@zackbart/connecta 0.41.0 → 0.42.0

package/dist/result-seal.js

@@ -0,0 +1,168 @@
+// A program's retained results are unreadable to any other request by default. Chunk 0,
+// which holds the header a reader needs, stays in this memory-only ledger while the run
+// lasts, so every way a run can end leaves nothing a reader can open unless sealing wrote
+// that chunk. Sealing waits until the run can no longer add to its secret set, and only
+// then writes the headers of entries that pass that set. Stored bytes never change, so an
+// offset issued for an entry stays valid. A reclaimed transfer leaves this ledger first and
+// gets no header. Sealing costs no extra writes, and reads stored bytes back only for
+// entries the set grew past.
+import { Duration, Effect } from "effect";
+import { authStorage } from "./auth/native.js";
+import { PendingWork } from "./runtime/request-scope.js";
+import { withDeadlineEffect } from "./runtime/run.js";
+import { resultKeys } from "./storage/keys.js";
+// A BOM is payload here, as it is on every page of the same bytes.
+const dec = new TextDecoder("utf-8", { ignoreBOM: true, fatal: false });
+export const RESULT_ENVELOPE_V4 = "connecta-result-v4:";
+/** Stored for an entry sealing did not publish, so its id can say why. Its binding and no bytes. */
+const RESULT_REFUSED_V4 = "connecta-result-refused-v4:";
+const SEAL_CONCURRENCY = 8;
+/** Kept back from sealing's time for the markers and cleanup of unpublished entries. */
+const REFUSAL_RESERVE_MS = 1000;
+const envelope = (entry) => `${RESULT_ENVELOPE_V4}${entry.binding}:${entry.total}:${entry.chunkBytes}:${entry.cap}:${entry.first}`;
+/** One run's unsealed results. It lives and dies with the run's request (INV-7). */
+export class HeldResults {
+    secrets;
+    credentialReads;
+    entries = new Map();
+    hostCalls = new PendingWork();
+    closed = false;
+    constructor(secrets, 
+    /** The request's credential reads, which outlast the host calls that started them. */
+    credentialReads) {
+        this.secrets = secrets;
+        this.credentialReads = credentialReads;
+    }
+    /** False once sealing began: a late entry would never become readable, and a late host call never starts. */
+    accepts() {
+        return !this.closed;
+    }
+    add(entry) {
+        if (this.closed)
+            return false;
+        this.entries.set(entry.id, entry);
+        return true;
+    }
+    /** Forget an entry whose stash is being given back, so sealing never writes its header.
+     * False once sealing began, when the entry is no longer this ledger's to give up. */
+    discard(id) {
+        return !this.closed && this.entries.delete(id);
+    }
+    /** Chunk 0 as storage will hold it, for paging inside the run that stashed it. */
+    stored(id) {
+        const entry = this.entries.get(id);
+        return entry && envelope(entry);
+    }
+    /** A guest host call; sealing waits for it to settle. */
+    track(work) {
+        const done = this.hostCalls.begin();
+        void work.then(done, done);
+    }
+    /** Stop accepting work and hand over what the run retained. */
+    close() {
+        this.closed = true;
+        const entries = [...this.entries.values()];
+        this.entries.clear();
+        return entries;
+    }
+    /** Succeeds once nothing the run started can add to the secret set. */
+    settled = Effect.suspend(() => this.hostCalls.idle).pipe(Effect.andThen(Effect.suspend(() => this.credentialReads.idle)), Effect.repeat({ until: () => !this.hostCalls.pending && !this.credentialReads.pending }), Effect.asVoid);
+}
+function bytesOf(encoded, total) {
+    const bytes = new Uint8Array(total);
+    let at = 0;
+    for (const part of encoded) {
+        const binary = atob(part);
+        for (let index = 0; index < binary.length; index++)
+            bytes[at++] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+/** The checks a result takes on its way into the stash, repeated over the whole stored value.
+ * Structured redaction joins text blocks, so a form split across two of them is found. */
+function passesSet(secrets, text, format) {
+    if (format === "json") {
+        try {
+            if (secrets.changes(JSON.parse(text)))
+                return false;
+        }
+        catch {
+            // A value JSON renders as text, such as `undefined`, takes the text check alone.
+        }
+    }
+    return secrets.text(text) === text;
+}
+const SEALED = { refused: 0, refusedWrite: false };
+/**
+ * Publish what can be published. Never fails. Nothing is published until the run's work
+ * has settled, and anything still pending when the budget ends leaves every entry
+ * unpublished, which is the refusal. Markers only improve what a later page is told, so
+ * a failed marker, a timeout or a cancellation changes nothing a reader can get.
+ */
+export function sealHeldResults(held, storage, 
+/** The absolute time the run's response must be on its way. */
+answerBy, signal) {
+    return Effect.suspend(() => {
+        const secrets = held.secrets;
+        const entries = held.close();
+        if (entries.length === 0)
+            return Effect.succeed(SEALED);
+        const published = new Set();
+        const key = (entry, index) => resultKeys.chunk(entry.id, index);
+        const passes = (entry) => Effect.gen(function* () {
+            const parts = [entry.first];
+            for (let index = 1; index < entry.chunks; index++) {
+                const chunk = yield* authStorage(storage, "get", [key(entry, index)]);
+                // Expired or evicted under a held header: nothing left to check, so nothing to offer.
+                if (chunk === null)
+                    return false;
+                parts.push(chunk);
+            }
+            const text = dec.decode(bytesOf(parts, entry.total));
+            return passesSet(secrets, text, entry.format);
+        });
+        const seal = Effect.gen(function* () {
+            yield* held.settled;
+            const stable = secrets.revision;
+            yield* Effect.forEach(entries, (entry) => Effect.gen(function* () {
+                if (entry.passed !== stable && (entry.binary || !(yield* passes(entry))))
+                    return;
+                // Nothing the run started is left, so this holds. If it ever fails, stop.
+                if (secrets.revision !== stable)
+                    return;
+                yield* authStorage(storage, "set", [key(entry, 0), envelope(entry), { expiresAtMs: entry.expiresAtMs }]);
+                published.add(entry);
+            }).pipe(Effect.ignore), { concurrency: SEAL_CONCURRENCY, discard: true });
+        });
+        // A header write that commits after its timeout can replace a marker, so a marker is no
+        // publication fence. That write only ever carries bytes this seal already checked.
+        const refuse = (entry) => Effect.gen(function* () {
+            yield* authStorage(storage, "set", [
+                key(entry, 0),
+                `${RESULT_REFUSED_V4}${entry.binding}:`,
+                { expiresAtMs: entry.expiresAtMs },
+            ]);
+            for (let index = 1; index < entry.chunks; index++) {
+                yield* authStorage(storage, "delete", [key(entry, index)]);
+            }
+        }).pipe(Effect.ignore);
+        const remainingMs = Math.max(1, answerBy - Date.now());
+        const reserveMs = Math.min(REFUSAL_RESERVE_MS, Math.floor(remainingMs / 4));
+        return withDeadlineEffect(() => seal, {
+            timeoutMs: Math.max(1, remainingMs - reserveMs),
+            ...(signal ? { signal } : {}),
+            timeoutError: new Error("Sealing ran out of time."),
+        }).pipe(Effect.ignore, Effect.flatMap(() => {
+            const refused = entries.filter((entry) => !published.has(entry));
+            const outcome = refused.length
+                ? { refused: refused.length, refusedWrite: refused.some((entry) => entry.write) }
+                : SEALED;
+            if (refused.length === 0 || signal?.aborted)
+                return Effect.succeed(outcome);
+            return Effect.forEach(refused, refuse, { concurrency: SEAL_CONCURRENCY, discard: true }).pipe(Effect.timeoutOrElse({
+                duration: Duration.millis(Math.max(1, answerBy - Date.now())),
+                orElse: () => Effect.void,
+            }), Effect.as(outcome));
+        }));
+    });
+}

package/dist/route-names.js

@@ -1,7 +1,8 @@
 /**
- * `meta`: the six meta-tools. `code`: in-program wording, selected only by the
- * eval code arm. `native` and `native-code`: native pools without and with
- * `execute_code`.
+ * `meta`: the six meta-tools. `read-route`: those plus `execute_read_code`, which
+ * then takes read follow-ups, so they cost no write approval. `code`: in-program
+ * wording, selected only by the eval code arm. `native` and `native-code`: native
+ * pools without and with `execute_code`.
  */
 const NAMES = {
     meta: Object.freeze({
@@ -12,6 +13,14 @@ const NAMES = {
         authorize: "authorize_connector",
         skills: "skills",
     }),
+    "read-route": Object.freeze({
+        search: "search_tools",
+        read: "call_tool",
+        write: "call_destructive_tool",
+        program: "execute_read_code",
+        authorize: "authorize_connector",
+        skills: "skills",
+    }),
     code: Object.freeze({
         search: "connecta.search inside execute_code",
         read: "connecta.call inside execute_code",
@@ -37,7 +46,7 @@ const NAMES = {
         skills: "skills",
     }),
 };
-/** The six-tool surface's names: the default wherever no other surface applies. */
+/** The meta surface's names: the default wherever no other surface applies. */
 export const META_ROUTES = NAMES.meta;
 export function routeNames(surface) {
     return NAMES[surface];

package/dist/routes/connect.js

@@ -5,7 +5,7 @@ import { escapeHtml, renderPage } from "../branding.js";
 import { htmlSecurityHeaders } from "../html-security.js";
 import { closeConnectorScope } from "../connector-scope.js";
 import { drainOAuthStartResets } from "../auth/oauth-start-reset.js";
-import { finishOAuthConnectStart, consumeOAuthConnectLink, oauthConnectUnavailable, verifyOAuthHandoff, } from "../oauth-handoff.js";
+import { finishOAuthConnectStart, claimOAuthConnectStart, oauthConnectUnavailable, verifyOAuthHandoff, } from "../oauth-handoff.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { runEdge, withDeadlineEffect } from "../runtime/run.js";
 import { admitsMaintainer, authorizeUiIdentity, mayManageConnector, privateJson, withSessionCookies, } from "./shared.js";
@@ -66,6 +66,9 @@ export function routeConnect(context) {
 async function connect(context) {
     const { opts, request, baseUrl, runtimeContext } = context;
     const refuse = (error, status = 403) => privateJson({ error }, { status });
+    const invalidLink = () => refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+    // Spends nothing, so this same link works once the other visit settles.
+    const starting = () => refuse("This connection is starting in another visit. Reload this page in a moment. If this stays, start a new connection request.", 409);
     if (request.method !== "GET")
         return privateJson({ error: "method not allowed" }, { status: 405, headers: { Allow: "GET" } });
     const unavailable = oauthConnectUnavailable(opts);
@@ -74,7 +77,7 @@ async function connect(context) {
     const id = context.path.slice("/connect/".length);
     const handoff = await verifyOAuthHandoff(opts, baseUrl, id, context.url.searchParams.get("h"));
     if (!handoff)
-        return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+        return invalidLink();
     const authPage = () => {
         const target = new URL(`/connectors/${id}`, baseUrl);
         target.searchParams.set("h", context.url.searchParams.get("h"));
@@ -124,10 +127,11 @@ async function connect(context) {
         }
         if (target.origin !== new URL(baseUrl).origin || target.username || target.password)
             return refuse("Credential management URL is unavailable", 503);
-        if (!(await consumeOAuthConnectLink(opts, handoff)))
-            return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
-        if (!(await finishOAuthConnectStart(opts, handoff, "started")))
-            return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+        const claim = await claimOAuthConnectStart(opts, handoff);
+        if (claim === "pending")
+            return starting();
+        if (claim === "refused" || !(await finishOAuthConnectStart(opts, handoff, "started")))
+            return invalidLink();
         // Credential entry stays in the authenticated operator UI on this origin.
         return withSessionCookies(new Response(null, {
             status: 302,
@@ -149,16 +153,20 @@ async function connect(context) {
     const timeoutError = new ConnectorCallError("timeout", "OAuth authorization start timed out");
     let claimed = false;
     try {
-        if (!(await consumeOAuthConnectLink(opts, handoff)))
-            return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+        const claim = await claimOAuthConnectStart(opts, handoff);
+        if (claim === "pending")
+            return starting();
+        if (claim === "refused")
+            return invalidLink();
         claimed = true;
+        const force = claim === "reset";
         const status = await runEdge(withDeadlineEffect((signal) => Effect.tryPromise({
             try: async () => {
                 ctx = registry.contextFor(id, baseUrl, scope, {
                     signal,
                     ...(context.defer ? { defer: context.defer } : {}),
                 });
-                const started = await connector.startAuth(ctx, { force: handoff.force });
+                const started = await connector.startAuth(ctx, { force });
                 if (signal.aborted)
                     throw signal.reason;
                 if (started.authorizationUrl) {
@@ -181,11 +189,11 @@ async function connect(context) {
             catch: (error) => error,
         }), { timeoutMs: START_TIMEOUT_MS, signal: request.signal, timeoutError }));
         await drainOAuthStartResets(scope);
-        if (handoff.force || (!status.authorizationReused && status.state !== "ok"))
+        if (force || (!status.authorizationReused && status.state !== "ok"))
             await registry.invalidateStored(id);
         if (status.state === "ok") {
             if (!(await finishOAuthConnectStart(opts, handoff, "started")))
-                return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+                return invalidLink();
             return withSessionCookies(new Response("This connector is already connected.", { headers: { "Cache-Control": "no-store" } }), authz.sessionCookies);
         }
         if (status.state !== "auth_required" || !status.authorizationUrl) {
@@ -194,7 +202,7 @@ async function connect(context) {
             // state only, since a plugin's `startAuth` returns whatever it likes.
             logFailure(opts.config.logger, "OAuth start failed", failureRecord({
                 connector: id,
-                mode: handoff.force ? "restart" : "continue",
+                mode: force ? "restart" : "continue",
                 state: status.state,
             }));
             return refuse(status.state === "auth_required"
@@ -205,7 +213,7 @@ async function connect(context) {
         if (!["https:", "http:"].includes(target.protocol) || target.username || target.password)
             return refuse("OAuth authorization returned no safe URL", 502);
         if (!(await finishOAuthConnectStart(opts, handoff, "started")))
-            return refuse("Invalid or expired connection link. Request a new link from connecta.", 400);
+            return invalidLink();
         return withSessionCookies(new Response(null, { status: 302, headers: { Location: target.href, "Cache-Control": "no-store" } }), authz.sessionCookies);
     }
     catch (error) {

package/dist/routes/mcp.js

@@ -1,5 +1,5 @@
 import { startTimingTrace } from "../timing-trace.js";
-import { routeNames } from "../agent-routes.js";
+import { META_ROUTES, routeNames } from "../agent-routes.js";
 import { upwardStep } from "../upward.js";
 import { bindDiscoveryEndpoint } from "../discovery-health.js";
 import { authCall, authInvoke, authFlow, authMethod } from "../auth/native.js";
@@ -9,15 +9,15 @@ import { observeAgentAdmission } from "../agent-observation.js";
 import { bindActivityRequest } from "../activity-request.js";
 import { closeScope } from "../runtime/connector-scope.js";
 import { executeLimits } from "../config.js";
-import { oauthConnectUrl, oauthConnectLink, oauthConnectLinkProgress, closeOAuthConnectLinks, claimAuthRetry, oauthConnectUnavailable, } from "../oauth-handoff.js";
+import { oauthConnectUrl, oauthConnectLink, oauthConnectLinkStarted, claimAuthRetry, oauthConnectUnavailable, } from "../oauth-handoff.js";
 import { AuthElicitation } from "../auth-elicitation.js";
 import { classifyInboundRequest, createMcpHandler, isJSONRPCErrorResponse, isLegacyRequest, McpServer, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
 import { Duration, Effect, Exit, Option, Result, Scope } from "effect";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { endpointInstructions } from "../skills.js";
-import { NATIVE_TOOLS_LIST_TTL_MS, NativeSurface, nativeRequestHint } from "../native-tools.js";
+import { ENDPOINT_EXTENSION, endpointExtension, endpointInstructions } from "../skills.js";
+import { NATIVE_DEGRADED_TOOLS_LIST_TTL_MS, NATIVE_TOOLS_LIST_TTL_MS, NativeSurface, nativeRequestHint, } from "../native-tools.js";
 import { registerSkills } from "./skills.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { redactAgentOutput, sentSecretsForRequest } from "../sent-secrets.js";
@@ -322,7 +322,7 @@ function toolkitRetired(logger, sentSecrets) {
         },
     });
 }
-function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, readOnly = false, pool, principalActor) {
+function serveMcp(request, requestSignal, requestStartedAt, requestScope, opts, baseUrl, actor, registry, canManageAuth, principalKey, runtimeContext, readOnly = false, pool, principalActor, agentEndpoint = false) {
     const sentSecrets = sentSecretsForRequest(requestScope);
     // Every McpServer the request builds is fresh and closes with its scope.
     // The modern handler tears its own down after the exchange; the legacy
@@ -330,7 +330,14 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
     const servers = [];
     // A native pool lists its downstream tools directly (pools.<name>.surface).
     const native = pool !== undefined ? opts.pools.get(pool)?.native : undefined;
+    // Agent endpoints keep six tools until Eve is tested against the seventh. The
+    // eval arms that render other route names measure their own fixed surfaces.
+    const readRoute = opts.config.execute.readRoute && !native && !readOnly && !agentEndpoint && opts.routes === META_ROUTES;
     const createServer = authMethod((hint) => authFlow(function* () {
+        // A native pool's text uses the native contract's wording.
+        const routes = native ? routeNames(native.executeCode ? "native-code" : "native") : opts.routes;
+        // Direct-call and handoff text names the program route read follow-ups should take.
+        const directRoutes = readRoute ? routeNames("read-route") : routes;
         const authElicitation = new AuthElicitation({
             vault: opts.config.vault,
             publicUrl: opts.config.publicUrl,
@@ -338,41 +345,49 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             principal: principalKey,
             registry,
             canManage: canManageAuth,
-            connectLink: authMethod((id, force, after) => authCall(oauthConnectLink, [
+            connectLink: authMethod((id, force, flow) => authCall(oauthConnectLink, [
                 opts,
                 opts.config.publicUrl ?? baseUrl,
                 id,
                 principalKey,
                 force,
                 Boolean(opts.config.vault?.seal && opts.config.vault.open),
-                after,
+                flow,
             ])),
-            linkProgress: authMethod((id, nonce) => authCall(oauthConnectLinkProgress, [opts, baseUrl, id, nonce])),
-            closeLinks: authMethod((id, nonces) => authCall(closeOAuthConnectLinks, [opts, baseUrl, id, nonces])),
+            linkStarted: authMethod((id, nonce) => authCall(oauthConnectLinkStarted, [opts, baseUrl, id, nonce])),
             claimRetry: authMethod((id, nonce) => authCall(claimAuthRetry, [opts, baseUrl, id, nonce])),
             unavailable: oauthConnectUnavailable(opts),
             credentialUi: Boolean(opts.config.ui && opts.config.vault),
+            credentialHandoffUrl: opts.config.ui?.credentialHandoffUrl(baseUrl),
+            routes: directRoutes,
             requestSignal,
             requestScope,
             defer: runtimeContext?.waitUntil?.bind(runtimeContext),
         });
+        // Read as this request's response is built, so a degraded native listing can shorten it.
+        const toolsListHint = { ttlMs: native ? NATIVE_TOOLS_LIST_TTL_MS : 3_600_000, cacheScope: "private" };
+        const connectors = registry.listConnectors();
+        const effectiveReadOnly = readOnly || (connectors.length > 0 && connectors.every((connector) => connector.readOnly === true));
         const server = new McpServer(opts.config.serverInfo, {
             // A request-local server cannot publish catalog changes. Set this before
             // tool registration, whose SDK default otherwise advertises listChanged.
-            capabilities: { tools: { listChanged: false }, extensions: { "io.modelcontextprotocol/skills": {} } },
-            // Instructions reflect the admitted pool and effective write policy. Every cache hint below is private, so a client keeps
-            // what it learned per endpoint URL and never shares it across them.
-            instructions: endpointInstructions(pool !== undefined ? opts.pools.get(pool)?.description : undefined, native, readOnly ||
-                (registry.listConnectors().length > 0 &&
-                    registry.listConnectors().every((connector) => connector.readOnly === true))),
+            capabilities: {
+                tools: { listChanged: false },
+                extensions: {
+                    "io.modelcontextprotocol/skills": {},
+                    [ENDPOINT_EXTENSION]: endpointExtension(connectors, native !== undefined, native?.executeCode ?? true, effectiveReadOnly),
+                },
+            },
+            // Instructions reflect the admitted pool, its connector roster and the effective write
+            // policy. `registry` is this caller's admitted view, the one execute_code's inventory
+            // reads, so a person at plain /mcp never sees an id outside their pool. Every cache hint
+            // below is private, so a client keeps what it learned for this caller and endpoint URL.
+            instructions: endpointInstructions(pool !== undefined ? opts.pools.get(pool)?.description : undefined, native, effectiveReadOnly, connectors.map((connector) => connector.id), readRoute),
             inputRequired: { legacyShim: false },
             requestState: { verify: (state, context) => authElicitation.verify(state, context) },
             cacheHints: {
                 "server/discover": { ttlMs: 3_600_000, cacheScope: "private" },
-                "tools/list": {
-                    ttlMs: native ? NATIVE_TOOLS_LIST_TTL_MS : 3_600_000,
-                    cacheScope: "private",
-                },
+                "tools/list": toolsListHint,
             },
         });
         servers.push(server);
@@ -400,12 +415,15 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
         });
-        const diagnostics = native ? { ...native, catalogErrors: [] } : undefined;
-        // A native pool's text uses the native contract's wording.
-        const routes = native ? routeNames(native.executeCode ? "native-code" : "native") : opts.routes;
+        const diagnostics = native
+            ? { ...native, catalogErrors: [], staleCatalogs: [] }
+            : undefined;
+        // The program tool this request lists and its reads may offer: the read route, where listed.
+        const programTool = !native || native.executeCode ? directRoutes.program : undefined;
         const nativeRoute = registerMetaTools(server, registry, {
             native: diagnostics,
-            routes,
+            programTool,
+            routes: directRoutes,
             authElicitation,
             client,
             baseUrl,
@@ -417,19 +435,23 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             credentialHandoffUrl: opts.config.ui?.credentialHandoffUrl(baseUrl),
             ...(activity ? { activity } : {}),
             defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
+            responseCeilingMs: opts.config.execute.watchdogMs,
+            requestStartedAt,
             maxProgramResultChars: opts.config.execute.maxResultChars,
+            maxProgramHostCalls: opts.config.execute.maxHostCalls,
             probeTimeoutMs: opts.config.discovery.probeTimeoutMs,
             discoveryConcurrency: opts.config.discovery.concurrency,
             requestSignal,
             ...(runtimeContext?.waitUntil ? { defer: runtimeContext.waitUntil.bind(runtimeContext) } : {}),
         });
-        if (!native || native.executeCode) {
+        if (programTool) {
             registerExecuteTool(server, registry, {
                 authElicitation,
                 client,
                 baseUrl,
                 requestScope,
                 executor: opts.executor,
+                requestStartedAt,
                 defaultToolTimeoutMs: opts.config.calls.defaultTimeoutMs ?? opts.config.execute.hostCallTimeoutMs,
                 logger: opts.config.logger,
                 ...(activity ? { activity } : {}),
@@ -439,6 +461,7 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
                 readOnly,
                 native: native !== undefined,
                 routes,
+                readRoute,
             });
         }
         if (native && nativeRoute && hint) {
@@ -448,6 +471,10 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
                 route: nativeRoute,
                 bind: (context) => authElicitation.bind(context),
                 catalogErrors: diagnostics.catalogErrors,
+                staleCatalogs: diagnostics.staleCatalogs,
+                onDegradedListing: () => {
+                    toolsListHint.ttlMs = NATIVE_DEGRADED_TOOLS_LIST_TTL_MS;
+                },
                 logger: opts.config.logger,
                 requestScope,
                 requestSignal,
@@ -665,6 +692,8 @@ export function createMcpRoute(opts) {
             // The Node adapter has already buffered up to its own pre-auth cap
             // (`listen`'s `maxBodyBytes`) before a request reaches core.
             const startedAt = Date.now();
+            // The response ceiling counts from here; a future stamp could only extend it.
+            const arrivedAt = Math.min(context.runtimeContext?.requestArrivedAt ?? startedAt, startedAt);
             const maxDurationMs = opts.requestAdmission.maxDurationMs;
             const listenHeader = request.method === "POST" && request.headers.get("Mcp-Method") === "subscriptions/listen";
             const refuseAdmission = (error) => {
@@ -942,7 +971,7 @@ export function createMcpRoute(opts) {
                 if (new URL(request.url).searchParams.has("toolkit")) {
                     return cors(toolkitRetired(opts.config.logger, sentSecrets));
                 }
-                return cors(yield* serveMcp(localRequest, localAbort.signal, requestScope, opts, baseUrl, authz.actor, scopedRegistry, (id) => {
+                return cors(yield* serveMcp(localRequest, localAbort.signal, arrivedAt, requestScope, opts, baseUrl, authz.actor, scopedRegistry, (id) => {
                     const connector = scopedRegistry.getConnector(id);
                     return Boolean(connector && mayManageConnector(opts, authz, connector));
                 }, authz.principalKey, runtimeContext, readOnly, scope.pool, authz.identity.principal
@@ -951,7 +980,7 @@ export function createMcpRoute(opts) {
                         id: authz.identity.principal.id,
                         namespace: authz.identity.principal.namespace,
                     }
-                    : undefined));
+                    : undefined, agentEndpoint));
             });
             if (remainingMs === undefined)
                 return yield* handled;

package/dist/routes/shared.d.ts

@@ -34,6 +34,12 @@ export interface ServerOptions {
 }
 export interface RuntimeExecutionContext extends InboundAuthRuntimeContext {
     waitUntil(promise: Promise<unknown>): void;
+    /**
+     * When the Node adapter received this request's headers, before it buffered
+     * the body. It comes from the host, never from anything the request carries.
+     * Workers read the body lazily, so the route's own clock already counts upload.
+     */
+    readonly requestArrivedAt?: number;
 }
 export interface RouteContext {
     request: Request;

package/dist/runtime/call.js

@@ -359,17 +359,22 @@ export function wrapViewCredentials(view) {
         return;
     entry.credentialWrapped = true;
     const access = view.credential;
+    // A read outlives a caller that stopped waiting and registers when it lands, so the
+    // request counts it until then: a sealing run must not publish ahead of that.
+    const read = async (value, values) => {
+        const done = requestOf(entry.request).credentialReads.begin();
+        try {
+            const result = await value();
+            registerCredentialValues(viewSecrets(view), values(result));
+            return result;
+        }
+        finally {
+            done();
+        }
+    };
     view.credential = {
-        get: (field) => settleOnClose(view, async () => {
-            const value = await access.get(field);
-            registerCredentialValues(viewSecrets(view), value === null ? null : { [field ?? "value"]: value });
-            return value;
-        }, true),
-        getAll: () => settleOnClose(view, async () => {
-            const values = await access.getAll();
-            registerCredentialValues(viewSecrets(view), values);
-            return values;
-        }, true),
+        get: (field) => settleOnClose(view, () => read(() => access.get(field), (value) => (value === null ? null : { [field ?? "value"]: value })), true),
+        getAll: () => settleOnClose(view, () => read(() => access.getAll(), (values) => values), true),
     };
 }
 /** Credentials for request-owned transports use the operation, never a closed call. */

package/dist/runtime/request-scope.js

@@ -1,9 +1,42 @@
 import { traceFor } from "../timing-trace.js";
 // One owner per existing upstream request identity. Facts survive revocation;
 // retaining them never reconstitutes a call capability or a live operation.
-import { Context, Exit, Scope } from "effect";
+import { Context, Effect, Exit, Scope } from "effect";
 import { RequestReads } from "./request-reads.js";
 import { detach } from "./run.js";
+/** Work that can still add to a secret set. A sealing run waits until none is left. */
+export class PendingWork {
+    active = 0;
+    waiting = new Set();
+    get pending() {
+        return this.active > 0;
+    }
+    /** Returns the function that ends this piece of work; calling it twice counts once. */
+    begin() {
+        this.active++;
+        let done = false;
+        return () => {
+            if (done)
+                return;
+            done = true;
+            if (--this.active > 0)
+                return;
+            for (const wake of this.waiting)
+                wake();
+            this.waiting.clear();
+        };
+    }
+    /** Succeeds when nothing is pending. Interrupting it drops the wait. */
+    idle = Effect.callback((resume) => {
+        if (this.active === 0)
+            return resume(Effect.void);
+        const wake = () => resume(Effect.void);
+        this.waiting.add(wake);
+        return Effect.sync(() => {
+            this.waiting.delete(wake);
+        });
+    });
+}
 export class RequestOwner {
     identity;
     open = true;
@@ -14,6 +47,8 @@ export class RequestOwner {
     calls = new Set();
     signals = new WeakMap();
     scope = Scope.makeUnsafe();
+    /** Credential reads whose values have yet to join this request's secret set. */
+    credentialReads = new PendingWork();
     // Initialize secrets only when data is sent. Metadata-only UI imports must
     // not retain the payload matcher merely to revoke a request.
     retained = {

package/dist/runtime/run.js

@@ -128,7 +128,10 @@ export function withDeadlineEffect(operation, options) {
             fromSignal(controller.signal),
         ];
         if (options.timeoutMs !== undefined) {
-            contenders.push(Effect.sleep(Duration.millis(options.timeoutMs)).pipe(Effect.andThen(Effect.sync(() => controller.abort(options.timeoutError))), Effect.andThen(Effect.never)));
+            contenders.push(Effect.sleep(Duration.millis(options.timeoutMs)).pipe(Effect.andThen(Effect.suspend(() => {
+                const more = options.extendMs?.() ?? 0;
+                return more > 0 ? Effect.sleep(Duration.millis(more)) : Effect.void;
+            })), Effect.andThen(Effect.sync(() => controller.abort(options.timeoutError))), Effect.andThen(Effect.never)));
         }
         return Effect.raceAllFirst(contenders).pipe(Effect.ensuring(Effect.sync(() => {
             controller.abort();