@lifeaitools/clauth 2.1.1 → 2.10.1

package/cli/supervisor-ui.test.js

@@ -5,20 +5,53 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 
-import { dashboardHtml } from './commands/serve.js';
+import { dashboardHtml, stripControlBytes } from './commands/serve.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const serveSource = fs.readFileSync(path.join(here, 'commands', 'serve.js'), 'utf8');
+// /write-token, /auth, /lock, /change-pw moved into their own file (the Vault/
+// Auth component) — static-analysis assertions about that server-side gate
+// logic read this instead of serveSource.
+const vaultAuthComponentSource = fs.readFileSync(path.join(here, 'http', 'components', 'vault-auth-component.js'), 'utf8');
+// The dashboard client script is a static asset (../dashboard/dashboard.js),
+// not inlined in serve.js — static-analysis assertions about client-side code
+// (write-action registry, write-guard install, etc.) read this instead.
+const dashboardJsSource = fs.readFileSync(path.join(here, 'dashboard', 'dashboard.js'), 'utf8');
+// Panel components load as their own classic <script> BEFORE dashboard.js
+// (panel-componentization work) — the harness must replay that same order so
+// panel functions are real window globals by the time dashboard.js's own boot
+// code (e.g. pollTunnel()) calls into them, exactly like the served page.
+// panel-element.js defines the ClauthPanelElement base class every real
+// component panel (clauth-tunnel-panel, etc.) extends -- it must load and
+// evaluate before any panel script that does `extends window.ClauthPanelElement`.
+const panelElementJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panel-element.js'), 'utf8');
+const panelRegistryJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'panel-registry.js'), 'utf8');
+const tunnelPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'tunnel-panel.js'), 'utf8');
+const toolbarPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'toolbar-panel.js'), 'utf8');
+const webdavPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'webdav-panel.js'), 'utf8');
+const servicesPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'services-panel.js'), 'utf8');
+const buildStatusPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'build-status-panel.js'), 'utf8');
+const surfacesPanelJsSource = fs.readFileSync(path.join(here, 'dashboard', 'panels', 'surfaces-panel.js'), 'utf8');
+// Write-action static analysis (registeredWriteActions/writeHeaderCallers)
+// must see every panel component's function bodies, not just dashboard.js's
+// own — a registered action's implementation can now live in a panel file
+// (e.g. wizSubmitCfToken moved to tunnel-panel.js). The choke-point mechanism
+// itself (WRITE_ACTIONS array, installWriteAccessGuards, pendingWriteAction,
+// the acquire site) stays in dashboard.js and is checked there directly.
+const allClientSource = dashboardJsSource + '\n' + panelElementJsSource + '\n' + panelRegistryJsSource + '\n' + tunnelPanelJsSource + '\n' + toolbarPanelJsSource + '\n' + webdavPanelJsSource + '\n' + servicesPanelJsSource + '\n' + buildStatusPanelJsSource + '\n' + surfacesPanelJsSource;
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Functional harness
 //
-// The dashboard JS ships inside a served HTML template, so there is nothing to
-// import. This harness renders the real page with dashboardHtml(), lifts its
-// script into a vm realm with a stub DOM + stub fetch, and then calls the real
-// controller seams (runSupervisorSurface, addService, submitWriteUnlock, …)
-// with simulated inputs — per the global UI functional-harness rule. No pixels,
-// no browser automation: assertions are on state, command and payload.
+// The dashboard JS ships as a static asset served by GET /dashboard.js, with a
+// tiny per-request inline preamble (dashboardHtml()) setting
+// window.__CLAUTH_VERSION__ / window.__CLAUTH_INIT_WRITE_TOKEN__ — the only
+// two values that vary per request. This harness reconstructs exactly that
+// concatenation (preamble + static script) in a vm realm with a stub DOM +
+// stub fetch, then calls the real controller seams (runSupervisorSurface,
+// addService, submitWriteUnlock, …) with simulated inputs — per the global UI
+// functional-harness rule. No pixels, no browser automation: assertions are
+// on state, command and payload.
 //
 // The requirement these tests encode: a dashboard button IS the human being
 // present. On an unlocked vault a click must proceed with no password prompt.
@@ -52,25 +85,65 @@ function makeElement(id) {
     focus() {},
     click() {},
     querySelectorAll: () => [],
+    // Real dashboard code reaches for these; a stub that lacks them fails as
+    // "x is not a function" from inside the code under test, which reads like a
+    // product bug and is not one.
+    querySelector: () => makeElement(id + '-child'),
+    remove() {},
   };
 }
 
