mandala-computer-mcp 0.6.0 → 0.8.0

package/dist/http.js

@@ -7,7 +7,7 @@ import express, {} from 'express';
 import { Api, MODEL_KEY_HEADER } from './api.js';
 import { APIError } from './errors.js';
 import { MeteredBody } from './http-body.js';
-import { SSH_KEYS } from './paths.js';
+import { WHOAMI } from './paths.js';
 import { createServer, SERVER_NAME, SERVER_VERSION } from './server.js';
 import { toolFilter } from './tool-filters.js';
 /** The OAuth scope the hosted resource asks for. */
@@ -66,7 +66,26 @@ const DEFAULT_TTL_MS = 30 * 60 * 1000;
  * any string gets that far; without a cap, a loop of initializes is a memory
  * exhaustion that costs the sender nothing.
  */
-const DEFAULT_MAX_SESSIONS = 256;
+export const DEFAULT_MAX_SESSIONS = 256;
+/**
+ * A ceiling on live sessions per bearer, under the one above.
+ *
+ * The process-wide cap bounds memory, but on its own it is a pool one caller
+ * can drain: a single accepted bearer could open every one of the 256 sessions
+ * and every other tenant's initialize was 503'd until the sweep, half an hour
+ * later. 16 leaves room for one person running several MCP clients on one key
+ * and still leaves the pool to everybody else.
+ *
+ * A suspended account's bearer is admitted (OPL-5437: it is how its holder
+ * reaches `whoami` and learns it is suspended), and one session is all that
+ * needs. Every other call it could make is refused by the platform.
+ */
+const DEFAULT_MAX_SESSIONS_PER_BEARER = 16;
+const MAX_SESSIONS_SUSPENDED = 1;
+/** How long a caller whose bearer holds its maximum is asked to wait, in s. */
+const BEARER_FULL_RETRY_AFTER_S = 30;
+/** How long a caller is asked to wait when the whole pool is full, in s. */
+const POOL_FULL_RETRY_AFTER_S = 30;
 const DEFAULT_MAX_LARGE_BODY_PARSES = 4;
 const SMALL_BODY_BYTES = 256 * 1024;
 /**
@@ -212,64 +231,81 @@ export async function runHttp(cfg) {
     const checkTtl = cfg.bearerCheckTtlMs ?? DEFAULT_BEARER_CHECK_TTL_MS;
     const accepted = new Map();
     let checksInFlight = 0;
-    /** Whether the platform accepted this bearer within the cache window. */
-    const isAccepted = (key) => {
-        const until = accepted.get(digest(key).toString('hex'));
-        return until !== undefined && until > Date.now();
+    /** The platform's acceptance of this bearer, while the cache window lasts. */
+    const acceptance = (key) => {
+        const entry = accepted.get(digest(key).toString('hex'));
+        return entry !== undefined && entry.until > Date.now() ? entry : undefined;
     };
+    /** Whether the platform accepted this bearer within the cache window. */
+    const isAccepted = (key) => acceptance(key) !== undefined;
     /**
      * `ok`: the probe answered 2xx, and only that — the one answer that says the
-     * platform authenticated this credential AND let it act. `refused`: a 401.
-     * `unknown`: anything else — a 403 (a suspended account or a lost
-     * membership), a 404 (the route moved), a 429, a 5xx, a timeout, or this
+     * platform authenticated this credential AND let it act. `suspended`: the
+     * same 2xx, for an account whose whoami says `status: "suspended"` — admitted
+     * as `ok` is, and held to one session. `refused`: a 401.
+     * `unknown`: anything else — a 403 (a lost membership, say; a suspended
+     * account is answered 2xx on whoami and admitted), a 404 (the route moved), a 429, a 5xx, a timeout, or this
      * server already asking about as many bearers as it will at once. Only `ok`
-     * is cached.
+     * and `suspended` are cached, the standing and the account id with the
+     * acceptance. `account` is the account key the bearer counts against (see
+     * {@link accountKey}); it is set whenever the verdict is `ok` or
+     * `suspended`, and returned rather than read back from the cache, which a
+     * zero TTL or a full cache may already have let go of.
      */
     // `onStart` runs only when a probe really starts — never for a cached answer
     // or a full cap — and synchronously, before the first await, so a caller's
     // bookkeeping and its check against it cannot interleave with another's.
     const checkBearer = async (key, onStart) => {
         const id = digest(key).toString('hex');
-        if (isAccepted(key))
-            return 'ok';
+        const cached = acceptance(key);
+        if (cached) {
+            return {
+                verdict: cached.suspended ? 'suspended' : 'ok',
+                account: accountKey(id, cached.account),
+            };
+        }
         if (checksInFlight >= MAX_BEARER_CHECKS_IN_FLIGHT)
-            return 'unknown';
+            return { verdict: 'unknown' };
         checksInFlight++;
         onStart?.();
+        let suspended;
+        let confirmed;
         try {
             const api = new Api(key, cfg.baseUrl, AbortSignal.timeout(BEARER_CHECK_TIMEOUT_MS), {
                 serviceSecret,
             });
-            // `GET ssh-keys`, chosen because it is the cheapest read that every
-            // valid credential is answered 2xx on. The platform's route table
-            // gives it the lowest role there is (viewer), a workspace-scoped key is
-            // refused only the key WRITES, and the handler lists the caller's own
-            // keys from the control plane without asking any host — so no role a
-            // grant can carry, and no host being down, turns it into a refusal.
-            // `account` is the alternative and costs two fleet inventories. The one
-            // valid credential it does not admit is a suspended account's (403),
-            // which is answered as unconfirmed. It takes no parameters, so none are
-            // sent.
-            await api.json('GET', SSH_KEYS);
+            // `GET whoami`, chosen because every valid credential is answered 2xx
+            // on it, a suspended account's included. The platform's route table
+            // gives it the lowest role there is (viewer) and marks it readable by a
+            // suspended account, and the handler answers from the control plane's
+            // own tables without asking any host — so no role a grant can carry, no
+            // workspace scope, no account standing and no host being down turns it
+            // into a refusal. It was `GET ssh-keys`, which a suspended account is
+            // refused (403): its holder was answered 503 on every initialize and so
+            // could never reach whoami, the one tool that would say it is suspended
+            // (OPL-5437). It takes no parameters, so none are sent.
+            const who = await api.json('GET', WHOAMI);
+            suspended = isSuspended(who);
+            confirmed = accountIdOf(who);
         }
         catch (err) {
-            return err instanceof APIError && err.status === 401 ? 'refused' : 'unknown';
+            return { verdict: err instanceof APIError && err.status === 401 ? 'refused' : 'unknown' };
         }
         finally {
             checksInFlight--;
         }
         const now = Date.now();
         if (accepted.size >= MAX_ACCEPTED_BEARERS) {
-            for (const [k, t] of accepted)
-                if (t <= now)
+            for (const [k, e] of accepted)
+                if (e.until <= now)
                     accepted.delete(k);
             // Still full: drop the oldest, which Map iteration yields first.
             if (accepted.size >= MAX_ACCEPTED_BEARERS) {
                 accepted.delete(accepted.keys().next().value);
             }
         }
-        accepted.set(id, now + checkTtl);
-        return 'ok';
+        accepted.set(id, { until: now + checkTtl, suspended, account: confirmed });
+        return { verdict: suspended ? 'suspended' : 'ok', account: accountKey(id, confirmed) };
     };
     // Refused initializes per source, in fixed one-minute windows. Kept apart
     // from the session cap so a flood of invented tokens is turned away before
@@ -350,6 +386,31 @@ export async function runHttp(cfg) {
     // the same `sessions.size`, all of them pass, and the cap bounds nothing —
     // which is the exact memory exhaustion it was put here to stop.
     let pending = 0;
+    // The same reservations again, per bearer digest (hex), for the per-bearer
+    // cap and for the same reason: a burst of initializes from one bearer would
+    // otherwise all count the same sessions and all pass. An entry is deleted
+    // when it reaches zero, so the map holds only bearers mid-initialize.
+    const pendingByDigest = new Map();
+    // Normalised, because the cap is also arithmetic against the process-wide
+    // one: a NaN here (`Number(process.env.X)` with X unset) made every
+    // comparison below false and switched off BOTH caps, the 256 backstop
+    // included. Anything that is not a number of at least one is the default;
+    // Infinity is let through, and leaves only the process-wide cap.
+    const perBearer = cfg.maxSessionsPerBearer;
+    const maxPerBearer = typeof perBearer === 'number' && perBearer >= 1
+        ? Math.floor(perBearer)
+        : DEFAULT_MAX_SESSIONS_PER_BEARER;
+    // The same reservations per account (OPL-5447): an account may hold any
+    // number of bearers, so a burst spread across its keys would otherwise all
+    // count the same sessions and all pass the account ceiling.
+    const pendingByAccount = new Map();
+    // The ceiling no account may pass, live plus pending: half the pool by
+    // default, so no one tenant can take the whole of it however many keys it
+    // holds. Normalised as the per-bearer cap is, and clamped to the pool.
+    const perAccount = cfg.maxSessionsPerAccount;
+    const maxPerAccount = typeof perAccount === 'number' && perAccount >= 1
+        ? Math.min(Math.floor(perAccount), maxSessions)
+        : Math.max(1, Math.floor(maxSessions / 2));
     // Two parsers, chosen by whether this server has already checked who is
     // asking.
     //
@@ -587,21 +648,133 @@ export async function runHttp(cfg) {
      * exists for, a laptop that slept and left the socket half-open, is exactly
      * the one where `close` never fires to undo the count. The transport and its
      * fully-registered server would sit on a `maxSessions` slot forever.
+     *
+     * `heard` says whether this traffic may stamp the session as heard from; it
+     * is asked at the start and again at the end. Only `active` is unconditional,
+     * so a session with work in flight is never swept whatever `heard` says.
      */
-    const beginActivity = (live) => {
+    const beginActivity = (live, heard = always) => {
         live.active++;
-        live.lastSeen = Date.now();
+        if (heard())
+            live.lastSeen = Date.now();
         let held = true;
         return () => {
             if (!held)
                 return;
             held = false;
             live.active--;
-            live.lastSeen = Date.now();
+            if (heard())
+                live.lastSeen = Date.now();
         };
     };
-    const serving = async (live, handle) => {
-        const release = beginActivity(live);
+    /**
+     * Whether traffic on this bearer that carries no request may keep its
+     * session from idling out (OPL-5455). Hosted, only while the platform's
+     * acceptance of the bearer is still cached: a notification, a response or
+     * the standing stream never asks the platform, so without this a revoked
+     * token's holder could keep its sessions (and its account's ceiling) held
+     * for ever by sending nothing but those. Once the acceptance lapses and no
+     * request renews it, they idle out after the session TTL. A cache peek, never
+     * a probe. Self-hosted: always.
+     */
+    const heardWhileAccepted = (key) => challenge ? () => isAccepted(key) : always;
+    /** The live sessions opened with this bearer, by its digest. */
+    const sessionsOf = (keyDigest) => {
+        const own = [];
+        for (const entry of sessions) {
+            const theirs = entry[1].keyDigest;
+            if (theirs.length === keyDigest.length && timingSafeEqual(theirs, keyDigest))
+                own.push(entry);
+        }
+        return own;
+    };
+    /**
+     * The live sessions counted against this account, whichever bearer opened
+     * them. One whose bearer the platform has refused is included: it holds its
+     * transport and its slot in the pool until it is closed, so leaving it out
+     * would let an account that revokes its own keys hold more than its
+     * ceiling, up to the whole pool.
+     */
+    const sessionsOfAccount = (account) => {
+        const counted = [];
+        for (const entry of sessions)
+            if (entry[1].account === account)
+                counted.push(entry);
+        return counted;
+    };
+    /**
+     * The sessions to close so that one more fits under both this bearer's cap
+     * and its account's ceiling (OPL-5447), or which of the two it cannot fit
+     * under.
+     *
+     * Only idle sessions (`active === 0`, what the sweeper closes) are
+     * candidates, and of two kinds. The bearer's own, which make room under
+     * whichever limit binds: its own cap, as before, or its account's ceiling.
+     * And the account's sessions of its other bearers that the platform has
+     * refused: nothing more is served on those, yet they count against the
+     * ceiling until closed, so without this a revoked key would hold its
+     * account's other keys out until the sweep. Refused ones go first, then the
+     * least recently seen. A live session of another bearer is never a
+     * candidate, and neither is anything of another account; an own session
+     * counts toward the ceiling's need only if it counts against this account.
+     *
+     * `pendingBearer`/`pendingAccount` are initializes admitted and not yet
+     * landed; at landing both are 0 (see `onsessioninitialized`). The result
+     * names sessions, so nothing that outlives the call may keep it.
+     */
+    const planRoom = (keyDigest, account, bearerCap, pendingBearer, pendingAccount) => {
+        const own = sessionsOf(keyDigest);
+        const counted = sessionsOfAccount(account);
+        let bearerNeed = own.length + pendingBearer - bearerCap + 1;
+        let accountNeed = counted.length + pendingAccount - maxPerAccount + 1;
+        const victims = [];
+        if (bearerNeed <= 0 && accountNeed <= 0)
+            return { victims };
+        const mine = new Set(own.map(([id]) => id));
+        const candidates = [...own, ...counted.filter(([id, live]) => !mine.has(id) && live.refused)]
+            .filter(([, live]) => live.active === 0)
+            .sort((a, b) => Number(b[1].refused) - Number(a[1].refused) || a[1].lastSeen - b[1].lastSeen);
+        for (const entry of candidates) {
+            if (bearerNeed <= 0 && accountNeed <= 0)
+                break;
+            const ofBearer = mine.has(entry[0]);
+            const ofAccount = entry[1].account === account;
+            if (!(ofBearer && bearerNeed > 0) && !(ofAccount && accountNeed > 0))
+                continue;
+            victims.push(entry);
+            if (ofBearer)
+                bearerNeed--;
+            if (ofAccount)
+                accountNeed--;
+        }
+        if (bearerNeed > 0)
+            return { full: 'bearer', holds: own.length };
+        if (accountNeed > 0)
+            return { full: 'account' };
+        return { victims };
+    };
+    /**
+     * Close this bearer's idle sessions, least recently seen first, until it
+     * holds no more than `cap` or none idle is left. Never `keep`, and never one
+     * with a request in flight: the same test the sweeper and an initialize's
+     * room-making apply. Only a cap that has fallen needs this — an account
+     * suspended after its bearer opened sessions (OPL-5448) — since an
+     * initialize never admits a session over the cap it is checked against.
+     */
+    const trimIdle = (keyDigest, cap, keep) => {
+        const own = sessionsOf(keyDigest);
+        const excess = own.length - cap;
+        if (excess <= 0)
+            return;
+        const idle = own.filter(([id, live]) => id !== keep && live.active === 0);
+        idle.sort((a, b) => a[1].lastSeen - b[1].lastSeen);
+        for (const [id, gone] of idle.slice(0, excess)) {
+            sessions.delete(id);
+            void gone.transport.close().catch(() => { });
+        }
+    };
+    const serving = async (live, handle, heard = always) => {
+        const release = beginActivity(live, heard);
         try {
             return await handle();
         }
@@ -613,11 +786,16 @@ export async function runHttp(cfg) {
             release();
         }
     };
-    /** Stamp a session as heard from, without claiming anything is in flight. */
-    const touch = (live, res) => {
-        live.lastSeen = Date.now();
-        res.on('close', () => {
+    /**
+     * Stamp a session as heard from, without claiming anything is in flight, on
+     * open and on close, each only when `heard` allows it (see `beginActivity`).
+     */
+    const touch = (live, res, heard) => {
+        if (heard())
             live.lastSeen = Date.now();
+        res.on('close', () => {
+            if (heard())
+                live.lastSeen = Date.now();
         });
     };
     /**
@@ -736,6 +914,7 @@ export async function runHttp(cfg) {
             return challenged(res, NO_TOKEN, rpcId(req));
         }
         if (sessionId) {
+            let unpin = () => { };
             try {
                 const live = sessions.get(sessionId);
                 if (!live)
@@ -758,24 +937,56 @@ export async function runHttp(cfg) {
                     }
                     return unauthorized(res, 'This session belongs to a different API key.', rpcId(req));
                 }
+                // In flight from here, not only once it is dispatched: the bearer
+                // check below awaits the platform, for up to BEARER_CHECK_TIMEOUT_MS on
+                // a cache miss, and an initialize on the same bearer at its cap closes
+                // an idle session to make room. Counted as busy through that wait, this
+                // one is never the session closed under a request already routed to it
+                // (OPL-5443). Only `active` is raised: a request refused below has not
+                // been served, and does not stamp the session as heard from.
+                live.active++;
+                let pinned = true;
+                unpin = () => {
+                    if (!pinned)
+                        return;
+                    pinned = false;
+                    live.active--;
+                };
                 if (challenge && live.refused)
                     return challenged(res, TOKEN_REFUSED, rpcId(req));
                 // Checked before a request is dispatched, while the answer can still
                 // be a 401 whatever the call goes on to do. A platform that cannot say
                 // is not a refusal: the call goes ahead, and a real refusal during it
                 // still reaches the client through the held answer or the mark.
-                if (challenge && carriesRequest(req.body) && (await checkBearer(key)) === 'refused') {
+                const request = carriesRequest(req.body);
+                const verdict = challenge && request ? (await checkBearer(key)).verdict : undefined;
+                if (verdict === 'refused') {
                     live.refused = true;
                     return challenged(res, TOKEN_REFUSED, rpcId(req));
                 }
+                // An account suspended after its bearer opened sessions kept every one
+                // of them, up to the 16 an active bearer may hold, while an initialize
+                // on it was held to one (OPL-5448). Its other idle sessions go now,
+                // down to that one; this session is pinned above and one busy
+                // elsewhere is skipped, and closed on a later request once it is idle.
+                if (verdict === 'suspended')
+                    trimIdle(live.keyDigest, MAX_SESSIONS_SUSPENDED, sessionId);
                 const lease = res.locals.largeBodyLease;
                 const id = rpcId(req);
                 const held = challenge
                     ? holdAnswer(res, () => challenged(res, TOKEN_REFUSED, id))
                     : undefined;
-                return await heldAnswer.run(held, () => requestBodyLease.run(lease, () => serving(live, () => live.transport.handleRequest(req, res, req.body))));
+                return await heldAnswer.run(held, () => requestBodyLease.run(lease, () => serving(live, () => live.transport.handleRequest(req, res, req.body), 
+                // A request keeps the session as before: it was just put to
+                // the platform, or found its acceptance cached. Anything else
+                // keeps it only while that acceptance lasts.
+                request ? always : heardWhileAccepted(key))));
             }
             finally {
+                // serving() held its own lease across handleRequest, and a tool
+                // callback that outlives it holds another through activity(), so the
+                // pin can go once the route is done with the request.
+                unpin();
                 // A verified session is the only request allowed through the large
                 // parser. Release the route's ownership here; a tool callback that
                 // outlives handleRequest retains its own reference through activity().
@@ -785,9 +996,14 @@ export async function runHttp(cfg) {
         // Sessionless requests always use the small parser. This no-op keeps the
         // ownership explicit if the parser policy changes later.
         releaseLargeBody(res);
-        if (!isInitializeRequest(req.body)) {
-            return badRequest(res, 'No session id, and this is not an initialize request.', rpcId(req));
-        }
+        // Who is asking is settled before what they asked for. A sessionless
+        // request that is not an initialize is a protocol mistake (400), but a
+        // client with no credential, or one the platform refuses, has an auth
+        // problem first — and a 400 "No session id" sent it looking at its session
+        // handling when the fix was its key. So the key, the Host check and, hosted,
+        // the bearer probe all run before the initialize test; only the session cap
+        // and the build below are an initialize's alone.
+        const initialize = isInitializeRequest(req.body);
         if (!key) {
             return unauthorized(res, 'Send your Mandala API key as a bearer token: Authorization: Bearer com_…', rpcId(req));
         }
@@ -802,6 +1018,8 @@ export async function runHttp(cfg) {
             return rpcError(res, 403, -32000, refused, rpcId(req));
         // Hosted: no session for a bearer the platform does not accept. Before the
         // cap and the reservation, so a refused bearer never holds a slot.
+        let suspended = false;
+        let checkedAccount;
         if (challenge) {
             // A spent budget does not close the address. Many clients can share one
             // (a NAT, an office), and one bad neighbour must not lock out the rest:
@@ -816,13 +1034,13 @@ export async function runHttp(cfg) {
                 const wait = entry?.lastProbeAt !== undefined ? entry.lastProbeAt + exhaustedInterval - Date.now() : 0;
                 if (wait > 0) {
                     res.set('Retry-After', String(Math.max(1, Math.ceil(wait / 1000))));
-                    return rpcError(res, 429, -32002, 'Too many refused initializes from this address. Retry later with a valid token.', rpcId(req));
+                    return rpcError(res, 429, -32002, 'Too many refused tokens from this address. Retry later with a valid token.', rpcId(req));
                 }
             }
             // The interval is spent only by a probe that starts: a request turned
             // away because the process-wide cap is full reached nobody, and must not
             // make the next client at this address wait out an interval for it.
-            const verdict = await checkBearer(key, spent
+            const { verdict, account } = await checkBearer(key, spent
                 ? () => {
                     const entry = failures.get(sourceOf(req));
                     if (entry)
@@ -833,26 +1051,100 @@ export async function runHttp(cfg) {
                 noteFailure(req);
                 return challenged(res, TOKEN_REFUSED, rpcId(req));
             }
-            if (verdict === 'unknown') {
+            // Not an initialize, it is a 400 whatever the platform could say about
+            // the key short of refusing it.
+            if (verdict === 'unknown' && initialize) {
                 return unavailable(res, 'The platform could not confirm this token just now. Retry shortly.', rpcId(req));
             }
+            suspended = verdict === 'suspended';
+            checkedAccount = account;
+        }
+        if (!initialize) {
+            return badRequest(res, 'No session id, and this is not an initialize request.', rpcId(req));
+        }
+        // One bearer may not hold the whole pool (OPL-5443), nor one account more
+        // than its ceiling however many bearers it holds (OPL-5447). Both counted
+        // before the process-wide cap, so a bearer that can make room by closing
+        // one of its idle sessions frees a process-wide slot as well. From the
+        // count to the reservation below is synchronous, so a burst cannot all
+        // read the same count.
+        const keyDigest = digest(key);
+        const keyId = keyDigest.toString('hex');
+        // Hosted, the account the platform confirmed for this bearer (or the
+        // bearer itself, when whoami named none); self-hosted, the bearer.
+        const account = checkedAccount ?? accountKey(keyId, undefined);
+        const bearerCap = suspended ? MAX_SESSIONS_SUSPENDED : maxPerBearer;
+        // A bearer can hold more than its cap only when the cap fell under it: an
+        // account suspended after it opened sessions (OPL-5448). Those over the
+        // cap are closed first if idle, whatever becomes of this initialize, so
+        // what is left to count, and to name in a 429, is what it really holds.
+        trimIdle(keyDigest, bearerCap);
+        const tooMany = (message) => {
+            res.set('Retry-After', String(BEARER_FULL_RETRY_AFTER_S));
+            return rpcError(res, 429, -32002, message, rpcId(req));
+        };
+        // Room is made from this bearer's own IDLE sessions, least recently seen
+        // first, exactly as the sweeper would close them, under whichever limit
+        // binds: its own cap or its account's ceiling. Never another bearer's live
+        // session, and never one with a request in flight: past the ceiling an
+        // initialize is refused, since the account's holder is the one who knows
+        // which of its clients can spare a session. An idle session of the
+        // account's whose bearer the platform refused is the one exception (see
+        // `planRoom`). A client whose old session is gone gets 404 for it and
+        // initializes again, as MCP clients do. Decided here, so a caller with
+        // nothing idle to give back is refused at once; carried out only once the
+        // new session exists (in `onsessioninitialized`), so an initialize the SDK
+        // then refuses (406, 415, 400) or that throws on the way does not also
+        // cost the caller a working session. Only the number is kept past here.
+        let planned = 0;
+        {
+            const room = planRoom(keyDigest, account, bearerCap, pendingByDigest.get(keyId) ?? 0, pendingByAccount.get(account) ?? 0);
+            if ('full' in room) {
+                if (room.full === 'account')
+                    return tooMany(accountFullMessage(account, maxPerAccount));
+                // Over the cap after the trim means every session over it is busy,
+                // and closing one would not be enough: the client can only wait.
+                return tooMany(room.holds > bearerCap
+                    ? `This token holds ${room.holds} sessions on this server, over its maximum of ${bearerCap}, and the ones over it are all serving a request. Retry once they finish; idle ones are closed to make room.`
+                    : `This token already holds its maximum of ${bearerCap} ${bearerCap === 1 ? 'session' : 'sessions'} on this server. Close one (DELETE /mcp) or retry shortly.`);
+            }
+            planned = room.victims.length;
         }
         // Swept sessions free their slot on the timer; this is the backstop for the
         // case the timer cannot help with, which is arrivals faster than the TTL.
-        if (sessions.size + pending >= maxSessions) {
+        // The sessions this initialize will close are still in the map, and are not
+        // counted against it: a bearer making room in its own share is not newly
+        // refused for the room it is about to give back. Nothing is closed to make
+        // room here, whoever holds the pool.
+        if (sessions.size - planned + pending >= maxSessions) {
+            res.set('Retry-After', String(POOL_FULL_RETRY_AFTER_S));
             return unavailable(res, `This server is holding its maximum of ${maxSessions} sessions. Retry shortly.`, rpcId(req));
         }
         pending++;
+        pendingByDigest.set(keyId, (pendingByDigest.get(keyId) ?? 0) + 1);
+        pendingByAccount.set(account, (pendingByAccount.get(account) ?? 0) + 1);
         // Released exactly once, whether the initialize lands in the map or throws
         // on the way there. A reservation that leaked on the failure path would
         // ratchet the cap down until the process restarted — every later initialize
         // refused with 503 for the life of the process, which is the denial of
-        // service the counter was added to prevent, self-inflicted.
+        // service the counter was added to prevent, self-inflicted. The per-bearer
+        // and per-account counts leaking would do the same to that bearer and that
+        // account.
         let reserved = true;
         const release = () => {
             if (reserved) {
                 reserved = false;
                 pending--;
+                const left = (pendingByDigest.get(keyId) ?? 1) - 1;
+                if (left > 0)
+                    pendingByDigest.set(keyId, left);
+                else
+                    pendingByDigest.delete(keyId);
+                const accountLeft = (pendingByAccount.get(account) ?? 1) - 1;
+                if (accountLeft > 0)
+                    pendingByAccount.set(account, accountLeft);
+                else
+                    pendingByAccount.delete(account);
             }
         };
         // Everything from here to the map write is inside the reservation,
@@ -865,6 +1157,9 @@ export async function runHttp(cfg) {
         let transport;
         let mcp;
         let finishInitialize = () => { };
+        // Set when the session was dropped at birth for want of room (see
+        // `onsessioninitialized`): it has an id but no map slot.
+        let dropped = false;
         try {
             const t = new StreamableHTTPServerTransport({
                 sessionIdGenerator: () => randomUUID(),
@@ -879,9 +1174,39 @@ export async function runHttp(cfg) {
                 allowedHosts: hosts,
                 allowedOrigins,
                 onsessioninitialized: (id) => {
+                    // The room the check above planned, made now that there is a session
+                    // to make it for. Chosen again from what is here NOW: a session
+                    // closed or put to work since then is not a candidate. Should too
+                    // few still be idle, nothing is closed and this session is dropped
+                    // instead of admitted over the cap. The transport closes before the
+                    // SDK answers, so the SDK answers this initialize itself, with its
+                    // 404 -32001 'Session not found' and no Retry-After — not the 429
+                    // the refusal above gives, which cannot be written from here. An
+                    // SDK client surfaces that as a failed connect; it does not retry
+                    // on its own. Only a race reaches this: a request landing on a
+                    // planned session between the check above and this callback.
+                    //
+                    // The account's ceiling is re-checked here too (OPL-5447), against
+                    // the map alone. Initializes still pending were each admitted
+                    // counting this one's reservation, and the room they will make is
+                    // still in the map, so counting them again here would drop a session
+                    // that fits; what keeps a burst under the ceiling is the pending
+                    // count at admission. Every landing leaves the map within both.
+                    const room = planRoom(keyDigest, account, bearerCap, 0, 0);
+                    if ('full' in room) {
+                        dropped = true;
+                        release();
+                        void t.close().catch(() => { });
+                        return;
+                    }
+                    for (const [other, gone] of room.victims) {
+                        sessions.delete(other);
+                        void gone.transport.close().catch(() => { });
+                    }
                     const live = {
                         transport: t,
-                        keyDigest: digest(key),
+                        keyDigest,
+                        account,
                         lastSeen: Date.now(),
                         // Initialize is already in flight when the session first becomes
                         // visible to the sweeper. Count it until handleRequest settles.
@@ -951,10 +1276,11 @@ export async function runHttp(cfg) {
             mcp = server;
             await server.connect(t);
             const handled = await t.handleRequest(req, res, req.body);
-            // Any initialize that never reached `onsessioninitialized` has no map
-            // slot and nothing the sweeper will reap. The SDK's 403 used to take
-            // this path without throwing; other early returns still can.
-            if (!t.sessionId) {
+            // Any initialize that never reached `onsessioninitialized`, or was
+            // dropped there, has no map slot and nothing the sweeper will reap. The
+            // SDK's 403 used to take this path without throwing; other early returns
+            // still can.
+            if (!t.sessionId || dropped) {
                 void server.close().catch(() => { });
                 void t.close().catch(() => { });
             }
@@ -1000,13 +1326,21 @@ export async function runHttp(cfg) {
         // DELETE is still honoured, since the digest shows it is the holder.
         if (challenge && live.refused && req.method === 'GET')
             return challenged(res, TOKEN_REFUSED);
-        // The DELETE is a request and is held for; the GET is the notification
-        // stream and is only noted. See `serving`.
+        // The GET is the notification stream and is only noted; anything else
+        // here (a DELETE, or a HEAD, which Express routes to the GET handler with
+        // the method unchanged) is held for while the SDK handles it. See
+        // `serving`. None of it is put to the platform, so none of it may keep the
+        // session from idling out once the token's acceptance lapses: a HEAD is
+        // answered 405 and a DELETE the SDK refuses (an unsupported protocol
+        // version, say) 400, both leaving the session open, and a revoked token's
+        // holder could otherwise send either for ever to keep its sessions, and
+        // its account's ceiling, held (OPL-5455). A DELETE that succeeds closes
+        // the session anyway, and `active` is counted whatever `heard` says.
         if (req.method === 'GET') {
-            touch(live, res);
+            touch(live, res, heardWhileAccepted(key));
             return live.transport.handleRequest(req, res);
         }
-        return serving(live, () => live.transport.handleRequest(req, res));
+        return serving(live, () => live.transport.handleRequest(req, res), heardWhileAccepted(key));
     };
     app.get('/mcp', bySession);
     app.delete('/mcp', bySession);
@@ -1151,6 +1485,55 @@ const BEARER_CHECK_TIMEOUT_MS = 10_000;
 const MAX_BEARER_CHECKS_IN_FLIGHT = 32;
 const MAX_ACCEPTED_BEARERS = 4096;
 const MAX_FAILURE_SOURCES = 10_000;
+/**
+ * Whether a whoami record says its account is suspended.
+ *
+ * Only an explicit `account.status` of `"suspended"` counts. A record this
+ * cannot read is not evidence of suspension, and treating it as such would hold
+ * a working account to one session on the strength of a shape change.
+ */
+function isSuspended(who) {
+    if (typeof who !== 'object' || who === null)
+        return false;
+    const account = who.account;
+    if (typeof account !== 'object' || account === null)
+        return false;
+    return account.status === 'suspended';
+}
+/**
+ * The account id a whoami record names: a non-empty string of at most 256
+ * characters. Anything else is no account, and the bearer then counts as an
+ * account of its own rather than as one this server could not confirm.
+ */
+function accountIdOf(who) {
+    if (typeof who !== 'object' || who === null)
+        return undefined;
+    const account = who.account;
+    if (typeof account !== 'object' || account === null)
+        return undefined;
+    const id = account.id;
+    return typeof id === 'string' && id.length > 0 && id.length <= 256 ? id : undefined;
+}
+/**
+ * What a session counts against for the account ceiling (OPL-5447).
+ *
+ * The account id the platform confirmed for the bearer when there is one
+ * (hosted mode), and otherwise the bearer's own digest: a hosted whoami that
+ * names no account, and every bearer on a self-hosted server, which verifies
+ * none and so puts no trust in a string it cannot check. Prefixed so the two
+ * can never name the same thing.
+ */
+function accountKey(keyId, confirmed) {
+    return confirmed !== undefined ? `account:${confirmed}` : `bearer:${keyId}`;
+}
+/** The 429 for an account at its ceiling. It names the limit and nothing else. */
+function accountFullMessage(account, cap) {
+    const noun = cap === 1 ? 'session' : 'sessions';
+    return account.startsWith('account:')
+        ? `This account has reached its maximum of ${cap} ${noun} on this server, across all its tokens. Close one (DELETE /mcp) or retry shortly.`
+        : `This token has reached the per-account maximum of ${cap} ${noun} on this server, as an account of its own. Close one (DELETE /mcp) or retry shortly.`;
+}
+const always = () => true;
 /** Whether a POST body holds a JSON-RPC request, which is what opens a stream. */
 function carriesRequest(body) {
     const isRequest = (m) => typeof m === 'object' && m !== null && 'method' in m && 'id' in m;