@lifeaitools/clauth 1.5.11 → 1.5.12

package/cli/commands/serve.js

@@ -2472,7 +2472,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   const CORS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
 
   // ── MCP SSE session tracking ──────────────────────────────
@@ -3033,6 +3033,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // POST /mcp|/gws|/clauth — requires Bearer token; returns 401 to trigger OAuth flow
     if (method === "POST" && isMcpPath) {
       const authHeader = req.headers.authorization;
+      // Detailed auth logging — helps diagnose claude.ai post-token failures
+      const authLogMsg = [
+        `[${new Date().toISOString()}] MCP POST ${reqPath}`,
+        `  Authorization: ${authHeader ? (authHeader.startsWith("Bearer ") ? `Bearer ${authHeader.slice(7, 15)}… (known=${oauthTokens.has(authHeader.slice(7))})` : authHeader.slice(0, 30) + "…") : "(none)"}`,
+        `  mcp-protocol-version: ${req.headers["mcp-protocol-version"] || "(not set)"}`,
+        `  accept: ${req.headers["accept"] || "(not set)"}`,
+        `  x-forwarded-for: ${req.headers["x-forwarded-for"] || "(not set)"}`,
+      ].join("\n") + "\n";
+      try { fs.appendFileSync(LOG_FILE, authLogMsg); } catch {}
+
       if (!authHeader || !authHeader.startsWith("Bearer ")) {
         const base = oauthBase();
         // Path-specific resource metadata URL so claude.ai gets the right resource URI
@@ -3046,6 +3056,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const token = authHeader.slice(7);
       if (!oauthTokens.has(token)) {
+        const badTokenLog = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool size=${oauthTokens.size})\n`;
+        try { fs.appendFileSync(LOG_FILE, badTokenLog); } catch {}
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid_token" }));
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.11",
+  "version": "1.5.12",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {

package/supabase/functions/auth-vault/index.ts

@@ -169,7 +169,7 @@ async function handleRevoke(sb: any, body: any, mh: string) {
 
 async function handleStatus(sb: any, body: any, mh: string) {
   let q = sb.from("clauth_services")
-    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at, project")
+    .select("name, label, key_type, enabled, vault_key, last_retrieved, last_rotated, created_at, project, description")
     .order("project", { ascending: true, nullsFirst: true })
     .order("name");
   if (body.project) q = q.eq("project", body.project);