@lifeaitools/clauth 1.5.8 → 1.5.9

package/cli/commands/serve.js

@@ -2870,13 +2870,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     // ── OAuth Discovery (RFC 9728 + RFC 8414) ──────────────
-    if (reqPath === "/.well-known/oauth-protected-resource" ||
-        reqPath === "/.well-known/oauth-protected-resource/mcp" ||
-        reqPath === "/.well-known/oauth-protected-resource/sse") {
+    if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
       const base = oauthBase();
+      // Derive resource URL from the well-known path suffix
+      // /.well-known/oauth-protected-resource       → /mcp
+      // /.well-known/oauth-protected-resource/mcp   → /mcp
+      // /.well-known/oauth-protected-resource/gws   → /gws
+      // /.well-known/oauth-protected-resource/clauth → /clauth
+      const suffix = reqPath.replace("/.well-known/oauth-protected-resource", "").replace(/^\//, "") || "mcp";
+      const resourcePath = suffix === "sse" ? "mcp" : suffix;
       res.writeHead(200, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify({
-        resource: `${base}/mcp`,
+        resource: `${base}/${resourcePath}`,
         authorization_servers: [base],
         scopes_supported: ["mcp:tools"],
         bearer_methods_supported: ["header"],
@@ -3037,6 +3042,21 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // fall through to MCP handling below
     }
 
+    // For namespaced paths, send path-specific 401 so claude.ai fetches the right resource metadata
+    if (method === "POST" && (reqPath === "/gws" || reqPath === "/clauth")) {
+      const authHeader = req.headers.authorization;
+      if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        const base = oauthBase();
+        const pathName = reqPath.slice(1); // "gws" or "clauth"
+        res.writeHead(401, {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/${pathName}"`,
+          ...CORS,
+        });
+        return res.end(JSON.stringify({ error: "unauthorized" }));
+      }
+    }
+
     // ── MCP Streamable HTTP transport (2025-03-26 spec) ──
     // POST /sse, /mcp, /gws, /clauth — JSON-RPC over HTTP
     if (method === "POST" && (reqPath === "/sse" || isMcpPath)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.8",
+  "version": "1.5.9",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {