@lifeaitools/clauth 2.15.7 → 2.15.8

package/cli/dashboard/panels/surfaces-panel.js

@@ -354,15 +354,26 @@ class ClauthSurfacesPanel extends window.ClauthPanelElement {
     const needsHelpLine = needsHelp
       ? "Stopped auto-restarting after " + (surface.consecutive_reconcile_failures || "several") + " failed attempts — check the log, fix the cause, then Start/Restart to resume auto-repair."
       : null;
+    // Command-set drift (2026-09-06): the surface's OWN code (read live via
+    // its health response) disagrees with what its manifest declares --
+    // exactly the "note says X, code doesn't enforce X" defect class. Only
+    // rendered when TRUE -- a surface that hasn't been retrofitted with the
+    // live commands field yet (the common case today) reports no drift, not
+    // a false one.
+    const driftLine = surface.command_drift
+      ? "Command-set drift: manifest declares " + (surface.declared_commands || []).join(", ") + "; surface's own code reports " + (surface.last_health_commands || []).join(", ") + "."
+      : null;
     return '<div class="' + rowClass + (needsHelp ? " needs-help" : "") + '" data-surface-id="' + htmlEscape(compositeId) + '"' + rowAction + '>' +
       '<div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.name || compositeId) + '</span>' +
       healthPill +
       supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(stateLabel, stateKind) +
+      (surface.command_drift ? supervisorBadge("COMMAND DRIFT", "warn") : "") +
       openBtn +
       '</div>' +
       '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
       '<div class="supervisor-meta">' + htmlEscape(healthLine) + '</div>' +
       (needsHelpLine ? '<div class="supervisor-meta critical">' + htmlEscape(needsHelpLine) + '</div>' : '') +
+      (driftLine ? '<div class="supervisor-meta critical">' + htmlEscape(driftLine) + '</div>' : '') +
       '</div>';
   }
 

package/cli/supervisor-registry.js

@@ -163,20 +163,56 @@ function appendSupervisorEvent(event) {
   appendJsonl(file("events.jsonl"), { ts: now(), ...event });
 }
 
+// The command set a surface's OWN manifest actually declares — derived from
+// which of the real action fields carry a non-empty command array. "reconcile"
+// and "test" are structural (reconcile is start-or-restart chosen by clauth;
+// test is the candidate-testing path), not something a manifest declares, so
+// they are excluded here on purpose.
+const DECLARABLE_ACTIONS = ["start", "stop", "restart", "promote", "rollback"];
+function declaredCommands(surface) {
+  return DECLARABLE_ACTIONS.filter((action) => Array.isArray(surface?.[action]) && surface[action].length > 0);
+}
+
+function sameCommandSet(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return false;
+  if (a.length !== b.length) return false;
+  const setA = new Set(a);
+  return b.every((item) => setA.has(item));
+}
+
 async function probeSurfaceHealth(url, fetchImpl, timeoutMs) {
   try {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
       const response = await fetchImpl(url, { signal: controller.signal });
-      return response?.ok
-        ? { healthy: true, error: null }
-        : { healthy: false, error: `HTTP ${response?.status ?? "unknown"}` };
+      if (!response?.ok) return { healthy: false, error: `HTTP ${response?.status ?? "unknown"}`, liveCommands: null };
+      // Command-set contract (2026-09-06): a surface MAY include a
+      // `commands` array in its health response — the set of actions ITS
+      // OWN code actually supports, read live rather than trusted from the
+      // manifest's static declaration ("from code not text so we know there
+      // is no drift" — Dave, 2026-09-06). Piggybacked on the health probe
+      // clauth already runs every reconcile tick, so retrofitting a surface
+      // costs it nothing extra: no new endpoint, no new round trip. A
+      // surface that doesn't (yet) include this field is unaffected —
+      // liveCommands stays null and callers fall back to the manifest's
+      // declared set, exactly as before this contract existed.
+      let liveCommands = null;
+      try {
+        // No .clone() needed — this is the only read of this response, real
+        // or mocked. Test fixtures across this suite mock fetchImpl with
+        // plain { ok, status } objects with no .json() at all; the try/catch
+        // already treats that identically to "not JSON" — both normal, not
+        // an error — so existing tests are unaffected without special-casing.
+        const body = typeof response.json === "function" ? await response.json() : null;
+        if (Array.isArray(body?.commands)) liveCommands = body.commands.filter((c) => typeof c === "string");
+      } catch { /* not JSON, or no commands field — both normal, not an error */ }
+      return { healthy: true, error: null, liveCommands };
     } finally {
       clearTimeout(timer);
     }
   } catch (err) {
-    return { healthy: false, error: err?.name === "AbortError" ? "health timeout" : String(err?.message || err) };
+    return { healthy: false, error: err?.name === "AbortError" ? "health timeout" : String(err?.message || err), liveCommands: null };
   }
 }
 
@@ -198,8 +234,21 @@ export async function reconcileSurfaceHealth({ fetchImpl = globalThis.fetch, tim
     const error = health.error;
 
     if (healthy) {
-      updateSurfaceState(id, { state: "current", last_health_at: observedAt, last_health_ok: true, last_health_error: null, consecutive_reconcile_failures: 0 });
-      inspected.push({ surface_id: id, state: "healthy", observed_at: observedAt });
+      const declared = declaredCommands(surface);
+      const commandDrift = Array.isArray(health.liveCommands) && !sameCommandSet(health.liveCommands, declared);
+      updateSurfaceState(id, {
+        state: "current",
+        last_health_at: observedAt,
+        last_health_ok: true,
+        last_health_error: null,
+        consecutive_reconcile_failures: 0,
+        last_health_commands: health.liveCommands,
+        command_drift: commandDrift,
+      });
+      if (commandDrift) {
+        appendSupervisorEvent({ kind: "surface_command_drift", surface_id: id, declared, live: health.liveCommands });
+      }
+      inspected.push({ surface_id: id, state: "healthy", observed_at: observedAt, command_drift: commandDrift });
       continue;
     }
 
@@ -365,6 +414,15 @@ export async function probeAllSurfaceHealth({ fetchImpl = globalThis.fetch, time
       url ? probeSurfaceHealth(url, fetchImpl, timeoutMs) : null,
       openUrl ? probeSurfaceHealth(openUrl, fetchImpl, timeoutMs) : null,
     ]);
+    // Command-set drift (2026-09-06): computed here too, not just in
+    // reconcileSurfaceHealth, because THIS sweep is the only one that ever
+    // probes external/remote surfaces — reconcile only looks at enabled
+    // clauth-owned local pm2 surfaces. null when the surface hasn't declared
+    // liveCommands (not retrofitted yet, or down) — that is a normal,
+    // unretrofitted surface, not a drift finding.
+    const declared = declaredCommands(surface);
+    const liveCommands = health?.healthy ? health.liveCommands : null;
+    const commandDrift = Array.isArray(liveCommands) ? !sameCommandSet(liveCommands, declared) : null;
     return {
       surface_id,
       health: !url ? "no_probe" : (health.healthy ? "healthy" : "down"),
@@ -372,6 +430,8 @@ export async function probeAllSurfaceHealth({ fetchImpl = globalThis.fetch, time
       error: url && !health.healthy ? (health.error || null) : null,
       open_url: openUrl || null,
       open_ok: open ? open.healthy : null,
+      live_commands: liveCommands,
+      command_drift: commandDrift,
       observed_at: now(),
     };
   }));
@@ -396,6 +456,8 @@ export async function probeAllSurfaceHealth({ fetchImpl = globalThis.fetch, time
       last_health_at: entry.observed_at,
       last_health_ok: entry.health === "healthy",
       last_health_error: entry.health === "healthy" ? null : entry.error,
+      last_health_commands: entry.live_commands,
+      command_drift: entry.command_drift,
     };
   });
   saveSupervisorState(state);
@@ -834,6 +896,7 @@ const PRODUCT_REPO_MANIFESTS = [
   { repo: "regen-root", manifest: "mcp-servers/regen-media/clauth-plugin.json" },
   { repo: "regen-root", manifest: "mcp-servers/web-research/clauth-plugin.json" },
   { repo: "rdc-skills", manifest: "clauth-plugin.json" },
+  { repo: "rdc-harness", manifest: "fsm-daemon/clauth-plugin.json" },
 ];
 
 // Sweep outcomes that mean "nothing was there to sync", as distinct from
@@ -853,6 +916,12 @@ export const SYNC_REPO_NAMES = Object.freeze([...new Set(PRODUCT_REPO_MANIFESTS.
 function defaultRepoRoot(repo) {
   if (repo === "regen-root") return process.env.REGEN_ROOT || process.env.LIFEAI_REPO_ROOT || "C:/Dev/regen-root";
   if (repo === "rdc-skills") return process.env.RDC_SKILLS_ROOT || "C:/Dev/rdc-skills";
+  // fsm-daemon's clauth-plugin.json lives inside rdc-harness, not published
+  // separately -- it was previously reachable only via a one-off manual
+  // `clauth plugin register` pinned to whichever machine ran it, invisible to
+  // this sweep and to any box that registers fsm-daemon fresh. Same env-var
+  // + hardcoded-default shape as the two entries above, not a new pattern.
+  if (repo === "rdc-harness") return process.env.RDC_HARNESS_ROOT || "C:/Dev/rdc-harness";
   return null;
 }
 
@@ -1193,6 +1262,17 @@ export function setPluginEnabled(id, enabled, actor = "localhost") {
   const prior = (state.plugins || []).find((plugin) => plugin.id === id);
   if (!prior) return { error: "plugin_not_found" };
   if (prior.state === "manifest_invalid") return { error: "manifest_invalid" };
+  // A core:true plugin auto-enables at discovery (discoverPlugins()) and,
+  // per the same rule, is never allowed BACK into awaiting_enable — "core
+  // surfaces just run" is a guarantee, not a default a dashboard toggle can
+  // quietly undo. Approved: direct operator instruction, 2026-09-06 —
+  // "core: true surfaces only" get the no-gate treatment, applied uniformly
+  // to every destination (local AND remote, same rule). Disabling a core
+  // plugin is rejected outright rather than silently ignored, so a caller
+  // finds out immediately rather than wondering why the toggle didn't stick.
+  if (!enabled && prior.core === true) {
+    return { error: "core_plugin_cannot_be_disabled", plugin_id: id };
+  }
   const nextPlugin = { ...prior, enabled: Boolean(enabled), state: enabled ? "current" : "awaiting_enable" };
   state.plugins = state.plugins.map((plugin) => plugin.id === id ? nextPlugin : plugin);
   state.surfaces = (state.surfaces || []).map((surface) => surface.plugin_id === id ? { ...surface, enabled: Boolean(enabled), state: nextPlugin.state } : surface);

package/cli/supervisor-registry.test.js

@@ -314,6 +314,29 @@ test("trusted managed core plugins auto-enable while user plugins remain opt-in"
   assert.equal(userPlugin.state, "awaiting_enable");
 }));
 
+test("setPluginEnabled refuses to disable a core plugin — 'core surfaces just run' is a guarantee, not a default", () => withTempSupervisor((root) => {
+  const managed = path.join(root, "managed");
+  const user = path.join(root, "user");
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = user;
+  writePlugin(root, "managed", "core-mcp", baseManifest("core-mcp", { core: true, enable_default: true }));
+  writePlugin(root, "managed", "noncore-mcp", baseManifest("noncore-mcp", { core: false }));
+  discoverPlugins();
+
+  const rejected = setPluginEnabled("core-mcp", false);
+  assert.equal(rejected.error, "core_plugin_cannot_be_disabled");
+  // Positive control: the plugin's actual state is UNCHANGED by the
+  // rejected call, not silently flipped anyway.
+  assert.equal(listPlugins().find((p) => p.id === "core-mcp").enabled, true);
+  assert.equal(listPlugins().find((p) => p.id === "core-mcp").state, "current");
+
+  // Regression guard: a NON-core plugin can still be disabled exactly as
+  // before -- this fix narrows the gate, it does not remove it.
+  const disabled = setPluginEnabled("noncore-mcp", false);
+  assert.equal(disabled.resulting_state.enabled, false);
+  assert.equal(listPlugins().find((p) => p.id === "noncore-mcp").state, "awaiting_enable");
+}));
+
 test("plugin test marks a private candidate and never creates a public route", () => withTempSupervisor((root) => {
   const managed = path.join(root, "managed");
   process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = managed;
@@ -452,6 +475,65 @@ test("health reconciliation marks a failed clauth surface and repairs it through
   }
 });
 
+test("a healthy surface's live-reported commands are recorded, and drift against the manifest is detected", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-commands-"));
+  const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
+  const oldManaged = process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+  const oldUser = process.env.CLAUTH_USER_PLUGIN_ROOTS;
+  process.env.CLAUTH_SUPERVISOR_DIR = root;
+  process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = path.join(root, "managed");
+  process.env.CLAUTH_USER_PLUGIN_ROOTS = path.join(root, "user");
+  try {
+    // Manifest declares start+stop only (no restart command).
+    writePlugin(root, "managed", "commands-demo", baseManifest("commands-demo", {
+      core: true,
+      enable_default: true,
+      surfaces: [{
+        id: "primary",
+        destination: "local/clauth/pm2",
+        lifecycle_owner: "clauth",
+        port: 39125,
+        health: "/health",
+        start: [process.execPath, "--version"],
+        stop: [process.execPath, "--version"],
+      }],
+    }));
+    discoverPlugins();
+
+    // Surface's OWN code reports a DIFFERENT set live (it also implements
+    // restart, which the manifest never declared) -- this is the drift case.
+    const drifted = await reconcileSurfaceHealth({
+      fetchImpl: async () => ({ ok: true, json: async () => ({ status: "ok", commands: ["start", "stop", "restart"] }) }),
+    });
+    assert.equal(drifted.inspected[0].command_drift, true);
+    const afterDrift = listSurfaces().find((s) => s.plugin_id === "commands-demo");
+    assert.deepEqual(afterDrift.last_health_commands, ["start", "stop", "restart"]);
+    assert.equal(afterDrift.command_drift, true);
+
+    // Surface's code now matches the manifest exactly -- no drift.
+    const matched = await reconcileSurfaceHealth({
+      fetchImpl: async () => ({ ok: true, json: async () => ({ status: "ok", commands: ["stop", "start"] }) }),
+    });
+    assert.equal(matched.inspected[0].command_drift, false);
+    assert.equal(listSurfaces().find((s) => s.plugin_id === "commands-demo").command_drift, false);
+
+    // A surface that hasn't been retrofitted with the commands field at all
+    // must NOT be flagged as drifted -- no live evidence is never treated as
+    // disagreeing evidence.
+    const unretrofitted = await reconcileSurfaceHealth({ fetchImpl: async () => ({ ok: true }) });
+    assert.equal(unretrofitted.inspected[0].command_drift, false, "no liveCommands reported must never read as drift");
+    assert.equal(listSurfaces().find((s) => s.plugin_id === "commands-demo").last_health_commands, null);
+  } finally {
+    if (oldDir === undefined) delete process.env.CLAUTH_SUPERVISOR_DIR;
+    else process.env.CLAUTH_SUPERVISOR_DIR = oldDir;
+    if (oldManaged === undefined) delete process.env.CLAUTH_MANAGED_PLUGIN_ROOTS;
+    else process.env.CLAUTH_MANAGED_PLUGIN_ROOTS = oldManaged;
+    if (oldUser === undefined) delete process.env.CLAUTH_USER_PLUGIN_ROOTS;
+    else process.env.CLAUTH_USER_PLUGIN_ROOTS = oldUser;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("health reconciliation does not claim current when a successful command leaves health down", async () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-supervisor-post-health-"));
   const oldDir = process.env.CLAUTH_SUPERVISOR_DIR;
@@ -894,6 +976,7 @@ function withTempProductRepos(fn) {
   const base = fs.mkdtempSync(path.join(os.tmpdir(), "clauth-sync-repos-"));
   const regenRoot = path.join(base, "regen-root");
   const rdcSkills = path.join(base, "rdc-skills");
+  const rdcHarness = path.join(base, "rdc-harness");
   const writeManifest = (repoRoot, relPath, manifest) => {
     const full = path.join(repoRoot, relPath);
     fs.mkdirSync(path.dirname(full), { recursive: true });
@@ -905,8 +988,9 @@ function withTempProductRepos(fn) {
   writeManifest(regenRoot, "mcp-servers/regen-media/clauth-plugin.json", baseManifest("regen-media"));
   writeManifest(regenRoot, "mcp-servers/web-research/clauth-plugin.json", baseManifest("web-research"));
   writeManifest(rdcSkills, "clauth-plugin.json", baseManifest("rdc-skills"));
+  writeManifest(rdcHarness, "fsm-daemon/clauth-plugin.json", baseManifest("fsm-daemon"));
   try {
-    return fn({ base, regenRoot, rdcSkills, writeManifest, roots: { "regen-root": regenRoot, "rdc-skills": rdcSkills } });
+    return fn({ base, regenRoot, rdcSkills, rdcHarness, writeManifest, roots: { "regen-root": regenRoot, "rdc-skills": rdcSkills, "rdc-harness": rdcHarness } });
   } finally {
     fs.rmSync(base, { recursive: true, force: true });
   }
@@ -914,7 +998,7 @@ function withTempProductRepos(fn) {
 
