@myspec/mcp-server 1.1.1-next.157 → 1.1.1-next.159

package/dist/index.js

@@ -316,15 +316,88 @@ function createFileCredentialsStore(paths = {}) {
     },
     async clear() {
       await unlinkIfExists(oauthCredsPath);
-    }
+    },
+    withLock: (fn) => withFileLock(`${oauthCredsPath}.lock`, fn, paths.lockTimings),
+    saveSettings: (creds) => writeSettingsFile(settingsPath, creds)
   };
 }
+function saveDiscoveredUrls(store, creds) {
+  return store.saveSettings ? store.saveSettings(creds) : store.save(creds);
+}
+var DEFAULT_LOCK_TIMINGS = { staleMs: 3e4, waitMs: 2e4, pollMs: 50 };
+async function withFileLock(lockPath, fn, timings = DEFAULT_LOCK_TIMINGS) {
+  const owner = await acquireFileLock(lockPath, timings);
+  try {
+    return await fn();
+  } finally {
+    if (owner !== null) {
+      await releaseFileLock(lockPath, owner);
+    }
+  }
+}
+async function acquireFileLock(lockPath, timings) {
+  const owner = randomUUID();
+  const deadline = Date.now() + timings.waitMs;
+  try {
+    await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 448 });
+  } catch {
+    return null;
+  }
+  for (; ; ) {
+    try {
+      await fs.writeFile(lockPath, owner, { flag: "wx", mode: 384 });
+      return owner;
+    } catch (err) {
+      if (!isFsExists(err)) {
+        return null;
+      }
+    }
+    if (Date.now() >= deadline) {
+      return null;
+    }
+    const held = await readLock(lockPath);
+    if (held === null) {
+      continue;
+    }
+    if (held.ageMs > timings.staleMs) {
+      const again = await readLock(lockPath);
+      if (again?.owner !== held.owner) {
+        continue;
+      }
+      try {
+        await fs.unlink(lockPath);
+      } catch (err) {
+        if (!isFsNotFound(err)) {
+          return null;
+        }
+      }
+      continue;
+    }
+    await new Promise((resolve3) => setTimeout(resolve3, timings.pollMs));
+  }
+}
+async function readLock(lockPath) {
+  try {
+    const [stat2, owner] = await Promise.all([fs.stat(lockPath), fs.readFile(lockPath, "utf-8")]);
+    return { owner, ageMs: Date.now() - stat2.mtimeMs };
+  } catch {
+    return null;
+  }
+}
+async function releaseFileLock(lockPath, owner) {
+  const current = await fs.readFile(lockPath, "utf-8").catch(() => null);
+  if (current === owner) {
+    await unlinkIfExists(lockPath).catch(() => void 0);
+  }
+}
 function keepCredentialsOnFailure(store) {
   return {
     load: () => store.load(),
     save: (creds) => store.save(creds),
     clear: () => Promise.resolve(),
-    path: () => store.path()
+    path: () => store.path(),
+    ...store.withLock ? { withLock: store.withLock } : {},
+    ...store.saveSettings ? { saveSettings: store.saveSettings } : {}
   };
 }
 async function writeSettingsFile(target, creds) {
@@ -596,15 +669,30 @@ function requireNumber(obj, key) {
 function isFsNotFound(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
+function isFsExists(err) {
+  return typeof err === "object" && err !== null && err.code === "EEXIST";
+}
 
 // src/auth/token-manager.ts
 var EXPIRY_SKEW_MS = 3e4;
+var REFRESH_TIMEOUT_MS = 8e3;
 var TokenManager = class {
   store;
   fetchImpl;
   now;
   cached = null;
   refreshInFlight = null;
+  /**
+   * Whether the refresh in flight is guaranteed to mint. An unforced one may
+   * settle for a token another process saved, which a forced caller must not
+   * be handed — see refresh().
+   */
+  refreshInFlightForced = false;
+  /**
+   * The access token this instance last minted, so a forced caller that
+   * waited on an unforced refresh can tell whether it got a minted token.
+   */
+  lastMintedAccessToken = null;
   /**
    * The in-flight disk read, shared by every concurrent caller.
    *
@@ -652,18 +740,25 @@ var TokenManager = class {
   }
   async getValidAccessToken() {
     const creds = await this.ensureLoaded();
-    if (creds.expiresAt > this.now() + EXPIRY_SKEW_MS) {
+    if (this.isFresh(creds)) {
       return creds.accessToken;
     }
-    const refreshed = await this.refresh(creds);
+    const refreshed = await this.refresh(creds, { forced: false });
     return refreshed.accessToken;
   }
   async getCredentials() {
     return this.ensureLoaded();
   }
+  /**
+   * Mints a new access token even if the current one has not expired — for
+   * callers whose token was just refused, or that need claims stamped after a
+   * server-side change (login re-minting after an organization switch). So,
+   * unlike getValidAccessToken, it never settles for a token another process
+   * already saved.
+   */
   async forceRefresh() {
     const creds = await this.ensureLoaded();
-    const refreshed = await this.refresh(creds);
+    const refreshed = await this.refresh(creds, { forced: true });
     return refreshed.accessToken;
   }
   async clear() {
@@ -689,16 +784,27 @@ var TokenManager = class {
     }
     return loaded;
   }
-  async refresh(creds) {
+  isFresh(creds) {
+    return creds.expiresAt > this.now() + EXPIRY_SKEW_MS;
+  }
+  async refresh(creds, opts) {
     if (this.refreshInFlight) {
-      return this.refreshInFlight;
+      if (this.refreshInFlightForced || !opts.forced) {
+        return this.refreshInFlight;
+      }
+      const settled = await this.refreshInFlight;
+      if (settled.accessToken === this.lastMintedAccessToken) {
+        return settled;
+      }
+      return this.refresh(this.cached ?? creds, opts);
     }
-    this.refreshInFlight = this.doRefresh(creds).finally(() => {
+    this.refreshInFlightForced = opts.forced;
+    this.refreshInFlight = this.doRefresh(creds, opts).finally(() => {
       this.refreshInFlight = null;
     });
     return this.refreshInFlight;
   }
-  async doRefresh(creds) {
+  async doRefresh(creds, opts) {
     if (creds.apiToken) {
       if (this.apiTokenRejection) {
         throw this.apiTokenRejection;
@@ -710,18 +816,100 @@ var TokenManager = class {
         "No credential is configured. Either set MYSPEC_API_TOKEN to a long-lived API token (or put one in the `apiToken` field of your credentials file) \u2014 create one in the MySpec webapp under the avatar menu, API tokens \u2014 or run `npx @myspec/mcp-server login` to sign in interactively."
       );
     }
+    return this.refreshSession(creds, opts);
+  }
+  /**
+   * Refreshes a login session that other processes may be refreshing too.
+   *
+   * Refresh tokens are single-use, and user-auth honours the previous one for
+   * only 60 seconds after a rotation. Every MCP client spawns its own `serve`,
+   * and `reverse` and `auth status` run beside them, all on the same
+   * ~/.myspec. This instance caches the credentials once, so when another
+   * process rotated the token, the cached one is already retired: presenting
+   * it gets a 401, and treating that as "signed out" used to delete the file —
+   * along with the valid token the other process had just saved.
+   *
+   * So the whole read → refresh → save runs under the store's lock, and the
+   * store is re-read first: a session rotated elsewhere is adopted (see
+   * newerSession), used as it is while its access token is fresh, otherwise
+   * refreshed with its token. While every process refreshing this file holds
+   * the lock, none can rotate in between. The lock is best-effort, though — a
+   * store without one, a lock not acquired in time or taken over as stale, an
+   * older CLI version — so a refusal is checked the same way, since a rotation
+   * can land while our request is in flight, and gets one retry with the newer
+   * token. Only then is the store cleared — and only if it still holds a token
+   * that was refused (see clearUnlessReplaced).
+   */
+  refreshSession(cachedCreds, opts) {
+    const run = () => this.refreshSessionLocked(cachedCreds, opts);
+    return this.store.withLock ? this.store.withLock(run) : run();
+  }
+  async refreshSessionLocked(cachedCreds, opts) {
+    const refused = /* @__PURE__ */ new Set();
+    let creds = cachedCreds;
+    let onDisk = await this.readStore();
+    const newer = newerSession(onDisk, creds);
+    if (newer) {
+      this.cached = newer;
+      if (!opts.forced && this.isFresh(newer)) {
+        return newer;
+      }
+      creds = newer;
+    }
     try {
-      return await this.performRefresh(creds);
+      return await this.performRefresh(creds, onDisk?.apiToken);
     } catch (err) {
-      await this.invalidateOnAuthFailure(err);
-      throw err;
+      if (!(err instanceof NeedsLoginError)) {
+        throw err;
+      }
+      refused.add(creds.refreshToken ?? "");
+      onDisk = await this.readStore();
+      const raced = newerSession(onDisk, creds);
+      if (!raced) {
+        await this.clearUnlessReplaced(onDisk, refused);
+        throw err;
+      }
+      this.cached = raced;
+      if (!opts.forced && this.isFresh(raced)) {
+        return raced;
+      }
+      try {
+        return await this.performRefresh(raced, onDisk?.apiToken);
+      } catch (retryErr) {
+        if (retryErr instanceof NeedsLoginError) {
+          refused.add(raced.refreshToken ?? "");
+          await this.clearUnlessReplaced(await this.readStore(), refused);
+        }
+        throw retryErr;
+      }
     }
   }
-  async invalidateOnAuthFailure(err) {
-    if (err instanceof NeedsLoginError) {
-      this.cached = null;
-      await this.store.clear();
+  /**
+   * A fresh read of the store; null when it is empty or cannot be read, so a
+   * refresh that would work is not failed by it.
+   */
+  readStore() {
+    return this.store.load().catch(() => null);
+  }
+  /**
+   * Signs out after a refusal: drops the cache and clears the store — unless
+   * the store no longer holds a refused token. An API-token record is shown
+   * exactly once and is never ours to delete, and a session we have not
+   * presented belongs to another process. A store that could not be read is
+   * left alone too: it may hold either (a hand edit with a typo, a bad file
+   * mode), and its own error is what the user needs to see. Network errors,
+   * 5xx and other transient faults never reach here: they must not delete the
+   * stored refresh token.
+   */
+  async clearUnlessReplaced(onDisk, refused) {
+    this.cached = null;
+    if (!onDisk || onDisk.apiToken !== void 0) {
+      return;
     }
+    if (onDisk.refreshToken !== void 0 && !refused.has(onDisk.refreshToken)) {
+      return;
+    }
+    await this.store.clear();
   }
   /**
    * Trades the long-lived API token for a short-lived access token.
@@ -774,15 +962,26 @@ var TokenManager = class {
       expiresAt: this.now() + payload.expiresIn * 1e3
     };
     this.cached = next;
-    await this.store.save(next);
+    this.lastMintedAccessToken = next.accessToken;
+    const onDisk = await this.readStore();
+    if (onDisk?.apiToken === apiToken) {
+      await this.store.save({ ...onDisk, accessToken: next.accessToken, expiresAt: next.expiresAt });
+    }
     return next;
   }
-  async performRefresh(creds) {
+  /**
+   * @param keepApiToken An API token the store holds beside this session —
+   *   added by hand while this process ran. Written back with the rotated pair,
+   *   since save() rewrites the whole file and a PAT is shown exactly once; the
+   *   cache stays on the session, so this process does not switch identity.
+   */
+  async performRefresh(creds, keepApiToken) {
     const url = `${creds.userAuthUrl}/api/auth/token/refresh`;
     const response = await this.fetchImpl(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refreshToken: creds.refreshToken })
+      body: JSON.stringify({ refreshToken: creds.refreshToken }),
+      signal: AbortSignal.timeout(REFRESH_TIMEOUT_MS)
     });
     if (response.status === 400 || response.status === 401 || response.status === 403 || response.status === 422) {
       throw new RefreshRejectedError(
@@ -793,7 +992,8 @@ var TokenManager = class {
       const body = await response.text().catch(() => "");
       throw new HttpStatusError(response.status, body, `Token refresh failed: HTTP ${String(response.status)}`);
     }
-    const payload = await response.json().catch(() => null);
+    const text = await response.text();
+    const payload = parseJson(text);
     if (!payload || typeof payload.accessToken !== "string" || typeof payload.refreshToken !== "string" || typeof payload.expiresIn !== "number") {
       throw new NeedsLoginError(
         "Token refresh response was malformed. Run `npx @myspec/mcp-server login` to sign in again."
@@ -806,10 +1006,24 @@ var TokenManager = class {
       expiresAt: this.now() + payload.expiresIn * 1e3
     };
     this.cached = next;
-    await this.store.save(next);
+    this.lastMintedAccessToken = next.accessToken;
+    await this.store.save(keepApiToken === void 0 ? next : { ...next, apiToken: keepApiToken });
     return next;
   }
 };
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function newerSession(onDisk, creds) {
+  if (onDisk?.refreshToken === void 0 || onDisk.refreshToken === creds.refreshToken || onDisk.userAuthUrl !== creds.userAuthUrl || onDisk.expiresAt <= creds.expiresAt) {
+    return null;
+  }
+  return { ...onDisk, apiToken: void 0 };
+}
 var RefreshRejectedError = class extends NeedsLoginError {
 };
 var ApiTokenRejectedError = class extends ConfigError {
@@ -1136,9 +1350,13 @@ async function runLogin(options, deps = {}) {
     webappUrl: config.webappUrl
   });
   const enriched = await discoverAfterLogin(credentials, config.webappUrl, deps.discover, log);
-  const prior = await store.load().catch(() => null);
-  const preserved = prior?.apiToken === void 0 ? enriched : { ...enriched, apiToken: prior.apiToken };
-  await store.save(preserved);
+  const persist = async () => {
+    const prior = await store.load().catch(() => null);
+    const merged = prior?.apiToken === void 0 ? enriched : { ...enriched, apiToken: prior.apiToken };
+    await store.save(merged);
+    return merged;
+  };
+  const preserved = await (store.withLock ? store.withLock(persist) : persist());
   log(`Signed in as ${enriched.user?.email ?? "unknown"}.`);
   log(`Credentials saved to ${store.path()}`);
   await ensureActiveOrganization({
@@ -1221,9 +1439,25 @@ async function ensureActiveOrganization(args) {
   log(`Active organization: ${mintedOrg}`);
 }
 function defaultRefreshTokens(store) {
-  const tokenManager = new TokenManager({ store: keepCredentialsOnFailure(store) });
+  const tokenManager = new TokenManager({ store: sessionOnly(store) });
   return tokenManager.forceRefresh();
 }
+function sessionOnly(store) {
+  return {
+    load: async () => {
+      const creds = await store.load();
+      return creds === null ? null : { ...creds, apiToken: void 0 };
+    },
+    save: async (creds) => {
+      const current = await store.load();
+      const apiToken = creds.apiToken ?? current?.apiToken;
+      await store.save(apiToken === void 0 ? creds : { ...creds, apiToken });
+    },
+    clear: () => Promise.resolve(),
+    path: () => store.path(),
+    ...store.withLock ? { withLock: store.withLock } : {}
+  };
+}
 function sameSlug(a, b) {
   return a.toLowerCase() === b.toLowerCase();
 }
@@ -1368,7 +1602,7 @@ async function resolveAuthStatus(deps) {
   return { ...status, organization: { slug, name: match.name } };
 }
 function describeTokenFailure(err, userAuthUrl) {
-  if (err instanceof TypeError) {
+  if (err instanceof TypeError || err instanceof Error && err.name === "TimeoutError") {
     return new ConfigError(
       `Could not reach ${userAuthUrl} to check the sign-in: ${errorMessage2(err)}`
     );
@@ -2658,11 +2892,7 @@ var HttpSpecSessionClient = class {
     if (opts?.query) params.set("q", opts.query);
     if (opts?.limit !== void 0) params.set("limit", String(opts.limit));
     if (opts?.offset !== void 0) params.set("offset", String(opts.offset));
-    const response = await this.httpClient.get(
-      `/project/v1/projects/${projectId}/sessions?${params.toString()}`,
-      jwtToken,
-      {}
-    );
+    const response = await this.httpClient.get(`/project/v1/projects/${projectId}/sessions?${params.toString()}`, jwtToken, {});
     return {
       sessions: response.sessions.map(transformSpecSessionResponse),
       total: response.total,
@@ -2670,13 +2900,14 @@ var HttpSpecSessionClient = class {
       offset: response.offset
     };
   }
-  async updateSpecSession(sessionId, updates, jwtToken) {
+  async updateSpecSession(sessionId, updates, jwtToken, options) {
     const body = {};
     if (updates.status !== void 0) body.status = updates.status;
     if (updates.messageCount !== void 0) body.message_count = updates.messageCount;
     if (updates.tokenCount !== void 0) body.token_count = updates.tokenCount;
     if (updates.context !== void 0) body.context = updates.context;
     if (updates.chatHistory !== void 0) body.chat_history = updates.chatHistory;
+    if (options?.originClientId) body.origin_client_id = options.originClientId;
     const raw = await this.httpClient.put(
       `/project/v1/sessions/${sessionId}`,
       body,
@@ -2685,8 +2916,10 @@ var HttpSpecSessionClient = class {
     );
     return transformSpecSessionResponse(raw);
   }
-  async appendSessionMessage(sessionId, message, jwtToken) {
-    const response = await this.httpClient.post(`/project/v1/sessions/${sessionId}/messages`, { message }, jwtToken, {});
+  async appendSessionMessage(sessionId, message, jwtToken, options) {
+    const body = { message };
+    if (options?.originClientId) body.origin_client_id = options.originClientId;
+    const response = await this.httpClient.post(`/project/v1/sessions/${sessionId}/messages`, body, jwtToken, {});
     return { messageCount: response.message_count };
   }
   async archiveSpecSession(sessionId, jwtToken) {
@@ -8504,10 +8737,13 @@ async function resolveReverseAgentUrl(sources) {
       );
     }
     if (stored && sources.persist) {
-      await sources.persist(applyDiscoveredUrls(stored, config.webappUrl, discovered)).catch((err) => {
-        const message = err instanceof Error ? err.message : String(err);
-        warn(`myspec-mcp reverse: could not save discovered URLs (${message})`);
-      });
+      const latest = await sources.loadStored().catch(() => null);
+      if (latest) {
+        await sources.persist(applyDiscoveredUrls(latest, config.webappUrl, discovered)).catch((err) => {
+          const message = err instanceof Error ? err.message : String(err);
+          warn(`myspec-mcp reverse: could not save discovered URLs (${message})`);
+        });
+      }
     }
     return { agentUrl: discovered.aiAgentMcpReverseUrl, discoveredVia: endpoint };
   } catch (err) {
@@ -8615,7 +8851,7 @@ async function runReverseCommand(flags) {
     };
     forceRefresh = () => tokenManager.forceRefresh();
     loadStored = () => store.load();
-    persist = (creds) => store.save(creds);
+    persist = (creds) => saveDiscoveredUrls(store, creds);
   }
   const resolved = await resolveReverseAgentUrl({
     flagAgentUrl: flagString(flags, "agent-url"),
@@ -8668,9 +8904,9 @@ function createPlatformUrlResolver(deps) {
         `Could not discover endpoints from ${configEndpoint(deps.webappUrl)} (response is missing platformUrl). Run \`npx @myspec/mcp-server login\` and retry.`
       );
     }
-    const creds = await deps.tokenManager.getCredentials().catch(() => null);
+    const creds = await deps.store.load().catch(() => null);
     if (creds) {
-      await deps.store.save(applyDiscoveredUrls(creds, deps.webappUrl, discovered)).catch((err) => {
+      await saveDiscoveredUrls(deps.store, applyDiscoveredUrls(creds, deps.webappUrl, discovered)).catch((err) => {
         const message = err instanceof Error ? err.message : String(err);
         warn(`myspec-mcp: could not save discovered URLs (${message})`);
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "1.1.1-next.157",
+  "version": "1.1.1-next.159",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {