@lifeaitools/clauth 1.5.7 → 1.5.9

package/cli/commands/serve.js

@@ -2870,13 +2870,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
-    if (reqPath === "/.well-known/oauth-protected-resource" ||
-        reqPath === "/.well-known/oauth-protected-resource/mcp" ||
-        reqPath === "/.well-known/oauth-protected-resource/sse") {
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
       const base = oauthBase();
+      // Derive resource URL from the well-known path suffix
+      // /.well-known/oauth-protected-resource       → /mcp
+      // /.well-known/oauth-protected-resource/mcp   → /mcp
+      // /.well-known/oauth-protected-resource/gws   → /gws
+      // /.well-known/oauth-protected-resource/clauth → /clauth
+      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "") || "mcp";
+      const resourcePath = suffix === "sse" ? "mcp" : suffix;
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify({
-        resource: `${base}/mcp`,
+        resource: `${base}/${resourcePath}`,
         authorization_servers: [base],
         scopes_supported: ["mcp:tools"],
         bearer_methods_supported: ["header"],
@@ -3000,9 +3005,23 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", expires_in: 86400 }));
     }
 
+    // ── MCP path helpers ──
+    const MCP_PATHS = ["/mcp", "/gws", "/clauth"];
+    const isMcpPath = MCP_PATHS.includes(reqPath);
+    function toolsForPath(p) {
+      if (p === "/gws")    return MCP_TOOLS.filter(t => t.name.startsWith("gws_"));
+      if (p === "/clauth") return MCP_TOOLS.filter(t => t.name.startsWith("clauth_"));
+      return MCP_TOOLS; // /mcp — all tools
+    }
+    function serverNameForPath(p) {
+      if (p === "/gws")    return "gws";
+      if (p === "/clauth") return "clauth";
+      return "clauth";
+    }
+
     // ── MCP OAuth-protected endpoint (for claude.ai web) ──
-    // POST /mcp — requires Bearer token; returns 401 to trigger OAuth flow
-    if (method === "POST" && reqPath === "/mcp") {
+    // POST /mcp|/gws|/clauth — requires Bearer token; returns 401 to trigger OAuth flow
+    if (method === "POST" && isMcpPath) {
       const authHeader = req.headers.authorization;
       if (!authHeader || !authHeader.startsWith("Bearer ")) {
         const base = oauthBase();
@@ -3023,9 +3042,24 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // fall through to MCP handling below
     }
 
+    // For namespaced paths, send path-specific 401 so claude.ai fetches the right resource metadata
+    if (method === "POST" && (reqPath === "/gws" || reqPath === "/clauth")) {
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        const base = oauthBase();
+        const pathName = reqPath.slice(1); // "gws" or "clauth"
+        res.writeHead(401, {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/${pathName}"`,
+          ...CORS,
+        });
+        return res.end(JSON.stringify({ error: "unauthorized" }));
+      }
+    }
+
     // ── MCP Streamable HTTP transport (2025-03-26 spec) ──
-    // POST /sse or POST /mcp — JSON-RPC over HTTP
-    if (method === "POST" && (reqPath === "/sse" || reqPath === "/mcp")) {
+    // POST /sse, /mcp, /gws, /clauth — JSON-RPC over HTTP
+    if (method === "POST" && (reqPath === "/sse" || isMcpPath)) {
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -3034,7 +3068,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
       const id = body.id;
       const rpcMethod = body.method;
-      const logMsg = `[${new Date().toISOString()}] Streamable HTTP: ${rpcMethod} id=${id}\n`;
+      const logMsg = `[${new Date().toISOString()}] Streamable HTTP [${reqPath}]: ${rpcMethod} id=${id}\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
 
       // Notifications — no response needed
@@ -3046,7 +3080,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (rpcMethod === "initialize") {
         const result = {
           protocolVersion: "2025-03-26",
-          serverInfo: { name: "clauth", version: VERSION },
+          serverInfo: { name: serverNameForPath(reqPath), version: VERSION },
           capabilities: { tools: {} }
         };
         res.writeHead(200, { "Content-Type": "application/json", ...CORS });
@@ -3055,7 +3089,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
       if (rpcMethod === "tools/list") {
         res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: { tools: MCP_TOOLS } }));
+        return res.end(JSON.stringify({ jsonrpc: "2.0", id, result: { tools: toolsForPath(reqPath) } }));
       }
 
       if (rpcMethod === "tools/call") {
@@ -4321,7 +4355,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // Don't count browser noise, MCP discovery probes, or OAuth probes as auth failures
     const isBenign = reqPath.startsWith("/.well-known/") || [
       "/favicon.ico", "/robots.txt", "/apple-touch-icon.png", "/apple-touch-icon-precomposed.png",
-      "/sse", "/mcp", "/message", "/register", "/authorize", "/token", "/shutdown", "/restart",
+      "/sse", "/mcp", "/gws", "/clauth", "/message", "/register", "/authorize", "/token", "/shutdown", "/restart",
     ].includes(reqPath);
     if (isBenign) {
       res.writeHead(404, { "Content-Type": "application/json", ...CORS });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.7",
+  "version": "1.5.9",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {