reflect-mcp 1.0.14 → 1.0.16

package/dist/pkcehandler.d.ts

@@ -28,8 +28,6 @@ export declare class PKCEOAuthProxy {
     private tokens;
     private recentlyExchangedCodes;
     private cleanupInterval;
-    private tokenMutex;
-    private tokenMutexBusy;
     private activeConnections;
     constructor(options: PKCEOAuthProxyConfig);
     private loadTokensFromDisk;

package/dist/pkcehandler.js

@@ -74,10 +74,6 @@ export class PKCEOAuthProxy {
     // Track tokens that have been exchanged but allow brief retry window
     recentlyExchangedCodes = new Map();
     cleanupInterval = null;
-    // In-memory mutex to prevent race conditions during token operations
-    // This ensures only one client can exchange a code at a time
-    tokenMutex = new Map();
-    tokenMutexBusy = false;
     // Active connections counter for debugging
     activeConnections = 0;
     constructor(options) {
@@ -135,7 +131,7 @@ export class PKCEOAuthProxy {
             await globalWriteQueue.add(async () => {
                 await fs.promises.writeFile(this.config.tokenStoragePath, JSON.stringify(toStore, null, 2), "utf-8");
             });
-            console.log(`[PKCEProxy] Saved ${toStore.length} tokens to disk`);
+            console.log(`[PKCEProxy] Saved ${Object.keys(toStore).length} tokens to disk`);
         }
         catch (error) {
             console.error("[PKCEProxy] Failed to save tokens to disk:", error);
@@ -190,7 +186,7 @@ export class PKCEOAuthProxy {
             await globalWriteQueue.add(async () => {
                 await fs.promises.writeFile(this.config.transactionStoragePath, JSON.stringify(toStore, null, 2), "utf-8");
             });
-            console.log(`[PKCEProxy] Saved ${toStore.length} transactions to disk`);
+            console.log(`[PKCEProxy] Saved ${Object.keys(toStore).length} transactions to disk`);
         }
         catch (error) {
             console.error("[PKCEProxy] Failed to save transactions to disk:", error);
@@ -232,6 +228,23 @@ export class PKCEOAuthProxy {
                 headers: { "Content-Type": "application/json" },
             });
         }
+        // If we already have a valid token, skip the full OAuth dance.
+        // Issue a proxy code immediately so subsequent clients never need a browser.
+        const existingToken = this.getFirstValidToken();
+        if (existingToken) {
+            console.log("[PKCEProxy] Valid token exists — issuing proxy code directly (skipping OAuth)");
+            const proxyCode = this.generateId();
+            this.tokens.set(proxyCode, { ...existingToken });
+            await this.saveTokensToDisk();
+            const clientRedirect = new URL(params.redirect_uri);
+            clientRedirect.searchParams.set("code", proxyCode);
+            clientRedirect.searchParams.set("state", params.state || "");
+            console.log("[PKCEProxy] Redirecting client directly to:", clientRedirect.toString());
+            return new Response(null, {
+                status: 302,
+                headers: { Location: clientRedirect.toString() },
+            });
+        }
         // Generate our own PKCE for upstream
         const pkce = this.generatePKCE();
         const transactionId = this.generateId();
@@ -369,83 +382,35 @@ export class PKCEOAuthProxy {
                 };
             }
         }
-        // Acquire mutex for this specific code to prevent race conditions
-        // This ensures only ONE client can exchange a given code at a time
-        let releaseMutex;
-        const acquireMutex = async () => {
-            const codeKey = `code_${params.code}`;
-            while (this.tokenMutex.has(codeKey)) {
-                // Wait for the current exchange to complete
-                await new Promise(resolve => setTimeout(resolve, 10));
-            }
-            // Create a pending promise to indicate we're acquiring the lock
-            const pending = new Promise(resolve => {
-                releaseMutex = resolve;
-                this.tokenMutex.set(codeKey, Promise.resolve());
-            });
-            // Check if we got the lock before another concurrent request took it
-            if (this.tokenMutex.get(codeKey) !== pending) {
-                this.tokenMutex.delete(codeKey);
-                return acquireMutex(); // Try again
-            }
-            await pending;
-        };
-        const releaseMutexForCode = (code) => {
-            const codeKey = `code_${code}`;
-            this.tokenMutex.delete(codeKey);
-        };
-        try {
-            await acquireMutex();
-            // Check again after acquiring mutex - another request might have already processed this code
-            const cachedExchange = this.recentlyExchangedCodes.get(params.code);
-            if (cachedExchange && cachedExchange.expiresAt > new Date()) {
-                const cachedTokenData = this.tokens.get(cachedExchange.accessToken);
-                if (cachedTokenData) {
-                    const expiresIn = Math.floor((cachedTokenData.expiresAt.getTime() - Date.now()) / 1000);
-                    return {
