@lifeaitools/clauth 1.5.58 → 1.5.60

package/cli/commands/serve.js

@@ -4807,6 +4807,39 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
     }
 
+    // POST /generate-token — generate a cryptographically random bearer token and store it
+    if (method === "POST" && reqPath === "/generate-token") {
+      if (lockedGuard(res)) return;
+
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
+      }
+
+      const service = (body.service || "").trim().toLowerCase();
+      const prefix = body.prefix || "";
+      if (!service) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "service name required" }));
+      }
+
+      if (whitelist && !whitelist.includes(service)) {
+        return strike(res, 403, `Service '${service}' not in whitelist`);
+      }
+
+      try {
+        const randomHex = crypto.randomBytes(32).toString("hex");
+        const token = `${prefix}${randomHex}`;
+        const { token: authToken, timestamp } = deriveToken(password, machineHash);
+        const result = await api.write(password, machineHash, authToken, timestamp, service, token);
+        if (result.error) return strike(res, 502, result.error);
+        return ok(res, { token, service, stored: true });
+      } catch (err) {
+        return strike(res, 502, err.message);
+      }
+    }
+
     // POST /add-service — register a new service in the vault
     if (method === "POST" && reqPath === "/add-service") {
       if (lockedGuard(res)) return;
@@ -4902,7 +4935,36 @@ async function verifyAuth(password) {
 async function actionStart(opts) {
   const isStaged = !!opts.staged || process.env.__CLAUTH_STAGED === "1";
   const port     = isStaged ? STAGED_PORT : parseInt(opts.port || String(LIVE_PORT), 10);
-  const password = opts.pw;
+  let password = opts.pw || null;
+
+  // Auto-unlock: if no --pw flag, try to decrypt boot.key (DPAPI on Windows, openssl on Linux)
+  if (!password) {
+    const bootKeyPath = getBootKeyPath();
+    if (bootKeyPath && fs.existsSync(bootKeyPath)) {
+      try {
+        if (os.platform() === "win32") {
+          const psExe = process.env.SystemRoot
+            ? `${process.env.SystemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`
+            : "powershell.exe";
+          const escaped = bootKeyPath.replace(/'/g, "''");
+          const psExpr = `Add-Type -AssemblyName System.Security; [Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String((Get-Content '${escaped}' -Raw).Trim()),\$null,'CurrentUser'))`;
+          password = execSyncTop(`"${psExe}" -NoProfile -Command "${psExpr}"`, { encoding: "utf8", timeout: 5000 }).trim();
+          if (!password) password = null;
+        } else if (os.platform() !== "darwin") {
+          // Linux: openssl decrypt with machine-id
+          const machineId = execSyncTop("cat /etc/machine-id", { encoding: "utf8", timeout: 3000 }).trim();
+          password = execSyncTop(`openssl enc -aes-256-cbc -pbkdf2 -iter 100000 -pass pass:"${machineId}" -base64 -d < "${bootKeyPath}"`, { encoding: "utf8", timeout: 5000 }).trim();
+          if (!password) password = null;
+        }
+        if (password) {
+          console.log(chalk.green("  \u2713 Auto-unlocked from boot.key"));
+        }
+      } catch {
+        password = null; // decrypt failed — fall through to locked mode
+      }
+    }
+  }
+
   const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())
@@ -5709,6 +5771,19 @@ const MCP_TOOLS = [
     description: "Test whether the clauth MCP connector is reachable via the Cloudflare tunnel. Returns connectivity status and tunnel URL.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false }
   },
+  {
+    name: "clauth_generate_token",
+    description: "Generate a cryptographically random bearer token and store it as a clauth service value",
+    inputSchema: {
+      type: "object",
+      properties: {
+        service: { type: "string", description: "Service name to store the token under (e.g. web-research-api)" },
+        prefix: { type: "string", description: "Token prefix (e.g. rdc_wr_). Default: empty string" }
+      },
+      required: ["service"],
+      additionalProperties: false
+    }
+  },
   {
     name: "monkey_dispatch",
     description: "Dispatch a skill job to a headless Claude Code CLI worker. Spawns claude -p with the given prompt in C:/Dev/regen-root. Max 2 concurrent workers.",
@@ -6365,6 +6440,23 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(results.join("\n"));
     }
 
+    case "clauth_generate_token": {
+      if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
+      const service = (args.service || "").trim().toLowerCase();
+      const prefix = args.prefix || "";
+      if (!service) return mcpError("service name is required");
+      try {
+        const randomHex = crypto.randomBytes(32).toString("hex");
+        const generatedToken = `${prefix}${randomHex}`;
+        const { token: authToken, timestamp } = deriveToken(vault.password, vault.machineHash);
+        const result = await api.write(vault.password, vault.machineHash, authToken, timestamp, service, generatedToken);
+        if (result.error) return mcpError(result.error);
+        return mcpResult(`Token generated and stored under "${service}": ${generatedToken}`);
+      } catch (err) {
+        return mcpError(`generate_token failed: ${err.message}`);
+      }
+    }
+
     // ── Google Workspace (gws CLI) ───────────────────────────────────────
     case "gws_run": {
       const { service, resource, sub_resource, method, params, body } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.58",
+  "version": "1.5.60",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {