@neus/sdk 1.2.1 → 1.2.2

package/mcp-hosts.js

@@ -57,11 +57,36 @@ export const IDE_HOST_BRAND_LOGOS = {
 };
 
 /**
+ * Build the MCP HTTP server config for an IDE/client.
+ *
+ * Two paths, one session model — same NEUS Profile/Account either way:
+ *
+ * - `npk_…` Profile access keys are durable (never expire). Written as a static
+ *   `Authorization: Bearer npk_…` header. Used for operator IDEs, servers, CI,
+ *   and automation where browser OAuth is unavailable.
+ * - OAuth (default for Cursor, VS Code, Claude Code, Codex): we return a URL-only
+ *   config (no `headers`). The IDE MCP client discovers OAuth metadata from the
+ *   server's `401 + WWW-Authenticate` challenge, then runs its own DCR + PKCE +
+ *   silent-refresh lifecycle (matching Linear, GitHub, Notion). The access token
+ *   is a short-lived JWT refreshed silently by the host for up to 30 days via the
+ *   `offline_access` refresh token — the session is long-lived, the access token
+ *   is not
+ *
+ * A raw OAuth access token (JWT) is never written as a static Bearer header: IDE
+ * MCP clients cannot refresh a static header, and writing one would create a
+ * session that dies when the access token expires. URL-only config is the correct
+ * OAuth path and is what `neus setup`/`neus auth` produce for browser-OAuth clients.
+ *
  * @param {string | null | undefined} accessKey
  * @returns {{ type: 'http'; url: string; headers?: { Authorization: string } }}
  */
 export function buildNeusMcpHttpConfig(accessKey) {
   const key = String(accessKey || '').trim();
+  // OAuth access tokens are JWTs (three dot-separated base64url segments). Never write
+  // them as a static Bearer header — return URL-only so the IDE runs OAuth itself.
+  if (key && !key.startsWith('npk_') && key.split('.').length === 3) {
+    return { type: 'http', url: NEUS_MCP_URL };
+  }
   return {
     type: 'http',
     url: NEUS_MCP_URL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neus/sdk",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "NEUS makes trust portable across the internet — so people, apps, and AI agents can prove what is real before access, payout, or execution.",
   "bin": {
     "neus": "cli/neus.mjs"