@holin-work/holin-cli 1.3.4 → 1.3.6

package/bin/holin-cli.js

@@ -218,10 +218,18 @@ function createProxyServer() {
 
       log(`[proxy] → ${req.method} ${req.url} body=${bodyPreview}`);
 
-      // Block OAuth discovery probes — return 401 so platform knows auth is required
+      // OAuth discovery probes — return standard protected-resource metadata
+      // so the host knows this MCP server requires authentication even when connected.
+      // RFC 9728: /.well-known/oauth-protected-resource must return 200 + JSON describing the auth requirement.
+      // Returning 401 here causes some hosts to show "does not require authentication".
       if (req.url.startsWith("/.well-known/")) {
-        const body = JSON.stringify({ error: "unauthorized" });
-        res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+        const body = JSON.stringify({
+          resource: `http://${PROXY_HOST}:${PROXY_PORT}`,
+          authorization_servers: [],
+          bearer_methods_supported: ["header"],
+          resource_documentation: "https://holin.work/docs/api",
+        });
+        res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
         res.end(body);
         return;
       }
@@ -557,10 +565,46 @@ function cmdProxyStart() {
   process.on("SIGTERM", cleanupAndExit);
 }
 
+/**
+ * Wait until the proxy port is actually accepting TCP connections.
+ * Polls every 200ms up to `timeoutMs`. Resolves when the port is reachable,
+ * rejects on timeout.
+ */
+function waitForPort(port, host, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const deadline = Date.now() + timeoutMs;
+    function attempt() {
+      const req = http.get({ hostname: host, port, path: "/health", timeout: 500 }, (res) => {
+        res.resume(); // drain response body
+        req.destroy();
+        resolve();
+      });
+      req.on("error", () => {
+        req.destroy();
+        if (Date.now() >= deadline) {
+          reject(new Error(`Proxy port ${port} not reachable within ${timeoutMs}ms. Check log: ${LOG_FILE}`));
+        } else {
+          setTimeout(attempt, 200);
+        }
+      });
+      req.on("timeout", () => {
+        req.destroy();
+        if (Date.now() >= deadline) {
+          reject(new Error(`Proxy port ${port} not reachable within ${timeoutMs}ms. Check log: ${LOG_FILE}`));
+        } else {
+          setTimeout(attempt, 200);
+        }
+      });
+    }
+    attempt();
+  });
+}
+
 function startProxyDaemon() {
   return new Promise((resolve, reject) => {
     if (isProxyRunning()) {
-      resolve();
+      // Proxy process exists per pid file — also verify port is actually listening
+      waitForPort(PROXY_PORT, PROXY_HOST, 3000).then(resolve).catch(resolve); // best-effort
       return;
     }
 
@@ -574,18 +618,10 @@ function startProxyDaemon() {
 
     child.unref();
 
-    // Poll for pid file up to 3s to confirm proxy is listening
-    let attempts = 0;
-    const poll = setInterval(() => {
-      attempts++;
-      if (isProxyRunning()) {
-        clearInterval(poll);
-        resolve();
-      } else if (attempts >= 15) {
-        clearInterval(poll);
-        reject(new Error(`Proxy did not start within 3s. Check log: ${LOG_FILE}`));
-      }
-    }, 200);
+    // Wait until the proxy port is actually accepting connections (up to 10s).
+    // This replaces the old pid-file poll which only confirmed the process existed,
+    // not that it was ready to serve — causing ECONNREFUSED races on slow machines.
+    waitForPort(PROXY_PORT, PROXY_HOST, 10000).then(resolve).catch(reject);
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.3.4",
+  "version": "1.3.6",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {