@pharaoh-so/mcp 0.3.24 → 0.3.25

package/dist/gateway.js

@@ -17,17 +17,31 @@
 import { openBrowser, pollOnce, requestDeviceCode, } from "./auth.js";
 import { readCredentials, writeCredentials } from "./credentials.js";
 import { resolveSseUrl, tokenToCredentials } from "./helpers.js";
-function isAccessExpired(creds) {
+/**
+ * True when the credentials' access token is at or past its expiry.
+ *
+ * Takes `now` as a parameter so boundary tests (Date.now() === expires_at
+ * exactly) work naturally with the gateway's injected clock — previously
+ * this used Date.now() directly, which couldn't be controlled from tests.
+ */
+function isAccessExpired(creds, now) {
     const expiresAt = new Date(creds.expires_at).getTime();
     if (Number.isNaN(expiresAt))
         return true;
-    return Date.now() >= expiresAt;
+    return now() >= expiresAt;
 }
 function buildAuthResponse(device) {
+    // Stryker disable next-line StringLiteral: user-facing UX copy; wording
+    // changes are deliberate and covered by manual review, not mutation testing.
     const prefix = device.errorMessage ? `${device.errorMessage}\n\n` : "";
-    const text = `${prefix}Pharaoh authentication required.\n\n` +
+    const text = 
+    // Stryker disable next-line StringLiteral: user-facing UX copy
+    `${prefix}Pharaoh authentication required.\n\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  1. Visit ${device.verification_uri_complete}\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  2. Enter code: ${device.user_code}\n` +
+        // Stryker disable next-line StringLiteral: user-facing UX copy
         `  3. Re-run this tool after authorizing.`;
     return {
         content: [{ type: "text", text }],
@@ -45,6 +59,12 @@ function buildAuthResponse(device) {
  */
 export function createGateway(opts) {
     const now = opts.now ?? (() => Date.now());
+    // Stryker disable next-line LogicalOperator: the `??` fallback is exercised
+    // at runtime when no opts.openBrowser is passed, but tests vi.mock auth.js's
+    // openBrowser to a noop, so a mutated operator can't be distinguished via
+    // observable behavior. vi.mock is the safety net; the fallback is defense
+    // in depth for production. See packages/mcp-proxy/tests/*.test.ts for the
+    // module-level mock that keeps real browser-open calls out of CI.
     const openBrowserImpl = opts.openBrowser ?? openBrowser;
     let pending = null;
     let lastCreds = null;
@@ -91,8 +111,6 @@ export function createGateway(opts) {
     }
     /** Decide whether the cached response is still valid without polling. */
     function shouldSkipPoll(state) {
-        if (state.last_poll_at === null)
-            return false;
         return now() - state.last_poll_at < state.interval_ms;
     }
     /**
@@ -110,6 +128,7 @@ export function createGateway(opts) {
             // inline so the agent sees why; the user will naturally retry.
             pending = null;
             return {
+                // Stryker disable next-line StringLiteral: user-facing UX copy
                 content: [{ type: "text", text: `Pharaoh auth denied: ${result.error}` }],
                 isError: true,
                 _meta: {
@@ -153,7 +172,7 @@ export function createGateway(opts) {
         if (!creds)
             return false;
         lastCreds = creds;
-        return !isAccessExpired(creds);
+        return !isAccessExpired(creds, now);
     }
     function getCredentials() {
         return lastCreds;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pharaoh-so/mcp",
   "mcpName": "so.pharaoh/pharaoh",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "MCP proxy for Pharaoh — maps codebases into queryable knowledge graphs for AI agents. Enables Claude Code in headless environments (VPS, SSH, CI) via device flow auth.",
   "type": "module",
   "main": "dist/index.js",