@lifeaitools/clauth 2.0.2 → 2.1.0

package/cli/commands/serve.js

@@ -1588,7 +1588,13 @@ let supervisorLogTailStarted = false;
 function startSupervisorLogTail() {
   if (supervisorLogTailStarted) return; // showMain() can run more than once per page load
   supervisorLogTailStarted = true;
-  setInterval(loadSupervisorCockpit, 3000);
+  // 3s was far too aggressive for a panel nobody watches continuously, and it
+  // was self-defeating: each tick issues GET /health + /v1/surfaces + the log
+  // read, and the request logger writes a line for each — so the dashboard was
+  // the dominant author of the very log it renders. clauth-serve.log had grown
+  // to 63 MB / 892,272 lines, its tail almost entirely this poll.
+  // 15s keeps the panel live without the panel being the workload.
+  setInterval(loadSupervisorCockpit, 15000);
 }
 
 function supervisorBadge(text, kind) {
@@ -1626,14 +1632,22 @@ const CLAUTH_SELF_PSEUDO_SURFACE = {
   health: null,
 };
 
+let supervisorCockpitLoadedOnce = false;
 async function loadSupervisorCockpit() {
   const status = document.getElementById("supervisor-status");
-  if (status) status.textContent = "Loading supervisor state…";
+  // Only announce loading on the FIRST paint. On a background poll this
+  // overwrote the healthy/vault/version badges with "Loading supervisor state…"
+  // every tick, so the panel visibly flashed on a fixed cadence forever.
+  if (status && !supervisorCockpitLoadedOnce) status.textContent = "Loading supervisor state…";
   try {
-    const [health, surfaces, logs] = await Promise.all([
+    const [health, surfaces, logs, daemonLog] = await Promise.all([
       supervisorJson("/health"),
       supervisorJson("/v1/surfaces"),
       supervisorJson("/v1/logs?limit=40"),
+      // The Operations card tails the clauth DAEMON log — the actual
+      // clauth-serve.log an operator means by "the clauth log" — not the
+      // supervisor's events.jsonl, which is a separate plugin-event stream.
+      fetch(BASE + "/v1/daemon-log?lines=60").then(r => r.json()).catch(() => null),
     ]);
     const surfaceRows = [CLAUTH_SELF_PSEUDO_SURFACE, ...(surfaces.surfaces || [])];
     lastSupervisorSurfaceRows = surfaceRows;
@@ -1644,17 +1658,32 @@ async function loadSupervisorCockpit() {
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
     document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
-    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    // Replacing innerHTML resets scrollTop to 0. The surfaces list is taller
+    // than its box, so on every poll tick the row you were looking at — or had
+    // just selected — scrolled out from under you. That is the "jumps up and
+    // down": not the data changing, the scroll position being thrown away on a
+    // fixed cadence. Preserve it across the swap.
+    const surfacesEl = document.getElementById("supervisor-surfaces");
+    const keepScroll = surfacesEl.scrollTop;
+    surfacesEl.innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    surfacesEl.scrollTop = keepScroll;
     renderSupervisorCmdbar();
+    supervisorCockpitLoadedOnce = true;
     const logEl = document.getElementById("supervisor-events");
     // Newest-at-bottom, like a real tail -- and only auto-scroll if the
     // reader was already at the bottom, so scrolling up to read history
     // during a poll tick doesn't get yanked back down.
     const wasAtBottom = logEl.scrollHeight - logEl.scrollTop - logEl.clientHeight < 12;
-    logEl.textContent = (logs.events || []).slice(-40).map(e => {
-      const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
-      return (e.ts || e.created_at || "") + "  " + label;
-    }).join("\\n") || "No events yet.";
+    // Real daemon log when it is reachable; supervisor events only as a
+    // fallback so the card is never blank if the tail route fails.
+    if (daemonLog && Array.isArray(daemonLog.lines) && daemonLog.lines.length) {
+      logEl.textContent = daemonLog.lines.join("\\n");
+    } else {
+      logEl.textContent = (logs.events || []).slice(-40).map(e => {
+        const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
+        return (e.ts || e.created_at || "") + "  " + label;
+      }).join("\\n") || "No events yet.";
+    }
     if (wasAtBottom) logEl.scrollTop = logEl.scrollHeight;
     if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status === "ok" ? "healthy" : (health.status || "unknown")), health.status === "ok" ? "ok" : "warn") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
   } catch (err) {
@@ -4498,6 +4527,48 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return ok(res, { tunnels: listTunnels() });
     }
 
+    // GET /v1/daemon-log — tail of THE clauth daemon log (clauth-serve.log),
+    // which is what an operator means by "the clauth log". /v1/logs below is a
+    // different thing: supervisor plugin events out of events.jsonl. The
+    // dashboard's Operations card rendered that second file, so it showed
+    // plugin_discovered/credential_required chatter and never the daemon's own
+    // activity.
+    //
+    // Reads only the LAST slice of the file, never the whole thing: this log is
+    // routinely tens of megabytes (63 MB / 892,272 lines when this was written),
+    // so a naive readFileSync would stall the daemon on every poll.
+    if (method === "GET" && reqPath === "/v1/daemon-log") {
+      const want = Number(url.searchParams.get("lines") || 60);
+      const lines = Number.isFinite(want) ? Math.max(1, Math.min(want, 500)) : 60;
+      try {
+        const stat = fs.statSync(LOG_FILE);
+        const TAIL_BYTES = 96 * 1024;
+        const start = Math.max(0, stat.size - TAIL_BYTES);
+        const fd = fs.openSync(LOG_FILE, "r");
+        const buf = Buffer.alloc(Math.min(TAIL_BYTES, stat.size));
+        fs.readSync(fd, buf, 0, buf.length, start);
+        fs.closeSync(fd);
+        const text = buf.toString("utf8");
+        // Drop the first line when we started mid-file — it is a partial line.
+        const all = text.split(/\r?\n/).filter(Boolean);
+        const rows = (start > 0 ? all.slice(1) : all).slice(-lines);
+        return ok(res, {
+          schema: "clauth.daemon.log.v1",
+          log_path: LOG_FILE,
+          size_bytes: stat.size,
+          lines: rows,
+        });
+      } catch (err) {
+        return ok(res, {
+          schema: "clauth.daemon.log.v1",
+          log_path: LOG_FILE,
+          size_bytes: 0,
+          lines: [],
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+
     if (method === "GET" && reqPath === "/v1/logs") {
       const limit = Number(url.searchParams.get("limit") || 100);
       const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(limit, 500)) : 100;

package/cli/supervisor-registry.js

@@ -500,6 +500,23 @@ export function registerPlugin(manifestPath, actor = "localhost") {
       ok: false, state: "manifest_unreadable", error: error instanceof Error ? error.message : String(error),
     }, actor);
   }
+  // ${PACKAGE_ROOT} — "wherever this manifest actually landed" — resolved HERE
+  // and baked into the stored copy, which is the only point at which the true
+  // origin is still known. registerPlugin copies the manifest into the managed
+  // root, so by the time discoverPlugins() re-reads it, sourcePath is the
+  // managed directory and the package's real install location is gone. An npm
+  // package installs at node_modules/@scope/name/, a path nothing can hardcode.
+  //
+  // Without this a shipped manifest had to name an absolute path: rdc-skills
+  // carried cwd "C:/Dev/rdc-skills" with core+enable_default, so `npm i -g` on
+  // any other machine auto-enabled a CORE plugin pointing at a directory that
+  // does not exist there. The token, not the package, was the defect — the
+  // correct value was simply inexpressible.
+  const packageRoot = path.dirname(path.resolve(manifestPath)).replaceAll("\\", "/");
+  raw = raw
+    .replaceAll("${PACKAGE_ROOT}", packageRoot)
+    .replaceAll("$PACKAGE_ROOT", packageRoot)
+    .replace(/%PACKAGE_ROOT%/gi, packageRoot);
   let manifest;
   try {
     manifest = validatePluginManifest(JSON.parse(raw), manifestPath);
@@ -836,6 +853,29 @@ export function operation(action, target, prior, result, actor = "localhost") {
   state.operations = [receipt, ...(state.operations || [])].slice(0, 500);
   saveSupervisorState(state);
   appendJsonl(file("events.jsonl"), { ts: now(), kind: "operation", ...receipt });
+  // Mirror one human-readable line into the clauth DAEMON log as well.
+  //
+  // events.jsonl stays the structured record that /v1/logs and state read.
+  // But an operator asking for "the clauth log" means clauth-serve.log, and
+  // until now supervisor operations never appeared there — so a surface
+  // start/stop/restart was invisible in the log people actually tail, and the
+  // dashboard had to render a second, separate stream to show them at all.
+  // One log, with the events in it.
+  //
+  // Best-effort by construction: a logging failure must never fail the
+  // operation whose receipt this is.
+  try {
+    const logFile = process.env.CLAUTH_SERVE_LOG
+      || path.join(os.tmpdir(), "clauth-serve.log");
+    if (fs.existsSync(path.dirname(logFile))) {
+      const okFlag = result?.ok === false ? "FAIL" : "ok";
+      const tgt = target && typeof target === "object"
+        ? (target.surface_id || target.plugin_id || target.service || JSON.stringify(target))
+        : String(target ?? "");
+      const stateLabel = result?.state ? ` ${result.state}` : "";
+      fs.appendFileSync(logFile, `[${receipt.created_at}] ${action} ${tgt} ${okFlag}${stateLabel} actor=${actor}\n`, "utf8");
+    }
+  } catch { /* logging must never break the operation it records */ }
   return receipt;
 }