-                        access_token: cachedExchange.accessToken,
-                        token_type: "Bearer",
-                        expires_in: expiresIn > 0 ? expiresIn : 3600,
-                    };
-                }
-            }
-            const tokenData = this.tokens.get(params.code);
-            if (!tokenData) {
-                console.error(`[PKCEProxy] Token not found for code: ${params.code}`);
-                console.error(`[PKCEProxy] Available tokens:`, Array.from(this.tokens.keys()).map(k => k.slice(0, 8) + "..."));
-                console.error(`[PKCEProxy] Recently exchanged codes:`, Array.from(this.recentlyExchangedCodes.keys()).map(k => k.slice(0, 8) + "..."));
-                throw new OAuthProxyError("invalid_grant", "Invalid or expired authorization code", 400);
-            }
-            // Remove the code but keep track of it for retry tolerance (30 second window)
-            // Mark as exchanged BEFORE saving to disk to prevent race conditions
-            this.tokens.delete(params.code);
-            // Generate a new access token for the client
-            const accessToken = this.generateId();
-            this.tokens.set(accessToken, tokenData);
-            // Store the exchange for retry tolerance (30 seconds) - mark as exchanged
-            this.recentlyExchangedCodes.set(params.code, {
-                accessToken,
-                expiresAt: new Date(Date.now() + 30 * 1000),
-            });
-            // Now save to disk - this is the only write operation during the critical section
-            await this.saveTokensToDisk();
-            const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
-            console.log(`[PKCEProxy] Issued access token (expires in ${expiresIn}s) for code: ${params.code.slice(0, 8)}...`);
-            return {
-                access_token: accessToken,
-                token_type: "Bearer",
-                expires_in: expiresIn > 0 ? expiresIn : 3600,
-                // Note: Not returning refresh_token since Reflect doesn't support refresh_token grant
-                // This tells the MCP client to re-authenticate via OAuth when the token expires
-            };
-        }
-        catch (error) {
-            throw error;
-        }
-        finally {
-            // Release the mutex
-            releaseMutexForCode(params.code);
+        const tokenData = this.tokens.get(params.code);
+        if (!tokenData) {
+            console.error(`[PKCEProxy] Token not found for code: ${params.code}`);
+            console.error(`[PKCEProxy] Available tokens:`, Array.from(this.tokens.keys()).map(k => k.slice(0, 8) + "..."));
+            console.error(`[PKCEProxy] Recently exchanged codes:`, Array.from(this.recentlyExchangedCodes.keys()).map(k => k.slice(0, 8) + "..."));
+            throw new OAuthProxyError("invalid_grant", "Invalid or expired authorization code", 400);
         }
+        // Remove the code but keep track of it for retry tolerance (30 second window)
+        // Mark as exchanged BEFORE saving to disk to prevent race conditions
+        this.tokens.delete(params.code);
+        // Generate a new access token for the client
+        const accessToken = this.generateId();
+        this.tokens.set(accessToken, tokenData);
+        // Store the exchange for retry tolerance (30 seconds) - mark as exchanged
+        this.recentlyExchangedCodes.set(params.code, {
+            accessToken,
+            expiresAt: new Date(Date.now() + 30 * 1000),
+        });
+        // Now save to disk
+        await this.saveTokensToDisk();
+        const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
+        console.log(`[PKCEProxy] Issued access token (expires in ${expiresIn}s) for code: ${params.code.slice(0, 8)}...`);
+        return {
+            access_token: accessToken,
+            token_type: "Bearer",
+            expires_in: expiresIn > 0 ? expiresIn : 3600,
+            // Note: Not returning refresh_token since Reflect doesn't support refresh_token grant
+            // This tells the MCP client to re-authenticate via OAuth when the token expires
+        };
     }
     // Handle refresh token exchange
     // Note: Reflect's API doesn't support standard refresh_token grant
@@ -471,6 +436,14 @@ export class PKCEOAuthProxy {
     async loadUpstreamTokens(proxyToken) {
         const data = this.tokens.get(proxyToken);
         if (!data) {
+            // Token not found — check if this is a stale/rotated token from a previous session.
+            // For a local server, all clients share the same Reflect credentials, so we can
+            // fall back to any currently-valid token rather than forcing a re-auth loop.
+            const validToken = this.getFirstValidToken();
+            if (validToken) {
+                console.warn("[PKCEProxy] Stale token presented, mapping to current valid token:", proxyToken.slice(0, 8) + "...");
+                return validToken;
+            }
             console.warn("[PKCEProxy] Token not found:", proxyToken.slice(0, 8) + "...");
             console.warn("[PKCEProxy] Total tokens in store:", this.tokens.size);
             return null;

package/dist/server.js

@@ -84,6 +84,7 @@ export async function startReflectMCPServer(config) {
     await server.start({
         httpStream: {
             port,
+            stateless: true,
         },
         transportType: "httpStream",
     });

package/dist/utils.js

@@ -32,31 +32,35 @@ export function findLocalDatabase() {
     }
     // Search for database files in the File System directory
     // Structure is typically: File System/XXX/t/XX/XXXXXXXX
+    // Reflect may have multiple database partitions (000, 001, etc.)
+    // so we find all SQLite files and return the most recently modified one.
     try {
         const entries = fs.readdirSync(basePath);
+        let bestPath = null;
+        let bestMtime = 0;
         for (const entry of entries) {
             const entryPath = path.join(basePath, entry);
             const tPath = path.join(entryPath, "t");
             if (fs.existsSync(tPath) && fs.statSync(tPath).isDirectory()) {
-                // Look for subdirectories in t/
                 const tEntries = fs.readdirSync(tPath);
                 for (const tEntry of tEntries) {
                     const subPath = path.join(tPath, tEntry);
                     if (fs.statSync(subPath).isDirectory()) {
-                        // Look for database files (8-char hex names)
                         const dbFiles = fs.readdirSync(subPath);
                         for (const dbFile of dbFiles) {
                             const dbPath = path.join(subPath, dbFile);
-                            // Check if it's a valid SQLite database (starts with SQLite header)
                             if (fs.statSync(dbPath).isFile()) {
                                 try {
                                     const header = Buffer.alloc(16);
                                     const fd = fs.openSync(dbPath, 'r');
                                     fs.readSync(fd, header, 0, 16, 0);
                                     fs.closeSync(fd);
-                                    // SQLite files start with "SQLite format 3"
                                     if (header.toString('utf8', 0, 15) === 'SQLite format 3') {
-                                        return dbPath;
+                                        const mtime = fs.statSync(dbPath).mtimeMs;
+                                        if (mtime > bestMtime) {
+                                            bestMtime = mtime;
+                                            bestPath = dbPath;
+                                        }
                                     }
                                 }
                                 catch {
@@ -68,11 +72,11 @@ export function findLocalDatabase() {
                 }
             }
         }
+        return bestPath;
     }
     catch {
         return null;
     }
-    return null;
 }
 /**
  * Gets the default database path, searching for it if not provided.
@@ -84,7 +88,7 @@ export function getDefaultDbPath() {
         return found;
     }
     if (os.platform() === "darwin") {
-        return expandPath("~/Library/Application Support/Reflect/File System/000/t/00/00000000");
+        return expandPath("~/Library/Application Support/Reflect/File System/001/t/00/00000000");
     }
     return "";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reflect-mcp",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "MCP server for Reflect Notes - connect your notes to Claude Desktop. Just run: npx reflect-mcp",
   "type": "module",
   "main": "dist/server.js",
@@ -39,7 +39,7 @@
     "@modelcontextprotocol/sdk": "^1.25.1",
     "better-sqlite3": "^11.10.0",
     "fastmcp": "^3.25.4",
-    "reflect-mcp": "^1.0.12",
+    "reflect-mcp": "^1.0.15",
     "zod": "^4.1.13"
   },
   "devDependencies": {