npm - @lifeaitools/clauth - Versions diffs - 2.0.0 → 2.0.1 - Mend

@lifeaitools/clauth 2.0.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/.clauth-skill/references/keys-guide.md +270 -270
package/cli/api.js +238 -238
package/cli/commands/install.js +396 -396
package/cli/commands/serve.js +174 -2
package/cli/commands/uninstall.js +164 -164
package/cli/index.js +73 -1
package/cli/supervisor-registry.js +291 -0
package/cli/supervisor-registry.test.js +345 -4
package/cli/supervisor-ui.test.js +436 -0
package/install.ps1 +102 -102
package/install.sh +49 -49
package/package.json +2 -2
package/scripts/bootstrap.cjs +121 -121
package/supabase/functions/auth-vault/index.ts +350 -350
package/supabase/migrations/001_clauth_schema.sql +94 -94
package/supabase/migrations/002_vault_helpers.sql +90 -90
package/supabase/migrations/20260317_lockout.sql +26 -26

package/cli/commands/serve.js CHANGED Viewed

@@ -662,7 +662,9 @@ function openBrowser(url) {
 }
 // ── Dashboard HTML ───────────────────────────────────────────
-function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null) {
+// Exported so cli/supervisor-ui.test.js can extract the served dashboard script
+// and drive its real functions, instead of asserting on source text.
+export function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null) {
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -1369,10 +1371,130 @@ function renderSetPanel(serviceOrName) {
 let writeToken = ${JSON.stringify(initWriteToken)};
 function writeHeaders(extra) {
-  if (!writeToken) throw new Error("Write access requires password unlock in this browser session.");
+  if (!writeToken) throw new Error("Writes are locked — click 🔓 Unlock Writes to enable saving.");
   return { ...(extra || {}), "X-Clauth-Write-Token": writeToken };
 }
+// ── Write-access choke point ────────────────
+// ONE mechanism sits in front of every write action.
+//
+// A button on this dashboard IS the human being present — they are past the
+// lock screen already. So a click must never demand a second password. Before
+// each action the page silently acquires a current write token from
+// POST /write-token, which succeeds whenever the vault is unlocked. The
+// password modal is the LOCKED-VAULT fallback only, and the common case never
+// reaches it.
+//
+// Acquiring per action (rather than trusting the token injected at page load)
+// is what makes staleness structurally impossible: the server session has a
+// 10-minute TTL while a dashboard tab can stay open for hours. That gap is the
+// actual defect behind "adding a service says I need write unlock" — the page
+// kept sending a token the daemon had already expired, and writeGuard answered
+// 403 "write token required". One loopback round-trip per click closes it.
+//
+// If the vault really is locked, the action is parked, the modal opens, and a
+// successful unlock re-fires it exactly once. Cancelling clears the park, so no
+// delayed write can fire later.
+//
+// writeHeaders() above still throws, but only as a backstop for a write path
+// that never went through here — WRITE_ACTIONS is asserted complete against
+// every writeHeaders() call site by cli/supervisor-ui.test.js.
+let pendingWriteAction = null;
+// Returns true when writeToken now holds a token the daemon will accept.
+// False means the vault is genuinely locked (or the daemon is unreachable),
+// which is the only case that deserves a password prompt.
+async function ensureWriteAccess() {
+  try {
+    const r = await fetch(BASE + "/write-token", { method: "POST" }).then(res => res.json());
+    if (r && r.write_token) {
+      writeToken = r.write_token;
+      refreshWriteLockUi();
+      return true;
+    }
+  } catch {}
+  return false;
+}
+// Every dashboard function whose body calls writeHeaders(). Adding a write
+// action without adding it here fails the registry-completeness test.
+const WRITE_ACTIONS = [
+  "rescanSupervisorPlugins",
+  "runSupervisorSurface",
+  "rotateKey",
+  "setExpiry",
+  "saveProject",
+  "saveLabel",
+  "deleteService",
+  "saveKey",
+  "toggleService",
+  "changePassword",
+  "addService",
+  "enrollMachine",
+  "submitMount",
+  "deleteMount",
+  "wizSubmitCfToken",
+];
+function withWriteAccess(name, fn) {
+  // async, so every path returns a thenable — a caller doing action(x).catch(…)
+  // must not TypeError on the no-write-access path only.
+  const guarded = async function (...args) {
+    if (!(await ensureWriteAccess())) {
+      // Vault is locked. Park the WHOLE call — nothing has run yet, so a
+      // confirm() inside the action is asked once, on the retry, rather than
+      // before a no-op.
+      pendingWriteAction = { name, fn, self: this, args };
+      openWriteUnlockModal();
+      return undefined;
+    }
+    return fn.apply(this, args);
+  };
+  guarded.__writeGuarded = true;
+  guarded.__unguarded = fn;
+  return guarded;
+}
+function clearPendingWriteAction() { pendingWriteAction = null; }
+// Read-only seams so tests (and the console) can observe park state without
+// reaching into a module-scoped binding.
+function hasPendingWriteAction() { return pendingWriteAction !== null; }
+function pendingWriteActionName() { return pendingWriteAction ? pendingWriteAction.name : null; }
+function takePendingWriteAction() {
+  const pending = pendingWriteAction;
+  pendingWriteAction = null;
+  return pending;
+}
+function installWriteAccessGuards(scope) {
+  for (const name of WRITE_ACTIONS) {
+    const fn = scope[name];
+    if (typeof fn === "function" && fn.__writeGuarded) continue;
+    if (typeof fn !== "function") {
+      // Fail loud, not silent. A registered name that is not a global function
+      // is almost always a write action refactored from a function declaration
+      // to a const/arrow binding: const/let create no global property, so
+      // scope[name] is undefined, the guard would no-op, and the inline
+      // onclick="" would resolve through the lexical binding straight to the
+      // UNGUARDED function — silently restoring the write-lock defect for that
+      // action. Skipping it here is how that regression would ship green.
+      throw new Error(
+        "clauth write-guard install failed: '" + name + "' is registered in WRITE_ACTIONS but is not a " +
+        "global function. Declare it as 'function " + name + "(...)' — a const/let/arrow binding cannot be guarded."
+      );
+    }
+    scope[name] = withWriteAccess(name, fn);
+  }
+}
+// Safe to run here: every dashboard function is a top-level function
+// declaration, so all of them are hoisted and initialised before this
+// statement executes. Inline onclick="" handlers resolve through the same
+// global properties, so they get the guarded versions.
+installWriteAccessGuards(typeof window !== "undefined" ? window : globalThis);
 async function boot() {
   try {
     const ping = await fetch(BASE + "/ping").then(r => r.json());
@@ -1681,6 +1803,9 @@ async function unlock() {
     }
     writeToken = r.write_token || null;
+    // Full-vault unlock is a fresh page state, not a retry of a parked write.
+    // Kept symmetric with unlockWrites() so no path can carry a stale park.
+    clearPendingWriteAction();
     input.value = "";
     const ping = await fetch(BASE + "/ping").then(r => r.json());
     showMain(ping);
@@ -1706,6 +1831,9 @@ async function lockVault() {
 // Needed when the daemon auto-unlocks via --pw/boot.key: the page never sees the
 // unlock screen, so it holds no write token. POST /auth mints one (10-min TTL).
 function unlockWrites() {
+  // Manual unlock from the toolbar — nothing is parked, so make sure a stale
+  // park from an earlier dismissed attempt cannot ride along on this unlock.
+  clearPendingWriteAction();
   openWriteUnlockModal();
 }
@@ -1720,6 +1848,9 @@ function openWriteUnlockModal() {
 }
 function closeWriteUnlockModal() {
+  // Dismissing the modal must disarm the parked write. submitWriteUnlock()
+  // takes the park before it calls this, so a successful unlock still retries.
+  clearPendingWriteAction();
   const overlay = document.getElementById("write-unlock-overlay");
   if (overlay) overlay.style.display = "none";
 }
@@ -1743,8 +1874,19 @@ async function submitWriteUnlock() {
       return;
     }
     writeToken = r.write_token || null;
+    // Take the park BEFORE closing — closeWriteUnlockModal() clears it.
+    const pending = takePendingWriteAction();
     refreshWriteLockUi();
     closeWriteUnlockModal();
+    if (pending && writeToken) {
+      // Re-fire the ORIGINAL unguarded action, exactly once. Using the
+      // unguarded reference means it can never re-park itself into a loop.
+      try {
+        await pending.fn.apply(pending.self, pending.args);
+      } catch (retryErr) {
+        console.error("[clauth] write action '" + pending.name + "' failed after unlock:", retryErr);
+      }
+    }
   } catch (e) {
     if (err) err.textContent = "Unlock error: " + (e.message || e);
   } finally {
@@ -6063,6 +6205,36 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
     }
+    // POST /write-token — hand the dashboard a current write token for an
+    // ALREADY-UNLOCKED vault, with no second password prompt.
+    //
+    // A human looking at the dashboard has already passed the lock screen (or
+    // the daemon was auto-unlocked via --pw/boot.key). Making them re-enter the
+    // password to press a button is ceremony, not security: GET / at the route
+    // above already embeds a write token on exactly this condition. This route
+    // just lets the page RENEW it, which GET / could only do on a full reload.
+    //
+    // Why the write token still exists at all: every request reaching this
+    // server is already loopback-only (hard 403 above), but cloudflared proxies
+    // the public tunnel FROM localhost, so a remote request and a local one are
+    // indistinguishable by address. The token is what a page-driven write has
+    // and a blind remote POST does not, so the gate stays; only the prompt goes.
+    //
+    // Mint-or-reuse, mirroring GET /: reusing a still-valid session keeps
+    // multiple open tabs working instead of each one invalidating the last.
+    if (method === "POST" && reqPath === "/write-token") {
+      if (!password) {
+        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "vault_locked", locked: true }));
+      }
+      if (!writeSession || Date.now() > writeSession.expiresAt) writeSession = makeWriteToken();
+      return ok(res, {
+        ok: true,
+        write_token: writeSession.token,
+        write_expires_at: new Date(writeSession.expiresAt).toISOString(),
+      });
+    }
     // POST /auth — unlock the vault with a password (verifies against Edge Function)
     if (method === "POST" && reqPath === "/auth") {
       let body;

package/cli/commands/uninstall.js CHANGED Viewed

@@ -1,164 +1,164 @@
-// cli/commands/uninstall.js
-// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
-//
-// Reverses everything `clauth install` does:
-//   1. Drops clauth tables, policies, triggers, functions from Supabase
-//   2. Deletes auth-vault Edge Function
-//   3. Removes CLAUTH_* secrets
-//   4. Removes Claude skill directory
-//   5. Clears local config (Conf store)
-import { existsSync, rmSync } from 'fs';
-import { join } from 'path';
-import Conf from 'conf';
-import chalk from 'chalk';
-import ora from 'ora';
-const MGMT = 'https://api.supabase.com/v1';
-const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
-  (process.platform === 'win32'
-    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
-    : join(process.env.HOME || '', '.claude', 'skills'));
-// ─────────────────────────────────────────────
-// Supabase Management API helper
-// ─────────────────────────────────────────────
-async function mgmt(pat, method, path, body) {
-  const res = await fetch(`${MGMT}${path}`, {
-    method,
-    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-    body: body ? JSON.stringify(body) : undefined,
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => res.statusText);
-    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
-  }
-  if (res.status === 204) return {};
-  const text = await res.text();
-  if (!text) return {};
-  return JSON.parse(text);
-}
-// ─────────────────────────────────────────────
-// Main uninstall command
-// ─────────────────────────────────────────────
-export async function runUninstall(opts = {}) {
-  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
-  const config = new Conf({ projectName: 'clauth' });
-  // ── Collect credentials ────────────────────
-  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
-  const pat = opts.pat;
-  if (!ref) {
-    console.log(chalk.red('  Cannot determine Supabase project ref.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-  if (!pat) {
-    console.log(chalk.red('  Supabase PAT required for teardown.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-  console.log(chalk.gray(`  Project: ${ref}\n`));
-  // ── Step 1: Drop database objects ──────────
-  const s1 = ora('Dropping clauth database objects...').start();
-  const teardownSQL = `
-    -- Drop triggers
-    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
-    -- Drop tables (CASCADE drops policies automatically)
-    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
-    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
-    DROP TABLE IF EXISTS public.clauth_services CASCADE;
-    -- Drop functions
-    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
-  `;
-  try {
-    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
-    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
-  } catch (e) {
-    s1.fail(`Database teardown failed: ${e.message}`);
-    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
-  }
-  // ── Step 2: Delete Edge Function ───────────
-  const s2 = ora('Deleting auth-vault Edge Function...').start();
-  try {
-    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}` },
-    });
-    if (res.ok || res.status === 404) {
-      s2.succeed(res.status === 404
-        ? 'Edge Function not found (already deleted)'
-        : 'Edge Function deleted');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s2.fail(`Edge Function delete failed: ${e.message}`);
-    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
-  }
-  // ── Step 3: Remove secrets ─────────────────
-  const s3 = ora('Removing clauth secrets...').start();
-  try {
-    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
-    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
-    });
-    if (res.ok) {
-      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s3.warn(`Secret removal failed: ${e.message}`);
-    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
-  }
-  // ── Step 4: Remove Claude skill ────────────
-  const s4 = ora('Removing Claude skill...').start();
-  const skillDir = join(SKILLS_DIR, 'clauth');
-  if (existsSync(skillDir)) {
-    try {
-      rmSync(skillDir, { recursive: true, force: true });
-      s4.succeed(`Skill removed: ${skillDir}`);
-    } catch (e) {
-      s4.warn(`Could not remove skill: ${e.message}`);
-    }
-  } else {
-    s4.succeed('Skill directory not found (already removed)');
-  }
-  // ── Step 5: Clear local config ─────────────
-  const s5 = ora('Clearing local config...').start();
-  try {
-    config.clear();
-    s5.succeed('Local config cleared');
-  } catch (e) {
-    s5.warn(`Could not clear config: ${e.message}`);
-  }
-  // ── Done ───────────────────────────────────
-  console.log('');
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log('');
-  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
-  console.log('');
-}
+// cli/commands/uninstall.js
+// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
+//
+// Reverses everything `clauth install` does:
+//   1. Drops clauth tables, policies, triggers, functions from Supabase
+//   2. Deletes auth-vault Edge Function
+//   3. Removes CLAUTH_* secrets
+//   4. Removes Claude skill directory
+//   5. Clears local config (Conf store)
+import { existsSync, rmSync } from 'fs';
+import { join } from 'path';
+import Conf from 'conf';
+import chalk from 'chalk';
+import ora from 'ora';
+const MGMT = 'https://api.supabase.com/v1';
+const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
+  (process.platform === 'win32'
+    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
+    : join(process.env.HOME || '', '.claude', 'skills'));
+// ─────────────────────────────────────────────
+// Supabase Management API helper
+// ─────────────────────────────────────────────
+async function mgmt(pat, method, path, body) {
+  const res = await fetch(`${MGMT}${path}`, {
+    method,
+    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => res.statusText);
+    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
+  }
+  if (res.status === 204) return {};
+  const text = await res.text();
+  if (!text) return {};
+  return JSON.parse(text);
+}
+// ─────────────────────────────────────────────
+// Main uninstall command
+// ─────────────────────────────────────────────
+export async function runUninstall(opts = {}) {
+  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
+  const config = new Conf({ projectName: 'clauth' });
+  // ── Collect credentials ────────────────────
+  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
+  const pat = opts.pat;
+  if (!ref) {
+    console.log(chalk.red('  Cannot determine Supabase project ref.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+  if (!pat) {
+    console.log(chalk.red('  Supabase PAT required for teardown.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+  console.log(chalk.gray(`  Project: ${ref}\n`));
+  // ── Step 1: Drop database objects ──────────
+  const s1 = ora('Dropping clauth database objects...').start();
+  const teardownSQL = `
+    -- Drop triggers
+    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
+    -- Drop tables (CASCADE drops policies automatically)
+    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
+    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
+    DROP TABLE IF EXISTS public.clauth_services CASCADE;
+    -- Drop functions
+    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
+  `;
+  try {
+    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
+    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
+  } catch (e) {
+    s1.fail(`Database teardown failed: ${e.message}`);
+    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
+  }
+  // ── Step 2: Delete Edge Function ───────────
+  const s2 = ora('Deleting auth-vault Edge Function...').start();
+  try {
+    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}` },
+    });
+    if (res.ok || res.status === 404) {
+      s2.succeed(res.status === 404
+        ? 'Edge Function not found (already deleted)'
+        : 'Edge Function deleted');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s2.fail(`Edge Function delete failed: ${e.message}`);
+    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
+  }
+  // ── Step 3: Remove secrets ─────────────────
+  const s3 = ora('Removing clauth secrets...').start();
+  try {
+    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
+    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
+    });
+    if (res.ok) {
+      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s3.warn(`Secret removal failed: ${e.message}`);
+    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
+  }
+  // ── Step 4: Remove Claude skill ────────────
+  const s4 = ora('Removing Claude skill...').start();
+  const skillDir = join(SKILLS_DIR, 'clauth');
+  if (existsSync(skillDir)) {
+    try {
+      rmSync(skillDir, { recursive: true, force: true });
+      s4.succeed(`Skill removed: ${skillDir}`);
+    } catch (e) {
+      s4.warn(`Could not remove skill: ${e.message}`);
+    }
+  } else {
+    s4.succeed('Skill directory not found (already removed)');
+  }
+  // ── Step 5: Clear local config ─────────────
+  const s5 = ora('Clearing local config...').start();
+  try {
+    config.clear();
+    s5.succeed('Local config cleared');
+  } catch (e) {
+    s5.warn(`Could not clear config: ${e.message}`);
+  }
+  // ── Done ───────────────────────────────────
+  console.log('');
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log('');
+  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
+  console.log('');
+}

package/cli/index.js CHANGED Viewed

@@ -150,7 +150,7 @@ import { runInstall } from './commands/install.js';
 import { runUninstall } from './commands/uninstall.js';
 import { runScrub } from './commands/scrub.js';
 import { runServe, MCP_TOOLS } from './commands/serve.js';
-import { listPlugins, registerPlugin } from './supervisor-registry.js';
+import { deregisterPlugin, listPlugins, registerPlugin, syncPluginsFromRepos, SYNC_REPO_NAMES, SYNC_SKIP_STATES } from './supervisor-registry.js';
 import { runOps } from './commands/ops.js';
 import { runOpsInstall } from './commands/ops-install.js';
 import { runCodevelop } from './commands/codevelop.js';
@@ -1034,6 +1034,78 @@ pluginCmd
     console.log(`  ✓ ${chalk.white(receipt.target?.plugin_id || '?')} ${state} — surfaces: ${(receipt.resulting_state?.surfaces || []).join(', ') || 'none'}`);
   });
+// clauth plugin sync — a SWEEP, NOT A CATALOG. It reads the ORIGINAL
+// clauth-plugin.json in each product repo; it stores no inventory of what
+// exists. See the comment above syncPluginsFromRepos in supervisor-registry.js
+// for why re-consolidating this into a catalog file undoes a deliberate change.
+pluginCmd
+  .command('sync')
+  .description('Sweep the known product-repo clauth-plugin.json manifests and register each one. Reads the ORIGINAL manifest in each repo — stores no catalog, no inventory, no manifest copy, no port assignments. A missing repo or manifest warns and continues.')
+  .option(
+    '--repo-root <path>',
+    `Override a product-repo root as <path> (applies to regen-root) or <name>=<path> where <name> is one of: ${SYNC_REPO_NAMES.join(', ')}. Repeatable.`,
+    (value, previous) => [...(previous || []), value],
+    [],
+  )
+  .action((opts) => {
+    const repoRoots = {};
+    for (const entry of opts.repoRoot || []) {
+      const match = /^([a-zA-Z0-9_.-]+)=(.+)$/.exec(entry);
+      if (match) repoRoots[match[1]] = match[2];
+      else repoRoots['regen-root'] = entry;
+    }
+    let receipts = [];
+    let threw = null;
+    try {
+      receipts = syncPluginsFromRepos(repoRoots, 'cli');
+    } catch (error) {
+      // syncPluginsFromRepos is contracted not to throw; if it ever does, still
+      // print whatever the operator needs rather than a raw Node stack.
+      threw = error;
+    }
+    const skipped = new Set(SYNC_SKIP_STATES);
+    let failures = 0;
+    for (const receipt of receipts) {
+      if (receipt.ok) {
+        console.log(`  ✓ ${chalk.white(receipt.id || '?')} ${receipt.state} — ${chalk.gray(receipt.path || receipt.repo)}`);
+      } else if (skipped.has(receipt.state)) {
+        console.warn(`  ⚠ ${receipt.state}: ${chalk.gray(receipt.path || receipt.repo)}`);
+      } else {
+        failures += 1;
+        console.error(`  ✗ ${receipt.state}: ${receipt.error || receipt.path || receipt.repo}`);
+      }
+    }
+    if (threw) {
+      console.error(`  ✗ sync_failed: ${threw instanceof Error ? threw.message : String(threw)}`);
+      failures += 1;
+    }
+    if (failures > 0) process.exitCode = 1;
+  });
+pluginCmd
+  .command('deregister <id>')
+  .description('Remove one managed plugin directory by id and re-run discovery. Removing an unregistered id is a safe no-op.')
+  .option('--dry-run', 'Resolve and print the directory that would be deleted, without deleting it')
+  .action((id, opts) => {
+    let receipt;
+    try {
+      receipt = deregisterPlugin(id, 'cli', { dryRun: Boolean(opts.dryRun) });
+    } catch (error) {
+      console.error(`  ✗ deregister_failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 1;
+      return;
+    }
+    const ok = receipt.resulting_state?.ok;
+    const state = receipt.resulting_state?.state;
+    if (!ok) {
+      console.error(`  ✗ ${state}: ${receipt.resulting_state?.error || 'deregistration failed'}`);
+      process.exitCode = 1;
+      return;
+    }
+    const target = receipt.resulting_state?.target_dir;
+    console.log(`  ✓ ${chalk.white(receipt.target?.plugin_id || '?')} ${state} — surfaces: ${(receipt.resulting_state?.surfaces || []).join(', ') || 'none'}${target ? ` — ${chalk.gray(target)}` : ''}`);
+  });
 // ──────────────────────────────────────────────
 // clauth chitchat --session <id>
 // ──────────────────────────────────────────────