@lifeaitools/clauth 2.1.0 → 2.1.1

package/cli/commands/serve.js

@@ -907,6 +907,13 @@ export function dashboardHtml(port, whitelist, isStaged = false, initWriteToken
   .supervisor-sub{font-size:.76rem;color:#94a3b8;margin-top:3px;line-height:1.35}
   .supervisor-actions{display:flex;gap:8px;flex-wrap:wrap}
   .supervisor-action{background:#0f172a;color:#cbd5e1;border:1px solid #334155;border-radius:6px;padding:6px 10px;font-size:.75rem;cursor:pointer}
+  .supervisor-action:hover:not(:disabled){background:#1e293b;border-color:#475569}
+  /* Visible but inert until a surface is selected — the operator can always
+     SEE which commands exist, which is the whole point of showing them. */
+  .supervisor-action:disabled{opacity:.42;cursor:not-allowed}
+  /* The selected row has to be unmistakable, otherwise "which surface am I
+     about to restart?" is a guess. */
+  .supervisor-row.selected{border-color:#38bdf8;background:rgba(56,189,248,.10)}
   .supervisor-action:hover{border-color:#38bdf8;color:#e0f2fe}
   .supervisor-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:10px}
   .supervisor-card{border:1px solid #1e293b;background:rgba(2,6,23,.52);border-radius:10px;padding:10px;min-width:0}
@@ -1657,7 +1664,11 @@ async function loadSupervisorCockpit() {
     document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length - 1);
     document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
     document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
-    document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
+    // Name the file actually being shown. It said events.jsonl while rendering
+    // the daemon log, which makes the card unverifiable — you cannot go look at
+    // the file it claims to be tailing.
+    document.getElementById("supervisor-log-path").textContent =
+      (daemonLog && daemonLog.log_path) || logs.log_path || "events.jsonl";
     // Replacing innerHTML resets scrollTop to 0. The surfaces list is taller
     // than its box, so on every poll tick the row you were looking at — or had
     // just selected — scrolled out from under you. That is the "jumps up and
@@ -1713,13 +1724,22 @@ function selectSupervisorSurface(compositeId, name) {
 function renderSupervisorCmdbar() {
   const bar = document.getElementById("supervisor-cmdbar");
   if (!bar) return;
-  if (!selectedSupervisorSurface) {
-    bar.innerHTML = '<span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span>';
-    return;
-  }
-  const { id, name } = selectedSupervisorSurface;
-  bar.innerHTML = '<span class="supervisor-cmdbar-name">' + htmlEscape(name) + '</span>' +
-    SUPERVISOR_SURFACE_ACTIONS.map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(id) + ',' + jsArg(a) + ')">' + a + '</button>').join("");
+  // The buttons are ALWAYS rendered — disabled until a surface is selected,
+  // never hidden. The previous version emitted only a "Select a surface below"
+  // sentence and materialised the buttons on click, so an operator who had not
+  // clicked yet saw no commands at all and had no way to know the panel had
+  // any. "The commands are missing" was an accurate report of what was on
+  // screen. A control you cannot see is a control that does not exist.
+  const sel = selectedSupervisorSurface;
+  const enable = Boolean(sel);
+  const label = sel
+    ? '<span class="supervisor-cmdbar-name">' + htmlEscape(sel.name) + '</span>'
+    : '<span class="supervisor-cmdbar-empty">Select a surface &rarr;</span>';
+  bar.innerHTML = label + SUPERVISOR_SURFACE_ACTIONS.map(a =>
+    '<button class="supervisor-action" data-supervisor-action="' + a + '"'
+    + (enable ? ' onclick="runSupervisorSurface(' + jsArg(sel.id) + ',' + jsArg(a) + ')"' : ' disabled')
+    + '>' + a + '</button>').join("")
+    + (enable ? '' : '');
 }
 
 function renderSupervisorSurface(surface) {
@@ -4550,8 +4570,19 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         fs.closeSync(fd);
         const text = buf.toString("utf8");
         // Drop the first line when we started mid-file — it is a partial line.
-        const all = text.split(/\r?\n/).filter(Boolean);
-        const rows = (start > 0 ? all.slice(1) : all).slice(-lines);
+        let all = text.split(/\r?\n/).filter(Boolean);
+        if (start > 0) all = all.slice(1);
+        // Strip routine HTTP access lines. The dashboard itself polls /health,
+        // /ping, /builds, /tunnel, /v1/surfaces, /v1/logs and /v1/daemon-log, so
+        // an unfiltered tail is almost entirely the dashboard watching itself —
+        // which is exactly what an operator sees as "it just has bullshit in
+        // it". What belongs here is what the daemon DID: operations, errors,
+        // startup, auth events. Pass `?raw=1` for the unfiltered tail.
+        if (url.searchParams.get("raw") !== "1") {
+          const NOISE = /\s(GET|HEAD)\s+\/(ping|health|builds|tunnel|v1\/(surfaces|logs|daemon-log|plugins)|favicon\.ico)\b/;
+          all = all.filter((l) => !NOISE.test(l));
+        }
+        const rows = all.slice(-lines);
         return ok(res, {
           schema: "clauth.daemon.log.v1",
           log_path: LOG_FILE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {