b2match-mcp 0.1.0 → 0.1.1

package/README.md

@@ -162,10 +162,11 @@ rm -rf ~/.config/b2match-mcp/browser-profile
 
 ### Storage locations
 
-- macOS: login Keychain via `/usr/bin/security` (`b2match-mcp` service, `default` account).
+- macOS: login Keychain via `/usr/bin/security` (`b2match-mcp` service, `default` account). After each save the CLI reads the item back; if the secret is missing or wrong it falls back to the private file and prints `keychain read-back failed, stored in file`.
 - Linux: `secret-tool` / libsecret when installed and unlocked.
 - Windows: private fallback file.
 - Fallback file: `$B2MATCH_MCP_CONFIG_DIR/auth.json`, `$XDG_CONFIG_HOME/b2match-mcp/auth.json`, or `~/.config/b2match-mcp/auth.json`, written with `0600` permissions.
+- `b2match-mcp status` reports `source: "keychain-unreadable"` (with a re-login hint) when a Keychain item exists but is empty or unreadable, instead of pretending you are logged out with `source: "none"`.
 - Dedicated browser profile: `~/.config/b2match-mcp/browser-profile` (same config directory).
 
 If a token is a JWT, the CLI records its `exp` claim as `expiresAt`. B2match also has opaque tokens, in which case lifetime cannot be known locally. A 401 on an authenticated viewer check is reported as invalid/expired and remembered for the process. Public tools then continue anonymously without deleting the stored token.
@@ -176,6 +177,7 @@ If a token is a JWT, the CLI records its `exp` claim as `expiresAt`. B2match als
 - **Google blocks the window:** finish sign-in in the dedicated window if possible; otherwise use `--paste`.
 - **Timeout / 404 after Google:** the CLI also reads a JWT from the event tab URL if Chrome 404s before a cookie is set. Finish sign-in and wait; or use `--paste`.
 - **Keychain prompt denied:** run `b2match-mcp logout`, then `login` again and approve the prompt; or set `B2MATCH_MCP_DISABLE_KEYCHAIN=1` to use the private file fallback.
+- **`status` shows `keychain-unreadable`:** the Keychain item is empty or corrupt and no usable `auth.json` was found. Run `b2match-mcp logout` then `login` again. If a file token still works, `status` uses `source: "file"` and sets a `warning` about the Keychain item instead.
 - **Wrong/expired token:** run `b2match-mcp logout`, sign in again, and repeat `login`.
 
 ## Tools
@@ -247,7 +249,7 @@ The smoke test is skipped unless both environment variables are set.
 
 ## Publishing
 
-Releases are cut by Release Please from Conventional Commits on `main`. The same workflow (`.github/workflows/release-please.yml`) publishes with `npm publish --provenance --access public` when a release is created. Provenance requires a public repo. Configure npm trusted publishing against `release-please.yml`. `NPM_TOKEN` is a documented fallback only. `.github/workflows/publish.yml` is a manual republish trigger. After the first 0.1.0 release, remove `"release-as": "0.1.0"` from `release-please-config.json`.
+Releases are cut by Release Please from Conventional Commits on `main`. The same workflow (`.github/workflows/release-please.yml`) publishes with `npm publish --provenance --access public` when a release is created. Provenance requires a public repo. Configure npm trusted publishing against `release-please.yml`. `NPM_TOKEN` is a documented fallback only. `.github/workflows/publish.yml` is a manual republish trigger.
 
 ## Verification status
 

package/dist/auth.d.ts

@@ -7,13 +7,22 @@ export interface StoredAuth {
     obtainedVia: "browser" | "paste" | "env" | "password" | "magic-link";
     savedAt: string;
 }
+export type AuthSource = "env" | "keychain" | "file" | "none" | "keychain-unreadable";
 export interface AuthState {
     loggedIn: boolean;
-    source: "env" | "keychain" | "file" | "none";
+    source: AuthSource;
     expiresAt?: string;
     userId?: string;
     loginEventId?: string;
     obtainedVia?: StoredAuth["obtainedVia"];
+    /** Present when source is keychain-unreadable. Never includes the secret. */
+    error?: string;
+    hint?: string;
+    /**
+     * Set when a usable file token is returned despite a broken keychain item.
+     * Never includes the secret. Surfaced by CLI `status` and MCP `auth_status`.
+     */
+    warning?: string;
 }
 export declare function configDir(): string;
 export declare function authFilePath(dir?: string): string;

package/dist/auth.js

@@ -37,6 +37,7 @@ export function isExpired(expiresAt, skewMs = 60_000) {
     }
     return new Date(expiresAt).getTime() <= Date.now() + skewMs;
 }
+const KEYCHAIN_REREAD_HINT = "Re-run `b2match-mcp login` (or `login --paste`). If it keeps failing, set B2MATCH_MCP_DISABLE_KEYCHAIN=1 and try again.";
 export class AuthStore {
     dir;
     backend;
@@ -60,13 +61,23 @@ export class AuthStore {
         if (this.backend) {
             try {
                 const password = await this.backend.get();
-                if (password) {
-                    return { record: JSON.parse(password), source: "keychain" };
+                if (password === null) {
+                    // Not found — fall through to the file.
+                }
+                else if (!password.trim()) {
+                    // Empty keychain item: try file fallback for callers that need a token.
+                }
+                else {
+                    try {
+                        return { record: JSON.parse(password), source: "keychain" };
+                    }
+                    catch {
+                        // Unparseable keychain payload — try file fallback.
+                    }
                 }
             }
             catch {
-                // Fall back to the local 0600 file when the OS keychain is unavailable,
-                // locked, or denied by the user.
+                // Keychain unavailable/locked/denied — try file fallback.
             }
         }
         try {
@@ -87,8 +98,19 @@ export class AuthStore {
         if (this.backend) {
             try {
                 await this.backend.set(serialized);
-                await rm(authFilePath(this.dir), { force: true });
-                return "keychain";
+                const readBack = await this.backend.get();
+                if (readBack !== null && readBack === serialized) {
+                    await rm(authFilePath(this.dir), { force: true });
+                    return "keychain";
+                }
+                // Bad/empty read-back: remove the broken item so status does not stick on keychain-unreadable.
+                try {
+                    await this.backend.delete();
+                }
+                catch {
+                    // Ignore delete failures; still fall back to the file.
+                }
+                console.error("b2match-mcp: keychain read-back failed, stored in file");
             }
             catch {
                 // Continue to file fallback.
@@ -110,18 +132,74 @@ export class AuthStore {
         await rm(authFilePath(this.dir), { force: true });
     }
     async status() {
-        const stored = await this.read();
-        if (!stored) {
+        const envToken = process.env.B2MATCH_TOKEN?.trim();
+        if (envToken) {
+            const expiresAt = decodeJwtExpiry(envToken);
+            return {
+                loggedIn: !isExpired(expiresAt),
+                source: "env",
+                expiresAt,
+                obtainedVia: "env"
+            };
+        }
+        let keychainProblem;
+        if (this.backend) {
+            try {
+                const password = await this.backend.get();
+                if (password === null) {
+                    // Not found — check file below.
+                }
+                else if (!password.trim()) {
+                    keychainProblem = { error: "macOS Keychain item exists but the secret is empty" };
+                }
+                else {
+                    try {
+                        const record = JSON.parse(password);
+                        return {
+                            loggedIn: !isExpired(record.expiresAt),
+                            source: "keychain",
+                            expiresAt: record.expiresAt,
+                            userId: record.userId,
+                            loginEventId: record.loginEventId,
+                            obtainedVia: record.obtainedVia
+                        };
+                    }
+                    catch {
+                        keychainProblem = { error: "macOS Keychain secret is not valid JSON metadata" };
+                    }
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                keychainProblem = { error: message };
+            }
+        }
+        try {
+            const text = await readFile(authFilePath(this.dir), "utf8");
+            const record = JSON.parse(text);
+            const state = {
+                loggedIn: !isExpired(record.expiresAt),
+                source: "file",
+                expiresAt: record.expiresAt,
+                userId: record.userId,
+                loginEventId: record.loginEventId,
+                obtainedVia: record.obtainedVia
+            };
+            if (keychainProblem) {
+                state.warning = `${keychainProblem.error}; using file token instead. ${KEYCHAIN_REREAD_HINT}`;
+            }
+            return state;
+        }
+        catch {
+            if (keychainProblem) {
+                return {
+                    loggedIn: false,
+                    source: "keychain-unreadable",
+                    error: keychainProblem.error,
+                    hint: KEYCHAIN_REREAD_HINT
+                };
+            }
             return { loggedIn: false, source: "none" };
         }
-        const { record, source } = stored;
-        return {
-            loggedIn: !isExpired(record.expiresAt),
-            source,
-            expiresAt: record.expiresAt,
-            userId: record.userId,
-            loginEventId: record.loginEventId,
-            obtainedVia: record.obtainedVia
-        };
     }
 }

package/dist/keychain.d.ts

@@ -15,7 +15,8 @@ export interface SecretBackend {
 export declare const runCommand: CommandRunner;
 export declare function macOSSecurityCommands(service?: string, account?: string): {
     get: readonly ["/usr/bin/security", readonly ["find-generic-password", "-s", string, "-a", string, "-w"]];
-    set: readonly ["/usr/bin/security", readonly ["add-generic-password", "-U", "-s", string, "-a", string]];
+    /** Interactive mode: the add-generic-password line (with -X hex) is written on stdin. */
+    set: readonly ["/usr/bin/security", readonly ["-i"]];
     delete: readonly ["/usr/bin/security", readonly ["delete-generic-password", "-s", string, "-a", string]];
 };
 export declare function linuxSecretToolCommands(service?: string, account?: string): {
@@ -23,6 +24,15 @@ export declare function linuxSecretToolCommands(service?: string, account?: stri
     set: readonly ["secret-tool", readonly ["store", "--label", string, "service", string, "account", string]];
     delete: readonly ["secret-tool", readonly ["clear", "service", string, "account", string]];
 };
+/** Hex-encode UTF-8 for `security add-generic-password -X`. */
+export declare function encodeSecretForKeychain(secret: string): string;
+/**
+ * Decode `security find-generic-password -w` output.
+ * When the password is non-printable, security prints hex; otherwise it prints the raw string.
+ * Trim a single trailing newline only.
+ */
+export declare function decodeKeychainPassword(stdout: string): string;
+export declare function formatKeychainCommandError(result: CommandResult, fallback: string): string;
 export declare class MacOSKeychainBackend implements SecretBackend {
     private readonly runner;
     private readonly service;

package/dist/keychain.js

@@ -29,7 +29,8 @@ export const runCommand = (command, args, input) => new Promise((resolve, reject
 export function macOSSecurityCommands(service = KEYCHAIN_SERVICE, account = KEYCHAIN_ACCOUNT) {
     return {
         get: ["/usr/bin/security", ["find-generic-password", "-s", service, "-a", account, "-w"]],
-        set: ["/usr/bin/security", ["add-generic-password", "-U", "-s", service, "-a", account]],
+        /** Interactive mode: the add-generic-password line (with -X hex) is written on stdin. */
+        set: ["/usr/bin/security", ["-i"]],
         delete: ["/usr/bin/security", ["delete-generic-password", "-s", service, "-a", account]]
     };
 }
@@ -40,6 +41,51 @@ export function linuxSecretToolCommands(service = KEYCHAIN_SERVICE, account = KE
         delete: ["secret-tool", ["clear", "service", service, "account", account]]
     };
 }
+/** Hex-encode UTF-8 for `security add-generic-password -X`. */
+export function encodeSecretForKeychain(secret) {
+    return Buffer.from(secret, "utf8").toString("hex");
+}
+/**
+ * Decode `security find-generic-password -w` output.
+ * When the password is non-printable, security prints hex; otherwise it prints the raw string.
+ * Trim a single trailing newline only.
+ */
+export function decodeKeychainPassword(stdout) {
+    const trimmed = stripTrailingNewline(stdout);
+    if (!trimmed) {
+        return "";
+    }
+    if (looksLikeJson(trimmed)) {
+        return trimmed;
+    }
+    if (/^[0-9a-fA-F]+$/.test(trimmed) && trimmed.length % 2 === 0) {
+        try {
+            return Buffer.from(trimmed, "hex").toString("utf8");
+        }
+        catch {
+            return trimmed;
+        }
+    }
+    return trimmed;
+}
+function looksLikeJson(value) {
+    const first = value[0];
+    if (first !== "{" && first !== "[") {
+        return false;
+    }
+    try {
+        JSON.parse(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function formatKeychainCommandError(result, fallback) {
+    const stderr = result.stderr.trim();
+    const detail = stderr ? `stderr=${stderr}` : "stderr=<empty>";
+    return `${fallback} (exit ${result.code ?? "null"}; ${detail})`;
+}
 export class MacOSKeychainBackend {
     runner;
     service;
@@ -53,26 +99,43 @@ export class MacOSKeychainBackend {
     async get() {
         const [command, args] = macOSSecurityCommands(this.service, this.account).get;
         const result = await this.runner(command, [...args]);
-        if (result.code === 44 || /could not be found/i.test(result.stderr)) {
+        if (result.code === 44) {
+            return null;
+        }
+        // Only treat "not found" stderr when the process actually failed.
+        if (result.code !== 0 && /could not be found/i.test(result.stderr)) {
             return null;
         }
         if (result.code !== 0) {
-            throw new Error(cleanCommandError(result.stderr, "macOS Keychain read failed"));
+            throw new Error(formatKeychainCommandError(result, "macOS Keychain read failed"));
         }
-        return stripTrailingNewline(result.stdout);
+        return decodeKeychainPassword(result.stdout);
     }
     async set(secret) {
+        const hex = encodeSecretForKeychain(secret);
+        // service/account are fixed safe tokens (KEYCHAIN_* constants).
+        const script = `add-generic-password -U -s ${this.service} -a ${this.account} -X ${hex}\n`;
         const [command, args] = macOSSecurityCommands(this.service, this.account).set;
-        const result = await this.runner(command, [...args], `${secret}\n`);
+        const result = await this.runner(command, [...args], script);
         if (result.code !== 0) {
-            throw new Error(cleanCommandError(result.stderr, "macOS Keychain write failed"));
+            throw new Error(formatKeychainCommandError(result, "macOS Keychain write failed"));
+        }
+        const stderr = result.stderr.trim();
+        if (stderr && /error|failed|denied|unable/i.test(stderr)) {
+            throw new Error(formatKeychainCommandError(result, "macOS Keychain write failed"));
         }
     }
     async delete() {
         const [command, args] = macOSSecurityCommands(this.service, this.account).delete;
         const result = await this.runner(command, [...args]);
-        if (result.code !== 0 && result.code !== 44 && !/could not be found/i.test(result.stderr)) {
-            throw new Error(cleanCommandError(result.stderr, "macOS Keychain delete failed"));
+        if (result.code === 44) {
+            return;
+        }
+        if (result.code !== 0 && /could not be found/i.test(result.stderr)) {
+            return;
+        }
+        if (result.code !== 0) {
+            throw new Error(formatKeychainCommandError(result, "macOS Keychain delete failed"));
         }
     }
 }
@@ -98,7 +161,7 @@ export class LinuxSecretToolBackend {
         const [command, args] = linuxSecretToolCommands(this.service, this.account).set;
         const result = await this.runner(command, [...args], `${secret}\n`);
         if (result.code !== 0) {
-            throw new Error(cleanCommandError(result.stderr, "secret-tool write failed"));
+            throw new Error(formatKeychainCommandError(result, "secret-tool write failed"));
         }
     }
     async delete() {
@@ -140,7 +203,3 @@ function commandExistsOnPath(command) {
 function stripTrailingNewline(value) {
     return value.replace(/\r?\n$/, "");
 }
-function cleanCommandError(stderr, fallback) {
-    const message = stderr.trim();
-    return message || fallback;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "b2match-mcp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Read-only MCP server for the B2match event and matchmaking platform",
   "type": "module",
   "main": "dist/cli.js",