@dollhousemcp/mcp-server 2.0.11 → 2.0.12-rc.2

package/dist/web/public/consoleAuth.js

@@ -0,0 +1,152 @@
+/**
+ * Console authentication helper (#1780).
+ *
+ * Reads the session token from the <meta name="dollhouse-console-token"> tag
+ * injected by the server at page-load time, and provides small wrapper
+ * functions that attach the token to API fetches and EventSource streams.
+ *
+ * When the token is empty (auth feature flag off, or server older than #1780)
+ * the helpers fall back to plain fetch / EventSource with no auth header —
+ * backwards-compatible with any Phase 0 setup.
+ *
+ * Usage (replace existing calls in other JS files):
+ *   fetch('/api/elements')               →  DollhouseAuth.apiFetch('/api/elements')
+ *   new EventSource('/api/logs/stream')  →  DollhouseAuth.apiEventSource('/api/logs/stream')
+ *
+ * External URLs (github.com, cdn.jsdelivr.net, etc.) should continue to use
+ * plain fetch — never send the console token to non-local hosts.
+ *
+ * @since v2.1.0 — Issue #1780
+ */
+
+(function () {
+  'use strict';
+
+  /**
+   * Strict format for console tokens — 64 lowercase hex characters.
+   * We refuse to attach anything that doesn't match this pattern, so
+   * malformed meta values or Unicode-obfuscated content never reach the
+   * server or leak into request URLs. DMCP-SEC-004 mitigation.
+   */
+  var TOKEN_FORMAT = /^[0-9a-f]{64}$/;
+
+  /**
+   * Read the console token from the meta tag in the document head.
+   * Normalizes the value to NFC and validates against the strict hex format.
+   * Returns an empty string if the tag is absent, empty, still the raw
+   * template placeholder, or fails validation.
+   */
+  function readTokenFromMeta() {
+    var meta = document.querySelector('meta[name="dollhouse-console-token"]');
+    if (!meta) return '';
+    var raw = (meta.getAttribute('content') || '').trim();
+    if (!raw || raw === '{{CONSOLE_TOKEN}}') return '';
+    // Normalize to NFC — strips any zero-width / combining mark weirdness
+    // before the format check. For legitimate hex tokens this is a no-op.
+    var normalized = raw.normalize('NFC');
+    if (!TOKEN_FORMAT.test(normalized)) return '';
+    return normalized;
+  }
+
+  var consoleToken = readTokenFromMeta();
+
+  /**
+   * Fire a custom event when the server returns 401 — the cached token is
+   * stale (rotated, server restarted, file deleted). The global listener
+   * in app.js shows a reload toast. Dispatched at most once per page load
+   * so multiple 401s don't stack multiple events.
+   */
+  var sessionExpiredFired = false;
+  function fireSessionExpired() {
+    if (sessionExpiredFired) return;
+    sessionExpiredFired = true;
+    window.dispatchEvent(new CustomEvent('dollhouse:session-expired'));
+  }
+
+  /**
+   * Fetch wrapper that attaches Authorization: Bearer to API requests.
+   * Accepts the same arguments as native fetch().
+   *
+   * @param {RequestInfo} input - URL or Request object
+   * @param {RequestInit} [init] - Fetch options (body, method, headers, etc.)
+   * @returns {Promise<Response>}
+   */
+  function apiFetch(input, init) {
+    if (!consoleToken) {
+      return fetch(input, init);
+    }
+    const opts = init ? Object.assign({}, init) : {};
+    const headers = new Headers(opts.headers || {});
+    if (!headers.has('Authorization')) {
+      headers.set('Authorization', 'Bearer ' + consoleToken);
+    }
+    opts.headers = headers;
+    return fetch(input, opts).then(function (response) {
+      if (response.status === 401 && consoleToken) {
+        fireSessionExpired();
+      }
+      return response;
+    });
+  }
+
+  /**
+   * EventSource wrapper that appends ?token=<token> to the URL.
+   * EventSource cannot set custom headers, so the token is carried as a
+   * query parameter. The middleware on the server accepts both the header
+   * and this fallback.
+   *
+   * @param {string} url - Relative or absolute URL
+   * @param {EventSourceInit} [init] - EventSource options (withCredentials, etc.)
+   * @returns {EventSource}
+   */
+  function apiEventSource(url, init) {
+    if (!consoleToken) {
+      return new EventSource(url, init);
+    }
+    var separator = url.indexOf('?') >= 0 ? '&' : '?';
+    var urlWithToken = url + separator + 'token=' + encodeURIComponent(consoleToken);
+    var es = new EventSource(urlWithToken, init);
+    // EventSource doesn't expose HTTP status codes on error. When the
+    // connection closes with an error, probe the base URL with a HEAD
+    // request to detect 401. If the token is stale, apiFetch's .then()
+    // handler fires the session-expired event. addEventListener runs
+    // alongside any onerror the caller sets — no interference.
+    es.addEventListener('error', function () {
+      if (consoleToken && es.readyState === EventSource.CLOSED) {
+        apiFetch(url, { method: 'HEAD' }).catch(function () { /* ignore */ });
+      }
+    });
+    return es;
+  }
+
+  /** Expose the helpers on the global namespace. */
+  window.DollhouseAuth = {
+    /** Current console token value (empty string if auth is off). */
+    get token() { return consoleToken; },
+
+    /**
+     * Update the cached token. If an explicit token string is provided and
+     * passes the strict hex format check, the in-memory cache is updated
+     * directly — this is the path used after a rotation response so the
+     * active tab picks up the new token without a page reload. Without an
+     * argument, falls back to re-reading the meta tag (legacy behavior).
+     *
+     * @param {string} [explicitToken] - New token value from a rotation response.
+     * @returns {string} The token now in use (may be empty if auth is off).
+     */
+    refresh: function (explicitToken) {
+      if (typeof explicitToken === 'string') {
+        var normalized = explicitToken.normalize('NFC');
+        if (TOKEN_FORMAT.test(normalized)) {
+          consoleToken = normalized;
+          return consoleToken;
+        }
+      }
+      consoleToken = readTokenFromMeta();
+      return consoleToken;
+    },
+
+    apiFetch: apiFetch,
+    apiEventSource: apiEventSource,
+  };
+})();

package/dist/web/public/index.html

@@ -7,6 +7,11 @@
   <meta name="description" content="DollhouseMCP management console — portfolio, logs, metrics">
   <meta http-equiv="X-Content-Type-Options" content="nosniff">
   <meta http-equiv="X-Frame-Options" content="DENY">
+  <!-- Console session token (#1780) — injected by server at request time.
+       When auth is enabled, browser JS reads this tag and attaches the value
+       as an Authorization: Bearer header on fetch calls, or as a ?token= query
+       param on EventSource connections. An empty value means auth is off. -->
+  <meta name="dollhouse-console-token" content="{{CONSOLE_TOKEN}}">
   <link rel="stylesheet" href="fonts.css">
   <link rel="stylesheet" href="styles.css">
   <link rel="stylesheet" href="logs.css">
@@ -14,6 +19,7 @@
   <link rel="stylesheet" href="permissions.css">
   <link rel="stylesheet" href="sessions.css">
   <link rel="stylesheet" href="setup.css">
+  <link rel="stylesheet" href="security.css">
   <!-- uPlot for metrics time-series charts -->
   <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/uplot@1.6.30/dist/uPlot.min.css" integrity="sha384-IfV0B7MIOYuO95kO9G5ySKPz/85zqFNOAs8iy4tkK5zd9izhJAB8b7lHrwYqqmYE" crossorigin="anonymous">
 </head>
@@ -32,10 +38,11 @@
     <div class="header-right">
       <nav class="console-tabs" id="console-tabs" aria-label="Console tabs">
         <button class="console-tab" data-tab="setup">Setup</button>
-        <button class="console-tab active" data-tab="portfolio">Portfolio</button>
+        <button class="console-tab" data-tab="security">Auth</button>
         <button class="console-tab" data-tab="logs">Logs</button>
         <button class="console-tab" data-tab="metrics">Metrics</button>
         <button class="console-tab" data-tab="permissions">Permissions</button>
+        <button class="console-tab active" data-tab="portfolio">Portfolio</button>
       </nav>
       <div class="session-indicator" id="session-indicator" title="Active sessions"></div>
       <div class="site-stats" id="stats" aria-live="polite"></div>
@@ -54,8 +61,8 @@
           <span class="setup-status-dot"></span>
           <span>DollhouseMCP is running on your machine</span>
         </div>
-        <h2 class="setup-hero-title">Connect your AI client</h2>
-        <p class="setup-hero-sub">Pick your platform below. Click <strong>Install Now</strong> to auto-configure, or copy the config manually.</p>
+        <h2 class="setup-hero-title">Connect DollhouseMCP to your AI client</h2>
+        <p class="setup-hero-sub">Pick your platform below. Click <strong>Configure Now</strong> to connect, or copy the config manually.</p>
       </div>
 
       <fieldset class="setup-method-toggle" id="setup-method-toggle">
@@ -70,6 +77,16 @@
         </button>
       </fieldset>
 
+      <fieldset class="setup-channel-toggle" id="setup-channel-toggle">
+        <legend class="setup-channel-legend">Release channel</legend>
+        <select id="setup-channel-select" class="setup-channel-select" aria-describedby="setup-channel-hint">
+          <option value="latest" selected>Stable</option>
+          <option value="rc">Release Candidate</option>
+          <option value="beta">Beta</option>
+        </select>
+        <span class="setup-channel-hint" id="setup-channel-hint">Recommended for most users.</span>
+      </fieldset>
+
       <!-- Pinned install prereq (hidden by default, shown when pinned selected) -->
       <div class="setup-pinned-prereq" id="setup-pinned-prereq" hidden>
         <div class="setup-method">
@@ -115,10 +132,10 @@ npm install @dollhousemcp/mcp-server</code></pre>
       <!-- Claude Desktop -->
       <section class="setup-panel is-active" role="tabpanel" id="setup-panel-claude-desktop" aria-labelledby="setup-tab-claude-desktop">
         <div class="setup-method setup-method-primary">
-          <h3>Auto-install <span class="setup-method-badge setup-badge">auto-updating</span></h3>
+          <h3>Auto-configure <span class="setup-method-badge setup-badge">auto-updating</span></h3>
           <p class="setup-method-desc">Pulls the latest version of DollhouseMCP on every startup. Uses <code>npx @latest</code> under the hood. Restart Claude Desktop after.</p>
           <div class="setup-install-row">
-            <button class="setup-btn setup-btn-primary setup-install-btn" type="button" data-install-client="claude">Install Now</button>
+            <button class="setup-btn setup-btn-primary setup-install-btn" type="button" data-install-client="claude">Configure Now</button>
             <span class="setup-install-status" data-install-status="claude"></span>
           </div>
         </div>
@@ -155,10 +172,10 @@ npm install @dollhousemcp/mcp-server</code></pre>
       <!-- Claude Code -->
       <section class="setup-panel" role="tabpanel" id="setup-panel-claude-code" aria-labelledby="setup-tab-claude-code" hidden>
         <div class="setup-method setup-method-primary">
-          <h3>Auto-install <span class="setup-method-badge setup-badge">auto-updating</span></h3>
+          <h3>Auto-configure <span class="setup-method-badge setup-badge">auto-updating</span></h3>
           <p class="setup-method-desc">Adds DollhouseMCP to Claude Code, pulling the latest version on every startup.</p>
           <div class="setup-install-row">
-            <button class="setup-btn setup-btn-primary setup-install-btn" type="button" data-install-client="claude-code">Install Now</button>
+            <button class="setup-btn setup-btn-primary setup-install-btn" type="button" data-install-client="claude-code">Configure Now</button>
             <span class="setup-install-status" data-install-status="claude-code"></span>
           </div>
         </div>
@@ -209,11 +226,163 @@ npm install @dollhousemcp/mcp-server</code></pre>
         </div>
       </div>
 
+      <!-- License selector (#1746 Step 3) -->
+      <div class="license-section" id="license-section">
+        <h3 class="license-heading">Choose your license</h3>
+        <p class="license-sub">DollhouseMCP is free and open source. Commercial use has simple, fair terms.</p>
+
+        <div class="license-tiers" id="license-tiers">
+          <!-- AGPL -->
+          <button class="license-tier is-selected" data-tier="agpl" type="button">
+            <span class="license-tier-price-label license-tier-price-label--free">Free</span>
+            <div class="license-tier-header">
+              <span class="license-tier-radio"></span>
+              <div>
+                <strong class="license-tier-name">AGPL-3.0</strong>
+                <span class="license-tier-badge license-tier-badge--default">default</span>
+              </div>
+            </div>
+            <p class="license-tier-desc">Open source. Share-alike license. No sign-up, no telemetry required.</p>
+          </button>
+
+          <!-- Free Commercial -->
+          <button class="license-tier" data-tier="free-commercial" type="button">
+            <span class="license-tier-price-label license-tier-price-label--free">Free</span>
+            <div class="license-tier-header">
+              <span class="license-tier-radio"></span>
+              <div>
+                <strong class="license-tier-name">Commercial</strong>
+              </div>
+            </div>
+            <p class="license-tier-desc">For companies earning under $1 million annual revenue. Attribution required.</p>
+          </button>
+
+          <!-- Paid Commercial / Enterprise -->
+          <button class="license-tier" data-tier="paid-commercial" type="button">
+            <span class="license-tier-price-label license-tier-price-label--paid">Paid</span>
+            <div class="license-tier-header">
+              <span class="license-tier-radio"></span>
+              <div>
+                <strong class="license-tier-name">Enterprise</strong>
+              </div>
+            </div>
+            <p class="license-tier-desc">For companies over $1M annual revenue, or white label. Priority support and SLA options available.</p>
+          </button>
+        </div>
+
+        <!-- AGPL detail (shown by default) -->
+        <div class="license-detail" id="license-detail-agpl">
+          <div class="license-detail-content">
+            <p>You're using DollhouseMCP under the <a href="https://www.gnu.org/licenses/agpl-3.0.en.html" target="_blank" rel="noopener">GNU Affero General Public License v3</a>. No action needed &mdash; this is the default.</p>
+            <ul class="license-detail-list">
+              <li>Use, modify, and distribute freely</li>
+              <li>Derivative works must also be AGPL-licensed</li>
+              <li>Source code must be made available to users who interact with the software over a network</li>
+              <li>Original copyright and license notices must be preserved</li>
+              <li>No telemetry collection</li>
+              <li>Community support via GitHub</li>
+            </ul>
+          </div>
+        </div>
+
+        <!-- Free Commercial detail (hidden) -->
+        <div class="license-detail" id="license-detail-free-commercial" hidden>
+          <form class="license-form" id="license-form-free-commercial" autocomplete="off">
+            <label class="license-form-label">
+              Email address
+              <input class="license-form-input" type="email" name="email" required maxlength="254" placeholder="you@company.com" />
+              <span class="license-form-hint">Your license confirmation will be sent to this address. A valid email is required to receive your license.</span>
+            </label>
+            <label class="license-form-check">
+              <input type="checkbox" name="telemetry" required />
+              <span>I acknowledge that anonymous usage telemetry will be collected as a condition of this license</span>
+            </label>
+            <label class="license-form-check">
+              <input type="checkbox" name="attribution" required />
+              <span>I acknowledge I will provide attribution when DollhouseMCP is used in any commercial product</span>
+            </label>
+            <label class="license-form-check">
+              <input type="checkbox" name="attestation" required />
+              <span>I attest that my organization's annual revenue is under $1,000,000 USD</span>
+            </label>
+            <button class="setup-btn setup-btn-primary license-submit-btn" type="submit">Activate Commercial License</button>
+            <p class="license-form-status" id="license-status-free-commercial"></p>
+          </form>
+        </div>
+
+        <!-- Paid Commercial detail (hidden) -->
+        <div class="license-detail" id="license-detail-paid-commercial" hidden>
+          <form class="license-form" id="license-form-paid-commercial" autocomplete="off">
+            <label class="license-form-label">
+              Email address
+              <input class="license-form-input" type="email" name="email" required maxlength="254" placeholder="you@company.com" />
+              <span class="license-form-hint">Your license confirmation will be sent to this address. A valid email is required to receive your license.</span>
+            </label>
+            <label class="license-form-label">
+              Revenue scale
+              <select class="license-form-select" name="revenueScale" required>
+                <option value="" disabled selected>Select range</option>
+                <option value="$1M–$5M">$1M – $5M</option>
+                <option value="$5M–$25M">$5M – $25M</option>
+                <option value="$25M–$100M">$25M – $100M</option>
+                <option value="$100M+">$100M+</option>
+              </select>
+            </label>
+            <label class="license-form-label">
+              Company name
+              <input class="license-form-input" type="text" name="companyName" required maxlength="200" placeholder="Acme Corp" />
+            </label>
+            <label class="license-form-label">
+              Use case
+              <textarea class="license-form-textarea" name="useCase" rows="2" required maxlength="500" placeholder="Brief description of how you're using DollhouseMCP"></textarea>
+            </label>
+            <label class="license-form-check">
+              <input type="checkbox" name="telemetry" required />
+              <span>I acknowledge that anonymous usage telemetry will be collected as a condition of this license</span>
+            </label>
+            <button class="setup-btn setup-btn-primary license-submit-btn" type="submit">Send Inquiry</button>
+            <p class="license-form-status" id="license-status-paid-commercial"></p>
+          </form>
+        </div>
+
+        <!-- Verification code input (shown after commercial form submit) -->
+        <div class="license-detail license-verification" id="license-verification" hidden>
+          <form class="license-form" id="license-verify-form" autocomplete="off">
+            <p class="license-verify-intro">We sent a 6-digit verification code to <strong id="license-verify-email"></strong>.</p>
+            <label class="license-form-label">
+              Verification code
+              <input class="license-form-input license-code-input" type="text" name="code" required maxlength="6" pattern="\d{6}" placeholder="000000" inputmode="numeric" autocomplete="one-time-code" />
+            </label>
+            <div class="license-verify-actions">
+              <button class="setup-btn setup-btn-primary license-submit-btn" type="submit">Verify</button>
+              <button class="setup-btn setup-btn-secondary" type="button" id="license-resend-btn">Resend code</button>
+            </div>
+            <p class="license-form-status" id="license-verify-status"></p>
+            <p class="license-verify-timer" id="license-verify-timer"></p>
+          </form>
+        </div>
+
+        <!-- Saved confirmation (shown after successful save) -->
+        <div class="license-saved" id="license-saved" hidden>
+          <span class="license-saved-icon">&#10003;</span>
+          <span class="license-saved-text" id="license-saved-text">License saved</span>
+        </div>
+
+        <!-- License details (shown when a commercial license is active) -->
+        <div class="license-detail license-active-details" id="license-active-details" hidden>
+          <div class="license-detail-content">
+            <h4 style="margin: 0 0 12px;">Your license</h4>
+            <table class="license-info-table" id="license-info-table"><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody id="license-info-tbody"></tbody></table>
+            <p class="license-file-path">License file: <code>~/.dollhouse/license.json</code></p>
+          </div>
+        </div>
+      </div>
+
       <div class="setup-footer">
         <p>Full documentation for all platforms (Continue, Docker, local LLMs) in the
           <a href="https://github.com/DollhouseMCP/mcp-server/blob/main/docs/guides/quick-start.md" target="_blank" rel="noopener">quick start guide</a>.
         </p>
-        <p>Auto-install powered by <a href="https://github.com/supermemoryai/install-mcp" target="_blank" rel="noopener">install-mcp</a> by <a href="https://github.com/dhravyashah" target="_blank" rel="noopener">Dhravya Shah</a>.</p>
+        <p>Auto-configure powered by <a href="https://github.com/supermemoryai/install-mcp" target="_blank" rel="noopener">install-mcp</a> by <a href="https://github.com/dhravyashah" target="_blank" rel="noopener">Dhravya Shah</a>.</p>
       </div>
     </div>
   </div>
@@ -292,6 +461,66 @@ npm install @dollhousemcp/mcp-server</code></pre>
     <div id="permissions-dashboard-root"></div>
   </div>
 
+  <!-- Tab: Security (#1791) -->
+  <div id="tab-security" class="tab-panel" hidden>
+    <div id="security-dashboard-root"></div>
+  </div>
+
+  <!-- Auth tab intro content (#1816) — edit here, not in security.js -->
+  <template id="sec-intro-template">
+    <section class="sec-card sec-card--intro" data-collapsed="true" aria-labelledby="sec-intro-title">
+      <button class="sec-card-header" type="button" aria-expanded="false">
+        <h3 class="sec-card-title" id="sec-intro-title">Console Authentication
+          <span class="sec-intro-summary">&mdash; how it can protect your sessions, permissions, and configurations</span>
+        </h3>
+        <span class="sec-card-toggle" aria-hidden="true">&#9662;</span>
+      </button>
+      <div class="sec-card-body">
+        <h4 class="sec-intro-subtitle">Why this matters</h4>
+        <ul class="sec-intro-list">
+          <li><strong>Prompt injection defense</strong> &mdash; Your LLM
+            processes content from the outside world: web searches, emails,
+            documents, links. Any of these can carry hidden instructions
+            targeting DollhouseMCP &mdash; attempting to create malicious
+            elements, alter permissions, or change your configuration.
+            Authentication ensures those attempts fail. The attacker
+            doesn&rsquo;t have your token, and TOTP means sensitive
+            operations require a code from your phone that no injection
+            can reach.</li>
+          <li><strong>Defense in depth</strong> &mdash; DollhouseMCP
+            validates and sanitizes inputs at the server level, but no
+            single layer is foolproof. Authentication adds an independent
+            barrier: even if an attack gets past input validation, it still
+            can&rsquo;t perform privileged operations without your
+            credentials.</li>
+          <li><strong>Shared environments</strong> &mdash; On shared
+            workstations, multi-user servers, or containers with mapped
+            ports, authentication prevents other users or network-adjacent
+            processes from accessing this console or any of its
+            capabilities.</li>
+        </ul>
+
+        <h4 class="sec-intro-subtitle">How it works</h4>
+        <ul class="sec-intro-list">
+          <li><strong>Console Token</strong> &mdash; A secret key generated
+            on first run. Every API request must carry it. Without the token,
+            other processes on your machine can&rsquo;t touch the console.
+            Use the <strong>Copy</strong> button below to share the token
+            with external services, scripts, or tools that need to access
+            the DollhouseMCP API on your behalf.</li>
+          <li><strong>Authenticator (TOTP)</strong> &mdash; An optional second
+            factor from your phone. Even if the token leaks, sensitive actions
+            like rotation still need a 6-digit code from your authenticator
+            app that changes every 30 seconds.</li>
+        </ul>
+
+        <a class="sec-intro-link"
+           href="https://github.com/DollhouseMCP/mcp-server/blob/main/docs/guides/console-auth.md"
+           target="_blank" rel="noopener">Full documentation &rarr;</a>
+      </div>
+    </section>
+  </template>
+
   <dialog id="element-modal" class="modal" aria-labelledby="modal-title">
     <div class="modal-overlay" id="modal-overlay"></div>
     <div class="modal-dialog">
@@ -326,10 +555,11 @@ npm install @dollhousemcp/mcp-server</code></pre>
 
   <footer class="site-footer">
     <div class="footer-inner">
-      <a href="https://github.com/DollhouseMCP/collection" class="footer-link">GitHub Repository</a>
+      <a href="https://github.com/DollhouseMCP/mcp-server" class="footer-link">GitHub Repository</a>
       <a href="./collection-index.json" class="footer-link">JSON API</a>
       <a href="https://dollhousemcp.com" class="footer-link">DollhouseMCP</a>
       <span class="footer-updated" id="footer-updated"></span>
+      <span class="footer-copyright">&copy; 2026 DollhouseMCP</span>
     </div>
   </footer>
 
@@ -358,11 +588,15 @@ npm install @dollhousemcp/mcp-server</code></pre>
         id="hljs-theme-dark" disabled>
   <!-- uPlot for metrics charts -->
   <script src="https://cdn.jsdelivr.net/npm/uplot@1.6.30/dist/uPlot.iife.min.js" integrity="sha384-1NEYi76CBpge3gahk4+X4M4JzdOV3WYq84RnByqYdAd5SdvJBTNCPFh/nsoHfN6i" crossorigin="anonymous"></script>
+  <!-- Console auth helper must load first — it reads the token meta tag and
+       exposes window.DollhouseAuth for all subsequent scripts (#1780). -->
+  <script src="consoleAuth.js"></script>
   <script src="setup.js"></script>
   <script src="app.js"></script>
   <script src="logs.js"></script>
   <script src="metrics.js"></script>
   <script src="permissions.js"></script>
   <script src="sessions.js"></script>
+  <script src="security.js"></script>
 </body>
 </html>

package/dist/web/public/logs.js

@@ -305,7 +305,7 @@
     if (filterCategory) params.set('category', filterCategory);
     if (filterLevel) params.set('level', filterLevel);
     const qs = params.toString();
-    eventSource = new EventSource('/api/logs/stream' + (qs ? '?' + qs : ''));
+    eventSource = DollhouseAuth.apiEventSource('/api/logs/stream' + (qs ? '?' + qs : ''));
 
     eventSource.onopen = () => setStatus('connected');
 

package/dist/web/public/metrics.js

@@ -147,7 +147,7 @@
   // ── Data fetching ────────────────────────────────────────────────────────
   async function fetchLatest() {
     try {
-      const res = await fetch('/api/metrics?latest=true');
+      const res = await DollhouseAuth.apiFetch('/api/metrics?latest=true');
       if (!res.ok) return;
       const data = await res.json();
       if (data.snapshots?.length > 0) {
@@ -167,7 +167,7 @@
   async function fetchHistory() {
     try {
       const since = new Date(Date.now() - TIME_RANGES[activeRange]).toISOString();
-      const res = await fetch(`/api/metrics?latest=false&since=${since}&limit=100`);
+      const res = await DollhouseAuth.apiFetch(`/api/metrics?latest=false&since=${since}&limit=100`);
       if (!res.ok) return;
       const data = await res.json();
       if (data.snapshots) {
@@ -403,7 +403,7 @@
     if (securityEventsCache && (now - securityEventsCacheTime) < SECURITY_CACHE_TTL) {
       renderSecurityEvents(securityEventsCache);
     } else {
-      fetch('/api/logs?category=security&level=warn&limit=5')
+      DollhouseAuth.apiFetch('/api/logs?category=security&level=warn&limit=5')
         .then(r => r.ok ? r.json() : null)
         .then(data => {
           if (data?.entries) {

package/dist/web/public/permissions.js

@@ -70,7 +70,7 @@
 
   async function poll() {
     try {
-      const res = await fetch('/api/permissions/status');
+      const res = await DollhouseAuth.apiFetch('/api/permissions/status');
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const data = await res.json();
       render(data);