@lifeaitools/clauth 2.0.3 → 2.1.1

package/cli/commands/serve.js

@@ -907,6 +907,13 @@ export function dashboardHtml(port, whitelist, isStaged = false, initWriteToken
   .supervisor-sub{font-size:.76rem;color:#94a3b8;margin-top:3px;line-height:1.35}
   .supervisor-actions{display:flex;gap:8px;flex-wrap:wrap}
   .supervisor-action{background:#0f172a;color:#cbd5e1;border:1px solid #334155;border-radius:6px;padding:6px 10px;font-size:.75rem;cursor:pointer}
+  .supervisor-action:hover:not(:disabled){background:#1e293b;border-color:#475569}
+  /* Visible but inert until a surface is selected — the operator can always
+     SEE which commands exist, which is the whole point of showing them. */
+  .supervisor-action:disabled{opacity:.42;cursor:not-allowed}
+  /* The selected row has to be unmistakable, otherwise "which surface am I
+     about to restart?" is a guess. */
+  .supervisor-row.selected{border-color:#38bdf8;background:rgba(56,189,248,.10)}
   .supervisor-action:hover{border-color:#38bdf8;color:#e0f2fe}
   .supervisor-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:10px}
   .supervisor-card{border:1px solid #1e293b;background:rgba(2,6,23,.52);border-radius:10px;padding:10px;min-width:0}
@@ -1588,7 +1595,13 @@ let supervisorLogTailStarted = false;
 function startSupervisorLogTail() {
   if (supervisorLogTailStarted) return; // showMain() can run more than once per page load
   supervisorLogTailStarted = true;
-  setInterval(loadSupervisorCockpit, 3000);
+  // 3s was far too aggressive for a panel nobody watches continuously, and it
+  // was self-defeating: each tick issues GET /health + /v1/surfaces + the log
+  // read, and the request logger writes a line for each — so the dashboard was
+  // the dominant author of the very log it renders. clauth-serve.log had grown
+  // to 63 MB / 892,272 lines, its tail almost entirely this poll.
+  // 15s keeps the panel live without the panel being the workload.
+  setInterval(loadSupervisorCockpit, 15000);
 }
 
 function supervisorBadge(text, kind) {
@@ -1626,14 +1639,22 @@ const CLAUTH_SELF_PSEUDO_SURFACE = {
   health: null,
 };
 
