trainbud 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,44 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.5.2] — server 0.5.2 · watch 2.0.2 — 2026-09-06
+
+### Added — a paired watch no longer holds the master key
+
+- **Pairing mints a token scoped to that device.** `/api/pair/<code>/status` used
+  to hand the watch `TRAINBUD_API_KEY` itself: the credential that also opens the
+  dashboard and `/mcp`, sent to a device over a public tunnel, with no way to take
+  it back except rotating the key for everything at once. It now mints a
+  256-bit token per pairing and stores only its SHA-256, so a copy of `app.db` is
+  not a working watch credential.
+- **`trainbud devices`** lists paired watches with when they were paired and last
+  seen; **`trainbud devices revoke <id>`** (or `--all`) takes one away without
+  logging out the dashboard, the MCP endpoint, or the other watches. Revoking is
+  now the documented way to remove a watch — rotating `TRAINBUD_API_KEY` is not.
+- **Nothing on the watch changed and no re-pair is forced.** The field name in the
+  pairing response is unchanged, the master key is still accepted, and a watch
+  paired before this release keeps working. Re-pair it to swap its stored master
+  key for a scoped token.
+
+### Added — security headers, on every response including the 401s
+
+- The server shipped 0.5.1 with none, while being reachable from the internet for
+  as long as the watch's tunnel is up. Now sends `Content-Security-Policy`
+  (`frame-ancestors 'none'`, `form-action 'self'`, no external script or style),
+  `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy: no-referrer`, and
+  the two `Cross-Origin-*` policies. Applied before routing, so an error path
+  cannot miss them.
+- `script-src` keeps `'unsafe-inline'`: the dashboard is server-rendered HTML with
+  inline handlers, and a nonce policy is a rewrite of the page, not a header.
+- **HSTS only when the request actually arrived over TLS.** Pinning https on a
+  host the user reaches at `http://127.0.0.1:3847` would lock them out of their
+  own dashboard.
+
+### Changed
+
+- npm keywords: added `mcp-server`, `cursor`, `chatgpt`, `connect-iq`.
+- 569 tests (567 pass, 2 skipped), up from 551.
+
 ## [0.5.1] — server 0.5.1 · watch 2.0.2 — 2026-09-06
 
 First release published to npm: `npx trainbud setup`. Trusted publishing over

package/README.md

@@ -224,6 +224,8 @@ trainbud findings       # What stands out against your own baselines
 trainbud start          # Start the MCP server (stdio)
 trainbud auth           # Force re-authentication
 trainbud cache clear    # Clear cached data
+trainbud devices        # List paired watches
+trainbud devices revoke <id>   # Take one watch's access away
 trainbud status         # Show session and cache status
 trainbud --version      # Print version
 ```
@@ -265,10 +267,14 @@ repo root, or call the built entry point directly with `node dist/index.js docto
 - The dashboard takes the key once, on `/dashboard?token=…`, then trades it for an
   `HttpOnly` session cookie and redirects to a clean URL — so the key does not sit in
   your address bar, your history, or a screenshot
-- **A paired watch holds the API key itself**, not a scoped per-device token. Pairing
-  approval hands over the same key that opens the dashboard and `/mcp`. Revoke a watch
-  by changing `TRAINBUD_API_KEY` and pairing again. A narrower per-device token is
-  planned; until then, treat pairing as handing out a password
+- **A paired watch holds a token scoped to that watch**, minted at pairing and stored
+  on the server as a SHA-256 hash. `trainbud devices` lists them, `trainbud devices
+  revoke <id>` takes one away — without logging out the dashboard, `/mcp`, or your
+  other watches. A watch paired before 0.5.2 holds the API key itself; re-pair it to
+  swap that for a scoped token
+- Every response carries `Content-Security-Policy`, `X-Content-Type-Options`,
+  `X-Frame-Options` and `Referrer-Policy`, including the 401s. HSTS is sent only on a
+  request that actually arrived over TLS, so the loopback dashboard stays reachable
 
 ### What TrainBud is not
 

package/dist/appDb.d.ts

@@ -14,7 +14,7 @@ export interface PromptJob {
     created_at: number;
     completed_at: number | null;
 }
-export declare const APP_DB_SCHEMA = "\n    CREATE TABLE IF NOT EXISTS settings (\n      key   TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS pair_tokens (\n      code        TEXT PRIMARY KEY,\n      created_at  INTEGER NOT NULL,\n      expires_at  INTEGER NOT NULL,\n      approved_at INTEGER\n    );\n    CREATE TABLE IF NOT EXISTS prompt_jobs (\n      id           TEXT PRIMARY KEY,\n      prompt       TEXT NOT NULL,\n      status       TEXT NOT NULL DEFAULT 'pending',\n      result       TEXT,\n      error        TEXT,\n      created_at   INTEGER NOT NULL,\n      completed_at INTEGER\n    );\n\n    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no\n    -- published price for records its tokens and leaves the cost unknown,\n    -- because a call priced at zero is a monthly cap that can never trip.\n    -- The schema lives here rather than in usage.ts so that opening the\n    -- database does not have to import the module that writes to it.\n    CREATE TABLE IF NOT EXISTS ai_usage (\n      id            INTEGER PRIMARY KEY AUTOINCREMENT,\n      at            INTEGER NOT NULL,\n      kind          TEXT    NOT NULL,\n      model         TEXT    NOT NULL,\n      source        TEXT    NOT NULL,\n      input_tokens  INTEGER NOT NULL,\n      output_tokens INTEGER NOT NULL,\n      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,\n      cache_write_tokens INTEGER NOT NULL DEFAULT 0,\n      cost_usd      REAL\n    );\n    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);\n\n    CREATE TABLE IF NOT EXISTS feature_usage (\n      name  TEXT NOT NULL,\n      day   TEXT NOT NULL,\n      count INTEGER NOT NULL,\n      PRIMARY KEY (name, day)\n    );\n";
+export declare const APP_DB_SCHEMA = "\n    CREATE TABLE IF NOT EXISTS settings (\n      key   TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n    CREATE TABLE IF NOT EXISTS pair_tokens (\n      code        TEXT PRIMARY KEY,\n      created_at  INTEGER NOT NULL,\n      expires_at  INTEGER NOT NULL,\n      approved_at INTEGER\n    );\n    -- One row per paired watch. Only the SHA-256 of the token is kept; see\n    -- deviceTokens.ts for why the plaintext is not stored anywhere. Created by\n    -- IF NOT EXISTS on every open, so a database written before 0.5.2 gains\n    -- the table without a migration step and without touching its other rows.\n    CREATE TABLE IF NOT EXISTS device_tokens (\n      id           INTEGER PRIMARY KEY AUTOINCREMENT,\n      token_hash   TEXT    NOT NULL UNIQUE,\n      label        TEXT    NOT NULL,\n      created_at   INTEGER NOT NULL,\n      last_seen_at INTEGER\n    );\n\n    CREATE TABLE IF NOT EXISTS prompt_jobs (\n      id           TEXT PRIMARY KEY,\n      prompt       TEXT NOT NULL,\n      status       TEXT NOT NULL DEFAULT 'pending',\n      result       TEXT,\n      error        TEXT,\n      created_at   INTEGER NOT NULL,\n      completed_at INTEGER\n    );\n\n    -- Usage. cost_usd is nullable ON PURPOSE: a model this build has no\n    -- published price for records its tokens and leaves the cost unknown,\n    -- because a call priced at zero is a monthly cap that can never trip.\n    -- The schema lives here rather than in usage.ts so that opening the\n    -- database does not have to import the module that writes to it.\n    CREATE TABLE IF NOT EXISTS ai_usage (\n      id            INTEGER PRIMARY KEY AUTOINCREMENT,\n      at            INTEGER NOT NULL,\n      kind          TEXT    NOT NULL,\n      model         TEXT    NOT NULL,\n      source        TEXT    NOT NULL,\n      input_tokens  INTEGER NOT NULL,\n      output_tokens INTEGER NOT NULL,\n      cache_read_tokens  INTEGER NOT NULL DEFAULT 0,\n      cache_write_tokens INTEGER NOT NULL DEFAULT 0,\n      cost_usd      REAL\n    );\n    CREATE INDEX IF NOT EXISTS ai_usage_at ON ai_usage(at);\n\n    CREATE TABLE IF NOT EXISTS feature_usage (\n      name  TEXT NOT NULL,\n      day   TEXT NOT NULL,\n      count INTEGER NOT NULL,\n      PRIMARY KEY (name, day)\n    );\n";
 /**
  * The open handle, for modules that own their own tables.
  *
@@ -44,6 +44,45 @@ export declare function getPairToken(code: string): PairToken | null;
 export declare function approvePairToken(code: string): boolean;
 export declare function deletePairToken(code: string): void;
 export declare function listPendingPairTokens(): PairToken[];
+export interface DeviceToken {
+    id: number;
+    label: string;
+    created_at: number;
+    last_seen_at: number | null;
+}
+/**
+ * Mints a token, stores its hash, and returns the plaintext exactly once.
+ *
+ * There is no way to read it back afterwards, which is the point: the only
+ * copy that survives this call is the one the watch stores. A lost token is
+ * re-paired, not recovered.
+ */
+export declare function createDeviceToken(label: string): {
+    id: number;
+    token: string;
+};
+/**
+ * The id behind a token, or null.
+ *
+ * The lookup is an indexed equality match on a hash rather than a constant-time
+ * comparison, and that is deliberate: timing here can only leak how close a
+ * guess came to an existing *hash*, and producing a token that hashes to a
+ * known value is the preimage problem. The master key comparison in
+ * httpServer.ts is timing-safe because there the secret itself is compared.
+ */
+export declare function findDeviceTokenId(token: string): number | null;
+/**
+ * Records that a device was seen, at most once a minute.
+ *
+ * The watch polls, and an unthrottled write here would mean a database write
+ * per request for a column nobody reads more precisely than "today".
+ */
+export declare function touchDeviceToken(id: number, now?: number): void;
+export declare function listDeviceTokens(): DeviceToken[];
+/** True if a row was actually removed, so the CLI can say so honestly. */
+export declare function revokeDeviceToken(id: number): boolean;
+/** Returns how many were revoked. */
+export declare function revokeAllDeviceTokens(): number;
 /**
  * How old an unfinished job has to be before it counts as wreckage.
  *

package/dist/appDb.js

@@ -3,6 +3,7 @@ import { randomInt } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { appConfig } from "./config.js";
+import { generateDeviceToken, hashDeviceToken, looksLikeDeviceToken } from "./deviceTokens.js";
 import { restrictExistingFile } from "./utils/secretFile.js";
 // SECTION: App DB — settings, pair tokens, prompt jobs
 const DB_PATH = path.resolve(path.dirname(appConfig.cachePath), "app.db");
@@ -18,6 +19,18 @@ export const APP_DB_SCHEMA = `
       expires_at  INTEGER NOT NULL,
       approved_at INTEGER
     );
+    -- One row per paired watch. Only the SHA-256 of the token is kept; see
+    -- deviceTokens.ts for why the plaintext is not stored anywhere. Created by
+    -- IF NOT EXISTS on every open, so a database written before 0.5.2 gains
+    -- the table without a migration step and without touching its other rows.
+    CREATE TABLE IF NOT EXISTS device_tokens (
+      id           INTEGER PRIMARY KEY AUTOINCREMENT,
+      token_hash   TEXT    NOT NULL UNIQUE,
+      label        TEXT    NOT NULL,
+      created_at   INTEGER NOT NULL,
+      last_seen_at INTEGER
+    );
+
     CREATE TABLE IF NOT EXISTS prompt_jobs (
       id           TEXT PRIMARY KEY,
       prompt       TEXT NOT NULL,
@@ -161,6 +174,62 @@ export function listPendingPairTokens() {
         .prepare("SELECT code, created_at, expires_at, approved_at FROM pair_tokens WHERE expires_at > ? AND approved_at IS NULL ORDER BY created_at DESC")
         .all(now);
 }
+/**
+ * Mints a token, stores its hash, and returns the plaintext exactly once.
+ *
+ * There is no way to read it back afterwards, which is the point: the only
+ * copy that survives this call is the one the watch stores. A lost token is
+ * re-paired, not recovered.
+ */
+export function createDeviceToken(label) {
+    const token = generateDeviceToken();
+    const now = Math.floor(Date.now() / 1000);
+    const result = getDb()
+        .prepare("INSERT INTO device_tokens (token_hash, label, created_at, last_seen_at) VALUES (?, ?, ?, NULL)")
+        .run(hashDeviceToken(token), label, now);
+    return { id: Number(result.lastInsertRowid), token };
+}
+/**
+ * The id behind a token, or null.
+ *
+ * The lookup is an indexed equality match on a hash rather than a constant-time
+ * comparison, and that is deliberate: timing here can only leak how close a
+ * guess came to an existing *hash*, and producing a token that hashes to a
+ * known value is the preimage problem. The master key comparison in
+ * httpServer.ts is timing-safe because there the secret itself is compared.
+ */
+export function findDeviceTokenId(token) {
+    if (!looksLikeDeviceToken(token))
+        return null;
+    const row = getDb()
+        .prepare("SELECT id FROM device_tokens WHERE token_hash = ?")
+        .get(hashDeviceToken(token));
+    return row?.id ?? null;
+}
+/**
+ * Records that a device was seen, at most once a minute.
+ *
+ * The watch polls, and an unthrottled write here would mean a database write
+ * per request for a column nobody reads more precisely than "today".
+ */
+export function touchDeviceToken(id, now = Math.floor(Date.now() / 1000)) {
+    getDb()
+        .prepare("UPDATE device_tokens SET last_seen_at = ? WHERE id = ? AND (last_seen_at IS NULL OR last_seen_at < ?)")
+        .run(now, id, now - 60);
+}
+export function listDeviceTokens() {
+    return getDb()
+        .prepare("SELECT id, label, created_at, last_seen_at FROM device_tokens ORDER BY created_at DESC")
+        .all();
+}
+/** True if a row was actually removed, so the CLI can say so honestly. */
+export function revokeDeviceToken(id) {
+    return getDb().prepare("DELETE FROM device_tokens WHERE id = ?").run(id).changes > 0;
+}
+/** Returns how many were revoked. */
+export function revokeAllDeviceTokens() {
+    return getDb().prepare("DELETE FROM device_tokens").run().changes;
+}
 // Prompt jobs
 /** Kept long enough to answer "what did it say earlier today", not forever. */
 const PROMPT_JOB_TTL_SECONDS = 7 * 24 * 60 * 60;

package/dist/cli.js

@@ -17,6 +17,7 @@ import { startHistoryScheduler } from "./history/scheduler.js";
 import { closeHistoryDb, historyStats, pruneRawPayloads, RAW_RETENTION_DAYS, RAW_REVISIONS_KEPT, } from "./history/store.js";
 import { describeFindingsCoverage, runDetectors } from "./detect/index.js";
 import { printLiveCheckResults, runLiveCheck } from "./check.js";
+import { listDeviceTokens, revokeAllDeviceTokens, revokeDeviceToken } from "./appDb.js";
 // SECTION: Bootstrap
 //
 // Runs before every command. Moves pre-0.3.0 state out of `.garmin/` and warns
@@ -440,6 +441,52 @@ export function createCliProgram() {
             process.exitCode = 1;
         }
     });
+    // Revoking a watch used to mean rotating TRAINBUD_API_KEY, which logged out
+    // the dashboard and every MCP client at the same time -- and, until watch
+    // 2.0.2, left the watch holding a dead key it would not replace. A paired
+    // watch now carries a token of its own, and this is where it is taken away.
+    const devicesCommand = program.command("devices").description("List and revoke paired watches");
+    devicesCommand
+        .command("list", { isDefault: true })
+        .description("Show paired watches, newest first")
+        .action(() => {
+        const devices = listDeviceTokens();
+        if (devices.length === 0) {
+            console.log("No paired watches. Pair one from the watch app's setup screen.");
+            return;
+        }
+        for (const device of devices) {
+            const created = new Date(device.created_at * 1000).toISOString().slice(0, 10);
+            const seen = device.last_seen_at
+                ? new Date(device.last_seen_at * 1000).toISOString().slice(0, 16).replace("T", " ")
+                : "never";
+            console.log(`${String(device.id).padStart(3)}  ${device.label}  paired ${created}  last seen ${seen}`);
+        }
+    });
+    devicesCommand
+        .command("revoke [id]")
+        .description("Revoke one paired watch, or --all of them")
+        .option("--all", "Revoke every paired watch")
+        .action((id, options) => {
+        if (options.all) {
+            const count = revokeAllDeviceTokens();
+            console.log(count === 0 ? "Nothing to revoke." : `Revoked ${count} watch${count === 1 ? "" : "es"}.`);
+            return;
+        }
+        const numericId = Number(id);
+        if (!id || !Number.isInteger(numericId)) {
+            console.error("Pass the id from `trainbud devices list`, or --all.");
+            process.exitCode = 1;
+            return;
+        }
+        if (revokeDeviceToken(numericId)) {
+            console.log(`Revoked ${numericId}. That watch will show "Watch not authorised" and can pair again.`);
+        }
+        else {
+            console.error(`No paired watch with id ${numericId}.`);
+            process.exitCode = 1;
+        }
+    });
     program
         .command("status")
         .description("Show session and cache status")

package/dist/deviceTokens.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The prefix is load-bearing, not decoration. Every authenticated request has
+ * to decide whether a bearer token is the master key or a device token, and
+ * without a marker that decision costs a database round trip on every single
+ * request -- including the dashboard's, which never carries a device token.
+ */
+export declare const DEVICE_TOKEN_PREFIX = "tbd_";
+/** 32 bytes from the CSPRNG. The prefix is not part of the entropy. */
+export declare function generateDeviceToken(): string;
+/**
+ * Only the hash is stored.
+ *
+ * `app.db` already holds the Anthropic key in the clear, which is why it is
+ * chmod'd 0600 -- but a backup, a sync folder or a support upload defeats file
+ * permissions, and a plaintext device token in that file is a working watch
+ * credential for whoever reads it. A SHA-256 of a 256-bit random value has no
+ * dictionary to attack: there is nothing to salt and nothing to guess.
+ */
+export declare function hashDeviceToken(token: string): string;
+/**
+ * A cheap structural check, deliberately not a security boundary.
+ *
+ * It decides which lookup to try, nothing more. A forged string carrying the
+ * prefix still has to hash to a row that exists.
+ */
+export declare function looksLikeDeviceToken(token: string): boolean;
+/** `watch-2026-09-06`, so the device list reads as something a human paired. */
+export declare function defaultDeviceLabel(now?: Date): string;
+//# sourceMappingURL=deviceTokens.d.ts.map

package/dist/deviceTokens.js

@@ -0,0 +1,49 @@
+import { createHash, randomBytes } from "node:crypto";
+// SECTION: Per-device tokens
+//
+// A paired watch used to be handed `appConfig.mcpApiKey` -- the master key,
+// the same credential that unlocks the dashboard and every MCP route. Two
+// things followed from that. Revoking one watch meant rotating the key, which
+// logged out everything else and, until 2.0.2, bricked the watch outright. And
+// a token read off a watch was full server access, not watch access.
+//
+// A device token is minted per pairing, carried by the watch in exactly the
+// same `Authorization: Bearer` header, and revocable on its own. The master key
+// keeps working, so a watch paired before this change does not have to re-pair.
+/**
+ * The prefix is load-bearing, not decoration. Every authenticated request has
+ * to decide whether a bearer token is the master key or a device token, and
+ * without a marker that decision costs a database round trip on every single
+ * request -- including the dashboard's, which never carries a device token.
+ */
+export const DEVICE_TOKEN_PREFIX = "tbd_";
+/** 32 bytes from the CSPRNG. The prefix is not part of the entropy. */
+export function generateDeviceToken() {
+    return DEVICE_TOKEN_PREFIX + randomBytes(32).toString("hex");
+}
+/**
+ * Only the hash is stored.
+ *
+ * `app.db` already holds the Anthropic key in the clear, which is why it is
+ * chmod'd 0600 -- but a backup, a sync folder or a support upload defeats file
+ * permissions, and a plaintext device token in that file is a working watch
+ * credential for whoever reads it. A SHA-256 of a 256-bit random value has no
+ * dictionary to attack: there is nothing to salt and nothing to guess.
+ */
+export function hashDeviceToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+/**
+ * A cheap structural check, deliberately not a security boundary.
+ *
+ * It decides which lookup to try, nothing more. A forged string carrying the
+ * prefix still has to hash to a row that exists.
+ */
+export function looksLikeDeviceToken(token) {
+    return token.startsWith(DEVICE_TOKEN_PREFIX) && token.length === DEVICE_TOKEN_PREFIX.length + 64;
+}
+/** `watch-2026-09-06`, so the device list reads as something a human paired. */
+export function defaultDeviceLabel(now = new Date()) {
+    return `watch-${now.toISOString().slice(0, 10)}`;
+}
+//# sourceMappingURL=deviceTokens.js.map

package/dist/httpServer.js

@@ -4,7 +4,8 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { closeCache } from "./garmin/cache.js";
 import { CARD_IDS, DEFAULT_PROFILE, getProfile, updateProfile, } from "./profile.js";
 import { budgetState, clearFeatureUsage, dailyAiSpend, featureCounts, monthToDateSpend, recentAiUsage, recordFeature, } from "./usage.js";
-import { closeAppDb, reconcilePromptJobsOnStartup, setSetting } from "./appDb.js";
+import { closeAppDb, findDeviceTokenId, reconcilePromptJobsOnStartup, setSetting, touchDeviceToken, } from "./appDb.js";
+import { looksLikeDeviceToken } from "./deviceTokens.js";
 import { assertGarminCredentials, assertApiKey, appConfig } from "./config.js";
 import { createMcpServerInstance } from "./server.js";
 import { configureLogger, logger } from "./utils/logger.js";
@@ -197,6 +198,46 @@ function sessionCookieHeader(req, id) {
     const maxAge = Math.floor(SESSION_TTL_MS / 1000);
     return `${SESSION_COOKIE}=${id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${secure}`;
 }
+/**
+ * Set on every response, before routing, so a 401 and a 500 carry them too.
+ *
+ * This server is reachable from the public internet whenever the tunnel the
+ * watch needs is up, and it was sending no security headers at all.
+ *
+ * `script-src` has to keep `'unsafe-inline'`: the dashboard is server-rendered
+ * HTML with one inline script and inline handlers, and a nonce-based policy is
+ * a rewrite of the page, not a header change. What the policy still buys is
+ * real -- no external script or style can load, the page cannot be framed, and
+ * `form-action 'self'` stops a submission being retargeted.
+ *
+ * HSTS is conditional on purpose. It is sent only on a request that actually
+ * arrived over TLS, because pinning https on a host someone later serves over
+ * plain http locally is a self-inflicted outage.
+ */
+function applySecurityHeaders(req, res) {
+    res.setHeader("Content-Security-Policy", [
+        "default-src 'self'",
+        "script-src 'self' 'unsafe-inline'",
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data:",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'none'",
+        "form-action 'self'",
+    ].join("; "));
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("X-Frame-Options", "DENY");
+    // The dashboard is reached with ?token=<key> exactly once before the redirect
+    // to a clean URL. no-referrer keeps that one URL out of any outbound request.
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+    res.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+    const forwarded = req.headers["x-forwarded-proto"];
+    const proto = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(",")[0]?.trim();
+    if (proto === "https") {
+        res.setHeader("Strict-Transport-Security", "max-age=31536000");
+    }
+}
 function isAuthorized(req, queryToken) {
     const header = req.headers.authorization;
     const headerToken = header?.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : null;
@@ -204,8 +245,29 @@ function isAuthorized(req, queryToken) {
     if (token !== null && matchesApiKey(token)) {
         return true;
     }
+    if (token !== null && matchesDeviceToken(token)) {
+        return true;
+    }
     return hasValidSession(req);
 }
+/**
+ * A paired watch presents a token minted for it alone.
+ *
+ * Checked after the master key, and only for strings shaped like a device
+ * token, so the dashboard and MCP paths -- which never carry one -- do not pay
+ * a database lookup per request. Revoking the row is what logs a watch out;
+ * rotating the master key no longer has to, which is what made rotation brick
+ * a watch before 2.0.2.
+ */
+function matchesDeviceToken(token) {
+    if (!looksLikeDeviceToken(token))
+        return false;
+    const id = findDeviceTokenId(token);
+    if (id === null)
+        return false;
+    touchDeviceToken(id);
+    return true;
+}
 /**
  * Constant-time comparison. `===` returns as soon as two bytes differ, which
  * leaks the length of the matching prefix to anyone who can time the response,
@@ -533,6 +595,7 @@ export function createHttpMcpServer() {
                 });
             });
             const handleRequest = async (req, res) => {
+                applySecurityHeaders(req, res);
                 // A Host that is not a valid authority is not worth a 500: fall back to
                 // a name that always parses. The host only matters for reading the path
                 // and, in resolvePublicUrl, for telling a paired watch where to call

package/dist/pairApi.js

@@ -1,5 +1,6 @@
-import { createPairToken, getPairToken, approvePairToken, deletePairToken, listPendingPairTokens } from "./appDb.js";
+import { createPairToken, getPairToken, approvePairToken, deletePairToken, listPendingPairTokens, createDeviceToken } from "./appDb.js";
 import { appConfig } from "./config.js";
+import { defaultDeviceLabel } from "./deviceTokens.js";
 export function requestPairing() {
     const token = createPairToken();
     const now = Math.floor(Date.now() / 1000);
@@ -21,9 +22,17 @@ export function checkPairStatus(code, publicUrl) {
         return null;
     if (token.approved_at !== null) {
         deletePairToken(code);
+        // What the watch receives here used to be appConfig.mcpApiKey: the master
+        // key, handed to a device over a tunnel, with no way to take it back except
+        // rotating the key for everything. It is now a token minted for this
+        // pairing alone, revocable by itself. The field name is unchanged on
+        // purpose -- the watch stores whatever arrives here and sends it as a
+        // bearer token, so nothing on the device had to change and no already
+        // paired watch has to pair again.
+        const device = createDeviceToken(defaultDeviceLabel());
         return {
             approved: true,
-            api_key: appConfig.mcpApiKey,
+            api_key: device.token,
             server_url: publicUrl || appConfig.publicUrl,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trainbud",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "TrainBud \u2014 talk to your Connect fitness data through Claude and other MCP clients",
   "type": "module",
   "main": "dist/index.js",
@@ -32,8 +32,12 @@
     "garmin",
     "garmin-connect",
     "mcp",
+    "mcp-server",
     "model-context-protocol",
     "claude",
+    "cursor",
+    "chatgpt",
+    "connect-iq",
     "fitness",
     "health",
     "trainbud"