@mathismeadows/roamer-device-auth 1.5.5 → 1.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",

package/roamer-device-auth.mjs

@@ -44,7 +44,7 @@ import {
   refreshAuthorization,
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { readFile, writeFile, mkdir, readdir, unlink } from "node:fs/promises";
-import { realpathSync } from "node:fs";
+import { realpathSync, watch } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
@@ -355,6 +355,13 @@ async function readCachedTokens(clientSlug, identityKey = null) {
     // A cache from an incompatible prior format must never be trusted just because it
     // happens to have the right field names — see CACHE_VERSION's comment.
     if (tokens?.cacheVersion !== CACHE_VERSION) return null;
+    // AUTH-38/AUTH-device-code-cache-issuer-blind: same protection readLoopbackTokens already
+    // has — a token cached against a prior authorization server (e.g. Cloudflare Access
+    // Managed OAuth, before AUTH-38) must never be trusted just because cacheVersion matches.
+    // No live discovery needed here (unlike the loopback cache): RoamerMcp declares itself as
+    // its own AS in its .well-known/oauth-protected-resource document, so the fixed
+    // ROAMER_MCP_ORIGIN constant is exactly as authoritative as a freshly-discovered value.
+    if (tokens?.issuerUrl !== ROAMER_MCP_ORIGIN) return null;
     return tokens;
   } catch {
     return null;
@@ -368,7 +375,12 @@ async function writeCachedTokens(clientSlug, tokens, identityKey = null) {
   const path = cacheFilePath("roamer_tokens", clientSlug, identityKey);
   if (!path) return; // AUTH-51: no usable client identity — never persisted.
   await mkdir(CACHE_DIR, { recursive: true, mode: 0o700 });
-  const stamped = { ...tokens, cacheVersion: CACHE_VERSION, label: identityLabelFromTokens(tokens) };
+  const stamped = {
+    ...tokens,
+    cacheVersion: CACHE_VERSION,
+    issuerUrl: ROAMER_MCP_ORIGIN,
+    label: identityLabelFromTokens(tokens),
+  };
   await writeFile(path, JSON.stringify(stamped, null, 2), { mode: 0o600 });
 }
 
@@ -957,6 +969,65 @@ function respondWithSignInError(line, err) {
   process.stdout.write(`${JSON.stringify(response)}\n`);
 }
 
+// AUTH-63: pure comparison, exported for direct unit testing — true when the on-disk active
+// identity for this slug no longer matches the identityKey this process resolved at startup.
+// Normalizes both sides through `?? null` since a cleared/never-set active identity reads back
+// as `undefined`, not `null`, and those must compare equal to "no identity" rather than as a
+// spurious change.
+function identityHasChanged(active, identityKey) {
+  return (active?.identityKey ?? null) !== (identityKey ?? null);
+}
+
+// AUTH-63: fast path (fs.watch) + slow-poll fallback, watching the containing directory rather
+// than the bare active-identity file so a login/logout's delete-then-rewrite cycle survives — a
+// bare-file watch's inode-tied handle dies on Linux/macOS across a delete/recreate. Node's own
+// fs.watch docs say it "is not 100% consistent across platforms, and is unavailable in some
+// situations," and the callback's filename argument isn't guaranteed everywhere — filename is
+// therefore used only as a cheap filter when present (skip re-checking on unrelated CACHE_DIR
+// writes, e.g. ordinary token refreshes), and always falls through to a real check when it's
+// null. The slow-poll interval is what actually guarantees this self-heals even on a
+// platform/filesystem combination where the fs.watch event never fires at all.
+const IDENTITY_WATCHDOG_POLL_INTERVAL_MS = 5 * 60 * 1000;
+
+function startIdentityWatchdog(clientSlug, identityKey, shutdown) {
+  if (!clientSlug) return () => {}; // nothing cacheable to watch for this run at all
+  const activeFileName = `roamer_active__${clientSlug}.json`;
+
+  const checkForIdentityChange = async () => {
+    try {
+      const active = await readActiveIdentity(clientSlug);
+      if (identityHasChanged(active, identityKey)) {
+        await shutdown(
+          `Active identity for client "${clientSlug}" changed elsewhere (now ${active?.label ?? "signed out"}) — exiting so the host respawns with the current credential.`,
+        );
+      }
+    } catch (err) {
+      // A transient read failure (e.g. caught mid-write) just retries on the next fs.watch
+      // event or the next poll tick — never itself a reason to exit.
+      log(`Identity watchdog check failed (ignoring): ${err.message}`);
+    }
+  };
+
+  let watcher = null;
+  try {
+    watcher = watch(CACHE_DIR, (eventType, filename) => {
+      if (filename && filename !== activeFileName) return;
+      checkForIdentityChange();
+    });
+    watcher.on("error", (err) => log(`Identity watchdog fs.watch error (relying on the slow-poll fallback): ${err.message}`));
+  } catch (err) {
+    log(`Identity watchdog fs.watch unavailable at startup (relying on the slow-poll fallback): ${err.message}`);
+  }
+
+  const interval = setInterval(checkForIdentityChange, IDENTITY_WATCHDOG_POLL_INTERVAL_MS);
+  interval.unref?.(); // a pending poll must never be the reason this process stays alive
+
+  return () => {
+    watcher?.close();
+    clearInterval(interval);
+  };
+}
+
 async function main() {
   // AUTH-28: stdin is read (and, until sign-in completes, queued) from the very first tick —
   // a cold-cache device-code flow can take minutes, and the MCP host must never see this
@@ -972,6 +1043,10 @@ async function main() {
   // connects — see identityResolved below), so roamer://whoami can answer even while the
   // real upstream connection is still coming up.
   let identityLabel = null;
+  // AUTH-63: this process's own baseline identityKey, captured alongside identityLabel below —
+  // the identity watchdog compares the on-disk active-identity pointer against this value to
+  // notice a login/logout that happened elsewhere.
+  let identityKey = null;
   let identityResolved = false;
   const pendingWhoamiLines = [];
 
@@ -1025,11 +1100,19 @@ async function main() {
     }
   });
 
-  process.stdin.on("end", async () => {
-    log("stdin closed, shutting down.");
+  // AUTH-63: shared by the stdin-close path below and the identity watchdog — a single,
+  // idempotent clean-shutdown path rather than two places independently closing the transport
+  // and calling process.exit.
+  let shuttingDown = false;
+  const shutdown = async (reason) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    log(reason);
     if (transport) await transport.close();
     process.exit(0);
-  });
+  };
+
+  process.stdin.on("end", () => shutdown("stdin closed, shutting down."));
 
   log("Local STDIO proxy running. Press Ctrl+C to exit.");
 
@@ -1068,6 +1151,7 @@ async function main() {
     // adds a network round trip to every ordinary client startup in exchange for a readable
     // log line; falls back to the existing oid-based label on any failure.
     identityLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
+    identityKey = result.identityKey ?? null;
   } catch (err) {
     // Sign-in genuinely failed (denied/expired), not just slow — every message queued while
     // we waited, starting with `initialize`, gets a real JSON-RPC error so the host sees an
@@ -1091,6 +1175,11 @@ async function main() {
   identityResolved = true;
   for (const line of pendingWhoamiLines) respondWhoami(line, clientSlug, identityLabel);
 
+  // AUTH-63: starts watching for a login/logout elsewhere on this same client slug — this
+  // process's own cached identity never hot-swaps, so the only correct response to noticing
+  // it's now stale is a clean self-exit (via `shutdown` above) for the host to respawn from.
+  startIdentityWatchdog(clientSlug, identityKey, shutdown);
+
   // AUTH-51: the moment that used to be completely silent — a process starting up and
   // immediately using a credential it never interactively obtained this run.
   if (reusedSilently) await notifySessionReused(clientSlug, identityLabel);
@@ -1297,4 +1386,7 @@ export {
   // AUTH-60
   isWhoamiResourceRead,
   respondWhoami,
+  // AUTH-63
+  identityHasChanged,
+  startIdentityWatchdog,
 };