3b8;font-family:'Courier New',monospace;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .supervisor-pill{display:inline-flex;align-items:center;border-radius:999px;padding:2px 7px;margin:2px 4px 2px 0;font-size:.68rem;border:1px solid #334155;color:#cbd5e1;background:#0f172a}
+  .supervisor-pill.ok{border-color:rgba(74,222,128,.35);color:#86efac;background:rgba(34,197,94,.08)}
+  .supervisor-pill.warn{border-color:rgba(250,204,21,.35);color:#fde68a;background:rgba(250,204,21,.08)}
+  .supervisor-pill.bad{border-color:rgba(248,113,113,.35);color:#fecaca;background:rgba(248,113,113,.08)}
+  .supervisor-list{display:flex;flex-direction:column;gap:8px;max-height:320px;overflow:auto}
+  .supervisor-row{border:1px solid #1e293b;border-radius:8px;padding:8px;background:rgba(15,23,42,.45)}
+  .supervisor-row-top{display:flex;justify-content:space-between;gap:8px;align-items:center}
+  .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
+  .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
+</style>
 </head>
 <body>
 
@@ -1090,7 +1177,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </div>
   </div>
 
-  <div class="monkey-panel" id="monkey-panel">
+  <div class="monkey-panel" id="monkey-panel">
     <div class="monkey-head">
       <div>
         <div class="monkey-title">Monkey local CLI dispatch</div>
@@ -1115,10 +1202,44 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
       <span class="monkey-status" id="monkey-status">idle</span>
     </div>
     <div class="monkey-result" id="monkey-result"></div>
-  </div>
-
-
-  <div class="wizard-panel" id="wizard-panel">
+  </div>
+
+  <section class="supervisor-panel" id="supervisor-panel">
+    <div class="supervisor-head">
+      <div>
+        <div class="supervisor-title">Local Software Factory Supervisor</div>
+        <div class="supervisor-sub">clauth owns local LIFEAI plugin discovery, candidate tests, clauth-owned surface operations, receipts, and supervisor event logs. Dev Center should call this surface instead of PM2 directly.</div>
+      </div>
+      <div class="supervisor-actions">
+        <button class="supervisor-action" onclick="loadSupervisorCockpit()">Refresh</button>
+        <button class="supervisor-action" onclick="rescanSupervisorPlugins()">Rescan plugins</button>
+      </div>
+    </div>
+    <div id="supervisor-status" class="supervisor-sub">Loading supervisor state…</div>
+    <div class="supervisor-grid" style="margin-top:10px">
+      <div class="supervisor-card">
+        <h4>Plugins</h4>
+        <div class="supervisor-kpi" id="supervisor-plugin-count">—</div>
+        <div class="supervisor-meta" id="supervisor-plugin-meta">awaiting data</div>
+        <div class="supervisor-list" id="supervisor-plugins" style="margin-top:8px"></div>
+      </div>
+      <div class="supervisor-card">
+        <h4>Surfaces</h4>
+        <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
+        <div class="supervisor-meta" id="supervisor-surface-meta">destination + owner matrix</div>
+        <div class="supervisor-list" id="supervisor-surfaces" style="margin-top:8px"></div>
+      </div>
+      <div class="supervisor-card">
+        <h4>Operations + log</h4>
+        <div class="supervisor-kpi" id="supervisor-operation-count">—</div>
+        <div class="supervisor-meta" id="supervisor-log-path">events.jsonl</div>
+        <div class="supervisor-log" id="supervisor-events" style="margin-top:8px">No events loaded.</div>
+      </div>
+    </div>
+  </section>
+
+
+  <div class="wizard-panel" id="wizard-panel">
     <div class="wizard-header">
       <div class="tunnel-dot off" id="wiz-dot" style="width:10px;height:10px;border-radius:50%"></div>
       <div class="wizard-title">claude.ai Tunnel Setup</div>
@@ -1368,10 +1489,89 @@ function showMain(ping) {
     document.getElementById("s-fails").textContent =
       ping.failures + "/" + (ping.failures + ping.failures_remaining);
   }
-  pollTunnel();
-  updateBuildStatus();
-  refreshWriteLockUi();
-}
+  pollTunnel();
+  updateBuildStatus();
+  loadSupervisorCockpit();
+  refreshWriteLockUi();
+}
+
+function supervisorBadge(text, kind) {
+  return '<span class="supervisor-pill ' + (kind || '') + '">' + htmlEscape(text) + '</span>';
+}
+
+async function supervisorJson(path, options) {
+  const response = await fetch(BASE + path, { cache: "no-store", ...(options || {}) });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || data.error) throw new Error(data.error || ("HTTP " + response.status));
+  return data;
+}
+
+async function loadSupervisorCockpit() {
+  const status = document.getElementById("supervisor-status");
+  if (status) status.textContent = "Loading supervisor state…";
+  try {
+    const [health, plugins, surfaces, logs] = await Promise.all([
+      supervisorJson("/health"),
+      supervisorJson("/v1/plugins"),
+      supervisorJson("/v1/surfaces"),
+      supervisorJson("/v1/logs?limit=40"),
+    ]);
+    const pluginRows = plugins.plugins || [];
+    const surfaceRows = surfaces.surfaces || [];
+    document.getElementById("supervisor-plugin-count").textContent = String(pluginRows.length);
+    document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length);
+    document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
+    document.getElementById("supervisor-plugin-meta").textContent = "current " + (pluginRows.filter(p => p.state === "current").length) + " · awaiting " + (pluginRows.filter(p => p.state === "awaiting_enable").length);
+    document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
+    document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
+    document.getElementById("supervisor-plugins").innerHTML = pluginRows.length ? pluginRows.map(renderSupervisorPlugin).join("") : '<div class="supervisor-sub">No plugins discovered.</div>';
+    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.length ? surfaceRows.map(renderSupervisorSurface).join("") : '<div class="supervisor-sub">No surfaces declared.</div>';
+    document.getElementById("supervisor-events").textContent = (logs.events || []).slice(-20).reverse().map(e => {
+      const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
+      return (e.ts || e.created_at || "") + "  " + label;
+    }).join("\\n") || "No events yet.";
+    if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status || "unknown"), "ok") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
+  } catch (err) {
+    if (status) status.innerHTML = supervisorBadge("supervisor unreachable", "bad") + " " + htmlEscape(err.message || err);
+  }
+}
+
+function renderSupervisorPlugin(plugin) {
+  const stateKind = plugin.state === "current" ? "ok" : (plugin.state === "manifest_invalid" || plugin.state === "missing" ? "bad" : "warn");
+  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(plugin.id) + '</span>' + supervisorBadge(plugin.state || "unknown", stateKind) + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(plugin.publisher || "unknown") + ' · ' + htmlEscape(plugin.version || "—") + ' · ' + htmlEscape(plugin.source || "—") + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape((plugin.manifest_hash || "").slice(0, 12)) + '</div>' +
+    '<div class="supervisor-row-actions"><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg(plugin.enabled ? "disable" : "enable") + ')">' + (plugin.enabled ? "Disable" : "Enable") + '</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("test") + ')">Test</button><button class="supervisor-action" onclick="runSupervisorPlugin(' + jsArg(plugin.id) + ',' + jsArg("promote") + ')">Promote</button></div></div>';
+}
+
+function renderSupervisorSurface(surface) {
+  const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
+  return '<div class="supervisor-row"><div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.plugin_id + ":" + surface.id) + '</span>' + supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
+    '<div class="supervisor-row-actions">' + ["reconcile","restart","test","rollback"].map(a => '<button class="supervisor-action" onclick="runSupervisorSurface(' + jsArg(surface.id) + ',' + jsArg(a) + ')">' + a + '</button>').join("") + '</div></div>';
+}
+
+async function rescanSupervisorPlugins() {
+  try {
+    await supervisorJson("/v1/plugins/rescan", { method: "POST", headers: writeHeaders() });
+    await loadSupervisorCockpit();
+  } catch (err) { alert("Supervisor rescan failed: " + (err.message || err)); }
+}
+
+async function runSupervisorPlugin(id, action) {
+  try {
+    await supervisorJson("/v1/plugins/" + encodeURIComponent(id) + "/" + encodeURIComponent(action), { method: "POST", headers: writeHeaders() });
+    await loadSupervisorCockpit();
+  } catch (err) { alert("Plugin " + action + " failed: " + (err.message || err)); }
+}
+
+async function runSupervisorSurface(id, action) {
+  try {
+    await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
+    await loadSupervisorCockpit();
+  } catch (err) { alert("Surface " + action + " failed: " + (err.message || err)); }
+}
 
 // ── Unlock ──────────────────────────────────
 async function unlock() {
@@ -3183,6 +3383,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   function hasSupervisorWrite(req) {
     if (validateWriteToken(req, writeSession)) return true;
     if (!isSupervisorPort) return false;
+    if (!isLoopbackAddress(req.socket?.remoteAddress)) return false;
     return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
   }
 
@@ -3611,9 +3812,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
   }
 
-  const server = http.createServer(async (req, res) => {
-    const remote = req.socket.remoteAddress;
-    const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  const server = http.createServer(async (req, res) => {
+    const remote = req.socket.remoteAddress;
+    const isLocal = isLoopbackAddress(remote);
 
     const url    = new URL(req.url, `http://127.0.0.1:${port}`);
     const reqPath = url.pathname;
@@ -3705,6 +3906,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return ok(res, { tunnels: listTunnels() });
     }
 
+    if (method === "GET" && reqPath === "/v1/logs") {
+      const limit = Number(url.searchParams.get("limit") || 100);
+      const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(limit, 500)) : 100;
+      const state = loadSupervisorState();
+      return ok(res, {
+        schema: "clauth.supervisor.logs.v1",
+        log_path: path.join(getSupervisorDir(), "events.jsonl"),
+        events: readSupervisorEvents(boundedLimit).map(supervisorLogDto),
+        operations: (state.operations || []).slice(0, boundedLimit).map(supervisorOperationDto),
+      });
+    }
+
     const tunnelRoutesMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes$/);
     if (method === "POST" && tunnelRoutesMatch) {
       if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
@@ -3726,7 +3939,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       const id = decodeURIComponent(reqPath.split("/").pop());
       const operation = (supervisorHealth(), readSupervisorEvents(500)).find((event) => event.operationId === id);
       res.writeHead(operation ? 200 : 404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(operation || { error: "operation_not_found" }));
+      return res.end(JSON.stringify(operation ? supervisorLogDto(operation) : { error: "operation_not_found" }));
     }
 
     if (method === "GET" && reqPath === "/v1/events") {
@@ -3737,7 +3950,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         ...CORS,
       });
       for (const event of readSupervisorEvents(Number(url.searchParams.get("limit") || 100))) {
-        res.write(`event: supervisor\ndata: ${JSON.stringify(event)}\n\n`);
+        res.write(`event: supervisor\ndata: ${JSON.stringify(supervisorLogDto(event))}\n\n`);
       }
       res.end();
       return;

package/cli/supervisor-registry.test.js

@@ -17,7 +17,7 @@ import {
   supervisorHealth,
   validatePluginManifest,
 } from "./supervisor-registry.js";
-import { supervisorRequiresWriteToken } from "./commands/serve.js";
+import { isLoopbackAddress, supervisorLogDto, supervisorRequiresWriteToken } from "./commands/serve.js";
 
 function withTempSupervisor(fn) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-"));
@@ -181,6 +181,39 @@ test("supervisor write-token policy is temporarily relaxed only for the localhos
   assert.equal(supervisorRequiresWriteToken(52439, {}), false);
   assert.equal(supervisorRequiresWriteToken(52439, { CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN: "1" }), true);
   assert.equal(supervisorRequiresWriteToken(52437, {}), true);
+  assert.equal(isLoopbackAddress("127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("::1"), true);
+  assert.equal(isLoopbackAddress("::ffff:127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("192.168.1.25"), false);
+});
+
+test("supervisor log DTO strips raw operation payloads", () => {
+  const dto = supervisorLogDto({
+    ts: "2026-07-30T00:00:00.000Z",
+    kind: "operation",
+    operationId: "op-secret",
+    actor: "localhost",
+    action: "restart",
+    target: { surface_id: "demo", command: ["node", "--token=secret"] },
+    prior_state: { start: ["node", "--token=secret"], cwd: "C:/secrets" },
+    resulting_state: {
+      ok: false,
+      state: "operation_failed",
+      stderr: "SECRET=abc123",
+      evidence: ["CLAUTH_PM2_HOME=C:/safe"],
+    },
+    stderr: "SECRET=abc123",
+    completed_at: "2026-07-30T00:00:01.000Z",
+  });
+
+  const json = JSON.stringify(dto);
+  assert.equal(dto.operationId, "op-secret");
+  assert.equal(dto.target.surface_id, "demo");
+  assert.equal(dto.resulting_state.state, "operation_failed");
+  assert.equal(json.includes("prior_state"), false);
+  assert.equal(json.includes("stderr"), false);
+  assert.equal(json.includes("SECRET"), false);
+  assert.equal(json.includes("--token"), false);
 });
 
 test("tunnel route add and remove produce reversible operation receipts", () => withTempSupervisor((root) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.30.9",
+  "version": "1.30.11",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {