@holin-work/holin-cli 1.3.5 → 1.3.6

package/bin/holin-cli.js

@@ -218,10 +218,18 @@ function createProxyServer() {
 
       log(`[proxy] → ${req.method} ${req.url} body=${bodyPreview}`);
 
-      // Block OAuth discovery probes — return 401 so platform knows auth is required
+      // OAuth discovery probes — return standard protected-resource metadata
+      // so the host knows this MCP server requires authentication even when connected.
+      // RFC 9728: /.well-known/oauth-protected-resource must return 200 + JSON describing the auth requirement.
+      // Returning 401 here causes some hosts to show "does not require authentication".
       if (req.url.startsWith("/.well-known/")) {
-        const body = JSON.stringify({ error: "unauthorized" });
-        res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+        const body = JSON.stringify({
+          resource: `http://${PROXY_HOST}:${PROXY_PORT}`,
+          authorization_servers: [],
+          bearer_methods_supported: ["header"],
+          resource_documentation: "https://holin.work/docs/api",
+        });
+        res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
         res.end(body);
         return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {