@productbrain/mcp 0.0.1-beta.945 → 0.0.1-beta.9450

package/dist/http.js

@@ -1,18 +1,20 @@
 import {
-  DEFAULT_CLOUD_URL,
   SERVER_VERSION,
-  bootstrapHttp,
   createProductBrainServer,
-  getKeyState,
-  hashKey,
-  initFeatureFlags,
-  runWithAuth
-} from "./chunk-VHL3Q5K6.js";
+  initFeatureFlags
+} from "./chunk-BCYOMOD2.js";
 import {
+  DEFAULT_CLOUD_URL,
+  apiKeysUrl,
+  bootstrapHttp,
+  forgetStreamLifecycle,
+  getKeyState,
   getPostHogClient,
+  hashKey,
   initAnalytics,
+  runWithAuth,
   shutdownAnalytics
-} from "./chunk-YMF3IQ5E.js";
+} from "./chunk-DKJ4X2D7.js";
 
 // src/http.ts
 import { createHash, randomUUID as randomUUID2 } from "crypto";
@@ -111,6 +113,255 @@ function verifyRefreshToken(token) {
   return { apiKey: payload.k };
 }
 
+// src/sessionCap.ts
+function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
+  if (cap < 1) {
+    throw new RangeError(`cap must be >= 1, got ${cap}`);
+  }
+  const { ttlMs, graceMs } = opts;
+  const isProtected = (s) => s.inFlight > 0 || now - s.lastAccess < graceMs;
+  const keyEntries = [];
+  for (const [id, session] of sessions2) {
+    if (session.keyHash === keyHash) {
+      keyEntries.push([id, session]);
+    }
+  }
+  const evictSet = /* @__PURE__ */ new Set();
+  for (const [id, session] of keyEntries) {
+    if (!isProtected(session) && now - session.lastAccess >= ttlMs) {
+      evictSet.add(id);
+    }
+  }
+  let survivors = keyEntries.filter(([id]) => !evictSet.has(id));
+  if (survivors.length >= cap) {
+    const idleSurvivors = survivors.filter(([, s]) => !isProtected(s)).sort(([, a], [, b]) => a.lastAccess - b.lastAccess);
+    for (const [id] of idleSurvivors) {
+      if (survivors.length < cap) break;
+      evictSet.add(id);
+      survivors = survivors.filter(([sid]) => sid !== id);
+    }
+  }
+  const evict = Array.from(evictSet);
+  const admit = survivors.length < cap;
+  let retryAfterSeconds = 0;
+  let retryIsPoll = false;
+  if (!admit) {
+    const graceBlockers = survivors.filter(([, s]) => s.inFlight === 0);
+    if (graceBlockers.length > 0) {
+      const minLastAccess = Math.min(...graceBlockers.map(([, s]) => s.lastAccess));
+      const msRemaining = graceMs - (now - minLastAccess);
+      retryAfterSeconds = Math.max(1, Math.ceil(msRemaining / 1e3));
+    } else {
+      retryAfterSeconds = 5;
+      retryIsPoll = true;
+    }
+  }
+  return { evict, admit, retryAfterSeconds, retryIsPoll };
+}
+function countKeySessions(sessions2, keyHash) {
+  let count = 0;
+  for (const session of sessions2.values()) {
+    if (session.keyHash === keyHash) count++;
+  }
+  return count;
+}
+
+// src/httpErrors.ts
+function clampSeconds(s) {
+  return Math.max(0, Math.round(s));
+}
+function build(reason, message, p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return {
+    status: 429,
+    headers: { "Retry-After": String(seconds) },
+    body: {
+      jsonrpc: "2.0",
+      id: p.id ?? null,
+      error: {
+        code: -32e3,
+        message,
+        data: {
+          reason,
+          retryAfterSeconds: seconds,
+          limit: p.limit,
+          current: p.current
+        }
+      }
+    }
+  };
+}
+function buildRateLimitError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "rate_limited",
+    `Too many requests \u2014 retry after ${seconds} s.`,
+    p
+  );
+}
+function buildAuthLockoutError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  return build(
+    "auth_lockout",
+    `Too many failed auth attempts \u2014 locked out, retry after ${seconds} s.`,
+    p
+  );
+}
+function buildSessionCapError(p) {
+  const seconds = clampSeconds(p.retryAfterSeconds);
+  const message = p.poll ? "Server busy \u2014 all sessions active; retry shortly." : `Too many active sessions for this key \u2014 retry after ${seconds} s.`;
+  return build("session_cap", message, p);
+}
+function send429(res, built) {
+  if (res.headersSent) return;
+  for (const [k, v] of Object.entries(built.headers)) {
+    res.setHeader(k, v);
+  }
+  res.status(built.status).json(built.body);
+}
+
+// src/authLockout.ts
+var AUTH_FAILURE_MAX = 10;
+var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
+var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
+var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+  if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
+    return { status: "absent" };
+  }
+  if (!authorizationHeader.startsWith("Bearer ")) {
+    return { status: "rejected" };
+  }
+  const token = authorizationHeader.slice(7).trim();
+  if (token === "") {
+    return { status: "rejected" };
+  }
+  if (token.startsWith("pb_sk_")) {
+    return { status: "ok", apiKey: token };
+  }
+  if (token.startsWith("pb_at_")) {
+    const entry = accessTokens2.get(token);
+    if (!entry) return { status: "rejected" };
+    if (now - entry.createdAt > accessTokenTtlMs) {
+      accessTokens2.delete(token);
+      return { status: "rejected" };
+    }
+    return { status: "ok", apiKey: entry.apiKey };
+  }
+  return { status: "rejected" };
+}
+function checkAuthBlock(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) return false;
+  return rec.blockedUntil > now;
+}
+function recordAuthFailure(failures, ip, now) {
+  const rec = failures.get(ip);
+  if (!rec) {
+    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    return;
+  }
+  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
+    rec.count = 1;
+    rec.firstFailure = now;
+    rec.blockedUntil = 0;
+  } else {
+    rec.count++;
+    if (rec.count >= AUTH_FAILURE_MAX) {
+      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
+    }
+  }
+}
+
+// src/lib/oauthRedirectAllowlist.ts
+var DEFAULT_OAUTH_REDIRECT_URIS = [
+  "https://claude.ai/api/mcp/auth_callback",
+  "https://claude.com/api/mcp/auth_callback",
+  "https://chatgpt.com/connector_platform_oauth_redirect"
+];
+var CHATGPT_CONNECTOR_CALLBACK = /^https:\/\/chatgpt\.com\/connector\/oauth\/[A-Za-z0-9_-]+$/;
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var MAX_REDIRECT_URI_LENGTH = 2048;
+var MAX_REGISTRATION_REDIRECTS = 10;
+var OPERATOR_ENTRY_FORM = "OAUTH_REDIRECT_HOST_ALLOWLIST entries must be full https redirect URIs such as https://partner.example/oauth/callback (no bare host, no query, no fragment)";
+function exactForm(url) {
+  return `${url.origin}${url.pathname}`;
+}
+function parseRedirectUriAllowlist(raw) {
+  if (!raw) return { uris: [], configError: null };
+  const uris = [];
+  for (const part of raw.split(",")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    let url = null;
+    try {
+      url = trimmed.includes("://") ? new URL(trimmed) : null;
+    } catch {
+      url = null;
+    }
+    const valid = url !== null && url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash && (url.port === "" || url.port === "443") && url.pathname !== "/";
+    if (!valid || url === null) {
+      return { uris: [], configError: `${OPERATOR_ENTRY_FORM}; got "${trimmed}"` };
+    }
+    uris.push(exactForm(url));
+  }
+  return { uris, configError: null };
+}
+function resolveOAuthRedirectAllowlist(opts = {}) {
+  const parsed = parseRedirectUriAllowlist(opts.explicitAllowlist);
+  return {
+    uris: [.../* @__PURE__ */ new Set([...DEFAULT_OAUTH_REDIRECT_URIS, ...parsed.uris])],
+    configError: parsed.configError
+  };
+}
+function checkRedirectUri(redirectUri, allowlist) {
+  if (allowlist.configError) return `OAuth is misconfigured: ${allowlist.configError}`;
+  if (typeof redirectUri !== "string" || redirectUri.length === 0) {
+    return "redirect_uri is required";
+  }
+  if (redirectUri.length > MAX_REDIRECT_URI_LENGTH) {
+    return `redirect_uri is longer than ${MAX_REDIRECT_URI_LENGTH} characters`;
+  }
+  let url;
+  try {
+    url = new URL(redirectUri);
+  } catch {
+    return "redirect_uri is not a valid absolute URL";
+  }
+  if (url.username || url.password) return "redirect_uri must not contain credentials";
+  if (url.hash) return "redirect_uri must not contain a fragment";
+  const host = url.hostname.toLowerCase();
+  if (url.protocol === "http:") {
+    return LOOPBACK_HOSTS.includes(host) ? null : "redirect_uri must use https (http is allowed only for localhost, 127.0.0.1 or [::1])";
+  }
+  if (url.protocol === "https:") {
+    if (url.port && url.port !== "443") return "redirect_uri must use the default https port (443)";
+    if (url.search) return "redirect_uri must not contain a query";
+    const exact = exactForm(url);
+    return allowlist.uris.includes(exact) || CHATGPT_CONNECTOR_CALLBACK.test(exact) ? null : "redirect_uri is not an allowed callback (an operator can add the full URI with OAUTH_REDIRECT_HOST_ALLOWLIST)";
+  }
+  return "redirect_uri scheme is not allowed (use https, or http on loopback)";
+}
+function checkRegistrationRedirects(redirectUris, allowlist) {
+  if (!Array.isArray(redirectUris) || redirectUris.length === 0) return "redirect_uris is required";
+  if (redirectUris.length > MAX_REGISTRATION_REDIRECTS) {
+    return `redirect_uris may hold at most ${MAX_REGISTRATION_REDIRECTS} entries`;
+  }
+  for (const uri of redirectUris) {
+    const reason = checkRedirectUri(uri, allowlist);
+    if (reason) return reason;
+  }
+  return null;
+}
+
+// src/lib/oauthAuthCode.ts
+function pendingCodeRefusal(pending, redirectUri, now) {
+  if (!pending) return "unknown_code";
+  if (pending.redirectUri !== redirectUri) return "redirect_mismatch";
+  if (now > pending.expiresAt) return "expired";
+  return null;
+}
+
 // src/http.ts
 bootstrapHttp();
 initAnalytics();
@@ -125,6 +376,7 @@ var app = express();
 app.set("trust proxy", 1);
 app.use(express.json());
 var ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? "https://claude.ai").split(",").map((o) => o.trim()).filter(Boolean);
+var OAUTH_REDIRECT_ALLOWLIST = resolveOAuthRedirectAllowlist({ explicitAllowlist: process.env.OAUTH_REDIRECT_HOST_ALLOWLIST });
 app.use((_req, res, next) => {
   const origin = _req.headers.origin;
   if (origin && ALLOWED_ORIGINS.includes(origin)) {
@@ -135,7 +387,7 @@ app.use((_req, res, next) => {
     "Access-Control-Allow-Headers",
     "Content-Type, Authorization, Mcp-Session-Id, Last-Event-Id"
   );
-  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
+  res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id, Retry-After");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -187,11 +439,9 @@ app.post(
       return;
     }
     const { redirect_uris, client_name } = req.body;
-    if (!Array.isArray(redirect_uris) || redirect_uris.length === 0) {
-      res.status(400).json({
-        error: "invalid_client_metadata",
-        error_description: "redirect_uris is required"
-      });
+    const refusal = checkRegistrationRedirects(redirect_uris, OAUTH_REDIRECT_ALLOWLIST);
+    if (refusal) {
+      res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
     const clientId = `pb_client_${randomUUID2()}`;
@@ -609,7 +859,7 @@ function errorPanelInner(title, trustedDetailHtml, retryUrl) {
 <p class="err-msg" data-field="err-msg">${trustedDetailHtml}</p>
 <div class="err-actions">
   <a href="${esc(retryUrl)}" class="btn-secondary" data-retry-link>&larr; Try again</a>
-  <a href="https://productbrain.io" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
+  <a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer" class="btn-secondary">Get an API key &rarr;</a>
 </div>`;
 }
 var cmdScript = `
@@ -657,7 +907,7 @@ function authorizeFormPage(params) {
     <div class="hint" id="hint" hidden></div>
     <button type="submit" class="btn-primary" id="sb" disabled><span id="bt">Connect</span></button>
   </form>
-  <div class="small-link"><a href="https://productbrain.io" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
+  <div class="small-link"><a href="${esc(apiKeysUrl())}" target="_blank" rel="noopener noreferrer">No key? Generate one &rarr;</a></div>
 </div>
 
 <!-- \u2500\u2500\u2500 VERIFYING \u2500\u2500\u2500 -->
@@ -796,6 +1046,11 @@ ${errorPanelInner(title, trustedDetailHtml, retryUrl)}
 }
 app.get("/authorize", authLimiter, (req, res) => {
   const { redirect_uri, code_challenge, code_challenge_method, state, client_id } = req.query;
+  const refusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+  if (refusal) {
+    res.status(400).json({ error: "invalid_request", error_description: refusal });
+    return;
+  }
   const cid = String(client_id ?? "");
   const clientName = cid && registeredClients.has(cid) ? registeredClients.get(cid).client_name : void 0;
   res.type("html").send(authorizeFormPage({
@@ -837,28 +1092,22 @@ app.post(
       return;
     }
     if (!client_id) {
-      res.status(400).json({
-        error: "invalid_request",
-        error_description: "client_id is required"
-      });
+      res.status(400).json({ error: "invalid_request", error_description: "client_id is required" });
+      return;
+    }
+    const redirectRefusal = checkRedirectUri(redirect_uri, OAUTH_REDIRECT_ALLOWLIST);
+    if (redirectRefusal) {
+      res.status(400).json({ error: "invalid_request", error_description: redirectRefusal });
       return;
     }
     if (!registeredClients.has(client_id)) {
-      if (typeof redirect_uri === "string" && redirect_uri.startsWith("https://")) {
-        registeredClients.set(client_id, {
-          client_id,
-          redirect_uris: [redirect_uri],
-          registeredAt: Date.now()
-        });
-        process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
-`);
-      } else {
-        res.status(400).json({
-          error: "invalid_request",
-          error_description: "Unknown client_id and redirect_uri is not a valid https URL"
-        });
+      if (registeredClients.size >= MAX_REGISTERED_CLIENTS) {
+        res.status(503).json({ error: "server_error", error_description: "Registration limit reached. Try again later." });
         return;
       }
+      registeredClients.set(client_id, { client_id, redirect_uris: [redirect_uri], registeredAt: Date.now() });
+      process.stderr.write(`[authorize] auto-re-registered stale client_id after restart
+`);
     }
     const client = registeredClients.get(client_id);
     if (!client.redirect_uris.includes(redirect_uri)) {
@@ -875,6 +1124,7 @@ app.post(
       const candidates = [primaryUrl, ...fallbackUrls];
       let foundUrl;
       let anyDefinitiveReject = false;
+      let rateLimitedRetryAfter;
       for (const url2 of candidates) {
         let checkData = null;
         try {
@@ -892,9 +1142,21 @@ app.post(
           foundUrl = checkData.deploymentUrl ?? url2;
           break;
         }
+        if (checkData.error === "rate_limited") {
+          rateLimitedRetryAfter = checkData.retryAfterSeconds;
+          continue;
+        }
         anyDefinitiveReject = true;
       }
       if (!foundUrl) {
+        if (rateLimitedRetryAfter != null && !anyDefinitiveReject) {
+          sendError(
+            "Rate limited",
+            `This API key is valid but temporarily rate limited. Try again in ${rateLimitedRetryAfter}s.`,
+            429
+          );
+          return;
+        }
         if (anyDefinitiveReject) {
           sendError(
             "Key not recognized",
@@ -963,7 +1225,13 @@ app.post(
       return;
     }
     const pending = pendingCodes.get(code);
-    if (!pending || pending.redirectUri !== redirect_uri) {
+    const codeRefusal = pendingCodeRefusal(pending, redirect_uri, Date.now());
+    if (codeRefusal === "expired") {
+      pendingCodes.delete(code);
+      res.status(400).json({ error: "invalid_grant", error_description: "authorization code expired" });
+      return;
+    }
+    if (codeRefusal || !pending) {
       res.status(400).json({ error: "invalid_grant" });
       return;
     }
@@ -985,85 +1253,63 @@ var mcpLimiter = rateLimit({
   max: 120,
   standardHeaders: true,
   legacyHeaders: false,
-  message: { error: "Too many requests. Try again later." }
+  handler: (req, res) => {
+    const r = req.rateLimit;
+    const reset = r?.resetTime?.getTime?.() ?? Date.now() + 6e4;
+    send429(res, buildRateLimitError({
+      retryAfterSeconds: Math.max(1, Math.ceil((reset - Date.now()) / 1e3)),
+      limit: r?.limit ?? 120,
+      current: r?.used ?? 0,
+      id: req.body?.id ?? null
+      // mirror the JSON-RPC id when a POST body is present
+    }));
+  }
 });
 var authFailures = /* @__PURE__ */ new Map();
-var AUTH_FAILURE_MAX = 10;
-var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
-var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
-var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function checkAuthBlock(ip) {
-  const rec = authFailures.get(ip);
-  if (!rec) return false;
-  return rec.blockedUntil > Date.now();
-}
-function recordAuthFailure(ip) {
-  const now = Date.now();
-  const rec = authFailures.get(ip);
-  if (!rec) {
-    authFailures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
-    return;
-  }
-  if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
-    rec.count = 1;
-    rec.firstFailure = now;
-    rec.blockedUntil = 0;
-  } else {
-    rec.count++;
-    if (rec.count >= AUTH_FAILURE_MAX) {
-      rec.blockedUntil = now + AUTH_BLOCK_DURATION_MS;
-    }
-  }
-}
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: SERVER_VERSION, transport: "http" });
 });
 var sessions = /* @__PURE__ */ new Map();
 var SESSION_TTL_MS = 30 * 60 * 1e3;
 var MAX_SESSIONS = 200;
-var MAX_SESSIONS_PER_KEY = 5;
+var EVICT_GRACE_MS = 6e4;
+var MAX_SESSIONS_PER_KEY = Math.max(
+  1,
+  Math.min(MAX_SESSIONS - 1, Number(process.env.MCP_MAX_SESSIONS_PER_KEY) || 25)
+);
 function evictStaleSessions() {
   const now = Date.now();
   for (const [id, entry] of sessions) {
     if (now - entry.lastAccess > SESSION_TTL_MS) {
-      logSessionLifecycle("session_deleted", id, "ttl");
+      logSessionLifecycle(
+        "session_deleted",
+        id,
+        entry.inFlight > 0 ? "inflight_leak" : "ttl"
+      );
       entry.transport.close().catch(() => {
       });
       sessions.delete(id);
     }
   }
   if (sessions.size > MAX_SESSIONS) {
-    const sorted = [...sessions.entries()].sort(
-      (a, b) => a[1].lastAccess - b[1].lastAccess
-    );
-    for (let i = 0; i < sorted.length - MAX_SESSIONS; i++) {
+    const sorted = [...sessions.entries()].filter(([, e]) => e.inFlight === 0).sort((a, b) => a[1].lastAccess - b[1].lastAccess);
+    const overflow = sessions.size - MAX_SESSIONS;
+    for (let i = 0; i < Math.min(overflow, sorted.length); i++) {
       logSessionLifecycle("session_deleted", sorted[i][0], "eviction");
       sorted[i][1].transport.close().catch(() => {
       });
       sessions.delete(sorted[i][0]);
     }
-  }
-}
-setInterval(evictStaleSessions, 6e4);
-function extractBearerKey(req) {
-  const header = req.headers?.authorization;
-  if (typeof header !== "string" || !header.startsWith("Bearer ")) return null;
-  const token = header.slice(7).trim();
-  if (token.startsWith("pb_sk_")) {
-    return token;
-  }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens.get(token);
-    if (!entry) return null;
-    const now = Date.now();
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) {
-      accessTokens.delete(token);
-      return null;
+    if (sessions.size > MAX_SESSIONS) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString();
+      process.stderr.write(
+        `[HTTP] ${ts} session_cap_breach size=${sessions.size} max=${MAX_SESSIONS} reason=all_inflight (no idle sessions to evict; TTL backstop will reclaim)
+`
+      );
     }
-    return entry.apiKey;
   }
-  return null;
 }
+setInterval(evictStaleSessions, 6e4);
 function send401(req, res) {
   const base = baseUrl(req);
   res.status(401).set(
@@ -1086,21 +1332,25 @@ function logSessionLifecycle(event, sessionId, reason) {
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   const reqStart = Date.now();
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       if (sessionId && sessions.has(sessionId)) {
         const entry = sessions.get(sessionId);
         if (entry.keyHash !== hashKey(apiKey)) {
@@ -1111,41 +1361,82 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           });
           return;
         }
-        entry.lastAccess = Date.now();
-        await entry.transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        try {
+          entry.inFlight++;
+          entry.lastAccess = Date.now();
+          await entry.transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", sessionId, Date.now() - reqStart);
+        } finally {
+          entry.inFlight--;
+          entry.lastAccess = Date.now();
+        }
       } else if (!sessionId && isInitializeRequest(req.body)) {
         const keyH = hashKey(apiKey);
-        let keySessionCount = 0;
-        for (const entry of sessions.values()) {
-          if (entry.keyHash === keyH) keySessionCount++;
-        }
-        if (keySessionCount >= MAX_SESSIONS_PER_KEY) {
-          res.status(429).json({
-            jsonrpc: "2.0",
-            error: { code: -32e3, message: "Too many sessions for this API key" },
-            id: null
+        const plan = planKeyAdmission(
+          sessions,
+          keyH,
+          MAX_SESSIONS_PER_KEY,
+          Date.now(),
+          { ttlMs: SESSION_TTL_MS, graceMs: EVICT_GRACE_MS }
+        );
+        for (const sid2 of plan.evict) {
+          const victim = sessions.get(sid2);
+          sessions.delete(sid2);
+          victim?.transport.close().catch(() => {
           });
+          logSessionLifecycle("session_deleted", sid2, "lru_evict");
+        }
+        if (!plan.admit) {
+          send429(res, buildSessionCapError({
+            retryAfterSeconds: plan.retryAfterSeconds,
+            limit: MAX_SESSIONS_PER_KEY,
+            current: countKeySessions(sessions, keyH),
+            poll: plan.retryIsPoll,
+            id: req.body?.id ?? null
+          }));
           return;
         }
+        const sid = randomUUID2();
+        let initialized = false;
         const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID2(),
-          onsessioninitialized: (sid) => {
-            sessions.set(sid, { transport, lastAccess: Date.now(), keyHash: keyH });
-            logSessionLifecycle("session_created", sid);
+          sessionIdGenerator: () => sid,
+          onsessioninitialized: (s) => {
+            initialized = true;
+            logSessionLifecycle("session_created", s);
           }
+          // log only — no map write
         });
+        const reserved = { transport, lastAccess: Date.now(), keyHash: keyH, inFlight: 1 };
+        sessions.set(sid, reserved);
         transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid) {
-            logSessionLifecycle("session_deleted", sid, "onclose");
-            sessions.delete(sid);
+          const s = transport.sessionId ?? sid;
+          forgetStreamLifecycle(keyH, s);
+          if (sessions.has(s)) {
+            sessions.delete(s);
+            logSessionLifecycle("session_deleted", s, "onclose");
           }
         };
-        const server = createProductBrainServer();
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        try {
+          const server = createProductBrainServer();
+          await server.connect(transport);
+          await transport.handleRequest(req, res, req.body);
+          logRequest("POST", "ok", transport.sessionId ?? void 0, Date.now() - reqStart);
+        } catch (e) {
+          transport.onclose = void 0;
+          sessions.delete(sid);
+          throw e;
+        } finally {
+          if (!initialized) {
+            transport.onclose = void 0;
+            if (sessions.delete(sid)) logSessionLifecycle("session_deleted", sid, "init_rejected");
+          } else {
+            const e = sessions.get(sid);
+            if (e) {
+              e.inFlight--;
+              e.lastAccess = Date.now();
+            }
+          }
+        }
       } else if (sessionId) {
         process.stderr.write(
           `[HTTP] ${(/* @__PURE__ */ new Date()).toISOString()} session_stale sessionId=${sessionId} (likely server restart \u2014 instructing client to re-initialise)
@@ -1181,17 +1472,21 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1206,7 +1501,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({
@@ -1226,17 +1521,21 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
   const reqIp = req.ip ?? "unknown";
-  if (checkAuthBlock(reqIp)) {
-    res.status(429).json({ error: "Too many failed auth attempts. Try again later." });
+  const nowTs = Date.now();
+  if (checkAuthBlock(authFailures, reqIp, nowTs)) {
+    const rec = authFailures.get(reqIp);
+    const retryAfterSeconds = rec ? Math.max(0, Math.ceil((rec.blockedUntil - nowTs) / 1e3)) : 0;
+    send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const apiKey = extractBearerKey(req);
-  if (!apiKey) {
+  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    recordAuthFailure(reqIp);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
     send401(req, res);
     return;
   }
+  const apiKey = auth.apiKey;
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId) {
     res.status(400).send("Missing Mcp-Session-Id header");
@@ -1251,7 +1550,7 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     return;
   }
   try {
-    await runWithAuth({ apiKey }, async () => {
+    await runWithAuth({ apiKey, mcpSessionId: sessionId }, async () => {
       const entry = sessions.get(sessionId);
       if (entry.keyHash !== hashKey(apiKey)) {
         res.status(403).json({