runbios-mcp 0.2.1-dev.163 → 0.2.1-dev.164

package/dist/config.d.ts

@@ -31,16 +31,33 @@ export declare function resolveLaunchGates(env?: LaunchGateEnv): LaunchGates;
  * environment gates above answer "is this surface open in this deployment?";
  * the training-beta grant answers "is THIS organization admitted?". When an
  * env gate is closed and the session knows its org, we ask the control plane
- * once — GET /api/organizations/{id}/features, the same endpoint the console
+ * — GET /api/organizations/{id}/features, the same endpoint the console
  * reads — and a granted org gets the creation tools registered for its
  * session even where the environment stays gated for everyone else.
  *
  * Fail-closed in both directions, matching the services: any failure to
- * resolve (no org, non-200, malformed body, network down) reads as NOT
- * granted and the env gates stand as resolved.
+ * resolve (no org, non-200, malformed body, network down, TIMEOUT) reads as
+ * NOT granted and the env gates stand as resolved.
+ *
+ * TWO THINGS GUARD THE HOT PATH, because in the environments that matter the
+ * gates are CLOSED, so this resolution runs on EVERY hosted MCP request —
+ * including tool calls that have nothing to do with training:
+ *
+ *   * A deadline. The control-plane read is not allowed to be slower than
+ *     GRANT_RESOLVE_TIMEOUT_MS; past that the answer is "not granted". Without
+ *     it, a workspace-service that hangs rather than refuses would hang every
+ *     MCP request behind it — failing closed only helps if it fails PROMPTLY.
+ *   * A short per-org cache. A session is many POSTs, and an entitlement does
+ *     not change between two tool calls a second apart. The TTL is deliberately
+ *     seconds, not minutes: an operator who admits a customer expects the next
+ *     reconnect to work, not to wait out a cache.
  */
+export declare const GRANT_RESOLVE_TIMEOUT_MS = 2000;
+export declare const GRANT_CACHE_TTL_MS = 30000;
+/** Test seam: drop memoised grants so a case starts from a cold cache. */
+export declare function resetGrantCache(): void;
 export declare function sessionLaunchGates(orgId: string, getFeatures: () => Promise<{
     features?: Record<string, boolean>;
-}>, env?: LaunchGateEnv): Promise<LaunchGates>;
+}>, env?: LaunchGateEnv, now?: () => number): Promise<LaunchGates>;
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,KAAK,UAAU,GAAG,OAAO,CACvB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAC9D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,UAAwB,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,KAAK,aAAa,GAAG,OAAO,CAC1B,IAAI,CACF,MAAM,CAAC,UAAU,EACf,8BAA8B,GAC9B,2BAA2B,GAC3B,8BAA8B,GAC9B,2BAA2B,CAC9B,CACF,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,aAA2B,GAAG,WAAW,CAKhF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAClE,GAAG,GAAE,aAA2B,GAC/B,OAAO,CAAC,WAAW,CAAC,CAUtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,KAAK,UAAU,GAAG,OAAO,CACvB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAC9D,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,UAAwB,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,KAAK,aAAa,GAAG,OAAO,CAC1B,IAAI,CACF,MAAM,CAAC,UAAU,EACf,8BAA8B,GAC9B,2BAA2B,GAC3B,8BAA8B,GAC9B,2BAA2B,CAC9B,CACF,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,aAA2B,GAAG,WAAW,CAKhF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAC9C,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAKzC,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAClE,GAAG,GAAE,aAA2B,EAChC,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAqCtB"}

package/dist/config.js

@@ -18,26 +18,70 @@ export function resolveLaunchGates(env = process.env) {
  * environment gates above answer "is this surface open in this deployment?";
  * the training-beta grant answers "is THIS organization admitted?". When an
  * env gate is closed and the session knows its org, we ask the control plane
- * once — GET /api/organizations/{id}/features, the same endpoint the console
+ * — GET /api/organizations/{id}/features, the same endpoint the console
  * reads — and a granted org gets the creation tools registered for its
  * session even where the environment stays gated for everyone else.
  *
  * Fail-closed in both directions, matching the services: any failure to
- * resolve (no org, non-200, malformed body, network down) reads as NOT
- * granted and the env gates stand as resolved.
+ * resolve (no org, non-200, malformed body, network down, TIMEOUT) reads as
+ * NOT granted and the env gates stand as resolved.
+ *
+ * TWO THINGS GUARD THE HOT PATH, because in the environments that matter the
+ * gates are CLOSED, so this resolution runs on EVERY hosted MCP request —
+ * including tool calls that have nothing to do with training:
+ *
+ *   * A deadline. The control-plane read is not allowed to be slower than
+ *     GRANT_RESOLVE_TIMEOUT_MS; past that the answer is "not granted". Without
+ *     it, a workspace-service that hangs rather than refuses would hang every
+ *     MCP request behind it — failing closed only helps if it fails PROMPTLY.
+ *   * A short per-org cache. A session is many POSTs, and an entitlement does
+ *     not change between two tool calls a second apart. The TTL is deliberately
+ *     seconds, not minutes: an operator who admits a customer expects the next
+ *     reconnect to work, not to wait out a cache.
  */
-export async function sessionLaunchGates(orgId, getFeatures, env = process.env) {
+export const GRANT_RESOLVE_TIMEOUT_MS = 2_000;
+export const GRANT_CACHE_TTL_MS = 30_000;
+const grantCache = new Map();
+/** Test seam: drop memoised grants so a case starts from a cold cache. */
+export function resetGrantCache() {
+    grantCache.clear();
+}
+export async function sessionLaunchGates(orgId, getFeatures, env = process.env, now = Date.now) {
     const gates = resolveLaunchGates(env);
     if (!orgId || (!gates.training && !gates.datasets))
         return gates;
+    const open = { training: false, datasets: false };
+    const cached = grantCache.get(orgId);
+    if (cached && now() - cached.at < GRANT_CACHE_TTL_MS) {
+        return cached.granted ? open : gates;
+    }
+    let granted = false;
+    let deadline;
     try {
-        const res = await getFeatures();
-        if (res?.features?.training !== true)
-            return gates;
-        return { training: false, datasets: false };
+        // Promise.race, not an AbortSignal: the caller hands us an opaque
+        // thunk, so the deadline belongs here rather than in each call site.
+        // A timed-out read is abandoned, never awaited — the request moves on.
+        const res = await Promise.race([
+            getFeatures(),
+            new Promise((_, reject) => {
+                deadline = setTimeout(() => reject(new Error("grant resolution timed out")), GRANT_RESOLVE_TIMEOUT_MS);
+            }),
+        ]);
+        granted = res?.features?.training === true;
     }
     catch {
+        // Every failure direction lands here and leaves `granted` false. A
+        // failure is NOT cached: a blip must not lock a paying customer out for
+        // the whole TTL, and retrying next request is cheap.
         return gates;
     }
+    finally {
+        // Always clear it. A 2s timer left per request is a slow leak on an
+        // endpoint that serves one of these per tool call, and an uncleared
+        // one keeps the process alive past when it should exit.
+        clearTimeout(deadline);
+    }
+    grantCache.set(orgId, { granted, at: now() });
+    return granted ? open : gates;
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAM7D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB,OAAO,CAAC,GAAG;IAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAgCD,MAAM,UAAU,kBAAkB,CAAC,MAAqB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,OAAO;QACzF,QAAQ,EAAE,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,OAAO;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,WAAkE,EAClE,MAAqB,OAAO,CAAC,GAAG;IAEhC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;QAChC,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAM7D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAkB,OAAO,CAAC,GAAG;IAC1D,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC;AAgCD,MAAM,UAAU,kBAAkB,CAAC,MAAqB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,QAAQ,EAAE,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,OAAO;QACzF,QAAQ,EAAE,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC,yBAAyB,CAAC,KAAK,OAAO;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,WAAkE,EAClE,MAAqB,OAAO,CAAC,GAAG,EAChC,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjE,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,kBAAkB,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACvC,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAmD,CAAC;IACxD,IAAI,CAAC;QACH,kEAAkE;QAClE,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC7B,WAAW,EAAE;YACb,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;YACzG,CAAC,CAAC;SACH,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,wEAAwE;QACxE,qDAAqD;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,oEAAoE;QACpE,oEAAoE;QACpE,wDAAwD;QACxD,YAAY,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAChC,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.2.1-dev.163";
+export declare const VERSION = "0.2.1-dev.164";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.2.1-dev.163";
+export const VERSION = "0.2.1-dev.164";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runbios-mcp",
-  "version": "0.2.1-dev.163",
+  "version": "0.2.1-dev.164",
   "description": "Run BiOS MCP server — train and deploy AI models from MCP-compatible automation clients",
   "license": "MIT",
   "type": "module",