@lifeaitools/clauth 1.5.15 → 1.5.17

package/cli/commands/serve.js

@@ -2878,40 +2878,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end();
     }
 
-    // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
-    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
-      // Only advertise OAuth for /mcp — /gws and /clauth are open (no OAuth).
-      // Advertising OAuth on open paths causes claude.ai to do an OAuth dance,
-      // get a token, then have no retry context (since the original 200 wasn't a 401).
-      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "") || "mcp";
-      if (suffix !== "mcp" && suffix !== "") {
-        // Path-specific OAuth metadata requested for a non-mcp path — 404 it
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
-      const base = oauthBase();
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        resource: `${base}/mcp`,
-        authorization_servers: [base],
-        scopes_supported: ["mcp:tools"],
-        bearer_methods_supported: ["header"],
-      }));
-    }
-
-    if (reqPath === "/.well-known/oauth-authorization-server") {
-      const base = oauthBase();
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        issuer: base,
-        authorization_endpoint: `${base}/authorize`,
-        token_endpoint: `${base}/token`,
-        registration_endpoint: `${base}/register`,
-        response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
-        code_challenge_methods_supported: ["S256"],
-        scopes_supported: ["mcp:tools"],
-      }));
+    // ── OAuth Discovery — disabled (causes claude.ai OAuth loop) ──────────────
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource") ||
+        reqPath === "/.well-known/oauth-authorization-server") {
+      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ error: "not_found" }));
     }
 
     // ── Dynamic Client Registration (RFC 7591) ──────────────
@@ -3071,16 +3042,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
 
       if (rpcMethod === "initialize") {
-        // Echo back the client's requested protocol version (negotiate down if needed)
-        const clientVersion = req.headers["mcp-protocol-version"] || body.params?.protocolVersion || "2025-03-26";
-        const SUPPORTED = ["2025-11-25", "2025-03-26"];
-        const protocolVersion = SUPPORTED.includes(clientVersion) ? clientVersion : "2025-03-26";
+        // Always return 2025-03-26 — returning 2025-11-25 causes claude.ai to require OAuth
         const result = {
-          protocolVersion,
+          protocolVersion: "2025-03-26",
           serverInfo: { name: serverNameForPath(reqPath), version: VERSION },
           capabilities: { tools: {} }
         };
-        res.writeHead(200, { "Content-Type": "application/json", "mcp-protocol-version": protocolVersion, ...CORS });
+        res.writeHead(200, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ jsonrpc: "2.0", id, result }));
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.15",
+  "version": "1.5.17",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {