@mathismeadows/roamer-device-auth 1.5.4 → 1.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.4",
+  "version": "1.5.5",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -639,10 +639,12 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
   }
 
   log(`Go to ${device.verification_uri} and enter code: ${device.user_code}`);
-  // Fire-and-forget: the dialog is how the human actually sees this on macOS; polling below
-  // must not wait on it being dismissed. Skip re-showing it on a resume — the human already
-  // saw it (or is mid-flow in the browser) from the process that started this same code.
-  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
+  // AUTH-61: launch the browser first, then show the fallback dialog — both are best-effort
+  // OS-level UI activations, and requesting them in the same instant can leave Safari
+  // intermittently stuck showing "Application Not Responding" on launch (macOS-only; see
+  // thread AUTH-safari-device-flow-hang). The dialog stays fire-and-forget: polling below
+  // must not wait on it being dismissed. Skip both on a resume — the human already saw them
+  // (or is mid-flow in the browser) from the process that started this same code.
   if (!resuming) {
     try {
       const { default: open } = await import("open");
@@ -651,6 +653,7 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
       // Best-effort only — the dialog and QR code below already carry the URL and code.
     }
   }
+  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
   // Terminal-visible for any client where a human sees this process's stderr/log output
   // (Claude Code CLI, VS Code's integrated terminal) — QR codes are a real usability win
   // for CLI auth over typing an 8-character code by hand.