reflect-mcp 1.0.6 → 1.0.7

package/dist/pkcehandler.d.ts

@@ -17,15 +17,19 @@ export interface PKCEOAuthProxyConfig {
     scopes: string[];
     redirectPath?: string;
     tokenStoragePath?: string;
+    transactionStoragePath?: string;
 }
 export declare class PKCEOAuthProxy {
     private config;
     private transactions;
     private tokens;
+    private recentlyExchangedCodes;
     private cleanupInterval;
     constructor(options: PKCEOAuthProxyConfig);
     private loadTokensFromDisk;
     private saveTokensToDisk;
+    private loadTransactionsFromDisk;
+    private saveTransactionsToDisk;
     private generatePKCE;
     private generateId;
     getAuthorizationServerMetadata(): {

package/dist/pkcehandler.js

@@ -14,10 +14,12 @@ import { OAuthProxyError } from "fastmcp/auth";
 // ============================================================================
 export class PKCEOAuthProxy {
     config;
-    // In-memory storage for transactions (short-lived, don't need persistence)
+    // Transaction storage - now persisted to disk to survive restarts
     transactions = new Map();
     // Token storage - persisted to disk
     tokens = new Map();
+    // Track tokens that have been exchanged but allow brief retry window
+    recentlyExchangedCodes = new Map();
     cleanupInterval = null;
     constructor(options) {
         this.config = {
@@ -28,8 +30,10 @@ export class PKCEOAuthProxy {
             redirectPath: options.redirectPath || "/oauth/callback",
             scopes: options.scopes,
             tokenStoragePath: options.tokenStoragePath || path.join(os.homedir(), ".reflect-mcp-tokens.json"),
+            transactionStoragePath: options.transactionStoragePath || path.join(os.homedir(), ".reflect-mcp-transactions.json"),
         };
         this.loadTokensFromDisk();
+        this.loadTransactionsFromDisk();
         this.startCleanup();
     }
     // Load tokens from disk on startup
@@ -73,6 +77,57 @@ export class PKCEOAuthProxy {
             console.error("[PKCEProxy] Failed to save tokens to disk:", error);
         }
     }
+    // Load transactions from disk on startup (survives server restarts)
+    loadTransactionsFromDisk() {
+        try {
+            if (fs.existsSync(this.config.transactionStoragePath)) {
+                const data = fs.readFileSync(this.config.transactionStoragePath, "utf-8");
+                const stored = JSON.parse(data);
+                for (const [key, value] of Object.entries(stored)) {
+                    const expiresAt = new Date(value.expiresAt);
+                    // Only load non-expired transactions
+                    if (expiresAt > new Date()) {
+                        this.transactions.set(key, {
+                            codeVerifier: value.codeVerifier,
+                            codeChallenge: value.codeChallenge,
+                            clientCallbackUrl: value.clientCallbackUrl,
+                            clientId: value.clientId,
+                            clientState: value.clientState,
+                            scope: value.scope,
+                            createdAt: new Date(value.createdAt),
+                            expiresAt,
+                        });
+                    }
+                }
+                console.log(`[PKCEProxy] Loaded ${this.transactions.size} transactions from disk`);
+            }
+        }
+        catch (error) {
+            console.warn("[PKCEProxy] Failed to load transactions from disk:", error);
+        }
+    }
+    // Save transactions to disk (survives server restarts)
+    saveTransactionsToDisk() {
+        try {
+            const toStore = {};
+            for (const [key, value] of this.transactions) {
+                toStore[key] = {
+                    codeVerifier: value.codeVerifier,
+                    codeChallenge: value.codeChallenge,
+                    clientCallbackUrl: value.clientCallbackUrl,
+                    clientId: value.clientId,
+                    clientState: value.clientState,
+                    scope: value.scope,
+                    createdAt: value.createdAt.toISOString(),
+                    expiresAt: value.expiresAt.toISOString(),
+                };
+            }
+            fs.writeFileSync(this.config.transactionStoragePath, JSON.stringify(toStore, null, 2));
+        }
+        catch (error) {
+            console.error("[PKCEProxy] Failed to save transactions to disk:", error);
+        }
+    }
     // Generate PKCE code verifier and challenge
     generatePKCE() {
         // Generate a random code verifier (43-128 characters)
@@ -124,6 +179,7 @@ export class PKCEOAuthProxy {
             expiresAt: new Date(Date.now() + 600 * 1000), // 10 minutes
         };
         this.transactions.set(transactionId, transaction);
+        this.saveTransactionsToDisk(); // Persist to survive restarts
         console.log("[PKCEProxy] Created transaction:", transactionId);
         // Build upstream authorization URL
         const authUrl = new URL(this.config.authorizationEndpoint);
@@ -172,6 +228,8 @@ export class PKCEOAuthProxy {
         }
         if (transaction.expiresAt < new Date()) {
             this.transactions.delete(state);
+            this.saveTransactionsToDisk();
+            console.error("[PKCEProxy] Transaction expired, created:", transaction.createdAt, "expired:", transaction.expiresAt);
             return new Response(JSON.stringify({ error: "transaction_expired" }), {
                 status: 400,
                 headers: { "Content-Type": "application/json" },
@@ -214,6 +272,7 @@ export class PKCEOAuthProxy {
         clientRedirect.searchParams.set("state", transaction.clientState);
         // Clean up transaction
         this.transactions.delete(state);
+        this.saveTransactionsToDisk();
         console.log("[PKCEProxy] Redirecting to client:", clientRedirect.toString());
         return new Response(null, {
             status: 302,
@@ -226,18 +285,39 @@ export class PKCEOAuthProxy {
         if (!params.code) {
             throw new OAuthProxyError("invalid_request", "Missing authorization code", 400);
         }
+        // Check if this code was recently exchanged (retry tolerance)
+        // This allows mcp-remote to retry if the first request timed out but actually succeeded
+        const recentExchange = this.recentlyExchangedCodes.get(params.code);
+        if (recentExchange && recentExchange.expiresAt > new Date()) {
+            console.log("[PKCEProxy] Returning cached token for retry of code:", params.code.slice(0, 8) + "...");
+            const tokenData = this.tokens.get(recentExchange.accessToken);
+            if (tokenData) {
+                const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
+                return {
+                    access_token: recentExchange.accessToken,
+                    token_type: "Bearer",
+                    expires_in: expiresIn > 0 ? expiresIn : 3600,
+                };
+            }
+        }
         const tokenData = this.tokens.get(params.code);
         if (!tokenData) {
             console.error("[PKCEProxy] Token not found for code:", params.code);
             console.error("[PKCEProxy] Available tokens:", Array.from(this.tokens.keys()).map(k => k.slice(0, 8) + "..."));
+            console.error("[PKCEProxy] Recently exchanged codes:", Array.from(this.recentlyExchangedCodes.keys()).map(k => k.slice(0, 8) + "..."));
             throw new OAuthProxyError("invalid_grant", "Invalid or expired authorization code", 400);
         }
-        // Remove the code (single use)
+        // Remove the code but keep track of it for retry tolerance (30 second window)
         this.tokens.delete(params.code);
         // Generate a new access token for the client
         const accessToken = this.generateId();
         this.tokens.set(accessToken, tokenData);
         this.saveTokensToDisk(); // Persist to disk
+        // Store the exchange for retry tolerance (30 seconds)
+        this.recentlyExchangedCodes.set(params.code, {
+            accessToken,
+            expiresAt: new Date(Date.now() + 30 * 1000),
+        });
         const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
         console.log("[PKCEProxy] Issuing access token, expires in:", expiresIn, "seconds");
         return {
@@ -271,13 +351,22 @@ export class PKCEOAuthProxy {
     // Load upstream tokens for a given proxy token
     loadUpstreamTokens(proxyToken) {
         const data = this.tokens.get(proxyToken);
-        if (!data)
+        if (!data) {
+            console.warn("[PKCEProxy] Token not found:", proxyToken.slice(0, 8) + "...");
+            console.warn("[PKCEProxy] Total tokens in store:", this.tokens.size);
             return null;
-        if (data.expiresAt < new Date()) {
+        }
+        const now = new Date();
+        if (data.expiresAt < now) {
+            console.warn("[PKCEProxy] Token expired:", proxyToken.slice(0, 8) + "...", "expired at:", data.expiresAt, "now:", now);
             this.tokens.delete(proxyToken);
             this.saveTokensToDisk();
             return null;
         }
+        const timeRemaining = Math.floor((data.expiresAt.getTime() - now.getTime()) / 1000);
+        if (timeRemaining < 300) { // Less than 5 minutes remaining
+            console.warn("[PKCEProxy] Token expiring soon:", proxyToken.slice(0, 8) + "...", "remaining:", timeRemaining, "seconds");
+        }
         return data;
     }
     // Get first valid token (for stdio mode where we don't have specific token ID)
@@ -290,24 +379,37 @@ export class PKCEOAuthProxy {
         }
         return null;
     }
-    // Cleanup expired transactions and tokens
+    // Cleanup expired transactions, tokens, and retry cache
     startCleanup() {
         this.cleanupInterval = setInterval(() => {
             const now = new Date();
             let tokensChanged = false;
+            let transactionsChanged = false;
             for (const [id, tx] of this.transactions) {
-                if (tx.expiresAt < now)
+                if (tx.expiresAt < now) {
                     this.transactions.delete(id);
+                    transactionsChanged = true;
+                }
             }
             for (const [id, token] of this.tokens) {
                 if (token.expiresAt < now) {
+                    console.log("[PKCEProxy] Cleaning up expired token:", id.slice(0, 8) + "...");
                     this.tokens.delete(id);
                     tokensChanged = true;
                 }
             }
+            // Clean up expired retry cache entries
+            for (const [code, data] of this.recentlyExchangedCodes) {
+                if (data.expiresAt < now) {
+                    this.recentlyExchangedCodes.delete(code);
+                }
+            }
             if (tokensChanged) {
                 this.saveTokensToDisk();
             }
+            if (transactionsChanged) {
+                this.saveTransactionsToDisk();
+            }
         }, 60000); // Every minute
     }
     destroy() {

package/dist/server.js

@@ -35,15 +35,26 @@ export async function startReflectMCPServer(config) {
         authenticate: async (request) => {
             const authHeader = request.headers.authorization;
             if (!authHeader?.startsWith("Bearer ")) {
-                return undefined;
+                console.warn("[Auth] Missing or invalid Authorization header - triggering 401");
+                // Throw Response to trigger re-authentication (per FastMCP docs)
+                throw new Response(null, {
+                    status: 401,
+                    statusText: "Unauthorized - Bearer token required",
+                });
             }
             const token = authHeader.slice(7);
             try {
                 const tokenData = pkceProxy.loadUpstreamTokens(token);
                 if (!tokenData) {
-                    return undefined;
+                    console.warn("[Auth] Token validation failed for:", token.slice(0, 8) + "... - triggering 401");
+                    // Throw Response to trigger re-authentication (per FastMCP docs)
+                    throw new Response(null, {
+                        status: 401,
+                        statusText: "Unauthorized - Invalid or expired token",
+                    });
                 }
                 const expiresIn = Math.floor((tokenData.expiresAt.getTime() - Date.now()) / 1000);
+                console.log("[Auth] Token validated, expires in:", expiresIn, "seconds");
                 return {
                     accessToken: tokenData.accessToken,
                     refreshToken: tokenData.refreshToken,
@@ -51,8 +62,15 @@ export async function startReflectMCPServer(config) {
                 };
             }
             catch (error) {
-                console.error("[Auth] Error:", error);
-                return undefined;
+                // Re-throw if it's already a Response (our auth failures above)
+                if (error instanceof Response) {
+                    throw error;
+                }
+                console.error("[Auth] Error validating token:", error);
+                throw new Response(null, {
+                    status: 401,
+                    statusText: "Unauthorized - Token validation error",
+                });
             }
         },
         version: "1.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reflect-mcp",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "MCP server for Reflect Notes - connect your notes to Claude Desktop. Just run: npx reflect-mcp",
   "type": "module",
   "main": "dist/server.js",