machine-bridge-mcp 2.0.0 → 3.0.0-beta.9

package/src/worker/index.ts

@@ -19,11 +19,12 @@ import { daemonToolError, publicWorkerToolError, WorkerToolError } from "./error
 import { sanitizeDaemonPolicy, sanitizeDaemonTools } from "./policy.ts";
 import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from "./access.ts";
 import { OAuthController, type AuthorizedToken, type OAuthControllerEnv } from "./oauth-controller.ts";
+import { consumeDpopProof, verifyDpopProof } from "./dpop.ts";
 import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority.ts";
 import { serverInfoTool, workspaceTools } from "./tool-catalog.ts";
 import { OFFLINE_ACCESS_SCOPE, randomToken } from "./oauth-state.ts";
 import {
-  HttpError, applyCors, baseUrl, bearerToken, corsPreflight, json, methodNotAllowed,
+  HttpError, applyCors, baseUrl, corsPreflight, discardRequestBody, json, methodNotAllowed, oauthAccessToken,
   parseJsonRequest, workerErrorClass,
 } from "./http.ts";
 import {
@@ -31,11 +32,11 @@ import {
   sessionInstructionText, textToolResult, validateProtocolVersionHeader, type JsonRpcRequest,
 } from "./mcp-jsonrpc.ts";
 import {
-  closeWebSocketQuietly, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly,
+  closeWebSocketQuietly, isObjectRecord, rejectDaemonMessage, sendWebSocketQuietly, trySendWebSocket,
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "2.0.0";
+const SERVER_VERSION = "3.0.0-beta.9";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -46,7 +47,6 @@ const DAEMON_RECONNECT_GRACE_MS = 30_000;
 
 interface BridgeEnv extends OAuthControllerEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
-  ACCOUNT_ADMIN_SECRET: string;
   DAEMON_DEVICE_PUBLIC_KEY: string;
   OAUTH_TOKEN_VERSION: string;
   MBM_WORKER_MAX_BODY_BYTES?: string;
@@ -63,7 +63,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   constructor(ctx: DurableObjectState, env: BridgeEnv) {
     super(ctx, env);
-    this.oauth = new OAuthController(ctx, env, SERVER_NAME);
+    this.oauth = new OAuthController(ctx, env, SERVER_NAME, SERVER_VERSION);
     this.daemonRegistry = new DaemonSocketRegistry(ctx);
   }
 
@@ -107,6 +107,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       }
       if (url.pathname === "/admin/accounts") return await this.oauth.handleAccountAdmin(request, "accounts");
       if (url.pathname === "/admin/accounts/rotate-password") return await this.oauth.handleAccountAdmin(request, "rotate-password");
+      if (url.pathname === "/admin/clients") return await this.oauth.handleClientAdmin(request);
       if (url.pathname === "/oauth/register") {
         if (request.method !== "POST") return methodNotAllowed("POST");
         return await this.oauth.registerClient(request);
@@ -185,12 +186,20 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         rejectDaemonMessage(ws, "invalid_daemon_instance", 1002, "daemon instance id required");
         return;
       }
-      if (!socketAttachment.authChallenge || !socketAttachment.authIssuedAt || !socketAttachment.authExpiresAt || !socketAttachment.workerOrigin) {
+      if (
+        !socketAttachment.authChallenge
+        || !socketAttachment.authIssuedAt
+        || !socketAttachment.authExpiresAt
+        || !socketAttachment.workerOrigin
+        || !socketAttachment.authSessionPublicKeyJson
+        || !socketAttachment.authSessionKeyId
+        || !socketAttachment.authCertificateExpiresAt
+      ) {
         rejectDaemonMessage(ws, "missing_daemon_challenge", 1008, "daemon challenge missing");
         return;
       }
       const authenticated = await verifyDaemonAuthentication({
-        publicKeyJson: this.env.DAEMON_DEVICE_PUBLIC_KEY ?? "",
+        publicKeyJson: socketAttachment.authSessionPublicKeyJson,
         authentication: body.authentication,
         challenge: {
           scheme: "device-signature-v1",
@@ -202,6 +211,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         server: SERVER_NAME,
         version: SERVER_VERSION,
         instanceId,
+        certificateExpiresAt: socketAttachment.authCertificateExpiresAt,
       });
       if (!authenticated) {
         rejectDaemonMessage(ws, "daemon_authentication_failed", 1008, "daemon authentication failed");
@@ -238,7 +248,9 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
     if (body.type === "heartbeat" || body.type === "ping") {
       await this.touchDaemonSocket(ws);
-      ws.send(JSON.stringify({ type: "pong", ts: body.ts ?? Date.now() }));
+      if (!trySendWebSocket(ws, { type: "pong", ts: body.ts ?? Date.now() })) {
+        this.invalidateDaemonSocket(ws, "failed to acknowledge daemon heartbeat", "daemon pong failed", "daemon_transport_error");
+      }
       return;
     }
 
@@ -311,13 +323,31 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       });
     }
 
-    const authorized = await this.oauth.verifyAccessToken(bearerToken(request), base);
-    if (!authorized) {
-      try { await request.arrayBuffer(); } catch { /* The rejected body may already be unavailable; the 401 remains authoritative. */ }
-      return new Response("OAuth bearer token required", {
+    const access = oauthAccessToken(request);
+    const authorized = await this.oauth.verifyAccessToken(access.token, base);
+    let dpopValid = true;
+    if (authorized?.dpopJkt) {
+      const proof = access.scheme === "dpop" ? await verifyDpopProof({
+        request,
+        expectedMethod: "POST",
+        expectedUrl: request.url,
+        accessToken: access.token,
+        expectedJkt: authorized.dpopJkt,
+      }) : null;
+      dpopValid = Boolean(proof && await consumeDpopProof(this.ctx.storage, proof));
+    } else if (authorized && access.scheme !== "bearer") {
+      dpopValid = false;
+    }
+    if (!authorized || !dpopValid) {
+      // Durable Object fetch forwarding transfers a live request stream. Consume it
+      // before returning, but retain no bytes, so the 401 cannot race a pending read
+      // and unauthenticated input never enters an in-memory request buffer.
+      await discardRequestBody(request, this.bodyLimitBytes());
+      const scheme = authorized?.dpopJkt ? "DPoP" : "Bearer";
+      return new Response(authorized?.dpopJkt ? "Valid DPoP proof required" : "OAuth bearer token required", {
         status: 401,
         headers: {
-          "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"`,
+          "WWW-Authenticate": `${scheme} resource_metadata="${base}/.well-known/oauth-protected-resource/mcp"`,
           "cache-control": "no-store",
           "content-type": "text/plain; charset=utf-8",
           "x-content-type-options": "nosniff",
@@ -509,6 +539,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
             account_id: authorized.accountId,
             account_version: authorized.accountVersion,
             client_id: authorized.clientId,
+            family_id: authorized.familyId,
             role: authorized.role,
           },
         }));
@@ -558,9 +589,9 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const [client, server] = Object.values(pair) as [WebSocket, WebSocket];
     this.ctx.acceptWebSocket(server);
     this.observability.socketCandidate();
-    this.daemonRegistry.beginCandidate(server, challenge);
+    this.daemonRegistry.beginCandidate(server, challenge, preflight);
     await this.scheduleSocketAlarms();
-    server.send(JSON.stringify({
+    const welcomed = trySendWebSocket(server, {
       type: "welcome",
       server: SERVER_NAME,
       version: SERVER_VERSION,
@@ -571,7 +602,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         issued_at: challenge.issuedAt,
         expires_at: challenge.expiresAt,
       },
-    }));
+    });
+    if (!welcomed) {
+      this.daemonRegistry.expire(server);
+      closeWebSocketQuietly(server, 1011, "daemon welcome failed");
+      await this.scheduleSocketAlarms();
+    }
     return new Response(null, { status: 101, webSocket: client });
   }
 
@@ -749,6 +785,7 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       response_types_supported: ["code"],
       grant_types_supported: ["authorization_code", "refresh_token"],
       token_endpoint_auth_methods_supported: ["none"],
+      dpop_signing_alg_values_supported: ["ES256"],
       code_challenge_methods_supported: ["S256"],
       scopes_supported: [SERVER_NAME, OFFLINE_ACCESS_SCOPE],
     };

package/src/worker/nonce-store.ts

@@ -42,12 +42,8 @@ async function consumeInStorage(
     if (expiresAt <= options.now) delete nonces[nonce];
   }
   if (nonces[options.nonce]) return false;
+  if (Object.keys(nonces).length >= options.maximum) return false;
   nonces[options.nonce] = options.expiresAt;
-  const entries = Object.entries(nonces).sort((left, right) => left[1] - right[1] || left[0].localeCompare(right[0]));
-  while (entries.length > options.maximum) {
-    const [nonce] = entries.shift()!;
-    delete nonces[nonce];
-  }
   await storage.put(options.key, nonces);
   return true;
 }

package/src/worker/oauth-client-admin.ts

@@ -0,0 +1,45 @@
+import { json, parseRequestBody } from "./http.ts";
+import { OAUTH_REFRESH_STORE_KEY } from "./oauth-refresh-families.ts";
+import type { OAuthRefreshStore, OAuthStore } from "./oauth-state.ts";
+
+const BODY_LIMIT_BYTES = 64 * 1024;
+const MAX_OAUTH_CLIENTS = 128;
+
+export async function handleOAuthClientAdminOperation(options: {
+  request: Request;
+  store: OAuthStore;
+  refreshStore: OAuthRefreshStore;
+  storage: DurableObjectStorage;
+  now: number;
+}): Promise<Response> {
+  const { request, store, refreshStore, storage, now } = options;
+  if (request.method === "GET") {
+    const clients = Object.values(store.clients)
+      .sort((left, right) => right.last_used_at - left.last_used_at || left.client_name.localeCompare(right.client_name))
+      .map((client) => ({
+        client_id: client.client_id,
+        client_name: client.client_name,
+        redirect_uris: [...client.redirect_uris],
+        created_at: client.created_at,
+        last_used_at: client.last_used_at,
+        trusted_account_id: client.trusted_account_id ?? null,
+        trusted_account_version: client.trusted_account_version ?? null,
+        trusted_role: client.trusted_role ?? null,
+        trusted_at: client.trusted_at ?? null,
+        active_access_tokens: Object.values(store.tokens).filter((token) => token.client_id === client.client_id && token.expires_at > now).length,
+        active_refresh_tokens: Object.values(refreshStore.tokens).filter((token) => token.client_id === client.client_id && token.expires_at > now).length,
+      }));
+    return json({ clients, maximum: MAX_OAUTH_CLIENTS });
+  }
+  if (request.method !== "DELETE") return json({ error: "method_not_allowed" }, 405, { Allow: "GET, DELETE" });
+  const body = await parseRequestBody(request, BODY_LIMIT_BYTES);
+  const clientId = String(body.client_id ?? "");
+  if (!/^mcp_client_[A-Za-z0-9_-]{43}$/.test(clientId)) return json({ error: "invalid_client_id" }, 400);
+  if (!store.clients[clientId]) return json({ error: "client_not_found" }, 404);
+  delete store.clients[clientId];
+  for (const [key, value] of Object.entries(store.codes)) if (value.client_id === clientId) delete store.codes[key];
+  for (const [key, value] of Object.entries(store.tokens)) if (value.client_id === clientId) delete store.tokens[key];
+  for (const [key, value] of Object.entries(refreshStore.tokens)) if (value.client_id === clientId) delete refreshStore.tokens[key];
+  await storage.put({ oauth: store, [OAUTH_REFRESH_STORE_KEY]: refreshStore });
+  return json({ removed: true, client_id: clientId });
+}

package/src/worker/oauth-controller.ts

@@ -12,6 +12,8 @@ import {
   normalizeRedirectUri, oauthRedirect, parseRequestBody, searchParamsObject,
 } from "./http.ts";
 import { authorizationPage } from "./oauth-authorization-page.ts";
+import { handleOAuthClientAdminOperation } from "./oauth-client-admin.ts";
+import { loadOAuthRefreshStore } from "./oauth-refresh-families.ts";
 
 const OAUTH_BODY_LIMIT_BYTES = 64 * 1024;
 const OAUTH_UNUSED_CLIENT_TTL_SECONDS = 60 * 60;
@@ -23,7 +25,6 @@ const MAX_OAUTH_CODES = 200;
 const MAX_AUTH_FAILURE_IDENTITIES = 200;
 
 export interface OAuthControllerEnv {
-  ACCOUNT_ADMIN_SECRET: string;
   DAEMON_DEVICE_PUBLIC_KEY: string;
   OAUTH_TOKEN_VERSION: string;
 }
@@ -33,6 +34,8 @@ export interface AuthorizedToken {
   accountId: string;
   accountVersion: number;
   clientId: string;
+  familyId: string;
+  dpopJkt: string;
   role: AccountRole;
 }
 
@@ -40,12 +43,14 @@ export class OAuthController {
   private readonly ctx: DurableObjectState;
   private readonly env: OAuthControllerEnv;
   private readonly serverName: string;
+  private readonly serverVersion: string;
   private oauthQueue: Promise<void> = Promise.resolve();
 
-  constructor(ctx: DurableObjectState, env: OAuthControllerEnv, serverName: string) {
+  constructor(ctx: DurableObjectState, env: OAuthControllerEnv, serverName: string, serverVersion: string) {
     this.ctx = ctx;
     this.env = env;
     this.serverName = serverName;
+    this.serverVersion = serverVersion;
   }
 
   private async oauthStore(): Promise<OAuthStore> {
@@ -108,7 +113,14 @@ export class OAuthController {
   async handleAccountAdmin(request: Request, operation: "accounts" | "rotate-password"): Promise<Response> {
     return this.withOAuthLock(async () => {
       const now = Math.floor(Date.now() / 1000);
-      const authorization = await accountAdminAuthorized(request, this.env.ACCOUNT_ADMIN_SECRET ?? "", now);
+      const authorization = await accountAdminAuthorized(
+        request,
+        this.env.DAEMON_DEVICE_PUBLIC_KEY ?? "",
+        new URL(request.url).origin,
+        this.serverName,
+        this.serverVersion,
+        now,
+      );
       if (!authorization || !(await consumeAccountAdminNonce(this.ctx.storage, authorization, now))) {
         return json({ error: "unauthorized" }, 401);
       }
@@ -120,6 +132,26 @@ export class OAuthController {
     });
   }
 
+  async handleClientAdmin(request: Request): Promise<Response> {
+    return this.withOAuthLock(async () => {
+      const now = Math.floor(Date.now() / 1000);
+      const authorization = await accountAdminAuthorized(
+        request,
+        this.env.DAEMON_DEVICE_PUBLIC_KEY ?? "",
+        new URL(request.url).origin,
+        this.serverName,
+        this.serverVersion,
+        now,
+      );
+      if (!authorization || !(await consumeAccountAdminNonce(this.ctx.storage, authorization, now))) {
+        return json({ error: "unauthorized" }, 401);
+      }
+      const store = await this.oauthStore();
+      const refreshStore = await loadOAuthRefreshStore(store, this.ctx.storage);
+      return handleOAuthClientAdminOperation({ request, store, refreshStore, storage: this.ctx.storage, now });
+    });
+  }
+
   async registerClient(request: Request): Promise<Response> {
     const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
     const redirectUris = body.redirect_uris;
@@ -212,9 +244,16 @@ export class OAuthController {
         const status = store.auth_failures[identity]?.blocked_until > now ? 429 : 401;
         return authorizationPage({ request, base, serverName: this.serverName, error: "Invalid account credentials.", submitted: body, status, authorization: validation.value });
       }
+      if (client.trusted_account_id && client.trusted_account_id !== account.account_id) {
+        return authorizationPage({ request, base, serverName: this.serverName, error: "This client is already bound to another account. Revoke it locally before changing accounts.", submitted: body, status: 409, authorization: validation.value });
+      }
       delete store.auth_failures[identity];
       client.last_used_at = now;
       client.has_been_authorized = true;
+      client.trusted_account_id = account.account_id;
+      client.trusted_account_version = account.version;
+      client.trusted_role = account.role;
+      client.trusted_at ||= now;
 
       const code = randomToken("mcp_code");
       const redirectLocation = authorizationRedirectLocation(redirectUri, code, state);
@@ -263,14 +302,24 @@ export class OAuthController {
       if (!record.version || !currentVersion || !(await safeEqual(record.version, currentVersion))) return null;
       if (record.resource !== `${base}/mcp`) return null;
       const account = store.accounts[record.account_id];
-      if (!account || !account.active || account.version !== record.account_version || account.role !== record.role) {
+      const client = store.clients[record.client_id];
+      if (
+        !account
+        || !account.active
+        || account.version !== record.account_version
+        || account.role !== record.role
+        || !client
+        || client.trusted_account_id !== account.account_id
+        || client.trusted_account_version !== account.version
+        || client.trusted_role !== account.role
+      ) {
         delete store.tokens[key];
         await this.ctx.storage.put("oauth", store);
         return null;
       }
       return {
         tokenKey: key, accountId: account.account_id,
-        accountVersion: account.version, clientId: record.client_id, role: account.role,
+        accountVersion: account.version, clientId: record.client_id, familyId: String(record.family_id || ""), dpopJkt: String(record.dpop_jkt || ""), role: account.role,
       };
     });
   }
@@ -288,7 +337,7 @@ export class OAuthController {
   }
 
   identityKey(): string {
-    const key = this.env.OAUTH_TOKEN_VERSION || this.env.ACCOUNT_ADMIN_SECRET;
+    const key = this.env.OAUTH_TOKEN_VERSION;
     if (!key) throw new HttpError(503, "server_not_configured", "OAuth identity key is not configured");
     return key;
   }

package/src/worker/oauth-refresh-families.ts

@@ -54,13 +54,14 @@ export async function loadOAuthRefreshStore(
       changed = true;
     }
   }
-  if (pruneOAuthRefreshReplayState(store)) changed = true;
+  if (pruneOAuthRefreshReplayState(store, oauthStore)) changed = true;
   if (changed || migrated) await storage.put(OAUTH_REFRESH_STORE_KEY, store);
   return store;
 }
 
 
 export function recordConsumedRefreshToken(
+  oauthStore: OAuthStore,
   store: OAuthRefreshStore,
   tokenHash: string,
   familyId: string,
@@ -74,16 +75,17 @@ export function recordConsumedRefreshToken(
     throw new Error("consumed refresh-token lifetime is invalid");
   }
   store.consumed[tokenHash] = { family_id: familyId, consumed_at: consumedAt, expires_at: expiresAt };
-  pruneOAuthRefreshReplayState(store);
+  pruneOAuthRefreshReplayState(store, oauthStore);
 }
 
-export function pruneOAuthRefreshReplayState(store: OAuthRefreshStore): boolean {
+export function pruneOAuthRefreshReplayState(store: OAuthRefreshStore, oauthStore?: OAuthStore): boolean {
   let changed = false;
   const consumed = Object.entries(store.consumed).sort((left, right) => (
     left[1].consumed_at - right[1].consumed_at || left[0].localeCompare(right[0])
   ));
   while (consumed.length > MAX_CONSUMED_REFRESH_TOKENS) {
-    const [tokenHash] = consumed.shift()!;
+    const [tokenHash, marker] = consumed.shift()!;
+    revokeRefreshFamilyRecords(oauthStore, store, marker.family_id, marker.expires_at);
     delete store.consumed[tokenHash];
     changed = true;
   }
@@ -115,6 +117,7 @@ function validRefreshStoreRecords(store: OAuthRefreshStore): boolean {
     && token.version.length > 0
     && token.version.length <= 256
     && FAMILY_ID_PATTERN.test(token.family_id)
+    && (token.dpop_jkt === undefined || /^[A-Za-z0-9_-]{43}$/.test(token.dpop_jkt))
     && validTimestamp(token.issued_at)
     && validTimestamp(token.expires_at)
     && validTimestamp(token.family_expires_at)
@@ -160,13 +163,24 @@ export function revokeOAuthRefreshFamily(
   refreshStore: OAuthRefreshStore,
   familyId: string,
   expiresAt: number,
+): void {
+  revokeRefreshFamilyRecords(oauthStore, refreshStore, familyId, expiresAt);
+  pruneOAuthRefreshReplayState(refreshStore, oauthStore);
+}
+
+function revokeRefreshFamilyRecords(
+  oauthStore: OAuthStore | undefined,
+  refreshStore: OAuthRefreshStore,
+  familyId: string,
+  expiresAt: number,
 ): void {
   for (const [key, token] of Object.entries(refreshStore.tokens)) {
     if (token.family_id === familyId) delete refreshStore.tokens[key];
   }
-  for (const [key, token] of Object.entries(oauthStore.tokens)) {
-    if (token.family_id === familyId) delete oauthStore.tokens[key];
+  if (oauthStore) {
+    for (const [key, token] of Object.entries(oauthStore.tokens)) {
+      if (token.family_id === familyId) delete oauthStore.tokens[key];
+    }
   }
   refreshStore.revoked_families[familyId] = { expires_at: expiresAt, reason: "replay" };
-  pruneOAuthRefreshReplayState(refreshStore);
 }

package/src/worker/oauth-state.ts

@@ -28,8 +28,13 @@ export interface OAuthClient {
   last_used_at: number;
   has_been_authorized?: boolean;
   registration_identity?: string;
+  trusted_account_id?: string;
+  trusted_account_version?: number;
+  trusted_role?: AccountRole;
+  trusted_at?: number;
 }
 
+
 export interface OAuthCode {
   client_id: string;
   account_id: string;
@@ -52,6 +57,7 @@ export interface OAuthToken {
   version: string;
   expires_at: number;
   family_id?: string;
+  dpop_jkt?: string;
 }
 
 export interface OAuthRefreshToken extends OAuthToken {

package/src/worker/oauth-tokens.ts

@@ -5,6 +5,7 @@ import {
 } from "./oauth-state.ts";
 import { HttpError, json, parseRequestBody } from "./http.ts";
 import { loadOAuthRefreshStore, OAUTH_REFRESH_STORE_KEY, recordConsumedRefreshToken, revokeOAuthRefreshFamily } from "./oauth-refresh-families.ts";
+import { consumeDpopProof, verifyDpopProof, type VerifiedDpopProof } from "./dpop.ts";
 
 const ACCESS_TOKEN_TTL_SECONDS = 15 * 60;
 const REFRESH_TOKEN_IDLE_TTL_SECONDS = 60 * 60 * 24 * 14;
@@ -36,9 +37,12 @@ export async function exchangeOAuthToken(
   options: OAuthTokenExchangeOptions,
 ): Promise<Response> {
   const body = await parseRequestBody(request, OAUTH_BODY_LIMIT_BYTES);
+  const hasDpop = Boolean(request.headers.get("DPoP"));
+  const dpop = hasDpop ? await verifyDpopProof({ request, expectedMethod: "POST", expectedUrl: request.url }) : null;
+  if (hasDpop && !dpop) return json({ error: "invalid_dpop_proof" }, 400);
   const grantType = String(body.grant_type ?? "");
-  if (grantType === "authorization_code") return exchangeAuthorizationCode(body, base, options);
-  if (grantType === "refresh_token") return exchangeRefreshToken(body, base, options);
+  if (grantType === "authorization_code") return exchangeAuthorizationCode(body, base, options, dpop || undefined);
+  if (grantType === "refresh_token") return exchangeRefreshToken(body, base, options, dpop || undefined);
   return json({ error: "unsupported_grant_type" }, 400);
 }
 
@@ -46,6 +50,7 @@ async function exchangeAuthorizationCode(
   body: Record<string, unknown>,
   base: string,
   options: OAuthTokenExchangeOptions,
+  dpop?: VerifiedDpopProof,
 ): Promise<Response> {
   const code = String(body.code ?? "");
   const verifier = String(body.code_verifier ?? "");
@@ -69,11 +74,14 @@ async function exchangeAuthorizationCode(
     const client = oauthStore.clients[record.client_id];
     if (!client) return json({ error: "invalid_grant", error_description: "unknown client" }, 400);
 
-    const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+    if (dpop && !(await consumeDpopProof(options.storage, dpop))) {
+      return json({ error: "invalid_dpop_proof" }, 400);
+    }
+    const issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion, dpop?.jkt);
     delete oauthStore.codes[code];
     client.last_used_at = Math.floor(Date.now() / 1000);
     await saveOAuthStores(oauthStore, refreshStore, options.storage);
-    return tokenResponse(issued, record.scope);
+    return tokenResponse(issued, record.scope, dpop?.jkt);
   });
 }
 
@@ -81,6 +89,7 @@ async function exchangeRefreshToken(
   body: Record<string, unknown>,
   base: string,
   options: OAuthTokenExchangeOptions,
+  dpop?: VerifiedDpopProof,
 ): Promise<Response> {
   const refreshToken = String(body.refresh_token ?? "");
   if (!/^mcp_rt_[A-Za-z0-9_-]{43}$/.test(refreshToken)) return json({ error: "invalid_grant" }, 400);
@@ -97,6 +106,8 @@ async function exchangeRefreshToken(
       }
       return json({ error: "invalid_grant" }, 400);
     }
+    if (record.dpop_jkt && record.dpop_jkt !== dpop?.jkt) return json({ error: "invalid_dpop_proof" }, 400);
+    if (!record.dpop_jkt && dpop?.jkt) record.dpop_jkt = dpop.jkt;
     if (refreshStore.revoked_families[record.family_id]) {
       delete refreshStore.tokens[refreshKey];
       await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
@@ -124,15 +135,21 @@ async function exchangeRefreshToken(
       || account.version !== record.account_version
       || account.role !== record.role
       || !client
+      || client.trusted_account_id !== account.account_id
+      || client.trusted_account_version !== account.version
+      || client.trusted_role !== account.role
     ) {
       delete refreshStore.tokens[refreshKey];
       await options.storage.put(OAUTH_REFRESH_STORE_KEY, refreshStore);
       return json({ error: "invalid_grant" }, 400);
     }
 
+    if (dpop && !(await consumeDpopProof(options.storage, dpop))) {
+      return json({ error: "invalid_dpop_proof" }, 400);
+    }
     let issued: IssuedTokenPair;
     try {
-      issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion);
+      issued = await issueTokenPair(oauthStore, refreshStore, record, options.tokenVersion, dpop?.jkt);
     } catch (error) {
       if (error instanceof HttpError && error.code === "invalid_grant") {
         delete refreshStore.tokens[refreshKey];
@@ -143,6 +160,7 @@ async function exchangeRefreshToken(
     }
     delete refreshStore.tokens[refreshKey];
     recordConsumedRefreshToken(
+      oauthStore,
       refreshStore,
       refreshKey,
       record.family_id,
@@ -151,7 +169,7 @@ async function exchangeRefreshToken(
     );
     client.last_used_at = Math.floor(Date.now() / 1000);
     await saveOAuthStores(oauthStore, refreshStore, options.storage);
-    return tokenResponse(issued, record.scope);
+    return tokenResponse(issued, record.scope, dpop?.jkt || record.dpop_jkt);
   });
 }
 
@@ -160,6 +178,7 @@ async function issueTokenPair(
   refreshStore: OAuthRefreshStore,
   source: OAuthCode | OAuthRefreshToken,
   tokenVersion: string,
+  dpopJkt?: string,
 ): Promise<IssuedTokenPair> {
   if (!tokenVersion) throw new HttpError(503, "server_error", "OAuth token version is not configured");
   const now = Math.floor(Date.now() / 1000);
@@ -179,6 +198,7 @@ async function issueTokenPair(
     resource: source.resource,
     version: tokenVersion,
     family_id: familyId,
+    ...(dpopJkt ? { dpop_jkt: dpopJkt } : {}),
   };
   oauthStore.tokens[`sha256:${await sha256Hex(accessToken)}`] = {
     ...common,
@@ -198,11 +218,11 @@ async function issueTokenPair(
   return { accessToken, refreshToken };
 }
 
-function tokenResponse(issued: IssuedTokenPair, scope: string): Response {
+function tokenResponse(issued: IssuedTokenPair, scope: string, dpopJkt?: string): Response {
   return json({
     access_token: issued.accessToken,
     refresh_token: issued.refreshToken,
-    token_type: "Bearer",
+    token_type: dpopJkt ? "DPoP" : "Bearer",
     expires_in: ACCESS_TOKEN_TTL_SECONDS,
     scope,
   });

package/src/worker/websocket-protocol.ts

@@ -7,14 +7,20 @@ export function rejectDaemonMessage(ws: WebSocket, error: string, closeCode: num
   closeWebSocketQuietly(ws, closeCode, closeReason);
 }
 
-export function sendWebSocketQuietly(ws: WebSocket, value: unknown): void {
+export function trySendWebSocket(ws: WebSocket, value: unknown): boolean {
   try {
     ws.send(typeof value === "string" ? value : JSON.stringify(value));
+    return true;
   } catch {
-    // Best-effort protocol cleanup must not replace the primary timeout or rejection.
+    return false;
   }
 }
 
+export function sendWebSocketQuietly(ws: WebSocket, value: unknown): void {
+  // Best-effort protocol cleanup must not replace the primary timeout or rejection.
+  trySendWebSocket(ws, value);
+}
+
 export function closeWebSocketQuietly(ws: WebSocket, code?: number, reason?: string): void {
   try {
     ws.close(code, reason);