snulbug 0.2.1__tar.gz → 0.2.2__tar.gz

{snulbug-0.2.1 → snulbug-0.2.2}/CHANGELOG.md

@@ -6,6 +6,20 @@ The format is based on Keep a Changelog, and this project follows semantic versi
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-10-16
+
+Support always-on MCP bots with renewable automation invites, without introducing
+a separate permission or approval system.
+
+- Added renewable automation invites using the existing backing lease, with bounded consumer renewal/restart recovery, rotating access tokens, identity bindings, persistent usage budgets, and console/CLI setup snippets.
+- Serialized lease mutations across local workers so renewal, revocation, cleanup, and concurrent call consumption cannot overwrite each other's state.
+- Added renewal visibility and refresh-stable invite forms in the web console, secret-safe renewal audit events, and share closeout that revokes invites as well as the session lease.
+
+Automation renewal is opt-in. Access leases remain short-lived; the owner's
+renewal authorization has a separate hard expiry. Clients must adopt refreshed
+lease headers, and revocation or exhausted budgets prevent recovery. No change
+to the default MCP protocol version or the experimental profile's limitations.
+
 ## [0.2.1] - 2026-10-15
 
 Expose web applications and APIs alongside MCP through one gateway and ngrok tunnel.

{snulbug-0.2.1 → snulbug-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: snulbug
-Version: 0.2.1
+Version: 0.2.2
 Summary: A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles
 Project-URL: Homepage, https://github.com/nahuaque/snulbug
 Project-URL: Repository, https://github.com/nahuaque/snulbug
@@ -63,6 +63,8 @@ It gives you a tight loop for agent-tool safety:
 - review MCP-native capability requests and approve them into normal task leases
 - use task-scoped leases for temporary tool/path grants, optionally bound to
   OAuth subject, tenant, client, group, issuer, or auth profile
+- give always-on bots [renewable automation invites](docs/mcp-share.md#renewable-automation-invites)
+  with short-lived leases, consumer renewal, and restart recovery
 - turn OAuth identity into MCP-specific tool permissions
 - pin facade upstream identity with signed manifests
 

{snulbug-0.2.1 → snulbug-0.2.2}/README.md

@@ -20,6 +20,8 @@ It gives you a tight loop for agent-tool safety:
 - review MCP-native capability requests and approve them into normal task leases
 - use task-scoped leases for temporary tool/path grants, optionally bound to
   OAuth subject, tenant, client, group, issuer, or auth profile
+- give always-on bots [renewable automation invites](docs/mcp-share.md#renewable-automation-invites)
+  with short-lived leases, consumer renewal, and restart recovery
 - turn OAuth identity into MCP-specific tool permissions
 - pin facade upstream identity with signed manifests
 

{snulbug-0.2.1 → snulbug-0.2.2}/SECURITY.md

@@ -59,6 +59,16 @@ Limits:
   schemas pass through unless your Lua policy blocks them separately.
 - Leases are bearer-style capabilities. Store `leases.json` locally, rotate or
   revoke leases after sharing, and prefer short TTLs for public tunnel use.
+- Renewable automation invites add a separate, reusable renewal credential with
+  an owner-set hard deadline. Treat it as a long-lived bot secret: theft together
+  with the required gateway authentication permits recovery within the approved
+  capability and call-budget bounds until revocation or expiry. It does not
+  grant console access. Renewal retains the existing lease's usage count and
+  identity bindings; revocation disables recovery. Access-token rotation has a
+  bounded overlap of at most 30 seconds. Lease operations are serialized on the
+  local lease file; independent gateway hosts must not treat copied JSON stores
+  as a shared revocation authority. The owner console's invite secret store
+  contains plaintext setup credentials and must remain private.
 
 ### Malicious or compromised MCP server
 

{snulbug-0.2.1 → snulbug-0.2.2}/docs/devcontainers.md

@@ -10,8 +10,8 @@ servers with a shared control plane.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.1": {
-      "version": "0.2.1",
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
+      "version": "0.2.2",
       "mode": "member-agent",
       "policy_profile": "tunnel-safe",
       "registry": "redis://redis:6379/0",

{snulbug-0.2.1 → snulbug-0.2.2}/docs/mcp-proxy.md

@@ -920,6 +920,10 @@ snulbug mcp evidence impact traces/session.jsonl --lease leases.json --report-ou
 In facade mode, leases use the client-facing tool name, such as
 `files.read_file` or `git.status`.
 
+For unattended consumers, [renewable automation invites](mcp-share.md#renewable-automation-invites)
+extend the same task lease with bounded consumer renewal and restart recovery.
+They retain the existing Lua, OAuth identity, revocation, and call-budget checks.
+
 ## Tool Schema Firewall
 
 When `schema_validation = true`, snulbug learns each MCP tool's `inputSchema`

{snulbug-0.2.1 → snulbug-0.2.2}/docs/mcp-share.md

@@ -123,6 +123,94 @@ traffic is observed. The table records evidence source, confidence, risk level,
 categories, and signals such as command-capable arguments, network/path
 arguments, destructive annotations, and open argument schemas.
 
+## Renewable Automation Invites
+
+For an always-on bot, enable **Renewable automation invite** in the console's
+Invites tab, or extend the normal invite command:
+
+```bash
+snulbug mcp share invite create .snulbug/shares/my-share \
+  --recipient nightly-bot --task "Inspect project" \
+  --capability project_readonly \
+  --renewable --ttl 30m --renewal-ttl 7d
+```
+
+`--ttl` controls the short-lived access lease. `--renewal-ttl` is the owner's
+hard authorization deadline, measured from invite creation, not each renewal.
+The backing lease keeps its ID, capabilities, identity bindings, usage count,
+and total `--max-calls` budget. Renewal does not approve policy changes or
+replenish an exhausted budget. Use the existing Lua rate limits for recurring
+request limits; this is not a new daily quota system.
+
+The setup packet includes a renewal credential, a curl command, and a Python
+integration example. Store the renewal credential as a bot secret, separately
+from the short-lived `x-snulbug-lease` token. It is reusable until its deadline
+or revocation, is not an OAuth refresh token, and cannot administer the console
+or create other invites. It is shown only through the existing owner CLI or
+secret-gated console. Protect the share directory and its `invite-secrets.json`.
+
+Consumers use ordinary HTTPS against the **same MCP URL**, so ngrok and other
+generated tunnel routes need no additional public endpoint:
+
+```bash
+export SNULBUG_MCP_URL="https://your-tunnel.example/mcp"
+export SNULBUG_INVITE_ID="invite_..."
+export SNULBUG_RENEWAL_TOKEN="sbr_..."
+# Set SNULBUG_BEARER_TOKEN to the bearer token from the invite packet.
+curl --fail-with-body -sS "$SNULBUG_MCP_URL" \
+  -H "Authorization: Bearer ${SNULBUG_BEARER_TOKEN}" \
+  -H "x-snulbug-renewal: ${SNULBUG_RENEWAL_TOKEN}" \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json, text/event-stream' \
+  -d "{\"jsonrpc\":\"2.0\",\"id\":\"renew\",\"method\":\"snulbug/lease/renew\",\"params\":{\"invite_id\":\"${SNULBUG_INVITE_ID}\"}}"
+```
+
+`snulbug/lease/renew` is a snulbug JSON-RPC extension, not a standard MCP method
+or an upstream tool. Its only parameter is `invite_id`; the consumer cannot
+choose a longer TTL, larger budget, or different capabilities. The gateway
+terminates the request without forwarding the renewal credential upstream.
+Errors use `error.data.reason_code`, even when the HTTP status is 200.
+
+On success, `result.headers` contains the current lease header;
+`result.lease.expires_at` and `result.lease.renewal.renew_after` tell the bot
+when to refresh its MCP client's headers. Call again at `renew_after`, with
+jitter and backoff for network failures. Retries inside the same lease window
+return the same access token. A renewal rotates it with at most 30 seconds of
+overlap for in-flight requests, bounded by the old token's original expiry.
+After a process restart or an expired access lease, the **same operation**
+recovers access while the owner authorization remains valid. No old lease token
+or installed snulbug client is required. Fixed-header clients need a refresh
+integration; a static client configuration does not renew itself.
+
+OAuth shares still require a valid access token obtained from the configured
+identity provider. Bind automation invites using `--allow-issuer` plus
+`--allow-subject` or `--allow-client-id`; optionally add `--allow-tenant`.
+Use that access token as the renewal request's `Authorization` header and the
+separate invite renewal credential as `x-snulbug-renewal`. Required OAuth scopes,
+DPoP requirements, and identity bindings still apply. Tool scope maps, claim
+policies, and Lua continue to govern every ordinary MCP tool call.
+For DPoP-required shares, the consumer must also sign and attach a fresh proof
+for each renewal request using its existing OAuth/DPoP client integration; the
+plain curl/Python examples do not mint proofs or OAuth access tokens.
+
+Revoking the invite or backing lease disables renewal and restart recovery.
+Closing the share with its default revocation option revokes its invites too.
+Even `invite revoke --keep-lease` revokes renewal authority; it leaves only the
+already-issued access lease usable until expiry. Removed capability labels,
+exhausted budgets, and expired renewal authorizations fail closed. Create a new
+invite for a new approval; operator reactivation cannot reset a renewable lease.
+Cleanup retains expired access leases while their renewal authorization is
+active. The console shows authorization expiry, access expiry, next renewal,
+and last renewal/count, and keeps setup snippets synchronized with token rotation.
+Renewal decisions go to the existing audit/event sinks, not the Lua replay log:
+renewing a credential is a control operation, not a simulated policy decision.
+
+Renewal and lease consumption use the existing JSON lease store with file locks
+and atomic replacement, including across local worker processes. Persist that
+file and the share directory across gateway restarts. This does not introduce
+a distributed lease database; separate hosts need a shared authority rather
+than independent copies of `leases.json`.
+
 ## Generated files
 
