@ronana/mcp 0.3.0 → 0.3.2

package/dist/cli.js

@@ -173,6 +173,14 @@ async function withRemote(fn) {
         await remote.close().catch(() => null);
     }
 }
+/** A queued job: print its id, or with --wait / --out follow it to the end. */
+async function queuedThenFinish(remote, queued, args) {
+    if (!has(args, "wait") && !has(args, "out")) {
+        return emit(queued, () => { print(queued.id); note(`Check it with \`ronana generate wait ${queued.id}\`.`); });
+    }
+    note(`Queued ${queued.id}.`);
+    await finish(await waitFor(remote, queued.id, args), args);
+}
 async function generateCommand(sub, args) {
     const [target] = args.positional;
     if (sub === "list") {
@@ -208,11 +216,7 @@ async function generateCommand(sub, args) {
            command run twice in ten minutes would return the first generation. */
         const idempotency_key = flag(args, "idempotency_key") ?? randomUUID();
         const queued = await callTool(remote, "generate", { model: contract.id, input, idempotency_key });
-        if (!has(args, "wait") && !has(args, "out")) {
-            return emit(queued, () => { print(queued.id); note(`Check it with \`ronana generate wait ${queued.id}\`.`); });
-        }
-        note(`Queued ${queued.id}.`);
-        await finish(await waitFor(remote, queued.id, args), args);
+        await queuedThenFinish(remote, queued, args);
     });
 }
 async function modelCommand(sub, args) {
@@ -263,11 +267,7 @@ async function upscaleCommand(args) {
             ...(flag(args, "resolution") ? { resolution: flag(args, "resolution") } : {}),
             idempotency_key: flag(args, "idempotency_key") ?? randomUUID(),
         });
-        if (!has(args, "wait") && !has(args, "out")) {
-            return emit(queued, () => { print(queued.id); note(`Check it with \`ronana generate wait ${queued.id}\`.`); });
-        }
-        note(`Queued ${queued.id}.`);
-        await finish(await waitFor(remote, queued.id, args), args);
+        await queuedThenFinish(remote, queued, args);
     });
 }
 async function folderCommand(sub, args) {
@@ -317,7 +317,12 @@ async function main() {
             }
             if (action === "status") {
                 const credentials = readCredentials();
-                return emit({ signed_in: !!credentials, base_url: credentials?.baseUrl ?? null }, () => print(credentials ? `Signed in to ${credentials.baseUrl}.` : "Not signed in."));
+                if (!credentials)
+                    return emit({ signed_in: false, base_url: null }, () => print("Not signed in."));
+                // Ask the server: a sign-in stored here may have been disconnected on
+                // the website or have expired, and only the server knows.
+                const problem = await withRemote((r) => callTool(r, "get_account")).then(() => null, (error) => error instanceof ToolError ? null : error instanceof Error ? error.message : String(error));
+                return emit({ signed_in: problem === null, base_url: credentials.baseUrl, ...(problem ? { error: problem } : {}) }, () => print(problem ?? `Signed in to ${credentials.baseUrl}.`));
             }
             throw new Error("Use auth login | logout | status.");
         }

package/dist/oauth.d.ts

@@ -8,4 +8,6 @@ export interface StoredCredentials {
 export declare function readCredentials(): StoredCredentials | null;
 export declare function logout(): Promise<void>;
 export declare function login(baseUrl?: string, openInBrowser?: boolean): Promise<void>;
+/** What a user reads when the stored sign-in no longer works on the server. */
+export declare const SIGN_IN_ENDED = "Your Ronana sign-in has ended (disconnected or expired). Run `ronana auth login` again.";
 export declare function accessToken(): Promise<string>;

package/dist/oauth.js

@@ -26,15 +26,19 @@ export function readCredentials() {
 function writeCredentials(value) {
     entry().setPassword(JSON.stringify(value));
 }
+/** Ends a stored sign-in on the server, so it leaves the account's connections.
+ *  Best effort: an unreachable server still lets the local step go ahead. */
+async function revoke(credentials) {
+    await fetch(`${credentials.baseUrl}/api/auth/oauth2/revoke`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token: credentials.refreshToken, client_id: credentials.clientId }),
+    }).catch(() => null);
+}
 export async function logout() {
     const current = readCredentials();
-    if (current) {
-        await fetch(`${current.baseUrl}/api/auth/oauth2/revoke`, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({ token: current.refreshToken, client_id: current.clientId }),
-        }).catch(() => null);
-    }
+    if (current)
+        await revoke(current);
     try {
         entry().deletePassword();
     }
@@ -80,22 +84,37 @@ export async function login(baseUrl = process.env.RONANA_BASE_URL ?? "https://ro
         let fail;
         const code = new Promise((ok, no) => { settle = ok; fail = no; });
         const timer = setTimeout(() => fail(new Error("Sign-in timed out. Run `ronana auth login` again.")), LOGIN_TIMEOUT_MS);
-        const close = () => { clearTimeout(timer); server.close(); };
+        /* The browser tab waits on this response until the code has been traded
+           for tokens, so it only says "connected" once that is true. */
+        let held = null;
+        let answered = false;
+        const finish = (text, status = 200) => {
+            if (!held)
+                return;
+            held.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" }).end(text);
+            held = null;
+        };
+        const close = () => {
+            clearTimeout(timer);
+            finish("Sign-in did not finish. See your terminal for why.", 500);
+            server.close();
+        };
         const server = createServer((req, res) => {
             const url = new URL(req.url ?? "/", "http://127.0.0.1");
-            if (url.searchParams.get("state") !== state) {
-                res.writeHead(400).end("Invalid OAuth state.");
-                fail(new Error("OAuth state did not match."));
+            // Anything but our own callback (a favicon, a prefetch, a stale tab from an
+            // earlier sign-in, a repeat) is ignored, so it cannot end the sign-in.
+            if (answered || url.pathname !== "/callback" || url.searchParams.get("state") !== state) {
+                res.writeHead(404).end();
+                return;
             }
-            else if (url.searchParams.get("error")) {
-                res.writeHead(400).end("Authorization was not completed.");
+            answered = true;
+            if (url.searchParams.get("error")) {
+                res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" }).end("Authorization was not completed.");
                 fail(new Error(url.searchParams.get("error_description") ?? url.searchParams.get("error")));
+                return;
             }
-            else {
-                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" }).end("Ronana is connected. You can close this window.");
-                settle(url.searchParams.get("code") ?? "");
-            }
-            close();
+            held = res;
+            settle(url.searchParams.get("code") ?? "");
         });
         server.once("error", (error) => { clearTimeout(timer); reject(error); });
         server.listen(0, "127.0.0.1", () => {
@@ -104,7 +123,7 @@ export async function login(baseUrl = process.env.RONANA_BASE_URL ?? "https://ro
                 close();
                 return reject(new Error("Loopback callback failed."));
             }
-            resolve({ redirectUri: `http://127.0.0.1:${address.port}/callback`, code, close });
+            resolve({ redirectUri: `http://127.0.0.1:${address.port}/callback`, code, finish, close });
         });
     });
     // Every exit below (refused registration, timeout, a refused token) frees the
@@ -154,6 +173,9 @@ ${authorize}
         });
         if (typeof tokens.access_token !== "string" || typeof tokens.refresh_token !== "string")
             throw new Error("OAuth response did not contain tokens.");
+        // Signing in again replaces the stored sign-in; end the old one too, or
+        // every login leaves another connection behind on the account.
+        const previous = readCredentials();
         writeCredentials({
             baseUrl,
             clientId: registered.client_id,
@@ -161,6 +183,9 @@ ${authorize}
             refreshToken: tokens.refresh_token,
             expiresAt: Date.now() + Number(tokens.expires_in ?? 900) * 1000,
         });
+        callback.finish("Ronana is connected. You can close this window.");
+        if (previous)
+            await revoke(previous);
     }
     finally {
         callback.close();
@@ -203,6 +228,8 @@ async function withRefreshLock(fn) {
             catch { /* Gone already. */ }
     }
 }
+/** What a user reads when the stored sign-in no longer works on the server. */
+export const SIGN_IN_ENDED = "Your Ronana sign-in has ended (disconnected or expired). Run `ronana auth login` again.";
 export async function accessToken() {
     const stored = readCredentials();
     if (!stored)
@@ -220,7 +247,21 @@ export async function accessToken() {
             client_id: current.clientId,
             refresh_token: current.refreshToken,
             resource: `${current.baseUrl}/mcp`,
+        }).catch((error) => {
+            // A network failure (fetch's TypeError) may pass; a refusal means this
+            // sign-in is over (disconnected on the website, or expired), and the
+            // server's own words ("session not found") would read as something else.
+            if (error instanceof TypeError)
+                throw error;
+            // A login in another process replaces the stored sign-in and revokes the
+            // one we were refreshing: carry on with the new one instead.
+            const replaced = readCredentials();
+            if (replaced && replaced.clientId !== current.clientId && fresh(replaced))
+                return { replaced: replaced.accessToken };
+            throw new Error(SIGN_IN_ENDED);
         });
+        if (typeof tokens.replaced === "string")
+            return tokens.replaced;
         if (typeof tokens.access_token !== "string")
             throw new Error("OAuth refresh failed.");
         const next = {

package/dist/remote.js

@@ -6,7 +6,7 @@ import { readFile } from "node:fs/promises";
 import { basename, extname } from "node:path";
 import { Readable } from "node:stream";
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
-import { accessToken, readCredentials } from "./oauth.js";
+import { accessToken, readCredentials, SIGN_IN_ENDED } from "./oauth.js";
 export async function remoteClient() {
     const credentials = readCredentials();
     if (!credentials)
@@ -20,6 +20,10 @@ export async function remoteClient() {
         await client.connect(transport);
     }
     catch (error) {
+        // A 401 on a token that was still in date: the server answers that for a
+        // connection disconnected on the website.
+        if (error instanceof Error && /\b401\b|unauthori[sz]ed|revoked/i.test(error.message))
+            throw new Error(SIGN_IN_ENDED);
         // A 404 means either an account outside the MCP rollout or a server with no
         // MCP at all (a wrong --base-url). Only a server that advertises the MCP
         // resource can be refusing the account.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ronana/mcp",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Ronana command line and local MCP bridge.",
   "license": "MIT",
   "homepage": "https://ronana.ai",