@holin-work/holin-cli 1.3.5 → 1.3.7

package/bin/holin-cli.js

@@ -218,10 +218,37 @@ function createProxyServer() {
 
       log(`[proxy] → ${req.method} ${req.url} body=${bodyPreview}`);
 
-      // Block OAuth discovery probes — return 401 so platform knows auth is required
+      // OAuth discovery probes — return standard protected-resource metadata
+      // so the host knows this MCP server requires authentication even when connected.
+      // RFC 9728: /.well-known/oauth-protected-resource must return 200 + JSON describing the auth requirement.
+      // Returning 401 here causes some hosts to show "does not require authentication".
       if (req.url.startsWith("/.well-known/")) {
-        const body = JSON.stringify({ error: "unauthorized" });
-        res.writeHead(401, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+        const body = JSON.stringify({
+          resource: `http://${PROXY_HOST}:${PROXY_PORT}`,
+          authorization_servers: [],
+          bearer_methods_supported: ["header"],
+          resource_documentation: "https://holin.work/docs/api",
+        });
+        res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+        res.end(body);
+        return;
+      }
+
+      // Health check endpoint — must be before credential check so waitForPort probes always succeed
+      if (req.method === "GET" && req.url === "/health") {
+        const creds = readCredentials();
+        const body = JSON.stringify({
+          status: "ok",
+          authenticated: !!(creds?.api_key),
+          customer: creds?.customer_name || null,
+          plan: creds?.plan || null,
+          upstream: UPSTREAM_URL,
+          pid: process.pid,
+        });
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Content-Length": Buffer.byteLength(body),
+        });
         res.end(body);
         return;
       }
@@ -240,24 +267,6 @@ function createProxyServer() {
       return;
     }
 
-    // Health check endpoint
-    if (req.method === "GET" && req.url === "/health") {
-      const body = JSON.stringify({
-        status: "ok",
-        authenticated: !!(creds && creds.api_key),
-        customer: creds?.customer_name || null,
-        plan: creds?.plan || null,
-        upstream: UPSTREAM_URL,
-        pid: process.pid,
-      });
-      res.writeHead(200, {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body),
-      });
-      res.end(body);
-      return;
-    }
-
     // Build upstream request
     // MCP streamable-http has a single endpoint; forward directly to upstream path.
     // Accio requests http://127.0.0.1:18787/mcp → upstream https://api.holin.work/icbu/mcp
@@ -594,26 +603,29 @@ function waitForPort(port, host, timeoutMs) {
 
 function startProxyDaemon() {
   return new Promise((resolve, reject) => {
-    if (isProxyRunning()) {
-      // Proxy process exists per pid file — also verify port is actually listening
-      waitForPort(PROXY_PORT, PROXY_HOST, 3000).then(resolve).catch(resolve); // best-effort
-      return;
-    }
-
-    ensureConfigDir();
-    const logFd = openSync(LOG_FILE, "a");
-
-    const child = spawn(process.execPath, [process.argv[1], "proxy", "start", "--daemon"], {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-    });
+    // Always verify the port is actually reachable first, regardless of pid file.
+    // The old proxy may have exited (idle timeout) while the pid file is stale.
+    waitForPort(PROXY_PORT, PROXY_HOST, 500)
+      .then(() => {
+        // Port is already up — existing proxy is healthy, no need to spawn.
+        resolve();
+      })
+      .catch(() => {
+        // Port not reachable — spawn a new proxy daemon regardless of pid file state.
+        ensureConfigDir();
+        const logFd = openSync(LOG_FILE, "a");
+
+        const child = spawn(process.execPath, [process.argv[1], "proxy", "start", "--daemon"], {
+          detached: true,
+          stdio: ["ignore", logFd, logFd],
+        });
 
-    child.unref();
+        child.unref();
 
-    // Wait until the proxy port is actually accepting connections (up to 10s).
-    // This replaces the old pid-file poll which only confirmed the process existed,
-    // not that it was ready to serve — causing ECONNREFUSED races on slow machines.
-    waitForPort(PROXY_PORT, PROXY_HOST, 10000).then(resolve).catch(reject);
+        // Wait until the proxy port is actually accepting connections (up to 10s).
+        // Only resolve after a real HTTP response from /health — never resolve on catch.
+        waitForPort(PROXY_PORT, PROXY_HOST, 10000).then(resolve).catch(reject);
+      });
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holin-work/holin-cli",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "Holin CLI — Accio plugin authorization tool for ICBU batch listing",
   "type": "module",
   "bin": {