@lifeaitools/clauth 2.1.1 → 2.10.0

package/cli/commands/login.test.js

@@ -2,7 +2,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { LOGIN_TARGETS, listTargets, resolveEnvRoot, resolveInvocation } from "./login.js";
+import { LOGIN_TARGETS, listTargets, resolveEnvRoot, resolveInvocation, findBash, printTargetList } from "./login.js";
 
 test("listTargets exposes vultr with its clauth service + default host", () => {
   const targets = listTargets();
@@ -71,3 +71,51 @@ test("resolveInvocation only switches to the native Windows engine when explicit
   assert.match(inv.args[2], /ssh-clauth\.ps1$/);
   assert.deepEqual(inv.args.slice(3, 5), ["-Service", "vultr-dev-ssh"]);
 });
+
+test("findBash returns the first probe-successful candidate", () => {
+  const calls = [];
+  const probe = (bin) => { calls.push(bin); return { status: bin === "bash" ? 0 : 1 }; };
+  assert.equal(findBash("linux", probe), "bash");
+  assert.deepEqual(calls, ["bash"], "posix has exactly one candidate — bash itself");
+});
+
+test("findBash on win32 tries Git Bash's absolute path before the bare 'bash' shim", () => {
+  const calls = [];
+  const probe = (bin) => { calls.push(bin); return { status: bin.includes("Git") ? 0 : 1 }; };
+  const result = findBash("win32", probe);
+  // Written via String.raw: a formatter previously collapsed a literal
+  // "\\P"/"\\G"/"\\b" double-backslash down to a single backslash, and "\b" in
+  // a normal JS string is the BACKSPACE control character, not "backslash b" —
+  // the assertion then compared a real path against a string full of control
+  // bytes. String.raw is immune to that class of silent corruption.
+  const expected = String.raw`C:\Program Files\Git\bin\bash.exe`;
+  assert.equal(result, expected);
+  assert.deepEqual(calls, [expected], "must not probe the fallback once the first candidate succeeds");
+});
+
+test("findBash falls back to the bare 'bash' shim when Git Bash's absolute path fails", () => {
+  const probe = (bin) => (bin === "bash" ? { status: 0 } : { status: 1 });
+  assert.equal(findBash("win32", probe), "bash");
+});
+
+test("findBash returns 'bash' as the last resort even when every probe throws", () => {
+  const probe = () => { throw new Error("spawnSync ENOENT"); };
+  assert.equal(findBash("win32", probe), "bash");
+});
+
+test("findBash treats a non-zero exit status as a failed probe, not a crash", () => {
+  const probe = () => ({ status: 127 });
+  assert.equal(findBash("linux", probe), "bash", "every candidate reported non-zero, so the final fallback must still be returned, not undefined");
+});
+
+test("printTargetList prints every registered target's name, host, and label", () => {
+  const lines = [];
+  printTargetList((line) => lines.push(line));
+  const text = lines.join("\n");
+  for (const t of listTargets()) {
+    assert.ok(text.includes(t.name), `missing target name ${t.name}`);
+    assert.ok(text.includes(t.host), `missing host for ${t.name}`);
+    assert.ok(text.includes(t.label), `missing label for ${t.name}`);
+  }
+  assert.match(text, /clauth login vultr/, "usage examples must be present");
+});

package/cli/commands/ops-install.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import pm2 from "pm2";
+import { ensurePm2 } from "../ops/pm2-preflight.js";
 
 const DEFAULT_PORT = 52439;
 const DEFAULT_NAME = "clauth-deployment";
@@ -115,7 +115,7 @@ export function buildOpsServiceSpec({ config, rootDir }) {
   };
 }
 
-function pm2Call(method, ...args) {
+function pm2Call(pm2, method, ...args) {
   return new Promise((resolve, reject) => pm2[method](...args, (error, value) => error ? reject(error) : resolve(value)));
 }
 
@@ -159,9 +159,9 @@ export function previousSpec(entry) {
   return restored;
 }
 
-async function rollback(previous, name) {
-  try { await pm2Call("delete", name); } catch {}
-  if (previous) await pm2Call("start", previous);
+async function rollback(pm2, previous, name) {
+  try { await pm2Call(pm2, "delete", name); } catch {}
+  if (previous) await pm2Call(pm2, "start", previous);
 }
 
 export async function runOpsInstall(opts = {}) {
@@ -174,22 +174,23 @@ export async function runOpsInstall(opts = {}) {
     process.stdout.write(`${JSON.stringify({ action: "install", dry_run: true, platform: process.platform, endpoint, pm2_name: config.pm2Name, policy_file: configPath, operations: Object.keys(config.applications).sort() }, null, 2)}\n`);
     return;
   }
+  const pm2 = await ensurePm2();
   await new Promise((resolve, reject) => pm2.connect(false, (error) => error ? reject(error) : resolve()));
   let result;
   let previous = null;
   try {
-    const existing = (await pm2Call("list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
+    const existing = (await pm2Call(pm2, "list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
     // PM2 rejects an inline `env` object on restart-by-name.  Replacing only
     // this dedicated control-plane process is the supported way to apply a
     // changed server policy without touching any managed application.
     if (existing && !ownedService(existing, spec)) throw new Error(`refusing to replace non-installer PM2 process: ${config.pm2Name}`);
     previous = existing ? previousSpec(existing) : null;
-    if (existing) await pm2Call("delete", config.pm2Name);
-    await pm2Call("start", spec);
+    if (existing) await pm2Call(pm2, "delete", config.pm2Name);
+    await pm2Call(pm2, "start", spec);
     for (let attempt = 0; attempt < 20; attempt += 1) {
       try {
         result = await probe(endpoint);
-        const current = (await pm2Call("list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
+        const current = (await pm2Call(pm2, "list")).find((entry) => (entry.name || entry.pm2_env?.name) === config.pm2Name);
         const pid = current?.pid ?? current?.pm2_env?.pm_pid;
         const status = current?.pm2_env?.status ?? current?.status;
         if (status !== "online" || !Number.isInteger(pid) || result.process_id !== pid || result.listening_port !== config.port) {
@@ -202,7 +203,7 @@ export async function runOpsInstall(opts = {}) {
       }
     }
   } catch (error) {
-    await rollback(previous, config.pm2Name);
+    await rollback(pm2, previous, config.pm2Name);
     throw error;
   } finally {
     await new Promise((resolve) => pm2.disconnect(() => resolve()));

