@ractive-ch/tab-mcp 0.3.0 → 0.4.0

package/index.js

@@ -751,9 +751,11 @@ class TabAssertionVerifier {
   #seen = new Map;
   #perPerson = new Map;
   #sweptAt = Number.NEGATIVE_INFINITY;
-  constructor(oidc, keys) {
+  #maxSeen;
+  constructor(oidc, keys, maxSeen = MAX_SEEN_JTI) {
     this.#oidc = oidc;
     this.#keys = keys ?? new JwksCache(oidc.assertionJwksUrl);
+    this.#maxSeen = maxSeen;
   }
   async verify(token, address, now = Date.now()) {
     const { payload } = await verifyJwt(token, this.#keys, {
@@ -799,15 +801,18 @@ ${jti}`;
       throw new JwtError("replayed", "the assertion was already used");
     }
     const mine = this.#perPerson.get(key) ?? 0;
-    if (mine >= MAX_JTI_PER_PERSON || this.#seen.size >= MAX_SEEN_JTI) {
+    if (mine >= MAX_JTI_PER_PERSON) {
       throw new JwtError("busy", "too many assertions at once");
     }
+    if (this.#seen.size >= this.#maxSeen) {
+      throw new JwtError("relay_busy", "the relay is checking too many assertions; try again shortly");
+    }
     this.#seen.set(seenKey, exp + CLOCK_LEEWAY_MS);
     this.#perPerson.set(key, mine + 1);
     return key;
   }
   #sweep(now) {
-    if (now - this.#sweptAt < 1000 && this.#seen.size < MAX_SEEN_JTI)
+    if (now - this.#sweptAt < 1000 && this.#seen.size < this.#maxSeen)
       return;
     this.#sweptAt = now;
     for (const [seenKey, until] of this.#seen) {
@@ -997,13 +1002,15 @@ function truncateIp(ip) {
   }
   return `${v6.slice(0, 3).map((g) => g.toString(16)).join(":")}::/48`;
 }
+function errorName(error) {
+  return error instanceof Error ? error.name : typeof error;
+}
 function installCrashLogging(logger, exit = (code) => process.exit(code)) {
-  const name = (error) => error instanceof Error ? error.name : typeof error;
   const onRejection = (error) => {
-    logger.error("process.unhandled_rejection", { error: name(error) });
+    logger.error("process.unhandled_rejection", { error: errorName(error) });
   };
   const onException = (error) => {
-    logger.error("process.uncaught_exception", { error: name(error) });
+    logger.error("process.uncaught_exception", { error: errorName(error) });
     exit(1);
   };
   process.on("unhandledRejection", onRejection);
@@ -1191,7 +1198,7 @@ function parseTabMessage(text) {
   }
 }
 // package.json
-var version = "0.3.0";
+var version = "0.4.0";
 
 // src/exchange.ts
 var RelayErrorCode = {
@@ -1203,7 +1210,8 @@ var RelayErrorCode = {
   tooLarge: -31006,
   badResponse: -31007,
   storeUnavailable: -31008,
-  signedOut: -31009
+  signedOut: -31009,
+  restarting: -31010
 };
 var encoder = new TextEncoder;
 var NULL_BODY_STATUSES = new Set([204, 205, 304]);
@@ -1232,6 +1240,11 @@ function rpcErrorBody(rpcId, code, message, data) {
     error["data"] = data;
   return JSON.stringify({ jsonrpc: "2.0", id: rpcId ?? null, error });
 }
+var TAB_STARTED = new Set([
+  "tab_stream",
+  "relay_passed",
+  "relay_wrapped"
+]);
 
 class Exchange {
   id;
@@ -1243,9 +1256,6 @@ class Exchange {
   #options;
   #resolve;
   #state = "waiting";
-  #relayStarted = false;
-  #tabStarted = false;
-  #wrap = false;
   #wrapped = "";
   #controller;
   #atBoundary = true;
@@ -1271,7 +1281,7 @@ class Exchange {
     return this.#state === "done";
   }
   onResponse(msg) {
-    if (this.#tabStarted) {
+    if (TAB_STARTED.has(this.#state)) {
       this.#badResponse("http.response after http.response.start");
       return;
     }
@@ -1294,7 +1304,7 @@ class Exchange {
       }
       this.#respond(response, msg.status);
       this.#finish("ok");
-    } else if (this.#state === "streaming" && this.#relayStarted) {
+    } else if (this.#state === "relay_stream") {
       if (!this.#account(msg.body))
         return;
       if (msg.body !== "")
@@ -1303,11 +1313,17 @@ class Exchange {
     }
   }
   onStart(msg) {
-    if (this.#tabStarted) {
+    if (this.#state === "done")
+      return;
+    if (TAB_STARTED.has(this.#state)) {
       this.#badResponse("http.response.start sent twice");
       return;
     }
-    this.#tabStarted = true;
+    const eventStream = isEventStream(msg.headers);
+    if (this.isListen && !eventStream) {
+      this.#badResponse("a listen response must be an event stream");
+      return;
+    }
     if (this.#state === "waiting") {
       if (NULL_BODY_STATUSES.has(msg.status)) {
         this.#badResponse(`status ${msg.status} cannot be streamed`);
@@ -1320,25 +1336,29 @@ class Exchange {
         this.#badResponse("the response headers are invalid");
         return;
       }
-      this.#openStream(msg.status, headers);
-    } else if (this.#state === "streaming" && this.#relayStarted) {
-      this.#wrap = !isEventStream(msg.headers);
+      this.#openStream(msg.status, headers, "tab_stream");
+    } else {
+      this.#state = eventStream ? "relay_passed" : "relay_wrapped";
     }
   }
   onChunk(data) {
-    if (this.#state !== "streaming")
+    if (!this.#streaming)
+      return;
+    if (this.#state === "relay_stream") {
+      this.#badResponse("http.response.chunk before http.response.start");
       return;
+    }
     if (!this.#account(data))
       return;
-    if (this.#wrap)
+    if (this.#state === "relay_wrapped")
       this.#wrapped += data;
     else
       this.#write(data);
   }
   onEnd() {
-    if (this.#state !== "streaming")
+    if (!this.#streaming)
       return;
-    if (this.#wrap && this.#wrapped !== "")
+    if (this.#state === "relay_wrapped" && this.#wrapped !== "")
       this.#write(sseEvent(this.#wrapped));
     this.#finish("ok");
   }
@@ -1360,6 +1380,11 @@ class Exchange {
       this.#finish("page_gone_retry");
       return;
     }
+    if (reply !== undefined && "error" in reply) {
+      const e = reply.error;
+      this.fail(e.status, e.code, e.message, false, e.headers);
+      return;
+    }
     const body = reply?.retry === false ? reply.body : undefined;
     if (body === undefined) {
       this.fail(503, RelayErrorCode.tabGone, "The page closed its connection to the relay.", false);
@@ -1375,11 +1400,11 @@ class Exchange {
     }
     this.#finish("page_gone");
   }
-  fail(status, code, message, cancelTab) {
+  fail(status, code, message, cancelTab, headers = {}) {
     if (this.#state === "done")
       return;
     if (this.#state === "waiting") {
-      this.#respond(this.#errorResponse(status, code, message), status);
+      this.#respond(this.#errorResponse(status, code, message, headers), status);
     } else if (this.#atBoundary && this.#options.rpcId !== undefined) {
       this.#write(sseEvent(rpcErrorBody(this.#options.rpcId, code, message)));
     }
@@ -1393,7 +1418,8 @@ class Exchange {
   }
   #account(data) {
     this.#bodyBytes += Buffer.byteLength(data);
-    if (this.isListen || this.#bodyBytes <= this.#options.maxBodyBytes) {
+    const unbounded = this.isListen && (this.#state === "tab_stream" || this.#state === "relay_passed");
+    if (unbounded || this.#bodyBytes <= this.#options.maxBodyBytes) {
       return true;
     }
     this.fail(502, RelayErrorCode.tooLarge, "The page sent a response that is too large.", true);
@@ -1408,10 +1434,9 @@ class Exchange {
   #startRelayStream() {
     if (this.#state !== "waiting")
       return;
-    this.#relayStarted = true;
-    this.#openStream(200, this.#headers({ "content-type": "text/event-stream" }));
+    this.#openStream(200, this.#headers({ "content-type": "text/event-stream" }), "relay_stream");
   }
-  #openStream(status, headers) {
+  #openStream(status, headers, state) {
     const stream = new ReadableStream({
       start: (controller) => {
         this.#controller = controller;
@@ -1432,12 +1457,12 @@ class Exchange {
       this.#badResponse("the response could not be built");
       return;
     }
-    this.#state = "streaming";
+    this.#state = state;
     this.#respond(response, status);
     this.#scheduleKeepAlive();
   }
   #write(text) {
-    if (this.#state !== "streaming" || this.#controller === undefined || text === "")
+    if (!this.#streaming || this.#controller === undefined || text === "")
       return;
     try {
       this.#controller.enqueue(encoder.encode(text));
@@ -1454,16 +1479,19 @@ class Exchange {
     }
     this.#scheduleKeepAlive();
   }
+  get #streaming() {
+    return this.#state !== "waiting" && this.#state !== "done";
+  }
   #scheduleKeepAlive() {
     clearTimeout(this.#keepAliveTimer);
-    if (this.#state !== "streaming" || this.#wrap) {
-      if (this.#state === "streaming") {
-        this.#keepAliveTimer = setTimeout(() => {
-          this.#write(`: keep-alive
+    if (!this.#streaming)
+      return;
+    if (this.#state === "relay_wrapped") {
+      this.#keepAliveTimer = setTimeout(() => {
+        this.#write(`: keep-alive
 
 `);
-        }, this.#options.keepAliveMs);
-      }
+      }, this.#options.keepAliveMs);
       return;
     }
     this.#keepAliveTimer = setTimeout(() => {
@@ -1483,8 +1511,10 @@ class Exchange {
     }
     return headers;
   }
-  #errorResponse(status, code, message) {
+  #errorResponse(status, code, message, extra) {
     const headers = this.#headers({ "content-type": "application/json" });
+    for (const [k, v] of Object.entries(extra))
+      headers.set(k, v);
     return new Response(rpcErrorBody(this.#options.rpcId, code, message), {
       status,
       headers
@@ -1498,7 +1528,7 @@ class Exchange {
   #finish(outcome, closeStream = true) {
     if (this.#state === "done")
       return;
-    const wasStreaming = this.#state === "streaming";
+    const wasStreaming = this.#streaming;
     this.#state = "done";
     this.outcome = outcome;
     clearTimeout(this.#startTimer);
@@ -1527,19 +1557,28 @@ function notOpenText(appName) {
 function signedOutText(appName) {
   return `The page is open, but nobody is signed in to it. Ask the user to sign in to ${pageName(appName)}, then try again.`;
 }
+function restartingText() {
+  return "The relay is restarting. Try again in a few seconds.";
+}
 function phaseText(phase, appName) {
+  if (phase === "restarting" || phase === "restarting_gone") {
+    return restartingText();
+  }
   return phase === "signed_out" ? signedOutText(appName) : notOpenText(appName);
 }
 function goneDuringCallText(appName) {
   return `The page closed while the tool was running, so it may or may not have finished. Ask the user to open ${pageName(appName)} and keep it in front (on a phone, in split screen), then check the result before trying again.`;
 }
+function restartedDuringCallText() {
+  return "The relay restarted while the tool was running, so it may or may not have finished. Check the result before trying again in a few seconds.";
+}
 function notOpenAnswer(body, rpcId, appName, phase, relay) {
   if (rpcId === undefined)
     return;
   const id = rpcId;
   const method = body["method"];
   if (method === "tools/call") {
-    const text = phase === "gone" ? goneDuringCallText(appName) : phaseText(phase, appName);
+    const text = phase === "gone" ? goneDuringCallText(appName) : phase === "restarting_gone" ? restartedDuringCallText() : phaseText(phase, appName);
     return JSON.stringify({
       jsonrpc: "2.0",
       id,
@@ -1574,7 +1613,7 @@ function notOpenAnswer(body, rpcId, appName, phase, relay) {
     jsonrpc: "2.0",
     id,
     error: {
-      code: phase === "gone" ? RelayErrorCode.tabGone : RelayErrorCode.pageNotOpen,
+      code: phase === "gone" ? RelayErrorCode.tabGone : phase === "restarting" || phase === "restarting_gone" ? RelayErrorCode.restarting : RelayErrorCode.pageNotOpen,
       message: phaseText(phase, appName)
     }
   });
@@ -1614,6 +1653,13 @@ class RateLimiter {
     bucket.tokens -= 1;
     return true;
   }
+  available(key, now = Date.now()) {
+    const bucket = this.#buckets.get(key);
+    if (bucket === undefined)
+      return this.#capacity >= 1;
+    const elapsed = Math.max(0, now - bucket.updatedAt) / 1000;
+    return Math.min(this.#capacity, bucket.tokens + elapsed * this.#refill) >= 1;
+  }
   sweep(now = Date.now()) {
     for (const [key, b] of this.#buckets) {
       const elapsed = Math.max(0, now - b.updatedAt) / 1000;
@@ -1699,7 +1745,7 @@ async function defaultLookup(hostname) {
   const records = await Bun.dns.lookup(hostname, {});
   return records.map((r) => r.address);
 }
-var INVISIBLE = /[\u034F\u115F\u1160\u17B4\u17B5\u2800\u3164\uFFA0]/gu;
+var INVISIBLE = /[\u034F\u115F\u1160\u17B4\u17B5\u2800\u3164\uFFA0]|\p{Variation_Selector}/gu;
 function displayName(raw) {
   let cleaned = raw.normalize("NFC").replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ").replace(/\p{Cf}/gu, "").replace(INVISIBLE, "");
   cleaned = cleaned.replace(/\s+/g, " ").trim();
@@ -1722,10 +1768,17 @@ function isIpLiteral(hostname) {
   const h = hostname.replace(/^\[|\]$/g, "");
   return parseIpv4(h) !== undefined || parseIpv6(h) !== undefined;
 }
+function limitKey(hostname) {
+  const h = hostname.replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  if (isIpLiteral(h))
+    return h;
+  return h.split(".").slice(-2).join(".");
+}
 
 class ClientMetadataFetcher {
   #cache = new Map;
   #perHost = new RateLimiter({ capacity: 5, refillPerSecond: 0.2 });
+  #perDomain = new RateLimiter({ capacity: 15, refillPerSecond: 0.6 });
   #global = new RateLimiter({ capacity: 30, refillPerSecond: 1 });
   #allowedHosts;
   #logger;
@@ -1749,22 +1802,28 @@ class ClientMetadataFetcher {
     const url = this.#checkUrl(clientId);
     const now = this.#now();
     const cached = this.#cache.get(clientId);
-    if (cached !== undefined && cached.until > now)
+    if (cached !== undefined && cached.until > now) {
+      this.#cache.delete(clientId);
+      this.#cache.set(clientId, cached);
       return cached.meta;
-    if (!this.#perHost.take(url.host, now)) {
+    }
+    const key = limitKey(url.hostname);
+    if (!this.#perHost.available(url.host, now) || !this.#perDomain.available(key, now)) {
       throw new ClientMetadataError("rate_limited", "Too many requests for this AI app's details. Try again in a minute.");
     }
     if (!this.#global.take("all", now)) {
       throw new ClientMetadataError("rate_limited", "The relay is busy. Try again in a minute.");
     }
+    this.#perHost.take(url.host, now);
+    this.#perDomain.take(key, now);
     const address = await this.#vettedAddress(url);
     const { meta, ttlMs } = await this.#fetchDocument(url, clientId, address);
+    this.#cache.delete(clientId);
     if (this.#cache.size >= MAX_CACHE_ENTRIES) {
       const oldest = this.#cache.keys().next().value;
       if (oldest !== undefined)
         this.#cache.delete(oldest);
     }
-    this.#cache.delete(clientId);
     this.#cache.set(clientId, { meta, until: now + ttlMs });
     return meta;
   }
@@ -1899,6 +1958,27 @@ class ClientMetadataFetcher {
     }
   }
 }
+var DOMAIN_SHAPED = /(?:[\p{L}\p{N}](?:[\p{L}\p{N}-]*[\p{L}\p{N}])?\.)+\p{L}{2,63}(?![\p{L}\p{N}])/gu;
+function comparable(name) {
+  return name.normalize("NFKC").replace(/\p{M}/gu, "").replace(/[\u3002\uFF0E\uFF61]/g, ".").toLowerCase();
+}
+function asciiHost(token) {
+  try {
+    return new URL(`https://${token}/`).hostname;
+  } catch {
+    return token;
+  }
+}
+function foreignDomain(name, hostname) {
+  const host = hostname.toLowerCase();
+  for (const [match] of comparable(name).matchAll(DOMAIN_SHAPED)) {
+    const token = asciiHost(match);
+    const own = token === host || host.endsWith(`.${token}`) || token.endsWith(`.${host}`);
+    if (!own)
+      return true;
+  }
+  return false;
+}
 function validateDocument(doc, clientId, url) {
   const invalid = (message) => new ClientMetadataError("invalid_metadata", message);
   if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
@@ -1915,9 +1995,12 @@ function validateDocument(doc, clientId, url) {
   if (typeof name !== "string" || displayName(name) === "") {
     throw invalid("The AI app's details have no client_name.");
   }
-  if (/\(\s*[^()\s]*[a-z0-9-]\.[a-z]{2,}[^()]*\)/i.test(displayName(name))) {
+  if (/\(\s*[^()\s]*[a-z0-9-]\.[a-z]{2,}[^()]*\)/i.test(comparable(displayName(name)))) {
     throw invalid("The AI app's name contains a web address in parentheses, which this relay does not show.");
   }
+  if (foreignDomain(displayName(name), url.hostname)) {
+    throw invalid("The AI app's name contains a web address other than its own, which this relay does not show.");
+  }
   const uris = d["redirect_uris"];
   if (!Array.isArray(uris) || uris.length === 0 || uris.length > MAX_REDIRECT_URIS || !uris.every((u) => typeof u === "string" && isRedirectUri(u))) {
     throw invalid("The AI app's details have no valid redirect_uris.");
@@ -2132,14 +2215,17 @@ class ProviderDiscovery {
 class OidcPairing {
   kind = "oidc";
   #config;
+  #maxFlows;
   #publicUrl;
   #logger;
   #discovery;
   #jwks;
   #flows = new Map;
+  #flowOf = new Map;
   #mismatched = new Set;
   constructor(options) {
     this.#config = options.config;
+    this.#maxFlows = options.maxFlows ?? MAX_FLOWS;
     this.#publicUrl = options.publicUrl;
     this.#logger = options.logger;
     this.#discovery = new ProviderDiscovery(options.config.issuer, options.development);
@@ -2176,7 +2262,7 @@ class OidcPairing {
     }
     return `<p>When you click Connect, sign in at <strong>${host}</strong> with the account you use in the page. No code is needed.</p>`;
   }
-  async check(target, _form, _admit, context) {
+  async check(target, _form, admit, context) {
     if (!target.pairingOpen) {
       return {
         ok: false,
@@ -2201,16 +2287,25 @@ class OidcPairing {
       return this.#unavailable(error);
     }
     this.#sweep();
-    if (this.#flows.size >= MAX_FLOWS) {
+    this.#dropFlow(context.requestId);
+    if (this.#flows.size >= this.#maxFlows) {
       return {
         ok: false,
         message: "Too many sign-ins are open right now. Wait a few minutes and try again.",
         reason: "busy"
       };
     }
+    if (!admit()) {
+      return {
+        ok: false,
+        message: "Too many attempts for this page. Wait a few minutes and try again.",
+        reason: "rate_limited"
+      };
+    }
     const state = random2(24);
     const nonce = random2(24);
     const verifier = random2(32);
+    this.#flowOf.set(context.requestId, state);
     this.#flows.set(state, {
       requestId: context.requestId,
       browserId: context.browserId,
@@ -2250,6 +2345,7 @@ class OidcPairing {
     }
     this.#flows.delete(state);
     const requestId = flow.requestId;
+    this.#flowOf.delete(requestId);
     const fail = (reason, message) => ({
       requestId,
       result: { ok: false, message, reason }
@@ -2376,12 +2472,25 @@ class OidcPairing {
       reason: "provider_unavailable"
     };
   }
+  forget(requestId) {
+    this.#dropFlow(requestId);
+    this.#mismatched.delete(requestId);
+  }
+  #dropFlow(requestId) {
+    const state = this.#flowOf.get(requestId);
+    if (state !== undefined)
+      this.#flows.delete(state);
+    this.#flowOf.delete(requestId);
+  }
   #sweep() {
     const now = Date.now();
     for (const [state, flow] of this.#flows) {
       if (flow.expiresAt > now)
         break;
       this.#flows.delete(state);
+      if (this.#flowOf.get(flow.requestId) === state) {
+        this.#flowOf.delete(flow.requestId);
+      }
     }
   }
 }
@@ -2519,6 +2628,8 @@ var AUTH_CODE_TTL_MS = 60000;
 var MAX_PENDING = 1e4;
 var MAX_PENDING_PER_IP = 10;
 var MAX_PENDING_PER_ADDRESS = 20;
+var MAX_PENDING_PER_ADDRESS_IP = 5;
+var REFRESH_REUSE_WINDOW_MS = 24 * 60 * 60000;
 var MAX_CODES = 1e4;
 var MAX_FORM_BYTES = 8192;
 var MAX_STATE_LENGTH = 1024;
@@ -2599,6 +2710,10 @@ class AuthorizationServer {
     refillPerSecond: 1 / 30
   });
   #tokenPerIp = new RateLimiter({ capacity: 30, refillPerSecond: 1 });
+  #refreshesPerGrant = new RateLimiter({
+    capacity: 20,
+    refillPerSecond: 1 / 60
+  });
   constructor(host, testMode) {
     this.#host = host;
     this.#authCodeTtlMs = testMode?.authCodeTtlMs ?? AUTH_CODE_TTL_MS;
@@ -2610,7 +2725,8 @@ class AuthorizationServer {
           config: oidc,
           publicUrl: () => host.publicUrl(),
           logger: host.logger,
-          development: host.config.development
+          development: host.config.development,
+          ...testMode?.oidcMaxFlows === undefined ? {} : { maxFlows: testMode.oidcMaxFlows }
         })
       },
       ...testMode?.pairingMethods
@@ -2776,7 +2892,7 @@ class AuthorizationServer {
       if (error instanceof ClientMetadataError) {
         this.#host.logger.info("oauth.client_refused", {
           reason: error.reason,
-          host: hostOf(clientId).slice(0, 100)
+          host: URL.canParse(clientId) ? hostOf(clientId).slice(0, 100) : "(not a URL)"
         });
         return this.#errorPage(400, error.message);
       }
@@ -2822,10 +2938,11 @@ class AuthorizationServer {
     if (scopes === undefined) {
       return fail("invalid_scope", `the only scope is "${SCOPE}"`);
     }
-    if (this.#host.session(addressId) === undefined) {
-      return this.#offlinePage(client, `/authorize${new URL(req.url).search}`, this.#errorUrl(redirectUri, state, "access_denied", "the user cancelled the connection"));
+    const session = this.#host.session(addressId);
+    if (session === undefined || !session.pairingOpen) {
+      return this.#offlinePage(client, `/authorize${new URL(req.url).search}`, this.#errorUrl(redirectUri, state, "access_denied", "the user cancelled the connection"), session !== undefined);
     }
-    const method = this.#methods[this.#host.session(addressId)?.site.pairing ?? "code"];
+    const method = this.#methods[session.site.pairing];
     if (method?.prepare !== undefined) {
       try {
         await method.prepare();
@@ -2837,9 +2954,10 @@ class AuthorizationServer {
       }
     }
     this.#sweepPending();
-    if (this.#pending.size >= MAX_PENDING || (this.#pendingPerIp.get(ip) ?? 0) >= MAX_PENDING_PER_IP || (this.#pendingPerAddress.get(addressId) ?? 0) >= MAX_PENDING_PER_ADDRESS) {
+    if (this.#pending.size >= MAX_PENDING || (this.#pendingPerIp.get(ip) ?? 0) >= MAX_PENDING_PER_IP) {
       return this.#errorPage(429, "Too many connection requests are open right now. Wait a few minutes and try again.");
     }
+    this.#makeRoom(addressId, ip);
     const pending = {
       id: random3(24),
       expiresAt: Date.now() + PENDING_TTL_MS,
@@ -2861,6 +2979,36 @@ class AuthorizationServer {
     this.#pendingPerIp.set(p.ip, (this.#pendingPerIp.get(p.ip) ?? 0) + 1);
     this.#pendingPerAddress.set(p.addressId, (this.#pendingPerAddress.get(p.addressId) ?? 0) + 1);
   }
+  #makeRoom(addressId, ip) {
+    const count = this.#pendingPerAddress.get(addressId) ?? 0;
+    if (count < MAX_PENDING_PER_ADDRESS_IP)
+      return;
+    const byIp = new Map;
+    for (const p of this.#pending.values()) {
+      if (p.addressId !== addressId)
+        continue;
+      const list = byIp.get(p.ip);
+      if (list === undefined)
+        byIp.set(p.ip, [p]);
+      else
+        list.push(p);
+    }
+    const own = byIp.get(ip) ?? [];
+    if (own.length >= MAX_PENDING_PER_ADDRESS_IP) {
+      if (own[0] !== undefined)
+        this.#dropPending(own[0]);
+      return;
+    }
+    if (count < MAX_PENDING_PER_ADDRESS)
+      return;
+    let most = [];
+    for (const list of byIp.values()) {
+      if (list.length >= most.length)
+        most = list;
+    }
+    if (most[0] !== undefined)
+      this.#dropPending(most[0]);
+  }
   #dropPending(p) {
     if (!this.#pending.delete(p.id))
       return;
@@ -2873,18 +3021,22 @@ class AuthorizationServer {
     };
     dec(this.#pendingPerIp, p.ip);
     dec(this.#pendingPerAddress, p.addressId);
-  }
-  #offlinePage(client, retryUrl, cancelUrl, error) {
-    const errorHtml = error === undefined ? "" : `<p class="error" role="alert">${escapeHtml(error)}</p>`;
-    const body = `<h1>Open the page first</h1>
-${errorHtml}
-<p><strong>${escapeHtml(client.name)}</strong> (${escapeHtml(client.host)}) wants to use the tools of a web page, but that page is not open right now.</p>
-<p>Open the page, click \u201CConnect your AI app\u201D, then try again here.</p>
+    for (const method of Object.values(this.#methods))
+      method?.forget?.(p.id);
+  }
+  #offlinePage(client, retryUrl, cancelUrl, connected = false) {
+    const who = `<strong>${escapeHtml(client.name)}</strong> (${escapeHtml(client.host)})`;
+    const title = connected ? "Open \u201CConnect your AI app\u201D first" : "Open the page first";
+    const intro = connected ? `<p>${who} wants to use the tools of a web page, but that page is not connecting right now.</p>
+<p>In the page, click \u201CConnect your AI app\u201D, then try again here.</p>` : `<p>${who} wants to use the tools of a web page, but that page is not open right now.</p>
+<p>Open the page, click \u201CConnect your AI app\u201D, then try again here.</p>`;
+    const body = `<h1>${title}</h1>
+${intro}
 <div class="actions">
 <a class="button primary" href="${escapeHtml(retryUrl)}">Try again</a>
 <a class="button" href="${escapeHtml(cancelUrl)}">Cancel</a>
 </div>`;
-    return this.#page(200, "Open the page first", body);
+    return this.#page(200, title, body);
   }
   async authorizeSubmit(req, ip) {
     const origin = req.headers.get("origin");
@@ -2963,7 +3115,7 @@ ${errorHtml}
         client: pending.client.host,
         reason: result.reason
       });
-      return this.#pairingPage(pending, browser.id, result.message, result.reason === "rate_limited" ? 429 : 400);
+      return this.#pairingPage(pending, browser.id, result.message, result.reason === "rate_limited" || result.reason === "busy" ? 429 : 400);
     }
     return this.#paired(pending, method.kind, result);
   }
@@ -3307,7 +3459,10 @@ ${cancel}
         throw new OAuthError(400, "invalid_scope", "scope exceeds the grant");
       }
     }
-    if (!await this.#host.store.markUsed(hash, now)) {
+    if (!this.#refreshesPerGrant.take(record.grantId, now)) {
+      throw new OAuthError(429, "temporarily_unavailable", "too many refreshes for this connection; try again in a minute");
+    }
+    if (!await this.#host.store.markUsed(hash, now, now + REFRESH_REUSE_WINDOW_MS)) {
       await this.#reuseDetected(record);
       throw invalid("the refresh token was already used; the connection was revoked");
     }
@@ -3416,6 +3571,7 @@ ${cancel}
     this.#guessesPerAddressIp.sweep(now);
     this.#guessesPerAddress.sweep(now);
     this.#tokenPerIp.sweep(now);
+    this.#refreshesPerGrant.sweep(now);
   }
 }
 
@@ -3438,11 +3594,8 @@ function clientHost(clientId) {
     return "";
   }
 }
-function messageId(parsed) {
-  if ("message" in parsed) {
-    return "id" in parsed.message ? parsed.message.id : undefined;
-  }
-  return parsed.id;
+function frameId(data) {
+  return /"id"\s*:\s*"([^"\\]{1,64})"/.exec(data.slice(0, 256))?.[1];
 }
 
 class TabSession {
@@ -3455,7 +3608,9 @@ class TabSession {
   appName;
   codes;
   identity;
+  identityUnchecked = false;
   pending = new Map;
+  #listenGrants = new Map;
   #ws;
   #host;
   #state = "new";
@@ -3520,15 +3675,14 @@ class TabSession {
       this.#protocolError("bad_message", "binary frames are not allowed");
       return;
     }
-    const tooLarge = Buffer.byteLength(data) > this.limits.maxMessageBytes;
-    const parsed = parseTabMessage(data);
-    if (tooLarge) {
-      const id = messageId(parsed);
+    if (Buffer.byteLength(data) > this.limits.maxMessageBytes) {
+      const id = frameId(data);
       this.#sendError("too_large", "message exceeds maxMessageBytes", id);
       const exchange = id === undefined ? undefined : this.pending.get(id);
       exchange?.fail(502, RelayErrorCode.tooLarge, "The page sent a response that is too large.", true);
       return;
     }
+    const parsed = parseTabMessage(data);
     if (!parsed.ok) {
       if (this.#state === "new") {
         this.#protocolError("bad_message", parsed.error);
@@ -3657,7 +3811,7 @@ class TabSession {
     } catch (error) {
       this.#host.logger.error("store.error", {
         op: "listGrants",
-        message: error instanceof Error ? error.message : "unknown"
+        error: errorName(error)
       });
     }
     if (this.#state !== "hello")
@@ -3689,7 +3843,7 @@ class TabSession {
       library: `${library.name}@${library.version}`,
       replaced: replaced !== undefined
     });
-    this.#host.ready?.(this);
+    this.#host.ready(this);
   }
   #serialIdentity(run) {
     const next = this.#identityChain.then(run);
@@ -3710,6 +3864,13 @@ class TabSession {
     this.#missedPongs++;
     this.send({ type: "ping", t: Date.now() });
   }
+  listenStreams(grantId) {
+    let n = 0;
+    for (const g of this.#listenGrants.values())
+      if (g === grantId)
+        n++;
+    return n;
+  }
   forward(input) {
     this.#lastRequestAt = Date.now();
     const id = `r${++this.#nextRequest}`;
@@ -3731,16 +3892,19 @@ class TabSession {
       },
       onDone: (e) => {
         this.pending.delete(id);
+        this.#listenGrants.delete(id);
         this.#lastRequestAt = Date.now();
         input.onDone(e);
       },
       ...input.pageGone === undefined ? {} : { pageGone: input.pageGone }
     });
     this.pending.set(id, exchange);
+    if (input.isListen)
+      this.#listenGrants.set(id, input.grant.grantId);
     const sent = this.send({
       type: "http.request",
       id,
-      method: input.method,
+      method: "POST",
       path: "/mcp",
       headers: input.headers,
       body: input.body,
@@ -3842,11 +4006,12 @@ class MemoryTokenStore {
     const r = this.#records.get(hash);
     return r === undefined ? undefined : copy(r);
   }
-  async markUsed(hash, now) {
+  async markUsed(hash, now, keepUntil) {
     const r = this.#records.get(hash);
     if (r === undefined || r.usedAt !== undefined)
       return false;
     r.usedAt = now;
+    r.expiresAt = Math.min(r.expiresAt, keepUntil);
     return true;
   }
   async revoke(selector, options) {
@@ -3899,7 +4064,8 @@ class MemoryTokenStore {
 
 // src/store/sqlite.ts
 import { Database } from "bun:sqlite";
-var SCHEMA_VERSION = 3;
+var SCHEMA_VERSION = 4;
+var REUSE_WINDOW_MS = 86400000;
 function toRecord(row) {
   const record = {
     hash: row.hash,
@@ -3962,6 +4128,8 @@ class SqliteTokenStore {
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_grant ON tokens (grant_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_address ON tokens (address_id)");
       this.#db.run("CREATE INDEX IF NOT EXISTS tokens_expires ON tokens (expires_at)");
+      this.#db.query(`UPDATE tokens SET expires_at = min(expires_at, used_at + $window)
+					WHERE kind = 'refresh' AND used_at IS NOT NULL`).run({ window: REUSE_WINDOW_MS });
       this.#db.run(`PRAGMA user_version = ${SCHEMA_VERSION}`);
     })();
   }
@@ -4002,8 +4170,9 @@ class SqliteTokenStore {
     const row = this.#db.query("SELECT * FROM tokens WHERE hash = $hash").get({ hash });
     return row === null ? undefined : toRecord(row);
   }
-  async markUsed(hash, now) {
-    const result = this.#db.query("UPDATE tokens SET used_at = $now WHERE hash = $hash AND used_at IS NULL").run({ hash, now });
+  async markUsed(hash, now, keepUntil) {
+    const result = this.#db.query(`UPDATE tokens SET used_at = $now, expires_at = min(expires_at, $keep_until)
+				WHERE hash = $hash AND used_at IS NULL`).run({ hash, now, keep_until: keepUntil });
     return result.changes === 1;
   }
   async revoke(selector, options) {
@@ -4042,6 +4211,16 @@ var VERSION = version;
 var RELAY_INFO = { name: "tab-mcp", version };
 var RETRY = Symbol("retry");
 var CLAUDE_MISMATCHED_HEADER = "2025-11-25";
+var MAX_LISTEN_STREAMS_PER_GRANT = 2;
+var FRAME_HEADROOM = 4;
+var TRANSIENT_REFUSALS = new Set([
+  "jwks_unavailable",
+  "store_unavailable",
+  "relay_busy",
+  "error"
+]);
+var UNCHECKED_TEXT = "The relay cannot check the page's user right now. Try again shortly.";
+var RETRY_AFTER_S = "5";
 var FORWARDED_HEADERS = new Set([
   "content-type",
   "accept",
@@ -4103,10 +4282,10 @@ function startRelay(options, hooks) {
   const perIp = new Map;
   const waiters = new Map;
   let waitingCount = 0;
-  const appNames = new Map;
+  const lastSeen = new Map;
   let claudeWorkarounds = 0;
   let publicUrl = config.publicUrl ?? "";
-  const assertions = config.oidc === undefined ? undefined : new TabAssertionVerifier(config.oidc, hooks?.assertionKeys);
+  const assertions = config.oidc === undefined ? undefined : new TabAssertionVerifier(config.oidc, hooks?.assertionKeys, hooks?.maxSeenAssertions);
   const corsHeaders = config.cors ? {
     "access-control-allow-origin": "*",
     "access-control-expose-headers": "www-authenticate, mcp-protocol-version"
@@ -4168,9 +4347,15 @@ function startRelay(options, hooks) {
         }
       };
       const refuse = (reason, message) => {
+        const transient = TRANSIENT_REFUSALS.has(reason);
+        session.identityUnchecked = transient;
         if (session.identity !== undefined) {
           session.identity = undefined;
-          failPending(session, "The page's user is no longer signed in.");
+          if (transient) {
+            failPending(session, UNCHECKED_TEXT, true);
+          } else {
+            failPending(session, "The page's user is no longer signed in.");
+          }
         }
         logger.info("identity.refused", {
           address: shortAddress(addressId),
@@ -4207,7 +4392,7 @@ function startRelay(options, hooks) {
       } catch (error) {
         logger.error("store.error", {
           op: "identity",
-          message: error instanceof Error ? error.message : "unknown"
+          error: errorName(error)
         });
         refuse("store_unavailable", "the relay cannot check grants right now");
         return;
@@ -4215,6 +4400,7 @@ function startRelay(options, hooks) {
       if (!session.ready)
         return;
       session.identity = key;
+      session.identityUnchecked = false;
       answer({ type: "identity.bound", ...echo });
       logger.info("identity.bound", {
         address: shortAddress(addressId),
@@ -4236,6 +4422,7 @@ function startRelay(options, hooks) {
         return;
       }
       session.identity = undefined;
+      session.identityUnchecked = false;
       failPending(session, "The page's user signed out.");
       try {
         const grants = await store.listGrants(addressId, Date.now());
@@ -4247,10 +4434,7 @@ function startRelay(options, hooks) {
         for (const g of grants)
           grantRemoved(addressId, g.grantId, "revoked");
       } catch (error) {
-        logger.error("store.error", {
-          op: "signOut",
-          message: error instanceof Error ? error.message : "unknown"
-        });
+        logger.error("store.error", { op: "signOut", error: errorName(error) });
       }
     },
     claimAddress(session) {
@@ -4272,14 +4456,16 @@ function startRelay(options, hooks) {
       const id = session.addressId;
       if (id === undefined)
         return;
-      if (session.appName !== undefined) {
-        appNames.delete(id);
-        appNames.set(id, session.appName);
-        if (appNames.size > config.maxSessions * 2) {
-          const oldest = appNames.keys().next().value;
-          if (oldest !== undefined)
-            appNames.delete(oldest);
-        }
+      const appName = session.appName ?? lastSeen.get(id)?.appName;
+      lastSeen.delete(id);
+      lastSeen.set(id, {
+        appName,
+        maxConcurrentRequests: session.limits.maxConcurrentRequests
+      });
+      if (lastSeen.size > config.maxSessions * 2) {
+        const oldest = lastSeen.keys().next().value;
+        if (oldest !== undefined)
+          lastSeen.delete(oldest);
       }
       const waiting = waiters.get(id);
       if (waiting !== undefined)
@@ -4287,9 +4473,11 @@ function startRelay(options, hooks) {
           wake(session);
     }
   };
-  function failPending(session, message) {
+  function failPending(session, message, transient = false) {
+    const addressId = session.addressId;
+    const headers = transient ? { "retry-after": RETRY_AFTER_S } : addressId === undefined ? {} : { "www-authenticate": wwwAuthenticate(addressId, true) };
     for (const exchange of [...session.pending.values()]) {
-      exchange.fail(401, RelayErrorCode.signedOut, message, true);
+      exchange.fail(transient ? 503 : 401, RelayErrorCode.signedOut, message, true, headers);
     }
   }
   function readySession(addressId, usable = () => true) {
@@ -4303,11 +4491,12 @@ function startRelay(options, hooks) {
     const now = readySession(addressId, usable);
     if (now !== undefined)
       return Promise.resolve(now);
-    if (waitMs === 0 || stopping !== undefined) {
+    if (waitMs === 0 || closing) {
       return Promise.resolve(undefined);
     }
     const set = waiters.get(addressId) ?? new Set;
-    if (set.size >= config.maxConcurrentRequests || waitingCount >= config.maxSessions) {
+    const limit = sessions.get(addressId)?.limits.maxConcurrentRequests ?? lastSeen.get(addressId)?.maxConcurrentRequests ?? config.maxConcurrentRequests;
+    if (set.size >= limit || waitingCount >= config.maxSessions) {
       return Promise.resolve(undefined);
     }
     return new Promise((resolve) => {
@@ -4436,10 +4625,7 @@ function startRelay(options, hooks) {
     try {
       record = await store.get(hashToken(token));
     } catch (error) {
-      logger.error("store.error", {
-        op: "get",
-        message: error instanceof Error ? error.message : "unknown"
-      });
+      logger.error("store.error", { op: "get", error: errorName(error) });
       return "unavailable";
     }
     if (record === undefined || record.kind !== "access" || record.addressId !== addressId || record.expiresAt <= Date.now() || !record.scopes.includes("tools")) {
@@ -4460,8 +4646,12 @@ function startRelay(options, hooks) {
       const deadline = new Promise((resolve) => {
         timer = setTimeout(() => resolve("timeout"), config.bodyTimeoutMs);
       });
-      const result = await Promise.race([reading, deadline]);
-      clearTimeout(timer);
+      let result;
+      try {
+        result = await Promise.race([reading, deadline]);
+      } finally {
+        clearTimeout(timer);
+      }
       if (result === "timeout") {
         return rpcError(408, undefined, -32600, "The request body did not arrive in time.", { ...corsHeaders, connection: "close" });
       }
@@ -4487,7 +4677,7 @@ function startRelay(options, hooks) {
   }
   function checkVersion(req, body, rpcId) {
     const header = req.headers.get("mcp-protocol-version");
-    if (body["method"] === "initialize") {
+    if (body["method"] === "initialize" && !(header === MCP_PROTOCOL_VERSION && metaVersion(body) === MCP_PROTOCOL_VERSION)) {
       const params = body["params"];
       const requested = typeof params?.["protocolVersion"] === "string" ? params["protocolVersion"] : header ?? null;
       return rpcError(400, rpcId, -32022, `Unsupported protocol version: ${String(requested)}. This server supports only ${MCP_PROTOCOL_VERSION}.`, corsHeaders, { supported: [MCP_PROTOCOL_VERSION], requested });
@@ -4531,7 +4721,7 @@ function startRelay(options, hooks) {
     const auth = await authenticate(req, addressId);
     if (auth === "unavailable") {
       logDone(503, method, { reason: "store_unavailable" });
-      return rpcError(503, rpcId, RelayErrorCode.storeUnavailable, "The relay cannot check tokens right now. Try again shortly.", { ...corsHeaders, "retry-after": "5" });
+      return rpcError(503, rpcId, RelayErrorCode.storeUnavailable, "The relay cannot check tokens right now. Try again shortly.", { ...corsHeaders, "retry-after": RETRY_AFTER_S });
     }
     if (typeof auth === "string") {
       logDone(401, method);
@@ -4563,12 +4753,9 @@ function startRelay(options, hooks) {
       logDone(499, method, { outcome: "client_closed" });
       return new Response(null, { status: 499 });
     };
+    const idle = (on) => server.timeout(req, on ? config.httpIdleTimeoutS : 0);
     const usable = usableFor(auth.subject);
-    if (readySession(addressId, usable) === undefined && waitMs > 0) {
-      server.timeout(req, 0);
-    }
-    let retried = false;
-    for (;; ) {
+    const admit = async () => {
       const found = await waitForPage(addressId, req.signal, waitMs, usable);
       if (found === "aborted" || req.signal.aborted)
         return closed();
@@ -4591,14 +4778,30 @@ function startRelay(options, hooks) {
         logDone(429, method);
         return rpcError(429, rpcId, RelayErrorCode.overloaded, "Too many requests at once for this page.", corsHeaders);
       }
-      server.timeout(req, 0);
+      if (isListen && session.listenStreams(auth.grantId) >= MAX_LISTEN_STREAMS_PER_GRANT) {
+        logDone(429, method, { reason: "listen_streams" });
+        return rpcError(429, rpcId, RelayErrorCode.overloaded, "Too many listen streams at once for this AI app.", corsHeaders);
+      }
+      return session;
+    };
+    if (readySession(addressId, usable) === undefined && waitMs > 0) {
+      idle(false);
+    }
+    let retried = false;
+    for (;; ) {
+      const admitted = await admit();
+      if (admitted instanceof Response) {
+        idle(true);
+        return admitted;
+      }
+      const session = admitted;
+      idle(false);
       let retry = () => {};
       const retrying = new Promise((resolve) => {
         retry = () => resolve(RETRY);
       });
       const mayRetry = !retried && waitMs > 0 && isRetryable(body.value["method"]);
       const exchange = session.forward({
-        method: "POST",
         headers,
         body: body.text,
         rpcId,
@@ -4612,6 +4815,7 @@ function startRelay(options, hooks) {
         onDone: (e) => {
           if (e.outcome === "page_gone_retry")
             return;
+          idle(true);
           logDone(e.status, method, {
             session: session.sessionId,
             client: clientHostName,
@@ -4624,8 +4828,18 @@ function startRelay(options, hooks) {
             retry();
             return { retry: true };
           }
-          const answer = notOpenAnswer(body.value, rpcId, session.appName, "gone", RELAY_INFO);
-          return answer === undefined ? { retry: false } : { retry: false, body: answer };
+          const answer = notOpenAnswer(body.value, rpcId, session.appName, closing ? "restarting_gone" : "gone", RELAY_INFO);
+          if (answer !== undefined)
+            return { retry: false, body: answer };
+          return !closing ? { retry: false } : {
+            retry: false,
+            error: {
+              status: 503,
+              code: RelayErrorCode.restarting,
+              message: "The relay is restarting.",
+              headers: { "retry-after": RETRY_AFTER_S }
+            }
+          };
         }
       });
       const onAbort = () => exchange.clientClosed();
@@ -4639,13 +4853,21 @@ function startRelay(options, hooks) {
   }
   function pageNotOpen(value, rpcId, addressId, logDone, method) {
     const open = sessions.get(addressId);
-    const phase = open?.ready === true && open.identity === undefined && open.site.pairing === "oidc" ? "signed_out" : "not_open";
-    const answer = notOpenAnswer(value, rpcId, open?.appName ?? appNames.get(addressId), phase, RELAY_INFO);
+    if (!closing && open?.ready === true && open.identity === undefined && open.identityUnchecked) {
+      logDone(503, method, { reason: "identity_unchecked" });
+      return rpcError(503, rpcId, RelayErrorCode.signedOut, UNCHECKED_TEXT, {
+        ...corsHeaders,
+        "retry-after": RETRY_AFTER_S
+      });
+    }
+    const phase = closing ? "restarting" : open?.ready === true && open.identity === undefined && open.site.pairing === "oidc" ? "signed_out" : "not_open";
+    const reason = phase === "restarting" ? "restarting" : "page_not_open";
+    const answer = notOpenAnswer(value, rpcId, open?.appName ?? lastSeen.get(addressId)?.appName, phase, RELAY_INFO);
     if (answer === undefined) {
-      logDone(503, method, { reason: "page_not_open" });
-      return rpcError(503, rpcId, RelayErrorCode.pageNotOpen, "The page is not open.", corsHeaders);
+      logDone(503, method, { reason });
+      return phase === "restarting" ? rpcError(503, rpcId, RelayErrorCode.restarting, "The relay is restarting.", { ...corsHeaders, "retry-after": RETRY_AFTER_S }) : rpcError(503, rpcId, RelayErrorCode.pageNotOpen, "The page is not open.", corsHeaders);
     }
-    logDone(200, method, { reason: "page_not_open" });
+    logDone(200, method, { reason });
     return new Response(answer, {
       status: 200,
       headers: { ...corsHeaders, "content-type": "application/json" }
@@ -4740,7 +4962,7 @@ function startRelay(options, hooks) {
     fetch: () => new Response("Not found", { status: 404 }),
     websocket: {
       data: {},
-      maxPayloadLength: largest * 4,
+      maxPayloadLength: largest * FRAME_HEADROOM,
       backpressureLimit: config.backpressureLimitBytes,
       closeOnBackpressureLimit: false,
       idleTimeout: 120,
@@ -4760,6 +4982,7 @@ function startRelay(options, hooks) {
     }
   });
   let stopping;
+  let closing = false;
   const port = server.port ?? config.port;
   if (publicUrl === "")
     publicUrl = `http://localhost:${port}`;
@@ -4770,7 +4993,7 @@ function startRelay(options, hooks) {
         logger.debug("store.swept", { deleted: n });
     }).catch((error) => logger.error("store.error", {
       op: "deleteExpired",
-      message: error instanceof Error ? error.message : "unknown"
+      error: errorName(error)
     }));
   }, config.sweepIntervalMs);
   const siteCount = config.allowedOrigins === "*" ? "*" : config.allowedOrigins.length + config.sites.length;
@@ -4799,6 +5022,7 @@ function startRelay(options, hooks) {
       return allSessions.size;
     },
     stop() {
+      closing = true;
       stopping ??= (async () => {
         clearInterval(sweep);
         for (const set of [...waiters.values()]) {
@@ -4834,5 +5058,5 @@ export {
   resolveConfig
 };
 
-//# debugId=D6651982449E84CF64756E2164756E21
+//# debugId=8481FBCB87B247C864756E2164756E21
 //# sourceMappingURL=index.js.map