From cf5a0fcee15e9d9748e7a074d2bac073b9918203 Mon Sep 17 00:00:00 2001
From: Ayush7614 <ayushknj3@gmail.com>
Date: Wed, 7 Oct 2026 13:43:52 +0530
Subject: [PATCH 1/3] =?UTF-8?q?fix(server):=20harden=20the=20production=20?=
 =?UTF-8?q?edge=20=E2=80=94=20framing=20headers,=20per-client=20sign-in=20?=
 =?UTF-8?q?limits,=20DB=20readiness?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The API sent only nosniff/referrer/no-store while serving bearer-equivalent
signed links (file bytes, browser preview/console) that users open in a
browser: any third-party page could frame them and injected markup in HTML
responses ran unsandboxed. The sign-in limiter was one process-global
30/minute counter, so a single hostile client could lock every legitimate
user out. /api/health always answered ok, so deploys received traffic with
the database unreachable.

- Route-aware security headers (security-headers.ts): strict CSP for
  JSON/HTML, console allowances preserved plus frame-ancestors allowlist
  built from the configured clients (the web app iframes console and PDFs
  cross-origin, so DENY/SAMEORIGIN would break it), framing-only policy on
  byte responses, Permissions-Policy lockdown, HSTS when publicUrl is https.
- Per-client sign-in budget (10/min via the existing rate-limit store/key
  helpers) replacing the global counter.
- GET /api/ready probing SELECT 1 with 503 fail-closed; render.yaml now
  gates traffic on it. /api/health semantics unchanged.
- 11 regression tests in tests/server-edge.test.ts.
---
 apps/server/src/app.ts              |  55 ++++---
 apps/server/src/db.ts               |   4 +
 apps/server/src/rate-limit.ts       |  10 ++
 apps/server/src/security-headers.ts | 101 +++++++++++++
 render.yaml                         |   4 +-
 tests/server-edge.test.ts           | 214 ++++++++++++++++++++++++++++
 6 files changed, 371 insertions(+), 17 deletions(-)
 create mode 100644 apps/server/src/security-headers.ts
 create mode 100644 tests/server-edge.test.ts

diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index 258d7a22b..c86b9ea31 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -24,7 +24,8 @@ import { AgentService } from "./engine/service.ts";
 import { AppError } from "./errors.ts";
 import { Files } from "./files.ts";
 import { GoogleAuth } from "./google-auth.ts";
-import { rateLimit } from "./rate-limit.ts";
+import { createRateLimitStore, rateLimit, resolveRequestKey } from "./rate-limit.ts";
+import { baseSecurityHeaders, contentSecurityPolicy, securityHeaders } from "./security-headers.ts";
 import { WorkspaceService } from "./workspace.ts";
 
 export async function createApp(
@@ -51,12 +52,12 @@ export async function createApp(
   const runtime = makeRuntime(config, agent, auth, intelligence);
   const app = new Hono<{ Variables: { owner: string } }>();
   const origins = new Set([...config.allowedOrigins, new URL(config.publicUrl).origin]);
+  // Hardening first so rejected requests (origin gate, rate limits, validation)
+  // carry the same headers as successful ones.
+  app.use("*", securityHeaders(config));
   app.use("*", async (c, next) => {
     const origin = c.req.header("origin");
     if (origin && !origins.has(origin)) return c.json({ error: "Origin is not allowed" }, 403);
-    c.header("X-Content-Type-Options", "nosniff");
-    c.header("Referrer-Policy", "no-referrer");
-    c.header("Cache-Control", "no-store");
     await next();
   });
   app.use(
@@ -103,14 +104,28 @@ export async function createApp(
       browserConfigured: Boolean(config.workerUrl && config.workerToken),
     }),
   );
-  let loginWindow = 0,
-    loginAttempts = 0;
-  app.post("/api/session", async (c) => {
-    if (Date.now() - loginWindow > 60000) {
-      loginWindow = Date.now();
-      loginAttempts = 0;
+  app.get("/api/ready", async (c) => {
+    // Load balancers cannot authenticate, so readiness stays open like health —
+    // but unlike health it actually probes the store, so a pod whose database
+    // is unreachable stops receiving traffic instead of serving 500s.
+    try {
+      await db.ping();
+      return c.json({ ok: true, mode: config.mode, database: "up" });
+    } catch {
+      return c.json({ ok: false, mode: config.mode, database: "down" }, 503);
     }
-    if (++loginAttempts > 30)
+  });
+  // Sign-in attempts are cheap for an attacker (one JSON body) and expensive to
+  // get wrong, so each client gets its own small bucket. The previous limiter
+  // was a single process-global 30/minute counter shared by every address,
+  // which meant one hostile client could lock every legitimate user out.
+  const signInAttempts = createRateLimitStore({
+    windowMs: 60_000,
+    maxRequests: 10,
+    maxEntries: 5_000,
+  });
+  app.post("/api/session", async (c) => {
+    if (!signInAttempts.take(resolveRequestKey(c, Boolean(config.trustProxy)), Date.now()))
       throw new AppError("Too many sign-in attempts. Try again in a minute.", 429);
     const body = z.object({ accessKey: z.string().optional() }).parse(await c.req.json());
     const session = await auth.session(body.accessKey);
@@ -319,10 +334,8 @@ export async function createApp(
   });
   app.get("/api/browsers/:id/console", async (c) => {
     await browser.get(c.get("owner"), c.req.param("id"));
-    c.header(
-      "Content-Security-Policy",
-      "default-src 'self'; img-src 'self' blob:; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'",
-    );
+    // Content-Security-Policy for this page comes from the security-headers
+    // middleware, which preserves these allowances and adds framing protection.
     return c.html(browser.console(c.get("owner"), c.req.param("id")));
   });
   app.post("/api/browsers/:id/console", async (c) => {
@@ -345,7 +358,17 @@ export async function createApp(
         },
       }),
     );
-    return new Response(body, { status: response.status, headers: response.headers });
+    // A returned Response bypasses context headers, so apply the edge policy
+    // explicitly instead of inheriting whatever the runtime happened to set.
+    const headers = new Headers(response.headers);
+    for (const [name, value] of Object.entries(baseSecurityHeaders(config)))
+      if (!headers.has(name)) headers.set(name, value);
+    if (!headers.has("Content-Security-Policy"))
+      headers.set(
+        "Content-Security-Policy",
+        contentSecurityPolicy(c.req.method, c.req.path, config),
+      );
+    return new Response(body, { status: response.status, headers });
   });
   app.get("/", (c) =>
     c.json({ name: "OpenMuse", app: "http://localhost:8081", health: "/api/health" }),
diff --git a/apps/server/src/db.ts b/apps/server/src/db.ts
index 4f057b6c9..2034e548a 100644
--- a/apps/server/src/db.ts
+++ b/apps/server/src/db.ts
@@ -131,6 +131,10 @@ export class Store {
       `UPDATE records SET data=data || '{"status":"outcome_unknown","error":"Server restarted during execution. Check the provider before creating another action."}'::jsonb WHERE kind='actions' AND data->>'status'='executing'`,
     );
   }
+  /** Liveness probe for the readiness endpoint; rejects when the database is unreachable. */
+  async ping(): Promise<void> {
+    await this.db.query("SELECT 1");
+  }
   async take<T>(owner: string, kind: string, id: string): Promise<T | null> {
     const result = await this.db.query(
       "DELETE FROM records WHERE owner=$1 AND kind=$2 AND id=$3 RETURNING data",
diff --git a/apps/server/src/rate-limit.ts b/apps/server/src/rate-limit.ts
index 95c1f5ff6..e4189bd49 100644
--- a/apps/server/src/rate-limit.ts
+++ b/apps/server/src/rate-limit.ts
@@ -70,6 +70,16 @@ function connectionAddress(c: Context): string | undefined {
   }
 }
 