package/cli/commands/ops.test.js

@@ -0,0 +1,270 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { runOps, requestOps } from "./ops.js";
+
+const APPROVED = "https://ops.example.regendevcorp.com";
+
+function withEnv(vars, fn) {
+  const old = {};
+  // `process.env.X = undefined` does NOT delete a var — it coerces to the
+  // literal string "undefined", which endpointFrom() then feeds to `new URL()`
+  // and gets a URL-parse error instead of the "is required" guard. A var must
+  // be deleted, never assigned undefined, to simulate "not set".
+  for (const [k, v] of Object.entries(vars)) {
+    old[k] = process.env[k];
+    if (v === undefined) delete process.env[k]; else process.env[k] = v;
+  }
+  return (async () => {
+    try { return await fn(); } finally {
+      for (const [k, v] of Object.entries(old)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+    }
+  })();
+}
+
+function withMockFetch(handler, fn) {
+  const old = globalThis.fetch;
+  globalThis.fetch = handler;
+  return (async () => { try { return await fn(); } finally { globalThis.fetch = old; } })();
+}
+
+function jsonRes(status, body) {
+  return { ok: status >= 200 && status < 300, status, json: async () => body, text: async () => JSON.stringify(body) };
+}
+
+function textRes(status, text) {
+  return { ok: status >= 200 && status < 300, status, text: async () => text };
+}
+
+function captureStdout(fn) {
+  const chunks = [];
+  const orig = process.stdout.write;
+  process.stdout.write = (chunk) => { chunks.push(chunk); return true; };
+  return (async () => {
+    try { await fn(); } finally { process.stdout.write = orig; }
+    return chunks.join("");
+  })();
+}
+
+// ── requestOps: the raw HTTP layer ──────────────────────────────────────────
+
+test("requestOps sends a bearer + JSON body and returns the parsed payload", async () => {
+  let seen = null;
+  await withMockFetch(
+    async (url, opts) => { seen = { url: String(url), opts }; return jsonRes(200, { ok: true, echoed: JSON.parse(opts.body) }); },
+    async () => {
+      const result = await requestOps({ endpoint: "https://ops.example", token: "tok-123", method: "POST", path: "/v1/ops/deployments", body: { application: "app-1" } });
+      assert.equal(result.echoed.application, "app-1");
+    },
+  );
+  assert.equal(seen.url, "https://ops.example/v1/ops/deployments");
+  assert.equal(seen.opts.headers.Authorization, "Bearer tok-123");
+  assert.equal(seen.opts.headers["Content-Type"], "application/json");
+});
+
+test("requestOps omits Content-Type on a bodyless GET", async () => {
+  let seen = null;
+  await withMockFetch(
+    async (url, opts) => { seen = opts; return jsonRes(200, { ok: true }); },
+    async () => requestOps({ endpoint: "https://ops.example", token: "t", method: "GET", path: "/v1/ops/catalog" }),
+  );
+  assert.equal(seen.headers["Content-Type"], undefined);
+  assert.equal(seen.body, undefined);
+});
+
+test("requestOps throws the server's error string on a non-2xx response", async () => {
+  await withMockFetch(
+    async () => jsonRes(403, { error: "forbidden_target" }),
+    async () => {
+      await assert.rejects(
+        () => requestOps({ endpoint: "https://ops.example", token: "t", method: "GET", path: "/v1/ops/list" }),
+        /forbidden_target/,
+      );
+    },
+  );
+});
+
+test("requestOps reports invalid_json_response rather than throwing when the error body is not JSON", async () => {
+  // .json().catch(() => ({ error: "invalid_json_response" })) means a non-JSON
+  // error body still produces a payload with an `error` field — which
+  // `payload.error || ...` then picks over the HTTP-status fallback string.
+  await withMockFetch(
+    async () => ({ ok: false, status: 502, json: async () => { throw new Error("not json"); } }),
+    async () => {
+      await assert.rejects(
+        () => requestOps({ endpoint: "https://ops.example", token: "t", method: "GET", path: "/x" }),
+        /invalid_json_response/,
+      );
+    },
+  );
+});
+
+// ── runOps: endpoint approval + bearer retrieval + action routing ──────────
+
+test("runOps refuses when CLAUTH_OPS_APPROVED_ORIGIN is not set — fails closed, not open", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: undefined }, async () => {
+    await assert.rejects(() => runOps("catalog", {}), /CLAUTH_OPS_APPROVED_ORIGIN is required/);
+  });
+});
+
+test("runOps refuses a caller-supplied endpoint that is not the approved origin", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await assert.rejects(
+      () => runOps("catalog", { endpoint: "https://evil.example.com" }),
+      /not the approved Vultr origin/,
+    );
+  });
+});
+
+test("runOps refuses an approved origin that is not https — this is the control-plane bearer, never plaintext", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: "http://ops.example.regendevcorp.com" }, async () => {
+    await assert.rejects(() => runOps("catalog", {}), /not the approved Vultr origin/);
+  });
+});
+
+test("runOps fetches the bearer from the LOCAL clauth vault, never inline, and sends it to the approved origin", async () => {
+  const calls = [];
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url) => {
