feat(api): MCP OAuth client registration (CIMD and DCR), RFC-0044 phase 3a (#144) - #178

…reen (#144)

Review of #178, finding 6. A client name is self-asserted (a metadata
document's or a registration's client_name), so:

- consent info and the stored grant show it plain: control, bidi,
  zero-width, tag and other format characters removed, space runs
  collapsed, at most 100 code points (client-identity.ts, linear);
- ConsentInfo.client gains kind (document, self-registered, server) and
  lookalike: a self-registered name containing Claude, Claude Code,
  ChatGPT, Codex, VS Code or Cursor;
- Studio leads with a document client's host, in the title too
  ("Connect {client} from {host}"), labels DCR clients "Self-registered,
  not verified", and warns about look-alike names.

Three new oauthConsent strings in en; the 18 other languages are machine
drafts from pnpm i18n:import, awaiting review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>

…its (#144)

Review of #178, finding 7. A set_embargo from an OAuth connection files
an on-approval release, whose execute time is the moment it was filed,
so the 60-minute window before it never matched once a millisecond had
passed. approvalDue() makes an on-approval release awaiting approval due
for as long as it waits. The test now reads notifications three hours
after filing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>

…he host list and DCR switch at authorize (#144)

Review of #178, findings 1-5.

1. Document clients are capped (5,000; 503 temporarily_unavailable for a
   new one beyond it) and pruned after a day with no connection and no
   fetch (pruneCimdClients); the hourly oauth.clients.prune job prunes
   DCR and document clients in alternate hours, on the :17 watermark.
2. cimd-discovery.ts wraps the plugin's discovery: a stored client
   validated within 60 min is served from its row with no fetch on every
   runtime; budgets are spent only before a real fetch (20/min per
   trusted caller address; 30/min per origin and 120/min in all only for
   documents not stored yet); a stored client is served from its row when
   a budget is spent. oauth-cimd-policy.ts is removed.
3. Private-use redirect schemes are accepted for native and public
   clients when reverse-domain or known (cursor, vscode,
   CLOUDHAL_MCP_REDIRECT_SCHEMES), matched exactly; dangerous schemes and
   http look-alikes are always refused; one bad entry refuses the whole
   registration. Cursor 3.14.27's observed DCR body registers.
4. validateRedirectUri applies CLOUDHAL_MCP_CLIENT_HOSTS to every client
   at every authorization; document hosts off the list resolve to none.
5. With CLOUDHAL_MCP_DCR=off, /oauth2/authorize refuses clients DCR
   stored earlier; their existing connections keep working.

New shared suite testing-mcp-oauth-bounds.ts on sqlite and D1; each case
fails on d363160. Hardening guide, self-host table, compose and
.env.example, ADR-0045 and the changeset updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>

…ding (#144)

Review round 2 of #178, item 7. approvalDue now reads the release's
linked approval request: an on-approval release awaiting approval is due
only while that request is pending and unexpired. After the request's
24 h TTL nobody can approve it, so nobody keeps a notification for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>

…und 2 (#144)

Review round 2 of #178.

1. The plugin's own fetch windows are set out of reach and its cache is
   off, so the stored row is the only cache and Cloudhal's rate_limits
   budgets the only budgets, on Node's long-lived instance too. A
   declined plugin fetch serves a stored row younger than 24 h.
2. At the cap a new document evicts the oldest grantless client not
   fetched for 10 min (else 503). The host list and the well-known
   document hosts (claude.ai, claude.com, chatgpt.com, openai.com,
   vscode.dev, github.com) are exempt from the cap and from eviction.
   Grantless document clients are pruned after 3 h, in up to four
   batches of 50 per run; DCR and CIMD are pruned every run.
3. The caller's own budget comes first and answers 429, never a stale
   row. A failed refetch is recorded on the row and refuses the client
   until a fetch succeeds.
4. Migration 0032_oauth_client_kind_index on
   oauthClient (clientDiscoveryId, updatedAt). The cap count runs only
   for a new document, after the per-address hit.
5. CIMD-off keeps cutting existing document connections (conservative);
   documented next to DCR-off.
6. Consent screen: a private-use redirect reads as an app on this
   computer; the title puts the host first; at most two combining marks
   per character; look-alikes are compared after NFKC plus a small
   confusable map, and flagged only for the CIMD well-known names, and
   not when the client is a document on that client's real host. New
   strings in en; the other languages are machine drafts.
8. Test: application_type web with a private-use redirect is refused.

Each fix has a test that fails on be319b8, except 8, which guards a
provider rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>

… hardening (#144)

Review round 3 of #178.

1. Eviction matched exempt hosts with `clientId LIKE 'https://%.host/%'`.
   In SQLite `%` spans `/`, so https://junk.example/x.claude.ai/c.json
   passed for claude.ai and was never evicted, which brought the cap
   lockout back. evictCimdClient now reads the oldest grantless
   candidates and judges each by `new URL(clientId).hostname` with the
   same isExempt as admission. It deletes the pick in one atomic batch
   that re-checks the predicate (`clientId IN (?)`).
2. The plugin's cache size, which also bounds its per-origin and
   per-client fetch state, goes from 500 to 10,000.
3. oauthClientsPruneJob takes the deployment's limits (dcrUnusedDays,
   cimdUnusedHours). Test: 120 rows pruned in one run.
4. Test: eviction never removes a client with a live grant, nor a
   well-known host's row older than evictMinutes.
5. Look-alike names are folded with NFKD and their combining marks
   dropped (Cláude, Clȧude), with Armenian, Cherokee and Latin small
   capital look-alikes added to the map. A UTS #39 skeleton stays a
   follow-up.
6. Self-host guide: behind a reverse proxy without
   CLOUDHAL_BEHIND_PROXY=1, every client shares the proxy's rate-limit
   bucket.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Madraka <8898640+Madraka@users.noreply.github.com>