blackveil-dns 2.2.2 → 2.3.5

package/dist/stdio.js

@@ -20,35 +20,39 @@ function isSensitiveKey(key) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function sanitizeString(value) {
+function sanitizeString(value, maxLength = MAX_LOG_STRING_LENGTH) {
   const stripped = value.replace(/[\x00-\x08\x0a-\x1f\x7f]/g, " ");
-  return stripped.length > MAX_LOG_STRING_LENGTH ? `${stripped.slice(0, MAX_LOG_STRING_LENGTH)}...` : stripped;
+  if (stripped.length <= maxLength) return stripped;
+  const half = Math.floor((maxLength - 5) / 2);
+  return `${stripped.slice(0, half)} ... ${stripped.slice(-half)}`;
 }
-function sanitizeLogValue(value, key) {
+function sanitizeLogValue(value, key, maxLength) {
   if (key && isSensitiveKey(key)) {
     return REDACTED;
   }
   if (typeof value === "string") {
-    return sanitizeString(value);
+    return sanitizeString(value, maxLength);
   }
   if (Array.isArray(value)) {
-    return value.map((item) => sanitizeLogValue(item));
+    return value.map((item) => sanitizeLogValue(item, void 0, maxLength));
   }
   if (isPlainObject(value)) {
     const sanitized = {};
     for (const [entryKey, entryValue] of Object.entries(value)) {
-      sanitized[entryKey] = sanitizeLogValue(entryValue, entryKey);
+      sanitized[entryKey] = sanitizeLogValue(entryValue, entryKey, maxLength);
     }
     return sanitized;
   }
   return value;
 }
 function logEvent(event) {
+  const isError = event.severity === "error";
+  const maxLen = isError ? MAX_ERROR_STRING_LENGTH : MAX_LOG_STRING_LENGTH;
   const log = {
     ...event,
     timestamp: event.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
-    details: sanitizeLogValue(event.details),
-    error: typeof event.error === "string" ? sanitizeString(event.error) : event.error
+    details: sanitizeLogValue(event.details, void 0, maxLen),
+    error: typeof event.error === "string" ? sanitizeString(event.error, maxLen) : event.error
   };
   console.log(JSON.stringify(log));
 }
@@ -60,17 +64,18 @@ function logError(error2, context) {
     ...context
   });
 }
-var REDACTED, MAX_LOG_STRING_LENGTH, SENSITIVE_KEY_PATTERN;
+var REDACTED, MAX_LOG_STRING_LENGTH, MAX_ERROR_STRING_LENGTH, SENSITIVE_KEY_PATTERN;
 var init_log = __esm({
   "src/lib/log.ts"() {
     REDACTED = "[redacted]";
     MAX_LOG_STRING_LENGTH = 256;
+    MAX_ERROR_STRING_LENGTH = 1024;
     SENSITIVE_KEY_PATTERN = /(^ip$|authorization|mcp-session-id|session|token|api[-_]?key|secret|password|cookie|rawbody)/i;
   }
 });
 
 // src/lib/config.ts
-var BLOCKED_SUFFIXES, BLOCKED_HOSTS, BLOCKED_IP_PATTERNS, BLOCKED_DNS_REBINDING, MAX_DOMAIN_LENGTH, MAX_LABEL_LENGTH, LABEL_REGEX, HTTPS_TIMEOUT_MS, DNS_TIMEOUT_MS, DNS_RETRIES, DOH_EDGE_CACHE_TTL, INFLIGHT_CLEANUP_MS, DNS_RETRY_BASE_DELAY_MS, DNS_CONFIRM_WITH_SECONDARY_ON_EMPTY, GLOBAL_DAILY_TOOL_LIMIT, TIER_DAILY_LIMITS, TIER_TOOL_DAILY_LIMITS, FREE_TOOL_DAILY_LIMITS;
+var BLOCKED_SUFFIXES, BLOCKED_HOSTS, BLOCKED_IP_PATTERNS, BLOCKED_DNS_REBINDING, MAX_DOMAIN_LENGTH, MAX_LABEL_LENGTH, LABEL_REGEX, HTTPS_TIMEOUT_MS, DNS_TIMEOUT_MS, DNS_RETRIES, DOH_EDGE_CACHE_TTL, INFLIGHT_CLEANUP_MS, DNS_RETRY_BASE_DELAY_MS, DNS_CONFIRM_WITH_SECONDARY_ON_EMPTY, GLOBAL_DAILY_TOOL_LIMIT, TIER_DAILY_LIMITS, TIER_TOOL_DAILY_LIMITS, FREE_TOOL_DAILY_LIMITS, TIER_CONCURRENT_LIMITS;
 var init_config = __esm({
   "src/lib/config.ts"() {
     BLOCKED_SUFFIXES = [
@@ -192,6 +197,14 @@ var init_config = __esm({
       map_compliance: 75,
       simulate_attack_paths: 75
     };
+    TIER_CONCURRENT_LIMITS = {
+      free: 3,
+      agent: 5,
+      developer: 10,
+      enterprise: 25,
+      partner: 50,
+      owner: Infinity
+    };
   }
 });
 
@@ -238,10 +251,37 @@ async function runWithCache(key, run, kv, ttlSeconds, skipCache) {
   }
   const existing = INFLIGHT.get(key);
   if (existing) return existing;
+  if (kv && !skipCache) {
+    const sentinelKey = `${key}:computing`;
+    try {
+      const sentinel = await kv.get(sentinelKey);
+      if (sentinel) {
+        const polled = await pollForResult(key, kv);
+        if (polled !== void 0) return polled;
+      } else {
+        await kv.put(sentinelKey, String(Date.now()), { expirationTtl: SENTINEL_TTL_SECONDS });
+      }
+    } catch {
+    }
+  }
   const cleanup = setTimeout(() => INFLIGHT.delete(key), INFLIGHT_CLEANUP_MS);
   const promise = run().then(async (result) => {
     await cacheSet(key, result, kv, ttlSeconds);
+    if (kv) {
+      try {
+        await kv.delete(`${key}:computing`);
+      } catch {
+      }
+    }
     return result;
+  }).catch(async (err) => {
+    if (kv) {
+      try {
+        await kv.delete(`${key}:computing`);
+      } catch {
+      }
+    }
+    throw err;
   }).finally(() => {
     clearTimeout(cleanup);
     INFLIGHT.delete(key);
@@ -249,7 +289,19 @@ async function runWithCache(key, run, kv, ttlSeconds, skipCache) {
   INFLIGHT.set(key, promise);
   return promise;
 }
-var DEFAULT_TTL_MS, DEFAULT_TTL_SECONDS, DEFAULT_MAX_ENTRIES, TTLCache, INFLIGHT, IN_MEMORY_CACHE;
+async function pollForResult(key, kv) {
+  for (const delay of POLL_DELAYS_MS) {
+    await new Promise((r) => setTimeout(r, delay));
+    try {
+      const val = await kv.get(key, "json");
+      if (val !== null) return val;
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+var DEFAULT_TTL_MS, DEFAULT_TTL_SECONDS, DEFAULT_MAX_ENTRIES, TTLCache, INFLIGHT, IN_MEMORY_CACHE, SENTINEL_TTL_SECONDS, POLL_DELAYS_MS;
 var init_cache = __esm({
   "src/lib/cache.ts"() {
     init_config();
@@ -341,6 +393,8 @@ var init_cache = __esm({
       ttlMs: DEFAULT_TTL_MS,
       maxEntries: DEFAULT_MAX_ENTRIES
     });
+    SENTINEL_TTL_SECONDS = 10;
+    POLL_DELAYS_MS = [250, 500, 750];
   }
 });
 
@@ -426,18 +480,25 @@ async function fetchDohResponse(url, timeoutMs, opts) {
   try {
     const headers = { Accept: "application/dns-json" };
     if (opts?.token) headers["X-BV-Token"] = opts.token;
-    const response = await fetch(url, {
+    const doFetch = () => fetch(url, {
       method: "GET",
       headers,
       signal: AbortSignal.timeout(timeoutMs),
       ...opts?.useEdgeCache ? { cf: { cacheTtl: DOH_EDGE_CACHE_TTL, cacheEverything: true } } : {}
     });
+    const response = opts?.semaphore ? await opts.semaphore.run(doFetch) : await doFetch();
     if (!response.ok) return null;
     const data = await response.json();
     const parsed = DohResponseSchema.safeParse(data);
     if (!parsed.success) return null;
     return parsed.data;
-  } catch {
+  } catch (err) {
+    const isTimeout = err instanceof DOMException && err.name === "TimeoutError";
+    logError(isTimeout ? "DNS fetch timeout" : "DNS fetch failed", {
+      severity: "warn",
+      category: "dns-transport",
+      details: { url: url.replace(/name=[^&]+/, "name=<domain>"), errorType: isTimeout ? "timeout" : "network" }
+    });
     return null;
   }
 }
@@ -460,11 +521,13 @@ async function queryDnsUncached(domain, type, dnssecCheck = false, opts) {
   const timeoutMs = opts?.timeoutMs ?? DNS_TIMEOUT_MS;
   const retries = opts?.retries ?? DNS_RETRIES;
   const confirmWithSecondaryOnEmpty = opts?.confirmWithSecondaryOnEmpty ?? DNS_CONFIRM_WITH_SECONDARY_ON_EMPTY;
+  const sem = opts?.dnsSemaphore;
   const url = buildDohUrl(DOH_ENDPOINT, domain, type, dnssecCheck);
+  const guardedFetch = (input, init) => sem ? sem.run(() => fetch(input, init)) : fetch(input, init);
   for (let attempt = 0; attempt <= retries; attempt++) {
     let response;
     try {
-      response = await fetch(url, {
+      response = await guardedFetch(url, {
         method: "GET",
         headers: { Accept: "application/dns-json" },
         signal: AbortSignal.timeout(timeoutMs),
@@ -498,35 +561,51 @@ async function queryDnsUncached(domain, type, dnssecCheck = false, opts) {
     }
     const data = validated.data;
     if (confirmWithSecondaryOnEmpty && !opts?.skipSecondaryConfirmation && !hasTypedAnswers(data, type)) {
-      if (opts?.secondaryDoh?.endpoint) {
-        const bvDns = await fetchDohResponse(
-          buildDohUrl(opts.secondaryDoh.endpoint, domain, type, dnssecCheck),
-          timeoutMs,
-          { token: opts.secondaryDoh.token }
-        );
-        if (bvDns && hasTypedAnswers(bvDns, type)) {
-          return bvDns;
-        }
-      }
-      const google = await fetchDohResponse(
-        buildDohUrl(GOOGLE_DOH_ENDPOINT, domain, type, dnssecCheck),
-        timeoutMs,
-        { useEdgeCache: true }
-      );
-      if (google && hasTypedAnswers(google, type)) {
-        return google;
-      }
+      const secondaryResult = await confirmWithSecondaryResolvers(domain, type, dnssecCheck, timeoutMs, sem, opts);
+      if (secondaryResult) return secondaryResult;
     }
     return data;
   }
   throw new DnsQueryError("DNS query failed after retries", domain, type);
 }
+async function confirmWithSecondaryResolvers(domain, type, dnssecCheck, timeoutMs, sem, opts) {
+  const hasBvDns = !!opts?.secondaryDoh?.endpoint;
+  const googleUrl = buildDohUrl(GOOGLE_DOH_ENDPOINT, domain, type, dnssecCheck);
+  if (hasBvDns) {
+    const bvDnsUrl = buildDohUrl(opts.secondaryDoh.endpoint, domain, type, dnssecCheck);
+    const candidates = [
+      fetchDohResponse(bvDnsUrl, timeoutMs, { token: opts.secondaryDoh.token, semaphore: sem }),
+      fetchDohResponse(googleUrl, timeoutMs, { useEdgeCache: true, semaphore: sem })
+    ];
+    const results = await Promise.allSettled(candidates);
+    for (const r of results) {
+      if (r.status === "fulfilled" && r.value && hasTypedAnswers(r.value, type)) {
+        return r.value;
+      }
+    }
+    const allFailed = results.every((r) => r.status === "rejected" || !r.value);
+    if (allFailed) {
+      logError("All secondary DNS resolvers failed", {
+        severity: "warn",
+        category: "dns-transport",
+        details: { domain, type }
+      });
+    }
+    return null;
+  }
+  const google = await fetchDohResponse(googleUrl, timeoutMs, { useEdgeCache: true, semaphore: sem });
+  if (google && hasTypedAnswers(google, type)) {
+    return google;
+  }
+  return null;
+}
 var DOH_ENDPOINT, GOOGLE_DOH_ENDPOINT, DnsQueryError;
 var init_dns_transport = __esm({
   "src/lib/dns-transport.ts"() {
     init_config();
     init_dns_types();
     init_dns();
+    init_log();
     DOH_ENDPOINT = "https://cloudflare-dns.com/dns-query";
     GOOGLE_DOH_ENDPOINT = "https://dns.google/resolve";
     DnsQueryError = class extends Error {
@@ -911,7 +990,16 @@ async function checkMx(domain, options, dnsOptions) {
         );
       }
     }
-  } catch {
+  } catch (err) {
+    logEvent({
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      severity: "warn",
+      category: "provider-detection",
+      domain,
+      tool: "check_mx",
+      error: err instanceof Error ? err.message : String(err),
+      details: { phase: "provider_detection" }
+    });
   }
   return { ...baseResult, findings };
 }
@@ -919,6 +1007,7 @@ var init_check_mx = __esm({
   "src/tools/check-mx.ts"() {
     init_dns2();
     init_provider_signatures();
+    init_log();
   }
 });
 
@@ -1190,6 +1279,76 @@ async function checkSessionCreateRateLimitWithCoordinator(ip, limit, windowMs, n
   });
 }
 
+// src/lib/circuit-breaker.ts
+var CircuitBreakerOpen = class extends Error {
+  constructor(name) {
+    super(`Circuit breaker '${name}' is OPEN \u2014 call rejected`);
+    this.name = "CircuitBreakerOpen";
+  }
+};
+var CircuitBreaker = class {
+  _state = "CLOSED";
+  _failureCount = 0;
+  _lastFailureAt = 0;
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  /** Current state (evaluates HALF_OPEN transition lazily). */
+  get state() {
+    if (this._state === "OPEN" && Date.now() - this._lastFailureAt >= this.config.cooldownMs) {
+      this._state = "HALF_OPEN";
+    }
+    return this._state;
+  }
+  get failureCount() {
+    return this._failureCount;
+  }
+  /** Execute a function through the circuit breaker. Throws CircuitBreakerOpen if OPEN. */
+  async call(fn) {
+    const currentState = this.state;
+    if (currentState === "OPEN") {
+      throw new CircuitBreakerOpen(this.config.name);
+    }
+    try {
+      const result = await fn();
+      this.onSuccess();
+      return result;
+    } catch (err) {
+      this.onFailure();
+      throw err;
+    }
+  }
+  /** Execute with a fallback value returned when the circuit is OPEN. */
+  async callWithFallback(fn, fallback) {
+    try {
+      return await this.call(fn);
+    } catch (err) {
+      if (err instanceof CircuitBreakerOpen) {
+        return fallback;
+      }
+      throw err;
+    }
+  }
+  /** Reset to CLOSED state. */
+  reset() {
+    this._state = "CLOSED";
+    this._failureCount = 0;
+    this._lastFailureAt = 0;
+  }
+  onSuccess() {
+    this._failureCount = 0;
+    this._state = "CLOSED";
+  }
+  onFailure() {
+    this._failureCount++;
+    this._lastFailureAt = Date.now();
+    if (this._failureCount >= this.config.failureThreshold) {
+      this._state = "OPEN";
+    }
+  }
+};
+
 // src/lib/rate-limiter.ts
 init_log();
 var MINUTE_LIMIT = 50;
@@ -1200,6 +1359,11 @@ var MINUTE_MS2 = 6e4;
 var HOUR_MS2 = 36e5;
 var DAY_MS2 = 864e5;
 var KV_IP_LOCK_TAILS = /* @__PURE__ */ new Map();
+var quotaCoordinatorBreaker = new CircuitBreaker({
+  name: "QuotaCoordinator",
+  failureThreshold: 3,
+  cooldownMs: 6e4
+});
 function checkRateLimitInMemory(ip) {
   return checkScopedRateLimitInMemory(ip, "tools", MINUTE_LIMIT, HOUR_LIMIT);
 }
@@ -1339,10 +1503,14 @@ async function checkGlobalDailyLimitKV(limit, kv) {
 async function checkRateLimit(ip, kv, quotaCoordinator) {
   if (quotaCoordinator) {
     try {
-      const coordinated = await checkScopedRateLimitWithCoordinator(ip, "tools", MINUTE_LIMIT, HOUR_LIMIT, quotaCoordinator);
+      const coordinated = await quotaCoordinatorBreaker.call(
+        () => checkScopedRateLimitWithCoordinator(ip, "tools", MINUTE_LIMIT, HOUR_LIMIT, quotaCoordinator)
+      );
       if (coordinated) return coordinated;
-    } catch {
-      logError("[rate-limiter] quota coordinator error, falling back to KV/in-memory");
+    } catch (err) {
+      if (!(err instanceof CircuitBreakerOpen)) {
+        logError("[rate-limiter] quota coordinator error, falling back to KV/in-memory");
+      }
     }
   }
   if (kv) {
@@ -1357,10 +1525,14 @@ async function checkRateLimit(ip, kv, quotaCoordinator) {
 async function checkControlPlaneRateLimit(ip, kv, quotaCoordinator) {
   if (quotaCoordinator) {
     try {
-      const coordinated = await checkScopedRateLimitWithCoordinator(ip, "control", CONTROL_PLANE_MINUTE_LIMIT, CONTROL_PLANE_HOUR_LIMIT, quotaCoordinator);
+      const coordinated = await quotaCoordinatorBreaker.call(
+        () => checkScopedRateLimitWithCoordinator(ip, "control", CONTROL_PLANE_MINUTE_LIMIT, CONTROL_PLANE_HOUR_LIMIT, quotaCoordinator)
+      );
       if (coordinated) return coordinated;
-    } catch {
-      logError("[rate-limiter] quota coordinator control-plane error, falling back to KV/in-memory");
+    } catch (err) {
+      if (!(err instanceof CircuitBreakerOpen)) {
+        logError("[rate-limiter] quota coordinator control-plane error, falling back to KV/in-memory");
+      }
     }
   }
   if (kv) {
@@ -1375,10 +1547,14 @@ async function checkControlPlaneRateLimit(ip, kv, quotaCoordinator) {
 async function checkToolDailyRateLimit(principalId, toolName, limit, kv, quotaCoordinator) {
   if (quotaCoordinator) {
     try {
-      const coordinated = await checkToolDailyRateLimitWithCoordinator(principalId, toolName, limit, quotaCoordinator);
+      const coordinated = await quotaCoordinatorBreaker.call(
+        () => checkToolDailyRateLimitWithCoordinator(principalId, toolName, limit, quotaCoordinator)
+      );
       if (coordinated) return coordinated;
-    } catch {
-      logError("[rate-limiter] quota coordinator tool quota error, falling back to KV/in-memory");
+    } catch (err) {
+      if (!(err instanceof CircuitBreakerOpen)) {
+        logError("[rate-limiter] quota coordinator tool quota error, falling back to KV/in-memory");
+      }
     }
   }
   if (kv) {
@@ -1393,10 +1569,14 @@ async function checkToolDailyRateLimit(principalId, toolName, limit, kv, quotaCo
 async function checkGlobalDailyLimit(limit, kv, quotaCoordinator) {
   if (quotaCoordinator) {
     try {
-      const coordinated = await checkGlobalDailyLimitWithCoordinator(limit, quotaCoordinator);
+      const coordinated = await quotaCoordinatorBreaker.call(
+        () => checkGlobalDailyLimitWithCoordinator(limit, quotaCoordinator)
+      );
       if (coordinated) return coordinated;
-    } catch {
-      logError("[rate-limiter] quota coordinator global cap error, falling back to KV/in-memory");
+    } catch (err) {
+      if (!(err instanceof CircuitBreakerOpen)) {
+        logError("[rate-limiter] quota coordinator global cap error, falling back to KV/in-memory");
+      }
     }
   }
   if (kv) {
@@ -1408,6 +1588,23 @@ async function checkGlobalDailyLimit(limit, kv, quotaCoordinator) {
   }
   return checkGlobalDailyLimitInMemory(limit);
 }
+var activeConcurrency = /* @__PURE__ */ new Map();
+function acquireConcurrencySlot(principalId, limit) {
+  const current = activeConcurrency.get(principalId) ?? 0;
+  if (current >= limit) {
+    return { allowed: false, retryAfterMs: 1e3, active: current, limit };
+  }
+  activeConcurrency.set(principalId, current + 1);
+  return { allowed: true, active: current + 1, limit };
+}
+function releaseConcurrencySlot(principalId) {
+  const current = activeConcurrency.get(principalId) ?? 0;
+  if (current <= 1) {
+    activeConcurrency.delete(principalId);
+  } else {
+    activeConcurrency.set(principalId, current - 1);
+  }
+}
 
 // src/mcp/execute.ts
 init_log();
@@ -1775,7 +1972,7 @@ async function validateSessionRequest(sessionId, sessionStore, id, message) {
   if (!await validateSession(sessionId, sessionStore)) {
     return {
       status: 404,
-      payload: jsonRpcError(id, JSON_RPC_ERRORS.INVALID_REQUEST, "Not Found: session expired or terminated")
+      payload: jsonRpcError(id, JSON_RPC_ERRORS.INVALID_REQUEST, "Not Found: session expired or terminated. Send a new initialize request to start a fresh session.")
     };
   }
   return void 0;
@@ -2502,51 +2699,66 @@ function makeQueryDNS4(dnsOptions) {
   };
 }
 async function checkDnssec2(domain, dnsOptions) {
-  const baseResult = await checkDNSSEC(
-    domain,
-    makeQueryDNS4(dnsOptions),
-    {
-      timeout: dnsOptions?.timeoutMs ?? 5e3,
-      rawQueryDNS: async (d, type, dnssecFlag) => {
-        const resp = await queryDns(d, type, dnssecFlag ?? false, dnsOptions);
-        return { AD: resp.AD, Answer: resp.Answer };
+  try {
+    const baseResult = await checkDNSSEC(
+      domain,
+      makeQueryDNS4(dnsOptions),
+      {
+        timeout: dnsOptions?.timeoutMs ?? 5e3,
+        rawQueryDNS: async (d, type, dnssecFlag) => {
+          const resp = await queryDns(d, type, dnssecFlag ?? false, dnsOptions);
+          return { AD: resp.AD, Answer: resp.Answer };
+        }
       }
+    );
+    const dnssecAbsent = baseResult.findings.some((f) => f.title === "DNSSEC not enabled") || baseResult.findings.some((f) => f.title === "DNSSEC check failed") || baseResult.findings.some((f) => f.title === "DNSSEC chain of trust incomplete") || baseResult.findings.some((f) => f.title === "DNSSEC validation failing");
+    if (dnssecAbsent) {
+      return baseResult;
     }
-  );
-  const dnssecAbsent = baseResult.findings.some((f) => f.title === "DNSSEC not enabled") || baseResult.findings.some((f) => f.title === "DNSSEC check failed") || baseResult.findings.some((f) => f.title === "DNSSEC chain of trust incomplete") || baseResult.findings.some((f) => f.title === "DNSSEC validation failing");
-  if (dnssecAbsent) {
-    return baseResult;
-  }
-  const [dnskeyResult, dsResult] = await Promise.allSettled([
-    queryDnsRecords(domain, "DNSKEY", dnsOptions),
-    queryDnsRecords(domain, "DS", dnsOptions)
-  ]);
-  const hasDnskey = dnskeyResult.status === "fulfilled" && dnskeyResult.value.length > 0;
-  const hasDs = dsResult.status === "fulfilled" && dsResult.value.length > 0;
-  const dnssecSource = hasDnskey && hasDs ? "domain_configured" : "tld_inherited";
-  if (dnssecSource === "tld_inherited") {
-    const inheritedFinding = createFinding(
+    const [dnskeyResult, dsResult] = await Promise.allSettled([
+      queryDnsRecords(domain, "DNSKEY", dnsOptions),
+      queryDnsRecords(domain, "DS", dnsOptions)
+    ]);
+    const hasDnskey = dnskeyResult.status === "fulfilled" && dnskeyResult.value.length > 0;
+    const hasDs = dsResult.status === "fulfilled" && dsResult.value.length > 0;
+    const dnssecSource = hasDnskey && hasDs ? "domain_configured" : "tld_inherited";
+    if (dnssecSource === "tld_inherited") {
+      const inheritedFinding = createFinding(
+        "dnssec",
+        "DNSSEC inherited from TLD",
+        "info",
+        `DNSSEC validation passes but ${domain} does not have its own DNSKEY or DS records. DNSSEC protection is inherited from the TLD registry, not configured by the domain owner.`,
+        { dnssecSource: "tld_inherited" }
+      );
+      return buildCheckResult("dnssec", [...baseResult.findings, inheritedFinding]);
+    }
+    if (baseResult.findings.length > 0) {
+      const [first, ...rest] = baseResult.findings;
+      const tagged = { ...first, metadata: { ...first.metadata ?? {}, dnssecSource: "domain_configured" } };
+      return buildCheckResult("dnssec", [tagged, ...rest]);
+    }
+    const configuredFinding = createFinding(
       "dnssec",
-      "DNSSEC inherited from TLD",
+      "DNSSEC configured by domain owner",
       "info",
-      `DNSSEC validation passes but ${domain} does not have its own DNSKEY or DS records. DNSSEC protection is inherited from the TLD registry, not configured by the domain owner.`,
-      { dnssecSource: "tld_inherited" }
+      `${domain} has DNSKEY and DS records \u2014 DNSSEC is explicitly configured by the domain owner.`,
+      { dnssecSource: "domain_configured" }
     );
-    return buildCheckResult("dnssec", [...baseResult.findings, inheritedFinding]);
-  }
-  if (baseResult.findings.length > 0) {
-    const [first, ...rest] = baseResult.findings;
-    const tagged = { ...first, metadata: { ...first.metadata ?? {}, dnssecSource: "domain_configured" } };
-    return buildCheckResult("dnssec", [tagged, ...rest]);
+    return buildCheckResult("dnssec", [configuredFinding]);
+  } catch (err) {
+    if (err instanceof DnsQueryError) {
+      return buildCheckResult("dnssec", [
+        createFinding(
+          "dnssec",
+          "DNSSEC check could not complete",
+          "info",
+          `Unable to verify DNSSEC for ${domain} \u2014 DNS query failed: ${err.message}`,
+          { checkStatus: "error" }
+        )
+      ]);
+    }
+    throw err;
   }
-  const configuredFinding = createFinding(
-    "dnssec",
-    "DNSSEC configured by domain owner",
-    "info",
-    `${domain} has DNSKEY and DS records \u2014 DNSSEC is explicitly configured by the domain owner.`,
-    { dnssecSource: "domain_configured" }
-  );
-  return buildCheckResult("dnssec", [configuredFinding]);
 }
 
 // src/tools/check-ssl.ts
@@ -2896,14 +3108,16 @@ async function checkLookalikes(domain) {
     checkLookalikesCore(domain),
     new Promise((_, reject) => setTimeout(() => reject(new Error("Lookalike check timed out")), LOOKALIKE_TIMEOUT_MS))
   ]).catch(() => {
-    return buildCheckResult("lookalikes", [
+    const result = buildCheckResult("lookalikes", [
       createFinding(
         "lookalikes",
         "Lookalike check incomplete",
         "info",
-        "Lookalike check did not complete. This check generates many DNS queries \u2014 try again shortly, as partial results are cached."
+        "Lookalike check did not complete within the time limit. Results may be incomplete \u2014 try again shortly."
       )
     ]);
+    result.partial = true;
+    return result;
   });
 }
 async function checkLookalikesCore(domain) {
@@ -3378,6 +3592,7 @@ async function checkShadowDomains(domain, dnsOptions) {
   const dnsOpts = { ...dnsOptions, skipSecondaryConfirmation: true };
   let primaryMx = [];
   let primaryNs = [];
+  let primaryDnsUnavailable = false;
   try {
     const [mxResult, nsResult] = await Promise.allSettled([
       queryMxRecords(domain, dnsOpts),
@@ -3385,7 +3600,21 @@ async function checkShadowDomains(domain, dnsOptions) {
     ]);
     primaryMx = mxResult.status === "fulfilled" ? mxResult.value.map((r) => r.exchange) : [];
     primaryNs = nsResult.status === "fulfilled" ? nsResult.value : [];
+    if (mxResult.status === "rejected" && nsResult.status === "rejected") {
+      primaryDnsUnavailable = true;
+    }
   } catch {
+    primaryDnsUnavailable = true;
+  }
+  if (primaryDnsUnavailable) {
+    findings.push(
+      createFinding(
+        "shadow_domains",
+        "Primary domain DNS unavailable",
+        "info",
+        `DNS queries for ${domain} failed \u2014 shadow domain analysis may be incomplete.`
+      )
+    );
   }
   const registeredVariants = await filterByNsExistence2(variants, dnsOpts);
   for (const variant of variants) {
@@ -4862,6 +5091,9 @@ function adjustForNoSendDomain(results) {
   });
 }
 
+// src/tools/scan-domain.ts
+init_log();
+
 // src/tools/scan/maturity-staging.ts
 function capMaturityStage(maturity, score) {
   if (score < 50 && maturity.stage > 2) {
@@ -6055,7 +6287,12 @@ async function scanDomain(domain, kv, runtimeOptions) {
       })();
       if (runtimeOptions.waitUntil) runtimeOptions.waitUntil(telemetryPromise);
     }
-  } catch {
+  } catch (postProcessError) {
+    logError(postProcessError instanceof Error ? postProcessError : String(postProcessError), {
+      category: "scan-domain",
+      domain,
+      details: { phase: "post-processing", checksCompleted: checkResults.length }
+    });
     if (degradedStatuses.size > 0) {
       checkResults = checkResults.map((r) => {
         const status = degradedStatuses.get(r.category);
@@ -6083,7 +6320,7 @@ async function scanDomain(domain, kv, runtimeOptions) {
       context: fallbackContext,
       cached: false,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      scoringNote: null,
+      scoringNote: "Post-processing encountered an error; results may be approximate",
       adaptiveWeightDeltas: null,
       interactionEffects: []
     };
@@ -6156,11 +6393,16 @@ async function safeCheck(category, fn) {
     return result;
   } catch (err) {
     const rawMessage = err instanceof Error ? err.message : "Check failed";
+    const isTimeout = rawMessage === "Check timed out";
     const SAFE_PREFIXES = ["DNS query", "Check timed out", "Check failed", "Connection", "timeout"];
     const safeMessage = SAFE_PREFIXES.some((p) => rawMessage.startsWith(p)) ? rawMessage : "Check failed";
-    const findings = [createFinding(category, `${category.toUpperCase()} check error`, "high", `Check failed: ${safeMessage}`)];
+    const severity = isTimeout ? "low" : "high";
+    const title = isTimeout ? `${category.toUpperCase()} check timed out` : `${category.toUpperCase()} check error`;
+    const detail = isTimeout ? `Check did not complete within the ${PER_CHECK_TIMEOUT_MS / 1e3}s per-check time limit. Try running this check individually.` : `Check failed: ${safeMessage}`;
+    const checkStatus = isTimeout ? "timeout" : "error";
+    const findings = [createFinding(category, title, severity, detail)];
     const result = buildCheckResult(category, findings);
-    return { ...result, score: 0, checkStatus: "error" };
+    return { ...result, score: 0, checkStatus };
   }
 }
 
@@ -9931,13 +10173,19 @@ async function handleToolsCall(params, scanCacheKV, runtimeOptions) {
     }
     const validDomain = domain ?? "";
     const effectiveFormat = resolveFormat(validatedArgs, runtimeOptions?.clientType);
-    const interactive = isInteractiveClient(runtimeOptions?.clientType);
+    const _interactive = isInteractiveClient(runtimeOptions?.clientType);
     const executeDispatch = async () => {
       const registeredTool = TOOL_REGISTRY[name];
       if (registeredTool) {
         const checkName = registeredTool.cacheKey(validatedArgs);
         const cacheKey = `cache:${validDomain}:check:${checkName}`;
         const result = await runWithCache(cacheKey, () => registeredTool.execute(validDomain, validatedArgs, runtimeOptions), scanCacheKV, registeredTool.cacheTtlSeconds);
+        if (result.partial && scanCacheKV) {
+          try {
+            await scanCacheKV.delete(cacheKey);
+          } catch {
+          }
+        }
         runtimeOptions?.resultCapture?.(result);
         logResult = result.passed ? "pass" : "fail";
         logDetails = result;
@@ -9977,7 +10225,7 @@ async function handleToolsCall(params, scanCacheKV, runtimeOptions) {
             authTier: runtimeOptions?.authTier
           });
           const content = [mcpText(formatScanReport(result, effectiveFormat))];
-          if (!interactive) {
+          if (effectiveFormat === "full") {
             const structured = buildStructuredScanResult(result);
             content.push(mcpText(`<!-- STRUCTURED_RESULT
 ${JSON.stringify(structured)}
@@ -10412,7 +10660,7 @@ STRUCTURED_RESULT -->`));
             clientType: runtimeOptions?.clientType,
             authTier: runtimeOptions?.authTier
           });
-          return buildToolErrorResult(`Unknown tool: ${name}`);
+          return buildToolErrorResult(`Unknown tool: ${name}. Call tools/list to see all 44 available tools.`);
       }
     };
     return await Promise.race([
@@ -10437,7 +10685,7 @@ STRUCTURED_RESULT -->`));
         isError: true
       };
     }
-    const message = sanitizeErrorMessage(err, "An unexpected error occurred");
+    const message = sanitizeErrorMessage(err, `An unexpected error occurred while running ${name}. Retry the request \u2014 transient DNS failures are common.`);
     logToolFailure({
       toolName: name,
       durationMs: Date.now() - startTime,
@@ -11289,6 +11537,7 @@ async function executeMcpRequest(options) {
       };
     }
   }
+  let concurrencyPrincipalId;
   if (method !== "tools/call") {
     const controlPlaneLimited = await buildControlPlaneRateLimitResponse(
       options.ip,
@@ -11312,12 +11561,13 @@ async function executeMcpRequest(options) {
     }
   }
   let sessionRevived = false;
-  if (options.validateSession && method !== "initialize" && !method.startsWith("notifications/")) {
+  const isSessionlessProtocolMethod = options.isAuthenticated && (method === "tools/list" || method === "resources/list" || method === "prompts/list" || method === "prompts/get" || method === "ping");
+  if (options.validateSession && method !== "initialize" && !method.startsWith("notifications/") && !isSessionlessProtocolMethod) {
     const sessionError = await validateSessionRequest(
       options.sessionId,
       options.sessionStore,
       id,
-      options.sessionErrorMessage ?? "Bad Request: missing session"
+      options.sessionErrorMessage ?? "Bad Request: missing session. Send an initialize request first to create a session."
     );
     if (sessionError) {
       const canRecoverExpiredSession = sessionError.status === 404 && typeof options.sessionId === "string" && options.sessionId.length > 0;
@@ -11365,6 +11615,43 @@ async function executeMcpRequest(options) {
     emitRequestAnalytics(options, method, "ok", false);
     return { kind: "notification" };
   }
+  if (method === "tools/call") {
+    const tier = options.tierAuthResult?.authenticated && options.tierAuthResult.tier ? options.tierAuthResult.tier : "free";
+    const concurrencyLimit = TIER_CONCURRENT_LIMITS[tier];
+    concurrencyPrincipalId = options.tierAuthResult?.authenticated && options.tierAuthResult.keyHash ? options.tierAuthResult.keyHash : options.ip;
+    if (concurrencyLimit !== Infinity) {
+      const concurrencyResult = acquireConcurrencySlot(concurrencyPrincipalId, concurrencyLimit);
+      if (!concurrencyResult.allowed) {
+        const concurrencyHeaders = {
+          ...rateHeaders,
+          "retry-after": String(Math.ceil((concurrencyResult.retryAfterMs ?? 1e3) / 1e3))
+        };
+        options.analytics?.emitRateLimitEvent({
+          limitType: "concurrency",
+          toolName: "n/a",
+          limit: concurrencyLimit,
+          remaining: 0,
+          country: options.country,
+          authTier: options.authTier ?? tier
+        });
+        emitRequestAnalytics(options, method, "error", true);
+        return {
+          kind: "response",
+          payload: jsonRpcError(
+            id,
+            JSON_RPC_ERRORS.RATE_LIMITED,
+            `Rate limit exceeded. ${tier} tier is limited to ${concurrencyLimit} concurrent requests.`
+          ),
+          headers: concurrencyHeaders,
+          httpStatus: 200,
+          useErrorEnvelope: true,
+          eventId
+        };
+      }
+    } else {
+      concurrencyPrincipalId = void 0;
+    }
+  }
   if (options.allowStreaming && method === "tools/call" && options.responseTransport === "sse" && acceptsSSE(options.accept)) {
     const dispatchPromise = dispatchMcpMethod({
       id,
@@ -11414,6 +11701,8 @@ async function executeMcpRequest(options) {
       const hasJsonRpcError = typeof dispatchResult.payload === "object" && dispatchResult.payload !== null && "error" in dispatchResult.payload;
       emitRequestAnalytics(options, method, hasJsonRpcError ? "error" : "ok", hasJsonRpcError);
       return dispatchResult.payload;
+    }).finally(() => {
+      if (concurrencyPrincipalId) releaseConcurrencySlot(concurrencyPrincipalId);
     });
     return {
       kind: "response",
@@ -11514,11 +11803,13 @@ async function executeMcpRequest(options) {
       useErrorEnvelope: true,
       eventId
     };
+  } finally {
+    if (concurrencyPrincipalId) releaseConcurrencySlot(concurrencyPrincipalId);
   }
 }
 
 // src/lib/server-version.ts
-var SERVER_VERSION = "2.2.2";
+var SERVER_VERSION = "2.3.5";
 
 // src/stdio.ts
 function buildNotInitializedError(id) {