@productbrain/mcp 0.0.1-beta.1223 → 0.0.1-beta.12232

package/dist/http.js

@@ -1,25 +1,28 @@
 import {
-  DEFAULT_CLOUD_URL,
+  PRODUCT_NAME,
   SERVER_VERSION,
+  createProductBrainServer
+} from "./chunk-5OQ7KOPB.js";
+import {
+  DEFAULT_CLOUD_URL,
+  PASTE_NOW,
+  apiKeysUrl,
   bootstrapHttp,
-  createProductBrainServer,
+  checkKeyAgainstCandidates,
+  forgetStreamLifecycle,
   getKeyState,
   hashKey,
-  initFeatureFlags,
+  isApiKeyShaped,
+  parseFallbackUrls,
   runWithAuth
-} from "./chunk-M5XN5T3N.js";
-import {
-  getPostHogClient,
-  initAnalytics,
-  shutdownAnalytics
-} from "./chunk-YMF3IQ5E.js";
+} from "./chunk-TZLNCSXM.js";
 
 // src/http.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import rateLimit from "express-rate-limit";
+import rateLimit2 from "express-rate-limit";
 
 // src/brand/logo-markup.ts
 var SIZE_CLASSES = {
@@ -50,67 +53,10 @@ function appLogoMarkup(opts = {}) {
   const size = opts.size ?? "sm";
   const showWordmark = opts.showWordmark ?? true;
   const cls = ["pb-logo", SIZE_CLASSES[size], opts.className].filter(Boolean).join(" ");
-  const wordmark = showWordmark ? `<span class="pb-logo__name">Product Brain</span>` : "";
+  const wordmark = showWordmark ? `<span class="pb-logo__name">${PRODUCT_NAME}</span>` : "";
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
-// src/lib/refresh-token.ts
-import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var PREFIX = "pb_rt_";
-var secret = (() => {
-  const fromEnv = process.env.MCP_REFRESH_SECRET;
-  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
-  if (process.env.NODE_ENV === "production") {
-    console.warn(
-      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
-    );
-  }
-  return randomBytes(32);
-})();
-function sign(payloadB64) {
-  return createHmac("sha256", secret).update(payloadB64).digest();
-}
-function signRefreshToken(apiKey) {
-  const payload = {
-    k: apiKey,
-    i: Date.now(),
-    j: randomUUID()
-  };
-  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  const sigB64 = sign(payloadB64).toString("base64url");
-  return `${PREFIX}${payloadB64}.${sigB64}`;
-}
-function verifyRefreshToken(token) {
-  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
-  const body = token.slice(PREFIX.length);
-  const dot = body.indexOf(".");
-  if (dot <= 0 || dot === body.length - 1) return null;
-  const payloadB64 = body.slice(0, dot);
-  const sigB64 = body.slice(dot + 1);
-  let providedSig;
-  try {
-    providedSig = Buffer.from(sigB64, "base64url");
-  } catch {
-    return null;
-  }
-  const expectedSig = sign(payloadB64);
-  if (providedSig.length !== expectedSig.length) return null;
-  if (!timingSafeEqual(providedSig, expectedSig)) return null;
-  let payload;
-  try {
-    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
-    payload = JSON.parse(json);
-  } catch {
-    return null;
-  }
-  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
-    return null;
-  }
-  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
-  return { apiKey: payload.k };
-}
-
 // src/sessionCap.ts
 function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
   if (cap < 1) {
@@ -218,11 +164,237 @@ function send429(res, built) {
   res.status(built.status).json(built.body);
 }
 
+// src/mcpRateLimit.ts
+import rateLimit from "express-rate-limit";
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function rejected(presented) {
+  return { status: "rejected", credentialId: hashKey(presented) };
+}
+function resolveBearerAuth(authorizationHeader) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return rejected(authorizationHeader.trim());
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (!isApiKeyShaped(token)) return rejected(token);
+  return { status: "ok", apiKey: token, credentialId: hashKey(token) };
+}
+function resolvePastedKey(apiKey) {
+  if (apiKey === "") return { status: "absent" };
+  if (!isApiKeyShaped(apiKey)) return rejected(apiKey);
+  return { status: "ok", apiKey, credentialId: hashKey(apiKey) };
+}
+function isCrossSiteFormPost(origin, secFetchSite, ownOrigin) {
+  if (secFetchSite === "cross-site") return true;
+  if (typeof origin !== "string" || origin === "") return false;
+  try {
+    return new URL(origin).origin !== new URL(ownOrigin).origin;
+  } catch {
+    return true;
+  }
+}
+function checkAuthBlock(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function authLockoutError(failures, auth, now, id = null) {
+  if (auth.status === "absent") return null;
+  const rec = failures.get(auth.credentialId);
+  if (!rec || !checkAuthBlock(failures, auth.credentialId, now)) return null;
+  const retryAfterSeconds = Math.max(0, Math.ceil((rec.blockedUntil - now) / 1e3));
+  return buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec.count, id });
+}
+function recordAuthFailure(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
+  if (!rec) {
+    if (failures.size >= MAX_AUTH_FAILURE_ENTRIES) {
+      const oldest = failures.keys().next().value;
+      if (oldest !== void 0) failures.delete(oldest);
+    }
+    failures.set(credentialId, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+function keyVerdictGate(verdict, failures, credentialId, now) {
+  if (verdict === "ok" || verdict === "rate_limited") return "admit";
+  if (verdict === "rejected") {
+    recordAuthFailure(failures, credentialId, now);
+    return "unauthorized";
+  }
+  return "unavailable";
+}
+
+// src/mcpRateLimit.ts
+var MCP_KEY_LIMIT = 120;
+var MCP_IP_CEILING = 1200;
+function mcpRateKey(req) {
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  return auth.status === "absent" ? `ip:${req.ip ?? ""}` : `key:${auth.credentialId}`;
+}
+function limiter(max, windowMs, keyGenerator) {
+  return rateLimit({
+    windowMs,
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    ...keyGenerator ? { keyGenerator } : {},
+    handler: (req, res) => {
+      const r = req.rateLimit;
+      const reset = r?.resetTime?.getTime?.() ?? Date.now() + windowMs;
+      send429(res, buildRateLimitError({
+        retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+        limit: r?.limit ?? max,
+        current: r?.used ?? 0,
+        id: req.body?.id ?? null
+        // mirror the JSON-RPC id when a POST body is present
+      }));
+    }
+  });
+}
+function mcpLimiters(opts = {}) {
+  const windowMs = opts.windowMs ?? 6e4;
+  return [
+    limiter(opts.ipCeiling ?? MCP_IP_CEILING, windowMs),
+    limiter(opts.keyLimit ?? MCP_KEY_LIMIT, windowMs, mcpRateKey)
+  ];
+}
+
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_URIS = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.com/api/mcp/auth_callback",
+  "https://chatgpt.com/connector_platform_oauth_redirect",
+  "https://www.cursor.com/agents/mcp/oauth/callback"
+];
+var CHATGPT_CONNECTOR_CALLBACK = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]+$/;
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+var OPERATOR_ENTRY_FORM = "OAUTH_REDIRECT_HOST_ALLOWLIST entries must be full https redirect URIs such as https://partner.example/oauth/callback (no bare host, no query, no fragment)";
+function exactForm(url) {
+  return `${url.origin}${url.pathname}`;
+}
+function parseRedirectUriAllowlist(raw) {
+  if (!raw) return { uris: [], configError: null };
+  const uris = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    let url = null;
+    try {
+      url = trimmed.includes("://") ? new URL(trimmed) : null;
+    } catch {
+      url = null;
+    }
+    const valid = url !== null && url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && (url.port === "" || url.port === "443") && url.pathname !== "/";
+    if (!valid || url === null) {
+      return { uris: [], configError: `${OPERATOR_ENTRY_FORM}; got "${trimmed}"` };
+    }
+    uris.push(exactForm(url));
+  }
+  return { uris, configError: null };
+}
+function resolveOAuthRedirectAllowlist(opts = {}) {
+  const parsed = parseRedirectUriAllowlist(opts.explicitAllowlist);
+  return {
+    uris: [.../* @__PURE__ */ new Set([...DEFAULT_OAUTH_REDIRECT_URIS, ...parsed.uris])],
+    configError: parsed.configError
+  };
+}
+function checkRedirectUri(redirectUri, allowlist) {
+  if (allowlist.configError) return `OAuth is misconfigured: ${allowlist.configError}`;
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return "redirect_uri is not a valid absolute URL";
+  }
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    if (url.search) return "redirect_uri must not contain a query";
+    const exact = exactForm(url);
+    return allowlist.uris.includes(exact) || CHATGPT_CONNECTOR_CALLBACK.test(exact) ? null : "redirect_uri is not an allowed callback (an operator can add the full URI with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowlist) {
+  const refused = (refusal) => ({ refusal, allowed: [], dropped: [] });
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return refused("redirect_uris is required");
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return refused(`redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`);
+  }
+  const allowed = [];
+  const dropped = [];
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowlist);
+    if (reason) dropped.push({ uri, reason });
+    else allowed.push(uri);
+  }
+  return { refusal: allowed.length === 0 ? dropped[0].reason : null, allowed, dropped };
+}
+
+// src/lib/oauthAuthCode.ts
+function normalisePastedKey(raw) {
+  if (typeof raw !== "string") return "";
+  const trimmed = raw.trim();
+  const first = trimmed[0];
+  if (trimmed.length >= 2 && (first === '"' || first === "'" || first === "`") && trimmed.endsWith(first)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function pendingCodeRefusal(pending, redirectUri, now) {
+  if (!pending) return "unknown_code";
+  if (pending.redirectUri !== redirectUri) return "redirect_mismatch";
+  if (now > pending.expiresAt) return "expired";
+  return null;
+}
+function tokenResponse(apiKey) {
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1 year: validity is enforced by Convex on every call, not by this clock.
+    expires_in: 365 * 24 * 3600
+  };
+}
+
 // src/http.ts
 bootstrapHttp();
-initAnalytics();
-initFeatureFlags(getPostHogClient());
 var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
+function keyCheckCandidates() {
+  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+  return [primaryUrl, ...parseFallbackUrls(process.env.CONVEX_FALLBACK_URLS).map((u) => u.replace(/\/$/, ""))];
+}
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
@@ -232,6 +404,7 @@ var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_ALLOWLIST = resolveOAuthRedirectAllowlist({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
   if (origin && ALLOWED_ORIGINS.includes(origin)) {
@@ -266,53 +439,46 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code"],
+    // TEN-4548: no refresh grant (lib/oauthAuthCode.ts tokenResponse)
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
   });
 });
-var authLimiter = rateLimit({
+function logOAuthDoor(door, status, reason, uris) {
+  const list = uris === void 0 ? "" : ` uris=${JSON.stringify(uris.map(String)).slice(0, 600)}`;
+  process.stderr.write(`[oauth] door=${door} status=${status} reason=${JSON.stringify(reason)}${list}
+`);
+}
+var authLimiter = rateLimit2({
   windowMs: 6e4,
   max: 20,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many auth requests. Try again later." }
+  handler: (req, res) => {
+    logOAuthDoor(`${req.method} /authorize`, 429, "rate_limited_per_ip");
+    res.status(429).json({ error: "Too many auth requests. Try again later." });
+  }
 });
-var registeredClients = /* @__PURE__ */ new Map();
-var MAX_REGISTERED_CLIENTS = 500;
 app.post(
   "/register",
-  authLimiter,
   express.json(),
   (req, res) => {
-    if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
-      res.status(503).json({
-        error: "server_error",
-        error_description: "Registration limit reached. Try again later."
-      });
-      return;
-    }
-    const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
-      });
+    const { redirect_uris, client_name } = req.body ?? {};
+    const { refusal, allowed, dropped } = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_ALLOWLIST);
+    if (refusal) {
+      logOAuthDoor("POST /register", 400, refusal, Array.isArray(redirect_uris) ? redirect_uris : [redirect_uris]);
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
-    const clientId = `pb_client_${randomUUID2()}`;
-    const client = {
-      client_id: clientId,
-      redirect_uris,
-      client_name,
-      registeredAt: Date.now()
-    };
-    registeredClients.set(clientId, client);
+    const clientId = `pb_client_${randomUUID()}`;
+    const droppedUris = dropped.length > 0 ? dropped.map((d) => d.uri) : void 0;
+    logOAuthDoor("POST /register", 201, droppedUris ? "dropped_redirects" : "registered", droppedUris);
     res.status(201).json({
       client_id: clientId,
       client_name: client_name ?? "MCP Client",
-      redirect_uris,
+      redirect_uris: allowed,
       grant_types: ["authorization_code"],
       response_types: ["code"],
       token_endpoint_auth_method: "none"
@@ -320,29 +486,14 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
-var ACCESS_TOKEN_TTL = 3600;
-var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
     if (now > auth.expiresAt) pendingCodes.delete(code);
   }
-  for (const [id, client] of registeredClients) {
-    if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
-  }
-  for (const [token, entry] of accessTokens) {
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
-  }
-  for (const [ip, rec] of authFailures) {
+  for (const [credentialId, rec] of authFailures) {
     if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
-      authFailures.delete(ip);
-    }
-  }
-  if (authFailures.size > MAX_AUTH_FAILURE_ENTRIES) {
-    const sorted = [...authFailures.entries()].sort((a, b) => a[1].firstFailure - b[1].firstFailure);
-    for (let i = 0; i < sorted.length - MAX_AUTH_FAILURE_ENTRIES; i++) {
-      authFailures.delete(sorted[i][0]);
+      authFailures.delete(credentialId);
     }
   }
 }, 6e4);
@@ -663,11 +814,7 @@ a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
 <div class="stage">${bodyContent}</div>
 </body></html>`;
 }
-function providerDisplayName(clientName) {
-  const name = (clientName ?? "").trim();
-  if (!name) return "your assistant";
-  return name.length > 40 ? name.slice(0, 40) + "\u2026" : name;
-}
+var PROVIDER_NAME = "your assistant";
 function successPanelInner(workspaceName, redirectUrl, providerName) {
   return `
 <div class="orb-wrap">
@@ -690,8 +837,8 @@ function successPanelInner(workspaceName, redirectUrl, providerName) {
 <h1 class="ok-title">Product Brain is Live</h1>
 <p class="ok-lead">Return to your assistant, then say</p>
 <div class="ok-phrase-row">
-  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;Start PB&quot; and return to ${esc(providerName)}">
-    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>Start PB</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;${esc(PASTE_NOW)}&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>${esc(PASTE_NOW)}</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
     <span class="cmd-icon" aria-hidden="true">
       <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
     </span>
@@ -716,7 +863,7 @@ function errorPanelInner(title, trustedDetailHtml, retryUrl) {
 <p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
 <div class="err-actions">
   <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
-  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+  <a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
 </div>`;
 }
 var cmdScript = `
@@ -735,7 +882,7 @@ var cmdScript = `
       };
       try{
         if(navigator.clipboard&&navigator.clipboard.writeText){
-          navigator.clipboard.writeText('Start PB').then(done,done);
+          navigator.clipboard.writeText(${JSON.stringify(PASTE_NOW)}).then(done,done);
         }else{done()}
       }catch(e){done()}
     });
@@ -745,7 +892,7 @@ var cmdScript = `
 `;
 function authorizeFormPage(params) {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = params;
-  const providerName = providerDisplayName(params.client_name);
+  const providerName = PROVIDER_NAME;
   const body = `
 <!-- \u2500\u2500\u2500 CONNECT \u2500\u2500\u2500 -->
 <div class="panel" id="p-connect" data-state="connect">
@@ -764,7 +911,7 @@ function authorizeFormPage(params) {
     <div class="hint" id="hint" hidden></div>
     <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
   </form>
-  <div class="small-link"><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
+  <div class="small-link"><a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
 </div>
 
 <!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
@@ -845,7 +992,6 @@ ${cmdScript}
     e.preventDefault();
     var v=k.value.trim();
     if(!v){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Paste your key first';hint.removeAttribute('hidden');return}
-    if(v.indexOf('pb_sk_')!==0){iw.classList.add('has-error');hint.classList.add('is-error');hint.textContent='Key must start with pb_sk_';hint.removeAttribute('hidden');return}
     sb.disabled=true;bt.textContent='Verifying';
     show(pVerify);
 
@@ -903,15 +1049,18 @@ ${errorPanelInner(title, trustedDetailHtml, retryUrl)}
 }
 app.get("/authorize", authLimiter, (req, res) => {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
-  const cid = String(client_id ?? "");
-  const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+  if (refusal) {
+    logOAuthDoor("GET /authorize", 400, refusal);
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
   res.type("html").send(authorizeFormPage({
     redirect_uri: String(redirect_uri ?? ""),
     code_challenge: String(code_challenge ?? ""),
     code_challenge_method: String(code_challenge_method ?? "S256"),
     state: String(state ?? ""),
-    client_id: cid,
-    client_name: clientName
+    client_id: String(client_id ?? "")
   }));
 });
 app.post(
@@ -919,7 +1068,8 @@ app.post(
   authLimiter,
   express.urlencoded({ extended: false }),
   async (req, res) => {
-    const { api_key, redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.body;
+    const api_key = normalisePastedKey(req.body.api_key);
     const wantsJson = String(req.headers["accept"] ?? "").includes("application/json");
     const retryParams = new URLSearchParams({
       redirect_uri: redirect_uri ?? "",
@@ -930,94 +1080,62 @@ app.post(
     }).toString();
     const retryUrl = `/authorize?${retryParams}`;
     function sendError(title, trustedDetailHtml, status = 400) {
+      logOAuthDoor("POST /authorize", status, title);
       if (wantsJson) {
         res.status(status).json({ ok: false, title, detail: trustedDetailHtml });
       } else {
         res.status(status).type("html").send(authorizeErrorPage(title, trustedDetailHtml, retryUrl));
       }
     }
-    if (!api_key?.startsWith("pb_sk_")) {
-      sendError(
-        "Invalid key format",
-        "API keys start with <code>pb_sk_</code>. Check your key and try again."
-      );
+    if (isCrossSiteFormPost(req.headers["origin"], req.headers["sec-fetch-site"], baseUrl(req))) {
+      sendError("Request refused", "This form only accepts keys sent from its own sign-in page. Open the connect link again.", 403);
       return;
     }
-    if (!client_id) {
-      res.status(400).json({
-        error: "invalid_request",
-        error_description: "client_id is required"
-      });
+    const nowTs = Date.now();
+    const pasted = resolvePastedKey(api_key);
+    const lockout = authLockoutError(authFailures, pasted, nowTs);
+    if (lockout) {
+      const retryAfter = lockout.headers["Retry-After"];
+      res.setHeader("Retry-After", retryAfter);
+      sendError("Too many attempts", `This key was not recognized too many times. Try again in ${retryAfter}s.`, 429);
       return;
     }
-    if (!registeredClients.has(client_id)) {
-      if (typeof redirect_uri === "string" && redirect_uri.startsWith("https://")) {
-        registeredClients.set(client_id, {
-          client_id,
-          redirect_uris: [redirect_uri],
-          registeredAt: Date.now()
-        });
-        process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
-`);
-      } else {
-        res.status(400).json({
-          error: "invalid_request",
-          error_description: "Unknown client_id and redirect_uri is not a valid https URL"
-        });
-        return;
-      }
+    if (pasted.status !== "ok") {
+      if (pasted.status === "rejected") recordAuthFailure(authFailures, pasted.credentialId, nowTs);
+      sendError("Invalid key format", "API keys start with <code>pb_sk_</code>. Check your key and try again.");
+      return;
     }
-    const client = registeredClients.get(client_id);
-    if (!client.redirect_uris.includes(redirect_uri)) {
-      res.status(400).json({
-        error: "invalid_request",
-        error_description: "redirect_uri does not match any registered redirect for this client"
-      });
+    if (!client_id) {
+      logOAuthDoor("POST /authorize", 400, "client_id is required");
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+    if (redirectRefusal) {
+      logOAuthDoor("POST /authorize", 400, redirectRefusal);
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
       return;
     }
     let workspaceName = "Your Workspace";
-    try {
-      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
-      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
-      const candidates = [primaryUrl, ...fallbackUrls];
-      let foundUrl;
-      let anyDefinitiveReject = false;
-      for (const url2 of candidates) {
-        let checkData = null;
-        try {
-          const checkRes = await fetch(`${url2}/api/key-check`, {
-            method: "POST",
-            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
-            signal: AbortSignal.timeout(5e3)
-          });
-          checkData = await checkRes.json();
-        } catch {
-          continue;
-        }
-        if (checkData.ok) {
-          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
-          foundUrl = checkData.deploymentUrl ?? url2;
-          break;
-        }
-        anyDefinitiveReject = true;
-      }
-      if (!foundUrl) {
-        if (anyDefinitiveReject) {
-          sendError(
-            "Key not recognized",
-            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
-            401
-          );
-          return;
-        }
-        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
-      } else {
-        getKeyState(api_key).deploymentUrl = foundUrl;
-      }
-    } catch {
+    const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
+    const gate = keyVerdictGate(check.verdict, authFailures, pasted.credentialId, nowTs);
+    if (check.verdict === "ok") {
+      if (check.workspaceName) workspaceName = check.workspaceName;
+      getKeyState(api_key).deploymentUrl = check.deploymentUrl;
+    } else if (check.verdict === "rate_limited") {
+      sendError(
+        "Rate limited",
+        `This API key is valid but temporarily rate limited. Try again in ${check.retryAfterSeconds ?? 60}s.`,
+        429
+      );
+      return;
+    } else if (gate === "unauthorized") {
+      sendError("Key not recognized", "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.", 401);
+      return;
+    } else {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID2();
+    const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -1028,7 +1146,8 @@ app.post(
     url.searchParams.set("code", code);
     if (state) url.searchParams.set("state", state);
     const redirectUrl = url.toString();
-    const providerName = providerDisplayName(client.client_name);
+    const providerName = PROVIDER_NAME;
+    logOAuthDoor("POST /authorize", 200, "code_issued");
     if (wantsJson) {
       res.json({ ok: true, workspaceName, redirectUrl, providerName });
     } else {
@@ -1036,47 +1155,34 @@ app.post(
     }
   }
 );
-function issueTokens(apiKey) {
-  return {
-    access_token: apiKey,
-    token_type: "Bearer",
-    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
-    // Long TTL prevents unnecessary refresh cycles after restarts.
-    expires_in: 365 * 24 * 3600,
-    refresh_token: signRefreshToken(apiKey)
-  };
-}
 app.post(
   "/oauth/token",
-  authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
-    if (grant_type === "refresh_token") {
-      const verified = verifyRefreshToken(refresh_token);
-      if (!verified) {
-        res.status(400).json({
-          error: "invalid_grant",
-          error_description: "Invalid or expired refresh token"
-        });
-        return;
-      }
-      res.json(issueTokens(verified.apiKey));
-      return;
-    }
+    const { grant_type, code, code_verifier, redirect_uri } = req.body ?? {};
     if (grant_type !== "authorization_code") {
+      logOAuthDoor("POST /oauth/token", 400, "unsupported_grant_type");
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
     }
     const pending = pendingCodes.get(code);
-    if (!pending || pending.redirectUri !== redirect_uri) {
+    const codeRefusal = pendingCodeRefusal(pending, redirect_uri, Date.now());
+    if (codeRefusal === "expired") {
+      pendingCodes.delete(code);
+      logOAuthDoor("POST /oauth/token", 400, "expired");
+      res.status(400).json({ error: "invalid_grant", error_description: "authorization code expired" });
+      return;
+    }
+    if (codeRefusal || !pending) {
+      logOAuthDoor("POST /oauth/token", 400, codeRefusal ?? "unknown_code");
       res.status(400).json({ error: "invalid_grant" });
       return;
     }
     const challenge = createHash("sha256").update(code_verifier ?? "").digest("base64url");
     if (challenge !== pending.codeChallenge) {
       pendingCodes.delete(code);
+      logOAuthDoor("POST /oauth/token", 400, "pkce_failed");
       res.status(400).json({
         error: "invalid_grant",
         error_description: "PKCE verification failed"
@@ -1084,54 +1190,12 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json(issueTokens(pending.apiKey));
+    logOAuthDoor("POST /oauth/token", 200, "token_issued");
+    res.json(tokenResponse(pending.apiKey));
   }
 );
-var mcpLimiter = rateLimit({
-  windowMs: 6e4,
-  max: 120,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (req, res) => {
-    const r = req.rateLimit;
-    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
-    send429(res, buildRateLimitError({
-      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
-      limit: r?.limit ?? 120,
-      current: r?.used ?? 0,
-      id: req.body?.id ?? null
-      // mirror the JSON-RPC id when a POST body is present
-    }));
-  }
-});
+var mcpLimit = mcpLimiters();
 var authFailures = /* @__PURE__ */ new Map();
-var AUTH_FAILURE_MAX = 10;
-var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
-var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
-var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function checkAuthBlock(ip) {
-  const rec = authFailures.get(ip);
-  if (!rec) return false;
-  return rec.blockedUntil > Date.now();
-}
-function recordAuthFailure(ip) {
-  const now = Date.now();
-  const rec = authFailures.get(ip);
-  if (!rec) {
-    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
-    return;
-  }
-  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
-    rec.count = 1;
-    rec.firstFailure = now;
-    rec.blockedUntil = 0;
-  } else {
-    rec.count++;
-    if (rec.count >= AUTH_FAILURE_MAX) {
-      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
-    }
-  }
-}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
@@ -1176,25 +1240,6 @@ function evictStaleSessions() {
   }
 }
 setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  if (token.startsWith("pb_sk_")) {
-    return token;
-  }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens.get(token);
-    if (!entry) return null;
-    const now = Date.now();
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
-      accessTokens.delete(token);
-      return null;
-    }
-    return entry.apiKey;
-  }
-  return null;
-}
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -1215,25 +1260,25 @@ function logSessionLifecycle(event, sessionId, reason) {
   process.stderr.write(`[HTTP] ${ts} ${event} session=${sessionId}${r}
 `);
 }
-app.post("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    const rec = authFailures.get(reqIp);
-    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - Date.now()) / 1e3)) : 0;
-    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+app.post("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
         if (entry.keyHash !== hashKey(apiKey)) {
@@ -1254,6 +1299,22 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           entry.lastAccess = Date.now();
         }
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
+        const gate = keyVerdictGate(check.verdict, authFailures, auth.credentialId, Date.now());
+        if (gate === "unauthorized") {
+          logRequest("POST", "auth_fail");
+          send401(req, res);
+          return;
+        }
+        if (gate === "unavailable") {
+          res.status(503).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Product Brain could not verify this API key right now. Retry shortly." },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        if (check.verdict === "ok" || check.verdict === "rate_limited") getKeyState(apiKey).deploymentUrl = check.deploymentUrl;
         const keyH = hashKey(apiKey);
         const plan = planKeyAdmission(
           sessions,
@@ -1279,7 +1340,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           }));
           return;
         }
-        const sid = randomUUID2();
+        const sid = randomUUID();
         let initialized = false;
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: () => sid,
@@ -1293,6 +1354,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
         sessions.set(sid, reserved);
         transport.onclose = () => {
           const s = transport.sessionId ?? sid;
+          forgetStreamLifecycle(keyH, s);
           if (sessions.has(s)) {
             sessions.delete(s);
             logSessionLifecycle("session_deleted", s, "onclose");
@@ -1352,21 +1414,21 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     }
   }
 });
-app.get("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    const rec = authFailures.get(reqIp);
-    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - Date.now()) / 1e3)) : 0;
-    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+app.get("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1381,7 +1443,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({
@@ -1399,21 +1461,21 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     logRequest("GET", "error", sessionId);
   }
 });
-app.delete("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    const rec = authFailures.get(reqIp);
-    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - Date.now()) / 1e3)) : 0;
-    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
+app.delete("/mcp", ...mcpLimit, async (req, res) => {
+  const nowTs = Date.now();
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
+  if (lockout) {
+    send429(res, lockout);
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1428,7 +1490,7 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({
@@ -1463,10 +1525,6 @@ async function gracefulShutdown() {
     await entry.transport.close().catch(() => {
     });
   }
-  try {
-    await shutdownAnalytics();
-  } catch {
-  }
   process.exit(0);
 }
 var LISTEN_HOST = "0.0.0.0";