@lifeaitools/clauth 1.5.65 → 1.5.66

package/cli/commands/serve.js

@@ -3252,11 +3252,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // ── MCP SSE transport — /sse and namespaced paths ────
     // GET /sse|/gws|/clauth — open SSE stream, receive endpoint event
-    // Remote clients (claude.ai) use Streamable HTTP (POST only) — return 404 on GET
-    // so claude.ai knows to POST directly rather than trying SSE transport.
-    if (method === "GET" && isMcpPath && req._clauthRemote) {
-      res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ error: "Use POST for Streamable HTTP transport" }));
+    // Remote clients (claude.ai) arrive with a Bearer token via OAuth.
+    // They use Streamable HTTP (POST only) — return 405 on GET so claude.ai
+    // knows to POST directly. Local clients have no Bearer token and use SSE.
+    if (method === "GET" && isMcpPath) {
+      const getAuthHeader = req.headers.authorization;
+      const getToken = getAuthHeader?.startsWith("Bearer ") ? getAuthHeader.slice(7) : null;
+      if (!noAuthHost && getToken && oauthTokens.has(getToken)) {
+        res.writeHead(405, { "Content-Type": "application/json", "Allow": "POST", ...CORS });
+        return res.end(JSON.stringify({ error: "Method Not Allowed", detail: "Use POST for Streamable HTTP transport" }));
+      }
     }
     if (method === "GET" && (reqPath === "/sse" || isMcpPath)) {
       const sessionId = `ses_${++sseCounter}_${Date.now()}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.65",
+  "version": "1.5.66",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {