reflect-mcp 1.0.15 → 1.0.17

package/dist/pkcehandler.d.ts

@@ -28,6 +28,7 @@ export declare class PKCEOAuthProxy {
     private tokens;
     private recentlyExchangedCodes;
     private cleanupInterval;
+    private pendingAuthTransaction;
     private activeConnections;
     constructor(options: PKCEOAuthProxyConfig);
     private loadTokensFromDisk;
@@ -66,7 +67,6 @@ export declare class PKCEOAuthProxy {
     }): Promise<{
         access_token: string;
         token_type: string;
-        expires_in: number;
         refresh_token?: string;
         scope?: string;
     }>;
@@ -78,7 +78,6 @@ export declare class PKCEOAuthProxy {
     }): Promise<{
         access_token: string;
         token_type: string;
-        expires_in: number;
         refresh_token?: string;
     }>;
     registerClient(request: {
@@ -89,6 +88,8 @@ export declare class PKCEOAuthProxy {
         client_name?: string;
         redirect_uris?: string[];
     }>;
+    private validateUpstreamToken;
+    invalidateUpstreamToken(accessToken: string): Promise<void>;
     loadUpstreamTokens(proxyToken: string): Promise<TokenData | null>;
     getFirstValidToken(): TokenData | null;
     private startCleanup;

package/dist/pkcehandler.js

@@ -74,6 +74,8 @@ export class PKCEOAuthProxy {
     // Track tokens that have been exchanged but allow brief retry window
     recentlyExchangedCodes = new Map();
     cleanupInterval = null;
+    // Debounce: track pending auth so concurrent requests don't each open a browser
+    pendingAuthTransaction = null;
     // Active connections counter for debugging
     activeConnections = 0;
     constructor(options) {
@@ -98,15 +100,11 @@ export class PKCEOAuthProxy {
                 const data = fs.readFileSync(this.config.tokenStoragePath, "utf-8");
                 const stored = JSON.parse(data);
                 for (const [key, value] of Object.entries(stored)) {
-                    const expiresAt = new Date(value.expiresAt);
-                    // Only load non-expired tokens
-                    if (expiresAt > new Date()) {
-                        this.tokens.set(key, {
-                            accessToken: value.accessToken,
-                            refreshToken: value.refreshToken,
-                            expiresAt,
-                        });
-                    }
+                    this.tokens.set(key, {
+                        accessToken: value.accessToken,
+                        refreshToken: value.refreshToken,
+                        expiresAt: new Date(value.expiresAt),
+                    });
                 }
                 console.log(`[PKCEProxy] Loaded ${this.tokens.size} tokens from disk`);
             }
@@ -245,6 +243,15 @@ export class PKCEOAuthProxy {
                 headers: { Location: clientRedirect.toString() },
             });
         }
+        // Debounce: if another request already started auth, reuse its redirect
+        // instead of opening yet another browser tab
+        if (this.pendingAuthTransaction && this.pendingAuthTransaction.expiresAt > new Date()) {
+            console.log("[PKCEProxy] Auth already in progress — reusing pending transaction:", this.pendingAuthTransaction.transactionId.slice(0, 8) + "...");
+            return new Response(null, {
+                status: 302,
+                headers: { Location: this.pendingAuthTransaction.authUrl },
+            });
+        }
         // Generate our own PKCE for upstream
         const pkce = this.generatePKCE();
         const transactionId = this.generateId();
@@ -271,6 +278,12 @@ export class PKCEOAuthProxy {
         authUrl.searchParams.set("state", transactionId); // Use transaction ID as state
         authUrl.searchParams.set("code_challenge", pkce.challenge);
         authUrl.searchParams.set("code_challenge_method", "S256");
+        // Store as pending so concurrent requests reuse this instead of opening more browsers
+        this.pendingAuthTransaction = {
+            transactionId,
+            authUrl: authUrl.toString(),
+            expiresAt: new Date(Date.now() + 60 * 1000), // 60 second debounce window
+        };
         console.log("[PKCEProxy] Redirecting to:", authUrl.toString());
         return new Response(null, {
             status: 302,
@@ -338,21 +351,22 @@ export class PKCEOAuthProxy {
             });
         }
         const tokens = await tokenResponse.json();
-        console.log("[PKCEProxy] Got tokens, expires_in:", tokens.expires_in);
+        console.log("[PKCEProxy] Reflect token response:", JSON.stringify(tokens, null, 2));
         // Generate a proxy token to give to the client
         const proxyToken = this.generateId();
         this.tokens.set(proxyToken, {
             accessToken: tokens.access_token,
             refreshToken: tokens.refresh_token,
-            expiresAt: new Date(Date.now() + (tokens.expires_in || 3600) * 1000),
+            expiresAt: new Date(Date.now() + (tokens.expires_in || 365 * 24 * 3600) * 1000),
         });
         await this.saveTokensToDisk(); // Persist to disk (async now)
         // Redirect back to client with our proxy token
         const clientRedirect = new URL(transaction.clientCallbackUrl);
         clientRedirect.searchParams.set("code", proxyToken);
         clientRedirect.searchParams.set("state", transaction.clientState);
-        // Clean up transaction
+        // Clean up transaction and pending auth debounce
         this.transactions.delete(state);
+        this.pendingAuthTransaction = null;
         await this.saveTransactionsToDisk();
         console.log("[PKCEProxy] Redirecting to client:", clientRedirect.toString());
         return new Response(null, {
@@ -378,7 +392,6 @@ export class PKCEOAuthProxy {
                 return {
                     access_token: recentExchange.accessToken,
                     token_type: "Bearer",
-                    expires_in: expiresIn > 0 ? expiresIn : 3600,
                 };
             }
         }
@@ -402,25 +415,53 @@ export class PKCEOAuthProxy {
         });
         // Now save to disk
         await this.saveTokensToDisk();
-        const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
-        console.log(`[PKCEProxy] Issued access token (expires in ${expiresIn}s) for code: ${params.code.slice(0, 8)}...`);
+        console.log(`[PKCEProxy] Issued access token for code: ${params.code.slice(0, 8)}...`);
+        const refreshToken = `refresh_${this.generateId()}`;
+        this.tokens.set(refreshToken, { ...tokenData });
+        await this.saveTokensToDisk();
         return {
             access_token: accessToken,
             token_type: "Bearer",
-            expires_in: expiresIn > 0 ? expiresIn : 3600,
-            // Note: Not returning refresh_token since Reflect doesn't support refresh_token grant
-            // This tells the MCP client to re-authenticate via OAuth when the token expires
+            refresh_token: refreshToken,
         };
     }
-    // Handle refresh token exchange
-    // Note: Reflect's API doesn't support standard refresh_token grant
-    // We throw an OAuthProxyError to trigger re-authentication via OAuth flow
     async exchangeRefreshToken(params) {
-        console.log("[PKCEProxy] exchangeRefreshToken called - Reflect doesn't support refresh_token grant");
-        console.log("[PKCEProxy] Triggering re-authentication via OAuth flow...");
-        // Reflect's token endpoint only accepts authorization_code grant, not refresh_token
-        // Throw OAuthProxyError so FastMCP handles it properly and triggers re-auth
-        throw new OAuthProxyError("invalid_grant", "Refresh tokens are not supported. Please re-authenticate.", 400);
+        console.log(`[PKCEProxy] exchangeRefreshToken called with: ${params.refresh_token.slice(0, 12)}...`);
+        const tokenData = this.tokens.get(params.refresh_token);
+        if (tokenData) {
+            const newAccessToken = this.generateId();
+            this.tokens.set(newAccessToken, { ...tokenData });
+            const newRefreshToken = `refresh_${this.generateId()}`;
+            this.tokens.set(newRefreshToken, { ...tokenData });
+            this.tokens.delete(params.refresh_token);
+            await this.saveTokensToDisk();
+            console.log(`[PKCEProxy] Refreshed silently`);
+            return {
+                access_token: newAccessToken,
+                token_type: "Bearer",
+                refresh_token: newRefreshToken,
+            };
+        }
+        // Refresh token not found — fall back to any available token
+        const validToken = this.getFirstValidToken();
+        if (validToken) {
+            console.log("[PKCEProxy] Refresh token not found, using fallback token");
+            const newAccessToken = this.generateId();
+            this.tokens.set(newAccessToken, { ...validToken });
+            const newRefreshToken = `refresh_${this.generateId()}`;
+            this.tokens.set(newRefreshToken, { ...validToken });
+            this.tokens.delete(params.refresh_token);
+            await this.saveTokensToDisk();
+            console.log(`[PKCEProxy] Issued token from fallback`);
+            return {
+                access_token: newAccessToken,
+                token_type: "Bearer",
+                refresh_token: newRefreshToken,
+            };
+        }
+        // No tokens at all — force browser re-auth
+        console.log("[PKCEProxy] No tokens available — forcing re-authentication");
+        throw new OAuthProxyError("invalid_grant", "All tokens expired. Please re-authenticate.", 400);
     }
     // Handle /oauth/register (Dynamic Client Registration)
     async registerClient(request) {
@@ -432,13 +473,40 @@ export class PKCEOAuthProxy {
             redirect_uris: request.redirect_uris,
         };
     }
+    // Validate an upstream Reflect token by calling the API
+    async validateUpstreamToken(tokenData) {
+        try {
+            const response = await fetch("https://reflect.app/api/users/me", {
+                headers: { Authorization: `Bearer ${tokenData.accessToken}` },
+            });
+            if (response.ok)
+                return true;
+            console.warn("[PKCEProxy] Upstream token rejected by Reflect API:", response.status);
+            return false;
+        }
+        catch (error) {
+            // Network error — don't invalidate, assume token is still good
+            console.warn("[PKCEProxy] Network error validating token, keeping it:", error);
+            return true;
+        }
+    }
+    // Invalidate all tokens that share a given upstream access token
+    async invalidateUpstreamToken(accessToken) {
+        let changed = false;
+        for (const [id, token] of this.tokens) {
+            if (token.accessToken === accessToken) {
+                console.log("[PKCEProxy] Invalidating token with revoked upstream:", id.slice(0, 8) + "...");
+                this.tokens.delete(id);
+                changed = true;
+            }
+        }
+        if (changed)
+            await this.saveTokensToDisk();
+    }
     // Load upstream tokens for a given proxy token
     async loadUpstreamTokens(proxyToken) {
         const data = this.tokens.get(proxyToken);
         if (!data) {
-            // Token not found — check if this is a stale/rotated token from a previous session.
-            // For a local server, all clients share the same Reflect credentials, so we can
-            // fall back to any currently-valid token rather than forcing a re-auth loop.
             const validToken = this.getFirstValidToken();
             if (validToken) {
                 console.warn("[PKCEProxy] Stale token presented, mapping to current valid token:", proxyToken.slice(0, 8) + "...");
@@ -448,26 +516,12 @@ export class PKCEOAuthProxy {
             console.warn("[PKCEProxy] Total tokens in store:", this.tokens.size);
             return null;
         }
-        const now = new Date();
-        if (data.expiresAt < now) {
-            console.warn("[PKCEProxy] Token expired:", proxyToken.slice(0, 8) + "...", "expired at:", data.expiresAt, "now:", now);
-            this.tokens.delete(proxyToken);
-            await this.saveTokensToDisk();
-            return null;
-        }
-        const timeRemaining = Math.floor((data.expiresAt.getTime() - now.getTime()) / 1000);
-        if (timeRemaining < 300) { // Less than 5 minutes remaining
-            console.warn("[PKCEProxy] Token expiring soon:", proxyToken.slice(0, 8) + "...", "remaining:", timeRemaining, "seconds");
-        }
         return data;
     }
-    // Get first valid token (for stdio mode where we don't have specific token ID)
+    // Get first available token (any token in the store)
     getFirstValidToken() {
-        const now = new Date();
         for (const [id, token] of this.tokens) {
-            if (token.expiresAt > now) {
-                return token;
-            }
+            return token;
         }
         return null;
     }
@@ -475,7 +529,6 @@ export class PKCEOAuthProxy {
     async startCleanup() {
         const cleanup = async () => {
             const now = new Date();
-            let tokensChanged = false;
             let transactionsChanged = false;
             for (const [id, tx] of this.transactions) {
                 if (tx.expiresAt < now) {
@@ -483,22 +536,11 @@ export class PKCEOAuthProxy {
                     transactionsChanged = true;
                 }
             }
-            for (const [id, token] of this.tokens) {
-                if (token.expiresAt < now) {
-                    console.log("[PKCEProxy] Cleaning up expired token:", id.slice(0, 8) + "...");
-                    this.tokens.delete(id);
-                    tokensChanged = true;
-                }
-            }
-            // Clean up expired retry cache entries
             for (const [code, data] of this.recentlyExchangedCodes) {
                 if (data.expiresAt < now) {
                     this.recentlyExchangedCodes.delete(code);
                 }
             }
-            if (tokensChanged) {
-                await this.saveTokensToDisk();
-            }
             if (transactionsChanged) {
                 await this.saveTransactionsToDisk();
             }

package/dist/server.js

@@ -56,12 +56,10 @@ export async function startReflectMCPServer(config) {
                         statusText: "Unauthorized - Invalid or expired token",
                     });
                 }
-                const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
-                console.log("[Auth] Token validated, expires in:", expiresIn, "seconds");
+                console.log("[Auth] Token validated");
                 return {
                     accessToken: tokenData.accessToken,
                     refreshToken: tokenData.refreshToken,
-                    expiresIn,
                 };
             }
             catch (error) {
@@ -78,12 +76,13 @@ export async function startReflectMCPServer(config) {
         },
         version: "1.0.0",
     });
-    // Register all tools
-    registerTools(server, config.dbPath);
+    // Register all tools (pass proxy so tools can invalidate tokens on upstream 401)
+    registerTools(server, config.dbPath, pkceProxy);
     // Start server
     await server.start({
         httpStream: {
             port,
+            stateless: false,
         },
         transportType: "httpStream",
     });
@@ -113,11 +112,9 @@ export async function startReflectMCPServerStdio(config) {
                 console.error("[Auth] No valid token on disk. Connect via HTTP mode first to complete OAuth.");
                 throw new Error("No valid token. Please authenticate via HTTP mode first.");
             }
-            const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
-            console.error("[Auth] Stdio mode: token loaded from disk, expires in:", expiresIn, "seconds");
+            console.error("[Auth] Stdio mode: token loaded from disk");
             return {
                 accessToken: tokenData.accessToken,
-                expiresIn,
             };
         },
         version: "1.0.0",

package/dist/tools/index.d.ts

@@ -4,4 +4,5 @@
  * All tools for interacting with Reflect notes
  */
 import { FastMCP } from "fastmcp";
-export declare function registerTools(server: FastMCP, dbPath?: string): void;
+import type { PKCEOAuthProxy } from "../pkcehandler.js";
+export declare function registerTools(server: FastMCP, dbPath?: string, pkceProxy?: PKCEOAuthProxy): void;

