@lifeaitools/clauth 2.15.3 → 2.15.4

package/.clauth-skill/references/operator-guide.md

@@ -36,10 +36,9 @@ supabase db push
 This creates:
 - `clauth_services` — service registry (12 services seeded)
 - `clauth_machines` — machine fingerprint registry
+- `clauth_audit` — all operations logged
 - Vault helper RPCs (upsert/decrypt/delete/list)
 
-Also run `004_remove_audit_and_rate_limiting.sql` after the above (or `supabase db push`, which applies all migrations in order). `001_clauth_schema.sql` still creates a `clauth_audit` table as part of its original, unedited history, but the current `auth-vault` function (v3+) neither reads nor writes it — it was removed 2026-09-03 after an unindexed per-request COUNT query against it cascaded into a full project outage. Machine lockout (`clauth_machines.fail_count` / `.locked`, 5 failed attempts) is the operative protection now; see 004's own comment for the full incident writeup.
-
 ---
 
 ## Step 3 — Deploy Edge Function
@@ -128,6 +127,17 @@ than invoking PM2 directly.
 
 ---
 
+## Viewing the Audit Log
+
+```sql
+select machine_hash, service_name, action, result, detail, created_at
+from clauth_audit
+order by created_at desc
+limit 50;
+```
+
+---
+
 ## Disabling a Machine
 
 If a machine is lost or stolen:

package/cli/commands/serve.js

@@ -29,7 +29,6 @@ import { registerDashboardRoutes } from "../http/components/dashboard-component.
 import { registerWatchdogRoutes } from "../http/components/watchdog-component.js";
 import { registerInboxRoutes } from "../http/components/inbox-component.js";
 import { registerMcpTransportRoutes } from "../http/components/mcp-transport-component.js";
-import { registerTestStaticOAuthRoutes } from "../http/components/test-static-oauth-component.js"; // TEST-ONLY: additive, see file header
 import { readBody } from "../http/request-utils.js";
 import chalk from "chalk";
 import ora from "ora";
@@ -44,9 +43,6 @@ import { loadConfig as webdavLoadConfig, addMount as webdavAddMount, removeMount
 import {
   discoverPlugins,
   getSupervisorDir,
-  isGenuinelyIsolatedInstance,
-  isProcessAlive,
-  resolveIsolatedSupervisorDir,
   getSupervisorPort,
   loadSupervisorState,
   listPlugins,
@@ -60,6 +56,7 @@ import {
   probeAllSurfaceHealth,
   runPluginAction,
   runSurfaceAction,
+  setPluginEnabled,
   supervisorHealth,
   operation,
 } from "../supervisor-registry.js";
@@ -604,11 +601,7 @@ const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
 const STAGED_PID_FILE = path.join(os.tmpdir(), "clauth-serve-staged.pid");
 const SUPERVISOR_PID_FILE = path.join(os.tmpdir(), "clauth-supervisor.pid");
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
-const MAX_LOG_AGE_MS = 24 * 60 * 60 * 1000;
-// Hard backstop only — age-based trimming below is what actually governs
-// retention. This just prevents unbounded growth if something goes wrong
-// with timestamp parsing (e.g. a burst of non-timestamped lines).
-const MAX_LOG_LINES = 200_000;
+const MAX_LOG_LINES = 80;
 
 // LOG_FILE is a plain append-only text log shared by every clauth instance on
 // this machine (live, staged, isolated-test all resolve the same os.tmpdir()
@@ -616,41 +609,14 @@ const MAX_LOG_LINES = 200_000;
 // to it per-request, with no central writer to retrofit a cap into. Trimming
 // it here instead, on a timer, keeps every append call site untouched. A
 // benign race between two instances trimming at once just means both
-// converge to roughly the same retained window — harmless for a plain text
-// tail, unlike a JSON store.
-//
-// Age-based (24h), not line-count-based: a fixed line cap (was 80) gets
-// exceeded by routine dashboard polling alone within under a minute, which
-// silently evicted real evidence twice in one debugging session (2026-08-31)
-// — once losing the only record of why the vault hard-locked, once losing
-// freshly-generated OAuth test credentials before they could be read. Only
-// rewrites the file when there's actually something to drop, so tail -f
-// doesn't see spurious "file truncated" resets on every trim tick.
+// converge to roughly the last MAX_LOG_LINES lines — harmless for a plain
+// text tail, unlike a JSON store.
 function trimLogFile() {
   try {
     const content = fs.readFileSync(LOG_FILE, "utf8");
     const lines = content.split("\n");
-    const cutoff = Date.now() - MAX_LOG_AGE_MS;
-    let dropCount = 0;
-    // An undated line (e.g. a wrapped stack trace) inherits the age
-    // classification of the most recent dated line rather than hard-stopping
-    // the scan. Breaking on the first undated line is what got this stuck:
-    // once a trim ends on an undated line, that line becomes lines[0] on the
-    // next pass, the loop breaks on iteration 1 with dropCount=0 forever, and
-    // age-based trimming silently stops working until the line-count backstop
-    // eventually kicks in.
-    let dropping = true;
-    for (const line of lines) {
-      const match = line.match(/^\[(.+?)\]/);
-      const ts = match ? Date.parse(match[1]) : NaN;
-      if (!Number.isNaN(ts)) dropping = ts < cutoff;
-      if (dropping) dropCount++;
-      else break; // first fresh dated line ends the drop run
-    }
-    const overLineCap = Math.max(0, lines.length - MAX_LOG_LINES);
-    const trimCount = Math.max(dropCount, overLineCap);
-    if (trimCount > 0) {
-      fs.writeFileSync(LOG_FILE, lines.slice(trimCount).join("\n"), "utf8");
+    if (lines.length > MAX_LOG_LINES) {
+      fs.writeFileSync(LOG_FILE, lines.slice(-MAX_LOG_LINES).join("\n"), "utf8");
     }
   } catch {}
 }
@@ -823,6 +789,10 @@ function removeSupervisorPid() {
   try { fs.unlinkSync(SUPERVISOR_PID_FILE); } catch {}
 }
 
+function isProcessAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
 // STOP-ON-REJECTION classifier. A server `reason` of invalid_token / machine_locked
 // (and friends) is a terminal verdict: the supplied password/machine is wrong or the
 // machine is locked, so every further attempt only burns another of the 5 server-side
@@ -1108,18 +1078,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
   };
-  // Chrome's Private Network Access requires this on the PREFLIGHT (OPTIONS)
-  // response before it allows a public-origin page to fetch a loopback
-  // address -- confirmed live 2026-08-31 via Playwright against the real
-  // consent page's attest fetch (127.0.0.1 from https://clauth.regendevcorp.com):
-  // "Permission was denied for this request to access the loopback address
-  // space." The actual GET /authorize/attest response already sent this
-  // header (oauth-component.js), but the blanket OPTIONS handler used to bake
-  // it into the shared CORS object -- answering every preflight in the app,
-  // not just this one route -- which grants PNA approval for every route on
-  // the daemon, not only the one that actually needs it (rdc:review finding,
-  // 2026-08-31). Scoped to just the attest path's own preflight instead.
-  const ATTEST_PREFLIGHT_CORS = { ...CORS, "Access-Control-Allow-Private-Network": "true" };
   const NO_BROWSER_CORS = {
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, Mcp-Session-Id, mcp-protocol-version, mcp-session-id",
@@ -1225,23 +1183,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   // ── OAuth provider (self-contained for claude.ai MCP) ──────
   const oauthCodes = new Map();     // code → { client_id, redirect_uri, code_challenge, expires }
-  const oauthApprovals = new Map(); // approval → pending authorization request
-  const oauthMachineAttestationKey = crypto.randomBytes(32); // never leaves this enrolled daemon
 
   // Persist tokens + clients to disk so daemon restarts don't invalidate sessions
   const TOKENS_FILE  = path.join(os.tmpdir(), "clauth-oauth-tokens.json");
   const CLIENTS_FILE = path.join(os.tmpdir(), "clauth-oauth-clients.json");
 
   function loadTokens() {
-    try {
-      const stored = JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"));
-      return new Map(Array.isArray(stored) && Array.isArray(stored[0])
-        ? stored
-        : (stored || []).map((token) => [token, { scopes: ["mcp:tools"], expires: 0 }]));
-    } catch { return new Map(); }
+    try { return new Set(JSON.parse(fs.readFileSync(TOKENS_FILE, "utf8"))); } catch { return new Set(); }
   }
-  function saveTokens(tokens) {
-    try { fs.writeFileSync(TOKENS_FILE, JSON.stringify([...tokens])); } catch {}
+  function saveTokens(set) {
+    try { fs.writeFileSync(TOKENS_FILE, JSON.stringify([...set])); } catch {}
   }
   function loadClients() {
     try { return new Map(JSON.parse(fs.readFileSync(CLIENTS_FILE, "utf8"))); } catch { return new Map(); }
@@ -2242,13 +2193,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     get CORS() { return CORS; },
     oauthClients,
     oauthCodes,
-    oauthApprovals,
     oauthTokens,
     saveClients,
     saveTokens,
-    machineHash,
-    machineAttestationKey: oauthMachineAttestationKey,
-    port,
   });
 
   registerCallAgentTerminalRoutes({
@@ -2308,30 +2255,6 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     noBrowserJson,
   });
 
-  // TEST-ONLY: additive, isolated from everything below — see file header
-  // in test-static-oauth-component.js. Does not read or write any state
-  // this daemon already owns. Registered BEFORE registerMcpTransportRoutes
-  // specifically: patternRoutes matches in registration order (first match
-  // wins, see the loop this file's registerPatternRoute feeds), and
-  // mcp-transport-component.js registers a broad /^\/\.well-known\// catch-
-  // all that would otherwise shadow this component's /.well-known/*/test
-  // discovery routes and 404 them via its own generic fallback (confirmed
-  // live 2026-08-31 — that's what broke claude.ai's discovery the first time).
-  // TEST-ONLY, and gated OFF by default: registerTestStaticOAuthRoutes stands
-  // up a second, permanently-reachable OAuth provider + a bearer-gated MCP
-  // surface. Unconditional registration put it on the same port as the real
-  // production vault with no way to turn it off (rdc:review finding,
-  // 2026-08-31) -- an explicit opt-in keeps it off every real instance,
-  // production included, unless someone deliberately wants it for a manual
-  // OAuth-connector verification pass.
-  if (process.env.CLAUTH_TEST_OAUTH_ENABLE === "1") {
-    registerTestStaticOAuthRoutes({
-      registerWriteRoute,
-      registerPatternRoute,
-      oauthBase,
-    });
-  }
-
   registerMcpTransportRoutes({
     registerWriteRoute,
     registerPatternRoute,
@@ -2552,14 +2475,9 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     const reqPath = url.pathname;
     const method = req.method;
 
-    // Log every request — console output too, not just the file. The file
-    // log has repeatedly proven unreliable for real-time debugging this
-    // session (trim-timer rewrites, tunnel-vs-local origin mislabeling);
-    // stdout bypasses all of that and is directly visible in whatever
-    // terminal is running the daemon.
+    // Log every request
     const logLine = `[${new Date().toISOString()}] ${method} ${reqPath} from=${remote} local=${isLocal}\n`;
     try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
-    console.log(`[REQ] ${method} ${reqPath} from=${remote} local=${isLocal} origin=${req.headers.origin || "-"} ua=${(req.headers["user-agent"] || "-").slice(0, 60)}`);
 
     // Hard reject anything not from loopback
     if (!isLocal) {
@@ -2568,7 +2486,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // CORS preflight
     if (req.method === "OPTIONS") {
-      res.writeHead(204, reqPath === "/authorize/attest" ? ATTEST_PREFLIGHT_CORS : CORS);
+      res.writeHead(204, CORS);
       return res.end();
     }
 
@@ -2841,34 +2759,6 @@ async function actionStart(opts) {
       }
     }
 
-    // This __CLAUTH_DAEMON branch is what the actual production daemon child
-    // runs — both a fresh `serve start` and every `/restart` (system-component.js
-    // spawns its child with __CLAUTH_DAEMON=1 set). actionForeground()'s
-    // unconditional discovery call (added because "normal serve start/foreground
-    // boot never ran it") never fires here — this branch returns before ever
-    // reaching actionForeground. Confirmed via a frozen state.json discovered_at
-    // timestamp that did not advance across several successful /restart calls.
-    // Same try/catch-never-crash-boot discipline as actionForeground's copy.
-    let discoveryResult = null;
-    let discoveryError = null;
-    try {
-      discoveryResult = discoverPlugins();
-    } catch (err) {
-      discoveryError = err;
-      fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ⚠ plugin discovery failed at boot: ${err.message}\n`);
-    }
-    try {
-      operation(
-        "daemon.plugin_discovery",
-        { port, isStaged },
-        null,
-        discoveryError
-          ? { ok: false, error: discoveryError.message }
-          : { ok: true, plugin_count: (discoveryResult?.plugins || []).length },
-        "system",
-      );
-    } catch { /* startup logging must never block the daemon from serving */ }
-
     const server = createServer(password, whitelist, port, tunnelHostname, isStaged);
     server.listen(port, "127.0.0.1", () => {
       if (isStaged) {
@@ -3095,27 +2985,6 @@ async function actionTest(opts) {
 async function actionForeground(opts) {
   const port      = parseInt(opts.port || "52437", 10);
   const isolated  = !!opts.isolated;
-
-  // rdc:review finding (2026-09-02), 4th round: withStateLock's acquire can
-  // now genuinely throw (5s contention timeout, or a real fs error) from
-  // deep inside an awaited request-handler call chain (e.g. `await
-  // runSurfacePromotion(...)` in cli/http/components/supervisor-component.js).
-  // The main HTTP listener (createServer's request callback, below) has no
-  // try/catch anywhere between it and that await, and this daemon registered
-  // no unhandledRejection handler -- Node's default behavior for an unhandled
-  // rejection (since Node 15, and this package requires Node >=18) is to
-  // terminate the process. A single contended lock could crash the whole
-  // daemon, reachable even from unauthenticated routes. Not a new class of
-  // exposure -- ANY unhandled rejection anywhere in this file already had
-  // this failure mode (tracked as its own follow-up, work item c308a2d0, for
-  // the full "wrap every request handler" fix) -- but this diff's lock is a
-  // new, concrete, reachable trigger for it, so it gets its own guard here
-  // rather than waiting on that broader item. Logs and keeps the daemon
-  // alive instead of a silent, unexplained exit.
-  process.on("unhandledRejection", (reason) => {
-    const msg = `[${new Date().toISOString()}] unhandled rejection (daemon kept alive): ${reason?.stack || reason}\n`;
-    try { fs.appendFileSync(LOG_FILE, msg); } catch { /* logging must never itself crash the daemon */ }
-  });
   const containerPassword = process.env.CLAUTH_MASTER_PASSWORD || process.env["clauth-master-password"] || null;
   const password  = isolated ? null : (opts.pw || containerPassword);
   const bindHost  = process.env.CLAUTH_BIND_HOST || "127.0.0.1";
@@ -3129,64 +2998,6 @@ async function actionForeground(opts) {
     process.exit(1);
   }
 
-  // rdc:review finding (2026-09-02): a manual `clauth serve foreground
-  // --isolated --port <supervisorPort>` reaches an unauthenticated,
-  // passwordless HTTP server bound to the real supervisor port, operating on
-  // live shared state (isGenuinelyIsolatedInstance below deliberately keeps
-  // the real supervisor port on the live state dir). Tried adding
-  // getSupervisorPort() to the refusal list above, gated behind a new
-  // internalSupervisor marker actionSupervisor() sets for its own automatic
-  // boot -- and broke 39 passing tests in test/serve-http-routes.test.mjs:
-  // that suite's OWN sanctioned pattern (its comment: "the sanctioned
-  // localhost-only test escape hatch... never the live daemon") spawns a
-  // SECOND isolated instance with CLAUTH_SUPERVISOR_PORT deliberately set to
-  // match its own --port, specifically to exercise the write-token-bypass
-  // logic gated on `port === getSupervisorPort()` -- via a raw CLI spawn,
-  // which has no way to set an internal opts field. There is no signal that
-  // distinguishes that sanctioned test invocation from the theoretical
-  // manual-misuse case; both produce identical (isolated:true, port ===
-  // getSupervisorPort()) with no CLAUTH_SUPERVISOR_PORT override reaching
-  // the process before getSupervisorPort() resolves. Left unfixed: reaching
-  // this at all requires local shell access to run the clauth CLI directly,
-  // which already grants the full admin blast radius documented in
-  // .claude/rules/subagent-credentials.md -- an unauthenticated local HTTP
-  // server is not a meaningfully larger grant on top of that. Revisit only
-  // if a real remote/lower-trust invocation path to `--isolated` is ever
-  // added; today all paths to it are local-shell-only.
-
-  // rdc:review finding (2026-09-02): `--isolated` never set CLAUTH_SUPERVISOR_DIR,
-  // so an isolated instance and the live :52437 daemon shared the SAME
-  // state.json by default -- the documented "verify against an isolated
-  // instance first" workflow (.claude/rules/clauth-endpoints.md) did not
-  // actually isolate state. resolveIsolatedSupervisorDir is a pure function
-  // (see supervisor-registry.js) so the decision itself is unit-tested
-  // without spawning a server.
-  //
-  // CRITICAL follow-up finding (2026-09-02, independent review of the fix
-  // above): `opts.isolated` is OVERLOADED. actionSupervisor() unconditionally
-  // sets it to true for an unrelated reason -- skipping vault password auth on
-  // the internal supervisor child process ensureSupervisorStarted() spawns for
-  // every normal `clauth serve start` -- and that child always runs on
-  // getSupervisorPort() (52439 by default), which is NOT in the LIVE_PORT/
-  // STAGED_PORT refusal list above. Without this guard, the first version of
-  // this fix redirected the REAL production supervisor's state.json to an
-  // empty %TEMP% path on every normal boot, silently disabling the entire
-  // health-reconcile/auto-repair loop (gated to exactly this one process --
-  // see `port === getSupervisorPort()` at the setInterval registration below)
-  // with no error and no log line. `serve test`'s own live-verification in the
-  // original fix used TEST_PORT (52440), which never exercises this path --
-  // that is why it didn't catch it.
-  //
-  // CORRECTION (4th review round): the real internal daemon is identified via
-  // __CLAUTH_SUPERVISOR_DAEMON (set by ensureSupervisorStarted, read nowhere
-  // until now), not by port -- see isGenuinelyIsolatedInstance's own comment
-  // for why the port-based version collided with sanctioned test
-  // infrastructure and had to be corrected.
-  const isInternalSupervisorDaemon = process.env.__CLAUTH_SUPERVISOR_DAEMON === "1";
-  if (isGenuinelyIsolatedInstance(isolated, isInternalSupervisorDaemon)) {
-    process.env.CLAUTH_SUPERVISOR_DIR = resolveIsolatedSupervisorDir(port, process.env.CLAUTH_SUPERVISOR_DIR);
-  }
-
   if (password) {
     console.log(chalk.gray("\n  Verifying vault credentials..."));
     try {
@@ -3211,34 +3022,21 @@ async function actionForeground(opts) {
   // so a stale/never-discovered plugin list could sit unnoticed until
   // someone happened to hit rescan. Discovery touching disk must never be
   // allowed to crash daemon boot, hence the try/catch.
-  let discoveryResult = null;
-  let discoveryError = null;
-  try {
-    discoveryResult = discoverPlugins();
-  } catch (err) {
-    discoveryError = err;
-    console.log(chalk.yellow(`  ⚠ plugin discovery failed at boot: ${err.message}`));
-  }
-
+  // BIND FIRST, DISCOVER SURFACES ON A SEPARATE TICK. Dave, 2026-09-04:
+  // "clauth should be able to respond to a health-ok while it is starting its
+  // surfaces — those should be separate threads." discoverPlugins() is a
+  // synchronous disk scan (readdirSync + manifest hashing) and createOpsServer()
+  // is awaited; running EITHER before server.listen() delays the :52439 bind, so
+  // /health does not answer until they finish. On CARBON7 that pushed the
+  // supervisor past the session guard's 15s /health wait and STOPped the session.
+  // Now the port binds and /health answers immediately; plugins + the ops server
+  // load in the background where a slow/offline discovery cannot block startup.
   const server = createServer(password, whitelist, port, tunnelHostname);
-  const opsServer = await createOpsServer();
   const opsPort = port + 4;
-  opsServer.listen(opsPort, "127.0.0.1", () => {
-    fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ops-server listening on port ${opsPort}\n`);
-  });
   server.listen(port, bindHost, () => {
     if (!isolated) writePid(process.pid, port);
     try {
       operation("daemon.started", { port, isolated }, null, { ok: true, version: VERSION }, "system");
-      operation(
-        "daemon.plugin_discovery",
-        { port },
-        null,
-        discoveryError
-          ? { ok: false, error: discoveryError.message }
-          : { ok: true, plugin_count: (discoveryResult?.plugins || discoveryResult || []).length },
-        "system",
-      );
     } catch { /* startup logging must never block the daemon from serving */ }
     console.log(chalk.green(`  clauth serve → http://${bindHost}:${port}`));
     if (tunnelHostname) {
@@ -3253,6 +3051,37 @@ async function actionForeground(opts) {
     if (!password && !isolated) console.log(chalk.cyan(`  👉 Open http://127.0.0.1:${port} to unlock`));
     console.log(chalk.gray("  Ctrl+C to stop\n"));
     if (!isolated) openBrowser(`http://127.0.0.1:${port}`);
+
+    // Surfaces load AFTER the port is bound and /health answers — separate tick.
+    setImmediate(async () => {
+      let discoveryResult = null;
+      let discoveryError = null;
+      try {
+        discoveryResult = discoverPlugins();
+      } catch (err) {
+        discoveryError = err;
+        console.log(chalk.yellow(`  ⚠ plugin discovery failed at boot: ${err.message}`));
+      }
+      try {
+        operation(
+          "daemon.plugin_discovery",
+          { port },
+          null,
+          discoveryError
+            ? { ok: false, error: discoveryError.message }
+            : { ok: true, plugin_count: (discoveryResult?.plugins || discoveryResult || []).length },
+          "system",
+        );
+      } catch { /* startup logging must never block the daemon from serving */ }
+      try {
+        const opsServer = await createOpsServer();
+        opsServer.listen(opsPort, "127.0.0.1", () => {
+          fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ops-server listening on port ${opsPort}\n`);
+        });
+      } catch (err) {
+        fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] ops-server failed to start: ${err.message}\n`);
+      }
+    });
   });
 
   server.on("error", err => {

package/cli/http/components/callagent-terminal-component.js

@@ -37,7 +37,7 @@ import { showTerminalSession } from "../../services/terminal-window.js";
 import { channelEvents, MAX_CHANNEL_EVENTS } from "../../services/terminal-registry.js";
 import crypto from "node:crypto";
 
-const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
 
 export function registerCallAgentTerminalRoutes(ctx) {
   // ── call_agent (Gate B) ───────────────────────────────────────────────────
@@ -46,7 +46,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // async: returns { ok, jobId } immediately; poll GET /call-agent/:jobId.
   ctx.registerWriteRoute("POST", "/call-agent", async (req, res, url) => {
       const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-      const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
+      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
       // call_agent spawns real `claude` workers. Like legacy /dispatch, it is a
       // local-tool-only path: reject any browser Origin (CSRF) and, on a noauth
       // tunnel host (clauth.regendevcorp.com etc.), require a valid
@@ -85,7 +85,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // GET /call-agent/:jobId — poll an async (or completed) call_agent job.
   ctx.registerPatternRoute("GET", /^\/call-agent\/([^/]+)$/, async (req, res, match, url) => {
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-    const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
+    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
     {
       const expectedToken = await ctx.resolveCallAgentToken();
       const verdict = ctx.evaluateCallAgentGuard({
@@ -113,7 +113,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // same guard as the poll route above.
   ctx.registerPatternRoute("POST", /^\/call-agent\/([^/]+)\/(show|hide)$/, async (req, res, match, url) => {
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-    const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
+    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
     {
       const expectedToken = await ctx.resolveCallAgentToken();
       const verdict = ctx.evaluateCallAgentGuard({
@@ -137,7 +137,7 @@ export function registerCallAgentTerminalRoutes(ctx) {
   // GET /call-agent — pool stats (health/debug, no credentials).
   ctx.registerWriteRoute("GET", "/call-agent", async (req, res, url) => {
       const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
-      const noAuthHost = !LOOPBACK_HOSTS.has(requestHost);
+      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
       {
         const expectedToken = await ctx.resolveCallAgentToken();
         const verdict = ctx.evaluateCallAgentGuard({

package/cli/http/components/mcp-transport-component.js

@@ -34,11 +34,15 @@ const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../../package.js
 const VERSION = pkg.version;
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 
+// Hosts that bypass OAuth (fresh domains for claude.ai compatibility) —
+// those domains use the tunnel URL itself as a shared secret (like regen-media).
+const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
 const MCP_PATHS = ["/mcp", "/gws", "/clauth", "/fs"];
 
 function hostFlags(req) {
   const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
   return {
+    noAuthHost: NOAUTH_HOSTS.includes(requestHost),
     localTrustedHost: ["127.0.0.1", "localhost", "::1", "[::1]"].includes(requestHost),
   };
 }
@@ -56,18 +60,19 @@ function serverNameForPath(p) {
   if (p === "/fs")       return "fs";
   return "clauth";
 }
-function validOAuthToken(ctx, token, reqPath) {
-  const record = token && ctx.oauthTokens.get(token);
-  if (!record || (record.expires && record.expires <= Date.now())) return false;
-  const scopes = record.scopes || ["mcp:tools"];
-  if (!reqPath || !MCP_PATHS.includes(reqPath)) return scopes.includes("mcp:tools") || scopes.includes("mcp:all");
-  return scopes.includes("mcp:tools") || scopes.includes("mcp:all") || scopes.includes(`mcp:${serverNameForPath(reqPath)}`);
-}
 
 export function registerMcpTransportRoutes(ctx) {
   // ── OAuth Discovery (RFC 9728 + RFC 8414) — any /.well-known/* path ──
   ctx.registerPatternRoute("GET", /^\/\.well-known\//, async (req, res, match, url) => {
       const reqPath = url.pathname;
+      const { noAuthHost } = hostFlags(req);
+
+      // Suppress OAuth discovery on noauth hosts — prevents claude.ai from entering OAuth flow
+      if (noAuthHost) {
+        res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ error: "not_found" }));
+      }
+
       // Restore full well-known + OAuth so custom setup with client_id/secret works.
       if (reqPath.startsWith("/.well-known/oauth-protected-resource")) {
         const base = ctx.oauthBase();
@@ -118,13 +123,14 @@ export function registerMcpTransportRoutes(ctx) {
 
 async function handleMcpPost(ctx, req, res, url, reqPath) {
   const isMcpPath = MCP_PATHS.includes(reqPath);
-  const { localTrustedHost } = hostFlags(req);
+  const { noAuthHost, localTrustedHost } = hostFlags(req);
 
   // ── MCP endpoint auth — 401 gate (OAuth 2.1 protocol) ──
+  // Skipped for noauth hosts — those domains use tunnel URL as shared secret (like regen-media)
   const authHeader = req.headers.authorization;
   const token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
 
-  if (!localTrustedHost && !validOAuthToken(ctx, token, reqPath)) {
+  if (!noAuthHost && !localTrustedHost && (!token || !ctx.oauthTokens.has(token))) {
     // No valid Bearer token → return 401 with discovery hint
     const base = ctx.oauthBase();
     const resourcePath = isMcpPath ? reqPath.slice(1) : "sse"; // "mcp", "gws", "clauth", or "sse"
@@ -216,6 +222,7 @@ async function handleMcpPost(ctx, req, res, url, reqPath) {
 }
 
 function handleMcpGet(ctx, req, res, url, reqPath) {
+  const { noAuthHost } = hostFlags(req);
 
   // ── MCP SSE transport — /sse and namespaced paths ────
   // Remote clients (claude.ai) arrive with a Bearer token via OAuth.
@@ -225,7 +232,7 @@ function handleMcpGet(ctx, req, res, url, reqPath) {
   if (isMcpPath) {
     const getAuthHeader = req.headers.authorization;
     const getToken = getAuthHeader?.startsWith("Bearer ") ? getAuthHeader.slice(7) : null;
-    if (validOAuthToken(ctx, getToken, reqPath)) {
+    if (!noAuthHost && getToken && ctx.oauthTokens.has(getToken)) {
       res.writeHead(405, { "Content-Type": "application/json", "Allow": "POST", ...ctx.CORS });
       return res.end(JSON.stringify({ error: "Method Not Allowed", detail: "Use POST for Streamable HTTP transport" }));
     }