@hirey/hi-mcp-server 0.1.23 → 0.1.25

package/README.md

@@ -22,6 +22,20 @@
 
 ## 对外暴露的两类工具
 
+默认 `HI_MCP_TOOL_SURFACE=full` 会暴露下面两类工具，适合 OpenClaw、Claude Code、Claude Desktop、本地 Codex MCP 等需要安装/诊断/事件消费能力的 MCP-first 宿主。
+
+ChatGPT App / OpenAI Apps SDK 的 hosted OAuth 入口应使用 `/mcp/chatgpt`，或在专用部署里设置 `HI_MCP_TOOL_SURFACE=chatgpt_app`。这个 surface 不暴露 `hi_agent_*` 安装和事件控制面，只暴露一个小而明确的业务工具集，方便 ChatGPT 选择工具、降低审核解释成本，也避免把本地安装语义带进公共 App：
+
+- `listing_taxonomy`
+- `agent_listings`
+- `matching_sessions`
+- `pairings`
+- `thread_meetings`
+- `faq_search`
+- `faq_get`
+- `content_render`
+- `content_get`
+
 ### 1. 控制面工具
 
 这些工具都以 `hi_agent_*` 命名，保持和 gateway 控制面同一语义边界：
@@ -117,6 +131,11 @@ npm install -g @hirey/hi-mcp-server
 - `HI_MCP_TRANSPORT`
   - 可选。`http` 或 `stdio`。
   - 默认 `http`。
+- `HI_MCP_TOOL_SURFACE`
+  - 可选。`full` 或 `chatgpt_app`。
+  - 默认 `full`。
+  - `chatgpt_app` 只暴露 ChatGPT App 审核/用户体验需要的业务工具，并在 `tools/call` 路径同步拒绝隐藏工具。
+  - 在共享 hosted 服务里，推荐保留默认 `full`，并把 ChatGPT App 的 MCP URL 配成 `/mcp/chatgpt`；这样 `/mcp` 仍可服务 Codex/OpenClaw/Claude 的完整工具面。
 - `HI_MCP_HOST`
   - `http` 模式监听地址，默认 `127.0.0.1`。
 - `HI_MCP_PORT`
@@ -163,6 +182,7 @@ hi-mcp-server
 MCP endpoint:
 
 - `POST /mcp`
+- `POST /mcp/chatgpt`（ChatGPT App 专用裁剪工具面）
 - `GET /healthz`
 
 ### Stdio

package/dist/defaultReplyRoute.d.ts

@@ -1,3 +1,5 @@
+export type HostKind = 'openclaw' | 'generic' | 'codex' | 'claude_code' | 'claude_chat' | 'claude_cowork' | 'claude_desktop' | 'chatgpt_app';
+export declare function isOpenClawHost(hostKind: HostKind): hostKind is 'openclaw';
 export type DefaultReplyDeliveryContext = {
     channel: string | null;
     to: string | null;
@@ -5,7 +7,7 @@ export type DefaultReplyDeliveryContext = {
     thread_id: string | null;
 };
 export declare function resolveInstallDefaultReplyDeliveryContext(args: {
-    hostKind: 'openclaw' | 'generic';
+    hostKind: HostKind;
     hasSessionKey: boolean;
     defaultReplyChannel?: unknown;
     defaultReplyTo?: unknown;
@@ -13,7 +15,7 @@ export declare function resolveInstallDefaultReplyDeliveryContext(args: {
     defaultReplyThreadId?: unknown;
 }): DefaultReplyDeliveryContext | null;
 export declare function resolveInstallRouteMissingPolicy(args: {
-    hostKind: 'openclaw' | 'generic';
+    hostKind: HostKind;
     explicitRouteMissingPolicy?: unknown;
     defaultReplyRoute?: Record<string, unknown> | null;
 }): {

package/dist/defaultReplyRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultReplyRoute.d.ts","sourceRoot":"","sources":["../src/defaultReplyRoute.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,wBAAgB,yCAAyC,CAAC,IAAI,EAAE;IAC9D,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,2BAA2B,GAAG,IAAI,CAqErC;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACpD,GAAG;IACF,EAAE,EAAE,IAAI,CAAC;IACT,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,sCAAsC,CAAC;CAC/C,CAcA"}
+{"version":3,"file":"defaultReplyRoute.d.ts","sourceRoot":"","sources":["../src/defaultReplyRoute.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,SAAS,GACT,OAAO,GACP,aAAa,GACb,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,aAAa,CAAC;AAElB,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,IAAI,UAAU,CAEzE;AAED,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,wBAAgB,yCAAyC,CAAC,IAAI,EAAE;IAC9D,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,2BAA2B,GAAG,IAAI,CAqErC;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,QAAQ,EAAE,QAAQ,CAAC;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACpD,GAAG;IACF,EAAE,EAAE,IAAI,CAAC;IACT,kBAAkB,EAAE,MAAM,CAAC;CAC5B,GAAG;IACF,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,sCAAsC,CAAC;CAC/C,CAcA"}