package/dist/tools/index.js

@@ -6,7 +6,7 @@
 import { z } from "zod";
 import Database from "better-sqlite3";
 import { DEFAULT_DB_PATH, expandPath, stripHtml, formatDate, getDateForTimezone } from "../utils.js";
-export function registerTools(server, dbPath) {
+export function registerTools(server, dbPath, pkceProxy) {
     const resolvedDbPath = expandPath(dbPath || DEFAULT_DB_PATH);
     // Tool: Get all Reflect graphs
     server.addTool({
@@ -32,6 +32,9 @@ export function registerTools(server, dbPath) {
                     },
                 });
                 if (!response.ok) {
+                    if (response.status === 401 && pkceProxy) {
+                        await pkceProxy.invalidateUpstreamToken(accessToken);
+                    }
                     throw new Error(`HTTP error! status: ${response.status}`);
                 }
                 const data = await response.json();
@@ -672,6 +675,9 @@ export function registerTools(server, dbPath) {
                     }),
                 });
                 if (!response.ok) {
+                    if (response.status === 401 && pkceProxy) {
+                        await pkceProxy.invalidateUpstreamToken(accessToken);
+                    }
                     const errorText = await response.text();
                     throw new Error(`HTTP error! status: ${response.status}, body: ${errorText}`);
                 }
@@ -690,6 +696,9 @@ export function registerTools(server, dbPath) {
                     }),
                 });
                 if (!dailyNoteResponse.ok) {
+                    if (dailyNoteResponse.status === 401 && pkceProxy) {
+                        await pkceProxy.invalidateUpstreamToken(accessToken);
+                    }
                     const errorText = await dailyNoteResponse.text();
                     console.error(`Failed to append to daily notes: ${dailyNoteResponse.status}, ${errorText}`);
                 }

package/dist/utils.js

@@ -32,31 +32,35 @@ export function findLocalDatabase() {
     }
     // Search for database files in the File System directory
     // Structure is typically: File System/XXX/t/XX/XXXXXXXX
+    // Reflect may have multiple database partitions (000, 001, etc.)
+    // so we find all SQLite files and return the most recently modified one.
     try {
         const entries = fs.readdirSync(basePath);
+        let bestPath = null;
+        let bestMtime = 0;
         for (const entry of entries) {
             const entryPath = path.join(basePath, entry);
             const tPath = path.join(entryPath, "t");
             if (fs.existsSync(tPath) && fs.statSync(tPath).isDirectory()) {
-                // Look for subdirectories in t/
                 const tEntries = fs.readdirSync(tPath);
                 for (const tEntry of tEntries) {
                     const subPath = path.join(tPath, tEntry);
                     if (fs.statSync(subPath).isDirectory()) {
-                        // Look for database files (8-char hex names)
                         const dbFiles = fs.readdirSync(subPath);
                         for (const dbFile of dbFiles) {
                             const dbPath = path.join(subPath, dbFile);
-                            // Check if it's a valid SQLite database (starts with SQLite header)
                             if (fs.statSync(dbPath).isFile()) {
                                 try {
                                     const header = Buffer.alloc(16);
                                     const fd = fs.openSync(dbPath, 'r');
                                     fs.readSync(fd, header, 0, 16, 0);
                                     fs.closeSync(fd);
-                                    // SQLite files start with "SQLite format 3"
                                     if (header.toString('utf8', 0, 15) === 'SQLite format 3') {
-                                        return dbPath;
+                                        const mtime = fs.statSync(dbPath).mtimeMs;
+                                        if (mtime > bestMtime) {
+                                            bestMtime = mtime;
+                                            bestPath = dbPath;
+                                        }
                                     }
                                 }
                                 catch {
@@ -68,11 +72,11 @@ export function findLocalDatabase() {
                 }
             }
         }
+        return bestPath;
     }
     catch {
         return null;
     }
-    return null;
 }
 /**
  * Gets the default database path, searching for it if not provided.
@@ -84,7 +88,7 @@ export function getDefaultDbPath() {
         return found;
     }
     if (os.platform() === "darwin") {
-        return expandPath("~/Library/Application Support/Reflect/File System/000/t/00/00000000");
+        return expandPath("~/Library/Application Support/Reflect/File System/001/t/00/00000000");
     }
     return "";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reflect-mcp",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "MCP server for Reflect Notes - connect your notes to Claude Desktop. Just run: npx reflect-mcp",
   "type": "module",
   "main": "dist/server.js",
@@ -39,7 +39,7 @@
     "@modelcontextprotocol/sdk": "^1.25.1",
     "better-sqlite3": "^11.10.0",
     "fastmcp": "^3.25.4",
-    "reflect-mcp": "^1.0.12",
+    "reflect-mcp": "^1.0.16",
     "zod": "^4.1.13"
   },
   "devDependencies": {