@sonoma-security/mcp-gateway 0.1.11 → 0.1.13

package/dist/auth/keychain.js

@@ -0,0 +1,305 @@
+/**
+ * OS Keychain abstraction for secure credential storage.
+ *
+ * Uses native OS credential stores via CLI tools (no native modules needed):
+ * - macOS: Keychain Access via `security` CLI
+ * - Windows: Credential Manager via PowerShell
+ * - Linux/other: Falls back to encrypted file storage (existing behavior)
+ *
+ * All credentials are stored as JSON strings, keyed by (service, account).
+ */
+import { execSync } from "node:child_process";
+const SERVICE_NAME = "sonoma-mcp-gateway";
+/**
+ * Store a credential in the OS keychain.
+ * @param account - Unique key within the service (e.g., "sonoma-auth", "upstream:https://mcp.slack.com")
+ * @param data - Credential data (will be JSON-stringified)
+ */
+export function keychainSet(account, data) {
+    const json = JSON.stringify(data);
+    const platform = process.platform;
+    if (platform === "darwin") {
+        macosSet(account, json);
+    }
+    else if (platform === "win32") {
+        windowsSet(account, json);
+    }
+    else {
+        throw new Error(`Keychain not supported on ${platform}`);
+    }
+}
+/**
+ * Retrieve a credential from the OS keychain.
+ * @returns Parsed JSON data, or null if not found
+ */
+export function keychainGet(account) {
+    const platform = process.platform;
+    let json;
+    if (platform === "darwin") {
+        json = macosGet(account);
+    }
+    else if (platform === "win32") {
+        json = windowsGet(account);
+    }
+    else {
+        throw new Error(`Keychain not supported on ${platform}`);
+    }
+    if (json === null)
+        return null;
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Delete a credential from the OS keychain.
+ */
+export function keychainDelete(account) {
+    const platform = process.platform;
+    if (platform === "darwin") {
+        macosDelete(account);
+    }
+    else if (platform === "win32") {
+        windowsDelete(account);
+    }
+    else {
+        throw new Error(`Keychain not supported on ${platform}`);
+    }
+}
+/**
+ * Delete all credentials for the service from the OS keychain.
+ */
+export function keychainDeleteAll() {
+    const platform = process.platform;
+    if (platform === "darwin") {
+        macosDeleteAll();
+    }
+    else if (platform === "win32") {
+        windowsDeleteAll();
+    }
+    else {
+        throw new Error(`Keychain not supported on ${platform}`);
+    }
+}
+/**
+ * Check whether OS keychain is available on this platform.
+ */
+export function keychainAvailable() {
+    const platform = process.platform;
+    if (platform === "darwin" || platform === "win32") {
+        return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// macOS Keychain via `security` CLI
+// ---------------------------------------------------------------------------
+function macosSet(account, password) {
+    // -U = update if exists, -s = service, -a = account, -w = password
+    // Accepted risk: macOS `security` CLI requires -w <password> as a CLI argument,
+    // which briefly exposes it in the process list. There is no stdin alternative for
+    // add-generic-password. The exposure window is sub-second and local-only.
+    execSync(`/usr/bin/security add-generic-password -s ${shellEscape(SERVICE_NAME)} -a ${shellEscape(account)} -U -w ${shellEscape(password)}`, { stdio: "pipe" });
+}
+function macosGet(account) {
+    try {
+        const result = execSync(`/usr/bin/security find-generic-password -s ${shellEscape(SERVICE_NAME)} -a ${shellEscape(account)} -w`, { stdio: "pipe", encoding: "utf-8" });
+        return result.trim();
+    }
+    catch {
+        // Not found (exit code 44) or other error
+        return null;
+    }
+}
+function macosDelete(account) {
+    try {
+        execSync(`/usr/bin/security delete-generic-password -s ${shellEscape(SERVICE_NAME)} -a ${shellEscape(account)}`, { stdio: "pipe" });
+    }
+    catch {
+        // Ignore if not found
+    }
+}
+function macosDeleteAll() {
+    // Delete entries one at a time until none remain
+    for (let i = 0; i < 100; i++) {
+        try {
+            execSync(`/usr/bin/security delete-generic-password -s ${shellEscape(SERVICE_NAME)}`, { stdio: "pipe" });
+        }
+        catch {
+            break; // No more entries
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Windows Credential Manager via PowerShell
+// ---------------------------------------------------------------------------
+function windowsTargetName(account) {
+    return `${SERVICE_NAME}:${account}`;
+}
+function windowsSet(account, password) {
+    const target = windowsTargetName(account);
+    // Use CredWrite via .NET interop for arbitrary credential storage.
+    // Base64-encode the password to avoid escaping issues in PowerShell.
+    const b64 = Buffer.from(password, "utf-8").toString("base64");
+    const ps = `
+$ErrorActionPreference='Stop'
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public class CredManager {
+    [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+    public static extern bool CredWriteW(ref CREDENTIAL cred, uint flags);
+    [DllImport("advapi32.dll", SetLastError=true)]
+    public static extern bool CredFree(IntPtr buffer);
+
+    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+    public struct CREDENTIAL {
+        public uint Flags;
+        public uint Type;
+        public string TargetName;
+        public string Comment;
+        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+
+    public static void Write(string target, string secret) {
+        byte[] bytes = Encoding.UTF8.GetBytes(secret);
+        IntPtr blob = Marshal.AllocHGlobal(bytes.Length);
+        Marshal.Copy(bytes, 0, blob, bytes.Length);
+        CREDENTIAL cred = new CREDENTIAL();
+        cred.Type = 1; // CRED_TYPE_GENERIC
+        cred.TargetName = target;
+        cred.CredentialBlobSize = (uint)bytes.Length;
+        cred.CredentialBlob = blob;
+        cred.Persist = 2; // CRED_PERSIST_LOCAL_MACHINE
+        cred.UserName = "sonoma-gateway";
+        bool ok = CredWriteW(ref cred, 0);
+        Marshal.FreeHGlobal(blob);
+        if (!ok) throw new Exception("CredWrite failed: " + Marshal.GetLastWin32Error());
+    }
+}
+"@
+$targetB64 = '${Buffer.from(target, "utf-8").toString("base64")}'
+$target = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($targetB64))
+$secret = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('${b64}'))
+[CredManager]::Write($target, $secret)
+`;
+    execSync(`powershell -NoProfile -NonInteractive -Command "${ps.replace(/"/g, '\\"')}"`, {
+        stdio: "pipe",
+        windowsHide: true,
+    });
+}
+function windowsGet(account) {
+    const target = windowsTargetName(account);
+    const ps = `
+$ErrorActionPreference='Stop'
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public class CredReader {
+    [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+    public static extern bool CredReadW(string target, uint type, uint flags, out IntPtr cred);
+    [DllImport("advapi32.dll", SetLastError=true)]
+    public static extern bool CredFree(IntPtr buffer);
+
+    [StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
+    public struct CREDENTIAL {
+        public uint Flags;
+        public uint Type;
+        public string TargetName;
+        public string Comment;
+        public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+
+    public static string Read(string target) {
+        IntPtr credPtr;
+        bool ok = CredReadW(target, 1, 0, out credPtr);
+        if (!ok) return null;
+        CREDENTIAL cred = (CREDENTIAL)Marshal.PtrToStructure(credPtr, typeof(CREDENTIAL));
+        byte[] bytes = new byte[cred.CredentialBlobSize];
+        Marshal.Copy(cred.CredentialBlob, bytes, 0, bytes.Length);
+        CredFree(credPtr);
+        return Encoding.UTF8.GetString(bytes);
+    }
+}
+"@
+$targetB64 = '${Buffer.from(target, "utf-8").toString("base64")}'
+$t = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($targetB64))
+$result = [CredReader]::Read($t)
+if ($result -eq $null) { exit 1 }
+[Console]::Write($result)
+`;
+    try {
+        return execSync(`powershell -NoProfile -NonInteractive -Command "${ps.replace(/"/g, '\\"')}"`, { stdio: "pipe", encoding: "utf-8", windowsHide: true });
+    }
+    catch {
+        return null;
+    }
+}
+function windowsDelete(account) {
+    const target = windowsTargetName(account);
+    try {
+        execSync(`cmdkey /delete:${target}`, { stdio: "pipe", windowsHide: true });
+    }
+    catch {
+        // Ignore if not found
+    }
+}
+function windowsDeleteAll() {
+    // List all credentials matching our service prefix and delete them
+    try {
+        const output = execSync("cmdkey /list", {
+            stdio: "pipe",
+            encoding: "utf-8",
+            windowsHide: true,
+        });
+        const prefix = `${SERVICE_NAME}:`;
+        for (const line of output.split("\n")) {
+            const match = line.match(/Target:\s*(.+)/i);
+            if (match) {
+                const target = match[1].trim();
+                if (target.startsWith(prefix)) {
+                    try {
+                        execSync(`cmdkey /delete:${target}`, { stdio: "pipe", windowsHide: true });
+                    }
+                    catch {
+                        // Ignore individual delete failures
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        // Ignore errors
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Shell-escape a string for use in a command argument.
+ * Wraps in single quotes and escapes embedded single quotes.
+ */
+function shellEscape(s) {
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/auth/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/auth/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAI1C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAa;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoB,CAAC;IAE9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAc,OAAe;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoB,CAAC;IAE9C,IAAI,IAAmB,CAAC;IACxB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoB,CAAC;IAE9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,WAAW,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoB,CAAC;IAE9C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,cAAc,EAAE,CAAC;IACnB,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,gBAAgB,EAAE,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoB,CAAC;IAC9C,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,OAAe,EAAE,QAAgB;IACjD,mEAAmE;IACnE,gFAAgF;IAChF,kFAAkF;IAClF,0EAA0E;IAC1E,QAAQ,CACN,6CAA6C,WAAW,CAAC,YAAY,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,UAAU,WAAW,CAAC,QAAQ,CAAC,EAAE,EAClI,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CACrB,8CAA8C,WAAW,CAAC,YAAY,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,EACvG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CACrC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,QAAQ,CACN,gDAAgD,WAAW,CAAC,YAAY,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,EAAE,EACtG,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED,SAAS,cAAc;IACrB,iDAAiD;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,CACN,gDAAgD,WAAW,CAAC,YAAY,CAAC,EAAE,EAC3E,EAAE,KAAK,EAAE,MAAM,EAAE,CAClB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,kBAAkB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,GAAG,YAAY,IAAI,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,QAAgB;IACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA8CG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;;uFAEwB,GAAG;;CAEzF,CAAC;IACA,QAAQ,CAAC,mDAAmD,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE;QACtF,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAyCG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;;;;;CAK9D,CAAC;IACA,IAAI,CAAC;QACH,OAAO,QAAQ,CACb,mDAAmD,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAC7E,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,CACN,kBAAkB,MAAM,EAAE,EAC1B,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CACrC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE;YACtC,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,QAAQ,CAAC,kBAAkB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7E,CAAC;oBAAC,MAAM,CAAC;wBACP,oCAAoC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC"}

package/dist/auth/server.d.ts

@@ -15,12 +15,24 @@ export interface CallbackServerOptions {
     /** Name of the service being authenticated (shown on success page) */
     serverName?: string;
 }
+export interface CallbackServerHandle {
+    /** Promise that resolves with the authorization code when received */
+    waitForCallback: () => Promise<CallbackResult>;
+    /** Clean up the server without waiting for a callback */
+    close: () => void;
+    /** Set the auth URL so the timeout page can offer a retry button */
+    setAuthUrl: (url: string) => void;
+}
 /**
- * Start a local HTTP server and wait for OAuth callback
+ * Start a local HTTP server for OAuth callback.
  *
- * @returns Promise that resolves with the authorization code when received
+ * Returns a promise that resolves once the server is listening (port acquired),
+ * or rejects immediately if the port is taken (EADDRINUSE). This two-phase
+ * design lets callers confirm they own the port before opening a browser tab,
+ * eliminating the race where two processes both check the port, both find it
+ * free, and both open duplicate tabs.
  */
-export declare function startCallbackServer(options?: CallbackServerOptions): Promise<CallbackResult>;
+export declare function startCallbackServer(options?: CallbackServerOptions): Promise<CallbackServerHandle>;
 /**
  * Get the callback URL for OAuth configuration
  */

package/dist/auth/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,cAAc,CAAC,CA4HhG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAe,GAAG,MAAM,CAE1D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,eAAe,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/C,yDAAyD;IACzD,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2KtG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAe,GAAG,MAAM,CAE1D"}

package/dist/auth/server.js

@@ -8,9 +8,13 @@ import { createServer } from "node:http";
 const DEFAULT_PORT = 19842;
 const TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 /**
- * Start a local HTTP server and wait for OAuth callback
+ * Start a local HTTP server for OAuth callback.
  *
- * @returns Promise that resolves with the authorization code when received
+ * Returns a promise that resolves once the server is listening (port acquired),
+ * or rejects immediately if the port is taken (EADDRINUSE). This two-phase
+ * design lets callers confirm they own the port before opening a browser tab,
+ * eliminating the race where two processes both check the port, both find it
+ * free, and both open duplicate tabs.
  */
 export function startCallbackServer(options = {}) {
     const port = options.port || DEFAULT_PORT;
@@ -26,11 +30,14 @@ export function startCallbackServer(options = {}) {
     // Grace period: keep server alive after timeout so the user sees a styled
     // error page instead of "This site can't be reached" if they click Allow late.
     const GRACE_PERIOD_MS = 5 * 60 * 1000; // 5 minutes
-    return new Promise((resolve, reject) => {
+    return new Promise((resolveStart, rejectStart) => {
         let server = null;
         let timeoutId = null;
         let graceTimeoutId = null;
         let timedOut = false;
+        let callbackResolve = null;
+        let callbackReject = null;
+        let authUrl = null;
         const cleanup = () => {
             if (timeoutId) {
                 clearTimeout(timeoutId);
@@ -45,30 +52,57 @@ export function startCallbackServer(options = {}) {
                 server = null;
             }
         };
-        // Set up timeout
-        timeoutId = setTimeout(() => {
-            timedOut = true;
-            timeoutId = null;
-            reject(new Error("OAuth callback timeout - no response received within 5 minutes"));
-            // Keep server alive during grace period to serve error page
-            graceTimeoutId = setTimeout(() => {
-                cleanup();
-            }, GRACE_PERIOD_MS);
-        }, timeout);
+        const resetTimeout = () => {
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+            }
+            if (graceTimeoutId) {
+                clearTimeout(graceTimeoutId);
+                graceTimeoutId = null;
+            }
+            timedOut = false;
+            timeoutId = setTimeout(() => {
+                timedOut = true;
+                timeoutId = null;
+                // If no auth URL for retry, reject immediately
+                if (!authUrl) {
+                    callbackReject?.(new Error("OAuth callback timeout - no response received within 5 minutes"));
+                }
+                // Keep server alive so user can see retry page or error page
+                graceTimeoutId = setTimeout(() => {
+                    callbackReject?.(new Error("OAuth callback timeout - no response after retry period"));
+                    cleanup();
+                }, GRACE_PERIOD_MS);
+            }, timeout);
+        };
         server = createServer((req, res) => {
             log("Received request:", req.url);
+            // Handle retry: redirect back to auth URL and reset timeout
+            if (req.url?.startsWith("/retry") && authUrl) {
+                log("Retry requested, redirecting to auth URL");
+                resetTimeout();
+                res.writeHead(302, { Location: authUrl });
+                res.end();
+                return;
+            }
             // Only handle GET /callback
             if (!req.url?.startsWith("/callback")) {
                 res.writeHead(404);
                 res.end("Not Found");
                 return;
             }
-            // If auth timed out, show error page instead of processing the callback
+            // If auth timed out, show retry page (if auth URL available) or error page
             if (timedOut) {
-                log("Received callback after timeout, serving error page");
-                res.writeHead(408, { "Content-Type": "text/html" });
-                res.end(renderErrorPage("Authentication timed out. Please close this tab and restart the connection from your application."));
-                cleanup();
+                log("Received callback after timeout, serving retry/error page");
+                if (authUrl) {
+                    res.writeHead(408, { "Content-Type": "text/html" });
+                    res.end(renderRetryPage("Authentication timed out.", `http://localhost:${port}/retry`, serverName));
+                }
+                else {
+                    res.writeHead(408, { "Content-Type": "text/html" });
+                    res.end(renderErrorPage("Authentication timed out. Please close this tab and restart the connection from your application."));
+                    cleanup();
+                }
                 return;
             }
             const url = new URL(req.url, `http://localhost:${port}`);
@@ -82,7 +116,7 @@ export function startCallbackServer(options = {}) {
                 res.writeHead(400, { "Content-Type": "text/html" });
                 res.end(renderErrorPage("Authorization failed. Please close this window and try again."));
                 cleanup();
-                reject(new Error(`OAuth error: ${error}${errorDescription ? ` - ${errorDescription}` : ""}`));
+                callbackReject?.(new Error(`OAuth error: ${error}${errorDescription ? ` - ${errorDescription}` : ""}`));
                 return;
             }
             // Handle missing code
@@ -91,7 +125,7 @@ export function startCallbackServer(options = {}) {
                 res.writeHead(400, { "Content-Type": "text/html" });
                 res.end(renderErrorPage("No authorization code received. Please try again."));
                 cleanup();
-                reject(new Error("No authorization code received"));
+                callbackReject?.(new Error("No authorization code received"));
                 return;
             }
             // Success!
@@ -99,19 +133,30 @@ export function startCallbackServer(options = {}) {
             res.writeHead(200, { "Content-Type": "text/html" });
             res.end(renderSuccessPage(serverName));
             cleanup();
-            resolve({ code, state: state || undefined });
+            callbackResolve?.({ code, state: state || undefined });
         });
         server.on("error", (err) => {
             cleanup();
             if (err.code === "EADDRINUSE") {
-                reject(new Error(`Port ${port} is already in use. Is another gateway login in progress?`));
+                rejectStart(new Error(`Port ${port} is already in use. Is another gateway login in progress?`));
             }
             else {
-                reject(err);
+                rejectStart(err);
             }
         });
         server.listen(port, "127.0.0.1", () => {
             log(`Callback server listening on http://localhost:${port}/callback`);
+            // Server is now listening; set up the callback timeout
+            resetTimeout();
+            // Return the handle so the caller can open the browser and then wait
+            resolveStart({
+                waitForCallback: () => new Promise((resolve, reject) => {
+                    callbackResolve = resolve;
+                    callbackReject = reject;
+                }),
+                close: cleanup,
+                setAuthUrl: (url) => { authUrl = url; },
+            });
         });
     });
 }
@@ -348,6 +393,24 @@ function pageShell(content) {
       background: rgba(59, 130, 246, 0.2);
       border-color: rgba(59, 130, 246, 0.3);
     }
+    .btn-secondary {
+      background: rgba(255, 255, 255, 0.06);
+      color: var(--muted);
+      border: 1px solid var(--card-border);
+    }
+    .btn-secondary:hover {
+      background: rgba(255, 255, 255, 0.1);
+    }
+    @media (prefers-color-scheme: light) {
+      .btn-secondary {
+        background: rgba(0, 0, 0, 0.04);
+        color: #666;
+        border: 1px solid rgba(0, 0, 0, 0.1);
+      }
+      .btn-secondary:hover {
+        background: rgba(0, 0, 0, 0.08);
+      }
+    }
     .wordmark {
       position: relative;
       z-index: 10;
@@ -430,6 +493,30 @@ function renderSuccessPage(serverName) {
       </div>
     </div>`);
 }
+function renderRetryPage(message, retryUrl, serverName) {
+    const displayName = serverName ? capitalize(escapeHtml(serverName)) : "the service";
+    return pageShell(`
+    <div class="card">
+      <div class="card-header">
+        <div class="logo-container">
+          <div class="logo-box">${SONOMA_LOGO}</div>
+        </div>
+        <div class="error-icon">
+          <svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="#f59e0b" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+            <circle cx="12" cy="12" r="10"/>
+            <line x1="12" y1="8" x2="12" y2="12"/>
+            <line x1="12" y1="16" x2="12.01" y2="16"/>
+          </svg>
+        </div>
+        <div class="title">Authentication Timed Out</div>
+        <p class="description">${escapeHtml(message)} Click retry to authenticate with <strong>${displayName}</strong> again.</p>
+      </div>
+      <div class="card-footer" style="display:flex;gap:12px;justify-content:center">
+        <a class="btn btn-cta" href="${escapeHtml(retryUrl)}" style="cursor:pointer!important">Retry</a>
+        <button class="btn btn-secondary" onclick="window.close()" style="cursor:pointer!important">Close</button>
+      </div>
+    </div>`);
+}
 function renderErrorPage(message) {
     return pageShell(`
     <div class="card">

package/dist/auth/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAe9C;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAiC,EAAE;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,iCAAiC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,cAAc,GAAyC,IAAI,CAAC;QAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QAEF,iBAAiB;QACjB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC,CAAC;YAEpF,4DAA4D;YAC5D,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC/B,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,eAAe,CAAC,CAAC;QACtB,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAClE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAElC,4BAA4B;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,wEAAwE;YACxE,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CACrB,mGAAmG,CACpG,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnE,qBAAqB;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBAE7C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,+DAA+D,CAAC,CAAC,CAAC;gBAE1F,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,sBAAsB;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAElC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBAE9E,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,WAAW;YACX,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAEnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;YAEvC,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,OAAO,EAAE,CAAC;YACV,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,2DAA2D,CAAC,CAAC,CAAC;YAC7F,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,GAAG,CAAC,iDAAiD,IAAI,WAAW,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,YAAY;IAChD,OAAO,oBAAoB,IAAI,WAAW,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAE/E,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxG,CAAC;AAED,2CAA2C;AAC3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,yEAAyE;AACzE,MAAM,WAAW,GAAG,22DAA22D,CAAC;AAEh4D,iEAAiE;AACjE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2Bb,CAAC;AAER,4EAA4E;AAC5E,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCjB,CAAC;AAER,yEAAyE;AACzE,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;OAcV,CAAC;AAER,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,UAAU,GAAG,sBAAsB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,OAAO;;;;;;gDAMuC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0KtD,QAAQ;0BACc,eAAe;;MAEnC,OAAO;;;;;;;;QAQL,CAAC;AACT,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,wBAAwB,WAAW,oDAAoD;QACzF,CAAC,CAAC,yEAAyE,CAAC;IAC9E,OAAO,SAAS,CAAC;;;;kCAIe,WAAW;;;;;;;;;iCASZ,WAAW;;;;;WAKjC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,SAAS,CAAC;;;;kCAIe,WAAW;;;;;;;;;;iCAUZ,OAAO;;;;;WAK7B,CAAC,CAAC;AACb,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/auth/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAwB9C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAiC,EAAE;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,GAAG,IAAe,EAAE,EAAE;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,2DAA2D;YAC3D,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,iCAAiC;QAC3F,CAAC;IACH,CAAC,CAAC;IAEF,0EAA0E;IAC1E,+EAA+E;IAC/E,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QAC/C,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,SAAS,GAAyC,IAAI,CAAC;QAC3D,IAAI,cAAc,GAAyC,IAAI,CAAC;QAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,eAAe,GAA8C,IAAI,CAAC;QACtE,IAAI,cAAc,GAAoC,IAAI,CAAC;QAC3D,IAAI,OAAO,GAAkB,IAAI,CAAC;QAElC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,IAAI,SAAS,EAAE,CAAC;gBACd,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS,GAAG,IAAI,CAAC;gBACjB,+CAA+C;gBAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,cAAc,EAAE,CAAC,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC,CAAC;gBAChG,CAAC;gBACD,6DAA6D;gBAC7D,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,cAAc,EAAE,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;oBACvF,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,eAAe,CAAC,CAAC;YACtB,CAAC,EAAE,OAAO,CAAC,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAClE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YAElC,4DAA4D;YAC5D,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC7C,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBAChD,YAAY,EAAE,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,4BAA4B;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,2DAA2D,CAAC,CAAC;gBACjE,IAAI,OAAO,EAAE,CAAC;oBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CACrB,2BAA2B,EAC3B,oBAAoB,IAAI,QAAQ,EAChC,UAAU,CACX,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CACrB,mGAAmG,CACpG,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnE,qBAAqB;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBAE7C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,+DAA+D,CAAC,CAAC,CAAC;gBAE1F,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;YAED,sBAAsB;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBAElC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,mDAAmD,CAAC,CAAC,CAAC;gBAE9E,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,WAAW;YACX,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAEnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;YAEvC,OAAO,EAAE,CAAC;YACV,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,OAAO,EAAE,CAAC;YACV,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,2DAA2D,CAAC,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,GAAG,CAAC,iDAAiD,IAAI,WAAW,CAAC,CAAC;YAEtE,uDAAuD;YACvD,YAAY,EAAE,CAAC;YAEf,qEAAqE;YACrE,YAAY,CAAC;gBACX,eAAe,EAAE,GAAG,EAAE,CACpB,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC9C,eAAe,GAAG,OAAO,CAAC;oBAC1B,cAAc,GAAG,MAAM,CAAC;gBAC1B,CAAC,CAAC;gBACJ,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,CAAC,GAAW,EAAE,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;aAChD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,YAAY;IAChD,OAAO,oBAAoB,IAAI,WAAW,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAE/E,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxG,CAAC;AAED,2CAA2C;AAC3C,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,yEAAyE;AACzE,MAAM,WAAW,GAAG,22DAA22D,CAAC;AAEh4D,iEAAiE;AACjE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2Bb,CAAC;AAER,4EAA4E;AAC5E,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCjB,CAAC;AAER,yEAAyE;AACzE,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;OAcV,CAAC;AAER,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,UAAU,GAAG,sBAAsB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3E,OAAO;;;;;;gDAMuC,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4LtD,QAAQ;0BACc,eAAe;;MAEnC,OAAO;;;;;;;;QAQL,CAAC;AACT,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAmB;IAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,wBAAwB,WAAW,oDAAoD;QACzF,CAAC,CAAC,yEAAyE,CAAC;IAC9E,OAAO,SAAS,CAAC;;;;kCAIe,WAAW;;;;;;;;;iCASZ,WAAW;;;;;WAKjC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,UAAmB;IAC7E,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACpF,OAAO,SAAS,CAAC;;;;kCAIe,WAAW;;;;;;;;;;iCAUZ,UAAU,CAAC,OAAO,CAAC,6CAA6C,WAAW;;;uCAGrE,UAAU,CAAC,QAAQ,CAAC;;;WAGhD,CAAC,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,SAAS,CAAC;;;;kCAIe,WAAW;;;;;;;;;;iCAUZ,OAAO;;;;;WAK7B,CAAC,CAAC;AACb,CAAC"}

package/dist/auth/storage.d.ts

@@ -1,9 +1,8 @@
 /**
  * Secure token storage for MCP Gateway OAuth credentials
  *
- * Stores tokens in ~/.sonoma/gateway-credentials.json with AES-256-GCM encryption.
- * The encryption key is derived from a machine-specific identifier to prevent
- * tokens from being copied between machines.
+ * Stores tokens in the OS keychain (macOS Keychain, Windows Credential Manager).
+ * Falls back to encrypted file storage on unsupported platforms.
  */
 import type { OAuthTokens, OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shared/auth.js";
 export interface StoredCredentials {
@@ -20,15 +19,15 @@ export interface StoredCredentials {
     lastRefreshed?: number;
 }
 /**
- * Load stored credentials from disk
+ * Load stored credentials from OS keychain (or legacy file).
  */
 export declare function loadCredentials(): StoredCredentials | null;
 /**
- * Save credentials to disk (encrypted)
+ * Save credentials to OS keychain (or fallback file).
  */
 export declare function saveCredentials(credentials: StoredCredentials): void;
 /**
- * Clear all stored credentials
+ * Clear all stored credentials.
  */
 export declare function clearCredentials(): void;
 /**

package/dist/auth/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAKzG,MAAM,WAAW,iBAAiB;IAEhC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAc1D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAOpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAY/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAYpG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,2BAA2B,GAAG,SAAS,CAUrG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,SAAQ,GAAG,OAAO,CAMlF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAQzG,MAAM,WAAW,iBAAiB;IAEhC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CA4B1D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAgBpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAkBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAY/E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,iBAAiB,CAYpG;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,2BAA2B,GAAG,SAAS,CAUrG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,SAAQ,GAAG,OAAO,CAMlF;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}