@nooticr/mcp 1.26.74 → 1.26.76

package/dist/auth.js

@@ -225,17 +225,35 @@ export function createManagementTokenProvider(auth) {
 /**
  * Builds a TokenProvider for one caller's own API key — the headless path
  * through HTTP mode, where the bearer the client presented *is* the nooticr
- * credential. Deliberately not `createHttpTokenProvider`: that one falls back
- * to the operator's environment and credentials file, which would answer one
- * tenant's call with another's account.
+ * credential. Never the operator's environment or credentials file, which would
+ * answer one tenant's call with another's account.
  */
 export function createApiKeyTokenProvider(apiKey) {
     return { getAccessToken: async () => apiKey };
 }
-/** Builds a TokenProvider for HTTP mode: env > api key > file > per-session tokens. */
-export function createHttpTokenProvider(auth, session) {
+/**
+ * Builds a TokenProvider for one OAuth session in HTTP mode: that session's
+ * nooticr tokens and nothing else. The environment and the credentials file
+ * belong to whoever runs the server; resolving them here answered every
+ * signed-in user as the operator. A refresh updates the session in place, so
+ * the next request from the same login carries the new token, and nothing is
+ * written to the operator's credentials file.
+ */
+export function createSessionTokenProvider(baseUrl, session) {
     return {
-        getAccessToken: async () => auth.getAccessToken(session),
-        onUnauthorized: async () => auth.onUnauthorized(session),
+        getAccessToken: async () => session.nooticrAccessToken || undefined,
+        onUnauthorized: async () => {
+            if (!session.nooticrRefreshToken)
+                return false;
+            try {
+                const next = await NooticrClient.refreshSession(baseUrl, session.nooticrRefreshToken);
+                session.nooticrAccessToken = next.accessToken;
+                session.nooticrRefreshToken = next.refreshToken ?? session.nooticrRefreshToken;
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
     };
 }

package/dist/index.js

@@ -14,7 +14,7 @@ import { randomUUID } from "node:crypto";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getBaseUrl, getPublicUrl, getPort, getCredentialsFile, getTransportMode, DEFAULT_PORT, } from "./config.js";
-import { AuthManager, NooticrAuthError, createApiKeyTokenProvider, createHttpTokenProvider, createManagementTokenProvider, createStdioTokenProvider, } from "./auth.js";
+import { AuthManager, NooticrAuthError, createApiKeyTokenProvider, createSessionTokenProvider, createManagementTokenProvider, createStdioTokenProvider, } from "./auth.js";
 import { forwardedHeaders, forwardedSession, looksLikeApiKey } from "./shared/api-key.js";
 import { NooticrClient, NooticrError } from "./nooticr.js";
 import { OAuthManager, SCOPES } from "./oauth.js";
@@ -227,9 +227,6 @@ export async function runHttp(port, publicUrl) {
         client: new NooticrClient(baseUrl, {
             getAccessToken: async () => undefined,
         }),
-        onSession: async (session) => {
-            await auth.persistSession(session);
-        },
     });
     const state = {
         oauth,
@@ -239,9 +236,9 @@ export async function runHttp(port, publicUrl) {
         serverFactory: () => createMcpServer((extra) => {
             const bearer = extra.authInfo?.token;
             // A caller who presented their own API key is answered as themselves.
-            // Falling through to `createHttpTokenProvider` here would resolve the
-            // *operator's* environment or credentials file instead — one tenant's
-            // request served from another's account.
+            // No branch below falls back to the *operator's* environment or
+            // credentials file: that would serve one tenant's request from
+            // another's account.
             if (looksLikeApiKey(bearer)) {
                 return new NooticrClient(baseUrl, createApiKeyTokenProvider(bearer));
             }
@@ -250,15 +247,13 @@ export async function runHttp(port, publicUrl) {
             if (forwarded) {
                 return new NooticrClient(baseUrl, createApiKeyTokenProvider(forwarded.token), undefined, forwardedHeaders(forwarded));
             }
+            // An OAuth login of this server: only that session's own tokens.
             const session = bearer
                 ? oauth.verifyToken(bearer)
                 : undefined;
-            return new NooticrClient(baseUrl, createHttpTokenProvider(auth, session
-                ? {
-                    accessToken: session.nooticrAccessToken,
-                    refreshToken: session.nooticrRefreshToken,
-                }
-                : undefined));
+            return new NooticrClient(baseUrl, session
+                ? createSessionTokenProvider(baseUrl, session)
+                : { getAccessToken: async () => undefined });
         }),
     };
     const server = http.createServer((req, res) => {

package/dist/shared/tools.js

@@ -36,7 +36,7 @@ import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 import { DEFAULT_NOOTICR_SETTINGS, DEFAULT_SOCIAL_PLATFORMS, MemorySettingsStore, SETTINGS_READ_TOOL, SETTINGS_UPDATE_TOOL, settingsOwnerFromAuth, } from "./settings.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.74";
+export const MCP_SERVER_VERSION = "1.26.76";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */

package/dist/shared/ui-template.js

@@ -2066,7 +2066,8 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
   var GROUP_PEEK=4;
   /** Groups the reader has opened, by post URL, kept across a filter or sort. */
   var expandedGroups={};
-  // Posters the reader has asked to play, keyed like expandedGroups.
+  // The poster the reader asked to play, keyed like expandedGroups. At most
+  // one key: see the [data-mplay] handler.
   var expandedMedia={};
 
   /** Reach of the post a comment sits under — how many people saw it. */
@@ -2227,11 +2228,16 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
     if(mplay&&(monitorState||spokenState)){
       var mkey=mplay.getAttribute("data-mplay")||"";
       if(mkey&&mplay.className.indexOf("is-playable")>=0){
+        // One post plays at a time. Every expanded stage is redrawn with
+        // autoplay, so a second poster click used to restart the first video
+        // under the new one, and only the first stage in the page was
+        // registered below, so neither paused the other (#253).
+        expandedMedia={};
         expandedMedia[mkey]=true;
         renderMentions();
-        // renderMentions draws outside the top-level render, so anything it
-        // just wrote has nothing bound to it. initPlayers resets first, so
-        // calling it again here is safe.
+        // Nothing in a mention view is a bound player today (no .mp, .au or
+        // poster fallback), so this only resets the registries before the
+        // stage is registered; it binds anything a later view adds.
         initPlayers();
         var v=document.querySelector(".mgroup-stage video");
         if(v){registerAudio(v);stopAllPlayers();}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.74",
+  "version": "1.26.76",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {