@lifeaitools/clauth 1.5.20 → 1.5.22

package/cli/commands/serve.js

@@ -2506,8 +2506,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   const oauthClients = new Map();   // client_id → { client_secret, redirect_uris, client_name }
   const oauthCodes = new Map();     // code → { client_id, redirect_uri, code_challenge, expires }
 
-  // Persist tokens to disk so daemon restarts don't invalidate claude.ai sessions
+  // Persist tokens + credentials to disk so daemon restarts don't invalidate sessions
   const TOKENS_FILE = path.join(os.tmpdir(), "clauth-oauth-tokens.json");
+  const CREDS_FILE = path.join(os.tmpdir(), "clauth-oauth-creds.json");
   function loadTokens() {
     try { return new Set(JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"))); } catch { return new Set(); }
   }
@@ -2516,9 +2517,22 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
   }
   const oauthTokens = loadTokens(); // active access tokens — persisted across restarts
 
-  // Pre-generate a stable client for claude.ai (shown at startup)
-  const OAUTH_CLIENT_ID = crypto.randomBytes(16).toString("hex");
-  const OAUTH_CLIENT_SECRET = crypto.randomBytes(32).toString("hex");
+  // Stable client credentials — persist across restarts so claude.ai custom setup works
+  function loadOrCreateCreds() {
+    try {
+      const saved = JSON.parse(fs.readFileSync(CREDS_FILE, "utf8"));
+      if (saved.client_id && saved.client_secret) return saved;
+    } catch {}
+    const creds = {
+      client_id: crypto.randomBytes(16).toString("hex"),
+      client_secret: crypto.randomBytes(32).toString("hex"),
+    };
+    try { fs.writeFileSync(CREDS_FILE, JSON.stringify(creds)); } catch {}
+    return creds;
+  }
+  const stableCreds = loadOrCreateCreds();
+  const OAUTH_CLIENT_ID = stableCreds.client_id;
+  const OAUTH_CLIENT_SECRET = stableCreds.client_secret;
   oauthClients.set(OAUTH_CLIENT_ID, {
     client_id: OAUTH_CLIENT_ID, client_secret: OAUTH_CLIENT_SECRET,
     client_name: "claude.ai", redirect_uris: ["https://claude.ai/api/mcp/auth_callback"],
@@ -2880,12 +2894,17 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
     // claude.ai probes these for ALL remote MCP connections.
-    // resource MUST match the connector URL configured in claude.ai (/sse).
+    // resource MUST match the connector URL configured in claude.ai.
+    // /.well-known/oauth-protected-resource/gws → resource=/gws
+    // /.well-known/oauth-protected-resource/sse → resource=/sse
+    // /.well-known/oauth-protected-resource     → resource=/sse (default)
     if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
       const base = oauthBase();
+      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "");
+      const resourcePath = suffix && ["/gws", "/clauth", "/mcp", "/sse"].includes("/" + suffix) ? "/" + suffix : "/sse";
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify({
-        resource: `${base}/sse`,
+        resource: `${base}${resourcePath}`,
         authorization_servers: [base],
         scopes_supported: ["mcp:tools"],
         bearer_methods_supported: ["header"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.20",
+  "version": "1.5.22",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {