@lifeaitools/clauth 1.5.16 → 1.5.17

package/cli/commands/serve.js

@@ -2878,40 +2878,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end();
     }
 
-    // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
-    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
-      // Only advertise OAuth for /mcp — /gws and /clauth are open (no OAuth).
-      // Advertising OAuth on open paths causes claude.ai to do an OAuth dance,
-      // get a token, then have no retry context (since the original 200 wasn't a 401).
-      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "") || "mcp";
-      if (suffix !== "mcp" && suffix !== "") {
-        // Path-specific OAuth metadata requested for a non-mcp path — 404 it
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
-      const base = oauthBase();
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        resource: `${base}/mcp`,
-        authorization_servers: [base],
-        scopes_supported: ["mcp:tools"],
-        bearer_methods_supported: ["header"],
-      }));
-    }
-
-    if (reqPath === "/.well-known/oauth-authorization-server") {
-      const base = oauthBase();
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({
-        issuer: base,
-        authorization_endpoint: `${base}/authorize`,
-        token_endpoint: `${base}/token`,
-        registration_endpoint: `${base}/register`,
-        response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
-        code_challenge_methods_supported: ["S256"],
-        scopes_supported: ["mcp:tools"],
-      }));
+    // ── OAuth Discovery — disabled (causes claude.ai OAuth loop) ──────────────
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource") ||
+        reqPath === "/.well-known/oauth-authorization-server") {
+      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({ error: "not_found" }));
     }
 
     // ── Dynamic Client Registration (RFC 7591) ──────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.16",
+  "version": "1.5.17",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {