@mathismeadows/roamer-device-auth 1.5.0 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -538,7 +538,22 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
   const active = forceFreshLogin ? null : await readActiveIdentity(clientSlug);
   const identityKey = active?.identityKey ?? null;
 
-  let tokens = forceRefresh || forceFreshLogin ? null : await readCachedTokens(clientSlug, identityKey);
+  // BUG (found live, same session, immediately post-1.5.0-publish): identityKey being null
+  // here is ambiguous between "no active identity has ever been established" (must never read
+  // any file — force a fresh sign-in) and "explicitly asked for the identity-less cache" (only
+  // ever true from a 2-arg test call). cacheFilePath maps a null identityKey to the exact same
+  // filename AUTH-54 shipped alongside — the pre-AUTH-54 file every already-authenticated
+  // client already had on disk. Without this guard, a machine upgrading straight from a
+  // pre-AUTH-54 version silently keeps reusing that old file forever (a real "reused existing
+  // creds" notification a user hit immediately after this shipped) and never establishes an
+  // active-identity pointer at all — reproducing the exact silent-stale-identity bug AUTH-54
+  // exists to fix, and permanently hiding that identity from login/logout/status, which only
+  // ever look at the new (client, identity)-keyed files. noActiveIdentity forces the same
+  // fresh-sign-in path a genuinely first-ever run takes, which is what self-heals into a real
+  // active pointer + a new-format file — see the fresh-sign-in branch below.
+  const noActiveIdentity = !forceFreshLogin && !active;
+
+  let tokens = forceRefresh || forceFreshLogin || noActiveIdentity ? null : await readCachedTokens(clientSlug, identityKey);
 
   if (!forceRefresh && !forceFreshLogin && tokens?.access_token && !expiresSoon(tokens)) {
     return { tokens, reusedSilently: true, identityKey, label: active?.label };
@@ -700,8 +715,12 @@ async function doGetValidTokensLoopback(clientSlug, forceRefresh, forceFreshLogi
 
   const active = forceFreshLogin ? null : await readActiveIdentity(clientSlug);
   const identityKey = active?.identityKey ?? null;
+  // See doGetValidTokens's identical guard above for why this is required, not optional: a
+  // null identityKey here would otherwise silently resolve to the exact pre-AUTH-54 filename.
+  const noActiveIdentity = !forceFreshLogin && !active;
 
-  let tokens = forceRefresh || forceFreshLogin ? null : await readLoopbackTokens(clientSlug, issuerUrl, identityKey);
+  let tokens =
+    forceRefresh || forceFreshLogin || noActiveIdentity ? null : await readLoopbackTokens(clientSlug, issuerUrl, identityKey);
 
   if (!forceRefresh && !forceFreshLogin && tokens?.access_token && !expiresSoon(tokens)) {
     return { tokens, reusedSilently: true, identityKey, label: active?.label };