e374440c67
code-forge (the stdio MCP server) calls the REST API directly and has no login flow of its own. With auth disabled it already passes through as guest, same as before - but the moment CLAUDE_OS_EMAIL/ PASSWORD get set, it would start getting 401'd with no way to authenticate. get_current_user now accepts a CLAUDE_OS_SERVICE_TOKEN as a bearer token, checked with a constant-time compare, alongside normal user JWTs. claude_code_mcp.py sends it (via a shared _auth_headers() used by all 5 of its httpx.AsyncClient() call sites) whenever CLAUDE_OS_SERVICE_TOKEN is set, and sends nothing when it isn't - a no-op change for anyone not using auth. Since this process can be launched directly (e.g. over SSH as a stdio server) without claude-os's own .env sourced into its shell or its cwd set to the project root, it now loads .env explicitly by path relative to the script's own location rather than relying on load_dotenv()'s cwd-relative default search. |
||
|---|---|---|
| .. | ||
| tools | ||
| __init__.py | ||
| auth.py | ||
| claude_code_mcp.py | ||
| server.py | ||