+        calls.push(String(url));
+        if (String(url).includes("/v/vultr-ops-api-token")) return textRes(200, "  secret-bearer-value  \n");
+        return jsonRes(200, { catalog: [] });
+      },
+      async () => {
+        const out = await captureStdout(() => runOps("catalog", {}));
+        assert.match(out, /"catalog"/);
+      },
+    );
+  });
+  assert.ok(calls.some((u) => u.includes("127.0.0.1:52437/v/vultr-ops-api-token")), "must fetch from the local clauth daemon");
+  assert.ok(calls.some((u) => u.startsWith(APPROVED)), "must call the approved origin, not local clauth, for the actual op");
+});
+
+test("runOps refuses when the vault has no bearer for the requested service", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async () => textRes(404, ""),
+      async () => {
+        await assert.rejects(() => runOps("catalog", {}), /vultr-ops-api-token unavailable/);
+      },
+    );
+  });
+});
+
+test("runOps refuses when the vault returns an empty token", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async () => textRes(200, "   "),
+      async () => {
+        await assert.rejects(() => runOps("catalog", {}), /is empty/);
+      },
+    );
+  });
+});
+
+const actionFixtures = [
+  ["list", {}, "GET", "/v1/ops/processes"],
+  ["describe", { target: "dev-center" }, "GET", "/v1/ops/processes/dev-center"],
+  ["job", { job: "job-42" }, "GET", "/v1/ops/jobs/job-42"],
+];
+
+for (const [action, opts, method, path] of actionFixtures) {
+  test(`runOps "${action}" issues ${method} ${path}`, async () => {
+    let seen = null;
+    await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+      await withMockFetch(
+        async (url, fetchOpts) => {
+          if (String(url).includes("/v/")) return textRes(200, "tok");
+          seen = { url: String(url), method: fetchOpts.method };
+          return jsonRes(200, { ok: true });
+        },
+        async () => { await captureStdout(() => runOps(action, opts)); },
+      );
+    });
+    assert.equal(seen.method, method);
+    assert.equal(seen.url, `${APPROVED}${path}`);
+  });
+}
+
+test('runOps "describe" requires --target', async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url) => (String(url).includes("/v/") ? textRes(200, "tok") : jsonRes(200, {})),
+      async () => { await assert.rejects(() => runOps("describe", {}), /--target is required/); },
+    );
+  });
+});
+
+test('runOps "run" builds the operation input from target/script/instances/argsJson/optionsJson', async () => {
+  let body = null;
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url, opts) => {
+        if (String(url).includes("/v/")) return textRes(200, "tok");
+        body = JSON.parse(opts.body);
+        return jsonRes(200, { ok: true });
+      },
+      async () => {
+        await captureStdout(() => runOps("run", {
+          operation: "restart", target: "dev-center", instances: "2",
+          argsJson: '["--force"]', optionsJson: '{"wait":true}',
+        }));
+      },
+    );
+  });
+  assert.equal(body.operation, "restart");
+  assert.equal(body.input.target, "dev-center");
+  assert.equal(body.input.instances, 2, "instances must be coerced to a number");
+  assert.deepEqual(body.input.args, ["--force"]);
+  assert.deepEqual(body.input.options, { wait: true });
+});
+
+test('runOps "run" requires --operation', async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url) => (String(url).includes("/v/") ? textRes(200, "tok") : jsonRes(200, {})),
+      async () => { await assert.rejects(() => runOps("run", {}), /--operation is required/); },
+    );
+  });
+});
+
+test('runOps "promote" and "deploy" require --application', async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url) => (String(url).includes("/v/") ? textRes(200, "tok") : jsonRes(200, {})),
+      async () => {
+        await assert.rejects(() => runOps("promote", {}), /--application is required for promote/);
+        await assert.rejects(() => runOps("deploy", {}), /--application is required for deploy/);
+      },
+    );
+  });
+});
+
+test('runOps "deploy" includes ref only when supplied', async () => {
+  const bodies = [];
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url, opts) => {
+        if (String(url).includes("/v/")) return textRes(200, "tok");
+        bodies.push(JSON.parse(opts.body));
+        return jsonRes(200, { ok: true });
+      },
+      async () => {
+        await captureStdout(() => runOps("deploy", { application: "app-uuid" }));
+        await captureStdout(() => runOps("deploy", { application: "app-uuid", ref: "abc123" }));
+      },
+    );
+  });
+  assert.equal("ref" in bodies[0], false, "ref must be omitted, not sent as undefined, when not supplied");
+  assert.equal(bodies[1].ref, "abc123");
+});
+
+test("runOps rejects an unknown action", async () => {
+  await withEnv({ CLAUTH_OPS_APPROVED_ORIGIN: APPROVED }, async () => {
+    await withMockFetch(
+      async (url) => (String(url).includes("/v/") ? textRes(200, "tok") : jsonRes(200, {})),
+      async () => { await assert.rejects(() => runOps("teleport", {}), /unknown ops action: teleport/); },
+    );
+  });
+});

package/cli/commands/scrub.test.js

@@ -12,6 +12,7 @@ import {
   isSecretLike,
   loadExtraPatterns,
   sessionTargets,
+  fetchVaultValues,
 } from "./scrub.js";
 
 const GH_TOKEN = "ghp_0123456789abcdefABCDEF0123456789abcd"; // ghp_ + 36 chars
@@ -113,3 +114,72 @@ test("loadExtraPatterns tolerates a missing/malformed file", () => {
   assert.deepEqual(loadExtraPatterns(bad), [], "malformed json → empty, never throws");
   fs.rmSync(bad, { force: true });
 });
+
+test("scrubFile skips an already-scrubbed file, and --force overrides the skip", () => {
+  const { jsonl } = seedProjects();
+  const first = scrubFile(jsonl);
+  assert.ok(typeof first === "number" && first > 0, "first pass must find and redact real secrets");
+
+  const second = scrubFile(jsonl);
+  assert.equal(second, "skipped", "a file carrying the scrub marker must not be rescanned");
+
+  // The GH token pattern is deterministic — re-seed a matching literal so a
+  // force-rescan has something real to find, proving --force actually
+  // bypasses the marker rather than the file simply having nothing left.
+  fs.appendFileSync(jsonl, `still-here=${GH_TOKEN}\n`, "utf-8");
+  const forced = scrubFile(jsonl, { force: true });
+  assert.ok(typeof forced === "number" && forced > 0, "force:true must rescan and find the freshly-appended secret");
+});
+
+test("fetchVaultValues returns [] when the daemon is unreachable — regex-only fallback, never a throw", async () => {
+  const values = await fetchVaultValues("http://127.0.0.1:1");
+  assert.deepEqual(values, []);
+});
+
+test("fetchVaultValues filters to secret-like values and skips services with has_key:false", async () => {
+  const oldFetch = globalThis.fetch;
+  const calls = [];
+  globalThis.fetch = async (url) => {
+    calls.push(String(url));
+    if (String(url).endsWith("/knowledge")) {
+      return { ok: true, json: async () => ({ services: [
+        { name: "real-secret", has_key: true },
+        { name: "no-key-yet", has_key: false },
+        { name: "looks-like-a-url", has_key: true },
+      ] }) };
+    }
+    if (String(url).includes("/v/real-secret")) return { ok: true, text: async () => "  ActualSecretValue123XYZ  " };
+    if (String(url).includes("/v/looks-like-a-url")) return { ok: true, text: async () => "https://example.com/not-a-secret" };
+    return { ok: false, text: async () => "" };
+  };
+  try {
+    const values = await fetchVaultValues("http://127.0.0.1:9");
+    assert.deepEqual(values, [{ name: "real-secret", value: "ActualSecretValue123XYZ" }]);
+    assert.ok(!calls.some((u) => u.includes("/v/no-key-yet")), "has_key:false must never even be fetched");
+  } finally {
+    globalThis.fetch = oldFetch;
+  }
+});
+
+test("fetchVaultValues returns [] when /knowledge itself responds non-ok", async () => {
+  const oldFetch = globalThis.fetch;
+  globalThis.fetch = async () => ({ ok: false });
+  try {
+    assert.deepEqual(await fetchVaultValues("http://127.0.0.1:9"), []);
+  } finally {
+    globalThis.fetch = oldFetch;
+  }
+});
+
+test("fetchVaultValues skips (not throws) a single service whose /v/ fetch rejects", async () => {
+  const oldFetch = globalThis.fetch;
+  globalThis.fetch = async (url) => {
+    if (String(url).endsWith("/knowledge")) return { ok: true, json: async () => ({ services: [{ name: "flaky", has_key: true }] }) };
+    throw new Error("network blip");
+  };
+  try {
+    assert.deepEqual(await fetchVaultValues("http://127.0.0.1:9"), []);
+  } finally {
+    globalThis.fetch = oldFetch;
+  }
+});