 test("plugin sync inherits registerPlugin idempotence — a second sweep reports every manifest unchanged", () => withTempSupervisor(() => withTempProductRepos(({ roots }) => {
   const first = syncPluginsFromRepos(roots, "test");
-  assert.equal(first.length, 5, "one receipt per attempted manifest");
+  assert.equal(first.length, 6, "one receipt per attempted manifest");
   assert.deepEqual(
     first.filter((entry) => !entry.ok).map((entry) => `${entry.repo}:${entry.state}`),
     [],
@@ -925,7 +1009,7 @@ test("plugin sync inherits registerPlugin idempotence — a second sweep reports
   // registerPlugin sha256-compares before writing; sync must not defeat that by
   // re-writing or re-hashing on its own.
   const second = syncPluginsFromRepos(roots, "test");
-  assert.equal(second.length, 5);
+  assert.equal(second.length, 6);
   assert.equal(second.every((entry) => entry.ok && entry.state === "unchanged"), true, "re-sweeping identical content must be a no-op");
 })));
 
@@ -937,7 +1021,7 @@ test("plugin sync warns and continues over a missing repo root instead of throwi
   assert.doesNotThrow(() => {
     receipts = syncPluginsFromRepos({ "regen-root": absent, "rdc-skills": rdcSkills }, "test");
   });
-  assert.equal(receipts.length, 5, "a skipped repo still yields a receipt per attempted manifest");
+  assert.equal(receipts.length, 6, "a skipped repo still yields a receipt per attempted manifest");
   const missing = receipts.filter((entry) => entry.state === "repo_root_missing");
   assert.equal(missing.length, 4, "all four regen-root manifests report the missing root");
   assert.equal(missing.every((entry) => entry.ok === false), true);
@@ -951,15 +1035,15 @@ test("plugin sync registers the remaining manifests when one is malformed", () =
   writeManifest(regenRoot, "apps/dev-center/clauth-plugin.json", "{ this is not valid json");
 
   const receipts = syncPluginsFromRepos(roots, "test");
-  assert.equal(receipts.length, 5);
+  assert.equal(receipts.length, 6);
   const bad = receipts.find((entry) => entry.path.includes("dev-center"));
   assert.equal(bad.ok, false);
   assert.equal(bad.state, "manifest_invalid");
   const good = receipts.filter((entry) => entry !== bad);
-  assert.equal(good.length, 4);
+  assert.equal(good.length, 5);
   assert.equal(good.every((entry) => entry.ok && entry.state === "registered"), true, "one bad manifest must not abort the sweep");
   const ids = new Set(listPlugins().map((plugin) => plugin.id));
-  for (const id of ["codeflow-mcp", "regen-media", "web-research", "rdc-skills"]) {
+  for (const id of ["codeflow-mcp", "regen-media", "web-research", "rdc-skills", "fsm-daemon"]) {
     assert.ok(ids.has(id), `${id} must still be registered`);
   }
 })));
@@ -1201,7 +1285,7 @@ test("plugin sync reports an unknown repo-root override instead of silently swee
   assert.equal(rejected[0].ok, false);
   assert.match(rejected[0].error, /unknown repo name/);
   assert.equal(SYNC_SKIP_STATES.includes("unknown_repo_name"), false, "a typo'd repo name must fail the sweep, not be skipped");
-  assert.deepEqual([...SYNC_REPO_NAMES].sort(), ["rdc-skills", "regen-root"]);
+  assert.deepEqual([...SYNC_REPO_NAMES].sort(), ["rdc-harness", "rdc-skills", "regen-root"]);
 })));
 
 test("plugin sync never throws on a malformed repo root — the contract absence must not break", () => withTempSupervisor(() => withTempProductRepos(({ rdcSkills }) => {
@@ -1212,7 +1296,7 @@ test("plugin sync never throws on a malformed repo root — the contract absence
     assert.doesNotThrow(() => {
       receipts = syncPluginsFromRepos({ "regen-root": badRoot, "rdc-skills": rdcSkills }, "test");
     }, `root ${JSON.stringify(badRoot)} must not throw`);
-    assert.equal(receipts.length, 5, "every attempted manifest still yields a receipt");
+    assert.equal(receipts.length, 6, "every attempted manifest still yields a receipt");
     assert.equal(
       receipts.filter((entry) => entry.repo === "regen-root" && entry.state === "repo_root_unknown").length,
       4,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "2.15.7",
+  "version": "2.15.8",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {