git-paid 2.1.5 → 2.1.7

package/lib/guard.js

@@ -0,0 +1,402 @@
+/**
+ * Unified Authentication, Inbox Ownership, Admin Guard, CORS & Rate Limiting for Postbuild API Routes
+ */
+
+import crypto from "node:crypto";
+import dns from "node:dns/promises";
+import {
+  verifyLicenseToken,
+  checkStripeCustomerStatusCached,
+  getFounderEmailsSet,
+  getDomainVerificationToken,
+  getCandidateVerificationTokens,
+  isSameDomainVerifiedEmail,
+  isFreeEmailDomain
+} from "./auth.js";
+import { getBotInboxForDomain, normalizeInboxInput } from "./inbox.js";
+import { safeFetch } from "./safe-fetch.js";
+
+export { getDomainVerificationToken };
+
+const rateLimitBuckets = new Map(); // `${bucket}:${ip}` -> { count: number, resetAt: number }
+const verifiedDomainCache = new Map(); // `${domain}:${email}` -> { verifiedAt: number, method: string }
+const failedDomainCache = new Map(); // `${domain}:${email}` -> { failedAt: number, payload: object }
+
+const ALLOWED_ORIGINS = new Set([
+  "https://www.postbuild.dev",
+  "https://postbuild.dev"
+]);
+
+export function applyCorsHeaders(req, res) {
+  const origin = req.headers?.origin || "";
+  if (ALLOWED_ORIGINS.has(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  } else {
+    res.setHeader("Access-Control-Allow-Origin", "https://www.postbuild.dev");
+  }
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Admin-Secret");
+}
+
+export function extractBearerToken(req, body = null) {
+  const header = req.headers?.authorization || req.headers?.Authorization || "";
+  if (typeof header === "string" && header.startsWith("Bearer ")) {
+    return header.slice(7).trim();
+  }
+  if (body && typeof body === "object" && typeof body.token === "string") {
+    return body.token.trim();
+  }
+  return "";
+}
+
+export function requireLicense(req, body = null) {
+  const token = extractBearerToken(req, body);
+  if (!token) return null;
+  try {
+    const verified = verifyLicenseToken(token);
+    return verified && verified.valid && verified.email ? { ...verified, token } : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function requireLicenseAsync(req, body = null) {
+  const verified = requireLicense(req, body);
+  if (!verified) return null;
+  const remoteStatus = await checkStripeCustomerStatusCached(verified);
+  if (remoteStatus !== "active") {
+    return null;
+  }
+  return verified;
+}
+
+export function isValidProjectDomain(rawDomain = "", allowPostbuildOperator = false) {
+  const clean = String(rawDomain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^(www\.)+/, "")
+    .split("/")[0]
+    .split("?")[0]
+    .split("#")[0]
+    .split(":")[0];
+
+  if (!clean || !clean.includes(".") || clean.length < 4 || clean.length > 253) {
+    return { valid: false, domain: "" };
+  }
+  if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(clean)) {
+    return { valid: false, domain: "" };
+  }
+  const labels = clean.split(".");
+  const tld = labels[labels.length - 1];
+  if (tld.length < 2 || /^\d+$/.test(tld)) {
+    return { valid: false, domain: "" };
+  }
+  if (
+    clean === "example.com" ||
+    clean.endsWith(".invalid") ||
+    clean.endsWith(".localhost") ||
+    clean.endsWith(".local") ||
+    clean.endsWith(".internal")
+  ) {
+    return { valid: false, domain: "" };
+  }
+  if (!allowPostbuildOperator && (clean === "postbuild.dev" || clean.endsWith(".postbuild.dev"))) {
+    return { valid: false, domain: "" };
+  }
+  return { valid: true, domain: clean };
+}
+
+export function requireAdmin(req) {
+  const givenStr = String(req.headers?.["x-admin-secret"] || "").trim();
+  const expectedStr = String(process.env.POSTBUILD_ADMIN_SECRET || "").trim();
+  if (expectedStr.length < 32 || givenStr.length !== expectedStr.length) {
+    return false;
+  }
+  const given = Buffer.from(givenStr, "utf8");
+  const expected = Buffer.from(expectedStr, "utf8");
+  return crypto.timingSafeEqual(given, expected);
+}
+
+/**
+ * Verifies that the authenticated license holder owns the requested inbox and domain.
+ * Every license is strictly bound to its own verified domain and inbox.
+ */
+export function isInboxOwnedByLicense(verified, requestedInbox = "", requestedDomain = "") {
+  if (!verified || !verified.valid) return false;
+
+  const licenseDomain = String(verified.domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  const licenseEmail = String(verified.email || "").toLowerCase().trim();
+  if (!licenseDomain || !licenseDomain.includes(".")) return false;
+
+  const isPostbuildOperator = getFounderEmailsSet().has(licenseEmail);
+
+  // Only an explicit operator may access the postbuild.dev inbox
+  if (licenseDomain === "postbuild.dev" && !isPostbuildOperator) {
+    return false;
+  }
+
+  if (requestedDomain) {
+    const cleanReqDomain = String(requestedDomain)
+      .toLowerCase()
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/^www\./, "")
+      .split("/")[0]
+      .split(":")[0];
+    if (!cleanReqDomain || cleanReqDomain !== licenseDomain) {
+      return false;
+    }
+  }
+
+  const targetInbox = normalizeInboxInput(requestedInbox || requestedDomain || verified.inbox || licenseDomain);
+  if (!targetInbox || targetInbox === "unassigned-bot@postbuild.dev") return false;
+  if (targetInbox === "postbuild-bot@postbuild.dev" && !isPostbuildOperator) return false;
+
+  const expectedInboxWithEmail = getBotInboxForDomain(licenseDomain, licenseEmail);
+  const expectedInboxDomainOnly = getBotInboxForDomain(licenseDomain);
+
+  return (
+    targetInbox === verified.inbox ||
+    targetInbox === expectedInboxWithEmail ||
+    targetInbox === expectedInboxDomainOnly
+  );
+}
+
+export function getClientIp(req) {
+  const xff = req.headers?.["x-forwarded-for"];
+  if (typeof xff === "string" && xff.trim()) {
+    return xff.split(",")[0].trim();
+  }
+  return req.socket?.remoteAddress || "127.0.0.1";
+}
+
+export function checkRateLimit(req, bucket = "default", limitPerMinute = 20) {
+  if (process.env.POSTBUILD_DISABLE_RATE_LIMIT === "1") {
+    return { allowed: true, remaining: limitPerMinute };
+  }
+  const ip = getClientIp(req);
+  const key = `${bucket}:${ip}`;
+  const now = Date.now();
+  const windowMs = 60 * 1000;
+
+  let entry = rateLimitBuckets.get(key);
+  if (!entry || now >= entry.resetAt) {
+    entry = { count: 0, resetAt: now + windowMs };
+    rateLimitBuckets.set(key, entry);
+  }
+
+  entry.count += 1;
+  if (entry.count > limitPerMinute) {
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterSeconds: Math.max(1, Math.ceil((entry.resetAt - now) / 1000))
+    };
+  }
+
+  return {
+    allowed: true,
+    remaining: Math.max(0, limitPerMinute - entry.count),
+    retryAfterSeconds: 0
+  };
+}
+
+export function hasVerificationMetaTagInHead(rawHtml = "", expectedTokens = []) {
+  const tokenSet = new Set(Array.isArray(expectedTokens) ? expectedTokens : [expectedTokens]);
+  if (!rawHtml || tokenSet.size === 0) return false;
+  const headMatch = String(rawHtml).match(/<head\b[^>]*>([\s\S]*?)<\/head>/i);
+  const rawHeadHtml = headMatch ? headMatch[1] : String(rawHtml).split(/<body\b/i)[0] || "";
+  const sanitizedHeadHtml = rawHeadHtml
+    .replace(/<!--[\s\S]*?-->/g, "")
+    .replace(/<(title|script|style|noscript|template|textarea)\b[^>]*>[\s\S]*?<\/\1>/gi, "");
+  const metaTags = sanitizedHeadHtml.match(/<meta\b[^>]*>/gi) || [];
+  for (const tag of metaTags) {
+    const nameMatch = tag.match(/\bname\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"']+))/i);
+    const contentMatch = tag.match(/\bcontent\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"']+))/i);
+    const metaName = (nameMatch?.[1] ?? nameMatch?.[2] ?? nameMatch?.[3] ?? "").trim().toLowerCase();
+    const metaContent = (contentMatch?.[1] ?? contentMatch?.[2] ?? contentMatch?.[3] ?? "").trim();
+    if (metaName === "postbuild-verification" && tokenSet.has(metaContent)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export async function verifyDomainOwnership(verified, requestedDomain = "", options = {}) {
+  if (!verified || !verified.valid) {
+    return { verified: false, method: "none", error: "Authentication required." };
+  }
+
+  const cleanDomain = String(requestedDomain || verified.domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  const cleanEmail = String(verified.email || "").toLowerCase().trim();
+  if (!cleanDomain || !cleanDomain.includes(".")) {
+    return { verified: false, method: "none", error: "Valid project domain required." };
+  }
+
+  const expectedToken = getDomainVerificationToken(cleanDomain, cleanEmail);
+  const candidateTokens = getCandidateVerificationTokens(cleanDomain, cleanEmail);
+  const emailDomain = cleanEmail.includes("@") ? cleanEmail.split("@")[1] : "";
+
+  // 1. Operator for postbuild.dev or OTP/email-verified non-freemail address on the same domain
+  if (isSameDomainVerifiedEmail(cleanEmail, cleanDomain, Boolean(verified.emailVerified))) {
+    return {
+      verified: true,
+      method: "email_domain",
+      domain: cleanDomain,
+      verificationToken: expectedToken
+    };
+  }
+
+  const cacheKey = `${cleanDomain}:${cleanEmail}`;
+  const cached = verifiedDomainCache.get(cacheKey);
+  if (cached && Date.now() - cached.verifiedAt < 3600 * 1000) {
+    return {
+      verified: true,
+      method: cached.method,
+      domain: cleanDomain,
+      verificationToken: expectedToken
+    };
+  }
+
+  if (!options.forceFresh && !options.resolveTxtFn && !options.fetchFn) {
+    const negCached = failedDomainCache.get(cacheKey);
+    if (negCached && Date.now() - negCached.failedAt < 60 * 1000) {
+      return negCached.payload;
+    }
+  }
+
+  const resolveTxt = options.resolveTxtFn || ((host) => dns.resolveTxt(host));
+  const fetchUrl =
+    options.fetchFn ||
+    ((url) => safeFetch(url, { timeoutMs: 4500, maxBytes: 256 * 1024, truncateOnMaxBytes: true }));
+
+  let dnsCheckDetail = `No matching TXT record on _postbuild.${cleanDomain}`;
+  let wellKnownCheckDetail = "Not found";
+  let htmlMetaCheckDetail = "No matching <meta> tag in homepage <head>";
+
+  // 2. Check DNS TXT on _postbuild.<domain> or <domain>
+  for (const host of [`_postbuild.${cleanDomain}`, cleanDomain]) {
+    try {
+      const records = await resolveTxt(host);
+      if (Array.isArray(records)) {
+        const flat = records.map((chunks) => (Array.isArray(chunks) ? chunks.join("") : String(chunks)).trim());
+        if (flat.some((r) => candidateTokens.some((tok) => r === tok || r.includes(tok)))) {
+          failedDomainCache.delete(cacheKey);
+          verifiedDomainCache.set(cacheKey, { verifiedAt: Date.now(), method: "dns_txt" });
+          return {
+            verified: true,
+            method: "dns_txt",
+            domain: cleanDomain,
+            verificationToken: expectedToken
+          };
+        }
+      }
+    } catch {}
+  }
+
+  // 3a. Check https://<domain>/.well-known/postbuild-verify.txt (strict line match)
+  try {
+    const resp = await fetchUrl(`https://${cleanDomain}/.well-known/postbuild-verify.txt`);
+    if (resp && resp.ok) {
+      const text = typeof resp.text === "function" ? await resp.text() : String(resp.body || "");
+      const lines = String(text || "").split(/\r?\n/).map((l) => l.trim());
+      if (candidateTokens.some((tok) => lines.includes(tok))) {
+        failedDomainCache.delete(cacheKey);
+        verifiedDomainCache.set(cacheKey, { verifiedAt: Date.now(), method: "well_known_file" });
+        return {
+          verified: true,
+          method: "well_known_file",
+          domain: cleanDomain,
+          verificationToken: expectedToken
+        };
+      }
+      wellKnownCheckDetail = "File returned 200 OK without matching token";
+    } else if (resp && resp.status) {
+      wellKnownCheckDetail = `HTTP ${resp.status}`;
+    }
+  } catch {
+    wellKnownCheckDetail = "Unreachable or timed out";
+  }
+
+  // 3b. Check https://<domain>/ for <meta name="postbuild-verification" content="..."> inside <head>
+  try {
+    const resp = await fetchUrl(`https://${cleanDomain}/`);
+    if (resp && resp.ok) {
+      const text = typeof resp.text === "function" ? await resp.text() : String(resp.body || "");
+      if (hasVerificationMetaTagInHead(text, candidateTokens)) {
+        failedDomainCache.delete(cacheKey);
+        verifiedDomainCache.set(cacheKey, { verifiedAt: Date.now(), method: "html_meta" });
+        return {
+          verified: true,
+          method: "html_meta",
+          domain: cleanDomain,
+          verificationToken: expectedToken
+        };
+      }
+      htmlMetaCheckDetail = "Homepage 200 OK — <meta name=\"postbuild-verification\"> not found in <head>";
+    } else if (resp && resp.status) {
+      htmlMetaCheckDetail = `HTTP ${resp.status}`;
+    }
+  } catch {
+    htmlMetaCheckDetail = "Homepage unreachable or timed out";
+  }
+
+  const isFree = isFreeEmailDomain(emailDomain);
+  const sameDomainUnconfirmed = Boolean(
+    emailDomain && !isFree && (cleanDomain === emailDomain || cleanDomain.endsWith(`.${emailDomain}`)) && !verified.emailVerified
+  );
+
+  const emailDomainStatus = !emailDomain
+    ? "No account email"
+    : isFree
+      ? `Personal email (${emailDomain}) requires domain proof`
+      : sameDomainUnconfirmed
+        ? "Confirm your email via 6-digit code to unlock automatically"
+        : `Account email (@${emailDomain}) differs from ${cleanDomain}`;
+
+  const failurePayload = {
+    verified: false,
+    method: "none",
+    domain: cleanDomain,
+    verificationToken: expectedToken,
+    sameDomainUnconfirmed,
+    checkedAt: new Date().toISOString(),
+    checks: {
+      emailDomain: emailDomainStatus,
+      dnsTxt: dnsCheckDetail,
+      wellKnownFile: wellKnownCheckDetail,
+      htmlMeta: htmlMetaCheckDetail
+    },
+    dnsHost: `_postbuild.${cleanDomain}`,
+    wellKnownPath: "/.well-known/postbuild-verify.txt",
+    metaTag: `<meta name="postbuild-verification" content="${expectedToken}" />`,
+    error: `Domain ownership proof required for ${cleanDomain} before reading ${getBotInboxForDomain(cleanDomain, cleanEmail)}. Deploy /.well-known/postbuild-verify.txt (included in your Launch Bundle .zip), add <meta name="postbuild-verification" content="${expectedToken}" /> to your homepage <head>, add DNS TXT record _postbuild.${cleanDomain} = ${expectedToken}, or sign in via 6-digit code with an @${cleanDomain} email.`
+  };
+
+  if (!options.resolveTxtFn && !options.fetchFn) {
+    failedDomainCache.set(cacheKey, { failedAt: Date.now(), payload: failurePayload });
+  }
+
+  return failurePayload;
+}
+
+export function resetRateLimitsForTests() {
+  rateLimitBuckets.clear();
+  verifiedDomainCache.clear();
+  failedDomainCache.clear();
+}
+

package/lib/inbox.js

@@ -155,7 +155,8 @@ export function sanitizeSubjectForDisplay(subject = "", otpCode = "") {
  * Ingests a verified inbound email webhook payload.
  * Rejects mail addressed to unknown or non-@postbuild.dev recipients.
  */
-export async function ingestInboundEmail(rawPayload = {}) {
+export async function ingestInboundEmail(rawPayload = {}, options = {}) {
+  const { fromWebhook = true } = options || {};
   const payload = rawPayload?.data && typeof rawPayload.data === "object" ? rawPayload.data : rawPayload;
 
   const toRaw = payload.to || payload.recipient || payload.envelope?.to || "";
@@ -194,6 +195,40 @@ export async function ingestInboundEmail(rawPayload = {}) {
   const fromRaw = payload.from || payload.sender || payload.envelope?.from || "no-reply@directory-verifier.com";
   const fromAddress = String(fromRaw).trim();
 
+  // Forward inbound customer support replies (support@postbuild.dev / login@postbuild.dev) to founder email only on webhook path
+  if (toAddress === "support@postbuild.dev" || toAddress === "login@postbuild.dev") {
+    if (fromWebhook && resendApiKey) {
+      const forwardTarget = (process.env.ADMIN_FORWARD_EMAIL || process.env.ADMIN_EMAIL || "").trim();
+      if (forwardTarget && forwardTarget.includes("@")) {
+        try {
+          await fetch("https://api.resend.com/emails", {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${resendApiKey}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({
+              from: "postbuild Support <login@postbuild.dev>",
+              reply_to: fromAddress,
+              to: [forwardTarget],
+              subject: `[Support ${toAddress}] ${subject}`,
+              text: `From: ${fromAddress}\nTo: ${toAddress}\nSubject: ${subject}\n\n${textBody || htmlBody}`
+            }),
+            signal: AbortSignal.timeout(4500)
+          });
+        } catch {}
+      }
+    }
+    return {
+      id: resendEmailId || `support_${Date.now()}`,
+      to: toAddress,
+      from: fromAddress,
+      subject,
+      status: "forwarded",
+      receivedAt: new Date().toISOString()
+    };
+  }
+
   const signals = extractVerificationSignals(subject, textBody, htmlBody);
   const displaySubject = sanitizeSubjectForDisplay(subject, signals.otpCode);
   const receivedDate = payload.created_at ? new Date(payload.created_at) : new Date();
@@ -232,7 +267,7 @@ async function syncFromResendReceivingApi(targetInbox = "") {
   const normalizedTarget = targetInbox.trim().toLowerCase();
 
   try {
-    const resp = await fetch("https://api.resend.com/emails/receiving?limit=25", {
+    const resp = await fetch("https://api.resend.com/emails/receiving?limit=100", {
       headers: { Authorization: `Bearer ${resendApiKey}` },
       signal: AbortSignal.timeout(3500)
     });
@@ -241,15 +276,16 @@ async function syncFromResendReceivingApi(targetInbox = "") {
     const data = await resp.json();
     const items = Array.isArray(data?.data) ? data.data : Array.isArray(data) ? data : [];
 
-    for (const item of items.slice(0, 15)) {
-      const id = item.id || item.email_id;
-      if (!id || memoryInboxMessages.has(id)) continue;
-
+    const matchingItems = items.filter((item) => {
       const recipients = (Array.isArray(item.to) ? item.to : [item.to])
         .filter(Boolean)
         .map((r) => String(r).replace(/^.*<([^>]+)>.*$/, "$1").trim().toLowerCase());
+      return recipients.includes(normalizedTarget);
+    });
 
-      if (!recipients.includes(normalizedTarget)) continue;
+    for (const item of matchingItems.slice(0, 15)) {
+      const id = item.id || item.email_id;
+      if (!id || memoryInboxMessages.has(id)) continue;
 
       let fullItem = item;
       if (!item.text && !item.html) {
@@ -264,7 +300,7 @@ async function syncFromResendReceivingApi(targetInbox = "") {
         } catch {}
       }
 
-      await ingestInboundEmail(fullItem);
+      await ingestInboundEmail(fullItem, { fromWebhook: false });
     }
   } catch {}
 }
@@ -294,11 +330,11 @@ export async function listInboxMessages(inboxAddress = "", options = {}) {
           headers: {
             Authorization: `Bearer ${options.bearerToken}`
           },
-          signal: AbortSignal.timeout(3000)
+          signal: AbortSignal.timeout(10000)
         }
       );
+      const remoteData = await remoteResp.json().catch(() => ({}));
       if (remoteResp.ok) {
-        const remoteData = await remoteResp.json();
         if (Array.isArray(remoteData.messages)) {
           for (const rm of remoteData.messages) {
             if (rm && rm.id && rm.to === normalized) {
@@ -307,6 +343,16 @@ export async function listInboxMessages(inboxAddress = "", options = {}) {
           }
           persistMessages();
         }
+      } else if (remoteResp.status === 403 && remoteData && remoteData.requiresDomainVerification) {
+        return {
+          inboxAddress: normalized,
+          retentionDays: 30,
+          count: 0,
+          messages: [],
+          requiresDomainVerification: true,
+          verificationToken: remoteData.verificationToken || "",
+          error: remoteData.error || "Domain ownership verification required before reading this inbox."
+        };
       }
     } catch {}
   }

package/lib/mcp.js

@@ -1,6 +1,6 @@
 /**
  * Postbuild Stateful MCP Server & Obsidian VaultOS Sync Engine
- * Powered by Postbuild MCP Middleware (postbuild-mcp v2.1.0)
+ * Powered by Postbuild MCP Middleware (postbuild-mcp v2.1.6)
  */
 
 import fs from "node:fs";
@@ -8,6 +8,7 @@ import path from "node:path";
 import readline from "node:readline";
 import { scanTargetUrl, searchBuyerIntentRadar, dispatchDirectories, DIRECTORIES } from "./engine.js";
 import { verifyCliLicense } from "./auth.js";
+import { isInboxOwnedByLicense } from "./guard.js";
 import { applyLocalSeoFixes } from "./fixer.js";
 import { listInboxMessages, sendTestVerificationEmail, getBotInboxForDomain, markMessageVerified } from "./inbox.js";
 import { withStatefulMcp, createGenericEntityAdapter, spotlightUntrustedText } from "./stateful-mcp.js";
@@ -181,6 +182,9 @@ export async function autoVerifyInboxLinks(inboxAddress = "", options = {}) {
 
   return {
     inboxAddress: res.inboxAddress,
+    requiresDomainVerification: Boolean(res.requiresDomainVerification),
+    verificationToken: res.verificationToken || "",
+    error: res.error || "",
     totalMessages: verificationResults.length,
     verifiedCount: verificationResults.filter((x) => x.autoVerified).length,
     extractedOtps: verificationResults
@@ -238,7 +242,7 @@ export async function runStatefulMcpSimulation({
   });
 
   return {
-    server: "postbuild-mcp@2.1.0",
+    server: "postbuild-mcp@2.1.6",
     domain: state.domain,
     readinessScore: report.readinessScore,
     botEmail: report.botEmail,
@@ -317,9 +321,9 @@ export async function syncPostbuildToVault({
 
   const telemetryPayload = {
     generatedAt: new Date().toISOString(),
-    engine: "postbuild-mcp@2.1.0",
+    engine: "postbuild-mcp@2.1.6",
     mcpTelemetry: {
-      server: "postbuild-mcp@2.1.0",
+      server: "postbuild-mcp@2.1.6",
       tokenReductionPct: projectsData[0]?.mcpReductionPct || "-75.4%",
       supersetCacheHits: mcpStats.supersetCacheHits,
       deltasEmitted: mcpStats.deltasEmitted,
@@ -424,7 +428,7 @@ try {
 
 const projects = pb && pb.projects ? pb.projects : [];
 const radar = pb && pb.radarThreads ? pb.radarThreads : [];
-const mcp = pb && pb.mcpTelemetry ? pb.mcpTelemetry : { server: 'postbuild-mcp@2.1.0', tokenReductionPct: '-75.4%', supersetCacheHits: 4 };
+const mcp = pb && pb.mcpTelemetry ? pb.mcpTelemetry : { server: 'postbuild-mcp@2.1.6', tokenReductionPct: '-75.4%', supersetCacheHits: 4 };
 
 root.innerHTML = \`
   <div class="meta-bar">
@@ -865,7 +869,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_inbox") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    const license = await verifyCliLicense({ domain: "", token: authToken });
     if (!license.valid) {
       return {
         isError: true,
@@ -876,13 +880,32 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
       };
     }
 
-    const inboxAddr = args.inbox || license.inbox || getBotInboxForDomain(license.domain || "postbuild.dev", license.email);
+    const defaultInbox = license.inbox || getBotInboxForDomain(license.domain || "postbuild.dev", license.email);
+    const inboxAddr = args.inbox || defaultInbox;
+    if (args.inbox && !isInboxOwnedByLicense({ email: license.email, domain: license.domain, inbox: defaultInbox }, inboxAddr, "")) {
+      return {
+        isError: true,
+        status: "FORBIDDEN_INBOX",
+        message: `Your license covers ${defaultInbox}. You cannot read ${inboxAddr}.`
+      };
+    }
+
     const autoVerify = Boolean(args.auto_verify);
     const result = await autoVerifyInboxLinks(inboxAddr, {
       autoVerify,
       bearerToken: license.token
     });
 
+    if (result.requiresDomainVerification) {
+      return {
+        isError: true,
+        status: "DOMAIN_VERIFICATION_REQUIRED",
+        inboxAddress: result.inboxAddress,
+        verificationToken: result.verificationToken,
+        message: result.error || "Verify ownership of your domain on https://www.postbuild.dev/?tab=account before reading this inbox."
+      };
+    }
+
     const compacted = mcpInbox.compactList({
       sessionId,
       records: result.messages || []
@@ -913,13 +936,14 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
 
     const fixRes = applyLocalSeoFixes(report, {
       cwd: args.cwd || process.cwd(),
-      overwritePublic: true
+      overwritePublic: true,
+      verificationToken: license.verificationToken || ""
     });
     return fixRes;
   }
 
   if (name === "postbuild_vault_sync") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    const license = await verifyCliLicense({ domain: "", token: authToken });
     if (!license.valid) {
       return {
         isError: true,
@@ -932,7 +956,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
 
     return await syncPostbuildToVault({
       vaultPath: args.vault_path || process.cwd(),
-      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : ["https://www.postbuild.dev"],
+      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : [license.domain ? `https://${license.domain}` : "https://www.postbuild.dev"],
       sessionId,
       bearerToken: license.token
     });
@@ -975,7 +999,7 @@ export function startPostbuildMcpServer() {
             },
             serverInfo: {
               name: "postbuild-mcp",
-              version: "2.1.0"
+              version: "2.1.6"
             }
           }
         });