 function bootDashboard({ initWriteToken = null, route } = {}) {
+  // Faithful to production: real page load is the tiny inline preamble
+  // (dashboardHtml()) running first, then the static dashboard.js. Assert the
+  // real page still emits that preamble rather than assuming its shape.
   const html = dashboardHtml(53999, [], false, initWriteToken);
-  const start = html.indexOf('<script>');
-  const end = html.lastIndexOf('</script>');
-  assert.ok(start !== -1 && end > start, 'dashboard HTML must contain exactly one script block');
-  const script = html.slice(start + '<script>'.length, end);
+  assert.match(
+    html,
+    /<script src="\/dashboard\/panel-element\.js"><\/script>\s*<script src="\/dashboard\/panels\/panel-registry\.js"><\/script>\s*<script src="\/dashboard\/panels\/tunnel-panel\.js"><\/script>\s*<script src="\/dashboard\/panels\/toolbar-panel\.js"><\/script>\s*<script src="\/dashboard\/panels\/webdav-panel\.js"><\/script>\s*<script src="\/dashboard\/panels\/services-panel\.js"><\/script>\s*<script src="\/dashboard\/panels\/build-status-panel\.js"><\/script>\s*<script src="\/dashboard\/panels\/surfaces-panel\.js"><\/script>\s*<script src="\/dashboard\.js"><\/script>/,
+    'dashboard HTML must load panel components before the main client script',
+  );
+  const preambleStart = html.indexOf('<script>');
+  const preambleEnd = html.indexOf('</script>');
+  assert.ok(preambleStart !== -1 && preambleEnd > preambleStart, 'dashboard HTML must contain its inline init preamble');
+  const preamble = html.slice(preambleStart + '<script>'.length, preambleEnd);
+  const script = preamble + '\n' + panelElementJsSource + '\n' + panelRegistryJsSource + '\n' + tunnelPanelJsSource + '\n' + toolbarPanelJsSource + '\n' + webdavPanelJsSource + '\n' + servicesPanelJsSource + '\n' + buildStatusPanelJsSource + '\n' + surfacesPanelJsSource + '\n' + dashboardJsSource;
 
   const elements = new Map();
   const fetchCalls = [];
   const confirmCalls = [];
+  // Real component panels register their class under customElements.define(),
+  // then a bridge like `window.runSupervisorSurface = () => document
+  // .querySelector("clauth-surfaces-panel")?.runSupervisorSurface(...)` is
+  // what every registered write action now dispatches through (Shadow DOM
+  // means installWriteAccessGuards can only wrap a real global function, not
+  // an instance method — see each panel file's own header comment for the
+  // bridge pattern). document.querySelector must therefore hand back a live
+  // instance of the matching class, not null, or every bridge silently no-ops
+  // and these tests would pass by testing nothing.
+  //
+  // Lazily instantiated + connectedCallback()'d (structural: builds the fake
+  // shadow root so this.$()/this.$$() resolve), one singleton per tag name —
+  // matching production, where exactly one of each panel tag exists in the
+  // page. mount() is deliberately NOT called: none of the write-action methods
+  // under test here depend on mount()-installed instance state, and skipping
+  // it avoids every panel's real polling/initial-fetch side effects leaking
+  // into these tests' fetchCalls tracking.
+  const customElementClasses = new Map();
+  const customElementInstances = new Map();
 
   const sandbox = {
     console: { log() {}, warn() {}, error() {} },
     JSON,
     Date,
     Math,
+    // A browser realm has these. Omitting URL made every new URL(...) throw
+    // ReferenceError inside the dashboard's own try/catch, so url-handling code
+    // silently took its fallback path and the test asserted the fallback.
+    URL,
+    URLSearchParams,
+    encodeURIComponent,
+    decodeURIComponent,
     setTimeout: () => 0,
     clearTimeout: () => {},
     setInterval: () => 0,
@@ -79,12 +152,42 @@ function bootDashboard({ initWriteToken = null, route } = {}) {
     navigator: { clipboard: { writeText: async () => {} } },
     confirm: (msg) => { confirmCalls.push(msg); return true; },
     alert: () => {},
+    // Real component panels (clauth-tunnel-panel, etc.) extend HTMLElement
+    // and call customElements.define() at module scope -- both must exist
+    // for those class declarations to evaluate without throwing. attachShadow()
+    // returns a generic DOM-node stub AND assigns it to this.shadowRoot --
+    // real browsers do that assignment as a side effect of attachShadow(),
+    // and panel-element.js's connectedCallback()/$()/$$() rely on it existing.
+    HTMLElement: class {
+      attachShadow() {
+        const root = makeElement('shadow-root');
+        this.shadowRoot = root;
+        return root;
+      }
+    },
+    customElements: {
+      define(tag, cls) { customElementClasses.set(tag, cls); },
+    },
     document: {
       getElementById(id) {
         if (!elements.has(id)) elements.set(id, makeElement(id));
         return elements.get(id);
       },
       createElement: (tag) => makeElement(tag),
+      // See customElementClasses/customElementInstances above -- a matching
+      // tag name lazily instantiates and structurally builds the real class,
+      // so a write-action bridge reaches real instance logic instead of a
+      // silent `el?.method()` no-op on null.
+      querySelector(selector) {
+        const cls = customElementClasses.get(selector);
+        if (!cls) return null;
+        if (!customElementInstances.has(selector)) {
+          const instance = new cls();
+          instance.connectedCallback();
+          customElementInstances.set(selector, instance);
+        }
+        return customElementInstances.get(selector);
+      },
       querySelectorAll: () => [],
       addEventListener() {},
       body: makeElement('body'),
@@ -299,7 +402,12 @@ test('locked vault: cancelling clears the parked action, and no write fires late
   assert.equal(h.ctx.hasPendingWriteAction(), false, 'cancel must disarm the parked write');
   assert.deepEqual(h.writeCalls(), []);
 
-  h.ctx.unlockWrites();
+  // unlockWrites() is dispatched via the toolbar panel's own data-action
+  // (see toolbar-panel.js) with no bare global bridge -- it's not a write
+  // action itself (never calls writeHeaders()), so installWriteAccessGuards
+  // never needed one. Reach the real instance directly, same as production's
+  // data-action click would.
+  h.ctx.document.querySelector('clauth-toolbar-panel').unlockWrites();
   h.el('write-unlock-input').value = 'correct-horse';
   await h.ctx.submitWriteUnlock();
   await h.settle();
@@ -323,11 +431,11 @@ const EXPECTED_WRITE_ACTIONS = [
   'deleteService',
   'enrollMachine',
   'rescanSupervisorPlugins',
+  'restartDaemon',
   'rotateKey',
   'runSupervisorSurface',
+  'saveCardEdit',
   'saveKey',
-  'saveLabel',
-  'saveProject',
   'setExpiry',
   'submitMount',
   'toggleService',
@@ -353,7 +461,16 @@ function registeredWriteActions(source) {
  * Comment lines are skipped: prose mentioning writeHeaders() is not a call
  * site, and counting it as one produced a false "bypasses the choke point"
  * failure the first time a doc comment landed after a function declaration.
+ *
+ * Also recognises ES6 class-method shorthand (`methodName() {` /
+ * `async methodName() {`) -- the real-component panel rewrite (clauth-tunnel-
+ * panel and its Web Component siblings) moved several registered write
+ * actions (e.g. wizSubmitCfToken) from top-level function declarations into
+ * class methods on a real component. Common control-flow keywords
+ * (if/for/while/switch/catch/function/return) are excluded so `if (x) {`
+ * doesn't get misread as a method named "if".
  */
+const JS_CONTROL_KEYWORDS = new Set(['if', 'for', 'while', 'switch', 'catch', 'function', 'return', 'else']);
 function writeHeaderCallers(source) {
   const callers = new Set();
   let current = null;
@@ -362,8 +479,10 @@ function writeHeaderCallers(source) {
     const bound = line.match(
       /^(?:const|let|var)\s+([A-Za-z0-9_$]+)\s*=\s*(?:async\s*)?(?:function\b|\(|[A-Za-z0-9_$]+\s*=>)/,
     );
+    const method = line.match(/^\s+(?:async\s+)?(?:\*\s*)?(?:get\s+|set\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*\([^)]*\)\s*\{?\s*$/);
     if (decl) current = decl[1];
     else if (bound) current = bound[1];
+    else if (method && !JS_CONTROL_KEYWORDS.has(method[1])) current = method[1];
 
     const code = line.trim();
     if (code.startsWith('//') || code.startsWith('*') || code.startsWith('/*')) continue;
@@ -375,7 +494,7 @@ function writeHeaderCallers(source) {
 }
 
 test('WRITE_ACTIONS matches the reviewed write-action surface exactly', () => {
-  const registered = [...registeredWriteActions(serveSource)].sort();
+  const registered = [...registeredWriteActions(dashboardJsSource)].sort();
   assert.deepEqual(
     registered,
     EXPECTED_WRITE_ACTIONS,
@@ -384,8 +503,8 @@ test('WRITE_ACTIONS matches the reviewed write-action surface exactly', () => {
 });
 
 test('WRITE_ACTIONS covers every function that calls writeHeaders()', () => {
-  const registered = registeredWriteActions(serveSource);
-  const callers = writeHeaderCallers(serveSource);
+  const registered = registeredWriteActions(dashboardJsSource);
+  const callers = writeHeaderCallers(allClientSource);
 
   const unguarded = [...callers].filter((n) => !registered.has(n));
   assert.deepEqual(unguarded, [], 'these write actions bypass the choke point: ' + unguarded.join(', '));
@@ -398,7 +517,7 @@ test('WRITE_ACTIONS covers every function that calls writeHeaders()', () => {
 
 test('every registered write action is actually wrapped at install time', () => {
   const h = bootDashboard({ initWriteToken: 'wt-preexisting', route: unlockedRoute });
-  const registered = [...registeredWriteActions(serveSource)];
+  const registered = [...registeredWriteActions(dashboardJsSource)];
 
   const notWrapped = registered.filter((name) => h.ctx[name]?.__writeGuarded !== true);
   assert.deepEqual(
@@ -410,33 +529,41 @@ test('every registered write action is actually wrapped at install time', () =>
 });
 
 test('installWriteAccessGuards throws on a registered name that cannot be guarded', () => {
-  assert.match(serveSource, /clauth write-guard install failed/);
+  assert.match(dashboardJsSource, /clauth write-guard install failed/);
   assert.doesNotMatch(
-    serveSource,
+    dashboardJsSource,
     /if \(typeof fn !== "function" \|\| fn\.__writeGuarded\) continue;/,
     'the old silent-skip guard must not come back',
   );
 });
 
 test('the write-access choke point is a single mechanism, not per-call-site guards', () => {
-  const parkSites = [...serveSource.matchAll(/pendingWriteAction = \{/g)];
+  const parkSites = [...dashboardJsSource.matchAll(/pendingWriteAction = \{/g)];
   assert.equal(parkSites.length, 1, 'exactly one place may park a write action');
-  const acquireSites = [...serveSource.matchAll(/BASE \+ "\/write-token"/g)];
+  const acquireSites = [...dashboardJsSource.matchAll(/BASE \+ "\/write-token"/g)];
   assert.equal(acquireSites.length, 1, 'exactly one place may acquire write access');
-  assert.match(serveSource, /function installWriteAccessGuards\(/);
+  assert.match(dashboardJsSource, /function installWriteAccessGuards\(/);
 });
 
 // ── 4. Server contract: the gate stays, the prompt goes ──────────────────────
 
 test('POST /write-token refuses a locked vault and never weakens the write gate', () => {
-  assert.match(serveSource, /reqPath === "\/write-token"/, 'the acquire route must exist');
+  // /write-token/, /auth, /lock, /change-pw moved into their own file (the
+  // Vault/Auth component, registered via registerWriteRoute — a Map lookup,
+  // not an inline "reqPath ===" check, hence the different regex shape here).
+  assert.match(
+    vaultAuthComponentSource,
+    /registerWriteRoute\("POST", "\/write-token"/,
+    'the acquire route must exist',
+  );
   assert.match(
-    serveSource,
-    /reqPath === "\/write-token"\)\s*\{\s*\n\s*if \(!password\) \{/,
+    vaultAuthComponentSource,
+    /registerWriteRoute\("POST", "\/write-token", async \(req, res\) => \{\s*\n\s*if \(!ctx\.password\) \{/,
     'a locked vault must be refused before any token is minted',
   );
   // writeGuard is what makes a page-driven write distinguishable from a blind
-  // remote POST arriving through the cloudflared tunnel as loopback. It stays.
+  // remote POST arriving through the cloudflared tunnel as loopback. It stays
+  // defined in serve.js (passed to components via ctx as a function reference).
   assert.match(serveSource, /function writeGuard\(req, res\) \{[\s\S]*?validateWriteToken\(req, writeSession\)/);
   assert.match(serveSource, /if \(!isLocal\) \{[\s\S]*?strike\(res, 403/, 'non-loopback must stay hard-rejected');
 });
@@ -445,8 +572,81 @@ test('POST /write-token refuses a locked vault and never weakens the write gate'
 
 test('clauth supervisor UI exposes every lifecycle action and receipt feedback', () => {
   for (const action of ['start', 'stop', 'restart', 'reconcile', 'test', 'promote', 'rollback']) {
-    assert.match(serveSource, new RegExp('"' + action + '"'));
+    assert.match(surfacesPanelJsSource, new RegExp('"' + action + '"'));
   }
-  assert.match(serveSource, /supervisorFeedback\(/);
-  assert.match(serveSource, /supervisor-feedback/);
+  assert.match(surfacesPanelJsSource, /supervisorFeedback\(/);
+  assert.match(surfacesPanelJsSource, /supervisor-feedback/);
+});
+
+// ── 5. Health status, focus refresh, and browsable Open targets ──────────────
+
+test('browsableUrl strips MCP transport paths and leaves real paths alone', () => {
+  const { ctx } = bootDashboard();
+  // The defect: clauth's own Open button opened https://clauth.../mcp and the
+  // browser rendered the raw SSE handshake — "event: endpoint / data: ...".
+  assert.equal(ctx.browsableUrl('https://clauth.regendevcorp.com/mcp'), 'https://clauth.regendevcorp.com/');
+  assert.equal(ctx.browsableUrl('https://media.regendevcorp.com/sse'), 'https://media.regendevcorp.com/');
+  assert.equal(ctx.browsableUrl('https://x.example.com/message?sessionId=ses_1'), 'https://x.example.com/');
+  // A genuine application path is NOT a transport path and must survive.
+  assert.equal(ctx.browsableUrl('https://fs.regendevcorp.com/fs'), 'https://fs.regendevcorp.com/fs');
+  assert.equal(ctx.browsableUrl('http://127.0.0.1:3003/'), 'http://127.0.0.1:3003/');
+  // Never throws on junk — the Open button must not take the panel down.
+  assert.equal(ctx.browsableUrl('not a url'), 'not a url');
+  assert.equal(ctx.browsableUrl(null), null);
+});
+
+test('a surface card renders a health pill distinct from its manifest state', () => {
+  const { ctx } = bootDashboard();
+  // renderSupervisorSurface/refreshSurfaceHealth are instance methods on
+  // ClauthSurfacesPanel now (Shadow DOM conversion) with no bare global
+  // bridge -- neither calls writeHeaders(), so installWriteAccessGuards
+  // never needed one. Reach the real instance directly.
+  const surfacesPanel = ctx.document.querySelector('clauth-surfaces-panel');
+  const base = { plugin_id: 'demo', id: 'primary', name: 'demo', destination: 'local/clauth/pm2', lifecycle_owner: 'clauth', port: 3110, health: '/health', state: 'current' };
+
+  const up = surfacesPanel.renderSupervisorSurface({ ...base, last_health_ok: true, last_health_at: new Date().toISOString() });
+  assert.match(up, /up ·/, 'a healthy surface must show an up pill');
+
+  // The point of the whole feature: state stays "current" (a manifest fact)
+  // while health says DOWN (a runtime fact). If the card only showed state,
+  // a surface that is not listening at all still reads "current".
+  const down = surfacesPanel.renderSupervisorSurface({ ...base, last_health_ok: false, last_health_at: new Date().toISOString(), last_health_error: 'ECONNREFUSED' });
+  assert.match(down, /DOWN ·/, 'an unreachable surface must show a DOWN pill');
+  assert.match(down, /current/, 'manifest state must still be shown alongside health');
+  assert.match(down, /ECONNREFUSED/, 'the failure reason belongs on the card');
+
+  const never = surfacesPanel.renderSupervisorSurface(base);
+  assert.match(never, /health unknown/, 'an unprobed surface must not claim to be up');
+});
+
+test('the health sweep carries NO write token — looking at the tab must never prompt to unlock', async () => {
+  const { ctx, fetchCalls, writeCalls, settle } = bootDashboard({
+    route: (url) => {
+      if (url.endsWith('/v1/surfaces/health')) {
+        return { probed: [{ surface_id: 'demo:primary', health: 'healthy', url: 'http://127.0.0.1:3110/health' }] };
+      }
+      if (url.endsWith('/write-token')) return { ok: true, write_token: 'wt-fresh' };
+      return {};
+    },
+  });
+  await ctx.document.querySelector('clauth-surfaces-panel').refreshSurfaceHealth({ quiet: false });
+  await settle();
+  const sweep = fetchCalls.filter((c) => c.url.endsWith('/v1/surfaces/health'));
+  assert.equal(sweep.length, 1, 'the sweep must have run — otherwise the assertions below prove nothing');
+  assert.equal(sweep[0].options.method, 'POST');
+  assert.equal(
+    writeCalls().filter((c) => c.url.endsWith('/v1/surfaces/health')).length, 0,
+    'the read-only health sweep must not send a write token, or a focus event would prompt for the vault password',
+  );
+});
+
+test('stripControlBytes removes ANSI colour and stray control bytes, keeping the text', () => {
+  const ESC = String.fromCharCode(27);
+  const coloured = ESC + '[32m✔ ready' + ESC + '[39m' + String.fromCharCode(1) + ' done';
+  assert.equal(stripControlBytes(coloured), '✔ ready done');
+  // Structure survives: tab, LF and CR are the log's own formatting.
+  assert.equal(stripControlBytes('a\tb\nc\r\nd'), 'a\tb\nc\r\nd');
+  // Positive control: a string with nothing to strip comes back byte-identical,
+  // so "it was cleaned" is distinguishable from "the function ate everything".
+  assert.equal(stripControlBytes('plain ASCII line 42'), 'plain ASCII line 42');
 });

