@mathismeadows/roamer-device-auth 1.5.0 → 1.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -197,8 +197,20 @@ async function listKnownClientSlugs() {
   for (const entry of entries) {
     // Safe to split on "__" without ambiguity: neither a client slug (clientSlugFromInitializeLine)
     // nor an identity key (identityKeyFromTokens) can contain an underscore post-sanitization.
-    const match = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)__/);
-    if (match) slugs.add(match[1]);
+    const withIdentity = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)__/);
+    if (withIdentity) {
+      slugs.add(withIdentity[1]);
+      continue;
+    }
+    // BUG (found live 2026-09-08, caused a real cross-session logout): a slug that has never
+    // reconnected since AUTH-54 shipped only has the pre-AUTH-54 legacy file — no identity
+    // segment at all — and was invisible here. login/logout's own "if status lists exactly one
+    // slug, there's no ambiguity" reasoning then wrongly treated a real, actively-used client as
+    // nonexistent, silently acting on a *different* session's slug instead because it was the
+    // only one that happened to already be migrated. A legacy-only slug must still count as a
+    // real, known candidate even though it has no identity cached under the new scheme yet.
+    const legacy = entry.match(/^roamer_(?:tokens|loopback_tokens)__([^_]+)\.json$/);
+    if (legacy) slugs.add(legacy[1]);
   }
   return [...slugs].sort();
 }
@@ -538,7 +550,22 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
   const active = forceFreshLogin ? null : await readActiveIdentity(clientSlug);
   const identityKey = active?.identityKey ?? null;
 
-  let tokens = forceRefresh || forceFreshLogin ? null : await readCachedTokens(clientSlug, identityKey);
+  // BUG (found live, same session, immediately post-1.5.0-publish): identityKey being null
+  // here is ambiguous between "no active identity has ever been established" (must never read
+  // any file — force a fresh sign-in) and "explicitly asked for the identity-less cache" (only
+  // ever true from a 2-arg test call). cacheFilePath maps a null identityKey to the exact same
+  // filename AUTH-54 shipped alongside — the pre-AUTH-54 file every already-authenticated
+  // client already had on disk. Without this guard, a machine upgrading straight from a
+  // pre-AUTH-54 version silently keeps reusing that old file forever (a real "reused existing
+  // creds" notification a user hit immediately after this shipped) and never establishes an
+  // active-identity pointer at all — reproducing the exact silent-stale-identity bug AUTH-54
+  // exists to fix, and permanently hiding that identity from login/logout/status, which only
+  // ever look at the new (client, identity)-keyed files. noActiveIdentity forces the same
+  // fresh-sign-in path a genuinely first-ever run takes, which is what self-heals into a real
+  // active pointer + a new-format file — see the fresh-sign-in branch below.
+  const noActiveIdentity = !forceFreshLogin && !active;
+
+  let tokens = forceRefresh || forceFreshLogin || noActiveIdentity ? null : await readCachedTokens(clientSlug, identityKey);
 
   if (!forceRefresh && !forceFreshLogin && tokens?.access_token && !expiresSoon(tokens)) {
     return { tokens, reusedSilently: true, identityKey, label: active?.label };
@@ -700,8 +727,12 @@ async function doGetValidTokensLoopback(clientSlug, forceRefresh, forceFreshLogi
 
   const active = forceFreshLogin ? null : await readActiveIdentity(clientSlug);
   const identityKey = active?.identityKey ?? null;
+  // See doGetValidTokens's identical guard above for why this is required, not optional: a
+  // null identityKey here would otherwise silently resolve to the exact pre-AUTH-54 filename.
+  const noActiveIdentity = !forceFreshLogin && !active;
 
-  let tokens = forceRefresh || forceFreshLogin ? null : await readLoopbackTokens(clientSlug, issuerUrl, identityKey);
+  let tokens =
+    forceRefresh || forceFreshLogin || noActiveIdentity ? null : await readLoopbackTokens(clientSlug, issuerUrl, identityKey);
 
   if (!forceRefresh && !forceFreshLogin && tokens?.access_token && !expiresSoon(tokens)) {
     return { tokens, reusedSilently: true, identityKey, label: active?.label };