runlight 0.1.0 → 0.1.1

data/lib/runlight/db/connect.rb

@@ -60,7 +60,8 @@ module Runlight
       # MySQL 8.4 or MariaDB 11.4 and later from a URL like mysql://user:pass@host:3306/db (or mariadb://),
       # through the trilogy gem when it is installed, else mysql2. The session is utf8mb4 with the server's own
       # SQL mode plus IGNORE_SPACE, as mysql2 opens it for the TypeScript driver (its connect flags ask for
-      # that, which neither Ruby driver can, so it is set as the session's mode). Runlight's tables carry their
+      # that, which neither Ruby driver can, so it is set as the session's mode), less NO_BACKSLASH_ESCAPES, as
+      # stores/mysql.ts drops it. Runlight's tables carry their
       # own binary collation, so text compares and sorts by code point. statement_timeout is set per
       # connection as stores/mysql.ts sets it; 0 turns it off.
       def mysql(url, statement_timeout: 120_000)
@@ -71,7 +72,9 @@ module Runlight
         db = Database.new(Pools.make(config.compact), owned: true, statement_timeout: statement_timeout.to_i, dialect: "mysql")
         version, mode = db.connection_class.connection_pool.with_connection { |c| c.select_rows("SELECT VERSION(), @@GLOBAL.sql_mode")[0] }
         db.connection_class.connection_pool.disconnect!
-        variables = { sql_mode: (mode.to_s.split(",") | ["IGNORE_SPACE"]).join(",") }
+        # Less NO_BACKSLASH_ESCAPES, since values are written with backslash escapes (Database drops it from
+        # every session too).
+        variables = { sql_mode: ((mode.to_s.split(",") - ["NO_BACKSLASH_ESCAPES"]) | ["IGNORE_SPACE"]).join(",") }
         if statement_timeout.to_i.positive?
           variables.merge!(version.to_s.match?(/mariadb/i) ? { max_statement_time: statement_timeout.to_i / 1000.0 } : { max_execution_time: statement_timeout.to_i })
         end

data/lib/runlight/db/db.rb

@@ -26,6 +26,14 @@ module Runlight
       # characters at most.
       MYSQL_LOCK = "CONCAT('runlight:', LEFT(SHA2(COALESCE(DATABASE(), ''), 256), 48))"
 
+      # The session's sql_mode as it was, less NO_BACKSLASH_ESCAPES, wherever it sits in the list, as
+      # stores/mysql.ts sets it.
+      NO_BACKSLASH_ESCAPES_OFF = "SET SESSION sql_mode = TRIM(BOTH ',' FROM REPLACE(CONCAT(',', @@SESSION.sql_mode, ','), ',NO_BACKSLASH_ESCAPES,', ','))"
+
+      # Deleted rows, such as a day's salt once it is gone, are overwritten where that costs no extra writes, so
+      # they do not linger in the file's free space. Rails' pragmas setting takes this one only as on or off.
+      SECURE_DELETE = "PRAGMA secure_delete = FAST"
+
       attr_reader :connection_class
 
       # connection_class: an ActiveRecord::Base subclass whose pool to use (ActiveRecord::Base for the app's
@@ -38,11 +46,16 @@ module Runlight
         @statement_timeout = statement_timeout
         @dialect = dialect
         @held = 0
+        # Set on the thread inside a SQLite turn, whose BEGIN IMMEDIATE Rails does not know about.
+        @turn_key = :"runlight_turn_#{object_id}"
+        # The MySQL sessions, and the SQLite connections this database opened, already set up, by their driver
+        # connection, which a reconnect replaces.
+        @set_up = ObjectSpace::WeakMap.new
       end
 
       # "sqlite", "postgres", or "mysql".
       def dialect
-        @dialect ||= self.class.dialect_of(connection { |c| c.adapter_name })
+        @dialect ||= @connection_class.connection_pool.with_connection { |c| self.class.dialect_of(c.adapter_name) }
       end
 
       def self.dialect_of(adapter)
@@ -80,7 +93,7 @@ module Runlight
       # transaction already open (the store's, or the app's) is joined, not nested. Yields this database.
       def transaction
         connection do |c|
-          if c.transaction_open?
+          if c.transaction_open? || Thread.current[@turn_key]
             yield self
           elsif dialect == "mysql"
             # As Postgres does by default: each statement sees what was committed before it began, and InnoDB
@@ -105,6 +118,41 @@ module Runlight
         end
       end
 
+      # Runs the block as the only one reading and changing what it reads, across threads and processes, and
+      # yields this database. On Postgres and MySQL that is the database-wide lock. On SQLite it is a
+      # transaction begun IMMEDIATE, which takes the file's write lock before the block reads anything, so a
+      # second turn waits (up to the busy timeout) rather than reading what the first is about to change. A turn
+      # inside a turn, or inside a transaction already open, joins it.
+      def turn(&block)
+        return exclusive(&block) unless dialect == "sqlite"
+
+        connection do |c|
+          next yield(self) if Thread.current[@turn_key] || c.transaction_open?
+
+          c.execute("BEGIN IMMEDIATE", "Runlight")
+          Thread.current[@turn_key] = true
+          failed = nil
+          begin
+            yield self
+          rescue Exception => e
+            failed = e
+            raise
+          ensure
+            Thread.current[@turn_key] = nil
+            if failed
+              begin
+                c.execute("ROLLBACK", "Runlight")
+              rescue StandardError
+                # The error that got here matters more than one rolling back.
+              end
+            else
+              # Also when the block leaves early with return, break, or next.
+              c.execute("COMMIT", "Runlight")
+            end
+          end
+        end
+      end
+
       def close
         return unless @owned
 
@@ -115,7 +163,7 @@ module Runlight
       # seconds and applies it to every statement; MySQL counts milliseconds and applies it to reads.
       def limit_statements(ms)
         connection do |c|
-          @mariadb = c.select_value("SELECT VERSION() AS v").to_s.match?(/mariadb/i) if @mariadb.nil?
+          @mariadb = value(c, "SELECT VERSION() AS v").to_s.match?(/mariadb/i) if @mariadb.nil?
           c.execute(@mariadb ? "SET SESSION max_statement_time = #{Json.number(ms / 1000.0)}" : "SET SESSION max_execution_time = #{ms.to_i}")
         end
       end
@@ -184,8 +232,24 @@ module Runlight
 
       private
 
-      def connection(&block)
-        @connection_class.connection_pool.with_connection(&block)
+      def connection
+        @connection_class.connection_pool.with_connection do |c|
+          set_up(c) if dialect == "mysql" || (@owned && dialect == "sqlite")
+          yield c
+        end
+      end
+
+      # Values are escaped with backslashes, which a server set to NO_BACKSLASH_ESCAPES reads as text, so a
+      # quote could end the value early. Every MySQL session Runlight uses drops that one mode first, an app's
+      # own ActiveRecord connection's too, and again after a reconnect, which starts the session over. A SQLite
+      # file Runlight opened itself turns on secure_delete, as stores/sqlite.ts does.
+      def set_up(c)
+        raw = c.instance_variable_get(:@raw_connection)
+        return if raw && @set_up[raw]
+
+        c.execute(dialect == "sqlite" ? SECURE_DELETE : NO_BACKSLASH_ESCAPES_OFF, "Runlight")
+        raw = c.instance_variable_get(:@raw_connection)
+        @set_up[raw] = true if raw
       end
 
       # A statement on a connection. A connection the server dropped (a restart, a failover, an idle timeout)
@@ -199,6 +263,7 @@ module Runlight
         warn "Runlight: a #{dialect == "mysql" ? "MySQL" : "Postgres"} connection was lost; it reconnects on the next query. #{e.message}"
         connection do |c|
           c.reconnect!
+          set_up(c) if dialect == "mysql"
           block.call(c)
         end
       end
@@ -233,7 +298,7 @@ module Runlight
         if dialect == "postgres"
           # Asked for again and again rather than waited on: a waiting statement would hold up an index being
           # built CONCURRENTLY by whoever has the lock, and the two would wait on each other for good.
-          sleep 0.1 until truthy(c.select_value("SELECT pg_try_advisory_lock(#{MIGRATION_LOCK}) AS ok"))
+          sleep 0.1 until truthy(value(c, "SELECT pg_try_advisory_lock(#{MIGRATION_LOCK}) AS ok"))
           begin
             return yield(self)
           ensure
@@ -245,7 +310,7 @@ module Runlight
           end
         end
         loop do
-          ok = c.select_value("SELECT GET_LOCK(#{MYSQL_LOCK}, 5) AS ok")
+          ok = value(c, "SELECT GET_LOCK(#{MYSQL_LOCK}, 5) AS ok")
           raise "Runlight: MySQL refused the lock for creating tables" if ok.nil?
           break if ok.to_i == 1
           # Not got within 5 seconds: another process is creating the tables. Ask again.
@@ -265,6 +330,13 @@ module Runlight
         end
       end
 
+      # The first column of a statement's first row, always asked of the database. select_value goes through
+      # Rails' query cache, which a Rails request turns on for every pool, so a poll for a lock would see its
+      # first answer again and again; exec_query is never cached.
+      def value(c, sql)
+        c.exec_query(sql, "Runlight").rows.first&.first
+      end
+
       def truthy(value)
         value == true || value == "t" || value == 1 || value == "1" || value == "true"
       end

data/lib/runlight/http/fetcher.rb

@@ -72,7 +72,10 @@ module Runlight
         left = deadline - monotonic
         raise FetchError.new(TIMED_OUT, timed_out: true) if left <= 0
 
-        http = Net::HTTP.new(host, port)
+        # A pinned request never goes through a proxy from the environment (http_proxy and the rest), which would
+        # connect wherever the name leads now rather than to the address that was checked.
+        pinned = !Array(init["resolve"]).empty?
+        http = pinned ? Net::HTTP.new(host, port, nil) : Net::HTTP.new(host, port)
         http.use_ssl = https
         # A pin connects to the checked address, with the name kept for the Host header and the certificate.
         Array(init["resolve"]).each do |pin|

data/lib/runlight/http/request.rb

@@ -32,11 +32,14 @@ module Runlight
       # the path's limit raises TooLarge once one byte past it has been read.
       def self.from_rack(env, read_body: true)
         scheme = env["rack.url_scheme"] || "http"
-        host = env["HTTP_HOST"]
-        if host.nil? || host.empty?
+        # A Host header no URL can hold (a space, a bad port, a userinfo @) is read as the server's own name, as
+        # an absent one is, so the request still has a URL; the header itself is kept as it came.
+        host = env["HTTP_HOST"].to_s
+        unless host?(scheme, host)
           port = env["SERVER_PORT"].to_s
           default = (scheme == "https" && port == "443") || (scheme == "http" && port == "80") || port.empty?
           host = "#{env["SERVER_NAME"] || "localhost"}#{default ? "" : ":#{port}"}"
+          host = "localhost" unless host?(scheme, host)
         end
         path = "#{env["SCRIPT_NAME"]}#{env["PATH_INFO"]}"
         path = "/#{path}" unless path.start_with?("/")
@@ -51,7 +54,9 @@ module Runlight
         headers.set("content-type", type) unless type.empty?
         length = env["CONTENT_LENGTH"].to_s
         headers.set("content-length", length) unless length.empty?
-        method = env["REQUEST_METHOD"].to_s.upcase
+        # Rack::MethodOverride (in every Rails app) turns a form's POST with _method=DELETE into a DELETE. Runlight
+        # answers the method the browser sent, so a form on another page cannot pass for a write that needs no JSON.
+        method = (env["rack.methodoverride.original_method"] || env["REQUEST_METHOD"]).to_s.upcase
         body = +""
         input = env["rack.input"]
         if read_body && !%w[GET HEAD].include?(method) && input
@@ -64,6 +69,12 @@ module Runlight
         new(url, method: method, headers: headers, body: body, remote_address: env["REMOTE_ADDR"].to_s)
       end
 
+      # Whether a Host header is a name (or [address]) and maybe a port, and nothing a URL would read as more.
+      def self.host?(scheme, host)
+        host.match?(%r{\A(?:\[[0-9A-Fa-f:.]+\]|[^\s/?#@\\\[\]:]+)(?::\d{1,5})?\z}) && !Url.parse("#{scheme}://#{host}/").nil?
+      end
+      private_class_method :host?
+
       # The most a body may hold at this path: little for the collect endpoint, more for everything else.
       def self.limit_for(path)
         path.end_with?("/e") ? MAX_COLLECT_BODY : MAX_BODY

data/lib/runlight/importers/csv_visits.rb

@@ -48,7 +48,7 @@ module Runlight
         ""
       end
 
-      # A row with no visitor is its own visit, keyed by its whole content so a second import gives it the same ids.
+      # A row with no visitor is its own visit, keyed by its whole content.
       def own_key(row)
         entries = row.map { |k, v| [k.to_s, v] }
         entries = entries.sort { |a, b| Js.compare(a[0], b[0]).negative? ? -1 : 1 }

data/lib/runlight/importers/index.rb

@@ -18,7 +18,9 @@ module Runlight
       #
       # Returns { "cursor", "done", "total", "links", "clicks", "skipped", "failed" }, each failure
       # { "slug", "reason", "code"?, "params"? }.
-      def import_step(runlight, site, source, credentials, cursor, done)
+      # link_domain: the domain as a site keeps it once it passes the checks a link domain added by hand does, or nil
+      # to drop it.
+      def import_step(runlight, site, source, credentials, cursor, done, link_domain = ->(_domain) {})
         name = IMPORTERS[source]
         raise ImportError.new("Runlight cannot import from #{source}", "import_source", { "source" => source }) if name.nil?
 
@@ -37,6 +39,12 @@ module Runlight
         # A total that is not a number is as good as none.
         total = result["total"]
         total = nil unless total.is_a?(Integer) || (total.is_a?(Float) && total.finite?)
+        # Each domain is checked once a step, since the check may look it up in DNS.
+        checked = {}
+        domain_for = lambda do |domain|
+          checked[domain] = link_domain.call(domain) unless checked.key?(domain)
+          checked[domain]
+        end
         step = { "cursor" => result["cursor"], "done" => done, "total" => total, "links" => 0, "clicks" => 0, "skipped" => 0, "failed" => [] }
         result["links"].each do |item|
           if Js.truthy?(item["known"])
@@ -44,7 +52,7 @@ module Runlight
             step["skipped"] += 1
             next
           end
-          written = Write.write_link(runlight, site, source, item["link"], item)
+          written = Write.write_link(runlight, site, source, item["link"], item, domain_for)
           step["done"] += 1
           case written["status"]
           when "created"

data/lib/runlight/importers/visits.rb

@@ -162,11 +162,13 @@ module Runlight
           store.db.run("DELETE FROM rl_events WHERE site = ? AND ts >= ? AND ts < ? AND kind IN ('pageview', 'event') AND session IN (#{imported})",
                        [site_id, from, to, site_id])
           # Visits of these days that kept no rows go too. Their rows would come within EVENT_TAIL_MS of the step,
-          # so the time bounds let the (site, ts) index find them, with no scan of every event.
+          # so the time bounds let the (site, ts) index find them, with no scan of every event. That reaches back
+          # EVENT_TAIL_MS too, for a visit an earlier import began before this step whose rows were all in it: a
+          # CSV imported again has new ids, so its new visit does not take that one's place.
           store.db.run(
             "DELETE FROM rl_sessions WHERE site = ? AND imported = 1 AND started_at >= ? AND started_at < ?
          AND id NOT IN (SELECT e.session FROM rl_events e WHERE e.site = ? AND e.ts >= ? AND e.ts < ?)",
-            [site_id, from, to, site_id, from, to + tail],
+            [site_id, from - tail, to, site_id, from - tail, to + tail],
           )
           hits.each do |h|
             counts["visits"] += 1 if write_event(store, site, h["ns"], h["hit"])
@@ -336,8 +338,15 @@ module Runlight
       # One batch of a CSV file, sorted oldest first by the dashboard. As with Umami, only rows from before
       # Runlight's own first visit, and within what the site keeps, are written. A batch can run again: its
       # time span is cleared first, so batches must not share a moment, which the dashboard sees to.
-      # Returns { "pageviews", "events", "visits", "skipped" }.
-      def import_csv_visits(runlight, site_id, rows)
+      #
+      # A CSV's visitor column can hold anything, an email or an IP address among them, and a plain hash of
+      # one is easily undone by trying every address. So each key is an HMAC under a random secret made for
+      # the import and never stored: the first batch gets one, the answer carries it, and the caller sends
+      # it with every later batch of the same file, so a visit that runs across two batches stays one. A file
+      # imported again gets a new secret and new ids; its time span is cleared first, as always, so nothing is
+      # counted twice.
+      # Returns { "pageviews", "events", "visits", "skipped", "secret" }.
+      def import_csv_visits(runlight, site_id, rows, secret = nil)
         runlight.init
         raise ImportError.new("Unknown site", "unknown_site") if runlight.site(site_id).nil?
         if !rows.is_a?(Array) || rows.length > CsvVisits::CSV_BATCH
@@ -356,6 +365,7 @@ module Runlight
         format = CsvVisits.csv_format(clean.empty? ? [] : clean[0].keys)
         raise ImportError.new("This CSV is not an Umami export or Runlight's visit format", "import_csv_format") if format.nil?
 
+        key = secret.is_a?(String) && secret.match?(/\A[A-Za-z0-9_-]{22,128}\z/) ? secret : Accounts::Crypto.base64url(Accounts::Crypto.random_bytes(24))
         cutoff = runlight.retention_cutoff(site_id) || 0
         own = runlight.store.first_own_visit(site_id)
         finish = [own.nil? ? Float::INFINITY : own, runlight.now].min
@@ -369,10 +379,11 @@ module Runlight
         end
         hits = hits.each_with_index.sort_by { |h, i| [h["hit"]["ts"], i] }.map(&:first)
         skipped = clean.length - hits.length
-        return { "pageviews" => 0, "events" => 0, "visits" => 0, "skipped" => skipped } if hits.empty?
+        return { "pageviews" => 0, "events" => 0, "visits" => 0, "skipped" => skipped, "secret" => key } if hits.empty?
 
+        hits.each { |h| h["hit"]["key"] = Accounts::Crypto.base64url(Accounts::Crypto.hmac("SHA-256", key, h["hit"]["key"])) }
         counts = write_step(runlight, site_id, hits[0]["hit"]["ts"], hits[-1]["hit"]["ts"] + 1, hits)
-        counts.merge("skipped" => skipped)
+        counts.merge("skipped" => skipped, "secret" => key)
       end
 
       private_class_method :progress_key, :all, :write_step, :referrer_of, :from_umami, :write_event

data/lib/runlight/importers/write.rb

@@ -6,7 +6,9 @@ module Runlight
     module Write
       # Domains run by the shorteners themselves. Links there stay on Runlight's own path.
       SHORTENER_DOMAINS = %w[bit.ly bitly.com j.mp dub.sh dub.co dub.link short.gy rebrand.ly rebrandly.com rb.gy].freeze
-      private_constant :SHORTENER_DOMAINS
+      # The most clicks a day one imported link gets from a daily count.
+      MAX_DAILY = 10_000
+      private_constant :SHORTENER_DOMAINS, :MAX_DAILY
 
       # Browser and system names as other tools write them, in Runlight's spelling.
       BROWSERS = {
@@ -76,8 +78,10 @@ module Runlight
       # importing again skips what is already there.
       #
       # foreign: { "sourceId", "slug", "domain", "name", "url", "createdAt" }; history: { "clicks"?, "daily"? }.
+      # link_domain: given a branded domain, the domain as the site keeps it once it passes a link domain's checks,
+      # or nil to bring the link over without it.
       # Returns { "status", "clicks", "reason"?, "code"?, "params"? }.
-      def write_link(runlight, site, source, foreign, history)
+      def write_link(runlight, site, source, foreign, history, link_domain = ->(_domain) {})
         source_id = Js.string(foreign["sourceId"])
         id = imported_link_id(source, source_id)
         return { "status" => "skipped", "clicks" => 0 } unless runlight.store.link_by_id(id).nil?
@@ -96,8 +100,18 @@ module Runlight
                    "params" => { "slug" => slug } }
         end
 
-        domain = Sources.strip_www(Js.truthy?(foreign["domain"]) ? foreign["domain"].to_s : "")
-        domain = "" if SHORTENER_DOMAINS.include?(domain)
+        # The destination passes the checks a link made by hand does.
+        begin
+          destination = Links.clean_url(foreign["url"])
+        rescue LinkError => e
+          return { "status" => "failed", "clicks" => 0, "reason" => e.message, "code" => e.code, "params" => e.params }
+        end
+
+        domain = Sources.strip_www(Js.lower(Js.truthy?(foreign["domain"]) ? foreign["domain"].to_s : ""))
+        # A branded domain must pass the checks one added in Settings does, so an import can never claim the
+        # dashboard's own host or a name inside a private network. One that fails is left off: the link is
+        # served from the app's own path instead.
+        domain = domain.empty? || SHORTENER_DOMAINS.include?(domain) ? "" : (link_domain.call(domain) || "")
         now = runlight.now
         clicks = 0
         # Nothing in the transaction is one link's own problem (those are checked above),
@@ -173,7 +187,8 @@ module Runlight
             start = Client.parse_date("#{d["day"]}T00:00:00Z")
             next if (start.is_a?(Float) && !start.finite?) || !(d["clicks"].is_a?(Numeric) && d["clicks"].positive?)
 
-            n = [d["clicks"], 1_000_000].min
+            # A day's count is capped, so one made-up figure from a source cannot write millions of rows.
+            n = [d["clicks"], MAX_DAILY].min.floor
             i = 0
             while i < n
               store.insert_event({
@@ -194,7 +209,7 @@ module Runlight
             "domain" => domain,
             "slug" => slug,
             "name" => Js.slice(name, 0, 100),
-            "url" => foreign["url"],
+            "url" => destination,
             "createdAt" => created,
             "updatedAt" => created,
           })

data/lib/runlight/links.rb

@@ -21,6 +21,19 @@ module Runlight
       SecureRandom.random_bytes(6).bytes.map { |byte| ALPHABET[byte % ALPHABET.length] }.join
     end
 
+    # A link's destination as it is kept: a full http or https URL, up to 2,000 characters.
+    def self.clean_url(value)
+      text = Js.trim(Js.string(value.nil? ? "" : value))
+      url = Http::Url.parse(text)
+      raise LinkError.new("The destination must be a full URL, starting with https://", "link_url") if url.nil?
+      if url.protocol != "https:" && url.protocol != "http:"
+        raise LinkError.new("The destination must start with http:// or https://", "link_protocol")
+      end
+      raise LinkError.new("The destination is longer than 2,000 characters", "link_long") if Js.length(text) > 2000
+
+      url.href
+    end
+
     def create(site, input)
       input = Options.normalize(input)
       @runlight.init
@@ -109,15 +122,7 @@ module Runlight
     private
 
     def clean_url(value)
-      text = Js.trim(Js.string(value.nil? ? "" : value))
-      url = Http::Url.parse(text)
-      raise LinkError.new("The destination must be a full URL, starting with https://", "link_url") if url.nil?
-      if url.protocol != "https:" && url.protocol != "http:"
-        raise LinkError.new("The destination must start with http:// or https://", "link_protocol")
-      end
-      raise LinkError.new("The destination is longer than 2,000 characters", "link_long") if Js.length(text) > 2000
-
-      url.href
+      self.class.clean_url(value)
     end
 
     def default_name(url)

data/lib/runlight/mail/smtp.rb

@@ -83,6 +83,8 @@ module Runlight
         s.connect(security == "tls", REPLY_TIMEOUT_MS)
         expect = lambda do |codes, what|
           reply = s.next_reply(REPLY_TIMEOUT_MS)
+          # Something that is not a mail server gets no more than that said, so its own words are never passed on.
+          raise MailError, "SMTP #{what}: #{s.host}:#{s.port} did not answer as a mail server does" unless reply["code"].between?(200, 599)
           raise MailError, Transports.slice16("SMTP #{what}: #{reply["code"]} #{reply["text"]}", 300) unless codes.include?(reply["code"])
 
           reply

data/lib/runlight/mail/smtp_session.rb

@@ -9,6 +9,8 @@ module Runlight
     # (multi-line included, one at a time), and the whole send's deadline, which
     # every wait is held to.
     class SmtpSession
+      attr_reader :host, :port
+
       # deadline: nanoseconds on Smtp.monotonic's clock.
       def initialize(host, port, deadline, late_message)
         @host = host
@@ -20,12 +22,22 @@ module Runlight
         @lines = []
       end
 
+      # A mail server may be on this computer or a private network, but never at a link-local or cloud metadata
+      # address. The name is resolved here and the connection goes to the addresses checked, so it cannot
+      # answer differently a moment later.
       def connect(tls, timeout_ms)
         wait = [timeout_ms, left].min
         raise late if wait <= 0
 
+        bare = @host.sub(/\A\[/, "").sub(/\]\z/, "")
+        addresses = Safefetch.metadata_address?(bare) ? [bare] : Safefetch.lookup(bare)
+        if addresses.any? { |address| Safefetch.metadata_address?(address) }
+          raise MailError.new("SMTP: #{@host} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused", { "host" => @host })
+        end
+
         begin
-          socket = Socket.tcp(@host, @port, connect_timeout: wait / 1000.0)
+          # A name that does not resolve is still tried by name, for the resolver's own words.
+          socket = open_socket(addresses.empty? ? [@host] : addresses, wait)
         rescue SystemCallError, SocketError, IO::TimeoutError => e
           raise late if left <= 0
 
@@ -192,6 +204,15 @@ module Runlight
         @socket = ssl
       end
 
+      # A connection to the first of the addresses that answers, each tried in the time left.
+      def open_socket(targets, wait)
+        targets.each_with_index do |target, i|
+          return Socket.tcp(target, @port, connect_timeout: [wait, left].min / 1000.0)
+        rescue SystemCallError, SocketError, IO::TimeoutError
+          raise if i == targets.length - 1 || left <= 0
+        end
+      end
+
       def connect_detail(error, whole_wait)
         return(whole_wait ? "timed out" : "connection failed") if error.is_a?(IO::TimeoutError) || error.is_a?(Errno::ETIMEDOUT)
 

data/lib/runlight/mcp.rb

@@ -28,6 +28,8 @@ module Runlight
     ].freeze
     # query.ts's MAX_FILTERS.
     MAX_FILTERS = 6
+    # The most messages one batch may hold.
+    MAX_BATCH = 20
 
     RANGE_KEYS = %w[site period from to filters].freeze
     COMPARE_KEYS = [*RANGE_KEYS, "compare", "compare_from", "compare_to"].freeze
@@ -321,8 +323,13 @@ module Runlight
       parsed, body = Js.parse_json(request.text)
       return Http::Response.new(Json.encode(rpc_error(nil, -32_700, "Send a JSON-RPC message")), status: 400, headers: headers) if !parsed || !Js.object?(body)
 
-      # Batches were in the 2025-03-26 protocol; answering them costs nothing.
+      # Batches were in the 2025-03-26 protocol. Only a short list, so one request cannot start hundreds of
+      # reports; they run one after another here, where TypeScript runs four at a time.
       if body.is_a?(Array)
+        if body.length > MAX_BATCH
+          return Http::Response.new(Json.encode(rpc_error(nil, -32_600, "Send at most #{MAX_BATCH} messages in a batch")), status: 400, headers: headers)
+        end
+
         answers = body.map { |message| answer(message, read_api) }.compact
         return answers.empty? ? Http::Response.new("", status: 202) : Http::Response.new(Json.encode(answers), status: 200, headers: headers)
       end

data/lib/runlight/oauth.rb

@@ -230,9 +230,8 @@ module Runlight
         return oauth_error("unsupported_grant_type", "Only authorization_code is supported") if form.get("grant_type") != "authorization_code"
 
         key = "oauth-code:#{Hashing.sha256(form.get("code") || "")}"
-        stored = runlight.store.setting(key)
-        # A code works once: it is gone before anything else is checked.
-        runlight.store.set_setting(key, nil) if !stored.nil? && stored != ""
+        # A code works once: it is gone before anything else is checked, and of two swaps at once only one gets it.
+        stored = runlight.store.take_setting(key)
         grant = !stored.nil? && stored != "" ? Json.decode(stored) : nil
         return oauth_error("invalid_grant", "The code has expired or was already used") if grant.nil? || grant["expires"] < runlight.now
         if grant["client"] != form.get("client_id") || grant["redirect"] != form.get("redirect_uri")

data/lib/runlight/rack_app.rb

@@ -33,6 +33,8 @@ module Runlight
       @observe = observe
       @route_options = route_options
       @lock = Mutex.new
+      @warming = nil
+      @warm_failed_at = nil
     end
 
     def core
@@ -51,10 +53,16 @@ module Runlight
       rescue Http::Request::TooLarge
         # The rest is never read, so the connection is not fit for another request.
         return [413, { "content-type" => "application/json; charset=utf-8", "connection" => "close" }, [TOO_LARGE]]
+      rescue StandardError => e
+        raise if @app.nil?
+
+        # Whatever Runlight cannot read, the app behind still answers.
+        warn "Runlight: #{e.message}"
+        return @app.call(env)
       end
       response = answer(request)
       if response.nil?
-        core.observe(request) if @observe && request.method == "GET"
+        observe(request) if @observe && request.method == "GET"
         return @app.call(env)
       end
       status, headers, body = response.to_rack
@@ -63,21 +71,29 @@ module Runlight
     end
 
     # The answer to one request, or nil when it is not Runlight's and an app sits behind.
+    #
+    # The app's own requests never wait on Runlight: until Runlight has made its tables they go straight to
+    # the app while init runs beside them (a link domain is known only once it has), and anything that goes
+    # wrong in Runlight is logged and the request still reaches the app.
     def answer(request)
       context = { "ip" => request.remote_address }
-      linked = core.link_domain_response(request, context)
-      return linked unless linked.nil?
-
       path = Http::Url.parse(request.url)&.pathname || "/"
       link_path = core.link_path
-      if request.method == "GET" && path.match?(%r{\A#{Regexp.escape(link_path)}/[^/]+/?\z})
-        return core.link_handler.call(request, context)
+      link = request.method == "GET" && path.match?(%r{\A#{Regexp.escape(link_path)}/[^/]+/?\z})
+      # The discovery documents OAuth clients read at the site's root are answered too, as under the base path.
+      own = @app.nil? || mine?(path) || link || Routes.oauth_document?(path)
+      if own || ready?
+        linked = core.link_domain_response(request, context)
+        return linked unless linked.nil?
       end
-      return routes.handle(request) if @app.nil? || mine?(path)
+      return core.link_handler.call(request, context) if link
+      return routes.handle(request) if own
 
       nil
     rescue StandardError => e
       warn "Runlight: #{e.message}"
+      return nil if @app && !own
+
       Http::Response.new(INTERNAL, status: 500, headers: {
                            "content-type" => "application/json; charset=utf-8",
                            "cache-control" => "no-store",
@@ -87,6 +103,37 @@ module Runlight
 
     private
 
+    # Whether Runlight has made its tables. Until it has, an app's request starts init beside it, once at a
+    # time, and again no sooner than a minute after one that failed.
+    def ready?
+      return true unless core.respond_to?(:ready?)
+      return true if core.ready?
+
+      @lock.synchronize do
+        return false if @warming&.alive?
+        return false if @warm_failed_at && monotonic - @warm_failed_at < 60
+
+        @warming = Thread.new do
+          core.init
+        rescue StandardError => e
+          @warm_failed_at = monotonic
+          warn "Runlight: could not get ready #{e.message}"
+        end
+      end
+      false
+    end
+
+    # AI agent fetches are recorded once Runlight is ready, and never hold up or break the page.
+    def observe(request)
+      core.observe(request) if ready?
+    rescue StandardError => e
+      warn "Runlight: #{e.message}"
+    end
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
     def idle
       core.idle if core.respond_to?(:idle)
     rescue StandardError => e