@mathismeadows/roamer-device-auth 1.5.3 → 1.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -639,10 +639,12 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
   }
 
   log(`Go to ${device.verification_uri} and enter code: ${device.user_code}`);
-  // Fire-and-forget: the dialog is how the human actually sees this on macOS; polling below
-  // must not wait on it being dismissed. Skip re-showing it on a resume — the human already
-  // saw it (or is mid-flow in the browser) from the process that started this same code.
-  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
+  // AUTH-61: launch the browser first, then show the fallback dialog — both are best-effort
+  // OS-level UI activations, and requesting them in the same instant can leave Safari
+  // intermittently stuck showing "Application Not Responding" on launch (macOS-only; see
+  // thread AUTH-safari-device-flow-hang). The dialog stays fire-and-forget: polling below
+  // must not wait on it being dismissed. Skip both on a resume — the human already saw them
+  // (or is mid-flow in the browser) from the process that started this same code.
   if (!resuming) {
     try {
       const { default: open } = await import("open");
@@ -651,6 +653,7 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
       // Best-effort only — the dialog and QR code below already carry the URL and code.
     }
   }
+  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
   // Terminal-visible for any client where a human sees this process's stderr/log output
   // (Claude Code CLI, VS Code's integrated terminal) — QR codes are a real usability win
   // for CLI auth over typing an 8-character code by hand.
@@ -906,6 +909,37 @@ async function forwardLine(transport, line, getTokens, setTokens, getFreshTokens
   }
 }
 
+// AUTH-60: a reserved, locally-answered resource — never forwarded to the real upstream
+// server. Lets the exact connection asking report its own resolved clientSlug/identityLabel
+// back through the MCP session itself, with no external file or PID correlation required
+// (see AUTH-60's notes for why a file-based "list live connections" design was rejected).
+function isWhoamiResourceRead(line) {
+  try {
+    const message = JSON.parse(line);
+    return message?.method === "resources/read" && message?.params?.uri === "roamer://whoami";
+  } catch {
+    return false;
+  }
+}
+
+function respondWhoami(line, clientSlug, identityLabel) {
+  let id = null;
+  try {
+    id = JSON.parse(line)?.id ?? null;
+  } catch {
+    // Malformed input never had a usable id anyway — respond with null per JSON-RPC convention.
+  }
+  const payload = { clientSlug: clientSlug ?? null, identityLabel: identityLabel ?? null };
+  const response = {
+    jsonrpc: "2.0",
+    id,
+    result: {
+      contents: [{ uri: "roamer://whoami", mimeType: "application/json", text: JSON.stringify(payload, null, 2) }],
+    },
+  };
+  process.stdout.write(`${JSON.stringify(response)}\n`);
+}
+
 // AUTH-28: a hard sign-in failure (denied/expired device code) must tell the host exactly
 // that, per request, rather than leaving requests unanswered for the host to time out on.
 function respondWithSignInError(line, err) {
@@ -934,6 +968,13 @@ async function main() {
   let ready = false;
   const pendingLines = [];
 
+  // AUTH-60: identityLabel is resolved independently of `ready` (well before transport
+  // connects — see identityResolved below), so roamer://whoami can answer even while the
+  // real upstream connection is still coming up.
+  let identityLabel = null;
+  let identityResolved = false;
+  const pendingWhoamiLines = [];
+
   // AUTH-51: which client is asking, resolved once from the first stdin line (the MCP
   // `initialize` request, always message #1 by protocol) before any credential is touched.
   let clientSlug = null;
@@ -970,6 +1011,12 @@ async function main() {
         clientSlug = clientSlugFromInitializeLine(line);
         resolveFirstLine();
       }
+      // AUTH-60: answered locally from this process's own state, never forwarded upstream.
+      if (isWhoamiResourceRead(line)) {
+        if (identityResolved) respondWhoami(line, clientSlug, identityLabel);
+        else pendingWhoamiLines.push(line);
+        continue;
+      }
       if (ready) {
         forwardLine(transport, line, getTokens, setTokens, freshTokensForForward);
       } else {
@@ -1013,7 +1060,6 @@ async function main() {
   freshTokensForForward = (force) => getFreshTokens(clientSlug, force).then((result) => result.tokens);
 
   let reusedSilently = false;
-  let identityLabel = null;
   try {
     const result = await getFreshTokens(clientSlug);
     tokens = result.tokens;
@@ -1028,6 +1074,9 @@ async function main() {
     // explicit failure instead of a process it has to silently time out on.
     log(`Sign-in failed: ${err.message}`);
     for (const line of pendingLines) respondWithSignInError(line, err);
+    // AUTH-60: a whoami read queued during a sign-in that then fails can never get a real
+    // answer — same failure treatment as every other queued line, not left hanging.
+    for (const line of pendingWhoamiLines) respondWithSignInError(line, err);
     process.exit(1);
   }
 
@@ -1037,6 +1086,11 @@ async function main() {
   // instant a transient OS notification fired.
   log(identityLabel ? `Authenticated as ${identityLabel} for client "${clientSlug}".` : `Authenticated for client "${clientSlug}" (no identity claim found on the token).`);
 
+  // AUTH-60: identityLabel is now final — answer any roamer://whoami reads that arrived
+  // before sign-in completed, the same way pendingLines get flushed once ready flips true.
+  identityResolved = true;
+  for (const line of pendingWhoamiLines) respondWhoami(line, clientSlug, identityLabel);
+
   // AUTH-51: the moment that used to be completely silent — a process starting up and
   // immediately using a credential it never interactively obtained this run.
   if (reusedSilently) await notifySessionReused(clientSlug, identityLabel);
@@ -1240,4 +1294,7 @@ export {
   loginCommand,
   logoutCommand,
   statusCommand,
+  // AUTH-60
+  isWhoamiResourceRead,
+  respondWhoami,
 };