+let supervisorCockpitLoadedOnce = false;
 async function loadSupervisorCockpit() {
   const status = document.getElementById("supervisor-status");
-  if (status) status.textContent = "Loading supervisor state…";
+  // Only announce loading on the FIRST paint. On a background poll this
+  // overwrote the healthy/vault/version badges with "Loading supervisor state…"
+  // every tick, so the panel visibly flashed on a fixed cadence forever.
+  if (status && !supervisorCockpitLoadedOnce) status.textContent = "Loading supervisor state…";
   try {
-    const [health, surfaces, logs] = await Promise.all([
+    const [health, surfaces, logs, daemonLog] = await Promise.all([
       supervisorJson("/health"),
       supervisorJson("/v1/surfaces"),
       supervisorJson("/v1/logs?limit=40"),
+      // The Operations card tails the clauth DAEMON log — the actual
+      // clauth-serve.log an operator means by "the clauth log" — not the
+      // supervisor's events.jsonl, which is a separate plugin-event stream.
+      fetch(BASE + "/v1/daemon-log?lines=60").then(r => r.json()).catch(() => null),
     ]);
     const surfaceRows = [CLAUTH_SELF_PSEUDO_SURFACE, ...(surfaces.surfaces || [])];
     lastSupervisorSurfaceRows = surfaceRows;
@@ -1643,18 +1664,37 @@ async function loadSupervisorCockpit() {
     document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length - 1);
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
-    document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
-    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    // Name the file actually being shown. It said events.jsonl while rendering
+    // the daemon log, which makes the card unverifiable — you cannot go look at
+    // the file it claims to be tailing.
+    document.getElementById("supervisor-log-path").textContent =
+      (daemonLog && daemonLog.log_path) || logs.log_path || "events.jsonl";
+    // Replacing innerHTML resets scrollTop to 0. The surfaces list is taller
+    // than its box, so on every poll tick the row you were looking at — or had
+    // just selected — scrolled out from under you. That is the "jumps up and
+    // down": not the data changing, the scroll position being thrown away on a
+    // fixed cadence. Preserve it across the swap.
+    const surfacesEl = document.getElementById("supervisor-surfaces");
+    const keepScroll = surfacesEl.scrollTop;
+    surfacesEl.innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    surfacesEl.scrollTop = keepScroll;
     renderSupervisorCmdbar();
+    supervisorCockpitLoadedOnce = true;
     const logEl = document.getElementById("supervisor-events");
     // Newest-at-bottom, like a real tail -- and only auto-scroll if the
     // reader was already at the bottom, so scrolling up to read history
     // during a poll tick doesn't get yanked back down.
     const wasAtBottom = logEl.scrollHeight - logEl.scrollTop - logEl.clientHeight < 12;
-    logEl.textContent = (logs.events || []).slice(-40).map(e => {
-      const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
-      return (e.ts || e.created_at || "") + "  " + label;
-    }).join("\\n") || "No events yet.";
+    // Real daemon log when it is reachable; supervisor events only as a
+    // fallback so the card is never blank if the tail route fails.
+    if (daemonLog && Array.isArray(daemonLog.lines) && daemonLog.lines.length) {
+      logEl.textContent = daemonLog.lines.join("\\n");
+    } else {
+      logEl.textContent = (logs.events || []).slice(-40).map(e => {
+        const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
+        return (e.ts || e.created_at || "") + "  " + label;
+      }).join("\\n") || "No events yet.";
+    }
     if (wasAtBottom) logEl.scrollTop = logEl.scrollHeight;
     if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status === "ok" ? "healthy" : (health.status || "unknown")), health.status === "ok" ? "ok" : "warn") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
   } catch (err) {
@@ -1684,13 +1724,22 @@ function selectSupervisorSurface(compositeId, name) {
 function renderSupervisorCmdbar() {
   const bar = document.getElementById("supervisor-cmdbar");
   if (!bar) return;
-  if (!selectedSupervisorSurface) {
-    bar.innerHTML = '<span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span>';
-    return;
-  }
-  const { id, name } = selectedSupervisorSurface;
-  bar.innerHTML = '<span class="supervisor-cmdbar-name">' + htmlEscape(name) + '</span>' +
-    SUPERVISOR_SURFACE_ACTIONS.map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(id) + ',' + jsArg(a) + ')">' + a + '</button>').join("");
+  // The buttons are ALWAYS rendered — disabled until a surface is selected,
+  // never hidden. The previous version emitted only a "Select a surface below"
+  // sentence and materialised the buttons on click, so an operator who had not
+  // clicked yet saw no commands at all and had no way to know the panel had
+  // any. "The commands are missing" was an accurate report of what was on
+  // screen. A control you cannot see is a control that does not exist.
+  const sel = selectedSupervisorSurface;
+  const enable = Boolean(sel);
+  const label = sel
+    ? '<span class="supervisor-cmdbar-name">' + htmlEscape(sel.name) + '</span>'
+    : '<span class="supervisor-cmdbar-empty">Select a surface &rarr;</span>';
+  bar.innerHTML = label + SUPERVISOR_SURFACE_ACTIONS.map(a =>
+    '<button class="supervisor-action" data-supervisor-action="' + a + '"'
+    + (enable ? ' onclick="runSupervisorSurface(' + jsArg(sel.id) + ',' + jsArg(a) + ')"' : ' disabled')
+    + '>' + a + '</button>').join("")
+    + (enable ? '' : '');
 }
 
 function renderSupervisorSurface(surface) {
@@ -4498,6 +4547,59 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return ok(res, { tunnels: listTunnels() });
     }
 
