xarmian 1339916b9c feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717) ...

OpenAI verifies a plugin's domain by fetching the token its dashboard
issued from /.well-known/openai-apps-challenge on the MCP host, and the
body must be the token alone.

PAD_OPENAI_APPS_CHALLENGE (toml openai_apps_challenge) resolves into
config.MCPEndpoints, so it reaches the server through the existing
SetMCPConfig binding. A value with inner whitespace or a control
character, or over 1024 bytes, is refused into Problems() and logged at
startup rather than served.

The route answers 200 text/plain with exactly the token only on cloud,
only with a token set, and only on the MCP URL's host. Every other case
is the U0a JSON 404, byte-identical to an unowned well-known path. It is
not behind the MCP or OAuth availability gates, because verification
happens before the plugin server is switched on.

Co-authored-by: Claude <noreply@anthropic.com>

2026-10-02 04:08:52 -04:00

..

apps_challenge_test.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

collab_limit_config_test.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

config_test.go

feat(cli): pad session arm/disarm/status + consent config resolution (PLAN-2613 S2, TASK-2617) (#1149)

2026-08-17 22:44:31 -04:00

config.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

encryption_key_test.go

fix(config): auto-generate PAD_ENCRYPTION_KEY on first run (TASK-668) (#189)

2026-04-22 08:45:56 -04:00

mcp_chatgpt_test.go

feat(oauth): a second canonical resource, with every token bound to one (TASK-3321 U2a) (#1715)

2026-10-02 02:06:09 -04:00

mcp_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

mcp.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

redis_stream_config_test.go

fix(watchevents): detect a half-open Redis connection with a bus heartbeat (BUG-2769) (#1199)

2026-08-25 11:04:18 -04:00