aismemory 0.3.0 → 0.5.0

package/dist/__tests__/device-flow-recovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/device-flow-recovery.test.js

@@ -0,0 +1,206 @@
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'path';
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+/**
+ * Regression: when the OAuth device-flow poll rejects (expired_token,
+ * access_denied, or 30-min deadline) the prior aismemory MCP would store the
+ * dead poll on `activeFlow` and every subsequent tool call would re-race
+ * against the rejected promise, propagating the same stale error. The only
+ * recovery was for the user to restart their AI tool — too friction-heavy for
+ * first-time users (they get distracted, the activation drops on the floor).
+ *
+ * After the fix, the MCP marks the flow `dead` on rejection and discards it,
+ * so the next tool call starts a fresh device flow inline and surfaces a new
+ * bond URL — no restart required.
+ *
+ * This test drives the binary against a fake AIS HTTP server that:
+ *   - returns a unique user_code per `/v1/oauth/device/authorize` call
+ *   - returns `expired_token` on the first `/v1/oauth/token` poll
+ * Two consecutive tool calls should produce two DIFFERENT user_codes in the
+ * surfaced bond URLs, proving the dead flow was discarded and replaced.
+ */
+describe('aismemory MCP device-flow recovery', () => {
+    let fakeAisServer;
+    let fakeAisPort = 0;
+    let authorizeCalls = 0;
+    const issuedCodes = [];
+    beforeAll(async () => {
+        fakeAisServer = createServer((req, res) => {
+            req.on('data', () => { });
+            req.on('end', () => {
+                if (req.url === '/v1/oauth/device/authorize' && req.method === 'POST') {
+                    authorizeCalls += 1;
+                    const userCode = `TEST-${String(authorizeCalls).padStart(4, '0')}`;
+                    issuedCodes.push(userCode);
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            device_code: `device-${authorizeCalls}`,
+                            user_code: userCode,
+                            verification_uri: `http://127.0.0.1:${fakeAisPort}/activate`,
+                            verification_uri_complete: `http://127.0.0.1:${fakeAisPort}/activate?user_code=${userCode}`,
+                            expires_in: 1800,
+                            interval: 1, // 1s poll → bounded to 5s min by the client
+                            agent_id: `agent-${authorizeCalls}`,
+                            provisional_tenant_id: `tenant-${authorizeCalls}`,
+                            provisional_token: 'provisional',
+                        },
+                    }));
+                    return;
+                }
+                if (req.url === '/v1/oauth/token' && req.method === 'POST') {
+                    // Always reject the poll so the flow dies and recovery kicks in.
+                    res.writeHead(400, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'expired_token' }));
+                    return;
+                }
+                res.writeHead(404);
+                res.end();
+            });
+        });
+        await new Promise((resolveServer) => {
+            fakeAisServer.listen(0, '127.0.0.1', () => {
+                const addr = fakeAisServer.address();
+                if (addr && typeof addr === 'object') {
+                    fakeAisPort = addr.port;
+                }
+                resolveServer();
+            });
+        });
+    });
+    afterAll(async () => {
+        await new Promise((r) => fakeAisServer?.close(() => r()));
+    });
+    beforeEach(() => {
+        authorizeCalls = 0;
+        issuedCodes.length = 0;
+    });
+    it('starts a fresh device flow after the previous one dies', async () => {
+        const distPath = resolve(__dirname, '..', '..', 'dist', 'index.js');
+        if (!existsSync(distPath)) {
+            throw new Error(`dist/index.js missing — run \`pnpm build\` first (looked at ${distPath})`);
+        }
+        const fakeHome = mkdtempSync(join(tmpdir(), 'aismem-recover-'));
+        let proc = null;
+        try {
+            proc = spawn('node', [distPath], {
+                env: {
+                    ...process.env,
+                    HOME: fakeHome,
+                    AIS_URL: `http://127.0.0.1:${fakeAisPort}`,
+                },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdoutBuf = '';
+            proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
+            proc.stderr.on('data', () => { });
+            // 1. Handshake: initialize the MCP transport.
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2024-11-05',
+                    capabilities: {},
+                    clientInfo: { name: 'recovery-test', version: '0.0.0' },
+                },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":1'), 5000, 'initialize response');
+            // 2. First tool call triggers device flow #1. The poll will reject
+            //    against the fake AIS (expired_token), marking the flow dead.
+            //    The call surfaces BondPendingError with the first user_code.
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'tools/call',
+                params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":2'), 15000, 'first whoami response');
+            const firstResponse = extractResponseText(stdoutBuf, 2);
+            // Give the poll time to actually reject — soft timeout is 7s, poll
+            // interval is min 5s, so the rejection lands ~5s after the call. We
+            // need that rejection observed before the second call so the `dead`
+            // flag is set when ensureCredentials runs again.
+            await new Promise((r) => setTimeout(r, 8000));
+            // 3. Second tool call — should detect the dead flow, start a fresh
+            //    device flow, and surface a DIFFERENT user_code.
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 3,
+                method: 'tools/call',
+                params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":3'), 15000, 'second whoami response');
+            const secondResponse = extractResponseText(stdoutBuf, 3);
+            // Recovery proof: more than one device-flow authorize was made. Without
+            // the fix the MCP would re-race the dead poll forever and never call
+            // authorize a second time.
+            expect(authorizeCalls).toBeGreaterThanOrEqual(2);
+            expect(issuedCodes.length).toBeGreaterThanOrEqual(2);
+            // Both tool calls return a bond URL (no misleading "Authentication
+            // timed out" leak from the dead poll's stored rejection).
+            expect(firstResponse).toMatch(/Memory bond required/);
+            expect(secondResponse).toMatch(/Memory bond required/);
+            // The two responses must surface DIFFERENT codes — proving the second
+            // call doesn't keep showing the original (now-dead) code.
+            const firstCode = extractUserCode(firstResponse);
+            const secondCode = extractUserCode(secondResponse);
+            expect(firstCode).toBeTruthy();
+            expect(secondCode).toBeTruthy();
+            expect(firstCode).not.toEqual(secondCode);
+            expect(issuedCodes).toContain(firstCode);
+            expect(issuedCodes).toContain(secondCode);
+        }
+        finally {
+            proc?.kill();
+            try {
+                rmSync(fakeHome, { recursive: true, force: true });
+            }
+            catch { /* ignore */ }
+        }
+    }, 45000);
+});
+function waitFor(predicate, ms, label) {
+    return new Promise((resolveOuter, reject) => {
+        const start = Date.now();
+        const tick = () => {
+            if (predicate()) {
+                resolveOuter();
+                return;
+            }
+            if (Date.now() - start > ms) {
+                reject(new Error(`timeout waiting for ${label}`));
+                return;
+            }
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+function extractUserCode(responseText) {
+    const match = /TEST-\d{4}/.exec(responseText);
+    return match ? match[0] : null;
+}
+function extractResponseText(buf, id) {
+    // MCP responses are newline-delimited JSON. Find the line with our id and
+    // pull the content[0].text payload out.
+    for (const line of buf.split('\n')) {
+        if (!line.includes(`"id":${id}`))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const text = parsed.result?.content?.[0]?.text;
+            if (typeof text === 'string')
+                return text;
+        }
+        catch {
+            /* malformed line; skip */
+        }
+    }
+    return '';
+}
+//# sourceMappingURL=device-flow-recovery.test.js.map

package/dist/__tests__/device-flow-recovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-recovery.test.js","sourceRoot":"","sources":["../../src/__tests__/device-flow-recovery.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,aAAiC,CAAC;IACtC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,aAAa,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAA2C,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,GAAG,KAAK,4BAA4B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtE,cAAc,IAAI,CAAC,CAAC;oBACpB,MAAM,QAAQ,GAAG,QAAQ,MAAM,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBACnE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;wBACb,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,WAAW,EAAE,UAAU,cAAc,EAAE;4BACvC,SAAS,EAAE,QAAQ;4BACnB,gBAAgB,EAAE,oBAAoB,WAAW,WAAW;4BAC5D,yBAAyB,EAAE,oBAAoB,WAAW,uBAAuB,QAAQ,EAAE;4BAC3F,UAAU,EAAE,IAAI;4BAChB,QAAQ,EAAE,CAAC,EAAE,4CAA4C;4BACzD,QAAQ,EAAE,SAAS,cAAc,EAAE;4BACnC,qBAAqB,EAAE,UAAU,cAAc,EAAE;4BACjD,iBAAiB,EAAE,aAAa;yBACjC;qBACF,CAAC,CACH,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC3D,iEAAiE;oBACjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,aAAa,EAAE,EAAE;YACxC,aAAc,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACzC,MAAM,IAAI,GAAG,aAAc,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC1B,CAAC;gBACD,aAAa,EAAE,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,GAAG,EAAE;QACd,cAAc,GAAG,CAAC,CAAC;QACnB,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAChE,IAAI,IAAI,GAA0C,IAAI,CAAC;QAEvD,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC/B,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oBAAoB,WAAW,EAAE;iBAC3C;gBACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAc,CAAC,CAAC,CAAC;YAE7C,8CAA8C;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CACd,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE;iBACxD;aACF,CAAC,GAAG,IAAI,CACV,CAAC;YACF,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAE/E,mEAAmE;YACnE,kEAAkE;YAClE,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,KAAK,CACd,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aAC1C,CAAC,GAAG,IAAI,CACV,CAAC;YACF,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;YAClF,MAAM,aAAa,GAAG,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAExD,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,iDAAiD;YACjD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YAE9C,mEAAmE;YACnE,qDAAqD;YACrD,IAAI,CAAC,KAAK,CAAC,KAAK,CACd,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aAC1C,CAAC,GAAG,IAAI,CACV,CAAC;YACF,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACnF,MAAM,cAAc,GAAG,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAEzD,wEAAwE;YACxE,qEAAqE;YACrE,2BAA2B;YAC3B,MAAM,CAAC,cAAc,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YAErD,mEAAmE;YACnE,0DAA0D;YAC1D,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACtD,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YAEvD,sEAAsE;YACtE,0DAA0D;YAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;YACnD,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,SAAwB,EAAE,EAAU,EAAE,KAAa;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,SAAS,EAAE,EAAE,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3F,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,EAAU;IAClD,0EAA0E;IAC1E,wCAAwC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE7B,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/__tests__/key-auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/key-auth.test.js

@@ -0,0 +1,284 @@
+/**
+ * Tests for the aismemory key-auth client module.
+ *
+ * Phase 1 DID-based authentication: the client reads an Ed25519 private key
+ * from disk, signs a challenge issued by AIS, and receives an owner JWT.
+ * Replaces the device-flow ceremony for every session after enrollment.
+ *
+ * Tests cover:
+ *   - tryKeyAuth() returns null when no key file is present (so callers can
+ *     gracefully fall back to device flow)
+ *   - tryKeyAuth() round-trips a challenge against a fake AIS and returns
+ *     the resulting owner JWT
+ *   - generateAndSaveKeypair() writes a valid key file
+ *   - readKeyFile() recovers what generateAndSaveKeypair() wrote
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, rmSync, existsSync, readFileSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer } from 'node:http';
+import { createPublicKey, createPrivateKey, verify as edVerify } from 'node:crypto';
+import { tryKeyAuth, generateAndSaveKeypair, readKeyFile, } from '../key-auth.js';
+// ───────────────────────────────────────────────────────────────────────────
+// Test fixtures
+// ───────────────────────────────────────────────────────────────────────────
+const TEST_USER_ID = '454e4306-423e-498d-9b85-24bafbabff9b';
+const TEST_DOMAIN = 'ais.example.com';
+const TEST_USER_DID = `did:web:${TEST_DOMAIN}:users:${TEST_USER_ID}`;
+let tmpKeysDir;
+beforeEach(() => {
+    tmpKeysDir = mkdtempSync(join(tmpdir(), 'aismemory-keys-test-'));
+});
+afterEach(() => {
+    if (existsSync(tmpKeysDir)) {
+        rmSync(tmpKeysDir, { recursive: true, force: true });
+    }
+});
+// ───────────────────────────────────────────────────────────────────────────
+// Key file generation + read
+// ───────────────────────────────────────────────────────────────────────────
+describe('generateAndSaveKeypair', () => {
+    it('writes a Ed25519 key file containing matching public/private bytes', async () => {
+        const result = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        expect(result.userId).toBe(TEST_USER_ID);
+        expect(result.userDid).toBe(TEST_USER_DID);
+        expect(result.keyType).toBe('Ed25519');
+        expect(result.publicKey).toMatch(/^[A-Za-z0-9_-]+$/); // base64url
+        expect(result.privateKey).toMatch(/^[A-Za-z0-9_-]+$/);
+        expect(result.publicKeyJwk.kty).toBe('OKP');
+        expect(result.publicKeyJwk.crv).toBe('Ed25519');
+        // File must exist with mode 0600.
+        const path = join(tmpKeysDir, `${TEST_USER_DID}.json`);
+        expect(existsSync(path)).toBe(true);
+        const stat = statSync(path);
+        // Bottom 9 bits = perms. We only assert the user-only invariant
+        // (group/other have no perms). Skip on Windows where this isn't real.
+        if (process.platform !== 'win32') {
+            const perms = stat.mode & 0o777;
+            expect(perms).toBe(0o600);
+        }
+        const onDisk = JSON.parse(readFileSync(path, 'utf-8'));
+        expect(onDisk.userId).toBe(TEST_USER_ID);
+    });
+});
+describe('readKeyFile', () => {
+    it('returns null when no key file is present', () => {
+        const got = readKeyFile({ userDid: TEST_USER_DID, keysDir: tmpKeysDir });
+        expect(got).toBeNull();
+    });
+    it('returns the file we generated', async () => {
+        const written = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        const read = readKeyFile({ userDid: TEST_USER_DID, keysDir: tmpKeysDir });
+        expect(read).not.toBeNull();
+        expect(read?.userId).toBe(written.userId);
+        expect(read?.privateKey).toBe(written.privateKey);
+    });
+});
+/**
+ * Spawns a tiny HTTP server that simulates the AIS challenge/did-prove
+ * endpoints. The server actually verifies the Ed25519 signature so we know
+ * the client signed the correct canonical string with the right key.
+ */
+async function startFakeAis(opts) {
+    const issued = { token: '' };
+    const server = createServer((req, res) => {
+        let body = '';
+        req.on('data', (chunk) => (body += chunk));
+        req.on('end', () => {
+            try {
+                if (req.method === 'POST' && req.url === '/v1/auth/challenge') {
+                    const parsed = JSON.parse(body || '{}');
+                    const nonce = `nonce-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+                    const exp = Math.floor(Date.now() / 1000) + (opts.forceExpiredChallenge ? -60 : 60);
+                    // We don't actually HMAC here — the fake just echoes back a marker;
+                    // the real server checks the HMAC, the fake doesn't need to.
+                    res.statusCode = 200;
+                    res.setHeader('Content-Type', 'application/json');
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { nonce, exp, hmac: `fake-hmac-for:${parsed.userDid}` },
+                    }));
+                    return;
+                }
+                if (req.method === 'POST' && req.url === '/v1/auth/did-prove') {
+                    const parsed = JSON.parse(body || '{}');
+                    if (!parsed.userDid || !parsed.nonce || !parsed.exp || !parsed.signature) {
+                        res.statusCode = 400;
+                        res.end(JSON.stringify({ success: false, error: { code: 'BAD_REQUEST' } }));
+                        return;
+                    }
+                    // Verify the signature against the accepted public key.
+                    const msg = Buffer.from(`${parsed.userDid}\n${parsed.nonce}\n${parsed.exp}`, 'utf8');
+                    const pub = createPublicKey({ key: opts.acceptedJwk, format: 'jwk' });
+                    const ok = edVerify(null, msg, pub, Buffer.from(parsed.signature, 'base64url'));
+                    if (!ok) {
+                        res.statusCode = 401;
+                        res.end(JSON.stringify({ success: false, error: { code: 'INVALID_SIGNATURE' } }));
+                        return;
+                    }
+                    const token = `fake-owner-jwt-${Date.now()}`;
+                    issued.token = token;
+                    res.statusCode = 200;
+                    res.setHeader('Content-Type', 'application/json');
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            bearerToken: token,
+                            expiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+                        },
+                    }));
+                    return;
+                }
+                res.statusCode = 404;
+                res.end(JSON.stringify({ error: 'not_found' }));
+            }
+            catch (e) {
+                res.statusCode = 500;
+                res.end(JSON.stringify({ error: e.message }));
+            }
+        });
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address();
+    if (!addr || typeof addr === 'string')
+        throw new Error('failed to bind');
+    const url = `http://127.0.0.1:${addr.port}`;
+    return {
+        url,
+        stop: () => new Promise((resolve) => {
+            server.close(() => resolve());
+        }),
+        get lastIssued() {
+            return issued.token || undefined;
+        },
+    };
+}
+describe('tryKeyAuth', () => {
+    it('returns null when no key file is present', async () => {
+        const result = await tryKeyAuth({
+            aisUrl: 'http://unreachable.example.com',
+            keysDir: tmpKeysDir,
+            userDid: TEST_USER_DID,
+        });
+        expect(result).toBeNull();
+    });
+    it('signs a real challenge and returns the issued bearer token', async () => {
+        // 1. Bootstrap a key file on disk.
+        const key = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        // 2. Stand up a fake AIS that accepts that exact public key.
+        const ais = await startFakeAis({ acceptedJwk: key.publicKeyJwk });
+        try {
+            // 3. Run the full challenge/prove flow.
+            const result = await tryKeyAuth({
+                aisUrl: ais.url,
+                keysDir: tmpKeysDir,
+                userDid: TEST_USER_DID,
+            });
+            expect(result).not.toBeNull();
+            expect(result?.userId).toBe(TEST_USER_ID);
+            expect(result?.userDid).toBe(TEST_USER_DID);
+            expect(result?.tokenType).toBe('owner');
+            expect(result?.token).toMatch(/^fake-owner-jwt-/);
+            expect(result?.expiresAt).toBeDefined();
+        }
+        finally {
+            await ais.stop();
+        }
+    });
+    it("throws when the server rejects the signature (e.g. user's key was revoked)", async () => {
+        // Generate two keypairs. Client has key A; server only accepts key B.
+        const clientKey = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        // Build a different keypair just to get a JWK the fake AIS will reject.
+        const tmpDir2 = mkdtempSync(join(tmpdir(), 'aismemory-otherkey-'));
+        const serverKey = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpDir2,
+        });
+        // Voiding the unused-var lint while keeping the keypair around for clarity.
+        void clientKey;
+        rmSync(tmpDir2, { recursive: true, force: true });
+        const ais = await startFakeAis({ acceptedJwk: serverKey.publicKeyJwk });
+        try {
+            await expect(tryKeyAuth({
+                aisUrl: ais.url,
+                keysDir: tmpKeysDir,
+                userDid: TEST_USER_DID,
+            })).rejects.toThrow();
+        }
+        finally {
+            await ais.stop();
+        }
+    });
+    it('auto-discovers the userDid when only one key file is present', async () => {
+        // No userDid passed; the helper should pick the lone file.
+        const key = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        const ais = await startFakeAis({ acceptedJwk: key.publicKeyJwk });
+        try {
+            const result = await tryKeyAuth({
+                aisUrl: ais.url,
+                keysDir: tmpKeysDir,
+            });
+            expect(result).not.toBeNull();
+            expect(result?.userDid).toBe(TEST_USER_DID);
+        }
+        finally {
+            await ais.stop();
+        }
+    });
+});
+// ───────────────────────────────────────────────────────────────────────────
+// Signing utility — verified by round-trip against Node's crypto
+// ───────────────────────────────────────────────────────────────────────────
+describe('canonical signing format', () => {
+    it("uses '<userDid>\\n<nonce>\\n<exp>' as the message body", async () => {
+        const key = await generateAndSaveKeypair({
+            userId: TEST_USER_ID,
+            userDid: TEST_USER_DID,
+            keysDir: tmpKeysDir,
+        });
+        // Re-derive the public key and verify a sample signature with the
+        // expected canonical form. If the implementation later changes the
+        // canonical bytes, this test breaks loudly.
+        const ais = await startFakeAis({ acceptedJwk: key.publicKeyJwk });
+        try {
+            const result = await tryKeyAuth({
+                aisUrl: ais.url,
+                keysDir: tmpKeysDir,
+                userDid: TEST_USER_DID,
+            });
+            expect(result).not.toBeNull();
+        }
+        finally {
+            await ais.stop();
+        }
+        // Smoke: private key actually loadable.
+        const priv = createPrivateKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: key.publicKeyJwk.x, d: key.privateKey },
+            format: 'jwk',
+        });
+        expect(priv).toBeDefined();
+    });
+});
+//# sourceMappingURL=key-auth.test.js.map

package/dist/__tests__/key-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-auth.test.js","sourceRoot":"","sources":["../../src/__tests__/key-auth.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpF,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,aAAa,GAAG,WAAW,WAAW,UAAU,YAAY,EAAE,CAAC;AAErE,IAAI,UAAkB,CAAC;AACvB,UAAU,CAAC,GAAG,EAAE;IACd,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY;QAClE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhD,kCAAkC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,aAAa,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,gEAAgE;QAChE,sEAAsE;QACtE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAChC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAaH;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAK3B;IACC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAE7B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAyB,CAAC;oBAChE,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACpF,oEAAoE;oBACpE,6DAA6D;oBAC7D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,MAAM,CAAC,OAAO,EAAE,EAAE;qBAC9D,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAKrC,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;wBACzE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;wBAC5E,OAAO;oBACT,CAAC;oBACD,wDAAwD;oBACxD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;oBACrF,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,WAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC/E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;oBAChF,IAAI,CAAC,EAAE,EAAE,CAAC;wBACR,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC;wBAClF,OAAO;oBACT,CAAC;oBACD,MAAM,KAAK,GAAG,kBAAkB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC7C,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;oBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,WAAW,EAAE,KAAK;4BAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;yBACxE;qBACF,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,GAAG;QACH,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC;QACJ,IAAI,UAAU;YACZ,OAAO,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,MAAM,EAAE,gCAAgC;YACxC,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,mCAAmC;QACnC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC;YACvC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,MAAM,EAAE,GAAG,CAAC,GAAG;gBACf,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,aAAa;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,sEAAsE;QACtE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;YAC7C,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,wEAAwE;QACxE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;YAC7C,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,4EAA4E;QAC5E,KAAK,SAAS,CAAC;QACf,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,MAAM,CACV,UAAU,CAAC;gBACT,MAAM,EAAE,GAAG,CAAC,GAAG;gBACf,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,aAAa;aACvB,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,2DAA2D;QAC3D,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC;YACvC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,MAAM,EAAE,GAAG,CAAC,GAAG;gBACf,OAAO,EAAE,UAAU;aACpB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC;YACvC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,kEAAkE;QAClE,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,MAAM,EAAE,GAAG,CAAC,GAAG;gBACf,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE,aAAa;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;QACD,wCAAwC;QACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC;YAC5B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,EAAW;YACtF,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/mcp-init-no-auth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/mcp-init-no-auth.test.js

@@ -0,0 +1,75 @@
+import { spawn } from 'node:child_process';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'path';
+import { describe, it, expect } from 'vitest';
+/**
+ * Regression test for the v0.2.0/v0.3.0 bug where `npx aismemory` blocked the
+ * MCP transport handshake on user device-flow approval, exceeding Claude
+ * Code's 30s connection timeout.
+ *
+ * Strategy: spawn the built binary with HOME pointed at a fresh tmpdir (no
+ * cached credentials) and AIS_URL pointed at a non-routable host. Before the
+ * fix, the device-flow HTTP call would hang for the connect timeout and the
+ * MCP `initialize` response would never arrive. After the fix, the transport
+ * connects before any auth, so initialize must return promptly.
+ */
+describe('MCP transport boots without blocking on auth', () => {
+    it('responds to initialize within 3s when uncredentialed and AIS unreachable', async () => {
+        const distPath = resolve(__dirname, '..', '..', 'dist', 'index.js');
+        if (!existsSync(distPath)) {
+            throw new Error(`dist/index.js missing — run \`pnpm build\` first (looked at ${distPath})`);
+        }
+        const fakeHome = mkdtempSync(join(tmpdir(), 'aismem-init-'));
+        let proc = null;
+        try {
+            proc = spawn('node', [distPath], {
+                env: {
+                    ...process.env,
+                    HOME: fakeHome,
+                    AIS_URL: 'http://10.255.255.1:1', // non-routable; the fetch will hang
+                },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
+            proc.stderr.on('data', (d) => { stderrBuf += d.toString(); });
+            const initRequest = JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2024-11-05',
+                    capabilities: {},
+                    clientInfo: { name: 'init-test', version: '0.0.0' },
+                },
+            }) + '\n';
+            const t0 = Date.now();
+            proc.stdin.write(initRequest);
+            const responseLine = await new Promise((resolveOuter, reject) => {
+                const timeout = setTimeout(() => {
+                    reject(new Error(`No MCP response in 3s. stderr:\n${stderrBuf}`));
+                }, 3000);
+                const interval = setInterval(() => {
+                    const line = stdoutBuf.split('\n').find((l) => l.includes('"jsonrpc"'));
+                    if (line) {
+                        clearTimeout(timeout);
+                        clearInterval(interval);
+                        resolveOuter(line);
+                    }
+                }, 25);
+            });
+            const elapsed = Date.now() - t0;
+            const parsed = JSON.parse(responseLine);
+            expect(elapsed).toBeLessThan(3000);
+            expect(parsed.result?.serverInfo?.name).toBe('aismemory');
+        }
+        finally {
+            if (proc && !proc.killed)
+                proc.kill('SIGKILL');
+            rmSync(fakeHome, { recursive: true, force: true });
+        }
+    }, 10_000);
+});
+//# sourceMappingURL=mcp-init-no-auth.test.js.map

package/dist/__tests__/mcp-init-no-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-init-no-auth.test.js","sourceRoot":"","sources":["../../src/__tests__/mcp-init-no-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7D,IAAI,IAAI,GAA0C,IAAI,CAAC;QACvD,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC/B,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,uBAAuB,EAAE,oCAAoC;iBACvE;gBACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,MAAM,WAAW,GACf,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE;iBACpD;aACF,CAAC,GAAG,IAAI,CAAC;YAEZ,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAE9B,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;gBACtE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC,CAAC;gBACpE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACT,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;oBAChC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;oBACxE,IAAI,IAAI,EAAE,CAAC;wBACT,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,aAAa,CAAC,QAAQ,CAAC,CAAC;wBACxB,YAAY,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACT,CAAC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAErC,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/cli/enable-key-auth.d.ts

@@ -0,0 +1 @@
+export {};