@peakflo/agent-harness 0.2.14 → 0.2.15-rc.1

package/dist/runtime/mcp-preflight.js

@@ -67,7 +67,9 @@ relist) {
             Date.now() - checkedAt < SUCCESS_CACHE_TTL_MS)
             return null;
         const priorFailure = failed?.get(key);
-        if (priorFailure && Date.now() < priorFailure.nextRetryAt) {
+        if (priorFailure &&
+            !relist?.has(name) &&
+            Date.now() < priorFailure.nextRetryAt) {
             return {
                 name,
                 reason: priorFailure.reason,

package/dist/runtime/mcp-tool-store.d.ts

@@ -11,11 +11,11 @@ import { type McpServerToolListing, type McpToolsetMember } from './mcp-toolset'
  * request before the prompt.
  *
  * WHEN A LISTING IS REUSED. Only while all of these still hold:
- * - the lease carries `mcpToolScope` (the speaker and the Space whose live
- *   permissions the gateway applies). An older control plane does not send
+ * - the lease carries `mcpToolScope` (the speaker, Space and effective grants
+ *   whose live permissions the gateway applies). An older control plane does not send
  *   it, and then nothing is reused, so a list never crosses speakers;
  * - the scope is the one the listing was taken under. A different speaker in
- *   a shared chat drops every stored listing of the session;
+ *   a shared chat or a changed grant set drops every stored listing;
  * - the server's own fingerprint (name, upstream URL, allowlist) is the same;
  * - the server is still configured at the URL the listing was taken from;
  * - the listing is younger than `MCP_TOOL_STORE_MAX_AGE_MS` and than the
@@ -36,10 +36,11 @@ import { type McpServerToolListing, type McpToolsetMember } from './mcp-toolset'
  * success cache, so a turn a few minutes after the last one skips the
  * preflight too (the baseline turn `91c442db` came 6 minutes after the one
  * before it and spent 9.7 s in it). Short, because a catalogue change that is
- * not in the lease (an app connected, or a grant revoked, for the same speaker)
- * shows only after this; Pi also replaces the cached tools as soon as it
- * connects to a server. A revoked tool can stay listed for up to this long,
- * but the gateway refuses the call: a stale name, never extra access.
+ * not represented in the lease (for example an upstream tool schema change)
+ * shows only after this. Integration grant changes invalidate the lease scope
+ * key on the next turn. Within a running turn a revoked tool can stay listed,
+ * but the gateway refuses its next call. Pi also replaces its cached metadata
+ * whenever it connects to the server.
  */
 export declare const MCP_TOOL_STORE_MAX_AGE_MS: number;
 interface StoredServer {
@@ -48,6 +49,7 @@ interface StoredServer {
 }
 interface StoredToolset {
     scopeKey: string;
+    members: Map<string, string>;
     servers: Map<string, StoredServer>;
 }
 /** Shared by the harness across the per-turn runners, keyed by session id. */

