@lifeaitools/clauth 0.5.2 → 0.7.3

package/cli/commands/serve.js

@@ -5,6 +5,7 @@
 // Supports: start (background daemon), stop, restart, ping, foreground
 
 import http from "http";
+import crypto from "crypto";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -153,6 +154,32 @@ function dashboardHtml(port, whitelist) {
   .btn-tunnel-stop{background:#1e293b;color:#f87171;border:1px solid #334155;padding:6px 12px;font-size:.8rem;border-radius:6px;cursor:pointer;font-weight:500}
   .btn-tunnel-stop:hover{background:#2d1f1f;border-color:#f87171}
   .tunnel-err{font-size:.78rem;color:#f87171;width:100%;margin-top:4px}
+  .mcp-setup{background:#0f1d2d;border:1px solid #1e3a5f;border-radius:8px;padding:1rem 1.25rem;margin-bottom:1.25rem;display:none}
+  .mcp-setup.open{display:block}
+  .mcp-setup-title{font-size:.85rem;font-weight:600;color:#e2e8f0;margin-bottom:.75rem}
+  .mcp-row{display:flex;align-items:center;gap:8px;margin-bottom:8px}
+  .mcp-label{font-size:.72rem;color:#64748b;min-width:80px;text-transform:uppercase;letter-spacing:.5px;font-weight:600}
+  .mcp-val{flex:1;font-family:'Courier New',monospace;font-size:.82rem;color:#60a5fa;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;padding:6px 10px;word-break:break-all;user-select:all}
+  .mcp-copy{background:none;border:1px solid #334155;color:#94a3b8;border-radius:4px;padding:4px 8px;cursor:pointer;font-size:.75rem;font-family:'Courier New',monospace;transition:all .15s;flex-shrink:0}
+  .mcp-copy:hover{border-color:#60a5fa;color:#60a5fa}
+  .mcp-copy.ok{border-color:#4ade80;color:#4ade80}
+  .btn-mcp-setup{background:#1e293b;color:#94a3b8;border:1px solid #334155;padding:6px 12px;font-size:.8rem;border-radius:6px;cursor:pointer;font-weight:500;transition:all .15s}
+  .btn-mcp-setup:hover{border-color:#60a5fa;color:#60a5fa}
+  .btn-mcp-setup:disabled{opacity:.4;cursor:not-allowed}
+  .btn-add{background:#1a2e1a;color:#4ade80;border:1px solid #166534;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:500;transition:all .15s}
+  .btn-add:hover{background:#1a3d22;border-color:#4ade80}
+  .add-panel{display:none;background:#1a1f2e;border:1px solid #334155;border-radius:8px;padding:1.25rem;margin-bottom:1.5rem}
+  .add-panel h3{font-size:.9rem;font-weight:600;color:#f8fafc;margin-bottom:1rem}
+  .add-row{display:flex;gap:10px;flex-wrap:wrap;align-items:flex-end;margin-bottom:.75rem}
+  .add-field{display:flex;flex-direction:column;gap:4px}
+  .add-field label{font-size:.75rem;color:#64748b}
+  .add-input{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s}
+  .add-input:focus{border-color:#3b82f6}
+  .add-select{background:#0f172a;border:1px solid #334155;border-radius:6px;color:#e2e8f0;font-size:.88rem;padding:7px 12px;outline:none;width:200px;transition:border-color .2s;cursor:pointer}
+  .add-select:focus{border-color:#3b82f6}
+  .add-foot{display:flex;gap:8px;align-items:center}
+  .add-msg{font-size:.82rem}
+  .add-msg.ok{color:#4ade80} .add-msg.fail{color:#f87171}
   .footer{margin-top:2rem;font-size:.75rem;color:#475569;text-align:center}
   .oauth-fields{display:flex;flex-direction:column;gap:8px;margin-bottom:8px}
   .oauth-field{display:flex;flex-direction:column;gap:3px}
@@ -191,11 +218,33 @@ function dashboardHtml(port, whitelist) {
   </div>
   <div class="toolbar">
     <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
+    <button class="btn-add" onclick="toggleAddService()">+ Add Service</button>
     <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
     <button class="btn-lock" onclick="lockVault()">🔒 Lock</button>
     <button class="btn-cancel" style="margin-left:auto" onclick="toggleChangePw()">Change Password</button>
   </div>
 
+  <div class="add-panel" id="add-panel">
+    <h3>Add New Service</h3>
+    <div class="add-row">
+      <div class="add-field">
+        <label>Service name</label>
+        <input class="add-input" id="add-name" type="text" placeholder="e.g. coolify-admin" autocomplete="off" spellcheck="false">
+      </div>
+      <div class="add-field">
+        <label>Key type</label>
+        <select class="add-select" id="add-type">
+          <option value="">Loading…</option>
+        </select>
+      </div>
+    </div>
+    <div class="add-foot">
+      <button class="btn-chpw-save" onclick="addService()">Create Service</button>
+      <button class="btn-cancel" onclick="toggleAddService()">Cancel</button>
+      <span class="add-msg" id="add-msg"></span>
+    </div>
+  </div>
+
   <div class="chpw-panel" id="chpw-panel">
     <h3>Change Master Password</h3>
     <div class="chpw-row">
@@ -223,11 +272,34 @@ function dashboardHtml(port, whitelist) {
     <button class="btn-check" id="btn-tunnel-test" style="display:none;padding:6px 12px;font-size:.8rem" onclick="testTunnel()">Test</button>
     <button class="btn-claude" id="btn-claude" disabled onclick="openClaude()">Connect claude.ai</button>
     <button class="btn-tunnel-stop" id="btn-tunnel-toggle" style="display:none" onclick="toggleTunnel()">Stop</button>
+    <button class="btn-mcp-setup" id="btn-mcp-setup" style="display:none" onclick="toggleMcpSetup()">Setup MCP</button>
     <div class="tunnel-err" id="tunnel-err" style="display:none"></div>
   </div>
 
+  <div class="mcp-setup" id="mcp-setup-panel">
+    <div class="mcp-setup-title">claude.ai MCP Integration</div>
+    <div class="oauth-fields">
+      <div class="mcp-row">
+        <span class="mcp-label">URL</span>
+        <span class="mcp-val" id="mcp-url">—</span>
+        <button class="mcp-copy" onclick="copyMcp('mcp-url')">copy</button>
+      </div>
+      <div class="mcp-row">
+        <span class="mcp-label">Client ID</span>
+        <span class="mcp-val" id="mcp-client-id">—</span>
+        <button class="mcp-copy" onclick="copyMcp('mcp-client-id')">copy</button>
+      </div>
+      <div class="mcp-row">
+        <span class="mcp-label">Secret</span>
+        <span class="mcp-val" id="mcp-client-secret">—</span>
+        <button class="mcp-copy" onclick="copyMcp('mcp-client-secret')">copy</button>
+      </div>
+    </div>
+    <div style="font-size:.72rem;color:#64748b;margin-top:4px">Paste these into <a href="https://claude.ai/settings/integrations" target="_blank" style="color:#60a5fa">claude.ai Settings → Integrations</a></div>
+  </div>
+
   <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
-  <div class="footer">localhost:${port} · 127.0.0.1 only · 3-strike lockout</div>
+  <div class="footer">localhost:${port} · 127.0.0.1 only · 10-strike lockout</div>
 </div>
 
 <script>
@@ -686,11 +758,78 @@ async function changePassword() {
   }
 }
 
-// Enter key on lock screen
+// ── Add Service ──────────────────────────────
+const TYPE_LABELS = {
+  token: "token (API key)",
+  secret: "secret (password, secret)",
+  keypair: "keypair (user:key pair)",
+  connstring: "connstring (connection string)",
+  oauth: "oauth (OAuth credentials)",
+};
+
+async function toggleAddService() {
+  const panel = document.getElementById("add-panel");
+  const open  = panel.style.display === "block";
+  panel.style.display = open ? "none" : "block";
+  if (!open) {
+    document.getElementById("add-name").value = "";
+    document.getElementById("add-msg").textContent = "";
+    // Fetch available key types from server
+    const sel = document.getElementById("add-type");
+    sel.innerHTML = '<option value="">Loading…</option>';
+    try {
+      const r = await fetch(BASE + "/meta").then(r => r.json());
+      const types = r.key_types || ["token", "secret", "keypair", "connstring", "oauth"];
+      sel.innerHTML = types.map(t =>
+        \`<option value="\${t}">\${TYPE_LABELS[t] || t}</option>\`
+      ).join("");
+    } catch {
+      sel.innerHTML = ["token","secret","keypair","connstring","oauth"].map(t =>
+        \`<option value="\${t}">\${TYPE_LABELS[t] || t}</option>\`
+      ).join("");
+    }
+    document.getElementById("add-name").focus();
+  }
+}
+
+async function addService() {
+  const name = document.getElementById("add-name").value.trim().toLowerCase();
+  const type = document.getElementById("add-type").value;
+  const msg  = document.getElementById("add-msg");
+
+  if (!name) { msg.className = "add-msg fail"; msg.textContent = "Service name is required."; return; }
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) { msg.className = "add-msg fail"; msg.textContent = "Lowercase letters, numbers, hyphens, underscores only."; return; }
+
+  msg.className = "add-msg"; msg.textContent = "Creating…";
+  try {
+    const r = await fetch(BASE + "/add-service", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ name, key_type: type, label: name })
+    }).then(r => r.json());
+
+    if (r.locked) { showLockScreen(); return; }
+    if (r.error) throw new Error(r.error);
+
+    msg.className = "add-msg ok"; msg.textContent = "✓ " + name + " created";
+    setTimeout(() => {
+      document.getElementById("add-panel").style.display = "none";
+      msg.textContent = "";
+      loadServices();
+    }, 1200);
+  } catch (e) {
+    msg.className = "add-msg fail"; msg.textContent = "✗ " + e.message;
+  }
+}
+
+// Enter key on lock screen and add-service panel
 document.addEventListener("DOMContentLoaded", () => {
   document.getElementById("lock-input").addEventListener("keydown", e => {
     if (e.key === "Enter") unlock();
   });
+  document.getElementById("add-name").addEventListener("keydown", e => {
+    if (e.key === "Enter") addService();
+  });
 });
 
 // ── Tunnel management ───────────────────────
@@ -714,6 +853,7 @@ async function updateTunnelUI() {
   const label = document.getElementById("tunnel-label");
   const btn   = document.getElementById("btn-claude");
   const togBtn = document.getElementById("btn-tunnel-toggle");
+  const mcpBtn = document.getElementById("btn-mcp-setup");
   const errEl = document.getElementById("tunnel-err");
 
   try {
@@ -725,10 +865,12 @@ async function updateTunnelUI() {
       dot.className = "tunnel-dot err";
       label.innerHTML = '<strong>claude.ai MCP</strong> — ' + t.error;
       btn.disabled = true;
+      mcpBtn.style.display = "none";
       togBtn.style.display = "none";
       togBtn.textContent = "Start Tunnel";
       togBtn.onclick = () => toggleTunnel("start");
       togBtn.style.display = "inline-block";
+      document.getElementById("mcp-setup-panel").classList.remove("open");
       return "error";
     }
 
@@ -740,6 +882,7 @@ async function updateTunnelUI() {
       togBtn.textContent = "Stop Tunnel";
       togBtn.onclick = () => toggleTunnel("stop");
       togBtn.style.display = "inline-block";
+      mcpBtn.style.display = "inline-block";
       return "connected";
     }
 
@@ -747,6 +890,7 @@ async function updateTunnelUI() {
       dot.className = "tunnel-dot starting";
       label.innerHTML = '<strong>claude.ai MCP</strong> — starting tunnel…';
       btn.disabled = true;
+      mcpBtn.style.display = "none";
       togBtn.textContent = "Stop Tunnel";
       togBtn.onclick = () => toggleTunnel("stop");
       togBtn.style.display = "inline-block";
@@ -757,16 +901,20 @@ async function updateTunnelUI() {
     dot.className = "tunnel-dot off";
     label.innerHTML = '<strong>claude.ai MCP</strong> — tunnel not running';
     btn.disabled = true;
+    mcpBtn.style.display = "none";
     togBtn.textContent = "Start Tunnel";
     togBtn.onclick = () => toggleTunnel("start");
     togBtn.style.display = "inline-block";
+    document.getElementById("mcp-setup-panel").classList.remove("open");
     return "stopped";
 
   } catch {
     dot.className = "tunnel-dot off";
     label.innerHTML = '<strong>claude.ai MCP</strong> — unable to reach daemon';
     btn.disabled = true;
+    mcpBtn.style.display = "none";
     togBtn.style.display = "none";
+    document.getElementById("mcp-setup-panel").classList.remove("open");
     return "error";
   }
 }
@@ -827,6 +975,32 @@ function openClaude() {
   });
 }
 
+async function toggleMcpSetup() {
+  const panel = document.getElementById("mcp-setup-panel");
+  const isOpen = panel.classList.toggle("open");
+  if (isOpen) {
+    try {
+      const m = await fetch(BASE + "/mcp-setup").then(r => r.json());
+      document.getElementById("mcp-url").textContent = m.url || "(tunnel not running)";
+      document.getElementById("mcp-client-id").textContent = m.clientId || "—";
+      document.getElementById("mcp-client-secret").textContent = m.clientSecret || "—";
+    } catch {
+      document.getElementById("mcp-url").textContent = "(error fetching)";
+    }
+  }
+}
+
+function copyMcp(elId) {
+  const val = document.getElementById(elId).textContent;
+  if (!val || val === "—" || val.startsWith("(")) return;
+  const btn = document.getElementById(elId).nextElementSibling;
+  navigator.clipboard.writeText(val).then(() => {
+    btn.textContent = "ok";
+    btn.classList.add("ok");
+    setTimeout(() => { btn.textContent = "copy"; btn.classList.remove("ok"); }, 1500);
+  }).catch(() => {});
+}
+
 boot();
 </script>
 </body>
@@ -844,7 +1018,7 @@ function readBody(req) {
 }
 
 // ── Server logic (shared by foreground + daemon) ─────────────
-function createServer(initPassword, whitelist, port) {
+function createServer(initPassword, whitelist, port, tunnelHostname = null) {
   // Ensure Windows system tools are reachable (bash shells may lack these on PATH)
   if (os.platform() === "win32") {
     const sys32 = "C:\\Windows\\System32";
@@ -855,7 +1029,7 @@ function createServer(initPassword, whitelist, port) {
       process.env.PATH = (process.env.PATH || "") + ";" + sys32;
     }
   }
-  const MAX_FAILS = 3;
+  const MAX_FAILS = 10;
   let failCount = 0;
   let password = initPassword || null;   // null = locked; set via POST /auth
   const machineHash = getMachineHash();
@@ -863,7 +1037,7 @@ function createServer(initPassword, whitelist, port) {
   const CORS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id",
   };
 
   // ── MCP SSE session tracking ──────────────────────────────
@@ -891,13 +1065,39 @@ function createServer(initPassword, whitelist, port) {
   let tunnelUrl = null;
   let tunnelError = null;
 
+  // ── OAuth provider (self-contained for claude.ai MCP) ──────
+  const oauthClients = new Map();   // client_id → { client_secret, redirect_uris, client_name }
+  const oauthCodes = new Map();     // code → { client_id, redirect_uri, code_challenge, expires }
+  const oauthTokens = new Set();    // active access tokens
+
+  // Pre-generate a stable client for claude.ai (shown at startup)
+  const OAUTH_CLIENT_ID = crypto.randomBytes(16).toString("hex");
+  const OAUTH_CLIENT_SECRET = crypto.randomBytes(32).toString("hex");
+  oauthClients.set(OAUTH_CLIENT_ID, {
+    client_id: OAUTH_CLIENT_ID, client_secret: OAUTH_CLIENT_SECRET,
+    client_name: "claude.ai", redirect_uris: ["https://claude.ai/api/mcp/auth_callback"],
+    grant_types: ["authorization_code"], response_types: ["code"],
+    token_endpoint_auth_method: "client_secret_post",
+  });
+
+  function oauthBase() { return tunnelUrl || `http://127.0.0.1:${port}`; }
+  function sha256base64url(str) { return crypto.createHash("sha256").update(str).digest("base64url"); }
+
+  function readRawBody(req) {
+    return new Promise((resolve, reject) => {
+      let data = "";
+      req.on("data", chunk => { data += chunk; if (data.length > 65536) reject(new Error("Body too large")); });
+      req.on("end", () => resolve(data));
+      req.on("error", reject);
+    });
+  }
+
   async function startTunnel() {
     if (tunnelProc) return; // already running
     tunnelUrl = null;
     tunnelError = null;
 
     try {
-      // Quick tunnel — no DNS/config needed, new random URL each session
       // Resolve cloudflared binary — may not be on PATH in bash shells
       let cfBin = "cloudflared";
       if (os.platform() === "win32") {
@@ -913,17 +1113,30 @@ function createServer(initPassword, whitelist, port) {
         }
       }
 
-      const proc = spawnProc(cfBin, ["tunnel", "--url", `http://127.0.0.1:${port}`], {
+      // Named tunnel (fixed subdomain) or quick tunnel (random URL)
+      let args;
+      if (tunnelHostname) {
+        // Named tunnel: cloudflared tunnel run (uses ~/.cloudflared/config.yml)
+        // Config maps hostname → local service, so no --url needed
+        args = ["tunnel", "run"];
+        tunnelUrl = `https://${tunnelHostname}`;
+      } else {
+        // Quick tunnel — random URL each session
+        args = ["tunnel", "--url", `http://127.0.0.1:${port}`];
+      }
+
+      const proc = spawnProc(cfBin, args, {
         stdio: ["ignore", "pipe", "pipe"],
       });
 
       tunnelProc = proc;
 
-      // cloudflared prints the quick tunnel URL to stderr
+      // cloudflared prints output to stderr
       let stderrBuf = "";
       proc.stderr.on("data", (chunk) => {
         stderrBuf += chunk.toString();
-        if (!tunnelUrl) {
+        // For quick tunnels, capture the random URL from stderr
+        if (!tunnelHostname && !tunnelUrl) {
           const match = stderrBuf.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
           if (match) {
             tunnelUrl = match[0];
@@ -954,6 +1167,11 @@ function createServer(initPassword, whitelist, port) {
       // Give it a moment to start
       await new Promise(r => setTimeout(r, 4000));
 
+      if (tunnelHostname && tunnelProc) {
+        const logLine = `[${new Date().toISOString()}] Named tunnel started: ${tunnelUrl}\n`;
+        try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+      }
+
     } catch (err) {
       tunnelError = err.message;
       tunnelProc = null;
@@ -1006,9 +1224,18 @@ function createServer(initPassword, whitelist, port) {
   }
 
   const server = http.createServer(async (req, res) => {
-    // Hard reject anything not from loopback
     const remote = req.socket.remoteAddress;
     const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+
+    const url    = new URL(req.url, `http://127.0.0.1:${port}`);
+    const reqPath = url.pathname;
+    const method = req.method;
+
+    // Log every request
+    const logLine = `[${new Date().toISOString()}] ${method} ${reqPath} from=${remote} local=${isLocal}\n`;
+    try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+
+    // Hard reject anything not from loopback
     if (!isLocal) {
       return strike(res, 403, `Rejected non-local address: ${remote}`);
     }
@@ -1019,11 +1246,216 @@ function createServer(initPassword, whitelist, port) {
       return res.end();
     }
 
-    const url    = new URL(req.url, `http://127.0.0.1:${port}`);
-    const reqPath = url.pathname;
-    const method = req.method;
+    // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
+    if (reqPath === "/.well-known/oauth-protected-resource" ||
+        reqPath === "/.well-known/oauth-protected-resource/mcp" ||
+        reqPath === "/.well-known/oauth-protected-resource/sse") {
+      const base = oauthBase();
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({
+        resource: `${base}/mcp`,
+        authorization_servers: [base],
+        scopes_supported: ["mcp:tools"],
+        bearer_methods_supported: ["header"],
+      }));
+    }
+
+    if (reqPath === "/.well-known/oauth-authorization-server") {
+      const base = oauthBase();
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({
+        issuer: base,
+        authorization_endpoint: `${base}/authorize`,
+        token_endpoint: `${base}/token`,
+        registration_endpoint: `${base}/register`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code"],
+        code_challenge_methods_supported: ["S256"],
+        scopes_supported: ["mcp:tools"],
+      }));
+    }
+
+    // ── Dynamic Client Registration (RFC 7591) ──────────────
+    if (method === "POST" && reqPath === "/register") {
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_request" }));
+      }
+      const clientId = crypto.randomBytes(16).toString("hex");
+      const clientSecret = crypto.randomBytes(32).toString("hex");
+      const client = {
+        client_id: clientId, client_secret: clientSecret,
+        client_name: body.client_name || "unknown",
+        redirect_uris: body.redirect_uris || [],
+        grant_types: body.grant_types || ["authorization_code"],
+        response_types: body.response_types || ["code"],
+        token_endpoint_auth_method: body.token_endpoint_auth_method || "client_secret_post",
+      };
+      oauthClients.set(clientId, client);
+      const logMsg = `[${new Date().toISOString()}] OAuth: registered client ${clientId} (${client.client_name})\n`;
+      try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      res.writeHead(201, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(client));
+    }
+
+    // ── Authorization endpoint — auto-approve ──────────────
+    if (method === "GET" && reqPath === "/authorize") {
+      const clientId = url.searchParams.get("client_id");
+      const redirectUri = url.searchParams.get("redirect_uri");
+      const state = url.searchParams.get("state");
+      const codeChallenge = url.searchParams.get("code_challenge");
+      const codeChallengeMethod = url.searchParams.get("code_challenge_method");
+
+      if (!clientId || !redirectUri) {
+        res.writeHead(400, { "Content-Type": "text/plain", ...CORS });
+        return res.end("Missing client_id or redirect_uri");
+      }
+
+      const code = crypto.randomBytes(32).toString("hex");
+      oauthCodes.set(code, {
+        client_id: clientId, redirect_uri: redirectUri,
+        code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod,
+        expires: Date.now() + 300_000,
+      });
+
+      const redirect = new URL(redirectUri);
+      redirect.searchParams.set("code", code);
+      if (state) redirect.searchParams.set("state", state);
+
+      const logMsg = `[${new Date().toISOString()}] OAuth: authorize → code issued for ${clientId}, redirecting to ${redirect.origin}\n`;
+      try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      res.writeHead(302, { Location: redirect.toString(), ...CORS });
+      return res.end();
+    }
+
+    // ── Token endpoint ──────────────────────────────────────
+    if (method === "POST" && reqPath === "/token") {
+      let body;
+      const ct = req.headers["content-type"] || "";
+      try {
+        if (ct.includes("application/json")) {
+          body = await readBody(req);
+        } else {
+          const raw = await readRawBody(req);
+          body = Object.fromEntries(new URLSearchParams(raw));
+        }
+      } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_request" }));
+      }
+
+      if (body.grant_type !== "authorization_code") {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
+      }
+
+      const stored = oauthCodes.get(body.code);
+      if (!stored || stored.expires < Date.now()) {
+        oauthCodes.delete(body.code);
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_grant" }));
+      }
+
+      // PKCE verification
+      if (stored.code_challenge && body.code_verifier) {
+        const computed = sha256base64url(body.code_verifier);
+        if (computed !== stored.code_challenge) {
+          oauthCodes.delete(body.code);
+          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ error: "invalid_grant", error_description: "PKCE verification failed" }));
+        }
+      }
+
+      oauthCodes.delete(body.code);
+      const accessToken = crypto.randomBytes(32).toString("hex");
+      oauthTokens.add(accessToken);
+
+      const logMsg = `[${new Date().toISOString()}] OAuth: token issued for client ${stored.client_id}\n`;
+      try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400 }));
+    }
+
+    // ── MCP OAuth-protected endpoint (for claude.ai web) ──
+    // POST /mcp — requires Bearer token; returns 401 to trigger OAuth flow
+    if (method === "POST" && reqPath === "/mcp") {
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        const base = oauthBase();
+        res.writeHead(401, {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
+          ...CORS,
+        });
+        return res.end(JSON.stringify({ error: "unauthorized" }));
+      }
+      const token = authHeader.slice(7);
+      if (!oauthTokens.has(token)) {
+        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_token" }));
+      }
+      // Token valid — mark as remote caller (claude.ai via tunnel)
+      req._clauthRemote = true;
+      // fall through to MCP handling below
+    }
+
+    // ── MCP Streamable HTTP transport (2025-03-26 spec) ──
+    // POST /sse or POST /mcp — JSON-RPC over HTTP
+    if (method === "POST" && (reqPath === "/sse" || reqPath === "/mcp")) {
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON" }));
+      }
+
+      const id = body.id;
+      const rpcMethod = body.method;
+      const logMsg = `[${new Date().toISOString()}] Streamable HTTP: ${rpcMethod} id=${id}\n`;
+      try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+
+      // Notifications — no response needed
+      if (rpcMethod === "notifications/initialized" || rpcMethod === "initialized") {
+        res.writeHead(204, CORS);
+        return res.end();
+      }
 
-    // ── MCP SSE transport ─────────────────────────────────
+      if (rpcMethod === "initialize") {
+        const result = {
+          protocolVersion: "2025-03-26",
+          serverInfo: { name: "clauth", version: VERSION },
+          capabilities: { tools: {} }
+        };
+        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result }));
+      }
+
+      if (rpcMethod === "tools/list") {
+        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: { tools: MCP_TOOLS } }));
+      }
+
+      if (rpcMethod === "tools/call") {
+        const { name, arguments: args } = body.params || {};
+        const vault = sseVault();
+        vault.remote = !!req._clauthRemote;
+        try {
+          const result = await handleMcpTool(vault, name, args || {});
+          password = vault.password;
+          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ jsonrpc: "2.0", id, result }));
+        } catch (err) {
+          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: mcpError(`Internal error: ${err.message}`) }));
+        }
+      }
+
+      // Unknown method
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ jsonrpc: "2.0", id, error: { code: -32601, message: `Unknown method: ${rpcMethod}` } }));
+    }
+
+    // ── MCP SSE transport (legacy) ───────────────────────
     // GET /sse — open SSE stream, receive endpoint event
     if (method === "GET" && reqPath === "/sse") {
       const sessionId = `ses_${++sseCounter}_${Date.now()}`;
@@ -1038,7 +1470,9 @@ function createServer(initPassword, whitelist, port) {
       sseSessions.set(sessionId, { res, initialized: false });
 
       // Send the endpoint URI the client should POST to
-      const endpoint = `/message?sessionId=${sessionId}`;
+      // Use absolute URL when tunnel is active so remote clients can resolve it
+      const basePath = tunnelUrl || `http://127.0.0.1:${port}`;
+      const endpoint = `${basePath}/message?sessionId=${sessionId}`;
       res.write(`event: endpoint\ndata: ${endpoint}\n\n`);
 
       // Keepalive every 15s
@@ -1162,6 +1596,15 @@ function createServer(initPassword, whitelist, port) {
       });
     }
 
+    // GET /mcp-setup — OAuth credentials for claude.ai MCP setup (localhost only)
+    if (method === "GET" && reqPath === "/mcp-setup") {
+      return ok(res, {
+        url: tunnelUrl && tunnelUrl.startsWith("http") ? `${tunnelUrl}/mcp` : null,
+        clientId: OAUTH_CLIENT_ID,
+        clientSecret: OAUTH_CLIENT_SECRET,
+      });
+    }
+
     // POST /tunnel — start or stop tunnel manually
     if (method === "POST" && reqPath === "/tunnel") {
       if (lockedGuard(res)) return;
@@ -1198,6 +1641,31 @@ function createServer(initPassword, whitelist, port) {
       return false;
     }
 
+    // GET /meta — return valid key_types from DB check constraint
+    if (method === "GET" && reqPath === "/meta") {
+      if (lockedGuard(res)) return;
+      try {
+        const baseUrl = api.getBaseUrl().replace("/functions/v1/auth-vault", "");
+        const anonKey = api.getAnonKey();
+        const sql = `SELECT check_clause FROM information_schema.check_constraints WHERE constraint_name = 'clauth_services_key_type_check'`;
+        const r = await fetch(`${baseUrl}/rest/v1/rpc/`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", "Authorization": `Bearer ${anonKey}`, "apikey": anonKey }
+        }).catch(() => null);
+        // Fallback: parse from a direct SQL query via postgrest isn't possible without an RPC,
+        // so we query the status endpoint which returns services with their key_types
+        const { token, timestamp } = deriveToken(password, machineHash);
+        const statusResult = await api.status(password, machineHash, token, timestamp);
+        const existingTypes = [...new Set((statusResult.services || []).map(s => s.key_type).filter(Boolean))];
+        // Merge with known types (in case no service of that type exists yet)
+        const knownTypes = ["token", "secret", "keypair", "connstring", "oauth"];
+        const allTypes = [...new Set([...knownTypes, ...existingTypes])];
+        return ok(res, { key_types: allTypes });
+      } catch (err) {
+        return ok(res, { key_types: ["token", "secret", "keypair", "connstring", "oauth"] });
+      }
+    }
+
     // GET /status
     if (method === "GET" && reqPath === "/status") {
       if (lockedGuard(res)) return;
@@ -1446,10 +1914,53 @@ function createServer(initPassword, whitelist, port) {
       }
     }
 
-    // Unknown route
+    // POST /add-service — register a new service in the vault
+    if (method === "POST" && reqPath === "/add-service") {
+      if (lockedGuard(res)) return;
+
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
+      }
+
+      const { name, label, key_type, description } = body;
+      if (!name || typeof name !== "string" || !name.trim()) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "name is required" }));
+      }
+      const validTypes = ["token", "keypair", "connstring", "oauth", "secret"];
+      const type = (key_type || "token").toLowerCase();
+      if (!validTypes.includes(type)) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: `key_type must be one of: ${validTypes.join(", ")}` }));
+      }
+
+      try {
+        const { token, timestamp } = deriveToken(password, machineHash);
+        const result = await api.addService(password, machineHash, token, timestamp, name.trim().toLowerCase(), label || name.trim(), type, description || "");
+        if (result.error) return strike(res, 502, result.error);
+        return ok(res, { ok: true, service: name.trim().toLowerCase() });
+      } catch (err) {
+        return strike(res, 502, err.message);
+      }
+    }
+
+    // Unknown route — don't count browser/MCP noise as auth failures
+    // Don't count browser noise, MCP discovery probes, or OAuth probes as auth failures
+    const isBenign = reqPath.startsWith("/.well-known/") || [
+      "/favicon.ico", "/robots.txt", "/apple-touch-icon.png", "/apple-touch-icon-precomposed.png",
+      "/sse", "/mcp", "/message", "/register", "/authorize", "/token",
+    ].includes(reqPath);
+    if (isBenign) {
+      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ error: "Not found" }));
+    }
     return strike(res, 404, `Unknown endpoint: ${reqPath}`);
   });
 
+  server.__oauthClientId = OAUTH_CLIENT_ID;
+  server.__oauthClientSecret = OAUTH_CLIENT_SECRET;
   return server;
 }
 
@@ -1465,6 +1976,7 @@ async function verifyAuth(password) {
 async function actionStart(opts) {
   const port     = parseInt(opts.port || "52437", 10);
   const password = opts.pw;
+  const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())
     : null;
@@ -1490,7 +2002,7 @@ async function actionStart(opts) {
       }
     }
 
-    const server = createServer(password, whitelist, port);
+    const server = createServer(password, whitelist, port, tunnelHostname);
     server.listen(port, "127.0.0.1", () => {
       writePid(process.pid, port);
       const msg = `[${new Date().toISOString()}] clauth serve started — PID ${process.pid}, port ${port}, services: ${whitelist ? whitelist.join(",") : "all"}\n`;
@@ -1534,6 +2046,7 @@ async function actionStart(opts) {
   const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
   if (password) childArgs.push("--pw", password);
   if (opts.services) childArgs.push("--services", opts.services);
+  if (tunnelHostname) childArgs.push("--tunnel", tunnelHostname);
 
   const out = fs.openSync(LOG_FILE, "a");
   const child = spawn(process.execPath, childArgs, {
@@ -1650,6 +2163,7 @@ async function actionRestart(opts) {
 async function actionForeground(opts) {
   const port      = parseInt(opts.port || "52437", 10);
   const password  = opts.pw || null;
+  const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())
     : null;
@@ -1671,10 +2185,19 @@ async function actionForeground(opts) {
   console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
   console.log(chalk.gray(`  Lockout:  3 failures → exit\n`));
 
-  const server = createServer(password, whitelist, port);
+  const server = createServer(password, whitelist, port, tunnelHostname);
   server.listen(port, "127.0.0.1", () => {
     writePid(process.pid, port);
     console.log(chalk.green(`  clauth serve → http://127.0.0.1:${port}`));
+    if (tunnelHostname) {
+      console.log(chalk.cyan(`  Tunnel:   https://${tunnelHostname}/sse`));
+      console.log("");
+      console.log(chalk.yellow("  ── claude.ai Custom Connector ──"));
+      console.log(chalk.white(`  URL:            https://${tunnelHostname}/mcp`));
+      console.log(chalk.white(`  Client ID:      ${server.__oauthClientId}`));
+      console.log(chalk.white(`  Client Secret:  ${server.__oauthClientSecret}`));
+      console.log(chalk.gray("  (paste these into Advanced Settings when adding the connector)"));
+    }
     if (!password) console.log(chalk.cyan(`  👉 Open http://127.0.0.1:${port} to unlock`));
     console.log(chalk.gray("  Ctrl+C to stop\n"));
     // Auto-open browser
@@ -1926,7 +2449,14 @@ async function handleMcpTool(vault, name, args) {
           };
         }
 
-        // Default: file
+        // Remote caller (claude.ai via tunnel) — can't read local temp files
+        // Return value inline in MCP response (safe: stays in AI context, not a shell transcript)
+        if (vault.remote) {
+          const envVar = ENV_MAP[service] || service.toUpperCase().replace(/-/g, "_");
+          return mcpResult(`${envVar}=${value}`);
+        }
+
+        // Default: file (local callers)
         const envVar = ENV_MAP[service] || service.toUpperCase().replace(/-/g, "_");
         const filePath = writeTempSecret(service, value);
         return mcpResult(`${service} → ${filePath} (auto-deletes in 30s)\nEnv var: ${envVar}\nUsage: export ${envVar}=$(cat ${filePath.replace(/\\/g, "/")})`);
@@ -1962,6 +2492,14 @@ async function handleMcpTool(vault, name, args) {
 
       if (!lines.length) return mcpError(`No services retrieved:\n${errors.join("\n")}`);
 
+      // Remote caller — return env vars inline
+      if (vault.remote) {
+        let msg = lines.join("\n");
+        if (errors.length) msg += `\n\nErrors:\n${errors.join("\n")}`;
+        return mcpResult(msg);
+      }
+
+      // Local caller — write temp env file
       const envFilePath = path.join(os.tmpdir(), ".clauth-env");
       fs.writeFileSync(envFilePath, lines.join("\n") + "\n", { mode: 0o600 });
       setTimeout(() => { try { fs.unlinkSync(envFilePath); } catch {} }, 30_000);
@@ -2048,7 +2586,7 @@ function createMcpServer(initPassword, whitelist) {
     get machineHash() { return ensureMachineHash(); },
     whitelist,
     failCount: 0,
-    MAX_FAILS: 3,
+    MAX_FAILS: 10,
   };
 
   const rl = createInterface({ input: process.stdin, terminal: false });
@@ -2137,6 +2675,98 @@ async function actionMcp(opts) {
   createMcpServer(password, whitelist);
 }
 
+// ── DPAPI auto-start install / uninstall (Windows only) ──────
+const AUTOSTART_DIR  = path.join(os.homedir(), "AppData", "Roaming", "clauth");
+const BOOT_KEY_PATH  = path.join(AUTOSTART_DIR, "boot.key");
+const PS_SCRIPT_PATH = path.join(AUTOSTART_DIR, "autostart.ps1");
+const TASK_NAME      = "ClauthAutostart";
+
+async function actionInstall(opts) {
+  if (os.platform() !== "win32") {
+    console.log(chalk.red("\n  serve install is only supported on Windows\n"));
+    process.exit(1);
+  }
+
+  const { default: inquirer } = await import("inquirer");
+  const { pw } = await inquirer.prompt([{
+    type: "password", name: "pw",
+    message: "Enter clauth password to store for auto-start:", mask: "*"
+  }]);
+
+  fs.mkdirSync(AUTOSTART_DIR, { recursive: true });
+
+  // Encrypt password with Windows DPAPI (CurrentUser scope — machine+user bound)
+  const spinner = ora("Encrypting password with Windows DPAPI...").start();
+  let encrypted;
+  try {
+    const { execSync } = await import("child_process");
+    const pwEscaped = pw.replace(/'/g, "''");
+    const psExpr = `[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes('${pwEscaped}'),$null,'CurrentUser'))`;
+    encrypted = execSync(`powershell -NoProfile -Command "${psExpr}"`, { encoding: "utf8" }).trim();
+    fs.writeFileSync(BOOT_KEY_PATH, encrypted, "utf8");
+    spinner.succeed(chalk.green("Password encrypted → boot.key"));
+  } catch (err) {
+    spinner.fail(chalk.red(`DPAPI encryption failed: ${err.message}`));
+    process.exit(1);
+  }
+
+  // Write PowerShell autostart script — decrypts boot.key and pipes to clauth serve start
+  const cliEntry = path.resolve(__dirname, "../index.js").replace(/\\/g, "\\\\");
+  const nodeExe  = process.execPath.replace(/\\/g, "\\\\");
+  const bootKey  = BOOT_KEY_PATH.replace(/\\/g, "\\\\");
+  const psScript = [
+    "# clauth autostart — generated by clauth serve install",
+    `$enc = (Get-Content '${bootKey}' -Raw).Trim()`,
+    `$pw = [Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String($enc),$null,'CurrentUser'))`,
+    `Start-Process '${nodeExe}' -ArgumentList "'${cliEntry}' serve start -p $pw" -WindowStyle Hidden`,
+  ].join("\n");
+  fs.writeFileSync(PS_SCRIPT_PATH, psScript, "utf8");
+
+  // Register Windows Scheduled Task — triggers on user logon
+  const spinner2 = ora("Registering Windows Scheduled Task...").start();
+  try {
+    const { execSync } = await import("child_process");
+    const psScriptEsc = PS_SCRIPT_PATH.replace(/\\/g, "\\\\");
+    const args = `-NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "${psScriptEsc}"`;
+    execSync(
+      `schtasks /create /f /tn "${TASK_NAME}" /sc onlogon /tr "powershell.exe ${args}"`,
+      { encoding: "utf8", stdio: "pipe" }
+    );
+    spinner2.succeed(chalk.green(`Scheduled Task "${TASK_NAME}" registered`));
+  } catch (err) {
+    spinner2.fail(chalk.yellow(`Scheduled task failed (non-fatal): ${err.message}`));
+    console.log(chalk.gray("  You can still start manually: clauth serve start"));
+  }
+
+  console.log(chalk.cyan("\n  Auto-start installed:\n"));
+  console.log(chalk.gray(`  boot.key:  ${BOOT_KEY_PATH}`));
+  console.log(chalk.gray(`  script:    ${PS_SCRIPT_PATH}`));
+  console.log(chalk.gray(`  task:      ${TASK_NAME}\n`));
+  console.log(chalk.green("  Daemon will auto-start on next Windows login.\n"));
+}
+
+async function actionUninstall() {
+  if (os.platform() !== "win32") {
+    console.log(chalk.red("\n  serve uninstall is only supported on Windows\n"));
+    process.exit(1);
+  }
+  const { execSync } = await import("child_process");
+
+  // Remove scheduled task
+  try {
+    execSync(`schtasks /delete /f /tn "${TASK_NAME}"`, { encoding: "utf8", stdio: "pipe" });
+    console.log(chalk.green(`  Removed Scheduled Task: ${TASK_NAME}`));
+  } catch { console.log(chalk.gray(`  Task not found (already removed): ${TASK_NAME}`)); }
+
+  // Remove boot.key and autostart script
+  for (const f of [BOOT_KEY_PATH, PS_SCRIPT_PATH]) {
+    try { fs.unlinkSync(f); console.log(chalk.green(`  Deleted: ${f}`)); }
+    catch { console.log(chalk.gray(`  Not found (skipped): ${f}`)); }
+  }
+
+  console.log(chalk.cyan("\n  Auto-start uninstalled.\n"));
+}
+
 // ── Export ────────────────────────────────────────────────────
 export async function runServe(opts) {
   const action = opts.action || "foreground";
@@ -2148,9 +2778,11 @@ export async function runServe(opts) {
     case "ping":       return actionPing();
     case "foreground": return actionForeground(opts);
     case "mcp":        return actionMcp(opts);
+    case "install":    return actionInstall(opts);
+    case "uninstall":  return actionUninstall();
     default:
       console.log(chalk.red(`\n  Unknown serve action: ${action}`));
-      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp\n"));
+      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp | install | uninstall\n"));
       process.exit(1);
   }
 }

package/cli/fingerprint.js

@@ -15,16 +15,18 @@ function getMachineId() {
 
   try {
     if (platform === "win32") {
-      // Primary: BIOS UUID via WMIC
-      const uuid = execSync("wmic csproduct get uuid /format:value", {
-        encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"]
-      }).match(/UUID=([A-F0-9-]+)/i)?.[1]?.trim();
+      // Primary: BIOS UUID via PowerShell (wmic removed in Win11 26xxx+)
+      const psPath = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
+      const uuid = execSync(
+        `${psPath} -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"`,
+        { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }
+      ).trim();
 
-      // Secondary: Windows MachineGuid from registry
+      // Secondary: Windows MachineGuid from registry (via PowerShell for Win11 compat)
       const machineGuid = execSync(
-        "reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid",
+        `${psPath} -NoProfile -Command "(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Cryptography').MachineGuid"`,
         { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] }
-      ).match(/MachineGuid\s+REG_SZ\s+([a-f0-9-]+)/i)?.[1]?.trim();
+      ).trim();
 
       if (!uuid || !machineGuid) throw new Error("Could not read Windows machine IDs");
       return { primary: uuid, secondary: machineGuid, platform: "win32" };

package/cli/index.js

@@ -12,7 +12,7 @@ import * as api from "./api.js";
 import os from "os";
 
 const config = new Conf(getConfOptions());
-const VERSION = "0.5.2";
+const VERSION = "0.7.0";
 
 // ============================================================
 // Password prompt helper
@@ -464,10 +464,11 @@ program.addHelpText("beforeAll", chalk.cyan(`
 // ──────────────────────────────────────────────
 program
   .command("serve [action]")
-  .description("Manage localhost HTTP vault daemon (start|stop|restart|ping)")
+  .description("Manage localhost HTTP vault daemon (start|stop|restart|ping|install|uninstall)")
   .option("--port <n>", "Port (default: 52437)")
   .option("-p, --pw <password>", "clauth password (optional — omit to start locked, unlock in browser)")
   .option("--services <list>", "Comma-separated service whitelist (default: all)")
+  .option("--tunnel <hostname>", "Fixed tunnel hostname (e.g. clauth.prtrust.fund) — uses named Cloudflare Tunnel instead of random URL")
   .option("--action <action>", "Internal: action override for daemon child")
   .addHelpText("after", `
 Actions:
@@ -477,6 +478,8 @@ Actions:
   ping        Check if the daemon is running
   foreground  Run in foreground (Ctrl+C to stop) — default if no action given
   mcp         Run as MCP stdio server for Claude Code (JSON-RPC over stdin/stdout)
+  install     (Windows) Encrypt password with DPAPI + create Scheduled Task for auto-start on login
+  uninstall   (Windows) Remove Scheduled Task + delete boot.key
 
 MCP SSE (built into start/foreground):
   The HTTP daemon also serves MCP SSE transport at GET /sse + POST /message.
@@ -491,6 +494,8 @@ Examples:
   clauth serve start --services github,vercel
   clauth serve mcp                       Start MCP server for Claude Code
   clauth serve mcp -p mypass             Start MCP server pre-unlocked
+  clauth serve install                   (Windows) Set up auto-start on login via DPAPI
+  clauth serve uninstall                 (Windows) Remove auto-start
 `)
   .action(async (action, opts) => {
     const resolvedAction = opts.action || action || "foreground";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "0.5.2",
+  "version": "0.7.3",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {