@mathismeadows/roamer-device-auth 1.1.1 → 1.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "private": false,
   "type": "module",
   "description": "AUTH-25: server-mediated device authorization flow + stdio<->HTTP MCP proxy for Roamer MCP. Used by roamer-bridge.sh for every OS and every default browser (no more Safari-specific branching, AUTH-14) — Cloudflare Access's Managed OAuth has no device-code grant of its own, so RoamerMcp's server implements it and this script talks to that instead of Entra directly.",

package/roamer-device-auth.mjs

@@ -25,6 +25,7 @@ import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
 import qrcode from "qrcode-terminal";
 
 const execFileAsync = promisify(execFile);
@@ -34,6 +35,7 @@ const ROAMER_MCP_ORIGIN = new URL(ROAMER_MCP_URL).origin;
 
 const CACHE_DIR = join(homedir(), ".mcp-auth-device");
 const CACHE_FILE = join(CACHE_DIR, "roamer_tokens.json");
+const PENDING_FILE = join(CACHE_DIR, "roamer_pending.json");
 
 // Bumped whenever the cached shape changes meaningfully. A cache written by a prior
 // mechanism (e.g. the retired Entra-direct flow, AUTH-11/14) happens to share field names
@@ -90,6 +92,35 @@ function clearCachedTokens() {
   return writeFile(CACHE_FILE, "{}", { mode: 0o600 }).catch(() => {});
 }
 
+// Claude Code (or any MCP host) may kill this process and respawn a fresh one if it doesn't
+// see a stdio handshake within its own connect timeout — and the interactive device flow
+// (dialog -> browser -> Cloudflare's consent screen -> poll) routinely takes longer than a
+// human can click through inside a short timeout. Without persisting the in-progress flow,
+// every respawn called /oauth/device/start again, which mints a BRAND NEW device_code/
+// user_code — the user would see a different code every single retry, forever, with no
+// path to ever actually finish signing in. Confirmed live 2026-08-21. Persisting the
+// pending flow means a respawned process resumes polling the SAME still-valid code instead.
+async function readPendingFlow() {
+  try {
+    const pending = JSON.parse(await readFile(PENDING_FILE, "utf8"));
+    if (!pending?.device_code || Date.now() > pending.expiresAt) return null;
+    return pending;
+  } catch {
+    return null;
+  }
+}
+
+async function writePendingFlow(device) {
+  await mkdir(CACHE_DIR, { recursive: true, mode: 0o700 });
+  const pending = { ...device, expiresAt: Date.now() + device.expires_in * 1000 };
+  await writeFile(PENDING_FILE, JSON.stringify(pending, null, 2), { mode: 0o600 });
+  return pending;
+}
+
+function clearPendingFlow() {
+  return writeFile(PENDING_FILE, "{}", { mode: 0o600 }).catch(() => {});
+}
+
 function expiresSoon(tokens) {
   // expires_in is optional in the response shape — an absent value means treat the token as
   // long-lived and rely on a real 401 to trigger re-auth rather than guessing a lifetime.
@@ -178,36 +209,153 @@ async function doGetValidTokens(forceRefresh) {
 
   if (forceRefresh) await clearCachedTokens();
 
-  log("Starting sign-in...");
-  const device = await startDeviceFlow();
+  // Resume an already-in-progress flow (from a process this host killed and respawned)
+  // instead of minting a new device_code the user would have to start over for.
+  let device = await readPendingFlow();
+  let resuming = Boolean(device);
+  if (!resuming) {
+    log("Starting sign-in...");
+    device = await startDeviceFlow();
+    await writePendingFlow(device);
+  } else {
+    log("Resuming an already-in-progress sign-in (a prior process was restarted before it finished)...");
+  }
+
   log(`Go to ${device.verification_uri} and enter code: ${device.user_code}`);
   // Fire-and-forget: the dialog is how the human actually sees this on macOS; polling below
-  // must not wait on it being dismissed.
-  showDeviceCodeDialog(device.verification_uri, device.user_code);
-  try {
-    const { default: open } = await import("open");
-    await open(device.verification_uri_complete);
-  } catch {
-    // Best-effort only — the dialog and QR code below already carry the URL and code.
+  // must not wait on it being dismissed. Skip re-showing it on a resume — the human already
+  // saw it (or is mid-flow in the browser) from the process that started this same code.
+  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
+  if (!resuming) {
+    try {
+      const { default: open } = await import("open");
+      await open(device.verification_uri_complete);
+    } catch {
+      // Best-effort only — the dialog and QR code below already carry the URL and code.
+    }
   }
   // Terminal-visible for any client where a human sees this process's stderr/log output
   // (Claude Code CLI, VS Code's integrated terminal) — QR codes are a real usability win
   // for CLI auth over typing an 8-character code by hand.
-  qrcode.generate(device.verification_uri_complete, { small: true }, (qr) => {
-    process.stderr.write(`${qr}\n`);
-  });
+  if (!resuming) {
+    qrcode.generate(device.verification_uri_complete, { small: true }, (qr) => {
+      process.stderr.write(`${qr}\n`);
+    });
+  }
 
-  const fresh = await pollDeviceFlow(device.device_code, device.interval ?? 5);
-  tokens = { ...fresh, obtained_at: Date.now() };
-  await writeCachedTokens(tokens);
-  log("Sign-in complete.");
-  return tokens;
+  try {
+    const fresh = await pollDeviceFlow(device.device_code, device.interval ?? 5);
+    tokens = { ...fresh, obtained_at: Date.now() };
+    await writeCachedTokens(tokens);
+    await clearPendingFlow();
+    log("Sign-in complete.");
+    return tokens;
+  } catch (err) {
+    // A hard failure (expired/denied, not just this process being killed) means the pending
+    // code is genuinely dead — clear it so the next attempt starts a real fresh one instead
+    // of retrying a code that will never succeed.
+    await clearPendingFlow();
+    throw err;
+  }
+}
+
+// AUTH-28: extracted so it can run both for live traffic (post-sign-in) and for messages
+// queued while sign-in was still in progress, with identical forwarding/retry behavior.
+async function forwardLine(transport, line, getTokens, setTokens) {
+  try {
+    let tokens = getTokens();
+    if (expiresSoon(tokens)) {
+      tokens = await getValidTokens();
+      setTokens(tokens);
+    }
+    try {
+      await transport.send(JSON.parse(line));
+    } catch (err) {
+      // Reactive invalidation: proactive expiry math can't catch everything (server-side
+      // revocation, clock skew, or an incompatible cache — see CACHE_VERSION). A real
+      // auth failure from the server is the ground truth; when we see one, invalidate
+      // whatever we're holding, force a genuinely fresh token, and retry once.
+      if (!isAuthError(err)) throw err;
+      log(`Send failed with an auth error (${err.message}) — invalidating cached token and retrying once.`);
+      tokens = await getValidTokens(true);
+      setTokens(tokens);
+      await transport.send(JSON.parse(line));
+    }
+  } catch (err) {
+    log(`Send failed: ${err.message}`);
+  }
+}
+
+// AUTH-28: a hard sign-in failure (denied/expired device code) must tell the host exactly
+// that, per request, rather than leaving requests unanswered for the host to time out on.
+function respondWithSignInError(line, err) {
+  let id = null;
+  try {
+    id = JSON.parse(line)?.id ?? null;
+  } catch {
+    // Malformed input never had a usable id anyway — respond with null per JSON-RPC convention.
+  }
+  const response = {
+    jsonrpc: "2.0",
+    id,
+    error: { code: -32001, message: `Roamer MCP sign-in failed: ${err.message}` },
+  };
+  process.stdout.write(`${JSON.stringify(response)}\n`);
 }
 
 async function main() {
-  let tokens = await getValidTokens();
+  // AUTH-28: stdin is read (and, until sign-in completes, queued) from the very first tick —
+  // a cold-cache device-code flow can take minutes, and the MCP host must never see this
+  // process as unresponsive/silent during that window. That silence, not the auth flow
+  // itself, is what triggers the host's connect-timeout kill/respawn (see readPendingFlow's
+  // comment above) — this fix targets the silence, not the flow's real, unavoidable duration.
+  let tokens = null;
+  let transport = null;
+  let ready = false;
+  const pendingLines = [];
+
+  const getTokens = () => tokens;
+  const setTokens = (fresh) => {
+    tokens = fresh;
+  };
 
-  const transport = new StreamableHTTPClientTransport(new URL(ROAMER_MCP_URL), {
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    let newlineIndex;
+    while ((newlineIndex = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, newlineIndex);
+      buffer = buffer.slice(newlineIndex + 1);
+      if (!line.trim()) continue;
+      if (ready) {
+        forwardLine(transport, line, getTokens, setTokens);
+      } else {
+        pendingLines.push(line);
+      }
+    }
+  });
+
+  process.stdin.on("end", async () => {
+    log("stdin closed, shutting down.");
+    if (transport) await transport.close();
+    process.exit(0);
+  });
+
+  log("Local STDIO proxy running. Press Ctrl+C to exit.");
+
+  try {
+    tokens = await getValidTokens();
+  } catch (err) {
+    // Sign-in genuinely failed (denied/expired), not just slow — every message queued while
+    // we waited, starting with `initialize`, gets a real JSON-RPC error so the host sees an
+    // explicit failure instead of a process it has to silently time out on.
+    log(`Sign-in failed: ${err.message}`);
+    for (const line of pendingLines) respondWithSignInError(line, err);
+    process.exit(1);
+  }
+
+  transport = new StreamableHTTPClientTransport(new URL(ROAMER_MCP_URL), {
     requestInit: {
       get headers() {
         return { Authorization: `Bearer ${tokens.access_token}` };
@@ -217,14 +365,11 @@ async function main() {
 
   transport.onerror = (err) => {
     log(`Transport error: ${err.message}`);
-    // Same reasoning as the send-path retry below: an auth error means whatever's cached is
+    // Same reasoning as the send-path retry above: an auth error means whatever's cached is
     // known-bad, so drop it now rather than let the next proactive expiresSoon() check
     // (which only reasons about calendar time) keep handing it out.
     if (isAuthError(err)) clearCachedTokens();
   };
-  await transport.start();
-  log("Connected to remote server using StreamableHTTPClientTransport.");
-
   // stdin/stdout <-> transport pass-through. Each stdin line is one JSON-RPC message;
   // transport.send() delivers it, and transport.onmessage delivers whatever comes back
   // (including server-initiated messages over the SSE half of the streamable-HTTP transport).
@@ -232,49 +377,23 @@ async function main() {
     process.stdout.write(`${JSON.stringify(message)}\n`);
   };
 
-  let buffer = "";
-  process.stdin.setEncoding("utf8");
-  process.stdin.on("data", (chunk) => {
-    buffer += chunk;
-    let newlineIndex;
-    while ((newlineIndex = buffer.indexOf("\n")) !== -1) {
-      const line = buffer.slice(0, newlineIndex);
-      buffer = buffer.slice(newlineIndex + 1);
-      if (!line.trim()) continue;
-      (async () => {
-        try {
-          if (expiresSoon(tokens)) {
-            tokens = await getValidTokens();
-          }
-          try {
-            await transport.send(JSON.parse(line));
-          } catch (err) {
-            // Reactive invalidation: proactive expiry math can't catch everything (server-side
-            // revocation, clock skew, or an incompatible cache — see CACHE_VERSION). A real
-            // auth failure from the server is the ground truth; when we see one, invalidate
-            // whatever we're holding, force a genuinely fresh token, and retry once.
-            if (!isAuthError(err)) throw err;
-            log(`Send failed with an auth error (${err.message}) — invalidating cached token and retrying once.`);
-            tokens = await getValidTokens(true);
-            await transport.send(JSON.parse(line));
-          }
-        } catch (err) {
-          log(`Send failed: ${err.message}`);
-        }
-      })();
-    }
-  });
+  await transport.start();
+  log("Connected to remote server using StreamableHTTPClientTransport.");
 
-  process.stdin.on("end", async () => {
-    log("stdin closed, shutting down.");
-    await transport.close();
-    process.exit(0);
-  });
+  ready = true;
+  for (const line of pendingLines) {
+    forwardLine(transport, line, getTokens, setTokens);
+  }
+}
 
-  log("Local STDIO proxy running. Press Ctrl+C to exit.");
+// Only auto-run when invoked directly (npx/CLI) — importing this module from a test file
+// must not trigger a live device-auth flow and stdio takeover as a side effect.
+const isMainModule = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMainModule) {
+  main().catch((err) => {
+    log(`Fatal error: ${err.stack ?? err.message}`);
+    process.exit(1);
+  });
 }
 
-main().catch((err) => {
-  log(`Fatal error: ${err.stack ?? err.message}`);
-  process.exit(1);
-});
+export { respondWithSignInError, forwardLine };