6 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Sonnet 4.6	c7e0192486	feat(auth): add Dex JWT middleware to supervisor, routing pod, and brain MCP ... Closes #6 on gitea.d-ma.be/mathias/hyperguild. Dex is deployed at auth.d-ma.be. All three MCP servers now accept JWTs issued by Dex in addition to static bearer tokens, enabling claude.ai OAuth 2.0 integration without abandoning backward-compat CLI auth. Changes: - internal/auth/: new Validator (JWKS auto-refresh via lestrrat-go/jwx/v2), ProtectedResourceHandler (RFC 9728 /.well-known/oauth-protected-resource) - internal/mcp/Server: adds optional *auth.Validator; checkAuth tries JWT first, then static token fallback; both-nil = auth disabled (unchanged default) - cmd/supervisor, cmd/routing: construct Validator from DEX_ISSUER_URL + MCP_AUDIENCE env vars; register protected-resource handler when set - ingestion/internal/auth/: same Validator + handler (separate module) - ingestion/internal/mcp/BearerAuth: same JWT-or-static chain - ingestion/cmd/server: same wiring pattern New env vars (all optional; absent = static-token-only, same as before): DEX_ISSUER_URL — Dex issuer URL (e.g. https://auth.d-ma.be) MCP_AUDIENCE — expected aud claim (e.g. brain, supervisor) MCP_RESOURCE_URL — resource identifier for RFC 9728 metadata response Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-11 20:10:05 +02:00
mathiasandClaude Sonnet 4.6	43a8255272	fix(mcp): add SSE GET handler for streamable HTTP transport ... claude.ai probes with GET before initialize; without this the supervisor returned application/json parse error instead of text/event-stream, causing "Couldn't reach the MCP server" in the claude.ai connector setup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-07 23:27:56 +02:00
mathiasandClaude Opus 4.7	928f23ab1b	feat(mcp): optional bearer-token auth via SUPERVISOR_MCP_TOKEN ... Enables exposing the supervisor MCP via Tailscale Funnel for claude.ai custom-connector tests. Auth is opt-in: empty SUPERVISOR_MCP_TOKEN preserves the existing unauthenticated behavior for tailnet-internal callers and local dev. When the token is set, every request must carry "Authorization: Bearer <token>" or it is rejected with HTTP 401 and a JSON-RPC -32001 error. Comparison uses crypto/subtle.ConstantTimeCompare; the token value and the supplied header are never logged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-04 07:31:29 +02:00
mathiasandClaude Opus 4.7	7f7524c859	fix(mcp): do not respond to JSON-RPC notifications ... The supervisor's MCP HTTP handler was answering every parsed request, including notifications (messages with no id field). Per JSON-RPC 2.0, notifications must not receive a response. The Apr-29 incident saw Claude Code's MCP client receive a -32601 error for the standard notifications/initialized handshake step and disconnect immediately after a successful initialize. Skip writing the response when req.ID == nil. Cover both the known-method (notifications/initialized) and unknown-method paths with tests. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-29 08:39:20 +02:00
mathiasandClaude Sonnet 4.6	a67106026f	fix(lint): satisfy errcheck for io.Copy, json.Encode, Body.Close, deferred Close ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-19 07:15:35 +02:00
mathias	edf47af8cf	feat: add MCP HTTP server with JSON-RPC 2.0 transport	2026-04-17 07:40:57 +02:00