@lifeaitools/clauth 1.5.58 → 1.5.59

package/cli/commands/serve.js

@@ -4902,7 +4902,36 @@ async function verifyAuth(password) {
 async function actionStart(opts) {
   const isStaged = !!opts.staged || process.env.__CLAUTH_STAGED === "1";
   const port     = isStaged ? STAGED_PORT : parseInt(opts.port || String(LIVE_PORT), 10);
-  const password = opts.pw;
+  let password = opts.pw || null;
+
+  // Auto-unlock: if no --pw flag, try to decrypt boot.key (DPAPI on Windows, openssl on Linux)
+  if (!password) {
+    const bootKeyPath = getBootKeyPath();
+    if (bootKeyPath && fs.existsSync(bootKeyPath)) {
+      try {
+        if (os.platform() === "win32") {
+          const psExe = process.env.SystemRoot
+            ? `${process.env.SystemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`
+            : "powershell.exe";
+          const escaped = bootKeyPath.replace(/'/g, "''");
+          const psExpr = `Add-Type -AssemblyName System.Security; [Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String((Get-Content '${escaped}' -Raw).Trim()),\$null,'CurrentUser'))`;
+          password = execSyncTop(`"${psExe}" -NoProfile -Command "${psExpr}"`, { encoding: "utf8", timeout: 5000 }).trim();
+          if (!password) password = null;
+        } else if (os.platform() !== "darwin") {
+          // Linux: openssl decrypt with machine-id
+          const machineId = execSyncTop("cat /etc/machine-id", { encoding: "utf8", timeout: 3000 }).trim();
+          password = execSyncTop(`openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -pass pass:"${machineId}" -base64 -d < "${bootKeyPath}"`, { encoding: "utf8", timeout: 5000 }).trim();
+          if (!password) password = null;
+        }
+        if (password) {
+          console.log(chalk.green("  \u2713 Auto-unlocked from boot.key"));
+        }
+      } catch {
+        password = null; // decrypt failed — fall through to locked mode
+      }
+    }
+  }
+
   const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.58",
+  "version": "1.5.59",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {