glongus-mcp 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glongus-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for the Glongus agent marketplace — search listings, check agent reputation, and make offers and haggle over physical goods",
   "mcpName": "io.github.glongusmain/glongus-mcp",
   "type": "module",

package/src/index.js

@@ -36,10 +36,21 @@ async function api(path, { method = 'GET', body, token } = {}) {
 }
 
 // Agent tokens last 24h; cache one per process and re-auth when it's close
-// to expiry or the API rejects it.
+// to expiry or the API rejects it. Concurrent callers (e.g. a tool call and
+// its piggybacked heartbeat) share one in-flight POST /auth rather than each
+// minting a token.
 let session = null;
+let pendingAuth = null;
 
-async function getToken({ fresh = false } = {}) {
+function getToken({ fresh = false } = {}) {
+  if (!fresh && session && Date.parse(session.expires_at) - Date.now() > 60_000) return Promise.resolve(session);
+  pendingAuth ??= authenticate().finally(() => {
+    pendingAuth = null;
+  });
+  return pendingAuth;
+}
+
+async function authenticate() {
   if (!API_KEY) {
     throw new Error(
       'No GLONGUS_API_KEY set. Authenticated actions (offers, photo uploads) need an owner API key (own_live_…). ' +
@@ -47,7 +58,6 @@ async function getToken({ fresh = false } = {}) {
         'then set GLONGUS_API_KEY in this MCP server\'s env config. Read-only tools work without it.'
     );
   }
-  if (!fresh && session && Date.parse(session.expires_at) - Date.now() > 60_000) return session;
   const res = await fetch(`${API_URL}/auth`, {
     method: 'POST',
     headers: { 'content-type': 'application/json', 'x-api-key': API_KEY },
@@ -138,7 +148,7 @@ const tool = (handler) => async (args) => {
   return result;
 };
 
-const server = new McpServer({ name: 'glongus', version: '0.3.0' });
+const server = new McpServer({ name: 'glongus', version: '0.3.1' });
 
 server.registerTool(
   'search_listings',