package/dist/defaultReplyRoute.js

@@ -1,6 +1,9 @@
 function normalizeText(input) {
     return String(input || '').trim();
 }
+export function isOpenClawHost(hostKind) {
+    return hostKind === 'openclaw';
+}
 export function resolveInstallDefaultReplyDeliveryContext(args) {
     const explicit = {
         channel: normalizeText(args.defaultReplyChannel) || null,

package/dist/installDefaults.d.ts

@@ -1,7 +1,8 @@
+import type { HostKind } from './defaultReplyRoute.js';
 export declare const DEFAULT_OPENCLAW_INSTALL_DISPLAY_NAME = "OpenClaw Hi Agent";
 export declare const DEFAULT_GENERIC_INSTALL_DISPLAY_NAME = "Hi Agent";
 export declare function resolveInstallDisplayName(args: {
     explicitDisplayName?: unknown;
-    hostKind: 'openclaw' | 'generic';
+    hostKind: HostKind;
 }): string;
 //# sourceMappingURL=installDefaults.d.ts.map

package/dist/installDefaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installDefaults.d.ts","sourceRoot":"","sources":["../src/installDefaults.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AACzE,eAAO,MAAM,oCAAoC,aAAa,CAAC;AAE/D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;CAClC,UAMA"}
+{"version":3,"file":"installDefaults.d.ts","sourceRoot":"","sources":["../src/installDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAMvD,eAAO,MAAM,qCAAqC,sBAAsB,CAAC;AACzE,eAAO,MAAM,oCAAoC,aAAa,CAAC;AAe/D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB,UAIA"}

package/dist/installDefaults.js

@@ -3,11 +3,22 @@ function normalizeText(input) {
 }
 export const DEFAULT_OPENCLAW_INSTALL_DISPLAY_NAME = 'OpenClaw Hi Agent';
 export const DEFAULT_GENERIC_INSTALL_DISPLAY_NAME = 'Hi Agent';
+// Per-host defaults so the agent shows up in Hi's admin panel with a stable
+// human-readable label that matches the host the user actually onboarded
+// from. None of these carry openclaw-style install semantics; only the
+// display name changes.
+const HOST_KIND_DISPLAY_NAME_DEFAULTS = {
+    openclaw: DEFAULT_OPENCLAW_INSTALL_DISPLAY_NAME,
+    codex: 'Codex Hi Agent',
+    claude_code: 'Claude Code Hi Agent',
+    claude_chat: 'Claude Hi Agent',
+    claude_cowork: 'Cowork Hi Agent',
+    claude_desktop: 'Claude Desktop Hi Agent',
+    chatgpt_app: 'ChatGPT Hi Agent',
+};
 export function resolveInstallDisplayName(args) {
     const explicitDisplayName = normalizeText(args.explicitDisplayName);
     if (explicitDisplayName)
         return explicitDisplayName;
-    return args.hostKind === 'openclaw'
-        ? DEFAULT_OPENCLAW_INSTALL_DISPLAY_NAME
-        : DEFAULT_GENERIC_INSTALL_DISPLAY_NAME;
+    return HOST_KIND_DISPLAY_NAME_DEFAULTS[args.hostKind] || DEFAULT_GENERIC_INSTALL_DISPLAY_NAME;
 }

