git-paid 2.1.2 → 2.1.4

package/lib/mcp.js

@@ -7,9 +7,22 @@ import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 import { scanTargetUrl, searchBuyerIntentRadar, dispatchDirectories, DIRECTORIES } from "./engine.js";
+import { verifyCliLicense } from "./auth.js";
 import { applyLocalSeoFixes } from "./fixer.js";
-import { listInboxMessages, sendTestVerificationEmail } from "./inbox.js";
-import { withStatefulMcp, createGenericEntityAdapter } from "./stateful-mcp.js";
+import { listInboxMessages, sendTestVerificationEmail, getBotInboxForDomain, markMessageVerified } from "./inbox.js";
+import { withStatefulMcp, createGenericEntityAdapter, spotlightUntrustedText } from "./stateful-mcp.js";
+import { safeFetch } from "./safe-fetch.js";
+
+const ALLOWED_VERIFY_DOMAINS = [
+  "postbuild.dev",
+  ...DIRECTORIES.map((d) => {
+    try {
+      return new URL(d.url).hostname.replace(/^www\./i, "").toLowerCase();
+    } catch {
+      return null;
+    }
+  }).filter(Boolean)
+];
 
 // ─── 1. STATEFUL MCP ENTITY ADAPTERS ──────────────────────────────────────────
 
@@ -42,7 +55,7 @@ export const inboxEntityAdapter = createGenericEntityAdapter({
   updatedAtField: "receivedAt",
   stubFields: ["id", "from", "otpCode", "primaryLink", "autoVerified"],
   journalFields: ["verificationLinks"],
-  untrustedTextFields: ["subject", "snippet"],
+  untrustedTextFields: ["from", "subject", "snippet", "primaryLink", "otpCode"],
   isActiveRecord: () => true
 });
 
@@ -83,7 +96,7 @@ export const mcpRadar = withStatefulMcp({
 
 const domainDirectoryState = new Map();
 
-function getDomainDirectories(targetUrl = "https://postbuild.dev", report = null) {
+function getDomainDirectories(targetUrl = "https://www.postbuild.dev", report = null) {
   const domain = targetUrl.replace(/^https?:\/\//i, "").replace(/^www\./i, "").split("/")[0] || "postbuild.dev";
   if (!domainDirectoryState.has(domain)) {
     const baseDirs = (report?.directories || DIRECTORIES).map((d, idx) => ({
@@ -110,46 +123,56 @@ function getDomainDirectories(targetUrl = "https://postbuild.dev", report = null
   return domainDirectoryState.get(domain);
 }
 
-// ─── 2. HANDS-FREE INBOX AUTO-VERIFIER ────────────────────────────────────────
+// ─── 2. HANDS-FREE INBOX AUTO-VERIFIER (OPT-IN & SSRF-ALLOWLISTED) ────────────
 
-export async function autoVerifyInboxLinks(inboxAddress = "postbuild-bot@postbuild.dev") {
-  const res = await listInboxMessages(inboxAddress);
+export async function autoVerifyInboxLinks(inboxAddress = "", options = {}) {
+  const shouldAutoVerify = options.autoVerify === true;
+  const targetMessageId = options.messageId ? String(options.messageId).trim() : "";
+  const res = await listInboxMessages(inboxAddress || getBotInboxForDomain("postbuild.dev"), {
+    allowRemoteFallback: options.allowRemoteFallback,
+    bearerToken: options.bearerToken
+  });
   const verificationResults = [];
 
   for (const m of res.messages) {
+    const shouldVerifyThisRow =
+      shouldAutoVerify && (!targetMessageId || m.id === targetMessageId);
     const entry = {
       id: m.id,
       from: m.from,
       subject: m.subject,
       otpCode: m.otpCode || null,
-      primaryLink: m.primaryLink || null,
-      autoVerified: false,
-      httpStatus: null,
+      primaryLink: m.primaryLink ? spotlightUntrustedText(m.primaryLink) : null,
+      verificationUrl: m.verificationUrl || (m.primaryLink && /^https:\/\//i.test(m.primaryLink) ? m.primaryLink : null),
+      autoVerified: Boolean(m.autoVerified || m.status === "verified"),
+      status: m.status,
+      httpStatus: m.httpStatus ?? null,
       version_etag: m.autoVerified ? "v2" : "v1",
       receivedAt: m.receivedAt,
       snippet: m.snippet
     };
 
-    if (m.primaryLink && /^https?:\/\//i.test(m.primaryLink)) {
+    if (shouldVerifyThisRow && !entry.autoVerified && m.primaryLink && /^https?:\/\//i.test(m.primaryLink)) {
       try {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), 4500);
-        const resp = await fetch(m.primaryLink, {
+        const resp = await safeFetch(m.primaryLink, {
           method: "GET",
-          redirect: "follow",
-          signal: controller.signal,
+          timeoutMs: 4500,
+          allowedDomains: ALLOWED_VERIFY_DOMAINS,
+          lookupFn: options.lookupFn,
           headers: {
-            "User-Agent": "Postbuild-Autonomous-Verifier/2.1 (+https://postbuild.dev)"
+            "User-Agent": "Postbuild-Verifier/2.1 (+https://www.postbuild.dev)"
           }
         });
-        clearTimeout(timer);
         entry.autoVerified = resp.ok || resp.status < 400;
         entry.httpStatus = resp.status;
+        entry.status = entry.autoVerified ? "verified" : m.status;
         entry.version_etag = "v2";
+        if (entry.autoVerified) {
+          markMessageVerified(m.id, true, resp.status);
+        }
       } catch {
-        entry.autoVerified = m.primaryLink.includes("postbuild.dev") || m.primaryLink.includes("confirm");
-        entry.httpStatus = entry.autoVerified ? 200 : 0;
-        entry.version_etag = "v2";
+        entry.autoVerified = false;
+        entry.httpStatus = 0;
       }
     }
 
@@ -160,7 +183,9 @@ export async function autoVerifyInboxLinks(inboxAddress = "postbuild-bot@postbui
     inboxAddress: res.inboxAddress,
     totalMessages: verificationResults.length,
     verifiedCount: verificationResults.filter((x) => x.autoVerified).length,
-    extractedOtps: verificationResults.filter((x) => x.otpCode).map((x) => ({ from: x.from, otp: x.otpCode })),
+    extractedOtps: verificationResults
+      .filter((x) => x.otpCode)
+      .map((x) => ({ from: spotlightUntrustedText(x.from), otp: spotlightUntrustedText(x.otpCode) })),
     messages: verificationResults
   };
 }
@@ -242,21 +267,20 @@ export async function runStatefulMcpSimulation({
 // ─── 4. OBSIDIAN VAULTOS TELEMETRY & DASHBOARD SYNC ───────────────────────────
 
 export async function syncPostbuildToVault({
-  vaultPath = "C:\\Users\\Bennett\\Bennett Labs",
-  urls = ["https://postbuild.dev", "https://payarity.com"],
-  sessionId = "vaultos-sync"
+  vaultPath = process.cwd(),
+  urls = ["https://www.postbuild.dev"],
+  sessionId = "vaultos-sync",
+  bearerToken = ""
 } = {}) {
   const projectsData = [];
 
   for (const targetUrl of urls) {
     const report = await scanTargetUrl(targetUrl);
     const state = getDomainDirectories(targetUrl, report);
-
-    const currentInbox = await listInboxMessages(report.botEmail);
-    if (currentInbox.count === 0) {
-      await sendTestVerificationEmail(report.botEmail, report.domain);
-    }
-    const verifiedInbox = await autoVerifyInboxLinks(report.botEmail);
+    const verifiedInbox = await autoVerifyInboxLinks(report.botEmail, {
+      autoVerify: false,
+      bearerToken
+    });
 
     const dirsQuery = await mcpDirectories.queryWithSupersetCache({
       sessionId,
@@ -281,7 +305,7 @@ export async function syncPostbuildToVault({
       botEmail: report.botEmail,
       inboxCount: verifiedInbox.totalMessages,
       autoVerifiedLinks: verifiedInbox.verifiedCount,
-      latestOtp: verifiedInbox.extractedOtps[0]?.otp || "849204",
+      latestOtp: verifiedInbox.extractedOtps[0]?.otp || "None",
       mcpReductionPct: mcpPass2._mcp?.payload_bytes?.reduction_pct || "-75.4%",
       mcpQueryMs: mcpPass2._mcp?.query_ms || 0.04,
       updatedAt: new Date().toISOString()
@@ -311,26 +335,54 @@ export async function syncPostbuildToVault({
   };
 
   const writtenVaultFiles = [];
+  const effectiveTarget = fs.existsSync(vaultPath) ? vaultPath : process.cwd();
+  const isObsidianVault =
+    fs.existsSync(path.join(effectiveTarget, ".obsidian")) ||
+    fs.existsSync(path.join(effectiveTarget, "_dashboards"));
 
-  if (fs.existsSync(vaultPath)) {
-    const metaDir = path.join(vaultPath, "_meta");
+  if (isObsidianVault) {
+    const metaDir = path.join(effectiveTarget, "_meta");
     fs.mkdirSync(metaDir, { recursive: true });
     const metaFile = path.join(metaDir, "postbuild-telemetry.json");
     fs.writeFileSync(metaFile, JSON.stringify(telemetryPayload, null, 2), "utf8");
     writtenVaultFiles.push(metaFile);
 
-    const dashboardsDir = path.join(vaultPath, "_dashboards");
+    const dashboardsDir = path.join(effectiveTarget, "_dashboards");
     if (fs.existsSync(dashboardsDir)) {
       const pbDashboardPath = path.join(dashboardsDir, "Postbuild Launch.md");
       const pbDashboardContent = buildVaultOsPostbuildDashboardMarkdown();
       fs.writeFileSync(pbDashboardPath, pbDashboardContent, "utf8");
       writtenVaultFiles.push(pbDashboardPath);
     }
+  } else {
+    const pbDir = path.join(effectiveTarget, ".postbuild");
+    fs.mkdirSync(pbDir, { recursive: true });
+    const jsonFile = path.join(pbDir, "telemetry.json");
+    fs.writeFileSync(jsonFile, JSON.stringify(telemetryPayload, null, 2), "utf8");
+    writtenVaultFiles.push(jsonFile);
+
+    const mdLines = [
+      "# postbuild Launch & SEO Status Report",
+      "",
+      `> Synced: \`${telemetryPayload.generatedAt}\` via \`postbuild-mcp\``,
+      "",
+      "| Domain | Readiness Score | Checks | Programmatic SEO | Directories | Bot Inbox | Latest OTP |",
+      "| :--- | :--- | :--- | :--- | :--- | :--- | :--- |",
+      ...telemetryPayload.projects.map(
+        (p) =>
+          `| **${p.domain}** | **${p.readinessScore}/100** | ${p.passedChecks}/${p.totalChecks} | ${p.pseoCount} Routes | ${p.directoryCount} (${p.autoVerifiedLinks} Verified) | \`${p.botEmail}\` | \`${p.latestOtp}\` |`
+      ),
+      ""
+    ];
+    const mdFile = path.join(effectiveTarget, "LAUNCH_STATUS.md");
+    fs.writeFileSync(mdFile, mdLines.join("\n"), "utf8");
+    writtenVaultFiles.push(mdFile);
   }
 
   return {
     ok: true,
-    vaultPath,
+    mode: isObsidianVault ? "obsidian_vault" : "markdown_repo",
+    vaultPath: effectiveTarget,
     writtenVaultFiles,
     telemetry: telemetryPayload
   };
@@ -339,7 +391,7 @@ export async function syncPostbuildToVault({
 function buildVaultOsPostbuildDashboardMarkdown() {
   return `---
 aliases:
-  - Postbuild Launch Cockpit
+  - Postbuild Launch Dashboard
   - "_dashboards/Postbuild Launch"
 tags:
   - dashboard
@@ -351,7 +403,7 @@ cssclasses:
 ---
 
 \`\`\`dataviewjs
-// ─── POSTBUILD MCP LAUNCH COCKPIT ────────────────────────────────────────────
+// ─── POSTBUILD MCP LAUNCH DASHBOARD ──────────────────────────────────────────
 // Reads cached telemetry from _meta/postbuild-telemetry.json (<2ms render)
 // ─────────────────────────────────────────────────────────────────────────────
 
@@ -391,8 +443,8 @@ root.innerHTML = \`
 
   <div class="hero-strip">
     <div>
-      <div class="hero-title">Postbuild Launch &amp; SEO Command Center</div>
-      <div class="hero-subtitle">Managed autonomously by Gemini × Postbuild MCP (<code>npx postbuild mcp</code>)</div>
+      <div class="hero-title">Postbuild Launch &amp; SEO Dashboard</div>
+      <div class="hero-subtitle">Managed autonomously by Postbuild MCP (<code>npx git-paid mcp</code>)</div>
     </div>
     <div class="stat-group">
       <div class="stat-block">
@@ -422,7 +474,7 @@ root.innerHTML = \`
           <span class="badge" style="background:rgba(16,185,129,0.15); color:#10b981; border:1px solid rgba(16,185,129,0.3);">LIVE AUDITS</span>
           Domain Readiness, pSEO &amp; Directory Dispatch
         </div>
-        <a class="action-btn" href="https://postbuild.dev" style="text-decoration:none;">Open Studio -></a>
+        <a class="action-btn" href="https://www.postbuild.dev" style="text-decoration:none;">Open Studio -></a>
       </div>
       <div style="display:flex; flex-direction:column; gap:8px;">
         \${projects.map(p => \`
@@ -431,7 +483,7 @@ root.innerHTML = \`
               <strong style="font-size:14px;">\${p.domain}</strong>
               <span class="badge badge-cyan" style="margin-left:8px;">\${p.passedChecks}/\${p.totalChecks} Checks Passed</span>
               <div style="font-size:11.5px; color:var(--text-muted); margin-top:4px;">
-                <code>\${p.botEmail}</code> · \${p.pseoCount} pSEO Routes · \${p.directoryCount} Directories (\${p.autoVerifiedLinks} Auto-Verified) · Latest OTP: <code>\${p.latestOtp}</code>
+                <code>\${p.botEmail}</code> · \${p.pseoCount} pSEO Routes · \${p.directoryCount} Directories (\${p.autoVerifiedLinks} Verified) · Latest OTP: <code>\${p.latestOtp}</code>
               </div>
             </div>
             <div style="text-align:right;">
@@ -469,7 +521,7 @@ root.innerHTML = \`
 `;
 }
 
-// ─── 5. AGENT SKILL & CONFIG SCAFFOLDER (`npx postbuild init-agent`) ──────────
+// ─── 5. AGENT SKILL & CONFIG SCAFFOLDER (`npx git-paid skill`) ───────────────
 
 export function installAgentSkillFiles({ cwd = process.cwd() } = {}) {
   const skillDir = path.join(cwd, ".agent", "skills", "postbuild");
@@ -478,12 +530,12 @@ export function installAgentSkillFiles({ cwd = process.cwd() } = {}) {
   const skillMdPath = path.join(skillDir, "SKILL.md");
   const skillMd = `---
 name: postbuild
-description: Autonomous Post-Build SEO, 85-Directory Dispatch, @postbuild.dev Inbox Auto-Verifier, and Obsidian VaultOS Sync powered by Postbuild MCP (postbuild-mcp v2.1.0).
+description: Autonomous Post-Build SEO, 85-Directory Launch Kit, @postbuild.dev Inbox Verifier, and Markdown Launch Status Sync powered by Postbuild MCP (git-paid).
 ---
 
-# Postbuild (\`git paid\`) Agent Skill
+# Postbuild (\`git-paid\`) Agent Skill
 
-Use the \`postbuild\` MCP server (\`npx postbuild mcp\`) or CLI (\`npx postbuild\`) to audit, fix, monetize, and launch any web project.
+Use the \`git-paid\` MCP server (\`npx -y git-paid mcp\`) or CLI (\`npx git-paid\`) to audit, fix, monetize, and launch any web project.
 
 ## MCP Server Configuration (\`.mcp.json\` / \`mcp_config.json\`)
 \`\`\`json
@@ -491,7 +543,7 @@ Use the \`postbuild\` MCP server (\`npx postbuild mcp\`) or CLI (\`npx postbuild
   "mcpServers": {
     "postbuild": {
       "command": "npx",
-      "args": ["-y", "postbuild", "mcp"]
+      "args": ["-y", "git-paid", "mcp"]
     }
   }
 }
@@ -499,11 +551,11 @@ Use the \`postbuild\` MCP server (\`npx postbuild mcp\`) or CLI (\`npx postbuild
 
 ## Available Postbuild MCP Tools
 1. \`postbuild_scan\` — Run the 8-check live Monetization & SEO audit on any URL.
-2. \`postbuild_directories\` — Query the 85 startup & AI directories using In-Memory Superset Caching (1ms subset filtering) + Watermark Context Residuals (\`unchanged@vN\`, -75% to -90% tokens).
+2. \`postbuild_directories\` — Query the 85 startup & AI directories using In-Memory Superset Caching + Watermark Context Residuals (\`unchanged@vN\`).
 3. \`postbuild_pseo\` — Query the 25 Programmatic SEO routes with stateful delta compaction.
-4. \`postbuild_dispatch\` — Dispatch a project to directories protected by Two-Phase Cryptographic OCC (\`dry_run: true\` issues \`commit_token: "ct_..."\`; \`dry_run: false\` commits).
-5. \`postbuild_inbox\` — Read \`<slug>-bot@postbuild.dev\` with Untrusted Content Spotlighting and automatically click/confirm directory verification links (\`auto_verify: true\`).
-6. \`postbuild_vault_sync\` — Sync all live readiness scores, inbox OTPs, MCP token savings, and Buyer Radar threads directly into an Obsidian VaultOS dashboard (\`_meta/postbuild-telemetry.json\` & \`_dashboards/Postbuild Launch.md\`).
+4. \`postbuild_dispatch\` — Prepare 85 prefilled launch links and ping IndexNow/WebSub protected by Two-Phase Cryptographic OCC (\`dry_run: true\` issues \`commit_token: "ct_..."\`; \`dry_run: false\` commits).
+5. \`postbuild_inbox\` — Read \`<slug>-<hash>@postbuild.dev\` with Untrusted Content Spotlighting and optionally verify allowlisted directory confirmation links (\`auto_verify: true\`).
+6. \`postbuild_vault_sync\` — Write \`LAUNCH_STATUS.md\` and \`.postbuild/telemetry.json\` to any repository (or sync to an Obsidian VaultOS dashboard if present).
 `;
   fs.writeFileSync(skillMdPath, skillMd, "utf8");
 
@@ -514,24 +566,24 @@ Use the \`postbuild\` MCP server (\`npx postbuild mcp\`) or CLI (\`npx postbuild
       mcpServers: {
         postbuild: {
           command: "npx",
-          args: ["-y", "postbuild", "mcp"]
+          args: ["-y", "git-paid", "mcp"]
         }
       }
     }
   };
 }
 
-// ─── 6. STDIO JSON-RPC 2.0 MCP SERVER (`npx postbuild mcp`) ───────────────────
+// ─── 6. STDIO JSON-RPC 2.0 MCP SERVER (`npx git-paid mcp`) ───────────────────
 
 export const MCP_TOOLS = [
   {
     name: "postbuild_scan",
     description:
-      "Run an 8-point Post-Build Monetization, AI Crawler, & SEO audit on any URL and provision a dedicated <slug>-bot@postbuild.dev verification inbox.",
+      "Run an 8-point Post-Build Monetization, AI Crawler, & SEO audit on any URL and provision a dedicated <slug>-<hash>@postbuild.dev verification inbox.",
     inputSchema: {
       type: "object",
       properties: {
-        url: { type: "string", description: "Target URL or domain (e.g. https://postbuild.dev)" }
+        url: { type: "string", description: "Target URL or domain (e.g. https://www.postbuild.dev)" }
       },
       required: ["url"]
     }
@@ -539,11 +591,11 @@ export const MCP_TOOLS = [
   {
     name: "postbuild_directories",
     description:
-      "Search and filter the 85 startup, AI, and developer directories using In-Memory Superset Cache and Watermark Context Residuals (unchanged@vN / updated@vN) for >75% token reduction.",
+      "Search and filter the 85 startup, AI, and developer directories using In-Memory Superset Cache and Watermark Context Residuals (unchanged@vN / updated@vN).",
     inputSchema: {
       type: "object",
       properties: {
-        url: { type: "string", description: "Target URL (default: https://postbuild.dev)" },
+        url: { type: "string", description: "Target URL (default: https://www.postbuild.dev)" },
         category: { type: "string", description: "Optional category filter (e.g. AI, SaaS, Developer, Launch)" },
         status: { type: "string", description: "Optional status filter (ready_auto, queued, dispatched)" },
         min_da: { type: "number", description: "Minimum Domain Rating (0-100)" },
@@ -568,7 +620,7 @@ export const MCP_TOOLS = [
   {
     name: "postbuild_dispatch",
     description:
-      "Dispatch a domain across the 85 directories with Two-Phase Cryptographic OCC Guard. Call with dry_run: true first to receive a commit_token (ct_...), then call with dry_run: false and commit_token to commit.",
+      "Prepare 85 prefilled directory links and ping IndexNow/WebSub with Two-Phase Cryptographic OCC Guard. Call with dry_run: true first to receive a commit_token (ct_...), then call with dry_run: false and commit_token to commit.",
     inputSchema: {
       type: "object",
       properties: {
@@ -576,7 +628,7 @@ export const MCP_TOOLS = [
         directory_ids: {
           type: "array",
           items: { type: "string" },
-          description: "Optional subset of directory IDs (omit for all auto-dispatch directories)"
+          description: "Optional subset of directory IDs"
         },
         expected_version: { type: "string", description: "Expected version watermark (e.g. v1)" },
         dry_run: { type: "boolean", description: "Phase 1 preview mode (default: true)" },
@@ -588,13 +640,12 @@ export const MCP_TOOLS = [
   {
     name: "postbuild_inbox",
     description:
-      "Check the dedicated <slug>-bot@postbuild.dev verification inbox with Untrusted Content Spotlighting. Set auto_verify: true to have the agent automatically click confirmation links and extract 6-digit OTPs.",
+      "Check the dedicated <slug>-<hash>@postbuild.dev verification inbox with Untrusted Content Spotlighting. Set auto_verify: true to follow allowlisted directory confirmation links.",
     inputSchema: {
       type: "object",
       properties: {
-        inbox: { type: "string", description: "Bot inbox address (e.g. postbuild-bot@postbuild.dev)" },
-        auto_verify: { type: "boolean", description: "Automatically follow confirmation links (default: true)" },
-        send_test: { type: "boolean", description: "Send a test verification email first" }
+        inbox: { type: "string", description: "Bot inbox address" },
+        auto_verify: { type: "boolean", description: "Opt-in: follow allowlisted confirmation links (default: false)" }
       }
     }
   },
@@ -614,13 +665,13 @@ export const MCP_TOOLS = [
   {
     name: "postbuild_vault_sync",
     description:
-      "Sync live Postbuild SEO scores, 85-directory status, inbox OTPs, Buyer Radar threads, and MCP token telemetry into an Obsidian VaultOS dashboard (_meta/postbuild-telemetry.json & _dashboards/Postbuild Launch.md).",
+      "Write LAUNCH_STATUS.md and .postbuild/telemetry.json into a local project directory (or sync to an Obsidian VaultOS dashboard if .obsidian/ is present).",
     inputSchema: {
       type: "object",
       properties: {
         vault_path: {
           type: "string",
-          description: "Absolute path to Obsidian vault (default: C:\\Users\\Bennett\\Bennett Labs)"
+          description: "Target repository or Obsidian vault path (defaults to current working directory)"
         },
         urls: {
           type: "array",
@@ -632,28 +683,40 @@ export const MCP_TOOLS = [
   }
 ];
 
-export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio-session") {
+export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio-session", authToken = "") {
   if (name === "postbuild_scan") {
-    const report = await scanTargetUrl(args.url || "https://postbuild.dev");
+    const report = await scanTargetUrl(args.url || "https://www.postbuild.dev");
+    const license = await verifyCliLicense({ domain: report.domain, token: authToken });
     getDomainDirectories(report.targetUrl, report);
     return {
       domain: report.domain,
       targetUrl: report.targetUrl,
       readinessScore: report.readinessScore,
       botEmail: report.botEmail,
+      licenseStatus: license.valid ? "PRO_ACTIVE" : "FREE_PREVIEW",
       checks: report.checks,
       pseoRouteCount: report.pseoPages.length,
-      directoryCount: report.directoryCount
+      directoryCount: report.directoryCount,
+      ...(license.valid
+        ? {}
+        : {
+            upgradeNotice: license.message,
+            checkoutUrl: license.checkoutUrl,
+            loginCommand: "npx git-paid login <your-pb_live_key>"
+          })
     };
   }
 
   if (name === "postbuild_directories") {
-    const targetUrl = args.url || "https://postbuild.dev";
+    const targetUrl = args.url || "https://www.postbuild.dev";
     const state = getDomainDirectories(targetUrl);
+    const license = await verifyCliLicense({ domain: state.domain, token: authToken });
     const catFilter = (args.category || "").toLowerCase();
     const statusFilter = (args.status || "").toLowerCase();
     const minDa = Number(args.min_da) || 0;
 
+    const maxAllowed = license.valid ? Number(args.limit) || 25 : 5;
+
     const records = await mcpDirectories.queryWithSupersetCache({
       sessionId,
       cacheKey: `dirs:${state.domain}`,
@@ -662,20 +725,34 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
         (!catFilter || d.category.toLowerCase().includes(catFilter)) &&
         (!statusFilter || d.status.toLowerCase().includes(statusFilter)) &&
         d.dr >= minDa,
-      limit: Number(args.limit) || 25,
+      limit: maxAllowed,
       bypassCache: Boolean(args.bypass_cache)
     });
 
-    return mcpDirectories.compactList({
+    const compacted = mcpDirectories.compactList({
       sessionId,
       records,
       bypassCache: Boolean(args.bypass_cache)
     });
+
+    if (!license.valid) {
+      return {
+        ...compacted,
+        _license_status: "PREVIEW_ONLY_5_OF_85",
+        _locked_directories: 80,
+        _checkout_url: license.checkoutUrl,
+        _unlock_instructions: "Purchase a $29 Launch Pass and run: npx git-paid login <pb_live_key>"
+      };
+    }
+    return compacted;
   }
 
   if (name === "postbuild_pseo") {
-    const targetUrl = args.url || "https://postbuild.dev";
+    const targetUrl = args.url || "https://www.postbuild.dev";
+    const license = await verifyCliLicense({ domain: targetUrl.replace(/^https?:\/\//, ""), token: authToken });
     const intentFilter = (args.intent || "").toLowerCase();
+    const maxAllowed = license.valid ? 25 : 3;
+
     const records = await mcpPseo.queryWithSupersetCache({
       sessionId,
       cacheKey: `pseo:${targetUrl}`,
@@ -688,20 +765,43 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
         }));
       },
       filter: (p) => !intentFilter || p.intent.toLowerCase().includes(intentFilter),
-      limit: 25,
+      limit: maxAllowed,
       bypassCache: Boolean(args.bypass_cache)
     });
 
-    return mcpPseo.compactList({
+    const compacted = mcpPseo.compactList({
       sessionId,
       records,
       bypassCache: Boolean(args.bypass_cache)
     });
+
+    if (!license.valid) {
+      return {
+        ...compacted,
+        _license_status: "PREVIEW_ONLY_3_OF_25",
+        _locked_routes: 22,
+        _checkout_url: license.checkoutUrl,
+        _unlock_instructions: "Purchase a $29 Launch Pass and run: npx git-paid login <pb_live_key>"
+      };
+    }
+    return compacted;
   }
 
   if (name === "postbuild_dispatch") {
-    const targetUrl = args.url || "https://postbuild.dev";
+    const targetUrl = args.url || "https://www.postbuild.dev";
     const state = getDomainDirectories(targetUrl);
+    const license = await verifyCliLicense({ domain: state.domain, token: authToken });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        domain: state.domain,
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     const dryRun = args.dry_run !== undefined ? Boolean(args.dry_run) : true;
     const targetIds = Array.isArray(args.directory_ids) ? args.directory_ids : [];
 
@@ -748,7 +848,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
     state.updated_at = nowIso;
     for (const d of state.directories) {
       if (!targetIds.length || targetIds.includes(d.id)) {
-        d.status = d.autoSubmit ? "dispatched" : "guided_ready";
+        d.status = d.autoSubmit ? "indexnow_pinged_form_ready" : "prefilled_ready";
         d.version_etag = nextVer;
         d.updated_at = nowIso;
       }
@@ -765,14 +865,23 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_inbox") {
-    const inboxAddr = args.inbox || "postbuild-bot@postbuild.dev";
-    if (args.send_test) {
-      await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
+    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
     }
-    const autoVerify = args.auto_verify !== undefined ? Boolean(args.auto_verify) : true;
-    const result = autoVerify
-      ? await autoVerifyInboxLinks(inboxAddr)
-      : await listInboxMessages(inboxAddr);
+
+    const inboxAddr = args.inbox || license.inbox || getBotInboxForDomain(license.domain || "postbuild.dev", license.email);
+    const autoVerify = Boolean(args.auto_verify);
+    const result = await autoVerifyInboxLinks(inboxAddr, {
+      autoVerify,
+      bearerToken: license.token
+    });
 
     const compacted = mcpInbox.compactList({
       sessionId,
@@ -789,7 +898,19 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_fix") {
-    const report = await scanTargetUrl(args.url || "https://postbuild.dev");
+    const report = await scanTargetUrl(args.url || "https://www.postbuild.dev");
+    const license = await verifyCliLicense({ domain: report.domain, token: authToken });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        domain: report.domain,
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     const fixRes = applyLocalSeoFixes(report, {
       cwd: args.cwd || process.cwd(),
       overwritePublic: true
@@ -798,10 +919,22 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_vault_sync") {
+    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    if (!license.valid) {
+      return {
+        isError: true,
+        status: "PRO_LICENSE_REQUIRED",
+        checkoutUrl: license.checkoutUrl,
+        message: license.message,
+        loginCommand: "npx git-paid login <your-pb_live_key>"
+      };
+    }
+
     return await syncPostbuildToVault({
-      vaultPath: args.vault_path || "C:\\Users\\Bennett\\Bennett Labs",
-      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : ["https://postbuild.dev", "https://payarity.com"],
-      sessionId
+      vaultPath: args.vault_path || process.cwd(),
+      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : ["https://www.postbuild.dev"],
+      sessionId,
+      bearerToken: license.token
     });
   }