@lifeaitools/clauth 2.15.4 → 2.15.5

package/cli/supervisor-registry.js

@@ -1212,8 +1212,16 @@ export function runSurfaceAction(id, action, actor = "localhost") {
     // a space (e.g. "C:\Program Files\nodejs\node.exe") breaks at the first
     // space unless quoted. Bare shim names (pm2, npm) never contain spaces,
     // so this only ever affects absolute-path values, and only on Windows.
-    const resolvedCmd = shellQuote(cmd, useShell);
-    const resolvedArgs = args.map((arg) => shellQuote(arg, useShell));
+    // Expand $LIFEAI_ENV / $REGEN_ROOT tokens in the command AND its args, the same
+    // way surface.cwd is expanded at normalize time. A surface start such as
+    // `pwsh -File $LIFEAI_ENV/services/restart-dev-center.ps1` (dev-center) or
+    // `pm2 start $REGEN_ROOT/apps/codeflow-explorer/... ` otherwise reached the shell
+    // with the literal token and failed ("not recognized as the name of a script
+    // file", exit 64) — a start/restart that fails while the service stays down.
+    // expandPathToken is a no-op on token-free values (pm2, --name, --cwd), so it is
+    // safe on every arg.
+    const resolvedCmd = shellQuote(expandPathToken(cmd) || cmd, useShell);
+    const resolvedArgs = args.map((arg) => shellQuote(expandPathToken(arg) || arg, useShell));
     return spawnSync(resolvedCmd, resolvedArgs, {
       cwd: surface.cwd || undefined,
       env: { ...process.env, CLAUTH_PM2_HOME: getClauthPm2Home(), PM2_HOME: getClauthPm2Home() },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "2.15.4",
+  "version": "2.15.5",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {