rhombus-node-mcp 0.1.35 → 0.1.36

package/dist/api/get-accessible-apps.js

@@ -2,15 +2,18 @@ import { logger } from "../logger.js";
 import { postApi } from "../network/network.js";
 /**
  * Fetches `user.accessibleRhombusApps` from getCurrentUser for the given session.
- * Result is cached in-memory for the lifetime of the session. Returns null on
- * error or missing session; callers should fall back to a permissive default.
+ * Successful results are cached in-memory for the lifetime of the session;
+ * failures are NOT cached so transient errors don't poison the session.
+ * Returns null on error or missing session; callers should fall back to a
+ * permissive default.
  */
 const cache = new Map();
 export async function resolveAccessibleApps(sessionId) {
     if (!sessionId)
         return null;
-    if (cache.has(sessionId))
-        return cache.get(sessionId) ?? null;
+    const cached = cache.get(sessionId);
+    if (cached !== undefined)
+        return cached;
     try {
         const res = await postApi({
             route: "/customer/getCurrentUser",
@@ -19,7 +22,6 @@ export async function resolveAccessibleApps(sessionId) {
         });
         if (res.error) {
             logger.warn(`resolveAccessibleApps: getCurrentUser failed for session ${sessionId}`);
-            cache.set(sessionId, null);
             return null;
         }
         const apps = (res.user?.accessibleRhombusApps ?? []).filter((a) => a !== null && a !== undefined);
@@ -29,7 +31,6 @@ export async function resolveAccessibleApps(sessionId) {
     }
     catch (e) {
         logger.warn(`resolveAccessibleApps: error for session ${sessionId}: ${String(e)}`);
-        cache.set(sessionId, null);
         return null;
     }
 }

package/dist/transports/streamable-http.js

@@ -75,7 +75,6 @@ export default function streamableHttpTransport() {
     /**
      * STATEFUL ENDPOINT
      */
-    const authRequired = ["tools/call"];
     app.post("/mcp", async (req, res) => {
         logger.info(`Received MCP request`, JSON.stringify(req.body, null, 2));
         // Check for existing session ID
@@ -95,8 +94,13 @@ export default function streamableHttpTransport() {
             // onsessioninitialized.
             const newSessionId = crypto.randomUUID();
             const authOk = populateAuthStore(req, newSessionId);
-            if (!authOk && authRequired.includes(req.body.method)) {
-                logger.error(`Auth required for ${req.body.method} but auth could not be populated`);
+            // Reject the initialize itself when auth couldn't be populated. Letting
+            // the session through without an authStore entry only defers the failure:
+            // any later /customer/getCurrentUser (during tool registration) or tool
+            // call will throw "No auth found for sessionId" from network.ts, which
+            // is harder to diagnose than an upfront 401 here.
+            if (!authOk) {
+                logger.error(`Auth could not be populated for ${req.body.method}; rejecting`);
                 res
                     .status(401)
                     .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",