chore: sync from internal

Author: phantom-commit-bot[bot]

packages/auth2/src/Auth2KmsRpcClient.ts

@@ -43,6 +43,8 @@ export class Auth2KmsRpcClient {
     const axiosInstance = axios.create();
 
     axiosInstance.interceptors.request.use(async config => {
+      await this.stamper.maybeRefreshTokens();
+
       config.headers = config.headers || {};
       config.headers["x-app-id"] = options.appId;
       config.headers["x-api-version"] = DEFAULT_KMS_API_VERSION;

packages/auth2/src/Auth2Stamper.ts

@@ -27,21 +27,17 @@ export class Auth2Stamper implements Auth2StamperWithKeyManagement {
 
   private refreshingTokensPromise: Promise<boolean> | null = null;
 
-  // Because TOKEN_REFRESH_BUFFER_MS proactively handles refresh, we can safely use void here
-  // and return the existing cached values immediately.
   get bearerToken(): string | null {
     if (!this._idType || !this._accessToken) {
       return null;
     }
-    void this.maybeRefreshTokens();
     return `${this._idType} ${this._accessToken}`;
   }
 
   get auth2Token(): Auth2Token | null {
     if (!this._accessToken) {
       return null;
     }
-    void this.maybeRefreshTokens();
     return Auth2Token.fromAccessToken(this._accessToken);
   }
 
@@ -170,7 +166,13 @@ export class Auth2Stamper implements Auth2StamperWithKeyManagement {
     return this.refreshingTokensPromise;
   }
   async stamp(params: { data: Buffer; type?: "PKI" } | { data: Buffer; type: "OIDC" }): Promise<string> {
-    if (!this._keyPair || !this._keyInfo || !this.auth2Token) {
+    if (!this._keyPair || !this._keyInfo) {
+      throw new Error("Auth2Stamper not initialized. Call init() first.");
+    }
+
+    await this.maybeRefreshTokens();
+
+    if (!this.auth2Token) {
       throw new Error("Auth2Stamper not initialized. Call init() first.");
     }
 

packages/auth2/src/__tests__/Auth2KmsRpcClient.test.ts

@@ -41,6 +41,7 @@ function makeStamper(
 ) {
   return {
     stamp: jest.fn().mockResolvedValue("mock-stamp"),
+    maybeRefreshTokens: jest.fn().mockResolvedValue(false),
     getKeyInfo: jest.fn().mockReturnValue({
       keyId: "key-id-1",
       publicKey: "7EcDshMsTHCs2f2HU2a3n36x9JkEVVenF9oQQGy5U3s",
@@ -107,6 +108,7 @@ describe("Auth2KmsRpcClient", () => {
       expect(headers["x-app-id"]).toBe("app-123");
       expect(headers["x-api-version"]).toBe("2025-11-24");
       expect(headers["x-phantom-stamp"]).toBe("mock-stamp");
+      expect(stamper.maybeRefreshTokens).toHaveBeenCalledTimes(1);
       expect(stamper.stamp).toHaveBeenCalledWith(expect.objectContaining({ data: expect.anything() }));
     });
 

packages/auth2/src/__tests__/Auth2Stamper.test.ts

@@ -337,6 +337,22 @@ describe("Auth2Stamper", () => {
   });
 
   describe("stamp()", () => {
+    it("awaits maybeRefreshTokens() before building the OIDC stamp", async () => {
+      const storage = makeStorage();
+      const stamper = new Auth2Stamper(storage);
+
+      await stamper.init();
+
+      storage.load.mockResolvedValueOnce({ keyPair: mockKeyPair, keyInfo: stamper.getKeyInfo()! });
+      await stamper.setTokens({ accessToken: "my-access-token", idType: "Bearer" });
+
+      const maybeRefreshSpy = jest.spyOn(stamper, "maybeRefreshTokens").mockResolvedValue(false);
+
+      await stamper.stamp({ type: "OIDC", data: Buffer.from("payload") });
+
+      expect(maybeRefreshSpy).toHaveBeenCalled();
+    });
+
     it("throws before init()", async () => {
       const stamper = new Auth2Stamper(makeStorage());
 
@@ -593,19 +609,8 @@ describe("Auth2Stamper", () => {
   });
 
   describe("token refresh", () => {
-    it("triggers a background refresh when the token is near expiry", async () => {
+    it("does not trigger refresh as a side effect of bearerToken access", async () => {
       const mockFetch = globalThis.fetch as jest.Mock;
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        json: () =>
-          Promise.resolve({
-            access_token: "new-access",
-            refresh_token: "new-refresh",
-            token_type: "Bearer",
-            expires_in: 3600,
-          }),
-      });
-
       const storage = makeStorage(STORED_RECORD);
       const stamper = new Auth2Stamper(storage, {
         authApiBaseUrl: "https://auth.example.com",
@@ -614,84 +619,28 @@ describe("Auth2Stamper", () => {
       });
 
       await stamper.init();
-
-      // Force the token to be near expiry.
       (stamper as any)._tokenExpiresAt = Date.now() - 1000;
       (stamper as any)._refreshToken = "stored-refresh-token";
 
-      // Access bearerToken to fire the background refresh.
-      stamper.bearerToken;
-
-      // Flush microtasks so the background refresh completes.
-      await new Promise(resolve => setTimeout(resolve, 0));
-
-      expect(mockFetch).toHaveBeenCalledWith(
-        "https://auth.example.com/oauth2/token",
-        expect.objectContaining({ method: "POST" }),
-      );
-      expect(stamper.bearerToken).toBe("Bearer new-access");
-    });
-
-    it("does not refresh when no refreshConfig is provided", async () => {
-      const mockFetch = globalThis.fetch as jest.Mock;
-
-      const storage = makeStorage(STORED_RECORD);
-      const stamper = new Auth2Stamper(storage);
-
-      await stamper.init();
-
-      (stamper as any)._tokenExpiresAt = Date.now() - 1000;
-
-      // Access bearerToken to fire the background refresh.
-      stamper.bearerToken;
-
-      // Flush microtasks so the background refresh completes.
-      await new Promise(resolve => setTimeout(resolve, 0));
-
+      expect(stamper.bearerToken).toBe("Bearer stored-access-token");
       expect(mockFetch).not.toHaveBeenCalled();
     });
 
-    it("does not fire a second refresh while one is already in flight", async () => {
+    it("does not trigger refresh as a side effect of auth2Token access", async () => {
       const mockFetch = globalThis.fetch as jest.Mock;
-      // Slow refresh that we can control.
-      let resolveRefresh!: () => void;
-      mockFetch.mockReturnValueOnce(
-        new Promise(resolve => {
-          resolveRefresh = () =>
-            resolve({
-              ok: true,
-              json: () =>
-                Promise.resolve({
-                  access_token: "new",
-                  refresh_token: "new-r",
-                  token_type: "Bearer",
-                  expires_in: 3600,
-                }),
-            });
-        }),
-      );
-
       const storage = makeStorage(STORED_RECORD);
       const stamper = new Auth2Stamper(storage, {
         authApiBaseUrl: "https://auth.example.com",
-        clientId: "c",
-        redirectUri: "https://app.example.com/cb",
+        clientId: "client-1",
+        redirectUri: "https://app.example.com/callback",
       });
 
       await stamper.init();
-
       (stamper as any)._tokenExpiresAt = Date.now() - 1000;
-      (stamper as any)._refreshToken = "r";
-
-      // Trigger two concurrent getter accesses.
-      stamper.bearerToken;
-      stamper.bearerToken;
-
-      resolveRefresh();
-      await new Promise(resolve => setTimeout(resolve, 0));
+      (stamper as any)._refreshToken = "stored-refresh-token";
 
-      // fetch should only have been called once despite two accesses.
-      expect(mockFetch).toHaveBeenCalledTimes(1);
+      expect(stamper.auth2Token?.sub).toBe("default-user");
+      expect(mockFetch).not.toHaveBeenCalled();
     });
   });
 });

packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phantom/mcp-server",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "MCP Server for Phantom Wallet",
   "repository": {
     "type": "git",

packages/mcp-server/src/session/manager.ts

@@ -252,9 +252,16 @@ export class SessionManager {
    */
   tryRefreshSession(): Promise<boolean> {
     if (this.session?.authFlow !== "device-code" || !this.stamper) {
+      this.logger.info(
+        `tryRefreshSession: skipping refresh (authFlow=${this.session?.authFlow ?? "none"}, hasStamper=${Boolean(this.stamper)})`,
+      );
       return Promise.resolve(false);
     }
-    return this.stamper.maybeRefreshTokens();
+    this.logger.info("tryRefreshSession: attempting stamper token refresh");
+    return this.stamper.maybeRefreshTokens().then(result => {
+      this.logger.info(`tryRefreshSession: refresh ${result ? "succeeded" : "did not run or failed"}`);
+      return result;
+    });
   }
 
   /**

packages/mcp-server/src/tools/buy-token.ts

@@ -35,10 +35,6 @@ export const buyTokenTool: ToolHandler = {
   inputSchema: {
     type: "object",
     properties: {
-      walletId: {
-        type: "string",
-        description: "Optional wallet ID (defaults to authenticated wallet)",
-      },
       sellChainId: {
         type: "string",
         description:

packages/mcp-server/src/tools/cancel-perp-order.ts

@@ -22,10 +22,6 @@ export const cancelPerpOrderTool = createTool<Params>({
   inputSchema: {
     type: "object",
     properties: {
-      walletId: {
-        type: "string",
-        description: "Optional wallet ID (defaults to authenticated wallet)",
-      },
       derivationIndex: {
         type: "integer",
         description: "Optional derivation index (default: 0)",

packages/mcp-server/src/tools/close-perp-position.test.ts

@@ -30,6 +30,8 @@ describe("close_perp_position", () => {
 
   it("calls closePosition with market and no sizePercent by default", async () => {
     await closePerpPositionTool.handler({ market: "BTC" }, makeContext() as any);
+    const { createPerpsClient } = jest.requireMock("../utils/perps.js");
+    expect(createPerpsClient).toHaveBeenCalledWith(expect.anything(), "wallet-1", undefined);
     expect(mockPerpsClient.closePosition).toHaveBeenCalledWith({ market: "BTC", sizePercent: undefined });
   });
 

packages/mcp-server/src/tools/close-perp-position.ts

@@ -24,10 +24,6 @@ export const closePerpPositionTool = createTool<Params>({
   inputSchema: {
     type: "object",
     properties: {
-      walletId: {
-        type: "string",
-        description: "Optional wallet ID (defaults to authenticated wallet)",
-      },
       derivationIndex: {
         type: "integer",
         description: "Optional derivation index (default: 0)",