+    // GET /v1/daemon-log — tail of THE clauth daemon log (clauth-serve.log),
+    // which is what an operator means by "the clauth log". /v1/logs below is a
+    // different thing: supervisor plugin events out of events.jsonl. The
+    // dashboard's Operations card rendered that second file, so it showed
+    // plugin_discovered/credential_required chatter and never the daemon's own
+    // activity.
+    //
+    // Reads only the LAST slice of the file, never the whole thing: this log is
+    // routinely tens of megabytes (63 MB / 892,272 lines when this was written),
+    // so a naive readFileSync would stall the daemon on every poll.
+    if (method === "GET" && reqPath === "/v1/daemon-log") {
+      const want = Number(url.searchParams.get("lines") || 60);
+      const lines = Number.isFinite(want) ? Math.max(1, Math.min(want, 500)) : 60;
+      try {
+        const stat = fs.statSync(LOG_FILE);
+        const TAIL_BYTES = 96 * 1024;
+        const start = Math.max(0, stat.size - TAIL_BYTES);
+        const fd = fs.openSync(LOG_FILE, "r");
+        const buf = Buffer.alloc(Math.min(TAIL_BYTES, stat.size));
+        fs.readSync(fd, buf, 0, buf.length, start);
+        fs.closeSync(fd);
+        const text = buf.toString("utf8");
+        // Drop the first line when we started mid-file — it is a partial line.
+        let all = text.split(/\r?\n/).filter(Boolean);
+        if (start > 0) all = all.slice(1);
+        // Strip routine HTTP access lines. The dashboard itself polls /health,
+        // /ping, /builds, /tunnel, /v1/surfaces, /v1/logs and /v1/daemon-log, so
+        // an unfiltered tail is almost entirely the dashboard watching itself —
+        // which is exactly what an operator sees as "it just has bullshit in
+        // it". What belongs here is what the daemon DID: operations, errors,
+        // startup, auth events. Pass `?raw=1` for the unfiltered tail.
+        if (url.searchParams.get("raw") !== "1") {
+          const NOISE = /\s(GET|HEAD)\s+\/(ping|health|builds|tunnel|v1\/(surfaces|logs|daemon-log|plugins)|favicon\.ico)\b/;
+          all = all.filter((l) => !NOISE.test(l));
+        }
+        const rows = all.slice(-lines);
+        return ok(res, {
+          schema: "clauth.daemon.log.v1",
+          log_path: LOG_FILE,
+          size_bytes: stat.size,
+          lines: rows,
+        });
+      } catch (err) {
+        return ok(res, {
+          schema: "clauth.daemon.log.v1",
+          log_path: LOG_FILE,
+          size_bytes: 0,
+          lines: [],
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
+    }
+
     if (method === "GET" && reqPath === "/v1/logs") {
       const limit = Number(url.searchParams.get("limit") || 100);
       const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(limit, 500)) : 100;

package/cli/supervisor-registry.js

@@ -853,6 +853,29 @@ export function operation(action, target, prior, result, actor = "localhost") {
   state.operations = [receipt, ...(state.operations || [])].slice(0, 500);
   saveSupervisorState(state);
   appendJsonl(file("events.jsonl"), { ts: now(), kind: "operation", ...receipt });
+  // Mirror one human-readable line into the clauth DAEMON log as well.
+  //
+  // events.jsonl stays the structured record that /v1/logs and state read.
+  // But an operator asking for "the clauth log" means clauth-serve.log, and
+  // until now supervisor operations never appeared there — so a surface
+  // start/stop/restart was invisible in the log people actually tail, and the
+  // dashboard had to render a second, separate stream to show them at all.
+  // One log, with the events in it.
+  //
+  // Best-effort by construction: a logging failure must never fail the
+  // operation whose receipt this is.
+  try {
+    const logFile = process.env.CLAUTH_SERVE_LOG
+      || path.join(os.tmpdir(), "clauth-serve.log");
+    if (fs.existsSync(path.dirname(logFile))) {
+      const okFlag = result?.ok === false ? "FAIL" : "ok";
+      const tgt = target && typeof target === "object"
+        ? (target.surface_id || target.plugin_id || target.service || JSON.stringify(target))
+        : String(target ?? "");
+      const stateLabel = result?.state ? ` ${result.state}` : "";
+      fs.appendFileSync(logFile, `[${receipt.created_at}] ${action} ${tgt} ${okFlag}${stateLabel} actor=${actor}\n`, "utf8");
+    }
+  } catch { /* logging must never break the operation it records */ }
   return receipt;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "2.0.3",
+  "version": "2.1.1",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {