toolroll 0.9.48 → 0.9.49

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.9.49 — 2026-10-07
+
+- **Tokens keep their limits.** A token's scope and project limits now hold
+  on every remote route.
+- **Browser login for step-ups.** Approvals and other password step-ups need
+  a browser login. OAuth refuses plain HTTP off loopback or your tailnet.
+- **Request budgets everywhere.** Budgets cover every remote route, and fake
+  account names can't lock anyone out.
+
 ## 0.9.48 — 2026-10-07
 
 - **Instant live views.** Changes reach open pages in about 2 ms (was about

package/dist/desktop-update.d.ts

@@ -94,20 +94,20 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
+    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
-    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/mcp-http.d.ts

@@ -27,5 +27,6 @@ export type McpHttpOptions = {
     runAs?: RunOperateAs;
     /** A person token's request budget (request-budget.ts), charged once per request before its body is read. */
     admit?: (person: Person) => Admission;
+    requestBudgetClock?: () => number;
 };
 export declare function createMcpHttp(options: McpHttpOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;

package/dist/mcp-http.js

@@ -15,11 +15,12 @@ import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js"
 import { authenticateCoordinator } from "./coordinator.js";
 import { LEGACY, MAX_REQUEST, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
 import { callPersonTool, personTools } from "./mcp-person.js";
-import { limitWords } from "./request-budget.js";
+import { limitWords, SOURCE_BUDGET_DEFAULTS, SourceAdmission } from "./request-budget.js";
 /** The most decisions a coordinator credential is remembered to have read (propose_answer needs one). */
 const READ_DECISIONS_KEPT = 200;
 export function createMcpHttp(options) {
     const { store } = options;
+    const coordinatorBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.coordinator, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
     /** Stdio remembers per connection which decisions a coordinator read; stateless HTTP remembers it per credential. */
     const readDecisions = new Map();
     const send = (response, status, body, headers = {}) => {
@@ -110,9 +111,10 @@ export function createMcpHttp(options) {
             const metadata = options.resourceMetadata?.(request) ?? null;
             return refuse(response, 401, "sign in with your API token (Authorization: Bearer so_…) or a coordinator credential — passwords and cookies are not accepted here", { "www-authenticate": `Bearer realm="toolroll-mcp"${metadata === null ? "" : `, resource_metadata="${metadata}"`}` });
         }
-        // A person's token is counted once per request, notifications included; a coordinator keeps its own proposal limit.
-        if (caller.kind === "person" && options.admit !== undefined) {
-            const admitted = options.admit(caller.person);
+        // Count every authenticated request once, including notifications. Coordinator proposal limits still apply
+        // separately inside tool transactions; this admission also bounds their reads and malformed requests.
+        {
+            const admitted = caller.kind === "person" ? options.admit?.(caller.person) ?? { ok: true } : coordinatorBudget.admit(caller.cid);
             if (!admitted.ok && admitted.status === 503)
                 return refuse(response, 503, "request limits could not be checked; nothing ran — try again shortly");
             if (!admitted.ok) {

package/dist/mcp-oauth.d.ts

@@ -21,6 +21,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Store } from "./store.js";
+import { type Admission } from "./request-budget.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export declare const OAUTH_TIMES: {
     readonly requestMs: number;
@@ -71,6 +72,8 @@ export type OAuthHttpOptions = {
     confirm: (session: OAuthSession, typed: string) => boolean;
     /** The projects this person may choose: each a project the server knows that they can use now. */
     projectsFor: (account: string) => string[];
+    /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */
+    admitToken?: (request: IncomingMessage) => Admission;
 };
 /**
  * A redirect a client may register: https anywhere, or http on 127.0.0.1 / [::1] (RFC 8252 §7.3), with no

package/dist/mcp-oauth.js

@@ -21,6 +21,7 @@
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
+import { limitWords } from "./request-budget.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -350,6 +351,13 @@ export function createOAuthHttp(options) {
     async function token(request, response, origin) {
         if (request.method !== "POST")
             return oauthError(response, 405, "invalid_request", "Use POST.");
+        const admitted = options.admitToken === undefined ? { ok: true } : options.admitToken(request);
+        if (!admitted.ok) {
+            request.resume();
+            if (admitted.status === 503)
+                return oauthError(response, 503, "temporarily_unavailable", "Request limits could not be checked; nothing was issued. Try again shortly.");
+            return json(response, 429, { error: "temporarily_unavailable", error_description: limitWords(admitted.limit, admitted.retryAfter) }, { "retry-after": String(admitted.retryAfter) });
+        }
         if (media(request) !== "application/x-www-form-urlencoded")
             return oauthError(response, 400, "invalid_request", "Send application/x-www-form-urlencoded.");
         const text = await readBody(request);

package/dist/public-access.d.ts

@@ -42,7 +42,9 @@ export declare function transportOf(request: {
     forwardedProto: string | string[] | undefined;
     forwarded: string | string[] | undefined;
 }): Transport;
-/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, and any bearer credential. */
+/** The OAuth endpoints that hand out, consent to or take back a token (mcp-oauth.ts; revoke is reserved). Discovery stays public. */
+export declare const OAUTH_TOKEN_PATHS: ReadonlySet<string>;
+/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, MCP sign-in, and any bearer credential. */
 export declare function carriesToken(pathname: string, authorization: string | undefined): boolean;
 /** The refusal for a token sent over plain HTTP from outside this computer and the tailnet, else null. */
 export declare function plainHttpRefusal(transport: Transport, pathname: string, authorization: string | undefined): string | null;

package/dist/public-access.js

@@ -69,10 +69,14 @@ export function transportOf(request) {
         return { source: "unknown", https, privatePath: false };
     return { source, https, privatePath: isLoopbackPeer(source) || isTailnetAddress(source) };
 }
-/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, and any bearer credential. */
+/** The OAuth endpoints that hand out, consent to or take back a token (mcp-oauth.ts; revoke is reserved). Discovery stays public. */
+export const OAUTH_TOKEN_PATHS = new Set(["/oauth/authorize", "/oauth/token", "/oauth/register", "/oauth/revoke"]);
+/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, MCP sign-in, and any bearer credential. */
 export function carriesToken(pathname, authorization) {
     if (pathname === "/api/cli" || pathname.startsWith("/api/cli/") || pathname === "/mcp" || pathname.startsWith("/mcp/"))
         return true;
+    if (OAUTH_TOKEN_PATHS.has(pathname.replace(/\/+$/, "") || "/"))
+        return true;
     return authorization !== undefined && /^bearer\s/i.test(authorization);
 }
 /** The refusal for a token sent over plain HTTP from outside this computer and the tailnet, else null. */

package/dist/request-budget.d.ts

@@ -1,6 +1,6 @@
 /**
- * Request budgets for person API tokens (v112): how many requests one `so_` token may make to `/api/cli` and `/mcp`.
- * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by both
+ * Request budgets for person API tokens (v112): how many requests one `so_` token may make across all accepting routes.
+ * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by those
  * routes. A read token gets 120 requests in any sliding minute, an act token 30, and either 10,000 in a rolling day;
  * an instance operator may override any of these for the installation or for one token in the console (step-up).
  *
@@ -26,7 +26,7 @@ export declare const PER_DAY_MAX = 100000;
 export declare const TRACKED_TOKENS = 1024;
 export declare const FLUSH_MS = 5000;
 /** Which limit a refusal hit: the body of a 429 names only this and Retry-After. */
-export type BudgetLimit = "read-per-minute" | "act-per-minute" | "per-day";
+export type BudgetLimit = "read-per-minute" | "act-per-minute" | "per-day" | "per-minute";
 export type Admission = {
     ok: true;
 } | {
@@ -95,3 +95,30 @@ export declare class RequestBudget {
     /** The tracked entry (now the most recently used), from memory or as last saved; the least recently used is saved and let go. */
     private load;
 }
+/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
+ * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
+export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
+    password: 120;
+    oauthToken: 30;
+    coordinator: 120;
+    teamsSource: 120;
+    teamsTenant: 600;
+}>;
+/**
+ * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
+ * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ */
+export declare class SourceAdmission {
+    private readonly perMinute;
+    private readonly clock;
+    private readonly tracked;
+    private readonly usage;
+    constructor(options: {
+        perMinute: number;
+        clock?: () => number;
+        tracked?: number;
+    });
+    get size(): number;
+    admit(source: string): Admission;
+}

package/dist/request-budget.js

@@ -22,7 +22,7 @@ export const TRACKED_TOKENS = 1024;
 export const FLUSH_MS = 5_000;
 const MINUTE = 60_000, DAY = 86_400_000;
 /** The words for a 429, in one line. */
-export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : "act requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
+export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : limit === "act-per-minute" ? "act requests per minute" : "requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
 /** A limit typed into a form: a whole number within bounds, "" for none, or a problem. */
 export function parseLimit(raw, max) {
     const text = raw.trim();
@@ -231,3 +231,46 @@ export class RequestBudget {
         return usage;
     }
 }
+/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
+ * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
+export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken: 30, coordinator: 120, teamsSource: 120, teamsTenant: 600 });
+/**
+ * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
+ * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ */
+export class SourceAdmission {
+    perMinute;
+    clock;
+    tracked;
+    usage = new Map();
+    constructor(options) {
+        this.perMinute = Math.max(1, Math.min(PER_MINUTE_MAX, options.perMinute));
+        this.clock = options.clock ?? Date.now;
+        this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
+    }
+    get size() { return this.usage.size; }
+    admit(source) {
+        const now = this.clock();
+        let times = this.usage.get(source);
+        if (times === undefined) {
+            if (this.usage.size >= this.tracked) {
+                for (const [key, kept] of this.usage)
+                    if (kept.every(at => at <= now - MINUTE))
+                        this.usage.delete(key);
+                if (this.usage.size >= this.tracked)
+                    this.usage.delete(this.usage.keys().next().value);
+            }
+            times = [];
+        }
+        this.usage.delete(source);
+        this.usage.set(source, times);
+        while (times.length > 0 && times[0] <= now - MINUTE)
+            times.shift();
+        if (times.length >= this.perMinute) {
+            return { ok: false, status: 429, limit: "per-minute", retryAfter: Math.max(1, Math.ceil((times[times.length - this.perMinute] + MINUTE - now) / 1000)) };
+        }
+        times.push(now);
+        return { ok: true };
+    }
+}