@lifeaitools/clauth 1.5.59 → 1.5.60

package/cli/commands/serve.js

@@ -4807,6 +4807,39 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
     }
 
+    // POST /generate-token — generate a cryptographically random bearer token and store it
+    if (method === "POST" && reqPath === "/generate-token") {
+      if (lockedGuard(res)) return;
+
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
+      }
+
+      const service = (body.service || "").trim().toLowerCase();
+      const prefix = body.prefix || "";
+      if (!service) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "service name required" }));
+      }
+
+      if (whitelist && !whitelist.includes(service)) {
+        return strike(res, 403, `Service '${service}' not in whitelist`);
+      }
+
+      try {
+        const randomHex = crypto.randomBytes(32).toString("hex");
+        const token = `${prefix}${randomHex}`;
+        const { token: authToken, timestamp } = deriveToken(password, machineHash);
+        const result = await api.write(password, machineHash, authToken, timestamp, service, token);
+        if (result.error) return strike(res, 502, result.error);
+        return ok(res, { token, service, stored: true });
+      } catch (err) {
+        return strike(res, 502, err.message);
+      }
+    }
+
     // POST /add-service — register a new service in the vault
     if (method === "POST" && reqPath === "/add-service") {
       if (lockedGuard(res)) return;
@@ -5738,6 +5771,19 @@ const MCP_TOOLS = [
     description: "Test whether the clauth MCP connector is reachable via the Cloudflare tunnel. Returns connectivity status and tunnel URL.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false }
   },
+  {
+    name: "clauth_generate_token",
+    description: "Generate a cryptographically random bearer token and store it as a clauth service value",
+    inputSchema: {
+      type: "object",
+      properties: {
+        service: { type: "string", description: "Service name to store the token under (e.g. web-research-api)" },
+        prefix: { type: "string", description: "Token prefix (e.g. rdc_wr_). Default: empty string" }
+      },
+      required: ["service"],
+      additionalProperties: false
+    }
+  },
   {
     name: "monkey_dispatch",
     description: "Dispatch a skill job to a headless Claude Code CLI worker. Spawns claude -p with the given prompt in C:/Dev/regen-root. Max 2 concurrent workers.",
@@ -6394,6 +6440,23 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(results.join("\n"));
     }
 
+    case "clauth_generate_token": {
+      if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
+      const service = (args.service || "").trim().toLowerCase();
+      const prefix = args.prefix || "";
+      if (!service) return mcpError("service name is required");
+      try {
+        const randomHex = crypto.randomBytes(32).toString("hex");
+        const generatedToken = `${prefix}${randomHex}`;
+        const { token: authToken, timestamp } = deriveToken(vault.password, vault.machineHash);
+        const result = await api.write(vault.password, vault.machineHash, authToken, timestamp, service, generatedToken);
+        if (result.error) return mcpError(result.error);
+        return mcpResult(`Token generated and stored under "${service}": ${generatedToken}`);
+      } catch (err) {
+        return mcpError(`generate_token failed: ${err.message}`);
+      }
+    }
+
     // ── Google Workspace (gws CLI) ───────────────────────────────────────
     case "gws_run": {
       const { service, resource, sub_resource, method, params, body } = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.59",
+  "version": "1.5.60",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {