toolroll 0.9.44 → 0.9.46

package/dist/request-budget.js

@@ -0,0 +1,227 @@
+export const REQUEST_BUDGET_SCHEMA = `
+CREATE TABLE IF NOT EXISTS request_budget_limit (
+  target          TEXT PRIMARY KEY CHECK (target = '*' OR (length(target) = 12 AND target NOT GLOB '*[^0-9a-f]*')),
+  read_per_minute INTEGER CHECK (read_per_minute IS NULL OR read_per_minute BETWEEN 1 AND 600),
+  act_per_minute  INTEGER CHECK (act_per_minute IS NULL OR act_per_minute BETWEEN 1 AND 600),
+  per_day         INTEGER CHECK (per_day IS NULL OR per_day BETWEEN 1 AND 100000),
+  set_by          TEXT NOT NULL,
+  set_at          TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS request_budget_usage (
+  token_id  TEXT PRIMARY KEY,
+  minute    TEXT NOT NULL,
+  day       TEXT NOT NULL,
+  noted     TEXT NOT NULL,
+  saved_at  INTEGER NOT NULL
+);
+`;
+export const REQUEST_BUDGET_DEFAULTS = Object.freeze({ read: 120, act: 30, day: 10_000 });
+export const PER_MINUTE_MAX = 600;
+export const PER_DAY_MAX = 100_000;
+export const TRACKED_TOKENS = 1024;
+export const FLUSH_MS = 5_000;
+const MINUTE = 60_000, DAY = 86_400_000;
+/** The words for a 429, in one line. */
+export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : "act requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
+/** A limit typed into a form: a whole number within bounds, "" for none, or a problem. */
+export function parseLimit(raw, max) {
+    const text = raw.trim();
+    if (text === "")
+        return null;
+    if (!/^[0-9]{1,6}$/.test(text))
+        return { problem: `Limits are whole numbers from 1 to ${max.toLocaleString("en-US")}.` };
+    const value = Number(text);
+    return value >= 1 && value <= max ? value : { problem: `Limits are whole numbers from 1 to ${max.toLocaleString("en-US")}.` };
+}
+const within = (value, max) => {
+    if (value === null || value === undefined)
+        return null;
+    const n = Number(value);
+    if (!Number.isSafeInteger(n) || n < 1 || n > max)
+        throw new Error("request budget: a saved limit is out of bounds");
+    return n;
+};
+function readOverride(db, target) {
+    const row = db.prepare("SELECT read_per_minute, act_per_minute, per_day FROM request_budget_limit WHERE target = ?").get(target);
+    if (row === undefined)
+        return null;
+    return { readPerMinute: within(row["read_per_minute"], PER_MINUTE_MAX), actPerMinute: within(row["act_per_minute"], PER_MINUTE_MAX), perDay: within(row["per_day"], PER_DAY_MAX) };
+}
+/** Every override: the installation's under "*", each token's under its id. */
+export function limitOverrides(db) {
+    const out = new Map();
+    for (const row of db.prepare("SELECT target FROM request_budget_limit ORDER BY target").all()) {
+        const target = String(row["target"]);
+        out.set(target, readOverride(db, target));
+    }
+    return out;
+}
+/** Token override, then the installation's, then the default — per limit. */
+export function effectiveLimits(db, tokenId, access) {
+    const token = readOverride(db, tokenId), installation = readOverride(db, "*");
+    const pick = (of, fallback) => (token === null ? null : of(token)) ?? (installation === null ? null : of(installation)) ?? fallback;
+    const minute = (one) => access === "read" ? one.readPerMinute : one.actPerMinute;
+    const perMinute = pick(minute, REQUEST_BUDGET_DEFAULTS[access]), perDay = pick(one => one.perDay, REQUEST_BUDGET_DEFAULTS.day);
+    return { perMinute, perDay, overridden: perMinute !== REQUEST_BUDGET_DEFAULTS[access] || perDay !== REQUEST_BUDGET_DEFAULTS.day };
+}
+/** Set (or, all null, clear) an override, with the change in the policy ledger. The caller checks who may. */
+export function setLimitOverride(store, target, next, by, now) {
+    const db = store.handle;
+    if (target !== "*" && !/^[0-9a-f]{12}$/.test(target))
+        throw new Error("request budget: unknown target");
+    within(next.readPerMinute, PER_MINUTE_MAX);
+    within(next.actPerMinute, PER_MINUTE_MAX);
+    within(next.perDay, PER_DAY_MAX);
+    const before = readOverride(db, target);
+    const cleared = next.readPerMinute === null && next.actPerMinute === null && next.perDay === null;
+    if (cleared)
+        db.prepare("DELETE FROM request_budget_limit WHERE target = ?").run(target);
+    else
+        db.prepare(`INSERT INTO request_budget_limit (target, read_per_minute, act_per_minute, per_day, set_by, set_at) VALUES (?, ?, ?, ?, ?, ?)
+    ON CONFLICT(target) DO UPDATE SET read_per_minute = excluded.read_per_minute, act_per_minute = excluded.act_per_minute, per_day = excluded.per_day, set_by = excluded.set_by, set_at = excluded.set_at`)
+            .run(target, next.readPerMinute, next.actPerMinute, next.perDay, by, now.toISOString());
+    const after = cleared ? null : next;
+    const words = (one) => one === null ? "defaults" : [one.readPerMinute === null ? null : `read ${one.readPerMinute}/min`, one.actPerMinute === null ? null : `act ${one.actPerMinute}/min`, one.perDay === null ? null : `${one.perDay}/day`].filter(Boolean).join(", ");
+    const name = target === "*" ? "installation" : `token ${store.apiTokenSecret(target)?.row.name ?? target}`;
+    store.recordAction({ at: now.toISOString(), actor: by, repo: null, taskId: null, runId: null, action: "request limits changed", outcome: "changed", source: "policy", detail: `${name}: ${words(before)} → ${words(after)}` });
+    return { before, after };
+}
+const finiteInts = (value, max) => Array.isArray(value) && value.length <= max && value.every(one => Number.isSafeInteger(one) && one >= 0);
+function prune(usage, now) {
+    let drop = 0;
+    while (drop < usage.minute.length && usage.minute[drop] <= now - MINUTE)
+        drop++;
+    if (drop > 0) {
+        usage.minute.splice(0, drop);
+        usage.dirty = true;
+    }
+    for (const at of usage.day.keys())
+        if ((at + 1) * MINUTE + DAY <= now) {
+            usage.day.delete(at);
+            usage.dirty = true;
+        }
+}
+/** One per server: both routes share it, so a token's allowance is never doubled. */
+export class RequestBudget {
+    store;
+    clock;
+    tracked;
+    flushMs;
+    usage = new Map();
+    lastFlush;
+    constructor(options) {
+        this.store = options.store;
+        this.clock = options.clock ?? Date.now;
+        this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
+        this.flushMs = options.flushMs ?? FLUSH_MS;
+        this.lastFlush = this.clock();
+    }
+    /** How many tokens are tracked in memory now (never more than `tracked`). */
+    get size() { return this.usage.size; }
+    /**
+     * Admit one request by an authenticated token, or say why not. Called once per HTTP request, before its body is
+     * read. Anything unreadable refuses with 503 and nothing runs.
+     */
+    admit(tokenId, route) {
+        try {
+            const now = this.clock();
+            const token = this.store.apiTokenSecret(tokenId)?.row;
+            if (token === undefined)
+                return { ok: false, status: 503 };
+            const limits = effectiveLimits(this.store.handle, token.id, token.access);
+            const usage = this.load(token.id, now);
+            prune(usage, now);
+            let wait = 0, limit = null;
+            if (usage.minute.length >= limits.perMinute) {
+                wait = usage.minute[usage.minute.length - limits.perMinute] + MINUTE - now;
+                limit = token.access === "read" ? "read-per-minute" : "act-per-minute";
+            }
+            let total = 0;
+            for (const count of usage.day.values())
+                total += count;
+            if (total >= limits.perDay) {
+                let freed = 0;
+                for (const at of [...usage.day.keys()].sort((a, b) => a - b)) {
+                    freed += usage.day.get(at);
+                    if (total - freed < limits.perDay) {
+                        const until = (at + 1) * MINUTE + DAY - now;
+                        if (until > wait || limit === null) {
+                            wait = until;
+                            limit = "per-day";
+                        }
+                        break;
+                    }
+                }
+            }
+            if (limit !== null) {
+                const retryAfter = Math.max(1, Math.ceil(wait / 1000));
+                const window = limit === "per-day" ? "day" : "minute";
+                // Once per exhausted window: the marker lasts until the window has room again, and is saved with the entry.
+                if (usage.noted[window] <= now) {
+                    usage.noted[window] = now + retryAfter * 1000;
+                    usage.dirty = true;
+                    this.save(token.id, usage, now);
+                    this.store.recordAction({ at: new Date(now).toISOString(), actor: token.account, repo: null, taskId: null, runId: null, action: "remote request limit reached", outcome: "refused", source: route, detail: `token ${token.name}: ${limit}` });
+                }
+                return { ok: false, status: 429, limit, retryAfter };
+            }
+            usage.minute.push(now);
+            if (usage.minute.length > PER_MINUTE_MAX)
+                usage.minute.splice(0, usage.minute.length - PER_MINUTE_MAX);
+            const at = Math.floor(now / MINUTE);
+            usage.day.set(at, (usage.day.get(at) ?? 0) + 1);
+            usage.dirty = true;
+            if (now - this.lastFlush >= this.flushMs)
+                this.flush();
+            return { ok: true };
+        }
+        catch {
+            return { ok: false, status: 503 };
+        }
+    }
+    /** Save every changed entry. A server calls this on a timer and when it closes. */
+    flush() {
+        const now = this.clock();
+        this.lastFlush = now;
+        for (const [id, usage] of this.usage)
+            if (usage.dirty)
+                this.save(id, usage, now);
+        // Saved rows whose every count has expired are no use to anyone.
+        this.store.handle.prepare("DELETE FROM request_budget_usage WHERE saved_at <= ?").run(now - DAY - MINUTE);
+    }
+    save(id, usage, now) {
+        this.store.handle.prepare(`INSERT INTO request_budget_usage (token_id, minute, day, noted, saved_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(token_id) DO UPDATE SET minute = excluded.minute, day = excluded.day, noted = excluded.noted, saved_at = excluded.saved_at`)
+            .run(id, JSON.stringify(usage.minute), JSON.stringify([...usage.day]), JSON.stringify(usage.noted), now);
+        usage.dirty = false;
+    }
+    /** The tracked entry (now the most recently used), from memory or as last saved; the least recently used is saved and let go. */
+    load(id, now) {
+        let usage = this.usage.get(id);
+        if (usage !== undefined) {
+            this.usage.delete(id);
+            this.usage.set(id, usage);
+            return usage;
+        }
+        const row = this.store.handle.prepare("SELECT minute, day, noted FROM request_budget_usage WHERE token_id = ?").get(id);
+        if (row === undefined)
+            usage = { minute: [], day: new Map(), noted: { minute: 0, day: 0 }, dirty: false };
+        else {
+            const minute = JSON.parse(String(row["minute"])), day = JSON.parse(String(row["day"])), noted = JSON.parse(String(row["noted"]));
+            if (!finiteInts(minute, PER_MINUTE_MAX) || !Array.isArray(day) || day.length > 2 * DAY / MINUTE || !day.every(pair => finiteInts(pair, 2) && pair.length === 2)
+                || noted === null || typeof noted !== "object" || !finiteInts([noted["minute"], noted["day"]], 2)) {
+                throw new Error("request budget: saved usage is unreadable");
+            }
+            const kept = noted;
+            usage = { minute: [...minute].sort((a, b) => a - b), day: new Map(day), noted: { minute: kept.minute, day: kept.day }, dirty: false };
+        }
+        this.usage.set(id, usage);
+        while (this.usage.size > this.tracked) {
+            const [oldest, entry] = this.usage.entries().next().value;
+            if (entry.dirty)
+                this.save(oldest, entry, now);
+            this.usage.delete(oldest);
+        }
+        return usage;
+    }
+}

package/dist/serve.d.ts

@@ -41,13 +41,16 @@ export type ServeOptions = {
      * (arc 3 finding 2/16): EXACTLY an origin — no path, query, credentials.
      * The one trust anchor for secure-context features: it joins the allowed
      * hosts, its origin authorizes POSTs, cookies turn Secure, and the
-     * install/push cards light up. X-Forwarded-* is never consulted.
+     * install/push cards light up. X-Forwarded-* is consulted only from a
+     * loopback peer, the same-host proxy (public-access.ts).
      */
     publicUrl?: string;
     /** Tests: the shared command boundary `POST /api/cli` runs (default: operate.ts's runOperateAs). */
     cliRunner?: RunOperateAs;
     /** Tests: remote command metadata until the shared contract declares it. */
     cliModeOf?: CliHttpOptions['modeOf'];
+    /** Tests: the clock request budgets for API tokens count by (request-budget.ts). */
+    requestBudgetClock?: () => number;
     /** Where repos.json lives — every enrollment locks exactly this file. */
     registryPath?: string;
     /** This console fronts an `up` process: onboarding copy says how to watch. */

package/dist/serve.js

@@ -262,9 +262,15 @@ import { LIMITS_CSS, limitsHtml, limitsView } from "./limits-ui.js";
 import { budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, teammateNames as teammateNamesOf, usd as spendUsd } from "./spend.js";
 import { targetOf } from "./monitoring.js";
 import { SSO_CSS, ssoSettingsHtml } from "./sso-ui.js";
-import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS } from "./api-tokens.js";
+import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS, tokenLive, tokenProjects } from "./api-tokens.js";
 import { createMcpHttp } from "./mcp-http.js";
+import { FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, parseLimit, PER_DAY_MAX as REQUEST_BUDGET_PER_DAY_MAX, PER_MINUTE_MAX as REQUEST_BUDGET_PER_MINUTE_MAX, RequestBudget, setLimitOverride } from "./request-budget.js";
+import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, transportOf } from "./public-access.js";
+import { createOAuthHttp, oauthTokenAllowed, resourceMetadataUrl } from "./mcp-oauth.js";
 import { CREDENTIALS_CSS, credentialsHtml, tokenShownHtml } from "./credentials-ui.js";
+import { REQUEST_LIMITS_CSS, requestLimitsHtml, tokenLimitWords } from "./request-budget-ui.js";
+import { PEOPLE_AUDIT_CSS, personAuditHtml, personHref } from "./people-audit-ui.js";
+import { cursorOf as auditCursorOf, remoteAudit } from "./remote-audit.js";
 import { logEvent } from "./log.js";
 import { modeTermsFromJson, modeWords, presetTerms, modeTermsJson, modeDigestOf, MODE_MAX_DAYS } from "./modes.js";
 import { PROVIDER_KEY_ENV, SUBSCRIPTION_CAPABLE, clearProviderKey, readProviderKey, keyStatus, plausibleKey, readAuthMode, readAuthModeStrict, saveProviderKey, setAuthMode, verifyProviderKey, verdictWords } from "./keys.js";
@@ -535,7 +541,7 @@ export function createDecisionServer(options) {
      * the trusted proxy itself appended; earlier entries are client-typed). */
     function joinSourceOf(request) {
         const peer = request.socket.remoteAddress ?? "unknown";
-        const loopback = peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+        const loopback = LOOPBACK_PEERS.has(peer);
         if (!loopback)
             return peer;
         const forwarded = request.headers["x-forwarded-for"];
@@ -581,7 +587,7 @@ export function createDecisionServer(options) {
     /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no forwarding proxy. */
     const fromThisComputer = (request) => {
         const peer = request.socket.remoteAddress ?? "";
-        const loopback = peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+        const loopback = LOOPBACK_PEERS.has(peer);
         return loopback && request.headers["x-forwarded-for"] === undefined && request.headers["forwarded"] === undefined
             && /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
     };
@@ -797,16 +803,19 @@ export function createDecisionServer(options) {
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         }, cursor: team.cursor, streams: teamStreams,
     });
+    // v112: one request budget per server for person API tokens, shared by /api/cli and /mcp (request-budget.ts).
+    const requestBudget = new RequestBudget({ store, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
     // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
     const cliEndpoint = (request, response) => handleCliHttp(request, response, {
+        admit: principal => requestBudget.admit(principal.tokenId, "api"),
         authenticate: request => {
-            const who = identify(request, false);
+            const who = identify(request, false, true);
             const id = parseApiToken(/^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1] ?? "")?.id;
             const row = id === undefined ? undefined : store.apiTokenSecret(id)?.row;
             const account = who === null ? null : store.accountOf(who.name);
             if (who?.via !== "bearer" || who.token === undefined || row === undefined || row.account !== who.name || account === null || account.revokedAt !== null)
                 return null;
-            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: account.projects === null ? null : [...account.projects] };
+            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: tokenProjects(account.projects, row.projects) };
         },
         run: async () => options.cliRunner ?? (await import("./operate.js")).runOperateAs ?? null,
         modeOf: options.cliModeOf,
@@ -876,6 +885,15 @@ export function createDecisionServer(options) {
         timer.unref?.();
         server.on("close", () => clearInterval(timer));
     }
+    {
+        const flushBudget = () => { try {
+            requestBudget.flush();
+        }
+        catch { /* the next admit refuses if the database is unwell */ } };
+        const timer = setInterval(flushBudget, REQUEST_BUDGET_FLUSH_MS);
+        timer.unref?.();
+        server.on("close", () => { clearInterval(timer); flushBudget(); });
+    }
     const servedPort = () => {
         const address = server.address();
         return typeof address === "object" && address !== null ? address.port : null;
@@ -1237,6 +1255,17 @@ export function createDecisionServer(options) {
         if (!allowedHost(request.headers.host)) {
             return respond(response, 421, "text/html; charset=utf-8", wrongHostPage(wrongHost(request.headers.host)));
         }
+        // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
+        // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
+        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: joinSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
+        const hsts = hstsFor(publicOrigin?.host ?? null, request.headers.host, transport);
+        if (hsts !== null)
+            response.setHeader("Strict-Transport-Security", hsts);
+        const insecure = plainHttpRefusal(transport, hook.pathname, request.headers.authorization);
+        if (insecure !== null) {
+            request.resume();
+            return respond(response, 403, "text/plain; charset=utf-8", insecure);
+        }
         const url = new URL(request.url ?? "/", "http://placeholder");
         // A token in a URL is a token in history, logs, and referers. Refused
         // outright rather than ignored, so nobody learns the habit works.
@@ -1246,6 +1275,9 @@ export function createDecisionServer(options) {
         // The MCP gateway over HTTP (mcp-http.ts): coordinators and people's own API tokens, after the Host check.
         if (url.pathname === "/mcp")
             return mcpHttp(request, response);
+        // MCP sign-in (mcp-oauth.ts): its discovery documents, client registration, consent and tokens.
+        if (await oauthHttp(request, response, url))
+            return;
         // Back from Google's consent screen (v89). The session cookie is SameSite=Strict and stays behind on
         // a return from another site: the visit's one-time state (made by a signed-in approver) is the proof.
         if (url.pathname === GOOGLE_CALLBACK && request.method === "GET")
@@ -2752,11 +2784,26 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("mode", [`<h1>Operating mode</h1><p>Authorize this project's automatic approvals once, for up to ${MODE_MAX_DAYS} days. Select the touchpoints below; the signature covers the exact choices. Existing modes keep their original terms.</p><p class="meta">Scope changes, agent questions, and requested revisions still require your attention. Automatic merging also needs a publication grant.</p>`, current, signForm].join("\n"), { chrome: chromeFor(project, "mode") }));
         }
         if (url.pathname === "/people") {
+            // People → a person: their API tokens and remote activity (people-audit-ui.ts). An approver may open anyone, within
+            // their projects; anyone else only themselves. Another person reads exactly like nobody.
+            const person = url.searchParams.get("person");
+            if (person !== null) {
+                const token = (url.searchParams.get("token-name") ?? "").slice(0, 60) || null, before = url.searchParams.get("before");
+                const cursor = before === null ? null : auditCursorOf(before);
+                if (before !== null && cursor === null)
+                    return refuse(response, who, 400, "Invalid activity cursor.", "/people");
+                const page = who.role === "approver" || person === who.name
+                    ? remoteAudit(store, { self: who.name, everyone: who.role === "approver", repos: admissionList(), unplaced: store.isInstanceOperator(who.name) }, { person, token, source: null, since: null }, { before: cursor })
+                    : null;
+                if (page === null || !page.ok)
+                    return refuse(response, who, 404, "No such person.", "/people");
+                return sendScreen(response, 200, screen("people", personAuditHtml({ name: person, tokens: store.apiTokens(person), actions: page.actions, token, nextCursor: page.nextCursor, now }), { chrome: chromeFor(project, "people") }));
+            }
             // Approvers see everyone (D7's ceiling: every fact already passed
             // the process admission); a viewer sees exactly themselves (U3).
             if (restricted()) {
                 const projects = admissionList() ?? [];
-                return sendScreen(response, 200, screen("people", `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => `<li>${escape(projectName(repo))}</li>`).join("")}</ul><p class="meta">An instance operator manages invitations and project access.</p>`, { chrome: chromeFor(project, "people") }));
+                return sendScreen(response, 200, screen("people", `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => `<li>${escape(projectName(repo))}</li>`).join("")}</ul><p class="meta">An instance operator manages invitations and project access.</p><p><a href="${escape(personHref(who.name))}">Your remote activity</a></p>`, { chrome: chromeFor(project, "people") }));
             }
             const approverView = store.isInstanceOperator(who.name);
             const accounts = store.accountFacts().filter(one => approverView || one.name === who.name);
@@ -2787,6 +2834,7 @@ export function createDecisionServer(options) {
                     `<p class="meta">${one.projects === null ? "All projects" : one.projects.length === 0 ? "No project access" : one.projects.map(repo => escape(projectName(repo))).join(", ")}</p>`,
                     approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
                     `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
+                    `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
                     attended.length === 0
                         ? ""
                         : `<p class="row">watching now: ${attended.map(session => `<a href="/t/${escape(session.taskId)}">${escape(session.taskId)}</a>`).join(", ")}</p>`,
@@ -3065,7 +3113,7 @@ export function createDecisionServer(options) {
                 if (tokenId === null)
                     return true;
                 const token = store.apiTokenSecret(tokenId)?.row;
-                return token !== undefined && token.revokedAt === null && Date.parse(token.expiresAt) > Date.now();
+                return token !== undefined && tokenLive(token, Date.now());
             };
             // The whole walk it starts from is shared by exports in the same minute; a reader who stops reading for a minute is let go.
             const pieces = ledgerExportChunks(store, { from, to }, { repos: access.repos, instance: store.isInstanceOperator(who.name) }, access, who.name, now, evidenceRoot);
@@ -4034,7 +4082,8 @@ export function createDecisionServer(options) {
             const everyone = url.searchParams.get("everyone") === "1" && store.isInstanceOperator(who.name);
             const here = sessions.hashOf(who.session);
             const view = { who: who.name, everyone, canSeeEveryone: store.isInstanceOperator(who.name), now: Date.now(),
-                sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name) };
+                sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name),
+                limits: { note: tokenLimitWords.bind(null, store.handle), section: store.isInstanceOperator(who.name) ? requestLimitsHtml(store.handle, store.apiTokens(null), who.session.csrf, Date.now()) : "" } };
             return sendScreen(response, 200, screen("Sessions & tokens", `<p><a href="/settings">Settings</a></p><h1>Sessions &amp; tokens</h1>${credentialsHtml(view, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
         // Settings → Flows: the starter flows, each switched on with one yes. ?starter= marks the one a task's
@@ -7472,6 +7521,31 @@ export function createDecisionServer(options) {
             store.setApprovalRules(repo, next, who.name, now);
             return back("said", `Saved. ${rulesSummary(next)}`);
         }
+        // v112: request limits for API tokens (request-budget.ts). An instance operator, in a browser, with their password;
+        // never over /api/cli or /mcp (a token never reaches a console form).
+        if (url.pathname === "/settings/request-limits") {
+            const body = readForm(posted, CONSOLE_FORMS.requestLimits);
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "An instance operator sets request limits.", "/settings/sessions");
+            const back = (key, words) => redirect(response, `/settings/sessions?${key}=${encodeURIComponent(words)}`);
+            const target = body.get("target") ?? "";
+            const token = target === "*" ? null : store.apiTokens(null).find(one => one.id === target && one.revokedAt === null) ?? null;
+            if (target !== "*" && token === null)
+                return back("problem", "That token is no longer live. Nothing changed.");
+            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+                return back("problem", "Enter your Toolroll password to change request limits.");
+            const read = (name) => parseLimit(body.get(name) ?? "", name === "per-day" ? REQUEST_BUDGET_PER_DAY_MAX : REQUEST_BUDGET_PER_MINUTE_MAX);
+            const clear = body.get("action") === "clear";
+            const fields = clear ? { readPerMinute: null, actPerMinute: null, perDay: null }
+                : token === null ? { readPerMinute: read("read-per-minute"), actPerMinute: read("act-per-minute"), perDay: read("per-day") }
+                    : { readPerMinute: token.access === "read" ? read("per-minute") : null, actPerMinute: token.access === "act" ? read("per-minute") : null, perDay: read("per-day") };
+            const problem = Object.values(fields).find((value) => value !== null && typeof value === "object");
+            if (problem !== undefined)
+                return back("problem", `${problem.problem} Nothing changed.`);
+            setLimitOverride(store, target, fields, who.name, now);
+            const label = token === null ? "Everyone's tokens" : token.name;
+            return back("said", clear || Object.values(fields).every(value => value === null) ? `${label}: default limits.` : `${label}: limits saved.`);
+        }
         if (url.pathname === "/settings/sessions") {
             const body = readForm(posted, CONSOLE_FORMS.sessions);
             if (who.via !== "cookie")
@@ -11780,10 +11854,32 @@ export function createDecisionServer(options) {
             approved: (() => { const scope = store.getScope(taskId); return scope !== null && approvalOf(scope).approved; })(),
         }));
     }
-    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request) !== null,
+    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
+        resourceMetadata: request => { const origin = consoleOrigin(request.headers.host); return origin === null ? null : resourceMetadataUrl(origin); },
         enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
+    // MCP sign-in: the console's own sign-in and step-up, a same-site consent form, and the person's current projects.
+    const oauthHttp = createOAuthHttp({ store, clock,
+        originOf: request => consoleOrigin(request.headers.host),
+        requesterKey: joinSourceOf,
+        session: request => {
+            const who = identify(request, false);
+            if (who === null || who.via !== "cookie")
+                return null;
+            return { name: who.name, role: who.role, csrf: who.session.csrf,
+                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider", fresh: Date.now() - who.session.sso.at < SSO_FRESH_MS } };
+        },
+        sameSite: request => {
+            const origin = request.headers.origin, referer = request.headers.referer;
+            const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
+            return named !== null && allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]);
+        },
+        // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
+        // grant (their role, their projects) is checked beside it.
+        confirm: (session, typed) => typed === "" ? session.sso?.fresh === true : authenticateAccount(store, session.name, typed).ok,
+        projectsFor: account => store.knownRepos().filter(repo => store.accountCanAccess(account, repo)).sort(),
+    });
     // ---- identity ------------------------------------------------------------
-    function identify(request, touch = true) {
+    function identify(request, touch = true, limited = false) {
         // v101: an API token. Wrong ones spend the address's tries like a wrong password; expired or revoked ones, and a removed account's, name no one.
         const presented = /^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1];
         if (presented !== undefined) {
@@ -11796,11 +11892,18 @@ export function createDecisionServer(options) {
                 signInBudget.failed(source, at);
                 return null;
             }
-            if (kept.row.revokedAt !== null || Date.parse(kept.row.expiresAt) <= at)
+            if (!tokenLive(kept.row, at))
+                return null;
+            // v111: a token limited to some projects signs in only where its limit travels with it (the remote CLI and MCP,
+            // through Principal.projects); the console's own pages and APIs check the account's access alone, so it is refused there.
+            if (kept.row.projects !== null && !limited)
                 return null;
             const account = store.accountOf(kept.row.account);
             if (account === null || account.revokedAt !== null)
                 return null;
+            // v113: an MCP sign-in's token works only at /mcp, while its access secret is fresh (mcp-oauth.ts).
+            if (!oauthTokenAllowed(store, kept.row.id, new URL(request.url ?? "/", "http://placeholder").pathname, new Date(at)))
+                return null;
             store.touchApiToken(kept.row.id, new Date(at));
             return { name: kept.row.account, via: "bearer", role: kept.row.access === "read" ? "viewer" : account.role, token: kept.row.name };
         }
@@ -12395,6 +12498,10 @@ export function createDecisionServer(options) {
     const closeServer = server.close.bind(server);
     server.close = ((callback) => {
         leadClosing = true;
+        try {
+            requestBudget.flush();
+        }
+        catch { /* saved again on the close event when it can be */ }
         for (const stream of teamStreams)
             stream.end();
         teamStreams.clear();
@@ -16304,7 +16411,7 @@ const INBOX_TABS_CSS = '.inbox-tabs{display:inline-flex;gap:2px;max-width:100%;o
     '.inbox-ask{margin:18px 0 0}.inbox-ask>h2{display:flex;align-items:baseline;gap:8px;margin:0 0 4px;font-size:15px;font-weight:600}.inbox-ask>h2 .count{font:500 12px var(--so-mono,ui-monospace,monospace);font-variant-numeric:tabular-nums;color:var(--so-muted)}.inbox-ask h3{font-size:13px;font-weight:600;margin:12px 0 4px}' +
     '.inbox-unread{display:none;position:absolute;top:4px;right:3px;width:6px;height:6px;border-radius:50%;background:var(--so-signal)}' +
     '@media (max-width:760px){.inbox-tabs{display:flex;width:100%}.inbox-tabs a{flex:1;justify-content:center;min-height:44px;padding:0 6px}.inbox-unread{display:block}}';
-const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
+const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
 /**
  * The board's liveness: fetch this page's own fragment on a timer and swap
  * it in place — no flicker, no scroll reset, no long-lived stream to manage,
@@ -20132,7 +20239,7 @@ function safeReturn(raw) {
  * button can name. Nothing here is a second redirect framework: one
  * same-site path, or "/".
  */
-const LOGIN_RETURN_PAGES = /^\/(t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
+const LOGIN_RETURN_PAGES = /^\/(oauth\/authorize|t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
 function loginReturn(raw) {
     const safe = safeReturn(raw);
     if (safe === "/")