@holin-work/holin-cli 1.1.2 → 1.1.3

package/bin/holin-cli.js

@@ -123,17 +123,30 @@ async function pingVerify(apiKey) {
 
 function createProxyServer() {
   const server = http.createServer((req, res) => {
-    // Block OAuth discovery probes — return 404 so platform skips OAuth flow
+    // Block OAuth discovery probes — return 401 so platform knows auth is required
     if (req.url.startsWith("/.well-known/")) {
-      const body = JSON.stringify({ error: "not_found" });
-      res.writeHead(404, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+      const body = JSON.stringify({ error: "unauthorized" });
+      res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+      res.end(body);
+      return;
+    }
+
+    // Read credentials on every request (hot-reload support)
+    const creds = readCredentials();
+    if (!creds?.api_key) {
+      // No credentials: return 401 so platform knows auth is required (not "no auth needed")
+      const body = JSON.stringify({ error: "unauthorized", message: "Run 'holin-cli auth login' first." });
+      res.writeHead(401, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body),
+        "WWW-Authenticate": "Bearer realm=\"Holin API\"",
+      });
       res.end(body);
       return;
     }
 
     // Health check endpoint
     if (req.method === "GET" && req.url === "/health") {
-      const creds = readCredentials();
       const body = JSON.stringify({
         status: "ok",
         authenticated: !!(creds && creds.api_key),
@@ -150,18 +163,6 @@ function createProxyServer() {
       return;
     }
 
-    // Read credentials on every request (hot-reload support)
-    const creds = readCredentials();
-    if (!creds?.api_key) {
-      const body = JSON.stringify({ error: "not_authenticated", message: "Run 'holin-cli auth login' first." });
-      res.writeHead(401, {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body),
-      });
-      res.end(body);
-      return;
-    }
-
     // Build upstream request
     // MCP streamable-http has a single endpoint; forward directly to upstream path.
     // Accio requests http://127.0.0.1:18787/mcp → upstream https://api.holin.work/icbu/mcp

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {