powerautomate-mcp 0.7.4 → 0.7.5

package/README.md

@@ -20,13 +20,16 @@ An MCP (Model Context Protocol) server that connects Claude to Microsoft Power A
 - Microsoft 365 work account with Power Automate access
 - **Linux only**: libsecret for secure token storage
   ```bash
-  # Ubuntu/Debian
-  sudo apt-get install libsecret-1-dev gnome-keyring
+  # Ubuntu/Debian runtime
+  sudo apt-get install libsecret-1-0 gnome-keyring
 
-  # Fedora/RHEL
-  sudo dnf install libsecret-devel gnome-keyring
+  # Fedora/RHEL runtime
+  sudo dnf install libsecret gnome-keyring
   ```
 
+  If setup fails with `libsecret-1.so.0: cannot open shared object file`, the
+  runtime package above is missing.
+
 ### Installation
 
 ```bash
@@ -215,7 +218,7 @@ npm run build
 
 This server implements defense-in-depth security:
 
-- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret (Linux) — no plaintext fallback
+- **Secure Token Storage**: DPAPI (Windows), Keychain (macOS), libsecret on Linux when available, with a 0o600 file-cache fallback when it is not
 - **Input Validation**: GUID validation on all IDs, OData injection protection (ASCII-only), path traversal blocking (including URL-encoded), SharePoint hostname allowlist
 - **SSRF Prevention**: Domain allowlists on Dataverse URLs, resource links, and token resources
 - **Injection Prevention**: Power Automate expression injection blocking (`@{`/`}@`), OData filter sanitization, command injection prevention (`execFile` over `exec`)

package/dist/index.js

@@ -13,7 +13,6 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { ListToolsRequestSchema, CallToolRequestSchema, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { PublicClientApplication, LogLevel } from '@azure/msal-node';
 import { execFile } from 'child_process';
-import { PersistenceCreator, DataProtectionScope, PersistenceCachePlugin } from '@azure/msal-node-extensions';
 import { request } from 'undici';
 import Database from 'better-sqlite3';
 import { fileURLToPath } from 'url';
@@ -725,6 +724,23 @@ function validateEnvironmentId(envId) {
   }
   return envId;
 }
+var msalNodeExtensionsPromise = null;
+async function loadMsalNodeExtensions() {
+  if (!msalNodeExtensionsPromise) {
+    msalNodeExtensionsPromise = import('@azure/msal-node-extensions').then((mod) => {
+      const moduleWithOptionalDefault = mod;
+      const resolved = moduleWithOptionalDefault.default ?? moduleWithOptionalDefault;
+      if (!resolved || !("PersistenceCreator" in resolved)) {
+        throw new Error("msal-node-extensions did not expose the expected exports");
+      }
+      return resolved;
+    });
+  }
+  return msalNodeExtensionsPromise;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
 var NativeFileCachePlugin = class {
   cachePath;
   constructor(cachePath) {
@@ -765,6 +781,11 @@ async function createPersistentCachePlugin(cachePath) {
   logger.debug({ cacheLocation, platform: platform }, "Creating persistent token cache");
   if (platform === "win32" || platform === "darwin") {
     try {
+      const {
+        DataProtectionScope,
+        PersistenceCreator,
+        PersistenceCachePlugin
+      } = await loadMsalNodeExtensions();
       const persistence = await PersistenceCreator.createPersistence({
         cachePath: cacheLocation,
         dataProtectionScope: platform === "win32" ? DataProtectionScope.CurrentUser : void 0,
@@ -777,11 +798,15 @@ async function createPersistentCachePlugin(cachePath) {
     } catch (err) {
       logger.error({ err, cacheLocation }, "Failed to create persistent cache");
       throw new Error(
-        `Failed to initialize token cache at ${cacheLocation}: ${err instanceof Error ? err.message : String(err)}`
+        `Failed to initialize token cache at ${cacheLocation}: ${formatError(err)}`
       );
     }
   }
   try {
+    const {
+      PersistenceCreator,
+      PersistenceCachePlugin
+    } = await loadMsalNodeExtensions();
     const persistence = await PersistenceCreator.createPersistence({
       cachePath: cacheLocation,
       serviceName: "powerautomate-mcp",
@@ -793,7 +818,7 @@ async function createPersistentCachePlugin(cachePath) {
     return new PersistenceCachePlugin(persistence);
   } catch (libsecretError) {
     logger.warn(
-      { err: libsecretError instanceof Error ? libsecretError.message : String(libsecretError) },
+      { err: formatError(libsecretError) },
       "libsecret unavailable \u2014 using native file cache fallback (0o600 permissions)"
     );
     logger.info({ cacheLocation }, "Persistent token cache initialized (native file)");
@@ -15134,6 +15159,7 @@ var c = {
 var icons = {
   check: `${c.green}\u2713${c.reset}`,
   cross: `${c.red}\u2717${c.reset}`,
+  info: `${c.blue}i${c.reset}`,
   arrow: `${c.cyan}\u2192${c.reset}`,
   bullet: `${c.dim}\u2022${c.reset}`,
   star: `${c.yellow}\u2605${c.reset}`