@mathismeadows/roamer-device-auth 1.5.4 → 1.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -355,6 +355,13 @@ async function readCachedTokens(clientSlug, identityKey = null) {
     // A cache from an incompatible prior format must never be trusted just because it
     // happens to have the right field names — see CACHE_VERSION's comment.
     if (tokens?.cacheVersion !== CACHE_VERSION) return null;
+    // AUTH-38/AUTH-device-code-cache-issuer-blind: same protection readLoopbackTokens already
+    // has — a token cached against a prior authorization server (e.g. Cloudflare Access
+    // Managed OAuth, before AUTH-38) must never be trusted just because cacheVersion matches.
+    // No live discovery needed here (unlike the loopback cache): RoamerMcp declares itself as
+    // its own AS in its .well-known/oauth-protected-resource document, so the fixed
+    // ROAMER_MCP_ORIGIN constant is exactly as authoritative as a freshly-discovered value.
+    if (tokens?.issuerUrl !== ROAMER_MCP_ORIGIN) return null;
     return tokens;
   } catch {
     return null;
@@ -368,7 +375,12 @@ async function writeCachedTokens(clientSlug, tokens, identityKey = null) {
   const path = cacheFilePath("roamer_tokens", clientSlug, identityKey);
   if (!path) return; // AUTH-51: no usable client identity — never persisted.
   await mkdir(CACHE_DIR, { recursive: true, mode: 0o700 });
-  const stamped = { ...tokens, cacheVersion: CACHE_VERSION, label: identityLabelFromTokens(tokens) };
+  const stamped = {
+    ...tokens,
+    cacheVersion: CACHE_VERSION,
+    issuerUrl: ROAMER_MCP_ORIGIN,
+    label: identityLabelFromTokens(tokens),
+  };
   await writeFile(path, JSON.stringify(stamped, null, 2), { mode: 0o600 });
 }
 
@@ -639,10 +651,12 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
   }
 
   log(`Go to ${device.verification_uri} and enter code: ${device.user_code}`);
-  // Fire-and-forget: the dialog is how the human actually sees this on macOS; polling below
-  // must not wait on it being dismissed. Skip re-showing it on a resume — the human already
-  // saw it (or is mid-flow in the browser) from the process that started this same code.
-  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
+  // AUTH-61: launch the browser first, then show the fallback dialog — both are best-effort
+  // OS-level UI activations, and requesting them in the same instant can leave Safari
+  // intermittently stuck showing "Application Not Responding" on launch (macOS-only; see
+  // thread AUTH-safari-device-flow-hang). The dialog stays fire-and-forget: polling below
+  // must not wait on it being dismissed. Skip both on a resume — the human already saw them
+  // (or is mid-flow in the browser) from the process that started this same code.
   if (!resuming) {
     try {
       const { default: open } = await import("open");
@@ -651,6 +665,7 @@ async function doGetValidTokens(clientSlug, forceRefresh, forceFreshLogin = fals
       // Best-effort only — the dialog and QR code below already carry the URL and code.
     }
   }
+  if (!resuming) showDeviceCodeDialog(device.verification_uri, device.user_code);
   // Terminal-visible for any client where a human sees this process's stderr/log output
   // (Claude Code CLI, VS Code's integrated terminal) — QR codes are a real usability win
   // for CLI auth over typing an 8-character code by hand.