package/cli/webdav-config.js

@@ -0,0 +1,84 @@
+// cli/webdav-config.js
+// WebDAV mount config persistence (CRUD over a JSON file). Split out of
+// webdav-service.js -- the SOLID scorer flagged that file's original shape
+// (74.8 total) as mixing this config-CRUD concern with the rclone child
+// supervisor, the rclone-obscure crypto helper, and rclone binary discovery.
+
+import { writeFileSync, readFileSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { join, dirname } from "path";
+
+export const WEBDAV_PORT = 8620;
+export const CRED_NAME = "webdav-claude";
+
+const APPDATA = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+// A FUNCTION, not a top-level const: this module is imported once and its
+// top-level bindings evaluate at that moment, so a const here would freeze
+// whatever CLAUTH_WEBDAV_CONFIG_PATH was (or wasn't) set to at import time —
+// a test setting the env var per-case afterward would have no effect at all.
+// Same override pattern as recovery.js's CLAUTH_RECOVERY_DIR and
+// supervisor-registry.js's CLAUTH_SUPERVISOR_DIR; without it,
+// loadConfig/saveConfig/addMount/removeMount/updateMount all read and write
+// Dave's real AppData mount config during a test run.
+export function getConfigPath() {
+  return process.env.CLAUTH_WEBDAV_CONFIG_PATH || join(APPDATA, "clauth", "webdav-config.json");
+}
+
+const DEFAULT_CONFIG = {
+  enabled: true,
+  port: WEBDAV_PORT,
+  credential: CRED_NAME,
+  upstreams: [],
+};
+
+export function loadConfig() {
+  try {
+    const raw = readFileSync(getConfigPath(), "utf8");
+    const cfg = JSON.parse(raw);
+    if (!Array.isArray(cfg.upstreams)) cfg.upstreams = [];
+    return { ...DEFAULT_CONFIG, ...cfg };
+  } catch {
+    // `{ ...DEFAULT_CONFIG }` alone is a shallow copy — `upstreams` would be
+    // the SAME array object as DEFAULT_CONFIG.upstreams, not a fresh one.
+    // addMount() does `cfg.upstreams.push(...)` on whatever loadConfig hands
+    // back; on this fallback path (no config file yet, or a corrupted one)
+    // that push would mutate the shared module-level DEFAULT_CONFIG.upstreams
+    // itself, permanently, for the rest of the process. Every later call
+    // reaching this SAME catch branch — a fresh install with no file yet, or
+    // any future read of a corrupted file — would then return whatever got
+    // pushed here before, not a true empty default.
+    return { ...DEFAULT_CONFIG, upstreams: [] };
+  }
+}
+
+export function saveConfig(cfg) {
+  const configPath = getConfigPath();
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, JSON.stringify(cfg, null, 2), "utf8");
+}
+
+export function addMount(name, mountPath) {
+  const cfg = loadConfig();
+  if (cfg.upstreams.some(u => u.name === name)) return { error: `Mount '${name}' already exists` };
+  cfg.upstreams.push({ name, path: mountPath });
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function removeMount(name) {
+  const cfg = loadConfig();
+  const before = cfg.upstreams.length;
+  cfg.upstreams = cfg.upstreams.filter(u => u.name !== name);
+  if (cfg.upstreams.length === before) return { error: `Mount '${name}' not found` };
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function updateMount(name, updates) {
+  const cfg = loadConfig();
+  const mount = cfg.upstreams.find(u => u.name === name);
+  if (!mount) return { error: `Mount '${name}' not found` };
+  if (updates.credential !== undefined) cfg.credential = updates.credential;
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}

package/cli/webdav-config.test.js

@@ -0,0 +1,79 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { loadConfig, addMount, removeMount, updateMount } from "./webdav-config.js";
+
+function withIsolatedConfig(fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-webdav-config-test-"));
+  const configPath = path.join(dir, "webdav-config.json");
+  const old = process.env.CLAUTH_WEBDAV_CONFIG_PATH;
+  process.env.CLAUTH_WEBDAV_CONFIG_PATH = configPath;
+  try { return fn(configPath); } finally {
+    if (old === undefined) Reflect.deleteProperty(process.env, "CLAUTH_WEBDAV_CONFIG_PATH");
+    else process.env.CLAUTH_WEBDAV_CONFIG_PATH = old;
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test("loadConfig returns sane defaults when no config file exists yet", () =>
+  withIsolatedConfig(() => {
+    const cfg = loadConfig();
+    assert.equal(cfg.enabled, true);
+    assert.deepEqual(cfg.upstreams, []);
+    assert.equal(cfg.credential, "webdav-claude");
+  }));
+
+test("addMount persists a new upstream and rejects a duplicate name", () =>
+  withIsolatedConfig((configPath) => {
+    const first = addMount("projects", "C:\\Dev\\regen-root");
+    assert.equal(first.ok, true);
+    assert.deepEqual(first.upstreams, [{ name: "projects", path: "C:\\Dev\\regen-root" }]);
+    assert.ok(fs.existsSync(configPath), "saveConfig must actually write the file");
+
+    const dup = addMount("projects", "C:\\Dev\\somewhere-else");
+    assert.match(dup.error, /already exists/);
+    // The duplicate attempt must not have overwritten the original entry.
+    assert.equal(loadConfig().upstreams.length, 1);
+  }));
+
+test("removeMount deletes the named upstream and reports not-found for an unknown one", () =>
+  withIsolatedConfig(() => {
+    addMount("projects", "C:\\Dev\\regen-root");
+    addMount("corpus", "C:\\rdc-gdrive\\global-corpus");
+    const removed = removeMount("projects");
+    assert.equal(removed.ok, true);
+    assert.deepEqual(removed.upstreams.map((u) => u.name), ["corpus"]);
+
+    const missing = removeMount("projects");
+    assert.match(missing.error, /not found/);
+  }));
+
+test("updateMount changes the credential and reports not-found for an unknown mount", () =>
+  withIsolatedConfig(() => {
+    addMount("projects", "C:\\Dev\\regen-root");
+    const updated = updateMount("projects", { credential: "webdav-alt-cred" });
+    assert.equal(updated.ok, true);
+    assert.equal(loadConfig().credential, "webdav-alt-cred");
+
+    const missing = updateMount("does-not-exist", { credential: "x" });
+    assert.match(missing.error, /not found/);
+  }));
+
+test("loadConfig tolerates a corrupt config file by falling back to defaults", () =>
+  withIsolatedConfig((configPath) => {
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, "{ not valid json", "utf8");
+    const cfg = loadConfig();
+    assert.deepEqual(cfg.upstreams, []);
+    assert.equal(cfg.enabled, true);
+  }));
+
+test("loadConfig coerces a non-array upstreams field instead of propagating a broken shape", () =>
+  withIsolatedConfig((configPath) => {
+    fs.mkdirSync(path.dirname(configPath), { recursive: true });
+    fs.writeFileSync(configPath, JSON.stringify({ upstreams: "not-an-array" }), "utf8");
+    assert.deepEqual(loadConfig().upstreams, []);
+  }));