package/dist/runtime/mcp-tool-store.js

@@ -16,11 +16,11 @@ const mcp_toolset_1 = require("./mcp-toolset");
  * request before the prompt.
  *
  * WHEN A LISTING IS REUSED. Only while all of these still hold:
- * - the lease carries `mcpToolScope` (the speaker and the Space whose live
- *   permissions the gateway applies). An older control plane does not send
+ * - the lease carries `mcpToolScope` (the speaker, Space and effective grants
+ *   whose live permissions the gateway applies). An older control plane does not send
  *   it, and then nothing is reused, so a list never crosses speakers;
  * - the scope is the one the listing was taken under. A different speaker in
- *   a shared chat drops every stored listing of the session;
+ *   a shared chat or a changed grant set drops every stored listing;
  * - the server's own fingerprint (name, upstream URL, allowlist) is the same;
  * - the server is still configured at the URL the listing was taken from;
  * - the listing is younger than `MCP_TOOL_STORE_MAX_AGE_MS` and than the
@@ -41,10 +41,11 @@ const mcp_toolset_1 = require("./mcp-toolset");
  * success cache, so a turn a few minutes after the last one skips the
  * preflight too (the baseline turn `91c442db` came 6 minutes after the one
  * before it and spent 9.7 s in it). Short, because a catalogue change that is
- * not in the lease (an app connected, or a grant revoked, for the same speaker)
- * shows only after this; Pi also replaces the cached tools as soon as it
- * connects to a server. A revoked tool can stay listed for up to this long,
- * but the gateway refuses the call: a stale name, never extra access.
+ * not represented in the lease (for example an upstream tool schema change)
+ * shows only after this. Integration grant changes invalidate the lease scope
+ * key on the next turn. Within a running turn a revoked tool can stay listed,
+ * but the gateway refuses its next call. Pi also replaces its cached metadata
+ * whenever it connects to the server.
  */
 exports.MCP_TOOL_STORE_MAX_AGE_MS = 15 * 60_000;
 const MAX_STORED_SESSIONS = 256;
@@ -67,13 +68,21 @@ function reusableUntil(listing) {
 function planMcpToolReuse(store, sessionId, members, scope, configured, now = Date.now()) {
     const plan = { reused: {}, relist: new Set(), dropped: {} };
     const stored = store.get(sessionId);
-    if (!stored)
+    if (!stored) {
+        // A server can reappear inside the preflight success/failure TTL. With no
+        // listing for this scope, probe it now rather than inherit that old hint.
+        if (scope)
+            for (const member of members)
+                plan.relist.add(member.name);
         return plan;
+    }
     const dropAll = (reason) => {
         for (const name of stored.servers.keys()) {
             plan.relist.add(name);
             plan.dropped[name] = reason;
         }
+        for (const member of members)
+            plan.relist.add(member.name);
         store.delete(sessionId);
     };
     if (!scope) {
@@ -81,7 +90,7 @@ function planMcpToolReuse(store, sessionId, members, scope, configured, now = Da
         return plan;
     }
     if (stored.scopeKey !== scopeKeyOf(scope)) {
-        dropAll('speaker or space changed');
+        dropAll('tool scope changed');
         return plan;
     }
     const current = new Map(members.map((member) => [member.name, member]));
@@ -111,10 +120,13 @@ function planMcpToolReuse(store, sessionId, members, scope, configured, now = Da
         }
         plan.reused[name] = entry.listing;
     }
+    for (const member of members) {
+        if (stored.members.get(member.name) !== memberKey(member))
+            plan.relist.add(member.name);
+    }
     // A reuse counts as use: move the session to the newest end.
     store.delete(sessionId);
-    if (stored.servers.size > 0)
-        store.set(sessionId, stored);
+    store.set(sessionId, stored);
     return plan;
 }
 /**
@@ -129,8 +141,9 @@ function rememberMcpToolListings(store, sessionId, members, scope, listings) {
     const scopeKey = scopeKeyOf(scope);
     let stored = store.get(sessionId);
     if (!stored || stored.scopeKey !== scopeKey) {
-        stored = { scopeKey, servers: new Map() };
+        stored = { scopeKey, members: new Map(), servers: new Map() };
     }
+    stored.members = new Map(members.map((member) => [member.name, memberKey(member)]));
     const current = new Map(members.map((member) => [member.name, member]));
     const kept = [];
     for (const [name, listing] of listings) {
@@ -142,8 +155,7 @@ function rememberMcpToolListings(store, sessionId, members, scope, listings) {
     }
     // Most recently used last, so the oldest session is evicted first.
     store.delete(sessionId);
-    if (stored.servers.size > 0)
-        store.set(sessionId, stored);
+    store.set(sessionId, stored);
     while (store.size > MAX_STORED_SESSIONS) {
         store.delete(store.keys().next().value);
     }

package/dist/types.d.ts

@@ -546,8 +546,8 @@ export interface LeasedSession {
     turnId: string;
     runtime: RunnerRuntime;
     /**
-     * Opaque. Changes when the speaker or the Space whose live permissions the
-     * MCP gateway applies changes, so the tool catalogue may differ. The harness
+     * Opaque. Changes with the speaker, Space or effective integration grants
+     * (including tool limits), so the tool catalogue may differ. The harness
      * reuses a session's stored MCP tool listings on a later turn only while
      * this is the same. Optional and additive: absent (an older control plane)
      * means nothing is reused across turns.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.14",
+  "version": "0.2.15-rc.1",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",