@lifeaitools/clauth 1.5.17 → 1.5.19

package/cli/commands/serve.js

@@ -2878,11 +2878,33 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end();
     }
 
-    // ── OAuth Discovery — disabled (causes claude.ai OAuth loop) ──────────────
-    if (reqPath.startsWith("/.well-known/oauth-protected-resource") ||
-        reqPath === "/.well-known/oauth-authorization-server") {
-      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ error: "not_found" }));
+    // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
+    // claude.ai probes these for ALL remote MCP connections.
+    // resource MUST match the connector URL configured in claude.ai (/sse).
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
+      const base = oauthBase();
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({
+        resource: `${base}/sse`,
+        authorization_servers: [base],
+        scopes_supported: ["mcp:tools"],
+        bearer_methods_supported: ["header"],
+      }));
+    }
+
+    if (reqPath === "/.well-known/oauth-authorization-server") {
+      const base = oauthBase();
+      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify({
+        issuer: base,
+        authorization_endpoint: `${base}/authorize`,
+        token_endpoint: `${base}/token`,
+        registration_endpoint: `${base}/register`,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code"],
+        code_challenge_methods_supported: ["S256"],
+        scopes_supported: ["mcp:tools"],
+      }));
     }
 
     // ── Dynamic Client Registration (RFC 7591) ──────────────
@@ -2982,7 +3004,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       oauthTokens.add(accessToken);
       saveTokens(oauthTokens);
 
-      const logMsg = `[${new Date().toISOString()}] OAuth: token issued for client ${stored.client_id}\n`;
+      const logMsg = `[${new Date().toISOString()}] OAuth: token issued for client ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400 }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.17",
+  "version": "1.5.19",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {