@mathismeadows/roamer-device-auth 1.2.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "private": false,
   "type": "module",
   "description": "AUTH-14/AUTH-25: stdio<->HTTP MCP proxy for Roamer MCP with two auth mechanisms, chosen per-machine by default-browser detection. Safari-default machines use a server-mediated device authorization flow (AUTH-25) since Safari's HTTPS-Only Mode blocks a loopback redirect; every other machine uses a standard direct loopback redirect against Cloudflare Access Managed OAuth instead.",

package/roamer-device-auth.mjs

@@ -30,6 +30,7 @@ import {
   refreshAuthorization,
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -650,7 +651,10 @@ async function main() {
 
 // Only auto-run when invoked directly (npx/CLI) — importing this module from a test file
 // must not trigger a live device-auth flow and stdio takeover as a side effect.
-const isMainModule = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+// AUTH-29: npx always launches this via the node_modules/.bin symlink, so argv[1] must be
+// realpath-resolved before comparing — import.meta.url is already realpath-resolved by Node.
+const isMainModule =
+  process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
 if (isMainModule) {
   main().catch((err) => {
     log(`Fatal error: ${err.stack ?? err.message}`);