package/dist/oauthRequestAuth.d.ts

@@ -0,0 +1,67 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type express from 'express';
+import { type JWTPayload, type JWTVerifyResult } from 'jose';
+export type RequestAuth = {
+    bearer: string;
+    subjectId: string;
+    claims: JWTPayload;
+};
+export declare const requestAuthStorage: AsyncLocalStorage<RequestAuth | null>;
+export declare function getCurrentRequestAuth(): RequestAuth | null;
+export type OAuthVerifierConfig = {
+    issuer: string;
+    audience: string | string[];
+    jwksUri?: string;
+};
+export declare function buildOAuthVerifier(config: OAuthVerifierConfig): (token: string) => Promise<JWTVerifyResult<JWTPayload>>;
+export declare function extractBearer(req: express.Request): string | null;
+export declare function buildWwwAuthenticateChallenge(input: {
+    protectedResourceMetadataUrl: string;
+    scope?: string[];
+    error?: 'invalid_token' | 'insufficient_scope';
+    errorDescription?: string;
+}): string;
+export type ProtectedResourceMetadata = {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: ['header'];
+    resource_documentation?: string;
+};
+export type AuthorizationServerMetadataAlias = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    jwks_uri: string;
+    response_types_supported: ['code'];
+    response_modes_supported: ['query'];
+    grant_types_supported: ['authorization_code', 'refresh_token', 'client_credentials'];
+    token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'];
+    code_challenge_methods_supported: ['S256'];
+    scopes_supported: string[];
+    resource_indicators_supported: true;
+    service_documentation?: string;
+};
+export declare function buildAuthorizationServerMetadataAlias(input: {
+    issuer: string;
+    authorizationServer: string;
+    scopes: string[];
+    serviceDocumentationUrl?: string;
+}): AuthorizationServerMetadataAlias;
+export declare function buildProtectedResourceMetadata(input: {
+    resource: string;
+    authorizationServer: string;
+    scopes: string[];
+    resourceDocumentationUrl?: string;
+}): ProtectedResourceMetadata;
+export type BearerVerifyOutcome = {
+    ok: true;
+    auth: RequestAuth;
+} | {
+    ok: false;
+    error: 'invalid_token';
+    description: string;
+};
+export declare function verifyRequestBearer(req: express.Request, verifier: (token: string) => Promise<JWTVerifyResult<JWTPayload>>): Promise<BearerVerifyOutcome>;
+//# sourceMappingURL=oauthRequestAuth.d.ts.map

package/dist/oauthRequestAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthRequestAuth.d.ts","sourceRoot":"","sources":["../src/oauthRequestAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAM5F,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAMF,eAAO,MAAM,kBAAkB,uCAA8C,CAAC;AAE9E,wBAAgB,qBAAqB,IAAI,WAAW,GAAG,IAAI,CAE1D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAGhC,MAAM,EAAE,MAAM,CAAC;IAMf,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAG5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAMF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,IAS/B,OAAO,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAMlF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAOjE;AAKD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,CAaT;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB,EAAE,CAAC,MAAM,CAAC,CAAC;IACnC,wBAAwB,EAAE,CAAC,OAAO,CAAC,CAAC;IACpC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACrF,qCAAqC,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC7F,gCAAgC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,6BAA6B,EAAE,IAAI,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAMF,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC,GAAG,gCAAgC,CAiBnC;AAKD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,GAAG,yBAAyB,CAQ5B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,GAChE,OAAO,CAAC,mBAAmB,CAAC,CAuB9B"}

package/dist/oauthRequestAuth.js

@@ -0,0 +1,117 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+function normalizeText(input) {
+    return String(input || '').trim();
+}
+// Per-request identity for the multi-tenant HTTP /mcp surface. Tool handlers
+// pull the bearer out of this storage instead of loading a disk-resident
+// identity, so the same hi-mcp-server process can serve any number of
+// Codex / Claude Code installs concurrently.
+export const requestAuthStorage = new AsyncLocalStorage();
+export function getCurrentRequestAuth() {
+    return requestAuthStorage.getStore() || null;
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+export function buildOAuthVerifier(config) {
+    const issuer = trimTrailingSlash(config.issuer);
+    const audience = config.audience;
+    const jwksUri = config.jwksUri || `${issuer}/.well-known/jwks.json`;
+    const jwks = createRemoteJWKSet(new URL(jwksUri), {
+        cacheMaxAge: 5 * 60_000,
+        cooldownDuration: 30_000,
+    });
+    return async function verify(token) {
+        return await jwtVerify(token, jwks, {
+            issuer,
+            audience,
+        });
+    };
+}
+export function extractBearer(req) {
+    const header = String(req.headers.authorization || '');
+    if (!header)
+        return null;
+    const lower = header.toLowerCase();
+    if (!lower.startsWith('bearer '))
+        return null;
+    const token = header.slice('bearer '.length).trim();
+    return token || null;
+}
+// RFC 6750 / RFC 9728 — the 401 response challenge that points
+// MCP clients at our oauth-protected-resource metadata. Codex / Claude
+// Code parse this exact header to start their auto-discovery flow.
+export function buildWwwAuthenticateChallenge(input) {
+    const parts = [];
+    if (input.error) {
+        parts.push(`error="${input.error}"`);
+        if (input.errorDescription) {
+            parts.push(`error_description="${input.errorDescription.replace(/"/g, '\\"')}"`);
+        }
+    }
+    if (input.scope && input.scope.length > 0) {
+        parts.push(`scope="${input.scope.join(' ')}"`);
+    }
+    parts.push(`resource_metadata="${input.protectedResourceMetadataUrl}"`);
+    return `Bearer ${parts.join(', ')}`;
+}
+// Compatibility alias for clients that still probe RFC 8414 authorization
+// metadata on the MCP resource host before trying RFC 9728 protected-resource
+// discovery. The canonical metadata is served by hi-auth; this mirrors the
+// same endpoints without making the MCP server an authorization server.
+export function buildAuthorizationServerMetadataAlias(input) {
+    const base = trimTrailingSlash(input.authorizationServer);
+    return {
+        issuer: trimTrailingSlash(input.issuer),
+        authorization_endpoint: `${base}/oauth/authorize`,
+        token_endpoint: `${base}/oauth/token`,
+        registration_endpoint: `${base}/oauth/register`,
+        jwks_uri: `${base}/.well-known/jwks.json`,
+        response_types_supported: ['code'],
+        response_modes_supported: ['query'],
+        grant_types_supported: ['authorization_code', 'refresh_token', 'client_credentials'],
+        token_endpoint_auth_methods_supported: ['none', 'client_secret_basic', 'client_secret_post'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: input.scopes,
+        resource_indicators_supported: true,
+        ...(input.serviceDocumentationUrl ? { service_documentation: input.serviceDocumentationUrl } : {}),
+    };
+}
+// RFC 9728 §3 — minimum required surface: `resource` (canonical URI, exact
+// string that tokens must `aud`-match), `authorization_servers` (so MCP
+// clients know where to discover AS metadata). Everything else is optional.
+export function buildProtectedResourceMetadata(input) {
+    return {
+        resource: input.resource,
+        authorization_servers: [trimTrailingSlash(input.authorizationServer)],
+        scopes_supported: input.scopes,
+        bearer_methods_supported: ['header'],
+        ...(input.resourceDocumentationUrl ? { resource_documentation: input.resourceDocumentationUrl } : {}),
+    };
+}
+export async function verifyRequestBearer(req, verifier) {
+    const bearer = extractBearer(req);
+    if (!bearer) {
+        return { ok: false, error: 'invalid_token', description: 'missing_bearer' };
+    }
+    try {
+        const { payload } = await verifier(bearer);
+        const subjectId = normalizeText(payload.sub);
+        if (!subjectId) {
+            return { ok: false, error: 'invalid_token', description: 'missing_sub' };
+        }
+        return {
+            ok: true,
+            auth: {
+                bearer,
+                subjectId,
+                claims: payload,
+            },
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, error: 'invalid_token', description: message };
+    }
+}

package/dist/receiver-command.d.ts

@@ -1,8 +1,9 @@
+import type { HostKind } from './defaultReplyRoute.js';
 export declare function resolveCanonicalOpenClawReceiverBinaryPath(homeDir?: string): string;
 export declare function buildInstallReceiverCommandArgv(args: {
     explicitArgv: string[];
     receiverCommand: string;
-    hostKind: 'openclaw' | 'generic';
+    hostKind: HostKind;
     enableLocalReceiver: boolean;
     homeDir?: string;
 }): string[];

package/dist/receiver-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receiver-command.d.ts","sourceRoot":"","sources":["../src/receiver-command.ts"],"names":[],"mappings":"AAGA,wBAAgB,0CAA0C,CAAC,OAAO,GAAE,MAAqB,GAAG,MAAM,CAEjG;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,EAAE,CAmBX"}
+{"version":3,"file":"receiver-command.d.ts","sourceRoot":"","sources":["../src/receiver-command.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,wBAAgB,0CAA0C,CAAC,OAAO,GAAE,MAAqB,GAAG,MAAM,CAEjG;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,EAAE,CAmBX"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AA+CA,OAAO,EAQL,KAAK,6BAA6B,EAMnC,MAAM,YAAY,CAAC;AAqcpB,wBAAgB,oBAAoB,yCAEnC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAgDA,OAAO,EASL,KAAK,6BAA6B,EAMnC,MAAM,YAAY,CAAC;AAgqBpB,wBAAgB,oBAAoB,yCAEnC"}