@lifeaitools/clauth 2.10.2 → 2.15.2

package/.clauth-skill/references/operator-guide.md

@@ -36,9 +36,10 @@ supabase db push
 This creates:
 - `clauth_services` — service registry (12 services seeded)
 - `clauth_machines` — machine fingerprint registry
-- `clauth_audit` — all operations logged
 - Vault helper RPCs (upsert/decrypt/delete/list)
 
+Also run `004_remove_audit_and_rate_limiting.sql` after the above (or `supabase db push`, which applies all migrations in order). `001_clauth_schema.sql` still creates a `clauth_audit` table as part of its original, unedited history, but the current `auth-vault` function (v3+) neither reads nor writes it — it was removed 2026-09-03 after an unindexed per-request COUNT query against it cascaded into a full project outage. Machine lockout (`clauth_machines.fail_count` / `.locked`, 5 failed attempts) is the operative protection now; see 004's own comment for the full incident writeup.
+
 ---
 
 ## Step 3 — Deploy Edge Function
@@ -127,17 +128,6 @@ than invoking PM2 directly.
 
 ---
 
-## Viewing the Audit Log
-
-```sql
-select machine_hash, service_name, action, result, detail, created_at
-from clauth_audit
-order by created_at desc
-limit 50;
-```
-
----
-
 ## Disabling a Machine
 
 If a machine is lost or stolen:

package/cli/commands/serve.js

@@ -29,6 +29,7 @@ import { registerDashboardRoutes } from "../http/components/dashboard-component.
 import { registerWatchdogRoutes } from "../http/components/watchdog-component.js";
 import { registerInboxRoutes } from "../http/components/inbox-component.js";
 import { registerMcpTransportRoutes } from "../http/components/mcp-transport-component.js";
+import { registerTestStaticOAuthRoutes } from "../http/components/test-static-oauth-component.js"; // TEST-ONLY: additive, see file header
 import { readBody } from "../http/request-utils.js";
 import chalk from "chalk";
 import ora from "ora";
@@ -43,6 +44,9 @@ import { loadConfig as webdavLoadConfig, addMount as webdavAddMount, removeMount
 import {
   discoverPlugins,
   getSupervisorDir,
+  isGenuinelyIsolatedInstance,
+  isProcessAlive,
+  resolveIsolatedSupervisorDir,
   getSupervisorPort,
   loadSupervisorState,
   listPlugins,
@@ -56,7 +60,6 @@ import {
   probeAllSurfaceHealth,
   runPluginAction,
   runSurfaceAction,
-  setPluginEnabled,
   supervisorHealth,
   operation,
 } from "../supervisor-registry.js";
@@ -601,7 +604,11 @@ const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
 const STAGED_PID_FILE = path.join(os.tmpdir(), "clauth-serve-staged.pid");
 const SUPERVISOR_PID_FILE = path.join(os.tmpdir(), "clauth-supervisor.pid");
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
-const MAX_LOG_LINES = 80;
+const MAX_LOG_AGE_MS = 24 * 60 * 60 * 1000;
+// Hard backstop only — age-based trimming below is what actually governs
+// retention. This just prevents unbounded growth if something goes wrong
+// with timestamp parsing (e.g. a burst of non-timestamped lines).
+const MAX_LOG_LINES = 200_000;
 
