@myspec/mcp-server 0.4.0-next.91 → 0.4.0-next.93

package/dist/index.js

@@ -255,6 +255,7 @@ async function exchangeCode(userAuthUrl, code, fetchImpl) {
 }
 
 // src/auth/credentials-store.ts
+import { randomUUID } from "crypto";
 import { promises as fs } from "fs";
 import os from "os";
 import path from "path";
@@ -365,9 +366,16 @@ async function writeJsonFile(target, data, opts) {
   if (process.platform !== "win32") {
     await fs.chmod(dir, 448);
   }
-  await fs.writeFile(target, JSON.stringify(data, null, 2), { mode: 384 });
-  if (opts.secret && process.platform !== "win32") {
-    await fs.chmod(target, 384);
+  const tmp = `${target}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+    if (opts.secret && process.platform !== "win32") {
+      await fs.chmod(tmp, 384);
+    }
+    await fs.rename(tmp, target);
+  } catch (err) {
+    await unlinkIfExists(tmp);
+    throw err;
   }
 }
 async function unlinkIfExists(target) {
@@ -584,6 +592,37 @@ var TokenManager = class {
   now;
   cached = null;
   refreshInFlight = null;
+  /**
+   * The in-flight disk read, shared by every concurrent caller.
+   *
+   * `refresh` below has always deduped; this did not, so N concurrent platform
+   * calls each issued their own `store.load()` before any of them populated
+   * `cached`. That is N redundant reads on every cold call, and it is what made
+   * a torn read reachable at all: one caller could be refreshing (and so
+   * rewriting the credential files) while the others were still reading them.
+   *
+   * The atomic write in credentials-store.ts is the real guarantee. This is the
+   * other half — it removes the redundant reads rather than merely surviving
+   * them.
+   */
+  loadInFlight = null;
+  /**
+   * Bumped by clear(), so a read that started before it cannot publish its
+   * result to `cached` afterwards.
+   *
+   * Scope, precisely: the caller already awaiting that read still receives the
+   * pre-clear credentials as its own return value and proceeds with them —
+   * nothing can retract a value from a call already in flight. What the guard
+   * buys is that the value stops there instead of being cached, so no
+   * SUBSEQUENT caller is handed credentials the user asked us to forget.
+   *
+   * Dropping `loadInFlight` alone would not achieve even that: the awaiting
+   * caller resumes after the clear and would assign `cached` itself.
+   * Pre-existing — the old code assigned `cached` straight after an un-deduped
+   * `await` — but the fix belongs with the dedupe rather than left as a claim
+   * the comment cannot back up.
+   */
+  loadGeneration = 0;
   /**
    * Set once the exchange endpoint rejects the API token outright.
    *
@@ -616,17 +655,25 @@ var TokenManager = class {
   }
   async clear() {
     this.cached = null;
+    this.loadInFlight = null;
+    this.loadGeneration += 1;
     await this.store.clear();
   }
   async ensureLoaded() {
     if (this.cached) {
       return this.cached;
     }
-    const loaded = await this.store.load();
+    const generation = this.loadGeneration;
+    this.loadInFlight ??= this.store.load().finally(() => {
+      this.loadInFlight = null;
+    });
+    const loaded = await this.loadInFlight;
     if (!loaded) {
       throw new NeedsLoginError();
     }
-    this.cached = loaded;
+    if (generation === this.loadGeneration) {
+      this.cached = loaded;
+    }
     return loaded;
   }
   async refresh(creds) {
@@ -1333,6 +1380,26 @@ var PlatformPreconditionRequiredError = class extends PlatformHttpError {
     this.name = "PlatformPreconditionRequiredError";
   }
 };
+var QUOTA_EXCEEDED_CODE = "quota_exceeded";
+var PlatformQuotaError = class extends PlatformHttpError {
+  /** The platform's machine-readable code, e.g. `quota_exceeded`. */
+  code;
+  constructor(message, status, details, code) {
+    super(message, status, details);
+    this.name = "PlatformQuotaError";
+    this.code = code;
+  }
+};
+function isPlatformQuotaError(err) {
+  if (statusOf(err) !== 429) {
+    return false;
+  }
+  if (typeof err !== "object" || err === null) {
+    return false;
+  }
+  const code = err.code;
+  return typeof code === "string" && code.toLowerCase() === QUOTA_EXCEEDED_CODE;
+}
 function isPlatformHttpError(err) {
   return typeof err === "object" && err !== null && err[PLATFORM_ERROR_BRAND] === true;
 }
@@ -1409,13 +1476,16 @@ function toConflictDetails(details) {
     changedAt: stringField(details, "last_modified_at")
   };
 }
-function createPlatformError(message, status, details) {
+function createPlatformError(message, status, details, code) {
   if (status === 409) {
     return new PlatformConflictError(message, status, details, toConflictDetails(details));
   }
   if (status === 428) {
     return new PlatformPreconditionRequiredError(message, details);
   }
+  if (status === 429 && typeof code === "string" && code.toLowerCase() === QUOTA_EXCEEDED_CODE) {
+    return new PlatformQuotaError(message, status, details, code.toLowerCase());
+  }
   return new PlatformHttpError(message, status, details);
 }
 function truncate(text) {
@@ -1426,17 +1496,19 @@ async function throwFromResponse(response, fallbackMessage) {
   const rawBody = await response.text().catch(() => "");
   let message = fallbackMessage;
   let details;
+  let code;
   if (rawBody) {
     try {
       const parsed = JSON.parse(rawBody);
       details = parsed.details;
+      code = typeof parsed.error === "string" ? parsed.error : void 0;
       const suffix = details ? ` [details: ${JSON.stringify(details)}]` : "";
       message = truncate(parsed.message ?? rawBody) + suffix;
     } catch {
       message = truncate(rawBody);
     }
   }
-  throw createPlatformError(`HTTP ${response.status}: ${message}`, response.status, details);
+  throw createPlatformError(`HTTP ${response.status}: ${message}`, response.status, details, code);
 }
 
 // ../../packages/shared/logger.ts
@@ -1644,6 +1716,10 @@ var BaseHttpClient = class {
       this.logger.debug("Retrying after abort/timeout", { error: error.message });
       return true;
     }
+    if (isPlatformQuotaError(error)) {
+      this.logger.debug("Not retrying quota rejection", { status: 429 });
+      return false;
+    }
     const httpError = error;
     if (httpError.status !== void 0) {
       const shouldRetry = RETRYABLE_STATUS_CODES.includes(httpError.status);
@@ -1700,6 +1776,9 @@ function transformSpecFileResponse(raw) {
     deletedAt: raw.deleted_at ? new Date(raw.deleted_at) : void 0
   };
 }
+function toRevisionAuthorKind(raw) {
+  return raw === "ai" ? "ai" : "human";
+}
 function transformFileRevisionResponse(raw) {
   return {
     id: raw.id,
@@ -1710,6 +1789,7 @@ function transformFileRevisionResponse(raw) {
     fileSizeBytes: raw.file_size_bytes,
     checksum: raw.checksum,
     changedBy: raw.changed_by,
+    changedByKind: toRevisionAuthorKind(raw.changed_by_kind),
     createdAt: new Date(raw.created_at)
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.4.0-next.91",
+  "version": "0.4.0-next.93",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {