@productbrain/mcp 0.0.1-beta.190 → 0.0.1-beta.192

package/dist/http.js

@@ -7,7 +7,7 @@ import {
   hashKey,
   initFeatureFlags,
   runWithAuth
-} from "./chunk-ZF6N62QQ.js";
+} from "./chunk-26IS4THT.js";
 import {
   getPostHogClient,
   initAnalytics,
@@ -15,7 +15,7 @@ import {
 } from "./chunk-YMF3IQ5E.js";
 
 // src/http.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -54,6 +54,63 @@ function appLogoMarkup(opts = {}) {
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
+// src/lib/refresh-token.ts
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
+var PREFIX = "pb_rt_";
+var secret = (() => {
+  const fromEnv = process.env.MCP_REFRESH_SECRET;
+  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
+  if (process.env.NODE_ENV === "production") {
+    console.warn(
+      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
+    );
+  }
+  return randomBytes(32);
+})();
+function sign(payloadB64) {
+  return createHmac("sha256", secret).update(payloadB64).digest();
+}
+function signRefreshToken(apiKey) {
+  const payload = {
+    k: apiKey,
+    i: Date.now(),
+    j: randomUUID()
+  };
+  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+  const sigB64 = sign(payloadB64).toString("base64url");
+  return `${PREFIX}${payloadB64}.${sigB64}`;
+}
+function verifyRefreshToken(token) {
+  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
+  const body = token.slice(PREFIX.length);
+  const dot = body.indexOf(".");
+  if (dot <= 0 || dot === body.length - 1) return null;
+  const payloadB64 = body.slice(0, dot);
+  const sigB64 = body.slice(dot + 1);
+  let providedSig;
+  try {
+    providedSig = Buffer.from(sigB64, "base64url");
+  } catch {
+    return null;
+  }
+  const expectedSig = sign(payloadB64);
+  if (providedSig.length !== expectedSig.length) return null;
+  if (!timingSafeEqual(providedSig, expectedSig)) return null;
+  let payload;
+  try {
+    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
+    payload = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
+    return null;
+  }
+  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
+  return { apiKey: payload.k };
+}
+
 // src/http.ts
 bootstrapHttp();
 initAnalytics();
@@ -137,7 +194,7 @@ app.post(
       });
       return;
     }
-    const clientId = `pb_client_${randomUUID()}`;
+    const clientId = `pb_client_${randomUUID2()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -158,10 +215,6 @@ app.post(
 var pendingCodes = /* @__PURE__ */ new Map();
 var ACCESS_TOKEN_TTL = 3600;
 var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var refreshTokens = /* @__PURE__ */ new Map();
-var MAX_REFRESH_TOKENS = 2e3;
-var MAX_REFRESH_TOKENS_PER_KEY = 20;
 var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
@@ -171,15 +224,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of refreshTokens) {
-    if (now - entry.createdAt > REFRESH_TOKEN_TTL_MS) refreshTokens.delete(token);
-  }
-  if (refreshTokens.size > MAX_REFRESH_TOKENS) {
-    const sorted = [...refreshTokens.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-    for (let i = 0; i < sorted.length - MAX_REFRESH_TOKENS; i++) {
-      refreshTokens.delete(sorted[i][0]);
-    }
-  }
   for (const [token, entry] of accessTokens) {
     if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
   }
@@ -415,12 +459,22 @@ ${appLogoStyles}
   color:var(--fg-bright);opacity:0;
 }
 .panel:not([hidden]) .ok-title{animation:rise 600ms ease-out 380ms forwards}
-.ok-sentence{
-  margin:20px auto 0;font-size:16px;line-height:1.6;color:var(--fg2);
+.ok-lead{
+  margin:18px auto 0;max-width:22em;font-size:16px;line-height:1.55;color:var(--fg2);
   opacity:0;
-  display:flex;align-items:center;justify-content:center;gap:8px;flex-wrap:wrap;
 }
-.panel:not([hidden]) .ok-sentence{animation:rise 600ms ease-out 520ms forwards}
+.panel:not([hidden]) .ok-lead{animation:rise 600ms ease-out 500ms forwards}
+.ok-phrase-row{
+  margin-top:14px;display:flex;align-items:center;justify-content:center;
+  opacity:0;
+}
+.panel:not([hidden]) .ok-phrase-row{animation:rise 600ms ease-out 620ms forwards}
+.cmd.is-copied .cmd-quote-part{display:none}
+.success-cta-wrap{
+  margin-top:48px;width:100%;opacity:0;
+}
+.panel:not([hidden]) .success-cta-wrap{animation:rise 600ms ease-out 780ms forwards}
+a.btn-primary.success-cta{color:var(--btn-fg);text-decoration:none}
 
 .cmd{
   display:inline-flex;align-items:center;gap:8px;vertical-align:middle;
@@ -441,16 +495,6 @@ ${appLogoStyles}
 .cmd.is-copied .cmd-icon{color:var(--green);opacity:1}
 .cmd .cmd-icon svg{width:12px;height:12px;stroke:currentColor;fill:none;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}
 
-.return-link{
-  display:block;margin:36px auto 0;width:fit-content;
-  font-family:var(--font-mono);font-size:11px;letter-spacing:0.18em;
-  text-transform:uppercase;color:var(--fg4);text-decoration:none;
-  border-bottom:1px dotted currentColor;padding-bottom:2px;
-  opacity:0;transition:color 140ms;
-}
-.panel:not([hidden]) .return-link{animation:rise 600ms ease-out 760ms forwards}
-.return-link:hover{color:var(--fg2)}
-
 /* error specifics */
 .err-title{
   font-family:var(--font-display);font-weight:600;
@@ -514,7 +558,7 @@ ${appLogoStyles}
 }
 function providerDisplayName(clientName) {
   const name = (clientName ?? "").trim();
-  if (!name) return "your agent";
+  if (!name) return "your assistant";
   return name.length > 40 ? name.slice(0, 40) + "\u2026" : name;
 }
 function successPanelInner(workspaceName, redirectUrl, providerName) {
@@ -536,18 +580,19 @@ function successPanelInner(workspaceName, redirectUrl, providerName) {
   <div class="orb-core"><div class="orb-dot"></div></div>
 </div>
 <div class="eyebrow success"><span class="dot"></span>Connected</div>
-<h1 class="ok-title">Product Brain is live.</h1>
-<p class="ok-sentence">
-  <span>Then say</span>
-  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy 'Start PB' and return to ${esc(providerName)}">
-    <span data-cmd-text>Start PB</span>
+<h1 class="ok-title">Product Brain is Live</h1>
+<p class="ok-lead">Return to your assistant, then say</p>
+<div class="ok-phrase-row">
+  <button class="cmd" type="button" data-cmd-pill data-redirect="${esc(redirectUrl)}" aria-label="Copy &quot;Start PB&quot; and return to ${esc(providerName)}">
+    <span class="cmd-quote-part" aria-hidden="true">&ldquo;</span><span data-cmd-text>Start PB</span><span class="cmd-quote-part" aria-hidden="true">&rdquo;</span>
     <span class="cmd-icon" aria-hidden="true">
       <svg data-cmd-svg viewBox="0 0 24 24"><rect x="9" y="9" width="11" height="11" rx="2"/><path d="M5 15V6a2 2 0 0 1 2-2h9"/></svg>
     </span>
   </button>
-  <span>in <span data-provider>${esc(providerName)}</span>.</span>
-</p>
-<a class="return-link" href="${esc(redirectUrl)}" data-return-link>Return to <span data-provider>${esc(providerName)}</span> &rarr;</a>
+</div>
+<div class="success-cta-wrap">
+  <a class="btn-primary success-cta" href="${esc(redirectUrl)}">Continue in ${esc(providerName)}</a>
+</div>
 <!-- workspace name retained as data hook for tests, hidden from view -->
 <span hidden data-field="ws-name">${esc(workspaceName)}</span>`;
 }
@@ -579,7 +624,7 @@ var cmdScript = `
         pill.classList.add('is-copied');
         if(textEl)textEl.textContent='Copied';
         if(svgEl)svgEl.innerHTML='<polyline points="4 12 10 18 20 6"/>';
-        setTimeout(function(){if(redirectUrl)window.location.href=redirectUrl},900);
+        setTimeout(function(){if(redirectUrl)window.location.assign(redirectUrl)},900);
       };
       try{
         if(navigator.clipboard&&navigator.clipboard.writeText){
@@ -677,7 +722,7 @@ ${cmdScript}
   function showSuccess(workspaceName,redirectUrl,providerName){
     var tpl=document.getElementById('tpl-connected');
     var safeWs=String(workspaceName||'').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
-    var safeProv=String(providerName||'your agent').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
+    var safeProv=String(providerName||'your assistant').replace(/[<>&]/g,function(c){return{'<':'&lt;','>':'&gt;','&':'&amp;'}[c]});
     var safeUrl=String(redirectUrl||'').replace(/"/g,'&quot;').replace(/[<>]/g,function(c){return{'<':'&lt;','>':'&gt;'}[c]});
     var html=tpl.innerHTML.split('__WS__').join(safeWs).split('__URL__').join(safeUrl).split('__PROVIDER__').join(safeProv);
     pOk.innerHTML=html;
@@ -865,7 +910,7 @@ app.post(
     } catch {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID();
+    const code = randomUUID2();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -885,42 +930,13 @@ app.post(
   }
 );
 function issueTokens(apiKey) {
-  const now = Date.now();
-  const refreshToken = `pb_rt_${randomUUID()}`;
-  let perKeyCount = 0;
-  let oldestKeyForApiKey = null;
-  let oldestAtForApiKey = Infinity;
-  for (const [k, v] of refreshTokens) {
-    if (v.apiKey === apiKey) {
-      perKeyCount++;
-      if (v.createdAt < oldestAtForApiKey) {
-        oldestAtForApiKey = v.createdAt;
-        oldestKeyForApiKey = k;
-      }
-    }
-  }
-  if (perKeyCount >= MAX_REFRESH_TOKENS_PER_KEY && oldestKeyForApiKey) {
-    refreshTokens.delete(oldestKeyForApiKey);
-  }
-  if (refreshTokens.size >= MAX_REFRESH_TOKENS) {
-    let oldestKey = null;
-    let oldestAt = Infinity;
-    for (const [k, v] of refreshTokens) {
-      if (v.createdAt < oldestAt) {
-        oldestAt = v.createdAt;
-        oldestKey = k;
-      }
-    }
-    if (oldestKey) refreshTokens.delete(oldestKey);
-  }
-  refreshTokens.set(refreshToken, { apiKey, createdAt: now });
   return {
     access_token: apiKey,
     token_type: "Bearer",
     // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
     // Long TTL prevents unnecessary refresh cycles after restarts.
     expires_in: 365 * 24 * 3600,
-    refresh_token: refreshToken
+    refresh_token: signRefreshToken(apiKey)
   };
 }
 app.post(
@@ -931,19 +947,15 @@ app.post(
   (req, res) => {
     const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
     if (grant_type === "refresh_token") {
-      const entry = refreshTokens.get(refresh_token);
-      if (!entry) {
-        res.status(400).json({ error: "invalid_grant", error_description: "Invalid refresh token" });
-        return;
-      }
-      if (Date.now() - entry.createdAt > REFRESH_TOKEN_TTL_MS) {
-        refreshTokens.delete(refresh_token);
-        res.status(400).json({ error: "invalid_grant", error_description: "Refresh token expired" });
+      const verified = verifyRefreshToken(refresh_token);
+      if (!verified) {
+        res.status(400).json({
+          error: "invalid_grant",
+          error_description: "Invalid or expired refresh token"
+        });
         return;
       }
-      const apiKey = entry.apiKey;
-      refreshTokens.delete(refresh_token);
-      res.json(issueTokens(apiKey));
+      res.json(issueTokens(verified.apiKey));
       return;
     }
     if (grant_type !== "authorization_code") {
@@ -1117,7 +1129,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           return;
         }
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
+          sessionIdGenerator: () => randomUUID2(),
           onsessioninitialized: (sid) => {
             sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
             logSessionLifecycle("session_created", sid);
@@ -1134,6 +1146,16 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
         await server.connect(transport);
         await transport.handleRequest(req, res, req.body);
         logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+      } else if (sessionId) {
+        process.stderr.write(
+          `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
+`
+        );
+        res.status(404).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Session not found \u2014 re-initialise" },
+          id: null
+        });
       } else {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_invalid no valid session ID (client may have omitted Mcp-Session-Id)
@@ -1171,8 +1193,16 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale GET sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {
@@ -1208,8 +1238,16 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).send("Invalid or missing session ID");
+  if (!sessionId) {
+    res.status(400).send("Missing Mcp-Session-Id header");
+    return;
+  }
+  if (!sessions.has(sessionId)) {
+    process.stderr.write(
+      `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale DELETE sessionId=${sessionId}
+`
+    );
+    res.status(404).send("Session not found \u2014 re-initialise");
     return;
   }
   try {