@ronana/mcp 0.3.0 → 0.3.1

package/dist/oauth.js

@@ -26,15 +26,19 @@ export function readCredentials() {
 function writeCredentials(value) {
     entry().setPassword(JSON.stringify(value));
 }
+/** Ends a stored sign-in on the server, so it leaves the account's connections.
+ *  Best effort: an unreachable server still lets the local step go ahead. */
+async function revoke(credentials) {
+    await fetch(`${credentials.baseUrl}/api/auth/oauth2/revoke`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: credentials.refreshToken, client_id: credentials.clientId }),
+    }).catch(() => null);
+}
 export async function logout() {
     const current = readCredentials();
-    if (current) {
-        await fetch(`${current.baseUrl}/api/auth/oauth2/revoke`, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({ token: current.refreshToken, client_id: current.clientId }),
-        }).catch(() => null);
-    }
+    if (current)
+        await revoke(current);
     try {
         entry().deletePassword();
     }
@@ -83,11 +87,13 @@ export async function login(baseUrl = process.env.RONANA_BASE_URL ?? "https://ro
         const close = () => { clearTimeout(timer); server.close(); };
         const server = createServer((req, res) => {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            if (url.searchParams.get("state") !== state) {
-                res.writeHead(400).end("Invalid OAuth state.");
-                fail(new Error("OAuth state did not match."));
+            // Anything but our own callback (a favicon, a prefetch, a stale tab from an
+            // earlier sign-in) is ignored, so it cannot end the sign-in it isn't part of.
+            if (url.pathname !== "/callback" || url.searchParams.get("state") !== state) {
+                res.writeHead(404).end();
+                return;
             }
-            else if (url.searchParams.get("error")) {
+            if (url.searchParams.get("error")) {
                 res.writeHead(400).end("Authorization was not completed.");
                 fail(new Error(url.searchParams.get("error_description") ?? url.searchParams.get("error")));
             }
@@ -154,6 +160,9 @@ ${authorize}
         });
         if (typeof tokens.access_token !== "string" || typeof tokens.refresh_token !== "string")
             throw new Error("OAuth response did not contain tokens.");
+        // Signing in again replaces the stored sign-in; end the old one too, or
+        // every login leaves another connection behind on the account.
+        const previous = readCredentials();
         writeCredentials({
             baseUrl,
             clientId: registered.client_id,
@@ -161,6 +170,8 @@ ${authorize}
             refreshToken: tokens.refresh_token,
             expiresAt: Date.now() + Number(tokens.expires_in ?? 900) * 1000,
         });
+        if (previous && previous.clientId !== registered.client_id)
+            await revoke(previous);
     }
     finally {
         callback.close();
@@ -220,6 +231,13 @@ export async function accessToken() {
             client_id: current.clientId,
             refresh_token: current.refreshToken,
             resource: `${current.baseUrl}/mcp`,
+        }).catch((error) => {
+            // A network failure (fetch's TypeError) may pass; a refusal means this
+            // sign-in is over (disconnected on the website, or expired), and the
+            // server's own words ("session not found") would read as something else.
+            if (error instanceof TypeError)
+                throw error;
+            throw new Error("Your Ronana sign-in has ended (disconnected or expired). Run `ronana auth login` again.");
         });
         if (typeof tokens.access_token !== "string")
             throw new Error("OAuth refresh failed.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ronana/mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Ronana command line and local MCP bridge.",
   "license": "MIT",
   "homepage": "https://ronana.ai",