@mathismeadows/roamer-device-auth 1.5.6 → 1.5.8

package/macos-notifier.app/Contents/Info.plist

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleDisplayName</key>
+    <string>Roamer MCP</string>
+    <key>CFBundleExecutable</key>
+    <string>roamer-mcp-notifier</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.mathismeadows.roamer-mcp.notifier.v4</string>
+    <key>CFBundleIconFile</key>
+    <string>roamer-mcp-v4.icns</string>
+    <key>CFBundleName</key>
+    <string>Roamer MCP</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0</string>
+    <key>CFBundleVersion</key>
+    <string>4</string>
+    <key>LSUIElement</key>
+    <true/>
+</dict>
+</plist>

package/macos-notifier.app/Contents/_CodeSignature/CodeResources

@@ -0,0 +1,150 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>files</key>
+	<dict>
+		<key>Resources/roamer-mcp-icon-v2.png</key>
+		<data>
+		2dM6CEL1wlYNq4xt+ecVt+BHGGE=
+		</data>
+		<key>Resources/roamer-mcp-v4.icns</key>
+		<data>
+		cQdIamkBe9J4DyIwSJnoMbrgdL4=
+		</data>
+		<key>Resources/roamer-mcp.icns</key>
+		<data>
+		cQdIamkBe9J4DyIwSJnoMbrgdL4=
+		</data>
+	</dict>
+	<key>files2</key>
+	<dict>
+		<key>Resources/roamer-mcp-icon-v2.png</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			MWFb39dsRLKc+Q+xfVR6joPIp/MVngghyYXAYyTUEQg=
+			</data>
+		</dict>
+		<key>Resources/roamer-mcp-v4.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			qx5IaaBZH5kHBh1t8Kb0XEpXM51aRZuMOvBIbQLqKsQ=
+			</data>
+		</dict>
+		<key>Resources/roamer-mcp.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			qx5IaaBZH5kHBh1t8Kb0XEpXM51aRZuMOvBIbQLqKsQ=
+			</data>
+		</dict>
+	</dict>
+	<key>rules</key>
+	<dict>
+		<key>^Resources/</key>
+		<true/>
+		<key>^Resources/.*\.lproj/</key>
+		<dict>
+			<key>optional</key>
+			<true/>
+			<key>weight</key>
+			<real>1000</real>
+		</dict>
+		<key>^Resources/.*\.lproj/locversion.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>1100</real>
+		</dict>
+		<key>^Resources/Base\.lproj/</key>
+		<dict>
+			<key>weight</key>
+			<real>1010</real>
+		</dict>
+		<key>^version.plist$</key>
+		<true/>
+	</dict>
+	<key>rules2</key>
+	<dict>
+		<key>.*\.dSYM($|/)</key>
+		<dict>
+			<key>weight</key>
+			<real>11</real>
+		</dict>
+		<key>^(.*/)?\.DS_Store$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>2000</real>
+		</dict>
+		<key>^(Frameworks|SharedFrameworks|PlugIns|Plug-ins|XPCServices|Helpers|MacOS|Library/(Automator|Spotlight|LoginItems))/</key>
+		<dict>
+			<key>nested</key>
+			<true/>
+			<key>weight</key>
+			<real>10</real>
+		</dict>
+		<key>^.*</key>
+		<true/>
+		<key>^Info\.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^PkgInfo$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^Resources/</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^Resources/.*\.lproj/</key>
+		<dict>
+			<key>optional</key>
+			<true/>
+			<key>weight</key>
+			<real>1000</real>
+		</dict>
+		<key>^Resources/.*\.lproj/locversion.plist$</key>
+		<dict>
+			<key>omit</key>
+			<true/>
+			<key>weight</key>
+			<real>1100</real>
+		</dict>
+		<key>^Resources/Base\.lproj/</key>
+		<dict>
+			<key>weight</key>
+			<real>1010</real>
+		</dict>
+		<key>^[^/]+$</key>
+		<dict>
+			<key>nested</key>
+			<true/>
+			<key>weight</key>
+			<real>10</real>
+		</dict>
+		<key>^embedded\.provisionprofile$</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+		<key>^version\.plist$</key>
+		<dict>
+			<key>weight</key>
+			<real>20</real>
+		</dict>
+	</dict>
+</dict>
+</plist>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mathismeadows/roamer-device-auth",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "private": false,
   "mcpName": "com.mathismeadows/roamer-mcp",
   "type": "module",
@@ -10,7 +10,8 @@
   },
   "main": "./roamer-device-auth.mjs",
   "files": [
-    "roamer-device-auth.mjs"
+    "roamer-device-auth.mjs",
+    "macos-notifier.app/"
   ],
   "publishConfig": {
     "access": "public"

package/roamer-device-auth.mjs

@@ -44,13 +44,13 @@ import {
   refreshAuthorization,
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { readFile, writeFile, mkdir, readdir, unlink } from "node:fs/promises";
-import { realpathSync } from "node:fs";
+import { realpathSync, watch } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { createServer } from "node:http";
 import qrcode from "qrcode-terminal";
 
@@ -60,6 +60,13 @@ const ROAMER_MCP_URL = process.env.ROAMER_MCP_URL ?? "https://roamer-mcp.mathism
 const ROAMER_MCP_ORIGIN = new URL(ROAMER_MCP_URL).origin;
 
 const CACHE_DIR = join(homedir(), ".mcp-auth-device");
+const MACOS_NOTIFIER_PATH = join(
+  dirname(fileURLToPath(import.meta.url)),
+  "macos-notifier.app",
+  "Contents",
+  "MacOS",
+  "roamer-mcp-notifier",
+);
 
 // AUTH-51: every on-disk cache is namespaced per client slug — a null slug (the connecting
 // host sent no usable clientInfo.name) means "never persist": the caller gets a real
@@ -329,18 +336,25 @@ async function showDeviceCodeDialog(verificationUri, userCode) {
 // distinction someone needs in order to notice a stale identity is still active.
 async function notifySessionReused(clientSlug, identityLabel) {
   const clientLabel = clientSlug ?? "an unidentified client";
-  const message = identityLabel
+  const logMessage = identityLabel
     ? `Reused an existing Roamer MCP session for ${clientLabel} (${identityLabel}).`
     : `Reused an existing Roamer MCP session for ${clientLabel}.`;
-  try {
-    await execFileAsync("osascript", [
-      "-e",
-      `display notification "${message.replace(/"/g, '\\"')}" with title "Roamer MCP"`,
-    ]);
-  } catch {
-    // Best-effort, macOS-only — the stderr log line below is the fallback for every other OS.
+  if (process.platform === "darwin") {
+    try {
+      await execFileAsync("open", [
+        "-n",
+        "-W",
+        join(dirname(MACOS_NOTIFIER_PATH), "..", ".."),
+        "--args",
+        "Roamer MCP",
+        identityLabel ? `Connected as ${identityLabel}.` : "Connected using a saved session.",
+        `Client: ${clientLabel}`,
+      ]);
+    } catch {
+      // Best-effort — stderr remains the fallback if native notifications are unavailable.
+    }
   }
-  log(message);
+  log(logMessage);
 }
 
 // AUTH-54: identityKey defaults to null (the pre-AUTH-54 file shape) rather than being
@@ -969,6 +983,65 @@ function respondWithSignInError(line, err) {
   process.stdout.write(`${JSON.stringify(response)}\n`);
 }
 
+// AUTH-63: pure comparison, exported for direct unit testing — true when the on-disk active
+// identity for this slug no longer matches the identityKey this process resolved at startup.
+// Normalizes both sides through `?? null` since a cleared/never-set active identity reads back
+// as `undefined`, not `null`, and those must compare equal to "no identity" rather than as a
+// spurious change.
+function identityHasChanged(active, identityKey) {
+  return (active?.identityKey ?? null) !== (identityKey ?? null);
+}
+
+// AUTH-63: fast path (fs.watch) + slow-poll fallback, watching the containing directory rather
+// than the bare active-identity file so a login/logout's delete-then-rewrite cycle survives — a
+// bare-file watch's inode-tied handle dies on Linux/macOS across a delete/recreate. Node's own
+// fs.watch docs say it "is not 100% consistent across platforms, and is unavailable in some
+// situations," and the callback's filename argument isn't guaranteed everywhere — filename is
+// therefore used only as a cheap filter when present (skip re-checking on unrelated CACHE_DIR
+// writes, e.g. ordinary token refreshes), and always falls through to a real check when it's
+// null. The slow-poll interval is what actually guarantees this self-heals even on a
+// platform/filesystem combination where the fs.watch event never fires at all.
+const IDENTITY_WATCHDOG_POLL_INTERVAL_MS = 5 * 60 * 1000;
+
+function startIdentityWatchdog(clientSlug, identityKey, shutdown) {
+  if (!clientSlug) return () => {}; // nothing cacheable to watch for this run at all
+  const activeFileName = `roamer_active__${clientSlug}.json`;
+
+  const checkForIdentityChange = async () => {
+    try {
+      const active = await readActiveIdentity(clientSlug);
+      if (identityHasChanged(active, identityKey)) {
+        await shutdown(
+          `Active identity for client "${clientSlug}" changed elsewhere (now ${active?.label ?? "signed out"}) — exiting so the host respawns with the current credential.`,
+        );
+      }
+    } catch (err) {
+      // A transient read failure (e.g. caught mid-write) just retries on the next fs.watch
+      // event or the next poll tick — never itself a reason to exit.
+      log(`Identity watchdog check failed (ignoring): ${err.message}`);
+    }
+  };
+
+  let watcher = null;
+  try {
+    watcher = watch(CACHE_DIR, (eventType, filename) => {
+      if (filename && filename !== activeFileName) return;
+      checkForIdentityChange();
+    });
+    watcher.on("error", (err) => log(`Identity watchdog fs.watch error (relying on the slow-poll fallback): ${err.message}`));
+  } catch (err) {
+    log(`Identity watchdog fs.watch unavailable at startup (relying on the slow-poll fallback): ${err.message}`);
+  }
+
+  const interval = setInterval(checkForIdentityChange, IDENTITY_WATCHDOG_POLL_INTERVAL_MS);
+  interval.unref?.(); // a pending poll must never be the reason this process stays alive
+
+  return () => {
+    watcher?.close();
+    clearInterval(interval);
+  };
+}
+
 async function main() {
   // AUTH-28: stdin is read (and, until sign-in completes, queued) from the very first tick —
   // a cold-cache device-code flow can take minutes, and the MCP host must never see this
@@ -984,6 +1057,10 @@ async function main() {
   // connects — see identityResolved below), so roamer://whoami can answer even while the
   // real upstream connection is still coming up.
   let identityLabel = null;
+  // AUTH-63: this process's own baseline identityKey, captured alongside identityLabel below —
+  // the identity watchdog compares the on-disk active-identity pointer against this value to
+  // notice a login/logout that happened elsewhere.
+  let identityKey = null;
   let identityResolved = false;
   const pendingWhoamiLines = [];
 
@@ -1037,11 +1114,19 @@ async function main() {
     }
   });
 
-  process.stdin.on("end", async () => {
-    log("stdin closed, shutting down.");
+  // AUTH-63: shared by the stdin-close path below and the identity watchdog — a single,
+  // idempotent clean-shutdown path rather than two places independently closing the transport
+  // and calling process.exit.
+  let shuttingDown = false;
+  const shutdown = async (reason) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    log(reason);
     if (transport) await transport.close();
     process.exit(0);
-  });
+  };
+
+  process.stdin.on("end", () => shutdown("stdin closed, shutting down."));
 
   log("Local STDIO proxy running. Press Ctrl+C to exit.");
 
@@ -1080,6 +1165,7 @@ async function main() {
     // adds a network round trip to every ordinary client startup in exchange for a readable
     // log line; falls back to the existing oid-based label on any failure.
     identityLabel = (await fetchLiveLabel(result.tokens?.access_token)) ?? result.label;
+    identityKey = result.identityKey ?? null;
   } catch (err) {
     // Sign-in genuinely failed (denied/expired), not just slow — every message queued while
     // we waited, starting with `initialize`, gets a real JSON-RPC error so the host sees an
@@ -1103,6 +1189,11 @@ async function main() {
   identityResolved = true;
   for (const line of pendingWhoamiLines) respondWhoami(line, clientSlug, identityLabel);
 
+  // AUTH-63: starts watching for a login/logout elsewhere on this same client slug — this
+  // process's own cached identity never hot-swaps, so the only correct response to noticing
+  // it's now stale is a clean self-exit (via `shutdown` above) for the host to respawn from.
+  startIdentityWatchdog(clientSlug, identityKey, shutdown);
+
   // AUTH-51: the moment that used to be completely silent — a process starting up and
   // immediately using a credential it never interactively obtained this run.
   if (reusedSilently) await notifySessionReused(clientSlug, identityLabel);
@@ -1309,4 +1400,7 @@ export {
   // AUTH-60
   isWhoamiResourceRead,
   respondWhoami,
+  // AUTH-63
+  identityHasChanged,
+  startIdentityWatchdog,
 };