@agent-native/core 0.131.9 → 0.132.1

package/src/mcp-client/routes.ts

@@ -32,7 +32,7 @@ import { getSession } from "../server/auth.js";
 import { getH3App } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
 import { runWithRequestContext } from "../server/request-context.js";
-import { getAllSettings } from "../settings/store.js";
+import { getAllSettings, getSettingsEmitter } from "../settings/store.js";
 import {
   areBuiltinMcpCapabilitiesSupported,
   BUILTIN_MCP_CAPABILITIES,
@@ -291,6 +291,13 @@ function sortedConfigSignature(config: McpConfig | null): string {
   return JSON.stringify(entries);
 }
 
+/**
+ * How long the refresh may skip the settings read on the strength of "no
+ * in-process settings write since the last one". Bounds how stale a remote MCP
+ * server list added by ANOTHER process can be.
+ */
+const MCP_CONFIG_REFRESH_BACKSTOP_MS = 5 * 60 * 1000;
+
 function mcpConfigRefreshIntervalMs(): number {
   const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;
   if (raw?.trim() === "0") return 0;
@@ -307,8 +314,24 @@ export function startMcpConfigRefresh(
 
   let currentSignature = sortedConfigSignature(manager.getConfig());
   let refreshing = false;
+  // `buildMergedConfig` reads the entire settings table just to diff a
+  // signature, which on an idle app is a full-table round trip every minute
+  // forever. Only pay it when an in-process settings write says something might
+  // have changed, plus a periodic backstop for writes from another process.
+  let settingsDirty = true;
+  let lastFullRefresh = 0;
+  const markDirty = () => {
+    settingsDirty = true;
+  };
+  getSettingsEmitter().on("settings", markDirty);
   const refresh = async () => {
     if (refreshing) return;
+    if (
+      !settingsDirty &&
+      Date.now() - lastFullRefresh < MCP_CONFIG_REFRESH_BACKSTOP_MS
+    ) {
+      return;
+    }
     refreshing = true;
     try {
       const next = await buildMergedConfig();
@@ -317,7 +340,12 @@ export function startMcpConfigRefresh(
         await manager.reconfigure(next);
         currentSignature = nextSignature;
       }
+      settingsDirty = false;
+      lastFullRefresh = Date.now();
     } catch (err: any) {
+      // Keep this dirty so a transient database or manager failure is retried
+      // on the next interval instead of being hidden by the backstop window.
+      settingsDirty = true;
       console.warn(
         `[mcp-client] config refresh failed: ${err?.message ?? err}`,
       );
@@ -328,7 +356,10 @@ export function startMcpConfigRefresh(
 
   const timer = setInterval(refresh, intervalMs);
   (timer as { unref?: () => void }).unref?.();
-  return () => clearInterval(timer);
+  return () => {
+    clearInterval(timer);
+    getSettingsEmitter().off("settings", markDirty);
+  };
 }
 
 async function resolveContextForRequest(event: H3Event): Promise<{

package/src/onboarding/plugin.ts

@@ -81,30 +81,34 @@ async function serializeSteps(
   options: { preview?: boolean } = {},
 ): Promise<OnboardingStepStatus[]> {
   const steps = listOnboardingSteps();
-  const out: OnboardingStepStatus[] = [];
-  for (const step of steps) {
-    let complete = false;
-    if (!options.preview) {
-      try {
-        complete = (await step.isComplete(context)) === true;
-      } catch {
-        complete = false;
-      }
-      if (!complete) {
-        complete = await hasOverride(context.sessionId, step.id);
+  // Steps are independent of each other, and each `isComplete()` is itself a
+  // chain of credential/settings reads — walking them one at a time made this
+  // route cost the SUM of every step's round trips against a remote database
+  // instead of the slowest one. `Promise.all` preserves `steps` order.
+  return Promise.all(
+    steps.map(async (step) => {
+      let complete = false;
+      if (!options.preview) {
+        try {
+          complete = (await step.isComplete(context)) === true;
+        } catch {
+          complete = false;
+        }
+        if (!complete) {
+          complete = await hasOverride(context.sessionId, step.id);
+        }
       }
-    }
-    out.push({
-      id: step.id,
-      title: step.title,
-      description: step.description,
-      order: step.order,
-      required: step.required ?? false,
-      complete,
-      methods: step.methods,
-    });
-  }
-  return out;
+      return {
+        id: step.id,
+        title: step.title,
+        description: step.description,
+        order: step.order,
+        required: step.required ?? false,
+        complete,
+        methods: step.methods,
+      };
+    }),
+  );
 }
 
 function withOnboardingRequestContext<T>(
@@ -240,11 +244,13 @@ export function createOnboardingPlugin(
         // doesn't surface as a 500 to the client.
         try {
           return await withOnboardingRequestContext(context, async () => {
-            const value = await appStateGet(context.sessionId, DISMISSED_KEY);
+            const [value, statuses] = await Promise.all([
+              appStateGet(context.sessionId, DISMISSED_KEY),
+              serializeSteps(context),
+            ]);
             const dismissed = !!(
               value && (value as { dismissed?: boolean }).dismissed
             );
-            const statuses = await serializeSteps(context);
             return {
               dismissed,
               allComplete: allRequiredComplete(statuses),

package/src/org/accept-pending.ts

@@ -1,5 +1,6 @@
 import { getDbExec } from "../db/client.js";
 import { setActiveOrgId } from "./active-org.js";
+import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
 
 const nanoid = (): string =>
   globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
@@ -75,6 +76,7 @@ export async function acceptPendingInvitationsForEmail(
               ON CONFLICT (org_id, LOWER(email)) DO NOTHING`,
         args: [nanoid(), inv.orgId, email, role, Date.now()],
       });
+      invalidateRequestMemberOrgIds();
     }
     await db.execute({
       sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,

package/src/org/auto-join-domain.ts

@@ -1,6 +1,7 @@
 import { getDbExec } from "../db/client.js";
 import { getUserSetting } from "../settings/user-settings.js";
 import { setActiveOrgId } from "./active-org.js";
+import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
 
 const nanoid = (): string =>
   globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
@@ -87,6 +88,7 @@ export async function autoJoinDomainMatchingOrgs(
         args: [nanoid(), m.orgId, email, Date.now()],
       });
       joined.push({ orgId: m.orgId });
+      invalidateRequestMemberOrgIds();
     } catch {
       // Race with a parallel join (e.g. user accepted an invite to the
       // same org milliseconds earlier). The unique constraint keeps the

package/src/org/context.ts

@@ -7,6 +7,10 @@ import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
 import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
+import {
+  invalidateRequestMemberOrgIds,
+  requestMemberOrgIds,
+} from "./request-org-cache.js";
 import type { OrgContext, OrgRole } from "./types.js";
 
 const EMPTY_CONTEXT: OrgContext = {
@@ -210,6 +214,12 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
 
   const exec = getDbExec();
 
+  // Started before the memberships await so the two round trips overlap; the
+  // `catch` only covers the early returns below, the later `await` still
+  // propagates a real failure.
+  const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);
+  activeOrgSettingPromise.catch(() => {});
+
   let memberships: MembershipRow[] | null;
   try {
     memberships = await loadMembershipsForEvent(event, email);
@@ -238,7 +248,7 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
     return { email, orgId: null, orgName: null, role: null };
   }
 
-  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+  const activeOrgSetting = await activeOrgSettingPromise;
   const explicitPersonal = activeOrgSetting?.orgId === null;
 
   const emailDomain = emailDomainOf(email);
@@ -410,17 +420,26 @@ async function loadMemberships(email: string): Promise<MembershipRow[] | null> {
 export async function resolveOrgIdForEmail(
   email: string,
 ): Promise<string | null> {
-  const rows = await queryOrgMembers({
-    sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
-          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
-    args: [email.toLowerCase()],
+  const idsPromise = requestMemberOrgIds(email, async () => {
+    const rows = await queryOrgMembers({
+      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
+            ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+      args: [email.toLowerCase()],
+    });
+    return rows?.map((r: any) => String(r.org_id)) ?? null;
   });
-  if (!rows?.length) return null;
-  const ids = rows.map((r: any) => String(r.org_id));
-  const activeOrgSetting = (await getUserSetting(
+  // Both reads depend only on the email, so they overlap instead of queueing.
+  // The `catch` only keeps the early return below from surfacing an unhandled
+  // rejection; the `await` further down still propagates the failure.
+  const settingPromise = getUserSetting(
     email,
     "active-org-id",
-  )) as ActiveOrgSetting;
+  ) as Promise<ActiveOrgSetting>;
+  settingPromise.catch(() => {});
+
+  const ids = await idsPromise;
+  if (!ids?.length) return null;
+  const activeOrgSetting = await settingPromise;
   if (activeOrgSetting?.orgId === null) return null;
   if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
     return activeOrgSetting.orgId;
@@ -438,9 +457,13 @@ export async function resolveOrgIdForEmailViaEvent(
   event: H3Event,
   email: string,
 ): Promise<string | null> {
+  // Overlapped, not queued: each is a separate round trip and this pair runs
+  // on the session-backfill path of every authenticated request.
+  const settingPromise = loadActiveOrgSettingForEvent(event, email);
+  settingPromise.catch(() => {});
   const memberships = await loadMembershipsForEvent(event, email);
   if (!memberships || memberships.length === 0) return null;
-  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+  const activeOrgSetting = await settingPromise;
   if (activeOrgSetting?.orgId === null) return null;
   if (
     activeOrgSetting?.orgId &&
@@ -485,6 +508,7 @@ export async function createOrganization(
     sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
     args: [nanoid(), id, email, role, createdAt],
   });
+  invalidateRequestMemberOrgIds();
 
   await warnOnAdditionalOrganization(exec, email, id, trimmedName);
 
@@ -669,6 +693,7 @@ async function tryCreateDefaultOrg(
       sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
       args: [nanoid(), orgId, email, "owner", now],
     });
+    invalidateRequestMemberOrgIds();
 
     await setActiveOrgId(email, orgId, "auto-created default organization");
 

package/src/org/handlers.ts

@@ -46,6 +46,7 @@ import { readBody } from "../server/h3-helpers.js";
 import { setActiveOrgId } from "./active-org.js";
 import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
+import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
 import type { OrgRole } from "./types.js";
 import { parseWorkspaceUrl } from "./workspace-url.js";
 
@@ -505,6 +506,7 @@ export const acceptInvitationHandler = defineEventHandler(
       sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
       args: [nanoid(), invOrgId, email, inviteRole, Date.now()],
     });
+    invalidateRequestMemberOrgIds();
 
     await e.execute({
       sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,
@@ -574,6 +576,7 @@ export const removeMemberHandler = defineEventHandler(
       sql: `DELETE FROM org_members WHERE org_id = ? AND LOWER(email) = ?`,
       args: [ctx.orgId, memberEmailLower],
     });
+    invalidateRequestMemberOrgIds();
 
     return { success: true };
   },
@@ -772,6 +775,8 @@ export const deleteOrgHandler = defineEventHandler(async (event: H3Event) => {
     });
   }
 
+  invalidateRequestMemberOrgIds();
+
   const nextRes = await e.execute({
     sql: `SELECT org_id AS "orgId" FROM org_members WHERE LOWER(email) = ? LIMIT 1`,
     args: [ctx.email.toLowerCase()],
@@ -875,6 +880,7 @@ export const joinByDomainHandler = defineEventHandler(
       sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,
       args: [nanoid(), orgId, email, Date.now()],
     });
+    invalidateRequestMemberOrgIds();
 
     await setActiveOrgId(email, orgId, "joined domain-matched organization");
 

package/src/org/request-org-cache.ts

@@ -0,0 +1,71 @@
+import { getRequestContext } from "../server/request-context.js";
+
+/**
+ * Per-request memo of the `org_members` read behind `resolveOrgIdForEmail`,
+ * keyed on the active AsyncLocalStorage `RequestContext` (WeakMap → freed with
+ * the request) and then on the lowercased email. Mirrors the settings cache in
+ * `settings/store.ts`.
+ *
+ * The `event.context` caches in `context.ts` only cover call chains that carry
+ * an h3 event. Identity resolution for credential lookups, agent runs, A2A,
+ * MCP, and adapter-authenticated action calls has no event, so every one of
+ * those callers used to pay its own round trip for the same answer — on a
+ * remote Postgres that is ~83ms each.
+ *
+ * TRAP: the key is the email, never "the current request's user". A single
+ * request legitimately resolves several addresses (the signed-in caller plus a
+ * run owner or credential subject), so a context-only key would answer one
+ * identity with another's memberships.
+ */
+const requestOrgIds = new WeakMap<
+  object,
+  Map<string, Promise<string[] | null>>
+>();
+
+function cacheForRequest(
+  create: boolean,
+): Map<string, Promise<string[] | null>> | null {
+  const ctx = getRequestContext();
+  if (!ctx || typeof ctx !== "object") return null;
+  let cache = requestOrgIds.get(ctx);
+  if (!cache && create) {
+    cache = new Map();
+    requestOrgIds.set(ctx, cache);
+  }
+  return cache ?? null;
+}
+
+/**
+ * Resolve the org ids `email` belongs to, once per request. `null` means the
+ * membership rows were unreadable and is cached like any other answer; a
+ * rejection is evicted so one transient failure cannot answer every later
+ * lookup in the same request.
+ */
+export function requestMemberOrgIds(
+  email: string,
+  load: () => Promise<string[] | null>,
+): Promise<string[] | null> {
+  const cache = cacheForRequest(true);
+  if (!cache) return load();
+  const key = email.trim().toLowerCase();
+  let pending = cache.get(key);
+  if (!pending) {
+    pending = load().catch((err) => {
+      cache.delete(key);
+      throw err;
+    });
+    cache.set(key, pending);
+  }
+  return pending;
+}
+
+/**
+ * Drop this request's memoized memberships after a write to `org_members`.
+ * Clears every email rather than one: deleting an organization or removing a
+ * member changes the answer for accounts other than the one being written.
+ * Requests already in flight elsewhere keep their own snapshot for the rest of
+ * their (short) lifetime, the same tradeoff the settings cache documents.
+ */
+export function invalidateRequestMemberOrgIds(): void {
+  cacheForRequest(false)?.clear();
+}

package/src/resources/store.ts

@@ -1494,18 +1494,19 @@ export async function resourceEffectiveContext(
 ): Promise<EffectiveResourceContext> {
   await ensureTable();
 
-  const workspace = await resourceGetByPath(WORKSPACE_OWNER, path, {
-    ...options,
-    userEmail,
-  });
+  // Four independent reads of the same path under different owners; the
+  // precedence below is pure JS, so serialising them only bought four round
+  // trips of latency. Mirrors `resourceListAccessible`, which already fans out.
   const organizationOwner = sharedResourceOwner(options?.orgId);
-  const organization =
+  const [workspace, organization, legacyShared, personal] = await Promise.all([
+    resourceGetByPath(WORKSPACE_OWNER, path, { ...options, userEmail }),
     organizationOwner === SHARED_OWNER
-      ? null
-      : await resourceGetByPath(organizationOwner, path);
-  const legacyShared = await resourceGetByPath(SHARED_OWNER, path);
+      ? Promise.resolve(null)
+      : resourceGetByPath(organizationOwner, path),
+    resourceGetByPath(SHARED_OWNER, path),
+    resourceGetByPath(userEmail, path),
+  ]);
   const shared = organization ?? legacyShared;
-  const personal = await resourceGetByPath(userEmail, path);
   const effective = personal ?? shared ?? workspace ?? null;
   const effectiveScope: ResourceInheritanceScope | null = personal
     ? "personal"

package/src/scripts/runner.ts

@@ -17,7 +17,10 @@ import { pathToFileURL } from "url";
 