+/** Per-client bucket key for routes with their own limiter (e.g. sign-in). */
+export function resolveRequestKey(c: Context, trustProxy: boolean): string {
+  return resolveClientKey({
+    trustProxy,
+    forwardedFor: c.req.header("x-forwarded-for"),
+    realIp: c.req.header("x-real-ip"),
+    connectionAddress: connectionAddress(c),
+  });
+}
+
 export function rateLimit(
   trustProxy: boolean,
   options: RateLimitStoreOptions & { getAddress?: (c: Context) => string | undefined } = {},
diff --git a/apps/server/src/security-headers.ts b/apps/server/src/security-headers.ts
new file mode 100644
index 000000000..cf17e50ed
--- /dev/null
+++ b/apps/server/src/security-headers.ts
@@ -0,0 +1,101 @@
+import type { Context } from "hono";
+import type { Config } from "./config.ts";
+
+/**
+ * Response hardening for the API edge.
+ *
+ * The API previously sent only `X-Content-Type-Options`, `Referrer-Policy`
+ * and `Cache-Control`. Signed file/preview/console links are bearer-equivalent
+ * URLs that users open in a browser, so without framing and content policies
+ * any third-party page could embed them (clickjacking) and any injected markup
+ * in an HTML response would run unsandboxed.
+ *
+ * Two first-party embeds constrain the design, both verified in the clients:
+ * - `apps/mobile/src/BrowserConsole.web.tsx` loads `/api/browsers/:id/console`
+ *   in an `<iframe>` from the web-app origin.
+ * - `apps/mobile/src/PdfReader.web.tsx` loads `/api/files/:id/content` (PDF)
+ *   in an `<iframe>` from the web-app origin.
+ * A blanket `DENY`/`SAMEORIGIN` would break those embeds because the web app
+ * runs on a different origin than the API, so framing is restricted with a
+ * `frame-ancestors` allowlist built from the configured clients instead, and
+ * byte responses (PDF/PNG) carry framing protection only — no content
+ * directives that could interfere with plugin/image rendering.
+ */
+
+/** First-party origins permitted to frame API responses. */
+export function frameAncestorSources(config: Config): string[] {
+  const sources = ["'self'"];
+  for (const entry of [...config.allowedOrigins, config.publicUrl]) {
+    const trimmed = entry.trim();
+    if (!trimmed) continue;
+    try {
+      const origin = new URL(trimmed).origin;
+      if (origin !== "null" && !sources.includes(origin)) sources.push(origin);
+    } catch {
+      // Unparseable entries never match an Origin header either; leaving them
+      // out keeps the directive valid instead of breaking the whole header.
+    }
+  }
+  return sources;
+}
+
+export function frameAncestorsDirective(config: Config): string {
+  return `frame-ancestors ${frameAncestorSources(config).join(" ")}`;
+}
+
+/** Directives preserved from the browser-console route when it is centralized here. */
+export const consoleContentPolicyBase =
+  "default-src 'self'; img-src 'self' blob:; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'";
+
+export function contentSecurityPolicy(method: string, path: string, config: Config): string {
+  const framing = frameAncestorsDirective(config);
+  // The console is an HTML page that fetches its preview over the network, so
+  // it keeps its script/style allowances and only gains framing protection.
+  if (method === "GET" && /^\/api\/browsers\/[^/]+\/console$/.test(path))
+    return `${consoleContentPolicyBase}; ${framing}`;
+  // Byte responses: framing protection only, so plugin/image rendering is untouched.
+  if (
+    method === "GET" &&
+    (/^\/api\/files\/[^/]+\/content$/.test(path) || /^\/api\/browsers\/[^/]+\/preview$/.test(path))
+  )
+    return framing;
+  // JSON, OAuth pages, and everything else: nothing may load or submit anywhere.
+  return `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+}
+
+/** Headers that are identical on every response. */
+export function baseSecurityHeaders(config: Config): Record<string, string> {
+  const headers: Record<string, string> = {
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "Cache-Control": "no-store",
+    // The API serves data, never media capture: deny the powerful features outright.
+    "Permissions-Policy":
+      "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
+      "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
+      "autoplay=(), encrypted-media=(), fullscreen=(), picture-in-picture=()",
+  };
+  // Browsers ignore HSTS on plaintext, and emitting it there would be a lie in
+  // local/sample setups, so only advertise it when the public URL is https.
+  try {
+    if (new URL(config.publicUrl).protocol === "https:")
+      headers["Strict-Transport-Security"] = "max-age=15552000; includeSubDomains";
+  } catch {
+    // An invalid public URL fails fast in createApp before this ever matters.
+  }
+  return headers;
+}
+
+/**
+ * Sets hardening headers on every response, including error responses produced
+ * by `onError`. Handlers that return a raw `Response` (the CopilotKit stream
+ * passthrough) bypass context headers and must apply these explicitly.
+ */
+export function securityHeaders(config: Config) {
+  const base = baseSecurityHeaders(config);
+  return async (c: Context, next: () => Promise<void>) => {
+    for (const [name, value] of Object.entries(base)) c.header(name, value);
+    c.header("Content-Security-Policy", contentSecurityPolicy(c.req.method, c.req.path, config));
+    await next();
+  };
+}
diff --git a/render.yaml b/render.yaml
index 62999493c..b797ef89a 100644
--- a/render.yaml
+++ b/render.yaml
@@ -9,7 +9,9 @@ services:
     # `corepack enable` dies with EROFS. Render's pnpm honors packageManager.
     buildCommand: pnpm install --frozen-lockfile && pnpm build:server
     startCommand: pnpm start
-    healthCheckPath: /api/health
+    # Readiness (not liveness): gates traffic on the database actually answering,
+    # so a deploy whose Postgres is unreachable never receives requests.
+    healthCheckPath: /api/ready
     disk:
       name: openmuse-data
       mountPath: /var/data
diff --git a/tests/server-edge.test.ts b/tests/server-edge.test.ts
new file mode 100644
index 000000000..3d9665bec
--- /dev/null
+++ b/tests/server-edge.test.ts
@@ -0,0 +1,214 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, before, test } from "node:test";
+import type { Context } from "hono";
+import { createApp } from "../apps/server/src/app.ts";
+import type { Config } from "../apps/server/src/config.ts";
+import { createStore, type Store } from "../apps/server/src/db.ts";
+import { resolveRequestKey } from "../apps/server/src/rate-limit.ts";
+import {
+  baseSecurityHeaders,
+  contentSecurityPolicy,
+  frameAncestorSources,
+} from "../apps/server/src/security-headers.ts";
+import { createSamplePdf } from "../packages/integrations/src/pdf.ts";
+
+let db: Store,
+  app: Awaited<ReturnType<typeof createApp>>["app"],
+  auth: Awaited<ReturnType<typeof createApp>>["auth"],
+  agent: Awaited<ReturnType<typeof createApp>>["agent"],
+  config: Config,
+  token: string,
+  directory: string;
+
+const headers = () => ({ Authorization: `Bearer ${token}`, "Content-Type": "application/json" });
+
+before(async () => {
+  directory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-"));
+  db = await createStore();
+  config = {
+    mode: "sample",
+    port: 8787,
+    host: "127.0.0.1",
+    publicUrl: "http://localhost:8787",
+    dataDir: directory,
+    agentBackend: "sample",
+    intelligenceApiKey: "test-project-key-never-sent",
+    googleRedirectUri: "http://localhost:8787/api/google/callback",
+    allowedOrigins: ["http://localhost:8081"],
+  };
+  ({ app, auth, agent } = await createApp(db, config));
+  const response = await app.request("/api/session", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: "{}",
+  });
+  assert.equal(response.status, 200);
+  token = (await response.json()).token;
+});
+
+after(async () => {
+  await db.close();
+  await rm(directory, { recursive: true, force: true });
+});
+
+const framing = "frame-ancestors 'self' http://localhost:8081 http://localhost:8787";
+const strictCsp = `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+
+test("JSON responses carry the full hardening headers and no HSTS on plaintext", async () => {
+  const response = await app.request("/api/health", { headers: headers() });
+  assert.equal(response.status, 200);
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+  assert.equal(response.headers.get("referrer-policy"), "no-referrer");
+  assert.equal(response.headers.get("cache-control"), "no-store");
+  assert.equal(response.headers.get("content-security-policy"), strictCsp);
+  assert.ok(
+    response.headers.get("permissions-policy")?.includes("camera=()"),
+    "powerful features are denied",
+  );
+  assert.equal(response.headers.get("strict-transport-security"), null);
+});
+
+test("rejected origins still receive the hardening headers", async () => {
+  const response = await app.request("/api/workspace", {
+    headers: { ...headers(), Origin: "https://unrelated.example" },
+  });
+  assert.equal(response.status, 403);
+  assert.equal(response.headers.get("x-content-type-options"), "nosniff");
+  assert.equal(response.headers.get("content-security-policy"), strictCsp);
+});
+
+test("signed file bytes allow first-party framing but no content directives", async () => {
+  const bytes = await createSamplePdf();
+  const file = await agent.files.import("local-user", "edge.pdf", bytes, "fixture");
+  const url = new URL(auth.sign("local-user", `/api/files/${file.id}/content`));
+  const response = await app.request(`${url.pathname}${url.search}`);
+  assert.equal(response.status, 200);
+  assert.equal(response.headers.get("content-type"), "application/pdf");
+  assert.equal(response.headers.get("content-security-policy"), framing);
+});
+
+test("readiness reports the database instead of a static ok", async () => {
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 200);
+  assert.deepEqual(await response.json(), { ok: true, mode: "sample", database: "up" });
+});
+
+test("readiness fails closed when the database is unreachable", async (t) => {
+  t.mock.method(db, "ping", async () => {
+    throw new Error("postgres gone");
+  });
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 503);
+  assert.deepEqual(await response.json(), { ok: false, mode: "sample", database: "down" });
+});
+
+test("sign-in attempts are budgeted per client instead of globally", async () => {
+  let liveDb: Store | undefined;
+  let liveDirectory = "";
+  try {
+    liveDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-live-"));
+    liveDb = await createStore();
+    const liveConfig: Config = {
+      ...config,
+      mode: "live",
+      agentBackend: "model",
+      dataDir: liveDirectory,
+      accessKey: "a".repeat(24),
+      trustProxy: true,
+    };
+    const { app: live } = await createApp(liveDb, liveConfig);
+    const signIn = (ip: string) =>
+      live.request("/api/session", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Forwarded-For": ip },
+        body: "{}",
+      });
+    // Wrong keys still count (the limiter runs before auth), but cheaply: no
+    // workspace warmup happens on a 401 path.
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn("203.0.113.7")).status, 401);
+    assert.equal((await signIn("203.0.113.7")).status, 429);
+    // A different address is unaffected: the old global limiter would have
+    // locked this client out too.
+    assert.equal((await signIn("198.51.100.9")).status, 401);
+  } finally {
+    await liveDb?.close();
+    if (liveDirectory) await rm(liveDirectory, { recursive: true, force: true });
+  }
+});
+
+test("HSTS is advertised only when the public URL is https", async () => {
+  let httpsDb: Store | undefined;
+  let httpsDirectory = "";
+  try {
+    httpsDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-https-"));
+    httpsDb = await createStore();
+    const httpsConfig: Config = {
+      ...config,
+      publicUrl: "https://example.com",
+      googleRedirectUri: "https://example.com/api/google/callback",
+      dataDir: httpsDirectory,
+    };
+    const { app: https } = await createApp(httpsDb, httpsConfig);
+    const response = await https.request("/api/health");
+    assert.equal(
+      response.headers.get("strict-transport-security"),
+      "max-age=15552000; includeSubDomains",
+    );
+    assert.equal(
+      response.headers.get("content-security-policy"),
+      `default-src 'none'; base-uri 'none'; form-action 'none'; ` +
+        `frame-ancestors 'self' http://localhost:8081 https://example.com`,
+    );
+  } finally {
+    await httpsDb?.close();
+    if (httpsDirectory) await rm(httpsDirectory, { recursive: true, force: true });
+  }
+});
+
+test("contentSecurityPolicy keeps console allowances and framing per route", () => {
+  const consolePolicy = contentSecurityPolicy("GET", "/api/browsers/abc/console", config);
+  assert.ok(consolePolicy.includes("script-src 'unsafe-inline'"));
+  assert.ok(consolePolicy.includes(framing));
+  assert.equal(contentSecurityPolicy("GET", "/api/browsers/abc/preview", config), framing);
+  assert.equal(contentSecurityPolicy("GET", "/api/files/abc/content", config), framing);
+  assert.equal(contentSecurityPolicy("POST", "/api/browsers/abc/console", config), strictCsp);
+  assert.equal(contentSecurityPolicy("GET", "/api/workspace", config), strictCsp);
+});
+
+test("frameAncestorSources trims, dedupes, and drops unparseable entries", () => {
+  assert.deepEqual(frameAncestorSources(config), [
+    "'self'",
+    "http://localhost:8081",
+    "http://localhost:8787",
+  ]);
+  assert.deepEqual(
+    frameAncestorSources({
+      ...config,
+      allowedOrigins: [" https://a.example/extra ,", "https://a.example", "not a url", ""],
+    }),
+    ["'self'", "https://a.example", "http://localhost:8787"],
+  );
+});
+
+test("baseSecurityHeaders gates HSTS on the public scheme", () => {
+  assert.equal(baseSecurityHeaders(config)["Strict-Transport-Security"], undefined);
+  assert.equal(
+    baseSecurityHeaders({ ...config, publicUrl: "https://example.com" })[
+      "Strict-Transport-Security"
+    ],
+    "max-age=15552000; includeSubDomains",
+  );
+});
+
+test("resolveRequestKey honors proxy headers only when trusted", () => {
+  const context = (forwardedFor?: string) =>
+    ({
+      req: { header: (name: string) => (name === "x-forwarded-for" ? forwardedFor : null) },
+    }) as unknown as Context;
+  assert.ok(resolveRequestKey(context("203.0.113.7"), true).includes("203.0.113.7"));
+  assert.equal(resolveRequestKey(context("203.0.113.7"), false).includes("203.0.113.7"), false);
+});

From 0c989add301330657d5dd8498d2349dcb6fe1ab2 Mon Sep 17 00:00:00 2001
From: Ayush7614 <ayushknj3@gmail.com>
Date: Thu, 8 Oct 2026 14:15:35 +0530
Subject: [PATCH 2/3] =?UTF-8?q?fix(server):=20address=20review=20on=20edge?=
 =?UTF-8?q?=20hardening=20=E2=80=94=20proxy-aware=20limits,=20readiness,?=
 =?UTF-8?q?=20headers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .env.example                        |  2 +
 apps/server/src/app.ts              | 93 +++++++++++++++++++----------
 apps/server/src/rate-limit.ts       | 41 +++++++++----
 apps/server/src/security-headers.ts | 84 ++++++++++++++++++++++----
 render.yaml                         | 10 +++-
 tests/rate-limit.test.ts            | 32 +++++++---
 tests/server-edge.test.ts           | 84 ++++++++++++++++++++++++++
 7 files changed, 282 insertions(+), 64 deletions(-)

diff --git a/.env.example b/.env.example
index 4ffae83bb..f55df2038 100644
--- a/.env.example
+++ b/.env.example
@@ -10,6 +10,8 @@ DATA_DIR=.openmuse
 TASK_WORKER_ENABLED=true
 # Rate limiting keys on the socket address. Set true only behind a reverse proxy that
 # overwrites X-Forwarded-For; otherwise callers can spoof it.
+# The per-client sign-in budget (10/min) and shared API budget depend on this:
+# behind a proxy without TRUST_PROXY=true every user shares one bucket.
 # TRUST_PROXY=false
 
 # General delegated work: select AGENT_BACKEND=model and a provider/model.
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index c86b9ea31..d9cfd0a3e 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -25,7 +25,12 @@ import { AppError } from "./errors.ts";
 import { Files } from "./files.ts";
 import { GoogleAuth } from "./google-auth.ts";
 import { createRateLimitStore, rateLimit, resolveRequestKey } from "./rate-limit.ts";
-import { baseSecurityHeaders, contentSecurityPolicy, securityHeaders } from "./security-headers.ts";
+import {
+  baseSecurityHeaders,
+  contentSecurityPolicy,
+  isSignedRoute,
+  securityHeaders,
+} from "./security-headers.ts";
 import { WorkspaceService } from "./workspace.ts";
 
 export async function createApp(
@@ -76,6 +81,39 @@ export async function createApp(
       onError: (c) => c.json({ error: "Request is too large; PDFs must be 10 MB or smaller" }, 413),
     }),
   );
+  // Health probes stay outside the shared budget so load-balancer checks are
+  // never turned away on a busy minute (rateLimit() also bypasses them, but
+  // registering them first makes the exemption explicit).
+  app.get("/api/health", (c) =>
+    c.json({
+      ok: true,
+      mode: config.mode,
+      agentConfigured: agentConfigured(config),
+      browserConfigured: Boolean(config.workerUrl && config.workerToken),
+    }),
+  );
+  app.get("/api/ready", async (c) => {
+    // Load balancers cannot authenticate, so readiness stays open like health.
+    // With the default embedded PGlite store this only proves the process is
+    // alive; with DATABASE_URL set it proves Postgres actually answers.
+    // PGlite runs one query at a time, so bound the probe: a slow query
+    // elsewhere must not make Render restart a healthy server.
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = new Promise<never>(
+      (_, reject) => (timer = setTimeout(() => reject(new Error("readiness timeout")), 1500)),
+    );
+    // Attach a noop handler up front so the rejection is never unhandled when
+    // the probe wins the race and the timer fires later (cleared below anyway).
+    timeout.catch(() => {});
+    try {
+      await Promise.race([db.ping(), timeout]);
+      return c.json({ ok: true, mode: config.mode, database: "up" });
+    } catch {
+      return c.json({ ok: false, mode: config.mode, database: "down" }, 503);
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+    }
+  });
   app.use("/api/*", rateLimit(Boolean(config.trustProxy)));
   app.onError((error, c) => {
     if (error instanceof z.ZodError)
@@ -96,36 +134,30 @@ export async function createApp(
       502,
     );
   });
-  app.get("/api/health", (c) =>
-    c.json({
-      ok: true,
-      mode: config.mode,
-      agentConfigured: agentConfigured(config),
-      browserConfigured: Boolean(config.workerUrl && config.workerToken),
-    }),
-  );
-  app.get("/api/ready", async (c) => {
-    // Load balancers cannot authenticate, so readiness stays open like health —
-    // but unlike health it actually probes the store, so a pod whose database
-    // is unreachable stops receiving traffic instead of serving 500s.
-    try {
-      await db.ping();
-      return c.json({ ok: true, mode: config.mode, database: "up" });
-    } catch {
-      return c.json({ ok: false, mode: config.mode, database: "down" }, 503);
-    }
-  });
   // Sign-in attempts are cheap for an attacker (one JSON body) and expensive to
-  // get wrong, so each client gets its own small bucket. The previous limiter
-  // was a single process-global 30/minute counter shared by every address,
-  // which meant one hostile client could lock every legitimate user out.
-  const signInAttempts = createRateLimitStore({
+  // get wrong, so each client gets its own small bucket (10/min), backed by a
+  // generous overall cap (100/min) so a flood of distinct spoofed addresses
+  // cannot exhaust the server. Per-client keys depend on TRUST_PROXY: behind a
+  // proxy without it, every user shares one bucket, so deploy with
+  // TRUST_PROXY=true (see render.yaml / .env.example).
+  const signInPerClient = createRateLimitStore({
     windowMs: 60_000,
     maxRequests: 10,
     maxEntries: 5_000,
   });
+  const signInOverall = createRateLimitStore({
+    windowMs: 60_000,
+    maxRequests: 100,
+    maxEntries: 2,
+  });
   app.post("/api/session", async (c) => {
-    if (!signInAttempts.take(resolveRequestKey(c, Boolean(config.trustProxy)), Date.now()))
+    const now = Date.now();
+    const clientAllowed = signInPerClient.take(
+      resolveRequestKey(c, Boolean(config.trustProxy)),
+      now,
+    );
+    const overallAllowed = signInOverall.take("global", now);
+    if (!clientAllowed || !overallAllowed)
       throw new AppError("Too many sign-in attempts. Try again in a minute.", 429);
     const body = z.object({ accessKey: z.string().optional() }).parse(await c.req.json());
     const session = await auth.session(body.accessKey);
@@ -146,10 +178,9 @@ export async function createApp(
     );
   });
   app.use("/api/*", async (c, next) => {
-    const signedRoute =
-      /^\/api\/files\/[^/]+\/content$|^\/api\/browsers\/[^/]+\/(?:preview|console)$/.test(
-        c.req.path,
-      );
+    // Shared with security-headers.ts so a new signed route cannot get the
+    // strictest CSP by forgetting one of the two lists.
+    const signedRoute = isSignedRoute(c.req.path);
     const owner =
       signedRoute && c.req.query("signature")
         ? auth.verify(new URL(c.req.url))
@@ -361,7 +392,9 @@ export async function createApp(
     // A returned Response bypasses context headers, so apply the edge policy
     // explicitly instead of inheriting whatever the runtime happened to set.
     const headers = new Headers(response.headers);
-    for (const [name, value] of Object.entries(baseSecurityHeaders(config)))
+    for (const [name, value] of Object.entries(
+      baseSecurityHeaders(config, c.req.method, c.req.path),
+    ))
       if (!headers.has(name)) headers.set(name, value);
     if (!headers.has("Content-Security-Policy"))
       headers.set(
diff --git a/apps/server/src/rate-limit.ts b/apps/server/src/rate-limit.ts
index e4189bd49..de741fede 100644
--- a/apps/server/src/rate-limit.ts
+++ b/apps/server/src/rate-limit.ts
@@ -31,7 +31,15 @@ export function createRateLimitStore(options: RateLimitStoreOptions = {}) {
     if (!entry) {
       if (entries.size >= maxEntries) {
         cleanupExpired(now);
-        if (entries.size >= maxEntries) return false;
+        if (entries.size >= maxEntries) {
+          // Evict the oldest entry instead of locking new keys out: the map
+          // preserves insertion order, so the first key is the stalest bucket.
+          // Failing closed here would reintroduce the lockout a per-client
+          // limiter is meant to prevent (one crowded window blocks newcomers).
+          const oldest = entries.keys().next();
+          if (!oldest.done) entries.delete(oldest.value);
+          else return false;
+        }
       }
       entry = { count: 0, expiresAt: now + windowMs };
       entries.set(key, entry);
@@ -45,6 +53,8 @@ export function createRateLimitStore(options: RateLimitStoreOptions = {}) {
 
 // This limiter runs before authentication, so the key must never be derived from
 // caller-supplied credentials (e.g. Authorization): any string would mint a new bucket.
+// When trusted, the client address is the hop our own proxy appended (the last
+// entry in X-Forwarded-For), not the leftmost entry, which any caller can spoof.
 export function resolveClientKey(input: {
   trustProxy: boolean;
   forwardedFor?: string;
@@ -52,8 +62,12 @@ export function resolveClientKey(input: {
   connectionAddress?: string;
 }): string {
   if (input.trustProxy) {
-    const forwarded = input.forwardedFor?.split(",")[0]?.trim();
-    if (forwarded) return `proxy:${forwarded}`;
+    const hops = input.forwardedFor
+      ?.split(",")
+      .map((hop) => hop.trim())
+      .filter(Boolean);
+    const lastHop = hops?.length ? hops[hops.length - 1] : undefined;
+    if (lastHop) return `proxy:${lastHop}`;
     if (input.realIp) return `proxy:${input.realIp}`;
   }
   return `conn:${input.connectionAddress ?? "unknown"}`;
@@ -71,12 +85,16 @@ function connectionAddress(c: Context): string | undefined {
 }
 
 /** Per-client bucket key for routes with their own limiter (e.g. sign-in). */
-export function resolveRequestKey(c: Context, trustProxy: boolean): string {
+export function resolveRequestKey(
+  c: Context,
+  trustProxy: boolean,
+  getAddress: (c: Context) => string | undefined = connectionAddress,
+): string {
   return resolveClientKey({
     trustProxy,
     forwardedFor: c.req.header("x-forwarded-for"),
     realIp: c.req.header("x-real-ip"),
-    connectionAddress: connectionAddress(c),
+    connectionAddress: getAddress(c),
   });
 }
 
@@ -87,12 +105,13 @@ export function rateLimit(
   const store = createRateLimitStore(options);
   const getAddress = options.getAddress ?? connectionAddress;
   return async (c: Context, next: () => Promise<void>) => {
-    const key = resolveClientKey({
-      trustProxy,
-      forwardedFor: c.req.header("x-forwarded-for"),
-      realIp: c.req.header("x-real-ip"),
-      connectionAddress: getAddress(c),
-    });
+    // Health probes must never consume the shared budget: load-balancer checks
+    // would otherwise be turned away on a busy minute and mark the server down.
+    if (c.req.path === "/api/health" || c.req.path === "/api/ready") {
+      await next();
+      return;
+    }
+    const key = resolveRequestKey(c, trustProxy, getAddress);
     if (!store.take(key, Date.now()))
       throw new AppError("Too many requests. Try again in a minute.", 429);
     await next();
diff --git a/apps/server/src/security-headers.ts b/apps/server/src/security-headers.ts
index cf17e50ed..5f777c9c2 100644
--- a/apps/server/src/security-headers.ts
+++ b/apps/server/src/security-headers.ts
@@ -43,6 +43,33 @@ export function frameAncestorsDirective(config: Config): string {
   return `frame-ancestors ${frameAncestorSources(config).join(" ")}`;
 }
 
+/** Single source of truth for bearer-equivalent signed routes (see app.ts auth gate). */
+export const signedFileContentPattern = /^\/api\/files\/[^/]+\/content$/;
+export const browserPreviewPattern = /^\/api\/browsers\/[^/]+\/preview$/;
+export const browserConsolePattern = /^\/api\/browsers\/[^/]+\/console$/;
+
+export function isSignedRoute(path: string): boolean {
+  return (
+    signedFileContentPattern.test(path) ||
+    browserPreviewPattern.test(path) ||
+    browserConsolePattern.test(path)
+  );
+}
+
+export function isConsolePage(method: string, path: string): boolean {
+  return method === "GET" && browserConsolePattern.test(path);
+}
+
+export function isByteRoute(method: string, path: string): boolean {
+  return (
+    method === "GET" && (signedFileContentPattern.test(path) || browserPreviewPattern.test(path))
+  );
+}
+
+export function isFileDownload(method: string, path: string): boolean {
+  return method === "GET" && signedFileContentPattern.test(path);
+}
+
 /** Directives preserved from the browser-console route when it is centralized here. */
 export const consoleContentPolicyBase =
   "default-src 'self'; img-src 'self' blob:; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'";
@@ -51,29 +78,43 @@ export function contentSecurityPolicy(method: string, path: string, config: Conf
   const framing = frameAncestorsDirective(config);
   // The console is an HTML page that fetches its preview over the network, so
   // it keeps its script/style allowances and only gains framing protection.
-  if (method === "GET" && /^\/api\/browsers\/[^/]+\/console$/.test(path))
-    return `${consoleContentPolicyBase}; ${framing}`;
+  if (isConsolePage(method, path)) return `${consoleContentPolicyBase}; ${framing}`;
   // Byte responses: framing protection only, so plugin/image rendering is untouched.
-  if (
-    method === "GET" &&
-    (/^\/api\/files\/[^/]+\/content$/.test(path) || /^\/api\/browsers\/[^/]+\/preview$/.test(path))
-  )
-    return framing;
+  if (isByteRoute(method, path)) return framing;
   // JSON, OAuth pages, and everything else: nothing may load or submit anywhere.
   return `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
 }
 
+/** File downloads render in an iframe PDF viewer on web (PdfReader.web.tsx),
+ * whose fullscreen button needs the delegation, so `fullscreen` stays enabled there. */
+const defaultPermissionsPolicy =
+  "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
+  "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
+  "autoplay=(), encrypted-media=(), fullscreen=(), picture-in-picture=()";
+const filePermissionsPolicy =
+  "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
+  "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
+  "autoplay=(), encrypted-media=(), picture-in-picture=()";
+
+export function permissionsPolicy(method: string, path: string): string {
+  return isFileDownload(method, path) ? filePermissionsPolicy : defaultPermissionsPolicy;
+}
+
 /** Headers that are identical on every response. */
-export function baseSecurityHeaders(config: Config): Record<string, string> {
+export function baseSecurityHeaders(
+  config: Config,
+  method?: string,
+  path?: string,
+): Record<string, string> {
   const headers: Record<string, string> = {
     "X-Content-Type-Options": "nosniff",
     "Referrer-Policy": "no-referrer",
     "Cache-Control": "no-store",
     // The API serves data, never media capture: deny the powerful features outright.
     "Permissions-Policy":
-      "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=(), " +
-      "magnetometer=(), gyroscope=(), accelerometer=(), ambient-light-sensor=(), " +
-      "autoplay=(), encrypted-media=(), fullscreen=(), picture-in-picture=()",
+      method !== undefined && path !== undefined
+        ? permissionsPolicy(method, path)
+        : defaultPermissionsPolicy,
   };
   // Browsers ignore HSTS on plaintext, and emitting it there would be a lie in
   // local/sample setups, so only advertise it when the public URL is https.
@@ -90,12 +131,29 @@ export function baseSecurityHeaders(config: Config): Record<string, string> {
  * Sets hardening headers on every response, including error responses produced
  * by `onError`. Handlers that return a raw `Response` (the CopilotKit stream
  * passthrough) bypass context headers and must apply these explicitly.
+ *
+ * The framing directive only depends on config, so it (and every policy derived
+ * from it) is built once at startup instead of on every request.
  */
 export function securityHeaders(config: Config) {
+  const framing = frameAncestorsDirective(config);
+  const strictCsp = `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
+  const consoleCsp = `${consoleContentPolicyBase}; ${framing}`;
+  const byteCsp = framing;
   const base = baseSecurityHeaders(config);
+  const policyFor = (method: string, path: string): string => {
+    if (isConsolePage(method, path)) return consoleCsp;
+    if (isByteRoute(method, path)) return byteCsp;
+    return strictCsp;
+  };
   return async (c: Context, next: () => Promise<void>) => {
-    for (const [name, value] of Object.entries(base)) c.header(name, value);
-    c.header("Content-Security-Policy", contentSecurityPolicy(c.req.method, c.req.path, config));
+    const method = c.req.method;
+    const path = c.req.path;
+    for (const [name, value] of Object.entries(base)) {
+      if (name === "Permissions-Policy") c.header(name, permissionsPolicy(method, path));
+      else c.header(name, value);
+    }
+    c.header("Content-Security-Policy", policyFor(method, path));
     await next();
   };
 }
diff --git a/render.yaml b/render.yaml
index b797ef89a..201ce5f83 100644
--- a/render.yaml
+++ b/render.yaml
@@ -9,8 +9,9 @@ services:
     # `corepack enable` dies with EROFS. Render's pnpm honors packageManager.
     buildCommand: pnpm install --frozen-lockfile && pnpm build:server
     startCommand: pnpm start
-    # Readiness (not liveness): gates traffic on the database actually answering,
-    # so a deploy whose Postgres is unreachable never receives requests.
+    # Liveness + readiness: with the default embedded PGlite store this only
+    # proves the process is alive; with DATABASE_URL set it additionally gates
+    # traffic on Postgres actually answering.
     healthCheckPath: /api/ready
     disk:
       name: openmuse-data
@@ -20,6 +21,11 @@ services:
       # HOST must be 0.0.0.0 on Render, and OpenMuse only allows that in live mode.
       - key: HOST
         value: 0.0.0.0
+      # Behind Render's proxy every connection comes from the proxy address, so
+      # per-client rate limits (sign-in budget, shared API budget) must read the
+      # client IP our proxy appended to X-Forwarded-For.
+      - key: TRUST_PROXY
+        value: true
       - key: WORKSPACE_MODE
         value: live
       - key: AGENT_BACKEND
diff --git a/tests/rate-limit.test.ts b/tests/rate-limit.test.ts
index 30ed7871e..ad422fc2c 100644
--- a/tests/rate-limit.test.ts
+++ b/tests/rate-limit.test.ts
@@ -26,9 +26,17 @@ test("resolveClientKey ignores forwarding headers unless trustProxy is enabled",
   });
   assert.equal(untrustedA, untrustedB, "spoofed X-Forwarded-For must not change the bucket");
 
+  // Only the hop our own proxy appended (the last entry) is trusted: the
+  // leftmost entry is caller-controlled and must not mint a new bucket.
   const trustedA = resolveClientKey({ trustProxy: true, forwardedFor: "1.2.3.4, 10.0.0.1" });
   const trustedB = resolveClientKey({ trustProxy: true, forwardedFor: "5.6.7.8, 10.0.0.1" });
-  assert.notEqual(trustedA, trustedB, "a trusted proxy header should pick the first (client) hop");
+  assert.equal(
+    trustedA,
+    trustedB,
+    "spoofed leftmost entries sharing one proxy hop must share one bucket",
+  );
+  const trustedC = resolveClientKey({ trustProxy: true, forwardedFor: "1.2.3.4, 10.0.0.2" });
+  assert.notEqual(trustedA, trustedC, "distinct proxy-appended hops get distinct buckets");
 
   assert.equal(resolveClientKey({ trustProxy: true, realIp: "1.2.3.4" }), "proxy:1.2.3.4");
 });
@@ -54,11 +62,12 @@ test("createRateLimitStore caps total entries and evicts expired ones to make ro
   assert.equal(store.take("a", 0), true);
   assert.equal(store.take("b", 0), true);
   assert.equal(store.size(), 2);
-  assert.equal(store.take("c", 500), false, "a brand-new key must be rejected once at capacity");
+  // At capacity the oldest entry is evicted so newcomers are never locked out.
+  assert.equal(store.take("c", 500), true, "a brand-new key evicts the oldest entry");
   assert.equal(store.size(), 2, "the map must never exceed maxEntries");
 
-  // Once "a" and "b" expire, capacity should be reclaimed for a new key.
-  assert.equal(store.take("c", 2000), true);
+  // Once "b" and "c" expire, capacity should be reclaimed for a new key.
+  assert.equal(store.take("d", 2000), true);
   assert.equal(store.size(), 1);
 });
 
@@ -99,7 +108,9 @@ test("session token rotation does not create new pre-auth buckets", async () =>
 test("unauthenticated requests cannot multiply buckets by spoofing X-Forwarded-For", async () => {
   let lastStatus = 200;
   for (let i = 0; i < 121; i++) {
-    const response = await app.request("/api/health", {
+    // /api/health and /api/ready are exempt (load-balancer probes), so exercise
+    // a rate-limited route instead.
+    const response = await app.request("/api/workspace", {
       headers: { "X-Forwarded-For": `10.0.0.${i % 255}` },
     });
     lastStatus = response.status;
@@ -148,15 +159,20 @@ test("capacity exhaustion fails closed and recovers once entries expire", async
   for (current = 0; current < 4; current++) {
     statuses.push((await app.request("/api/ping")).status);
   }
-  assert.deepEqual(statuses, [200, 200, 200, 429], "the fourth connection is rejected");
-  current = 0;
+  assert.deepEqual(
+    statuses,
+    [200, 200, 200, 200],
+    "the fourth connection evicts the oldest entry instead of locking out",
+  );
+  current = 1;
   assert.equal((await app.request("/api/ping")).status, 200, "existing entries keep working");
 });
 
 test("capacity exhaustion reclaims expired entries", () => {
   const store = createRateLimitStore({ windowMs: 1000, maxEntries: 3 });
   for (const key of ["conn:a", "conn:b", "conn:c"]) assert.equal(store.take(key, 0), true);
-  assert.equal(store.take("conn:d", 500), false);
+  // At capacity the oldest entry is evicted for the newcomer.
+  assert.equal(store.take("conn:d", 500), true);
   assert.equal(store.take("conn:d", 1500), true);
   assert.equal(store.size(), 1);
 });
diff --git a/tests/server-edge.test.ts b/tests/server-edge.test.ts
index 3d9665bec..474f5bc4a 100644
--- a/tests/server-edge.test.ts
+++ b/tests/server-edge.test.ts
@@ -12,6 +12,8 @@ import {
   baseSecurityHeaders,
   contentSecurityPolicy,
   frameAncestorSources,
+  isSignedRoute,
+  permissionsPolicy,
 } from "../apps/server/src/security-headers.ts";
 import { createSamplePdf } from "../packages/integrations/src/pdf.ts";
 
@@ -88,6 +90,14 @@ test("signed file bytes allow first-party framing but no content directives", as
   assert.equal(response.status, 200);
   assert.equal(response.headers.get("content-type"), "application/pdf");
   assert.equal(response.headers.get("content-security-policy"), framing);
+  // The iframe PDF viewer needs fullscreen; JSON responses keep it denied.
+  assert.equal(
+    response.headers.get("permissions-policy")?.includes("fullscreen"),
+    false,
+    "file downloads must not deny fullscreen",
+  );
+  const json = await app.request("/api/health", { headers: headers() });
+  assert.ok(json.headers.get("permissions-policy")?.includes("fullscreen=()"));
 });
 
 test("readiness reports the database instead of a static ok", async () => {
@@ -105,6 +115,33 @@ test("readiness fails closed when the database is unreachable", async (t) => {
   assert.deepEqual(await response.json(), { ok: false, mode: "sample", database: "down" });
 });
 
+test("readiness times out instead of queueing behind a slow query", async (t) => {
+  t.mock.method(db, "ping", () => new Promise<void>(() => {}));
+  const started = Date.now();
+  const response = await app.request("/api/ready");
+  assert.equal(response.status, 503);
+  assert.deepEqual(await response.json(), { ok: false, mode: "sample", database: "down" });
+  assert.ok(Date.now() - started < 5000, "the probe must be bounded");
+});
+
+test("health and readiness stay outside the shared rate budget", async () => {
+  let probeDb: Store | undefined;
+  let probeDirectory = "";
+  try {
+    probeDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-probe-"));
+    probeDb = await createStore();
+    const probeConfig: Config = { ...config, dataDir: probeDirectory };
+    const { app: probe } = await createApp(probeDb, probeConfig);
+    for (let i = 0; i < 130; i += 1) await probe.request("/api/workspace");
+    assert.equal((await probe.request("/api/workspace")).status, 429);
+    assert.equal((await probe.request("/api/health")).status, 200);
+    assert.equal((await probe.request("/api/ready")).status, 200);
+  } finally {
+    await probeDb?.close();
+    if (probeDirectory) await rm(probeDirectory, { recursive: true, force: true });
+  }
+});
+
 test("sign-in attempts are budgeted per client instead of globally", async () => {
   let liveDb: Store | undefined;
   let liveDirectory = "";
@@ -134,12 +171,45 @@ test("sign-in attempts are budgeted per client instead of globally", async () =>
     // A different address is unaffected: the old global limiter would have
     // locked this client out too.
     assert.equal((await signIn("198.51.100.9")).status, 401);
+    // Spoofed leftmost entries share the proxy-appended hop, so no new bucket.
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn(`10.9.9.${attempt}, 198.51.100.77`)).status, 401);
+    assert.equal((await signIn("198.51.100.77")).status, 429);
   } finally {
     await liveDb?.close();
     if (liveDirectory) await rm(liveDirectory, { recursive: true, force: true });
   }
 });
 
+test("sign-in keeps a generous overall cap across distinct clients", async () => {
+  let capDb: Store | undefined;
+  let capDirectory = "";
+  try {
+    capDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-cap-"));
+    capDb = await createStore();
+    const capConfig: Config = {
+      ...config,
+      mode: "live",
+      agentBackend: "model",
+      dataDir: capDirectory,
+      accessKey: "a".repeat(24),
+      trustProxy: true,
+    };
+    const { app: capped } = await createApp(capDb, capConfig);
+    const signIn = (ip: string) =>
+      capped.request("/api/session", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Forwarded-For": ip },
+        body: "{}",
+      });
+    for (let i = 0; i < 100; i += 1) assert.equal((await signIn(`198.51.100.${i}`)).status, 401);
+    assert.equal((await signIn("203.0.113.99")).status, 429);
+  } finally {
+    await capDb?.close();
+    if (capDirectory) await rm(capDirectory, { recursive: true, force: true });
+  }
+});
+
 test("HSTS is advertised only when the public URL is https", async () => {
   let httpsDb: Store | undefined;
   let httpsDirectory = "";
@@ -212,3 +282,17 @@ test("resolveRequestKey honors proxy headers only when trusted", () => {
   assert.ok(resolveRequestKey(context("203.0.113.7"), true).includes("203.0.113.7"));
   assert.equal(resolveRequestKey(context("203.0.113.7"), false).includes("203.0.113.7"), false);
 });
+
+test("signed routes share one list between auth and headers", () => {
+  assert.equal(isSignedRoute("/api/files/abc/content"), true);
+  assert.equal(isSignedRoute("/api/browsers/abc/preview"), true);
+  assert.equal(isSignedRoute("/api/browsers/abc/console"), true);
+  assert.equal(isSignedRoute("/api/workspace"), false);
+  assert.equal(isSignedRoute("/api/files/abc/fill"), false);
+});
+
+test("permissionsPolicy keeps fullscreen for file downloads only", () => {
+  assert.equal(permissionsPolicy("GET", "/api/files/abc/content").includes("fullscreen"), false);
+  assert.ok(permissionsPolicy("GET", "/api/workspace").includes("fullscreen=()"));
+  assert.ok(permissionsPolicy("GET", "/api/browsers/abc/preview").includes("fullscreen=()"));
+});

From 23581838be89fcad816661fa0fc5cf2bcbc60c00 Mon Sep 17 00:00:00 2001
From: Ayush7614 <ayushknj3@gmail.com>
Date: Thu, 8 Oct 2026 20:09:04 +0530
Subject: [PATCH 3/3] =?UTF-8?q?fix(server):=20address=20second=20review=20?=
 =?UTF-8?q?on=20edge=20hardening=20=E2=80=94=20warn-only=20flood=20monitor?=
 =?UTF-8?q?,=20LRU=20limits,=20coalesced=20readiness,=20single=20header=20?=
 =?UTF-8?q?builder?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/mobile/src/PdfReader.web.tsx   |  3 ++
 apps/server/src/app.ts              | 70 ++++++++++++++++-------------
 apps/server/src/rate-limit.ts       | 53 +++++++++++++---------
 apps/server/src/security-headers.ts | 58 +++++++++++++-----------
 tests/rate-limit.test.ts            | 27 ++++++++++-
 tests/server-edge.test.ts           | 42 ++++++++++++++++-
 6 files changed, 171 insertions(+), 82 deletions(-)

diff --git a/apps/mobile/src/PdfReader.web.tsx b/apps/mobile/src/PdfReader.web.tsx
index 017fdf562..4eccbb0de 100644
--- a/apps/mobile/src/PdfReader.web.tsx
+++ b/apps/mobile/src/PdfReader.web.tsx
@@ -44,6 +44,9 @@ export default function PdfReader({ url, pageCount }: PdfReaderProps) {
         key={`${page}:${zoom}`}
         title="PDF document reader"
         src={`${url}#page=${page}&zoom=${zoom}`}
+        // The file-download Permissions-Policy leaves fullscreen to this
+        // origin; the iframe still needs the delegation for the viewer button.
+        allow="fullscreen"
         style={{ height: 570, width: "100%", border: 0, borderRadius: 12, background: "#e7e9e3" }}
       />
       <Text style={s.small}>Use the reader toolbar to download or print a copy.</Text>
diff --git a/apps/server/src/app.ts b/apps/server/src/app.ts
index d9cfd0a3e..bf130264e 100644
--- a/apps/server/src/app.ts
+++ b/apps/server/src/app.ts
@@ -25,12 +25,7 @@ import { AppError } from "./errors.ts";
 import { Files } from "./files.ts";
 import { GoogleAuth } from "./google-auth.ts";
 import { createRateLimitStore, rateLimit, resolveRequestKey } from "./rate-limit.ts";
-import {
-  baseSecurityHeaders,
-  contentSecurityPolicy,
-  isSignedRoute,
-  securityHeaders,
-} from "./security-headers.ts";
+import { createEdgeHeaders, isSignedRoute } from "./security-headers.ts";
 import { WorkspaceService } from "./workspace.ts";
 
 export async function createApp(
@@ -57,9 +52,13 @@ export async function createApp(
   const runtime = makeRuntime(config, agent, auth, intelligence);
   const app = new Hono<{ Variables: { owner: string } }>();
   const origins = new Set([...config.allowedOrigins, new URL(config.publicUrl).origin]);
+  // One prebuilt policy for both response paths: the middleware below and the
+  // CopilotKit raw-Response passthrough share headersFor(), so a change to one
+  // cannot silently miss the other.
+  const edgeHeaders = createEdgeHeaders(config);
   // Hardening first so rejected requests (origin gate, rate limits, validation)
   // carry the same headers as successful ones.
-  app.use("*", securityHeaders(config));
+  app.use("*", edgeHeaders.middleware);
   app.use("*", async (c, next) => {
     const origin = c.req.header("origin");
     if (origin && !origins.has(origin)) return c.json({ error: "Origin is not allowed" }, 403);
@@ -82,8 +81,8 @@ export async function createApp(
     }),
   );
   // Health probes stay outside the shared budget so load-balancer checks are
-  // never turned away on a busy minute (rateLimit() also bypasses them, but
-  // registering them first makes the exemption explicit).
+  // never turned away on a busy minute: they are registered before the
+  // `/api/*` limiter, which is the single exemption mechanism.
   app.get("/api/health", (c) =>
     c.json({
       ok: true,
@@ -92,6 +91,11 @@ export async function createApp(
       browserConfigured: Boolean(config.workerUrl && config.workerToken),
     }),
   );
+  // Coalesced probe: PGlite runs one query at a time, so concurrent Render
+  // checks share a single in-flight ping instead of queueing behind each other
+  // and making recovery slower. The per-request timeout still bounds the HTTP
+  // response; the shared ping keeps waiting once and is reused, never piled up.
+  let readyInFlight: Promise<void> | null = null;
   app.get("/api/ready", async (c) => {
     // Load balancers cannot authenticate, so readiness stays open like health.
     // With the default embedded PGlite store this only proves the process is
@@ -106,7 +110,16 @@ export async function createApp(
     // the probe wins the race and the timer fires later (cleared below anyway).
     timeout.catch(() => {});
     try {
-      await Promise.race([db.ping(), timeout]);
+      if (!readyInFlight) {
+        readyInFlight = db.ping().finally(() => {
+          readyInFlight = null;
+        });
+      }
+      const probe = readyInFlight;
+      // A late timer rejection after the probe wins must not surface as an
+      // unhandled rejection on the shared promise.
+      probe.catch(() => {});
+      await Promise.race([probe, timeout]);
       return c.json({ ok: true, mode: config.mode, database: "up" });
     } catch {
       return c.json({ ok: false, mode: config.mode, database: "down" }, 503);
@@ -135,30 +148,29 @@ export async function createApp(
     );
   });
   // Sign-in attempts are cheap for an attacker (one JSON body) and expensive to
-  // get wrong, so each client gets its own small bucket (10/min), backed by a
-  // generous overall cap (100/min) so a flood of distinct spoofed addresses
-  // cannot exhaust the server. Per-client keys depend on TRUST_PROXY: behind a
-  // proxy without it, every user shares one bucket, so deploy with
-  // TRUST_PROXY=true (see render.yaml / .env.example).
+  // get wrong, so each client gets its own small bucket (10/min). A hard
+  // overall cap would pull against that goal — one address burning through it
+  // would lock everyone else out — so the flood monitor below only logs a
+  // warning instead of blocking. It counts only attempts that pass the
+  // per-client check, so already-rejected floods cannot consume it. Per-client
+  // keys depend on TRUST_PROXY: behind a proxy without it, every user shares
+  // one bucket, so deploy with TRUST_PROXY=true (see render.yaml / .env.example).
   const signInPerClient = createRateLimitStore({
     windowMs: 60_000,
     maxRequests: 10,
     maxEntries: 5_000,
   });
-  const signInOverall = createRateLimitStore({
+  const signInFlood = createRateLimitStore({
     windowMs: 60_000,
     maxRequests: 100,
     maxEntries: 2,
   });
   app.post("/api/session", async (c) => {
     const now = Date.now();
-    const clientAllowed = signInPerClient.take(
-      resolveRequestKey(c, Boolean(config.trustProxy)),
-      now,
-    );
-    const overallAllowed = signInOverall.take("global", now);
-    if (!clientAllowed || !overallAllowed)
+    if (!signInPerClient.take(resolveRequestKey(c, Boolean(config.trustProxy)), now))
       throw new AppError("Too many sign-in attempts. Try again in a minute.", 429);
+    if (!signInFlood.take("global", now))
+      console.warn("[OpenMuse] sign-in flood: over 100 attempts in a minute");
     const body = z.object({ accessKey: z.string().optional() }).parse(await c.req.json());
     const session = await auth.session(body.accessKey);
     await workspace.ensureSample("local-user", actions);
@@ -389,18 +401,12 @@ export async function createApp(
         },
       }),
     );
-    // A returned Response bypasses context headers, so apply the edge policy
-    // explicitly instead of inheriting whatever the runtime happened to set.
+    // A returned Response bypasses context headers, so apply the same edge
+    // policy the middleware sets instead of inheriting whatever the runtime
+    // happened to set.
     const headers = new Headers(response.headers);
-    for (const [name, value] of Object.entries(
-      baseSecurityHeaders(config, c.req.method, c.req.path),
-    ))
+    for (const [name, value] of Object.entries(edgeHeaders.headersFor(c.req.method, c.req.path)))
       if (!headers.has(name)) headers.set(name, value);
-    if (!headers.has("Content-Security-Policy"))
-      headers.set(
-        "Content-Security-Policy",
-        contentSecurityPolicy(c.req.method, c.req.path, config),
-      );
     return new Response(body, { status: response.status, headers });
   });
   app.get("/", (c) =>
diff --git a/apps/server/src/rate-limit.ts b/apps/server/src/rate-limit.ts
index de741fede..2b5777d76 100644
--- a/apps/server/src/rate-limit.ts
+++ b/apps/server/src/rate-limit.ts
@@ -26,25 +26,38 @@ export function createRateLimitStore(options: RateLimitStoreOptions = {}) {
   }
 
   function take(key: string, now: number): boolean {
-    let entry = entries.get(key);
-    if (entry && entry.expiresAt <= now) entry = undefined;
-    if (!entry) {
+    const existing = entries.get(key);
+    if (existing && existing.expiresAt > now) {
+      // Active hit: refresh recency so eviction drops the
+      // least-recently-active bucket, not merely the earliest-inserted one.
+      existing.count += 1;
+      entries.delete(key);
+      entries.set(key, existing);
+      return existing.count <= maxRequests;
+    }
+    // New key or expired renewal. Renewals must move to the back: Map.set() on
+    // an existing key keeps its original (front) position, so an actively
+    // signing-in client would otherwise be evicted before long-gone entries.
+    const hadExpired = existing !== undefined;
+    if (hadExpired) {
+      entries.delete(key);
+      // The window turned over for this key, so peers likely expired too:
+      // reclaim them now instead of leaving stale buckets behind.
+      cleanupExpired(now);
+    }
+    if (entries.size >= maxEntries) {
+      cleanupExpired(now);
       if (entries.size >= maxEntries) {
-        cleanupExpired(now);
-        if (entries.size >= maxEntries) {
-          // Evict the oldest entry instead of locking new keys out: the map
-          // preserves insertion order, so the first key is the stalest bucket.
-          // Failing closed here would reintroduce the lockout a per-client
-          // limiter is meant to prevent (one crowded window blocks newcomers).
-          const oldest = entries.keys().next();
-          if (!oldest.done) entries.delete(oldest.value);
-          else return false;
-        }
+        // Evict the least-recently-used entry instead of locking new keys out.
+        // Failing closed here would reintroduce the lockout a per-client
+        // limiter is meant to prevent (one crowded window blocks newcomers).
+        const oldest = entries.keys().next();
+        if (!oldest.done) entries.delete(oldest.value);
+        else return false;
       }
-      entry = { count: 0, expiresAt: now + windowMs };
-      entries.set(key, entry);
     }
-    entry.count += 1;
+    const entry = { count: 1, expiresAt: now + windowMs };
+    entries.set(key, entry);
     return entry.count <= maxRequests;
   }
 
@@ -105,12 +118,8 @@ export function rateLimit(
   const store = createRateLimitStore(options);
   const getAddress = options.getAddress ?? connectionAddress;
   return async (c: Context, next: () => Promise<void>) => {
-    // Health probes must never consume the shared budget: load-balancer checks
-    // would otherwise be turned away on a busy minute and mark the server down.
-    if (c.req.path === "/api/health" || c.req.path === "/api/ready") {
-      await next();
-      return;
-    }
+    // Health/readiness exemption lives in app.ts registration order (probes are
+    // registered before this middleware), so this limiter stays route-agnostic.
     const key = resolveRequestKey(c, trustProxy, getAddress);
     if (!store.take(key, Date.now()))
       throw new AppError("Too many requests. Try again in a minute.", 429);
diff --git a/apps/server/src/security-headers.ts b/apps/server/src/security-headers.ts
index 5f777c9c2..9b48272e8 100644
--- a/apps/server/src/security-headers.ts
+++ b/apps/server/src/security-headers.ts
@@ -101,20 +101,11 @@ export function permissionsPolicy(method: string, path: string): string {
 }
 
 /** Headers that are identical on every response. */
-export function baseSecurityHeaders(
-  config: Config,
-  method?: string,
-  path?: string,
-): Record<string, string> {
+export function baseSecurityHeaders(config: Config): Record<string, string> {
   const headers: Record<string, string> = {
     "X-Content-Type-Options": "nosniff",
     "Referrer-Policy": "no-referrer",
     "Cache-Control": "no-store",
-    // The API serves data, never media capture: deny the powerful features outright.
-    "Permissions-Policy":
-      method !== undefined && path !== undefined
-        ? permissionsPolicy(method, path)
-        : defaultPermissionsPolicy,
   };
   // Browsers ignore HSTS on plaintext, and emitting it there would be a lie in
   // local/sample setups, so only advertise it when the public URL is https.
@@ -128,32 +119,49 @@ export function baseSecurityHeaders(
 }
 
 /**
- * Sets hardening headers on every response, including error responses produced
- * by `onError`. Handlers that return a raw `Response` (the CopilotKit stream
- * passthrough) bypass context headers and must apply these explicitly.
+ * Single builder for both response paths. The framing directive only depends
+ * on config, so it (and every policy derived from it) is built once at
+ * startup instead of on every request.
  *
- * The framing directive only depends on config, so it (and every policy derived
- * from it) is built once at startup instead of on every request.
+ * Handlers that return a raw `Response` (the CopilotKit stream passthrough)
+ * bypass context headers, so they use `headersFor()` to apply the exact same
+ * policy the middleware sets.
  */
-export function securityHeaders(config: Config) {
+export function createEdgeHeaders(config: Config) {
   const framing = frameAncestorsDirective(config);
   const strictCsp = `default-src 'none'; base-uri 'none'; form-action 'none'; ${framing}`;
   const consoleCsp = `${consoleContentPolicyBase}; ${framing}`;
   const byteCsp = framing;
   const base = baseSecurityHeaders(config);
-  const policyFor = (method: string, path: string): string => {
+
+  const cspFor = (method: string, path: string): string => {
     if (isConsolePage(method, path)) return consoleCsp;
     if (isByteRoute(method, path)) return byteCsp;
     return strictCsp;
   };
-  return async (c: Context, next: () => Promise<void>) => {
-    const method = c.req.method;
-    const path = c.req.path;
-    for (const [name, value] of Object.entries(base)) {
-      if (name === "Permissions-Policy") c.header(name, permissionsPolicy(method, path));
-      else c.header(name, value);
-    }
-    c.header("Content-Security-Policy", policyFor(method, path));
+
+  const headersFor = (method: string, path: string): Record<string, string> => ({
+    ...base,
+    // The API serves data, never media capture: deny the powerful features outright.
+    "Permissions-Policy": permissionsPolicy(method, path),
+    "Content-Security-Policy": cspFor(method, path),
+  });
+
+  const middleware = async (c: Context, next: () => Promise<void>) => {
+    for (const [name, value] of Object.entries(headersFor(c.req.method, c.req.path)))
+      c.header(name, value);
     await next();
   };
+
+  return { base, cspFor, headersFor, middleware };
+}
+
+/**
+ * Sets hardening headers on every response, including error responses produced
+ * by `onError`. Handlers that return a raw `Response` (the CopilotKit stream
+ * passthrough) bypass context headers and must apply these explicitly via
+ * `createEdgeHeaders(config).headersFor()`.
+ */
+export function securityHeaders(config: Config) {
+  return createEdgeHeaders(config).middleware;
 }
diff --git a/tests/rate-limit.test.ts b/tests/rate-limit.test.ts
index ad422fc2c..2663b3b33 100644
--- a/tests/rate-limit.test.ts
+++ b/tests/rate-limit.test.ts
@@ -151,7 +151,7 @@ test("spoofed bearer tokens from one connection share a single bucket", async ()
   assert.equal(other.status, 200);
 });
 
-test("capacity exhaustion fails closed and recovers once entries expire", async () => {
+test("capacity exhaustion evicts the oldest entry instead of locking out", async () => {
   const addresses = ["10.0.0.1", "10.0.0.2", "10.0.0.3", "10.0.0.4"];
   let current = 0;
   const app = limitedApp({ maxEntries: 3, windowMs: 60_000, getAddress: () => addresses[current] });
@@ -168,6 +168,31 @@ test("capacity exhaustion fails closed and recovers once entries expire", async
   assert.equal((await app.request("/api/ping")).status, 200, "existing entries keep working");
 });
 
+test("an evicted entry restarts with a fresh budget", () => {
+  const store = createRateLimitStore({ windowMs: 60_000, maxRequests: 1, maxEntries: 2 });
+  assert.equal(store.take("a", 0), true);
+  assert.equal(store.take("b", 0), true);
+  // At capacity "c" evicts "a" (least recently used).
+  assert.equal(store.take("c", 1), true);
+  // The dropped key gets a fresh bucket rather than inheriting its old count.
+  assert.equal(store.take("a", 2), true, "evicted key restarts at count 1");
+  assert.equal(store.take("a", 3), false, "but the fresh bucket still enforces its limit");
+});
+
+test("recently active entries survive eviction over idle ones", () => {
+  const store = createRateLimitStore({ windowMs: 60_000, maxRequests: 2, maxEntries: 3 });
+  assert.equal(store.take("a", 0), true);
+  assert.equal(store.take("a", 1), true, "a is now at its limit (count 2)");
+  assert.equal(store.take("b", 2), true);
+  assert.equal(store.take("c", 3), true);
+  // Touch "b" so recency order is a, c, b; the next newcomer must evict "a".
+  assert.equal(store.take("b", 4), true, "b reaches its limit (count 2)");
+  assert.equal(store.take("d", 5), true, "newcomer evicts least-recently-active entry");
+  // "a" was evicted and restarts fresh; "b" kept its exhausted count.
+  assert.equal(store.take("a", 6), true, "evicted entry restarts fresh");
+  assert.equal(store.take("b", 6), false, "recently active entry keeps its count");
+});
+
 test("capacity exhaustion reclaims expired entries", () => {
   const store = createRateLimitStore({ windowMs: 1000, maxEntries: 3 });
   for (const key of ["conn:a", "conn:b", "conn:c"]) assert.equal(store.take(key, 0), true);
diff --git a/tests/server-edge.test.ts b/tests/server-edge.test.ts
index 474f5bc4a..70f889d36 100644
--- a/tests/server-edge.test.ts
+++ b/tests/server-edge.test.ts
@@ -124,6 +124,38 @@ test("readiness times out instead of queueing behind a slow query", async (t) =>
   assert.ok(Date.now() - started < 5000, "the probe must be bounded");
 });
 
+test("concurrent readiness checks share one in-flight probe", async (t) => {
+  // Fresh app: the timeout test above leaves the shared app's coalesced probe
+  // pending forever (its mocked ping never resolves), so isolation matters here.
+  let sharedDb: Store | undefined;
+  let sharedDirectory = "";
+  try {
+    sharedDirectory = await mkdtemp(join(tmpdir(), "openmuse-server-edge-shared-"));
+    sharedDb = await createStore();
+    const sharedConfig: Config = { ...config, dataDir: sharedDirectory };
+    const { app: shared } = await createApp(sharedDb, sharedConfig);
+    let calls = 0;
+    let release: (() => void) | undefined;
+    const gate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    t.mock.method(sharedDb, "ping", async () => {
+      calls += 1;
+      await gate;
+    });
+    const first = shared.request("/api/ready");
+    const second = shared.request("/api/ready");
+    setTimeout(() => release?.(), 50);
+    const [r1, r2] = await Promise.all([first, second]);
+    assert.equal(r1.status, 200);
+    assert.equal(r2.status, 200);
+    assert.equal(calls, 1, "concurrent checks must not queue extra database queries");
+  } finally {
+    await sharedDb?.close();
+    if (sharedDirectory) await rm(sharedDirectory, { recursive: true, force: true });
+  }
+});
+
 test("health and readiness stay outside the shared rate budget", async () => {
   let probeDb: Store | undefined;
   let probeDirectory = "";
@@ -181,7 +213,7 @@ test("sign-in attempts are budgeted per client instead of globally", async () =>
   }
 });
 
-test("sign-in keeps a generous overall cap across distinct clients", async () => {
+test("sign-in flood monitor warns instead of locking everyone out", async () => {
   let capDb: Store | undefined;
   let capDirectory = "";
   try {
@@ -202,8 +234,14 @@ test("sign-in keeps a generous overall cap across distinct clients", async () =>
         headers: { "Content-Type": "application/json", "X-Forwarded-For": ip },
         body: "{}",
       });
+    // A hard overall cap would let a few addresses lock everyone else out, so
+    // the flood monitor only logs: 101 distinct clients all still get through
+    // to auth (401), and per-client budgets still block repeat offenders.
     for (let i = 0; i < 100; i += 1) assert.equal((await signIn(`198.51.100.${i}`)).status, 401);
-    assert.equal((await signIn("203.0.113.99")).status, 429);
+    assert.equal((await signIn("203.0.113.99")).status, 401);
+    for (let attempt = 0; attempt < 10; attempt += 1)
+      assert.equal((await signIn("203.0.113.7")).status, 401);
+    assert.equal((await signIn("203.0.113.7")).status, 429);
   } finally {
     await capDb?.close();
     if (capDirectory) await rm(capDirectory, { recursive: true, force: true });