package/cli/webdav-obscure.js

@@ -0,0 +1,23 @@
+// cli/webdav-obscure.js
+// rclone-compatible AES-CTR "obscure" -- same algorithm as `rclone obscure`.
+// Used by fs_dav_setup to embed a non-plaintext credential in the mount
+// script. The result can be passed as RCLONE_CONFIG_xxx_PASS. Split out of
+// webdav-service.js -- the SOLID scorer flagged that file's original shape
+// as mixing this crypto helper with the rclone child supervisor, config
+// persistence, and rclone binary discovery.
+
+import crypto from "node:crypto";
+
+export function rcloneObscure(password) {
+  // Key from rclone source: lib/obscure/obscure.go  cryptKey
+  const key = Buffer.from([
+    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
+    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
+    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
+    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
+  ]);
+  const iv     = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv("aes-256-ctr", key, iv);
+  const ct     = Buffer.concat([cipher.update(Buffer.from(password, "utf8")), cipher.final()]);
+  return Buffer.concat([iv, ct]).toString("base64url");
+}

package/cli/webdav-obscure.test.js

@@ -0,0 +1,41 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+
+import { rcloneObscure } from "./webdav-obscure.js";
+
+// rclone's own decrypt (same key, AES-256-CTR, IV prefixed to ciphertext) —
+// reimplemented here purely to round-trip verify. Asserting only "looks like
+// base64url" would pass even if the cipher, key, or IV placement were wrong;
+// this proves the actual bytes rclone would receive decrypt back to the input.
+function rcloneUnobscure(obscured) {
+  const key = Buffer.from([
+    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
+    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
+    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
+    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
+  ]);
+  const raw = Buffer.from(obscured, "base64url");
+  const iv = raw.subarray(0, 16);
+  const ct = raw.subarray(16);
+  const decipher = crypto.createDecipheriv("aes-256-ctr", key, iv);
+  return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
+}
+
+test("rcloneObscure round-trips through rclone's own obscure algorithm", () => {
+  const obscured = rcloneObscure("hunter2-password");
+  assert.equal(rcloneUnobscure(obscured), "hunter2-password");
+});
+
+test("rcloneObscure never emits the plaintext password as a substring", () => {
+  const obscured = rcloneObscure("very-recognizable-secret-xyz");
+  assert.ok(!obscured.includes("very-recognizable-secret-xyz"));
+});
+
+test("rcloneObscure uses a fresh random IV each call — the same password never obscures identically twice", () => {
+  const a = rcloneObscure("same-password");
+  const b = rcloneObscure("same-password");
+  assert.notEqual(a, b, "identical output for identical input means the IV is not actually random");
+  assert.equal(rcloneUnobscure(a), "same-password");
+  assert.equal(rcloneUnobscure(b), "same-password");
+});