@mathismeadows/roamer-device-auth 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -312,8 +312,15 @@ async function refreshTokens(refreshToken) {
   return response.json();
 }
 
-async function startDeviceFlow() {
-  const response = await fetch(`${ROAMER_MCP_ORIGIN}/oauth/device/start`, { method: "POST" });
+// AUTH-52: carries the same client identity the loopback flow already sends at DCR
+// registration, so the server's device-code confirm/success/failure/contact-email pages can
+// name which client each sign-in prompt is actually for, instead of a generic message.
+async function startDeviceFlow(clientSlug) {
+  const response = await fetch(`${ROAMER_MCP_ORIGIN}/oauth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_name: clientSlug }),
+  });
   if (!response.ok) {
     throw new Error(`Device flow start failed: ${response.status} ${await response.text()}`);
   }
@@ -392,7 +399,7 @@ async function doGetValidTokens(clientSlug, forceRefresh) {
   let resuming = Boolean(device);
   if (!resuming) {
     log("Starting sign-in...");
-    device = await startDeviceFlow();
+    device = await startDeviceFlow(clientSlug);
     await writePendingFlow(clientSlug, device);
   } else {
     log("Resuming an already-in-progress sign-in (a prior process was restarted before it finished)...");