 import type { ActionEntry } from "../agent/production-agent.js";
 import { closeDbExec } from "../db/client.js";
-import { notifyActionChange } from "../server/action-change.js";
+import {
+  actionCallIsReadOnly,
+  notifyActionChange,
+} from "../server/action-change.js";
 import {
   runWithRequestContext,
   getRequestOrgId,
@@ -442,7 +445,7 @@ async function dispatchAction(
       ) {
         const parsed = parseActionArgs(args, { coerceBooleans: true });
         const result = await handler.run(parsed, cliActionCtx(actionName));
-        if (handler.readOnly !== true) {
+        if (!actionCallIsReadOnly(handler, parsed, false)) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
         if (result) assertCliHandoffLaunched(printActionResult(result));
@@ -476,7 +479,7 @@ async function dispatchAction(
         parsed as Record<string, string>,
         cliActionCtx(actionName),
       );
-      if (packageAction.readOnly !== true) {
+      if (!actionCallIsReadOnly(packageAction, parsed, false)) {
         await notifyActionChange({ actionName }).catch(() => {});
       }
       if (result) assertCliHandoffLaunched(printActionResult(result));

package/src/secrets/storage.ts

@@ -16,6 +16,7 @@ import { randomUUID } from "node:crypto";
 
 import { getDbExec, isPostgres } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
+import { getRequestContext } from "../server/request-context.js";
 import {
   encryptSecretValue as encryptLegacyValue,
   encryptSharedSecretValue as encryptValue,
@@ -217,6 +218,8 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
     now,
   ];
 
+  invalidateRequestSecret(args);
+
   if (isPostgres()) {
     const { rows } = await client.execute({
       sql: `${upsertSql} RETURNING id`,
@@ -339,6 +342,52 @@ async function populateSharedAppSecret(
   }
 }
 
+// ---------------------------------------------------------------------------
+// Per-request read memo
+// ---------------------------------------------------------------------------
+
+/**
+ * Per-request memo of secret reads, keyed on the active AsyncLocalStorage
+ * RequestContext (WeakMap → freed with the request). Mirrors the settings
+ * store's cache, including its staleness rule: a write in THIS request is
+ * written through, while other in-flight requests keep their snapshot for
+ * their own (short) lifetime.
+ *
+ * The map key is `scope|scopeId|key`, which is the secret's full identity —
+ * `user:<email>`, `org:<id>`, `solo:<email>`, `workspace` — so a hit can never
+ * answer one caller with another caller's secret. Do NOT reduce the key to
+ * just `key`.
+ *
+ * This exists because one credential resolution is a WATERFALL: user scope,
+ * then org, then workspace, then solo. Callers re-resolve the same credential
+ * several times per request (engine detection, config resolution, usability
+ * checks), and against a remote database each probe is a network round trip.
+ */
+const _requestSecretsCache = new WeakMap<
+  object,
+  Map<string, ReadSecretResult | null>
+>();
+
+function requestSecretsCache(): Map<string, ReadSecretResult | null> | null {
+  const ctx = getRequestContext();
+  if (!ctx || typeof ctx !== "object") return null;
+  let cache = _requestSecretsCache.get(ctx);
+  if (!cache) {
+    cache = new Map();
+    _requestSecretsCache.set(ctx, cache);
+  }
+  return cache;
+}
+
+function secretCacheKey(ref: SecretRef): string {
+  return `${ref.scope}|${ref.scopeId}|${ref.key}`;
+}
+
+/** Drop this request's memo for a secret whose stored value just changed. */
+function invalidateRequestSecret(ref: SecretRef): void {
+  requestSecretsCache()?.delete(secretCacheKey(ref));
+}
+
 type AppSecretsReadQuery = { sql: string; args: unknown[] };
 
 /**
@@ -379,6 +428,17 @@ async function executeAppSecretsRead(query: AppSecretsReadQuery) {
  */
 export async function readAppSecret(
   ref: SecretRef,
+): Promise<ReadSecretResult | null> {
+  const cache = requestSecretsCache();
+  const cacheKey = secretCacheKey(ref);
+  if (cache?.has(cacheKey)) return cache.get(cacheKey) ?? null;
+  const result = await readAppSecretUncached(ref);
+  cache?.set(cacheKey, result);
+  return result;
+}
+
+async function readAppSecretUncached(
+  ref: SecretRef,
 ): Promise<ReadSecretResult | null> {
   const { key, scope, scopeId } = ref;
   const { rows } = await executeAppSecretsRead({
@@ -417,15 +477,41 @@ export async function readAppSecrets(args: {
   scope: SecretScope;
   scopeId: string;
 }): Promise<Map<string, ReadSecretResult>> {
-  const keys = [...new Set(args.keys.filter(Boolean))];
-  if (keys.length === 0) return new Map();
+  const requested = [...new Set(args.keys.filter(Boolean))];
+  if (requested.length === 0) return new Map();
+
+  const cache = requestSecretsCache();
+  const results = new Map<string, ReadSecretResult>();
+  const keys: string[] = [];
+  for (const key of requested) {
+    const cacheKey = secretCacheKey({
+      key,
+      scope: args.scope,
+      scopeId: args.scopeId,
+    });
+    if (cache?.has(cacheKey)) {
+      const cached = cache.get(cacheKey);
+      if (cached) results.set(key, cached);
+      continue;
+    }
+    keys.push(key);
+  }
+  if (keys.length === 0) return results;
 
   const placeholders = keys.map(() => "?").join(", ");
   const { rows } = await executeAppSecretsRead({
     sql: `SELECT key, encrypted_value, shared_encrypted_value, updated_at, id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
     args: [args.scope, args.scopeId, ...keys],
   });
-  const results = new Map<string, ReadSecretResult>();
+  // The statement covered every uncached key in this scope, so a key missing
+  // from `rows` is genuinely absent — memo it as such rather than leaving a
+  // single-key read to go ask again.
+  for (const key of keys) {
+    cache?.set(
+      secretCacheKey({ key, scope: args.scope, scopeId: args.scopeId }),
+      null,
+    );
+  }
   for (const row of rows) {
     const key = String(row.key ?? "");
     if (!key) continue;
@@ -442,11 +528,16 @@ export async function readAppSecrets(args: {
           decrypted.sharedCiphertextToReplace ?? null,
         );
       }
-      results.set(key, {
+      const result = {
         value: decrypted.value,
         last4: last4(decrypted.value),
         updatedAt: Number(row.updated_at ?? 0),
-      });
+      };
+      results.set(key, result);
+      cache?.set(
+        secretCacheKey({ key, scope: args.scope, scopeId: args.scopeId }),
+        result,
+      );
     } catch {
       // Match readAppSecret: corrupted or stale ciphertext behaves as missing.
     }
@@ -589,6 +680,7 @@ function parseAllowlist(raw: string | null): string[] | null {
 
 export async function deleteAppSecret(ref: SecretRef): Promise<boolean> {
   await ensureTable();
+  invalidateRequestSecret(ref);
   const { key, scope, scopeId } = ref;
   const client = getDbExec();
   const { rowsAffected } = await client.execute({

package/src/server/action-change.ts

@@ -4,10 +4,43 @@ import {
   actionChangeMarkerValue,
   type ActionChangeTarget,
 } from "../action-change-marker.js";
+import type { ActionPlanModeConfig } from "../action.js";
 import { appStatePut } from "../application-state/store.js";
 import { recordChange } from "./poll.js";
 import { getRequestOrgId, getRequestUserEmail } from "./request-context.js";
 
+/**
+ * Whether THIS invocation should announce a change.
+ *
+ * `readOnly` describes an action name, but a tool that discriminates on an
+ * argument reads on some calls and writes on others — `manage-agent-engine`
+ * with `action: "list"` is a status poll, with `action: "set"` a write. Such
+ * actions already publish the per-call answer as a Plan-mode `effect`
+ * predicate, so read it here instead of treating every call as a write: a poll
+ * that bumps the `"action"` change version makes every query keyed on it
+ * refetch forever.
+ *
+ * `readOnly` stays authoritative otherwise. Widening the flag to cover mixed
+ * tools would also open them to read-only A2A peers and to the agent's
+ * read-result cache, where it would be false.
+ */
+export function actionCallIsReadOnly(
+  entry: { readOnly?: boolean; planMode?: ActionPlanModeConfig<any> },
+  params: unknown,
+  fallback: boolean,
+): boolean {
+  const effect = entry.planMode?.effect;
+  if (typeof effect === "function") {
+    try {
+      return effect(params) === "read";
+    } catch {
+      // A predicate that throws says nothing; fall through to the flag.
+    }
+  }
+  if (typeof entry.readOnly === "boolean") return entry.readOnly;
+  return fallback;
+}
+
 export interface NotifyActionChangeOptions {
   actionName: string;
   owner?: string;