@lifeaitools/clauth 1.5.23 → 1.5.25

package/cli/commands/serve.js

@@ -847,12 +847,12 @@ function dashboardHtml(port, whitelist, isStaged = false) {
     <div class="mcp-setup-title">claude.ai MCP Integration</div>
     <div class="oauth-fields">
       <div class="mcp-row">
-        <span class="mcp-label">URL (all tools)</span>
+        <span class="mcp-label">Clauth</span>
         <span class="mcp-val" id="mcp-url">—</span>
         <button class="mcp-copy" onclick="copyMcp('mcp-url')">copy</button>
       </div>
       <div class="mcp-row">
-        <span class="mcp-label">URL (GWS only)</span>
+        <span class="mcp-label">GWS</span>
         <span class="mcp-val" id="mcp-gws-url">—</span>
         <button class="mcp-copy" onclick="copyMcp('mcp-gws-url')">copy</button>
       </div>
@@ -2330,18 +2330,24 @@ async function wizRunCreateTunnel() {
 // Step: MCP setup in claude.ai
 async function wizShowMcpSetup(hostname) {
   wizStep = "mcp_setup";
-  const sseUrl = \`https://\${hostname}/sse\`;
+  const clauthUrl = \`https://\${hostname}/clauth\`;
+  const gwsUrl = \`https://\${hostname}/gws\`;
 
   const mcpData = await apiFetch("/mcp-setup");
 
   renderWizBody(\`
-    <div class="wiz-desc">Add clauth as an MCP server in claude.ai settings. Paste these values:</div>
+    <div class="wiz-desc">Add two MCP connectors in claude.ai — one for Clauth, one for GWS:</div>
     <div style="display:flex;flex-direction:column;gap:8px;margin-top:10px">
       <div class="mcp-row">
-        <span class="mcp-label">URL</span>
-        <span class="mcp-val" id="wiz-mcp-url">\${sseUrl}</span>
+        <span class="mcp-label">Clauth URL</span>
+        <span class="mcp-val" id="wiz-mcp-url">\${clauthUrl}</span>
         <button class="mcp-copy" onclick="wizCopy('wiz-mcp-url',this)">copy</button>
       </div>
+      <div class="mcp-row">
+        <span class="mcp-label">GWS URL</span>
+        <span class="mcp-val" id="wiz-mcp-gws">\${gwsUrl}</span>
+        <button class="mcp-copy" onclick="wizCopy('wiz-mcp-gws',this)">copy</button>
+      </div>
       <div class="mcp-row">
         <span class="mcp-label">Client ID</span>
         <span class="mcp-val" id="wiz-mcp-cid">\${mcpData?.clientId || '(unlock required)'}</span>
@@ -2357,7 +2363,7 @@ async function wizShowMcpSetup(hostname) {
       Paste into <a class="wiz-link" href="https://claude.ai/settings/integrations" target="_blank">claude.ai → Settings → Integrations</a>
     </div>
     <div style="margin-top:8px;font-size:.78rem;color:#64748b">
-      GWS connector: use <code style="color:#60a5fa">https://\${hostname}/gws</code> as URL (same Client ID/Secret)
+      Same Client ID/Secret for both connectors.
     </div>
   \`, [], [
     \`<button class="btn-wiz-primary" onclick="window.open('https://claude.ai/settings/integrations','_blank');wizShowTest()">I've Added It — Test Now</button>\`,
@@ -2937,7 +2943,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
       const base = oauthBase();
       const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "");
-      const resourcePath = suffix && ["/gws", "/clauth", "/mcp", "/sse"].includes("/" + suffix) ? "/" + suffix : "/sse";
+      const resourcePath = suffix && ["/gws", "/clauth", "/mcp", "/sse"].includes("/" + suffix) ? "/" + suffix : "/clauth";
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify({
         resource: `${base}${resourcePath}`,
@@ -2956,7 +2962,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         token_endpoint: `${base}/token`,
         registration_endpoint: `${base}/register`,
         response_types_supported: ["code"],
-        grant_types_supported: ["authorization_code"],
+        grant_types_supported: ["authorization_code", "client_credentials"],
         code_challenge_methods_supported: ["S256"],
         scopes_supported: ["mcp:tools"],
       }));
@@ -3032,6 +3038,23 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "invalid_request" }));
       }
 
+      // client_credentials grant — skip authorize/redirect, just issue token from client_id+secret
+      if (body.grant_type === "client_credentials") {
+        const cid = body.client_id;
+        const csec = body.client_secret;
+        if (cid === OAUTH_CLIENT_ID && csec === OAUTH_CLIENT_SECRET) {
+          const accessToken = crypto.randomBytes(32).toString("hex");
+          oauthTokens.add(accessToken);
+          saveTokens(oauthTokens);
+          const logMsg = `[${new Date().toISOString()}] OAuth: client_credentials token issued for ${cid.slice(0,8)}… (token=${accessToken.slice(0,8)}…)\n`;
+          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+          res.writeHead(200, { "Content-Type": "application/json", ...CORS });
+          return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400, scope: "mcp:tools" }));
+        }
+        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_client" }));
+      }
+
       if (body.grant_type !== "authorization_code") {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "unsupported_grant_type" }));
@@ -3108,15 +3131,20 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           return res.end(JSON.stringify({ error: "unauthorized" }));
         }
         const token = authHeader.slice(7);
-        if (!oauthTokens.has(token)) {
-          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size})\n`;
+        // Accept: OAuth-issued tokens OR the stable client_secret directly
+        const isValidToken = oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET;
+        if (!isValidToken) {
+          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size}, secret=${token === OAUTH_CLIENT_SECRET})\n`;
           try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_token" }));
         }
         req._clauthRemote = true;
-      } else if (authHeader?.startsWith("Bearer ") && oauthTokens.has(authHeader.slice(7))) {
-        req._clauthRemote = true;
+      } else if (authHeader?.startsWith("Bearer ")) {
+        const token = authHeader.slice(7);
+        if (oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET) {
+          req._clauthRemote = true;
+        }
       }
       // fall through to MCP handling
     }
@@ -3194,7 +3222,8 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           });
           return res.end(JSON.stringify({ error: "unauthorized" }));
         }
-        if (!oauthTokens.has(authHeader.slice(7))) {
+        const sseToken = authHeader.slice(7);
+        if (!oauthTokens.has(sseToken) && sseToken !== OAUTH_CLIENT_SECRET) {
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "invalid_token" }));
         }
@@ -3365,7 +3394,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     if (method === "GET" && reqPath === "/mcp-setup") {
       const base = tunnelUrl && tunnelUrl.startsWith("http") ? tunnelUrl : null;
       return ok(res, {
-        url: base ? `${base}/sse` : null,
+        url: base ? `${base}/clauth` : null,
         gwsUrl: base ? `${base}/gws` : null,
         clientId: OAUTH_CLIENT_ID,
         clientSecret: OAUTH_CLIENT_SECRET,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.23",
+  "version": "1.5.25",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {