@lifeaitools/clauth 1.5.10 → 1.5.12

package/cli/commands/serve.js

@@ -2472,7 +2472,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   const CORS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
 
   // ── MCP SSE session tracking ──────────────────────────────
@@ -2505,7 +2505,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   // ── OAuth provider (self-contained for claude.ai MCP) ──────
   const oauthClients = new Map();   // client_id → { client_secret, redirect_uris, client_name }
   const oauthCodes = new Map();     // code → { client_id, redirect_uri, code_challenge, expires }
-  const oauthTokens = new Set();    // active access tokens
+
+  // Persist tokens to disk so daemon restarts don't invalidate claude.ai sessions
+  const TOKENS_FILE = path.join(os.tmpdir(), "clauth-oauth-tokens.json");
+  function loadTokens() {
+    try { return new Set(JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"))); } catch { return new Set(); }
+  }
+  function saveTokens(set) {
+    try { fs.writeFileSync(TOKENS_FILE, JSON.stringify([...set])); } catch {}
+  }
+  const oauthTokens = loadTokens(); // active access tokens — persisted across restarts
 
   // Pre-generate a stable client for claude.ai (shown at startup)
   const OAUTH_CLIENT_ID = crypto.randomBytes(16).toString("hex");
@@ -2998,6 +3007,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       oauthCodes.delete(body.code);
       const accessToken = crypto.randomBytes(32).toString("hex");
       oauthTokens.add(accessToken);
+      saveTokens(oauthTokens);
 
       const logMsg = `[${new Date().toISOString()}] OAuth: token issued for client ${stored.client_id}\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
@@ -3023,6 +3033,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // POST /mcp|/gws|/clauth — requires Bearer token; returns 401 to trigger OAuth flow
     if (method === "POST" && isMcpPath) {
       const authHeader = req.headers.authorization;
+      // Detailed auth logging — helps diagnose claude.ai post-token failures
+      const authLogMsg = [
+        `[${new Date().toISOString()}] MCP POST ${reqPath}`,
+        `  Authorization: ${authHeader ? (authHeader.startsWith("Bearer ") ? `Bearer ${authHeader.slice(7, 15)}… (known=${oauthTokens.has(authHeader.slice(7))})` : authHeader.slice(0, 30) + "…") : "(none)"}`,
+        `  mcp-protocol-version: ${req.headers["mcp-protocol-version"] || "(not set)"}`,
+        `  accept: ${req.headers["accept"] || "(not set)"}`,
+        `  x-forwarded-for: ${req.headers["x-forwarded-for"] || "(not set)"}`,
+      ].join("\n") + "\n";
+      try { fs.appendFileSync(LOG_FILE, authLogMsg); } catch {}
+
       if (!authHeader || !authHeader.startsWith("Bearer ")) {
         const base = oauthBase();
         // Path-specific resource metadata URL so claude.ai gets the right resource URI
@@ -3036,6 +3056,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const token = authHeader.slice(7);
       if (!oauthTokens.has(token)) {
+        const badTokenLog = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool size=${oauthTokens.size})\n`;
+        try { fs.appendFileSync(LOG_FILE, badTokenLog); } catch {}
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid_token" }));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.10",
+  "version": "1.5.12",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {

package/supabase/functions/auth-vault/index.ts

@@ -169,7 +169,7 @@ async function handleRevoke(sb: any, body: any, mh: string) {
 
 async function handleStatus(sb: any, body: any, mh: string) {
   let q = sb.from("clauth_services")
-    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at, project")
+    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at, project, description")
     .order("project", { ascending: true, nullsFirst: true })
     .order("name");
   if (body.project) q = q.eq("project", body.project);