 // LOG_FILE is a plain append-only text log shared by every clauth instance on
 // this machine (live, staged, isolated-test all resolve the same os.tmpdir()
@@ -609,14 +616,41 @@ const MAX_LOG_LINES = 80;
 // to it per-request, with no central writer to retrofit a cap into. Trimming
 // it here instead, on a timer, keeps every append call site untouched. A
 // benign race between two instances trimming at once just means both
-// converge to roughly the last MAX_LOG_LINES lines — harmless for a plain
-// text tail, unlike a JSON store.
+// converge to roughly the same retained window — harmless for a plain text
+// tail, unlike a JSON store.
+//
+// Age-based (24h), not line-count-based: a fixed line cap (was 80) gets
+// exceeded by routine dashboard polling alone within under a minute, which
+// silently evicted real evidence twice in one debugging session (2026-08-31)
+// — once losing the only record of why the vault hard-locked, once losing
+// freshly-generated OAuth test credentials before they could be read. Only
+// rewrites the file when there's actually something to drop, so tail -f
+// doesn't see spurious "file truncated" resets on every trim tick.
 function trimLogFile() {
   try {
     const content = fs.readFileSync(LOG_FILE, "utf8");
     const lines = content.split("\n");
-    if (lines.length > MAX_LOG_LINES) {
-      fs.writeFileSync(LOG_FILE, lines.slice(-MAX_LOG_LINES).join("\n"), "utf8");
+    const cutoff = Date.now() - MAX_LOG_AGE_MS;
+    let dropCount = 0;
+    // An undated line (e.g. a wrapped stack trace) inherits the age
+    // classification of the most recent dated line rather than hard-stopping
+    // the scan. Breaking on the first undated line is what got this stuck:
+    // once a trim ends on an undated line, that line becomes lines[0] on the
+    // next pass, the loop breaks on iteration 1 with dropCount=0 forever, and
+    // age-based trimming silently stops working until the line-count backstop
+    // eventually kicks in.
+    let dropping = true;
+    for (const line of lines) {
+      const match = line.match(/^\[(.+?)\]/);
+      const ts = match ? Date.parse(match[1]) : NaN;
+      if (!Number.isNaN(ts)) dropping = ts < cutoff;
+      if (dropping) dropCount++;
+      else break; // first fresh dated line ends the drop run
+    }
+    const overLineCap = Math.max(0, lines.length - MAX_LOG_LINES);
+    const trimCount = Math.max(dropCount, overLineCap);
+    if (trimCount > 0) {
+      fs.writeFileSync(LOG_FILE, lines.slice(trimCount).join("\n"), "utf8");
     }
   } catch {}
 }
@@ -789,10 +823,6 @@ function removeSupervisorPid() {
   try { fs.unlinkSync(SUPERVISOR_PID_FILE); } catch {}
 }
 
-function isProcessAlive(pid) {
-  try { process.kill(pid, 0); return true; } catch { return false; }
-}
-
 // STOP-ON-REJECTION classifier. A server `reason` of invalid_token / machine_locked
 // (and friends) is a terminal verdict: the supplied password/machine is wrong or the
 // machine is locked, so every further attempt only burns another of the 5 server-side
@@ -1078,6 +1108,18 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
+  // Chrome's Private Network Access requires this on the PREFLIGHT (OPTIONS)
+  // response before it allows a public-origin page to fetch a loopback
+  // address -- confirmed live 2026-08-31 via Playwright against the real
+  // consent page's attest fetch (127.0.0.1 from https://clauth.regendevcorp.com):
+  // "Permission was denied for this request to access the loopback address
+  // space." The actual GET /authorize/attest response already sent this
+  // header (oauth-component.js), but the blanket OPTIONS handler used to bake
+  // it into the shared CORS object -- answering every preflight in the app,
+  // not just this one route -- which grants PNA approval for every route on
+  // the daemon, not only the one that actually needs it (rdc:review finding,
+  // 2026-08-31). Scoped to just the attest path's own preflight instead.
+  const ATTEST_PREFLIGHT_CORS = { ...CORS, "Access-Control-Allow-Private-Network": "true" };
   const NO_BROWSER_CORS = {
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
@@ -1183,16 +1225,23 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   // ── OAuth provider (self-contained for claude.ai MCP) ──────
   const oauthCodes = new Map();     // code → { client_id, redirect_uri, code_challenge, expires }
+  const oauthApprovals = new Map(); // approval → pending authorization request
+  const oauthMachineAttestationKey = crypto.randomBytes(32); // never leaves this enrolled daemon
 
   // Persist tokens + clients to disk so daemon restarts don't invalidate sessions
   const TOKENS_FILE  = path.join(os.tmpdir(), "clauth-oauth-tokens.json");
   const CLIENTS_FILE = path.join(os.tmpdir(), "clauth-oauth-clients.json");
 
   function loadTokens() {
-    try { return new Set(JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"))); } catch { return new Set(); }
+    try {
+      const stored = JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"));
+      return new Map(Array.isArray(stored) && Array.isArray(stored[0])
+        ? stored
+        : (stored || []).map((token) => [token, { scopes: ["mcp:tools"], expires: 0 }]));
+    } catch { return new Map(); }
   }
-  function saveTokens(set) {
-    try { fs.writeFileSync(TOKENS_FILE, JSON.stringify([...set])); } catch {}
+  function saveTokens(tokens) {
+    try { fs.writeFileSync(TOKENS_FILE, JSON.stringify([...tokens])); } catch {}
   }
   function loadClients() {
     try { return new Map(JSON.parse(fs.readFileSync(CLIENTS_FILE, "utf8"))); } catch { return new Map(); }
@@ -2193,9 +2242,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     get CORS() { return CORS; },
     oauthClients,
     oauthCodes,
+    oauthApprovals,
     oauthTokens,
     saveClients,
     saveTokens,
+    machineHash,
+    machineAttestationKey: oauthMachineAttestationKey,
+    port,
   });
 
   registerCallAgentTerminalRoutes({
@@ -2255,6 +2308,30 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     noBrowserJson,
   });
 
+  // TEST-ONLY: additive, isolated from everything below — see file header
+  // in test-static-oauth-component.js. Does not read or write any state
+  // this daemon already owns. Registered BEFORE registerMcpTransportRoutes
+  // specifically: patternRoutes matches in registration order (first match
+  // wins, see the loop this file's registerPatternRoute feeds), and
+  // mcp-transport-component.js registers a broad /^\/\.well-known\// catch-
+  // all that would otherwise shadow this component's /.well-known/*/test
+  // discovery routes and 404 them via its own generic fallback (confirmed
+  // live 2026-08-31 — that's what broke claude.ai's discovery the first time).
+  // TEST-ONLY, and gated OFF by default: registerTestStaticOAuthRoutes stands
+  // up a second, permanently-reachable OAuth provider + a bearer-gated MCP
+  // surface. Unconditional registration put it on the same port as the real
+  // production vault with no way to turn it off (rdc:review finding,
+  // 2026-08-31) -- an explicit opt-in keeps it off every real instance,
+  // production included, unless someone deliberately wants it for a manual
+  // OAuth-connector verification pass.
+  if (process.env.CLAUTH_TEST_OAUTH_ENABLE === "1") {
+    registerTestStaticOAuthRoutes({
+      registerWriteRoute,
+      registerPatternRoute,
+      oauthBase,
+    });
+  }
+
   registerMcpTransportRoutes({
     registerWriteRoute,
     registerPatternRoute,
@@ -2475,9 +2552,14 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     const reqPath = url.pathname;
     const method = req.method;
 
-    // Log every request
+    // Log every request — console output too, not just the file. The file
+    // log has repeatedly proven unreliable for real-time debugging this
+    // session (trim-timer rewrites, tunnel-vs-local origin mislabeling);
+    // stdout bypasses all of that and is directly visible in whatever
+    // terminal is running the daemon.
     const logLine = `[${new Date().toISOString()}] ${method} ${reqPath} from=${remote} local=${isLocal}\n`;
     try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+    console.log(`[REQ] ${method} ${reqPath} from=${remote} local=${isLocal} origin=${req.headers.origin || "-"} ua=${(req.headers["user-agent"] || "-").slice(0, 60)}`);
 
     // Hard reject anything not from loopback
     if (!isLocal) {
@@ -2486,7 +2568,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // CORS preflight
     if (req.method === "OPTIONS") {
-      res.writeHead(204, CORS);
+      res.writeHead(204, reqPath === "/authorize/attest" ? ATTEST_PREFLIGHT_CORS : CORS);
       return res.end();
     }
 
@@ -2759,6 +2841,34 @@ async function actionStart(opts) {
       }
     }
 
+    // This __CLAUTH_DAEMON branch is what the actual production daemon child
+    // runs — both a fresh `serve start` and every `/restart` (system-component.js
+    // spawns its child with __CLAUTH_DAEMON=1 set). actionForeground()'s
+    // unconditional discovery call (added because "normal serve start/foreground
+    // boot never ran it") never fires here — this branch returns before ever
+    // reaching actionForeground. Confirmed via a frozen state.json discovered_at
+    // timestamp that did not advance across several successful /restart calls.
+    // Same try/catch-never-crash-boot discipline as actionForeground's copy.
+    let discoveryResult = null;
+    let discoveryError = null;
+    try {
+      discoveryResult = discoverPlugins();
+    } catch (err) {
+      discoveryError = err;
+      fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ⚠ plugin discovery failed at boot: ${err.message}\n`);
+    }
+    try {
+      operation(
+        "daemon.plugin_discovery",
+        { port, isStaged },
+        null,
+        discoveryError
+          ? { ok: false, error: discoveryError.message }
+          : { ok: true, plugin_count: (discoveryResult?.plugins || []).length },
+        "system",
+      );
+    } catch { /* startup logging must never block the daemon from serving */ }
+
     const server = createServer(password, whitelist, port, tunnelHostname, isStaged);
     server.listen(port, "127.0.0.1", () => {
       if (isStaged) {
@@ -2985,6 +3095,27 @@ async function actionTest(opts) {
 async function actionForeground(opts) {
   const port      = parseInt(opts.port || "52437", 10);
   const isolated  = !!opts.isolated;
+
+  // rdc:review finding (2026-09-02), 4th round: withStateLock's acquire can
+  // now genuinely throw (5s contention timeout, or a real fs error) from
+  // deep inside an awaited request-handler call chain (e.g. `await
+  // runSurfacePromotion(...)` in cli/http/components/supervisor-component.js).
+  // The main HTTP listener (createServer's request callback, below) has no
+  // try/catch anywhere between it and that await, and this daemon registered
+  // no unhandledRejection handler -- Node's default behavior for an unhandled
+  // rejection (since Node 15, and this package requires Node >=18) is to
+  // terminate the process. A single contended lock could crash the whole
+  // daemon, reachable even from unauthenticated routes. Not a new class of
+  // exposure -- ANY unhandled rejection anywhere in this file already had
+  // this failure mode (tracked as its own follow-up, work item c308a2d0, for
+  // the full "wrap every request handler" fix) -- but this diff's lock is a
+  // new, concrete, reachable trigger for it, so it gets its own guard here
+  // rather than waiting on that broader item. Logs and keeps the daemon
+  // alive instead of a silent, unexplained exit.
+  process.on("unhandledRejection", (reason) => {
+    const msg = `[${new Date().toISOString()}] unhandled rejection (daemon kept alive): ${reason?.stack || reason}\n`;
+    try { fs.appendFileSync(LOG_FILE, msg); } catch { /* logging must never itself crash the daemon */ }
+  });
   const containerPassword = process.env.CLAUTH_MASTER_PASSWORD || process.env["clauth-master-password"] || null;
   const password  = isolated ? null : (opts.pw || containerPassword);
   const bindHost  = process.env.CLAUTH_BIND_HOST || "127.0.0.1";
@@ -2998,6 +3129,64 @@ async function actionForeground(opts) {
     process.exit(1);
   }
 
+  // rdc:review finding (2026-09-02): a manual `clauth serve foreground
+  // --isolated --port <supervisorPort>` reaches an unauthenticated,
+  // passwordless HTTP server bound to the real supervisor port, operating on
+  // live shared state (isGenuinelyIsolatedInstance below deliberately keeps
+  // the real supervisor port on the live state dir). Tried adding
+  // getSupervisorPort() to the refusal list above, gated behind a new
+  // internalSupervisor marker actionSupervisor() sets for its own automatic
+  // boot -- and broke 39 passing tests in test/serve-http-routes.test.mjs:
+  // that suite's OWN sanctioned pattern (its comment: "the sanctioned
+  // localhost-only test escape hatch... never the live daemon") spawns a
+  // SECOND isolated instance with CLAUTH_SUPERVISOR_PORT deliberately set to
+  // match its own --port, specifically to exercise the write-token-bypass
+  // logic gated on `port === getSupervisorPort()` -- via a raw CLI spawn,
+  // which has no way to set an internal opts field. There is no signal that
+  // distinguishes that sanctioned test invocation from the theoretical
+  // manual-misuse case; both produce identical (isolated:true, port ===
+  // getSupervisorPort()) with no CLAUTH_SUPERVISOR_PORT override reaching
+  // the process before getSupervisorPort() resolves. Left unfixed: reaching
+  // this at all requires local shell access to run the clauth CLI directly,
+  // which already grants the full admin blast radius documented in
+  // .claude/rules/subagent-credentials.md -- an unauthenticated local HTTP
+  // server is not a meaningfully larger grant on top of that. Revisit only
+  // if a real remote/lower-trust invocation path to `--isolated` is ever
+  // added; today all paths to it are local-shell-only.
+
+  // rdc:review finding (2026-09-02): `--isolated` never set CLAUTH_SUPERVISOR_DIR,
+  // so an isolated instance and the live :52437 daemon shared the SAME
+  // state.json by default -- the documented "verify against an isolated
+  // instance first" workflow (.claude/rules/clauth-endpoints.md) did not
+  // actually isolate state. resolveIsolatedSupervisorDir is a pure function
+  // (see supervisor-registry.js) so the decision itself is unit-tested
+  // without spawning a server.
+  //
+  // CRITICAL follow-up finding (2026-09-02, independent review of the fix
+  // above): `opts.isolated` is OVERLOADED. actionSupervisor() unconditionally
+  // sets it to true for an unrelated reason -- skipping vault password auth on
+  // the internal supervisor child process ensureSupervisorStarted() spawns for
+  // every normal `clauth serve start` -- and that child always runs on
+  // getSupervisorPort() (52439 by default), which is NOT in the LIVE_PORT/
+  // STAGED_PORT refusal list above. Without this guard, the first version of
+  // this fix redirected the REAL production supervisor's state.json to an
+  // empty %TEMP% path on every normal boot, silently disabling the entire
+  // health-reconcile/auto-repair loop (gated to exactly this one process --
+  // see `port === getSupervisorPort()` at the setInterval registration below)
+  // with no error and no log line. `serve test`'s own live-verification in the
+  // original fix used TEST_PORT (52440), which never exercises this path --
+  // that is why it didn't catch it.
+  //
+  // CORRECTION (4th review round): the real internal daemon is identified via
+  // __CLAUTH_SUPERVISOR_DAEMON (set by ensureSupervisorStarted, read nowhere
+  // until now), not by port -- see isGenuinelyIsolatedInstance's own comment
+  // for why the port-based version collided with sanctioned test
+  // infrastructure and had to be corrected.
+  const isInternalSupervisorDaemon = process.env.__CLAUTH_SUPERVISOR_DAEMON === "1";
+  if (isGenuinelyIsolatedInstance(isolated, isInternalSupervisorDaemon)) {
+    process.env.CLAUTH_SUPERVISOR_DIR = resolveIsolatedSupervisorDir(port, process.env.CLAUTH_SUPERVISOR_DIR);
+  }
+
   if (password) {
     console.log(chalk.gray("\n  Verifying vault credentials..."));
     try {

package/cli/http/components/callagent-terminal-component.js

@@ -37,7 +37,7 @@ import { showTerminalSession } from "../../services/terminal-window.js";
 import { channelEvents, MAX_CHANNEL_EVENTS } from "../../services/terminal-registry.js";
 import crypto from "node:crypto";
 
-const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 
 export function registerCallAgentTerminalRoutes(ctx) {
   // ── call_agent (Gate B) ───────────────────────────────────────────────────
@@ -46,7 +46,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // async: returns { ok, jobId } immediately; poll GET /call-agent/:jobId.
   ctx.registerWriteRoute("POST", "/call-agent", async (req, res, url) => {
       const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+      const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
       // call_agent spawns real `claude` workers. Like legacy /dispatch, it is a
       // local-tool-only path: reject any browser Origin (CSRF) and, on a noauth
       // tunnel host (clauth.regendevcorp.com etc.), require a valid
@@ -85,7 +85,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // GET /call-agent/:jobId — poll an async (or completed) call_agent job.
   ctx.registerPatternRoute("GET", /^\/call-agent\/([^/]+)$/, async (req, res, match, url) => {
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+    const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
     {
       const expectedToken = await ctx.resolveCallAgentToken();
       const verdict = ctx.evaluateCallAgentGuard({
@@ -113,7 +113,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // same guard as the poll route above.
   ctx.registerPatternRoute("POST", /^\/call-agent\/([^/]+)\/(show|hide)$/, async (req, res, match, url) => {
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+    const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
     {
       const expectedToken = await ctx.resolveCallAgentToken();
       const verdict = ctx.evaluateCallAgentGuard({
@@ -137,7 +137,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // GET /call-agent — pool stats (health/debug, no credentials).
   ctx.registerWriteRoute("GET", "/call-agent", async (req, res, url) => {
       const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+      const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
       {
         const expectedToken = await ctx.resolveCallAgentToken();
         const verdict = ctx.evaluateCallAgentGuard({

package/cli/http/components/mcp-transport-component.js

@@ -34,15 +34,11 @@ const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../../package.js
 const VERSION = pkg.version;
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 
-// Hosts that bypass OAuth (fresh domains for claude.ai compatibility) —
-// those domains use the tunnel URL itself as a shared secret (like regen-media).
-const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
 const MCP_PATHS = ["/mcp", "/gws", "/clauth", "/fs"];
 
 function hostFlags(req) {
   const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
   return {
-    noAuthHost: NOAUTH_HOSTS.includes(requestHost),
     localTrustedHost: ["127.0.0.1", "localhost", "::1", "[::1]"].includes(requestHost),
   };
 }
@@ -60,19 +56,18 @@ function serverNameForPath(p) {
   if (p === "/fs")       return "fs";
   return "clauth";
 }
+function validOAuthToken(ctx, token, reqPath) {
+  const record = token && ctx.oauthTokens.get(token);
+  if (!record || (record.expires && record.expires <= Date.now())) return false;
+  const scopes = record.scopes || ["mcp:tools"];
+  if (!reqPath || !MCP_PATHS.includes(reqPath)) return scopes.includes("mcp:tools") || scopes.includes("mcp:all");
+  return scopes.includes("mcp:tools") || scopes.includes("mcp:all") || scopes.includes(`mcp:${serverNameForPath(reqPath)}`);
+}
 
 export function registerMcpTransportRoutes(ctx) {
   // ── OAuth Discovery (RFC 9728 + RFC 8414) — any /.well-known/* path ──
   ctx.registerPatternRoute("GET", /^\/\.well-known\//, async (req, res, match, url) => {
       const reqPath = url.pathname;
-      const { noAuthHost } = hostFlags(req);
-
-      // Suppress OAuth discovery on noauth hosts — prevents claude.ai from entering OAuth flow
-      if (noAuthHost) {
-        res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
-
       // Restore full well-known + OAuth so custom setup with client_id/secret works.
       if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
         const base = ctx.oauthBase();
@@ -123,14 +118,13 @@ export function registerMcpTransportRoutes(ctx) {
 
 async function handleMcpPost(ctx, req, res, url, reqPath) {
   const isMcpPath = MCP_PATHS.includes(reqPath);
-  const { noAuthHost, localTrustedHost } = hostFlags(req);
+  const { localTrustedHost } = hostFlags(req);
 
   // ── MCP endpoint auth — 401 gate (OAuth 2.1 protocol) ──
-  // Skipped for noauth hosts — those domains use tunnel URL as shared secret (like regen-media)
   const authHeader = req.headers.authorization;
   const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
 
-  if (!noAuthHost && !localTrustedHost && (!token || !ctx.oauthTokens.has(token))) {
+  if (!localTrustedHost && !validOAuthToken(ctx, token, reqPath)) {
     // No valid Bearer token → return 401 with discovery hint
     const base = ctx.oauthBase();
     const resourcePath = isMcpPath ? reqPath.slice(1) : "sse"; // "mcp", "gws", "clauth", or "sse"
@@ -222,7 +216,6 @@ async function handleMcpPost(ctx, req, res, url, reqPath) {
 }
 
 function handleMcpGet(ctx, req, res, url, reqPath) {
-  const { noAuthHost } = hostFlags(req);
 
   // ── MCP SSE transport — /sse and namespaced paths ────
   // Remote clients (claude.ai) arrive with a Bearer token via OAuth.
@@ -232,7 +225,7 @@ function handleMcpGet(ctx, req, res, url, reqPath) {
   if (isMcpPath) {
     const getAuthHeader = req.headers.authorization;
     const getToken = getAuthHeader?.startsWith("Bearer ") ? getAuthHeader.slice(7) : null;
-    if (!noAuthHost && getToken && ctx.oauthTokens.has(getToken)) {
+    if (validOAuthToken(ctx, getToken, reqPath)) {
       res.writeHead(405, { "Content-Type": "application/json", "Allow": "POST", ...ctx.CORS });
       return res.end(JSON.stringify({ error: "Method Not Allowed", detail: "Use POST for Streamable HTTP transport" }));
     }

package/cli/http/components/oauth-component.js

@@ -28,31 +28,32 @@ import { readBody, readRawBody } from "../request-utils.js";
 
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 
-// Hosts that bypass OAuth entirely (fresh domains for claude.ai compatibility
-// -- those domains use the tunnel URL itself as a shared secret, like
-// regen-media). Dynamic Client Registration (RFC 7591) must not be reachable
-// on them. This check used to live as a raw if-block in serve.js's if-chain,
-// but the exact-match write-route Map (where these 3 routes now live) is
-// checked BEFORE that if-chain -- so the block never actually ran once these
-// routes moved to the registry, silently exposing /register, /authorize, and
-// /token on the noauth hosts. Restored here, at the point the Map actually
-// intercepts the request.
-const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
-function isNoAuthHost(req) {
-  const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-  return NOAUTH_HOSTS.includes(requestHost);
-}
-
 function sha256base64url(str) {
   return crypto.createHash("sha256").update(str).digest("base64url");
 }
 
+function approvalPage({ approvalId, clientName, scopes, port }) {
+  const escapedName = String(clientName).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+  const scopeList = scopes.map((scope) => `<li>${scope}</li>`).join("") || "<li>mcp:tools</li>";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>CLAUTH access request</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>body{font-family:system-ui;margin:3rem;max-width:42rem;color:#18251e}button{padding:.7rem 1rem;margin-right:.6rem;font:inherit;border-radius:.45rem}button[name=decision]{background:#164f35;color:white;border:0}button[value=deny]{background:white;color:#8b1d1d;border:1px solid #8b1d1d}#machine{color:#8b5b00}</style></head><body><h1>CLAUTH access request</h1><p><strong>${escapedName}</strong> is requesting access to this machine's MCP services.</p><p>Requested scopes:</p><ul>${scopeList}</ul><p id="machine">Verifying this browser is paired with the enrolled CLAUTH machine…</p><form method="post" action="/authorize/approve"><input type="hidden" name="approval_id" value="${approvalId}"><input id="attestation" type="hidden" name="attestation"><button id="approve" name="decision" value="approve" type="submit" disabled>Approve access</button><button name="decision" value="deny" type="submit">Deny</button></form><script>fetch('http://127.0.0.1:${port}/authorize/attest?approval_id=${approvalId}').then(r=>r.ok?r.json():Promise.reject()).then(x=>{document.querySelector('#attestation').value=x.attestation;document.querySelector('#approve').disabled=false;document.querySelector('#machine').textContent='This browser is paired with the enrolled CLAUTH machine.'}).catch(()=>{document.querySelector('#machine').textContent='Machine verification failed. Open this request on the machine that runs CLAUTH.'})</script></body></html>`;
+}
+
+function attestationFor(ctx, approvalId, nonce) {
+  if (!ctx.machineAttestationKey) return null;
+  return crypto.createHmac("sha256", ctx.machineAttestationKey).update(`${ctx.machineHash}:${approvalId}:${nonce}`).digest("base64url");
+}
+
+function issueAuthorizationCode(ctx, request) {
+  const code = crypto.randomBytes(32).toString("hex");
+  ctx.oauthCodes.set(code, { ...request, expires: Date.now() + 300_000 });
+  const redirect = new URL(request.redirect_uri);
+  redirect.searchParams.set("code", code);
+  if (request.state) redirect.searchParams.set("state", request.state);
+  return redirect;
+}
+
 export function registerOAuthRoutes(ctx) {
   ctx.registerWriteRoute("POST", "/register", async (req, res, url) => {
-      if (isNoAuthHost(req)) {
-        res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
@@ -77,10 +78,6 @@ export function registerOAuthRoutes(ctx) {
       return res.end(JSON.stringify(client));
   });
   ctx.registerWriteRoute("GET", "/authorize", async (req, res, url) => {
-      if (isNoAuthHost(req)) {
-        res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
       const clientId = url.searchParams.get("client_id");
       const redirectUri = url.searchParams.get("redirect_uri");
       const state = url.searchParams.get("state");
@@ -112,29 +109,66 @@ export function registerOAuthRoutes(ctx) {
         return res.end("redirect_uri mismatch");
       }
 
-      // Auto-approve (no user interaction — clauth is a personal vault)
-      const code = crypto.randomBytes(32).toString("hex");
-      ctx.oauthCodes.set(code, {
+      const approvalId = crypto.randomBytes(24).toString("base64url");
+      const scopes = (url.searchParams.get("scope") || "mcp:tools").split(/\s+/).filter(Boolean);
+      ctx.oauthApprovals.set(approvalId, {
         client_id: clientId,
         redirect_uri: redirectUri,
         code_challenge: codeChallenge,
-        expires: Date.now() + 300_000,  // 5 minutes
+        state,
+        scopes,
+        machine_id: ctx.machineHash,
+        expires: Date.now() + 300_000,
       });
-
-      const redirect = new URL(redirectUri);
-      redirect.searchParams.set("code", code);
-      if (state) redirect.searchParams.set("state", state);
-
-      const logMsg = `[${new Date().toISOString()}] OAuth: authorize → code for ${clientId}, redirect to ${redirect.origin}\n`;
+      const logMsg = `[${new Date().toISOString()}] OAuth: consent requested for ${clientId}\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-      res.writeHead(302, { Location: redirect.toString(), "Cache-Control": "no-store", ...ctx.CORS });
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+      const request = ctx.oauthApprovals.get(approvalId);
+      request.nonce = crypto.randomBytes(24).toString("base64url");
+      return res.end(approvalPage({ approvalId, clientName: client.client_name, scopes, port: ctx.port }));
+  });
+  ctx.registerWriteRoute("GET", "/authorize/attest", async (req, res, url) => {
+      const host = (req.headers.host || "").split(":")[0].toLowerCase();
+      if (!["127.0.0.1", "localhost", "::1", "[::1]"].includes(host)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ error: "loopback_required" }));
+      }
+      const approvalId = url.searchParams.get("approval_id");
+      const request = ctx.oauthApprovals.get(approvalId);
+      const attestation = request && request.expires > Date.now() ? attestationFor(ctx, approvalId, request.nonce) : null;
+      if (!attestation) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        return res.end(JSON.stringify({ error: "invalid_or_expired_request" }));
+      }
+      res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store", "Access-Control-Allow-Origin": req.headers.origin || "null", "Access-Control-Allow-Private-Network": "true" });
+      return res.end(JSON.stringify({ attestation }));
+  });
+  ctx.registerWriteRoute("POST", "/authorize/approve", async (req, res) => {
+      const raw = await readRawBody(req);
+      const body = Object.fromEntries(new URLSearchParams(raw));
+      const request = ctx.oauthApprovals.get(body.approval_id);
+      ctx.oauthApprovals.delete(body.approval_id);
+      if (!request || request.expires < Date.now()) {
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        return res.end("Authorization request expired or invalid.");
+      }
+      const expectedAttestation = request && attestationFor(ctx, body.approval_id, request.nonce);
+      const presented = Buffer.from(body.attestation || "");
+      const expected = Buffer.from(expectedAttestation || "");
+      if (!expected.length || presented.length !== expected.length || !crypto.timingSafeEqual(presented, expected)) {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        return res.end("Machine verification failed.");
+      }
+      if (body.decision !== "approve") {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        return res.end("Access denied.");
+      }
+      const redirect = issueAuthorizationCode(ctx, request);
+      operation("oauth.consent_approve", { client_id: request.client_id, scopes: request.scopes }, null, { ok: true });
+      res.writeHead(302, { Location: redirect.toString(), "Cache-Control": "no-store" });
       return res.end();
   });
   ctx.registerWriteRoute("POST", "/token", async (req, res, url) => {
-      if (isNoAuthHost(req)) {
-        res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
-        return res.end(JSON.stringify({ error: "not_found" }));
-      }
       let body;
       const ct = req.headers["content-type"] || "";
       try {
@@ -195,13 +229,13 @@ export function registerOAuthRoutes(ctx) {
       // All checks passed — delete code (one-time use) and issue token
       ctx.oauthCodes.delete(body.code);
       const accessToken = crypto.randomBytes(32).toString("hex");
-      ctx.oauthTokens.add(accessToken);
+      ctx.oauthTokens.set(accessToken, { scopes: stored.scopes || ["mcp:tools"], machine_id: stored.machine_id, expires: Date.now() + 86_400_000 });
       ctx.saveTokens(ctx.oauthTokens);
 
       const logMsg = `[${new Date().toISOString()}] OAuth: token issued for ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
       operation("oauth.token_issue", { client_id: stored.client_id }, null, { ok: true });
       res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store", ...ctx.CORS });
-      return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", scope: "mcp:tools", expires_in: 86400 }));
+      return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", scope: (stored.scopes || ["mcp:tools"]).join(" "), expires_in: 86400 }));
   });
 }