toolroll 0.9.45 → 0.9.46

package/dist/serve.js

@@ -262,9 +262,15 @@ import { LIMITS_CSS, limitsHtml, limitsView } from "./limits-ui.js";
 import { budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, teammateNames as teammateNamesOf, usd as spendUsd } from "./spend.js";
 import { targetOf } from "./monitoring.js";
 import { SSO_CSS, ssoSettingsHtml } from "./sso-ui.js";
-import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS } from "./api-tokens.js";
+import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS, tokenLive, tokenProjects } from "./api-tokens.js";
 import { createMcpHttp } from "./mcp-http.js";
+import { FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, parseLimit, PER_DAY_MAX as REQUEST_BUDGET_PER_DAY_MAX, PER_MINUTE_MAX as REQUEST_BUDGET_PER_MINUTE_MAX, RequestBudget, setLimitOverride } from "./request-budget.js";
+import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, transportOf } from "./public-access.js";
+import { createOAuthHttp, oauthTokenAllowed, resourceMetadataUrl } from "./mcp-oauth.js";
 import { CREDENTIALS_CSS, credentialsHtml, tokenShownHtml } from "./credentials-ui.js";
+import { REQUEST_LIMITS_CSS, requestLimitsHtml, tokenLimitWords } from "./request-budget-ui.js";
+import { PEOPLE_AUDIT_CSS, personAuditHtml, personHref } from "./people-audit-ui.js";
+import { cursorOf as auditCursorOf, remoteAudit } from "./remote-audit.js";
 import { logEvent } from "./log.js";
 import { modeTermsFromJson, modeWords, presetTerms, modeTermsJson, modeDigestOf, MODE_MAX_DAYS } from "./modes.js";
 import { PROVIDER_KEY_ENV, SUBSCRIPTION_CAPABLE, clearProviderKey, readProviderKey, keyStatus, plausibleKey, readAuthMode, readAuthModeStrict, saveProviderKey, setAuthMode, verifyProviderKey, verdictWords } from "./keys.js";
@@ -535,7 +541,7 @@ export function createDecisionServer(options) {
      * the trusted proxy itself appended; earlier entries are client-typed). */
     function joinSourceOf(request) {
         const peer = request.socket.remoteAddress ?? "unknown";
-        const loopback = peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+        const loopback = LOOPBACK_PEERS.has(peer);
         if (!loopback)
             return peer;
         const forwarded = request.headers["x-forwarded-for"];
@@ -581,7 +587,7 @@ export function createDecisionServer(options) {
     /** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no forwarding proxy. */
     const fromThisComputer = (request) => {
         const peer = request.socket.remoteAddress ?? "";
-        const loopback = peer === "127.0.0.1" || peer === "::1" || peer === "::ffff:127.0.0.1";
+        const loopback = LOOPBACK_PEERS.has(peer);
         return loopback && request.headers["x-forwarded-for"] === undefined && request.headers["forwarded"] === undefined
             && /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(request.headers.host ?? "");
     };
@@ -797,16 +803,19 @@ export function createDecisionServer(options) {
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         }, cursor: team.cursor, streams: teamStreams,
     });
+    // v112: one request budget per server for person API tokens, shared by /api/cli and /mcp (request-budget.ts).
+    const requestBudget = new RequestBudget({ store, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
     // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
     const cliEndpoint = (request, response) => handleCliHttp(request, response, {
+        admit: principal => requestBudget.admit(principal.tokenId, "api"),
         authenticate: request => {
-            const who = identify(request, false);
+            const who = identify(request, false, true);
             const id = parseApiToken(/^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1] ?? "")?.id;
             const row = id === undefined ? undefined : store.apiTokenSecret(id)?.row;
             const account = who === null ? null : store.accountOf(who.name);
             if (who?.via !== "bearer" || who.token === undefined || row === undefined || row.account !== who.name || account === null || account.revokedAt !== null)
                 return null;
-            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: account.projects === null ? null : [...account.projects] };
+            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: tokenProjects(account.projects, row.projects) };
         },
         run: async () => options.cliRunner ?? (await import("./operate.js")).runOperateAs ?? null,
         modeOf: options.cliModeOf,
@@ -876,6 +885,15 @@ export function createDecisionServer(options) {
         timer.unref?.();
         server.on("close", () => clearInterval(timer));
     }
+    {
+        const flushBudget = () => { try {
+            requestBudget.flush();
+        }
+        catch { /* the next admit refuses if the database is unwell */ } };
+        const timer = setInterval(flushBudget, REQUEST_BUDGET_FLUSH_MS);
+        timer.unref?.();
+        server.on("close", () => { clearInterval(timer); flushBudget(); });
+    }
     const servedPort = () => {
         const address = server.address();
         return typeof address === "object" && address !== null ? address.port : null;
@@ -1237,6 +1255,17 @@ export function createDecisionServer(options) {
         if (!allowedHost(request.headers.host)) {
             return respond(response, 421, "text/html; charset=utf-8", wrongHostPage(wrongHost(request.headers.host)));
         }
+        // A real domain (public-access.ts): HSTS for the public https host reached over HTTPS, and no API token over
+        // plain HTTP from outside this computer and the tailnet — refused before anything reads or checks it.
+        const transport = transportOf({ peer: request.socket.remoteAddress, joinSource: joinSourceOf(request), forwardedProto: request.headers["x-forwarded-proto"], forwarded: request.headers["forwarded"] });
+        const hsts = hstsFor(publicOrigin?.host ?? null, request.headers.host, transport);
+        if (hsts !== null)
+            response.setHeader("Strict-Transport-Security", hsts);
+        const insecure = plainHttpRefusal(transport, hook.pathname, request.headers.authorization);
+        if (insecure !== null) {
+            request.resume();
+            return respond(response, 403, "text/plain; charset=utf-8", insecure);
+        }
         const url = new URL(request.url ?? "/", "http://placeholder");
         // A token in a URL is a token in history, logs, and referers. Refused
         // outright rather than ignored, so nobody learns the habit works.
@@ -1246,6 +1275,9 @@ export function createDecisionServer(options) {
         // The MCP gateway over HTTP (mcp-http.ts): coordinators and people's own API tokens, after the Host check.
         if (url.pathname === "/mcp")
             return mcpHttp(request, response);
+        // MCP sign-in (mcp-oauth.ts): its discovery documents, client registration, consent and tokens.
+        if (await oauthHttp(request, response, url))
+            return;
         // Back from Google's consent screen (v89). The session cookie is SameSite=Strict and stays behind on
         // a return from another site: the visit's one-time state (made by a signed-in approver) is the proof.
         if (url.pathname === GOOGLE_CALLBACK && request.method === "GET")
@@ -2752,11 +2784,26 @@ export function createDecisionServer(options) {
             return sendScreen(response, 200, screen("mode", [`<h1>Operating mode</h1><p>Authorize this project's automatic approvals once, for up to ${MODE_MAX_DAYS} days. Select the touchpoints below; the signature covers the exact choices. Existing modes keep their original terms.</p><p class="meta">Scope changes, agent questions, and requested revisions still require your attention. Automatic merging also needs a publication grant.</p>`, current, signForm].join("\n"), { chrome: chromeFor(project, "mode") }));
         }
         if (url.pathname === "/people") {
+            // People → a person: their API tokens and remote activity (people-audit-ui.ts). An approver may open anyone, within
+            // their projects; anyone else only themselves. Another person reads exactly like nobody.
+            const person = url.searchParams.get("person");
+            if (person !== null) {
+                const token = (url.searchParams.get("token-name") ?? "").slice(0, 60) || null, before = url.searchParams.get("before");
+                const cursor = before === null ? null : auditCursorOf(before);
+                if (before !== null && cursor === null)
+                    return refuse(response, who, 400, "Invalid activity cursor.", "/people");
+                const page = who.role === "approver" || person === who.name
+                    ? remoteAudit(store, { self: who.name, everyone: who.role === "approver", repos: admissionList(), unplaced: store.isInstanceOperator(who.name) }, { person, token, source: null, since: null }, { before: cursor })
+                    : null;
+                if (page === null || !page.ok)
+                    return refuse(response, who, 404, "No such person.", "/people");
+                return sendScreen(response, 200, screen("people", personAuditHtml({ name: person, tokens: store.apiTokens(person), actions: page.actions, token, nextCursor: page.nextCursor, now }), { chrome: chromeFor(project, "people") }));
+            }
             // Approvers see everyone (D7's ceiling: every fact already passed
             // the process admission); a viewer sees exactly themselves (U3).
             if (restricted()) {
                 const projects = admissionList() ?? [];
-                return sendScreen(response, 200, screen("people", `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => `<li>${escape(projectName(repo))}</li>`).join("")}</ul><p class="meta">An instance operator manages invitations and project access.</p>`, { chrome: chromeFor(project, "people") }));
+                return sendScreen(response, 200, screen("people", `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => `<li>${escape(projectName(repo))}</li>`).join("")}</ul><p class="meta">An instance operator manages invitations and project access.</p><p><a href="${escape(personHref(who.name))}">Your remote activity</a></p>`, { chrome: chromeFor(project, "people") }));
             }
             const approverView = store.isInstanceOperator(who.name);
             const accounts = store.accountFacts().filter(one => approverView || one.name === who.name);
@@ -2787,6 +2834,7 @@ export function createDecisionServer(options) {
                     `<p class="meta">${one.projects === null ? "All projects" : one.projects.length === 0 ? "No project access" : one.projects.map(repo => escape(projectName(repo))).join(", ")}</p>`,
                     approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
                     `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
+                    `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
                     attended.length === 0
                         ? ""
                         : `<p class="row">watching now: ${attended.map(session => `<a href="/t/${escape(session.taskId)}">${escape(session.taskId)}</a>`).join(", ")}</p>`,
@@ -3065,7 +3113,7 @@ export function createDecisionServer(options) {
                 if (tokenId === null)
                     return true;
                 const token = store.apiTokenSecret(tokenId)?.row;
-                return token !== undefined && token.revokedAt === null && Date.parse(token.expiresAt) > Date.now();
+                return token !== undefined && tokenLive(token, Date.now());
             };
             // The whole walk it starts from is shared by exports in the same minute; a reader who stops reading for a minute is let go.
             const pieces = ledgerExportChunks(store, { from, to }, { repos: access.repos, instance: store.isInstanceOperator(who.name) }, access, who.name, now, evidenceRoot);
@@ -4034,7 +4082,8 @@ export function createDecisionServer(options) {
             const everyone = url.searchParams.get("everyone") === "1" && store.isInstanceOperator(who.name);
             const here = sessions.hashOf(who.session);
             const view = { who: who.name, everyone, canSeeEveryone: store.isInstanceOperator(who.name), now: Date.now(),
-                sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name) };
+                sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name),
+                limits: { note: tokenLimitWords.bind(null, store.handle), section: store.isInstanceOperator(who.name) ? requestLimitsHtml(store.handle, store.apiTokens(null), who.session.csrf, Date.now()) : "" } };
             return sendScreen(response, 200, screen("Sessions & tokens", `<p><a href="/settings">Settings</a></p><h1>Sessions &amp; tokens</h1>${credentialsHtml(view, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
         }
         // Settings → Flows: the starter flows, each switched on with one yes. ?starter= marks the one a task's
@@ -7472,6 +7521,31 @@ export function createDecisionServer(options) {
             store.setApprovalRules(repo, next, who.name, now);
             return back("said", `Saved. ${rulesSummary(next)}`);
         }
+        // v112: request limits for API tokens (request-budget.ts). An instance operator, in a browser, with their password;
+        // never over /api/cli or /mcp (a token never reaches a console form).
+        if (url.pathname === "/settings/request-limits") {
+            const body = readForm(posted, CONSOLE_FORMS.requestLimits);
+            if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
+                return refuse(response, who, 403, "An instance operator sets request limits.", "/settings/sessions");
+            const back = (key, words) => redirect(response, `/settings/sessions?${key}=${encodeURIComponent(words)}`);
+            const target = body.get("target") ?? "";
+            const token = target === "*" ? null : store.apiTokens(null).find(one => one.id === target && one.revokedAt === null) ?? null;
+            if (target !== "*" && token === null)
+                return back("problem", "That token is no longer live. Nothing changed.");
+            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+                return back("problem", "Enter your Toolroll password to change request limits.");
+            const read = (name) => parseLimit(body.get(name) ?? "", name === "per-day" ? REQUEST_BUDGET_PER_DAY_MAX : REQUEST_BUDGET_PER_MINUTE_MAX);
+            const clear = body.get("action") === "clear";
+            const fields = clear ? { readPerMinute: null, actPerMinute: null, perDay: null }
+                : token === null ? { readPerMinute: read("read-per-minute"), actPerMinute: read("act-per-minute"), perDay: read("per-day") }
+                    : { readPerMinute: token.access === "read" ? read("per-minute") : null, actPerMinute: token.access === "act" ? read("per-minute") : null, perDay: read("per-day") };
+            const problem = Object.values(fields).find((value) => value !== null && typeof value === "object");
+            if (problem !== undefined)
+                return back("problem", `${problem.problem} Nothing changed.`);
+            setLimitOverride(store, target, fields, who.name, now);
+            const label = token === null ? "Everyone's tokens" : token.name;
+            return back("said", clear || Object.values(fields).every(value => value === null) ? `${label}: default limits.` : `${label}: limits saved.`);
+        }
         if (url.pathname === "/settings/sessions") {
             const body = readForm(posted, CONSOLE_FORMS.sessions);
             if (who.via !== "cookie")
@@ -11780,10 +11854,32 @@ export function createDecisionServer(options) {
             approved: (() => { const scope = store.getScope(taskId); return scope !== null && approvalOf(scope).approved; })(),
         }));
     }
-    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request) !== null,
+    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
+        resourceMetadata: request => { const origin = consoleOrigin(request.headers.host); return origin === null ? null : resourceMetadataUrl(origin); },
         enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
+    // MCP sign-in: the console's own sign-in and step-up, a same-site consent form, and the person's current projects.
+    const oauthHttp = createOAuthHttp({ store, clock,
+        originOf: request => consoleOrigin(request.headers.host),
+        requesterKey: joinSourceOf,
+        session: request => {
+            const who = identify(request, false);
+            if (who === null || who.via !== "cookie")
+                return null;
+            return { name: who.name, role: who.role, csrf: who.session.csrf,
+                sso: who.session.sso === undefined ? null : { label: ssoSettings()?.label ?? "your identity provider", fresh: Date.now() - who.session.sso.at < SSO_FRESH_MS } };
+        },
+        sameSite: request => {
+            const origin = request.headers.origin, referer = request.headers.referer;
+            const named = typeof origin === "string" && origin !== "null" ? origin : typeof referer === "string" ? referer : null;
+            return named !== null && allowedHost(named.replace(/^https?:\/\//, "").split("/")[0]);
+        },
+        // The step-up for a credential: the person's password, or (empty) a fresh identity-provider check. What they may
+        // grant (their role, their projects) is checked beside it.
+        confirm: (session, typed) => typed === "" ? session.sso?.fresh === true : authenticateAccount(store, session.name, typed).ok,
+        projectsFor: account => store.knownRepos().filter(repo => store.accountCanAccess(account, repo)).sort(),
+    });
     // ---- identity ------------------------------------------------------------
-    function identify(request, touch = true) {
+    function identify(request, touch = true, limited = false) {
         // v101: an API token. Wrong ones spend the address's tries like a wrong password; expired or revoked ones, and a removed account's, name no one.
         const presented = /^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1];
         if (presented !== undefined) {
@@ -11796,11 +11892,18 @@ export function createDecisionServer(options) {
                 signInBudget.failed(source, at);
                 return null;
             }
-            if (kept.row.revokedAt !== null || Date.parse(kept.row.expiresAt) <= at)
+            if (!tokenLive(kept.row, at))
+                return null;
+            // v111: a token limited to some projects signs in only where its limit travels with it (the remote CLI and MCP,
+            // through Principal.projects); the console's own pages and APIs check the account's access alone, so it is refused there.
+            if (kept.row.projects !== null && !limited)
                 return null;
             const account = store.accountOf(kept.row.account);
             if (account === null || account.revokedAt !== null)
                 return null;
+            // v113: an MCP sign-in's token works only at /mcp, while its access secret is fresh (mcp-oauth.ts).
+            if (!oauthTokenAllowed(store, kept.row.id, new URL(request.url ?? "/", "http://placeholder").pathname, new Date(at)))
+                return null;
             store.touchApiToken(kept.row.id, new Date(at));
             return { name: kept.row.account, via: "bearer", role: kept.row.access === "read" ? "viewer" : account.role, token: kept.row.name };
         }
@@ -12395,6 +12498,10 @@ export function createDecisionServer(options) {
     const closeServer = server.close.bind(server);
     server.close = ((callback) => {
         leadClosing = true;
+        try {
+            requestBudget.flush();
+        }
+        catch { /* saved again on the close event when it can be */ }
         for (const stream of teamStreams)
             stream.end();
         teamStreams.clear();
@@ -16304,7 +16411,7 @@ const INBOX_TABS_CSS = '.inbox-tabs{display:inline-flex;gap:2px;max-width:100%;o
     '.inbox-ask{margin:18px 0 0}.inbox-ask>h2{display:flex;align-items:baseline;gap:8px;margin:0 0 4px;font-size:15px;font-weight:600}.inbox-ask>h2 .count{font:500 12px var(--so-mono,ui-monospace,monospace);font-variant-numeric:tabular-nums;color:var(--so-muted)}.inbox-ask h3{font-size:13px;font-weight:600;margin:12px 0 4px}' +
     '.inbox-unread{display:none;position:absolute;top:4px;right:3px;width:6px;height:6px;border-radius:50%;background:var(--so-signal)}' +
     '@media (max-width:760px){.inbox-tabs{display:flex;width:100%}.inbox-tabs a{flex:1;justify-content:center;min-height:44px;padding:0 6px}.inbox-unread{display:block}}';
-const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
+const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CSS + APPROVAL_RULES_CSS + SPEND_CSS + RETENTION_CSS + STORAGE_CSS + UPDATES_CSS + LIMITS_CSS + MONITORING_CSS + INTEGRATIONS_CSS + BACKUP_CSS + EXPORT_CSS + PROJECT_DELETE_CSS + POLICY_CSS + EVIDENCE_PACK_CSS + THEME_CONTROLS_CSS + CODING_CSS + CODING_SHIPPING_CSS + RECIPE_CSS + SKILLS_CSS + TOOLS_CSS + FLOWS_CSS + TEAMMATE_CSS + KITS_CSS + STARTERS_CSS + GALLERY_CSS + SSO_CSS + CREDENTIALS_CSS + REQUEST_LIMITS_CSS + PEOPLE_AUDIT_CSS + KNOWLEDGE_CSS + MODELS_CSS + CHAT_POLISH_CSS + TRANSITIONS_CSS + WORKSPACE_MOTION_CSS + ASSIGNMENT_CSS + TASK_STATUS_CSS + LEAD_CONTEXT_CSS + PULL_REQUEST_SETTINGS_CSS + CHECK_SETTINGS_CSS + DISCLOSURE_CSS + '.learning{min-width:0;overflow-wrap:anywhere}.learning .card{min-width:0}.learning code,.learning blockquote,.learning pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.learning button,.learning summary,.learning .button-link{min-height:44px}.learning button{white-space:nowrap}.learning summary{padding:12px 0;cursor:pointer}.learning form{margin:12px 0}.learning select{max-width:100%}.learning blockquote{margin:8px 0}.learning ul{padding-left:20px}');
 /**
  * The board's liveness: fetch this page's own fragment on a timer and swap
  * it in place — no flicker, no scroll reset, no long-lived stream to manage,
@@ -20132,7 +20239,7 @@ function safeReturn(raw) {
  * button can name. Nothing here is a second redirect framework: one
  * same-site path, or "/".
  */
-const LOGIN_RETURN_PAGES = /^\/(t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
+const LOGIN_RETURN_PAGES = /^\/(oauth\/authorize|t\/[^/]+|r\/[1-9]\d*|code(?:\/[a-f0-9]{32}(?:\/ship)?)?|review|chat|work|board|projects|routines|recipes|fleet|settings(\/[a-z-]+)?|mode)$/;
 function loginReturn(raw) {
     const safe = safeReturn(raw);
     if (safe === "/")

package/dist/store.d.ts

@@ -2,6 +2,7 @@ import type { DecisionOption } from "./contracts/decision.js";
 import { type SavedToolAction, type SavedToolRule } from "./contracts/store-json.js";
 import type { FlowCardChange, FlowCardFields } from "./contracts/flow-card.js";
 import { type Actor } from "./actor.js";
+import { type TokenPurpose } from "./api-tokens.js";
 import { type CriterionMatrixRow, type CriterionJudgementWord } from "./proof.js";
 import { type ExecutionProfile, type ChainEntry, type UnattendedPermissionMode, type AcceptanceCriterion } from "./scope.js";
 import { type ProviderRoom, type CandidateTier, type TaskSize, type TaskSizing, type PhaseRoute, type PublicationAuthority, type RouteStamp, type ReadinessLookup, type ReadinessObservation, type RiskLevel, type RouteOverride } from "./phase-routing.js";
@@ -145,7 +146,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 110;
+export declare const SCHEMA_VERSION = 113;
 /**
  * The migrations `toolroll update` may carry a database through in place: each
  * one only adds (a table, a column, an accepted value) and leaves every saved row
@@ -155,11 +156,43 @@ export declare const SCHEMA_VERSION = 110;
  * migrates and does not read this list.
  *
  * v110 rebuilds action_ledger only to widen its source check ('api', 'mcp'):
- * every row, id and hash-chain link is copied unchanged.
+ * every row, id and hash-chain link is copied unchanged. v111 adds nullable
+ * api_token columns (project limit, rotation); existing tokens read as before.
+ * v112 only adds the two request-budget tables.
+ * v113 adds MCP sign-in tables and API-token purpose metadata.
  */
 export declare const UPDATE_SAFE_MIGRATIONS: readonly number[];
 /** Whether a database settled at `version` reaches this build's schema through update-safe migrations alone. */
 export declare function updateSafeSchema(version: number | null): boolean;
+export type OAuthClientRow = {
+    id: string;
+    name: string;
+    redirectUris: string[];
+    createdAt: string;
+};
+export type OAuthCodeRow = {
+    client: string;
+    account: string;
+    generation: number;
+    access: "read" | "act";
+    projects: string[];
+    redirectUri: string;
+    resource: string;
+    challenge: string;
+    expiresAt: string;
+    usedAt: string | null;
+    token: string | null;
+};
+export type OAuthGrantRow = {
+    token: string;
+    client: string;
+    account: string;
+    generation: number;
+    projects: string[];
+    resource: string;
+    accessExpiresAt: string;
+    refreshHash: string;
+};
 export type ApiTokenRow = {
     id: string;
     account: string;
@@ -171,6 +204,14 @@ export type ApiTokenRow = {
     lastUsedAt: string | null;
     revokedAt: string | null;
     revokedBy: string | null;
+    /** v113: MCP manages its own access-secret rotation. */
+    purpose: TokenPurpose;
+    /** v111: the projects it is limited to (null: every project its person may use). */
+    projects: string[] | null;
+    /** v111: the token it replaced, the one that replaced it, and when this one stops after being replaced. */
+    replaces: string | null;
+    replacedBy: string | null;
+    overlapUntil: string | null;
 };
 export type WebSessionRow = {
     idHash: string;
@@ -2591,7 +2632,26 @@ export declare class Store {
         access: "read" | "act";
         expiresAt: string;
         by: string;
+        projects?: readonly string[] | null;
+        purpose?: TokenPurpose;
     }, now: Date): void;
+    /**
+     * v111: replace a live, not-yet-replaced token with a new secret on the same terms (access, projects, end date, so
+     * rotating never extends it). The old one keeps working until `overlapUntil` (never past its own end), then stops;
+     * every check reads that time, and endRotatedApiTokens records the end afterwards. Only the token's own person.
+     */
+    rotateApiToken(oldId: string, replacement: {
+        id: string;
+        secretHash: string;
+    }, by: string, now: Date, overlapMs: number): {
+        ok: true;
+        row: ApiTokenRow;
+    } | {
+        ok: false;
+        reason: "unknown" | "replaced" | "mcp-managed";
+    };
+    /** v111: record the end of each replaced token whose overlap has passed (it already signs no one in). */
+    endRotatedApiTokens(now: Date): number;
     /** A token by id with its kept hash (for the check), or null. */
     apiTokenSecret(id: string): {
         row: ApiTokenRow;
@@ -2602,6 +2662,62 @@ export declare class Store {
     /** Kept at most once a minute: a busy script doesn't write on every request. */
     touchApiToken(id: string, now: Date): void;
     revokeApiToken(id: string, by: string, now: Date, why?: string): boolean;
+    /** A registered client, or null. */
+    oauthClient(id: string): OAuthClientRow | null;
+    /** Expire unused registrations, retaining clients with a live code, grant or in-process consent. */
+    pruneOAuthClients(now: Date, pending?: readonly string[]): void;
+    /**
+     * Unused registrations expire after a day. Admission has a global and per-source bound; it never evicts a live
+     * registration. Repeating metadata from the same source returns its existing registration without spending a slot.
+     */
+    registerOAuthClient(client: {
+        id: string;
+        name: string;
+        redirectUris: string[];
+        source: string;
+    }, now: Date, cap: number, perSourceCap: number, pending?: readonly string[]): OAuthClientRow | null;
+    /** Keep a one-time code by its hash. */
+    saveOAuthCode(hash: string, code: Omit<OAuthCodeRow, "usedAt" | "token">): void;
+    /**
+     * Spend a code: the first caller gets it (`taken`), once, before it expires. A code spent before answers `used`
+     * with the token it made, so that token can be ended; anything else is null.
+     */
+    takeOAuthCode(hash: string, now: Date): {
+        taken: OAuthCodeRow;
+    } | {
+        used: string | null;
+    } | null;
+    /** Make a grant: its API token (created and recorded as any other) and its binding, together; the code notes the token. */
+    createOAuthGrant(code: string, token: {
+        id: string;
+        account: string;
+        name: string;
+        secretHash: string;
+        access: "read" | "act";
+        expiresAt: string;
+    }, grant: Omit<OAuthGrantRow, "token">, now: Date): void;
+    /** The grant an API token signs in for, or null when the token is an ordinary one. */
+    oauthGrant(token: string): OAuthGrantRow | null;
+    /**
+     * Classify, validate and rotate under one write transaction. Every issued hash remains in the family, so any
+     * older secret revokes even a concurrent winner. An unknown guess or the wrong client cannot end the family.
+     */
+    rotateOAuthGrant(token: string, ask: {
+        client: string;
+        resource: string;
+        refreshHash: string;
+        scope?: string;
+    }, next: {
+        refreshHash: string;
+        accessHash: string;
+        accessExpiresAt: string;
+    }, now: Date, projectsFor: (account: string) => readonly string[]): {
+        ok: true;
+        access: "read" | "act";
+    } | {
+        ok: false;
+        reason: "invalid_grant" | "invalid_scope";
+    };
     saveWebSession(session: WebSessionRow): void;
     webSession(idHash: string): WebSessionRow | null;
     webSessions(account: string | null): WebSessionRow[];