 By default, the command writes under `.snulbug/shares/share-*` and creates:

{snulbug-0.2.1 → snulbug-0.2.2}/docs/release.md

@@ -3,7 +3,8 @@
 1. Finalize `CHANGELOG.md`, with a dated release section and upgrade notes. Keep
    protocol preview limitations distinct from package release readiness.
 2. Bump `version` in `pyproject.toml` and `snulbug/__init__.py`, update the
-   devcontainer feature manifest and its docs/example references, and run `uv lock`.
+   devcontainer feature manifest and its docs/example references (including
+   `examples/codespace_local_gateway/.devcontainer/devcontainer.json`), and run `uv lock`.
 3. Run verification:
 
 ```bash
@@ -48,7 +49,7 @@ python -m zipfile -l dist/snulbug-*.whl
 8. Install from TestPyPI in a clean environment and smoke test:
 
 ```bash
-uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.1 --help
+uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ snulbug==0.2.2 --help
 ```
 
 9. Run the manual `Publish` workflow with `repository = pypi` when the TestPyPI
@@ -56,4 +57,4 @@ uvx --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org
 10. Create the GitHub release and tag after the PyPI package is available.
 
 The `Publish` workflow uses `workflow_dispatch`, not a tag trigger. Creating or
-pushing `v0.2.1` does not publish a package or automatically create a GitHub release.
+pushing `v0.2.2` does not publish a package or automatically create a GitHub release.

{snulbug-0.2.1 → snulbug-0.2.2}/examples/codespace_local_gateway/.devcontainer/devcontainer.json

@@ -2,7 +2,7 @@
   "name": "snulbug Codespace MCP member",
   "features": {
     "ghcr.io/devcontainers/features/python:1": {},
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.1": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.1 → snulbug-0.2.2}/features/snulbug/README.md

@@ -6,7 +6,7 @@ workspace helpers for Codespaces/devcontainers.
 ```json
 {
   "features": {
-    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.1": {
+    "ghcr.io/nahuaque/snulbug/features/snulbug:0.2.2": {
       "install_source": "github",
       "github_ref": "main",
       "mode": "member-agent",

{snulbug-0.2.1 → snulbug-0.2.2}/features/snulbug/devcontainer-feature.json

@@ -1,6 +1,6 @@
 {
   "id": "snulbug",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "name": "snulbug",
   "description": "Install snulbug and optional helpers for MCP policy gateways and remote fabric members in devcontainers.",
   "documentationURL": "https://github.com/nahuaque/snulbug/blob/main/docs/devcontainers.md",

{snulbug-0.2.1 → snulbug-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "snulbug"
-version = "0.2.1"
+version = "0.2.2"
 description = "A local-dev MCP policy proxy with Lua policies, replay logs, and learned least-privilege bundles"
 readme = "README.md"
 requires-python = ">=3.10"

{snulbug-0.2.1 → snulbug-0.2.2}/snulbug/__init__.py

@@ -1,6 +1,6 @@
 """Local-dev MCP policy proxy and programmable Lua ASGI policy layer."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"
 
 from .auth_providers import (
     AuthProvider,
@@ -206,6 +206,7 @@ from .leases import (
     create_lease,
     list_leases,
     reactivate_lease,
+    renew_lease,
     revoke_lease,
 )
 from .manifests import load_manifest, manifest_digest, sign_upstream_manifest, verify_upstream_manifest, write_manifest
@@ -746,6 +747,7 @@ __all__ = [
     "record_audit_event",
     "record_policy_request",
     "reactivate_lease",
+    "renew_lease",
     "reconcile_fabric_controller",
     "reconcile_policy_activation",
     "register_fabric_member",

{snulbug-0.2.1 → snulbug-0.2.2}/snulbug/cli/share.py

@@ -627,6 +627,12 @@ def handle_mcp_share_command(args: argparse.Namespace, parser: argparse.Argument
                     ttl=args.ttl,
                     max_calls=args.max_calls,
                     client_name=args.client_name,
+                    renewable=args.renewable,
+                    renewal_ttl=args.renewal_ttl,
+                    allow_subjects=args.allow_subject,
+                    allow_issuers=args.allow_issuer,
+                    allow_tenants=args.allow_tenant,
+                    allow_client_ids=args.allow_client_id,
                 )
             elif args.share_invite_command == "list":
                 result = list_mcp_share_invites(args.directory, include_revoked=not args.active_only)
@@ -1488,6 +1494,22 @@ def _add_share_invite_args(parser: argparse.ArgumentParser) -> None:
     invite_create.add_argument("--ttl", default="30m", help="invite lease TTL, such as 30m, 2h, or 1d")
     invite_create.add_argument("--max-calls", type=int, help="maximum number of allowed tools/call uses")
     invite_create.add_argument("--client-name", help="MCP client config server name")
+    invite_create.add_argument(
+        "--renewable", action="store_true", help="allow this automation to renew/recover its short-lived lease"
+    )
+    invite_create.add_argument(
+        "--renewal-ttl", default="7d", help="hard renewal authorization lifetime; defaults to 7d"
+    )
+    invite_create.add_argument(
+        "--allow-subject", action="append", default=[], help="bind the invite to this authenticated subject"
+    )
+    invite_create.add_argument(
+        "--allow-issuer", action="append", default=[], help="bind the invite to this OAuth issuer"
+    )
+    invite_create.add_argument("--allow-tenant", action="append", default=[], help="bind the invite to this tenant")
+    invite_create.add_argument(
+        "--allow-client-id", action="append", default=[], help="bind the invite to this OAuth workload client"
+    )
     add_compact_arg(invite_create)
 
     invite_list = invite_subparsers.add_parser("list", help="list MCP share invites without revealing tokens")

{snulbug-0.2.1 → snulbug-0.2.2}/snulbug/leases.py

@@ -1,21 +1,70 @@
 from __future__ import annotations
 
 import hashlib
+import hmac
 import json
+import math
+import os
 import posixpath
 import secrets
 import shlex
-from collections.abc import Mapping, Sequence
+import threading
+from collections.abc import Callable, Mapping, Sequence
+from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
+from functools import wraps
 from pathlib import Path
-from typing import Any
+from typing import Any, Iterator
 from urllib.parse import urlparse
 
 from .middleware import Scope
 
 LEASE_HEADER = "x-snulbug-lease"
 LEASE_TOKEN_PREFIX = "sbl_"
+LEASE_RENEWAL_METHOD = "snulbug/lease/renew"
+LEASE_RENEWAL_HEADER = "x-snulbug-renewal"
+_STORE_LOCK = threading.RLock()
+
+
+@contextmanager
+def _store_transaction(path: str | Path) -> Iterator[None]:
+    """Serialize read/modify/write across gateway workers and console threads."""
+
+    store_path = Path(path)
+    store_path.parent.mkdir(parents=True, exist_ok=True)
+    with _STORE_LOCK, store_path.with_name(store_path.name + ".lock").open("a+b") as lock:
+        if os.name == "nt":  # pragma: no cover - Windows CI
+            import msvcrt
+
+            if not lock.seek(0, 2):
+                lock.write(b"\0")
+                lock.flush()
+            lock.seek(0)
+            msvcrt.locking(lock.fileno(), msvcrt.LK_LOCK, 1)
+            try:
+                yield
+            finally:
+                lock.seek(0)
+                msvcrt.locking(lock.fileno(), msvcrt.LK_UNLCK, 1)
+        else:
+            import fcntl
+
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(lock.fileno(), fcntl.LOCK_UN)
+
+
+def _lease_transaction(function):
+    @wraps(function)
+    def locked(path, *args, **kwargs):
+        with _store_transaction(path):
+            return function(path, *args, **kwargs)
+
+    return locked
+
 
 PATH_KEYS = {
     "path",
@@ -42,6 +91,7 @@ class LeasePolicyConfig:
     header: str = LEASE_HEADER
 
 
+@_lease_transaction
 def create_lease(
     path: str | Path,
     *,
@@ -61,6 +111,9 @@ def create_lease(
     max_calls: int | None = None,
     token: str | None = None,
     invite: Mapping[str, Any] | None = None,
+    renewal_ttl: str | int | float | None = None,
+    renewal_token: str | None = None,
+    renewal_bearer: str | None = None,
 ) -> dict[str, Any]:
     """Create a task-scoped lease and return the one-time plaintext token."""
 
@@ -99,6 +152,29 @@ def create_lease(
     invite_metadata = _lease_invite_metadata(invite)
     if invite_metadata:
         lease["invite"] = invite_metadata
+    if renewal_ttl is not None:
+        if not invite_metadata.get("id"):
+            raise ValueError("renewable leases must belong to a share invite")
+        lease_seconds = _parse_ttl(ttl)
+        authorization_seconds = _parse_ttl(renewal_ttl)
+        if not math.isfinite(lease_seconds) or not math.isfinite(authorization_seconds):
+            raise ValueError("renewal and lease TTL must be finite")
+        if authorization_seconds < lease_seconds:
+            raise ValueError("renewal authorization TTL must be at least the lease TTL")
+        if not renewal_bearer and not (allow_issuers and (allow_subjects or allow_client_ids)):
+            raise ValueError("renewal requires bearer authentication or an issuer-bound subject/client identity")
+        renewal_token = renewal_token or "sbr_" + secrets.token_urlsafe(32)
+        lease_token = lease_token_for_renewal(renewal_token, lease["id"], 0)
+        lease["token_hash"] = _token_hash(lease_token)
+        lease["renewal"] = {
+            "authorization_expires_at": _format_time(now + timedelta(seconds=authorization_seconds)),
+            "lease_ttl_seconds": lease_seconds,
+            "token_hash": _token_hash(renewal_token),
+            "bearer_hash": _token_hash(renewal_bearer) if renewal_bearer else None,
+            "generation": 0,
+            "renewal_count": 0,
+            "last_renewed_at": None,
+        }
     store_path = Path(path)
     store = _load_store(store_path, create_missing=True)
     store.setdefault("leases", []).append(lease)
@@ -109,6 +185,7 @@ def create_lease(
         "token": lease_token,
         "headers": {LEASE_HEADER: lease_token},
         "file": str(store_path),
+        **({"renewal_token": renewal_token} if renewal_ttl is not None else {}),
     }
 
 
@@ -123,25 +200,28 @@ def list_leases(path: str | Path, *, include_inactive: bool = True) -> dict[str,
     return {"ok": True, "file": str(store_path), "leases": leases}
 
 
+@_lease_transaction
 def cleanup_inactive_leases(path: str | Path) -> dict[str, Any]:
     """Remove revoked or expired leases from a lease store."""
 
     store_path = Path(path)
     store = _load_store(store_path, create_missing=True)
     leases = list(_leases(store))
-    kept = [lease for lease in leases if _lease_view(lease)["active"]]
-    removed = [lease for lease in leases if _lease_view(lease)["active"] is not True]
+    kept = [lease for lease in leases if _lease_view(lease)["active"] or _renewal_view(lease).get("active")]
+    removed = [lease for lease in leases if lease not in kept]
     store["leases"] = kept
     _write_store(store_path, store)
     return {
         "ok": True,
         "file": str(store_path),
         "removed_count": len(removed),
-        "active_count": len(kept),
+        "active_count": sum(bool(_lease_view(lease)["active"]) for lease in kept),
+        "retained_renewable_count": sum(not _lease_view(lease)["active"] for lease in kept),
         "leases": [_lease_view(lease) for lease in kept],
     }
 
 
+@_lease_transaction
 def revoke_lease(path: str | Path, lease_id: str) -> dict[str, Any]:
     """Revoke a lease by id."""
 
@@ -156,6 +236,17 @@ def revoke_lease(path: str | Path, lease_id: str) -> dict[str, Any]:
     return {"ok": False, "file": str(store_path), "error": f"lease not found: {lease_id}"}
 
 
+@_lease_transaction
+def revoke_invite_renewal(path: str | Path, invite_id: str) -> None:
+    store_path = Path(path)
+    store = _load_store(store_path, create_missing=True)
+    for lease in _leases(store):
+        if lease.get("invite", {}).get("id") == invite_id and isinstance(lease.get("renewal"), dict):
+            lease["renewal"]["revoked_at"] = lease["renewal"].get("revoked_at") or _format_time(_now())
+            _write_store(store_path, store)
+
+
+@_lease_transaction
 def reactivate_lease(
     path: str | Path,
     lease_id: str,
@@ -174,6 +265,8 @@ def reactivate_lease(
     now = _now()
     for lease in _leases(store):
         if lease.get("id") == lease_id:
+            if lease.get("renewal"):
+                raise ValueError("create a new automation invite instead of reactivating a renewable lease")
             lease["revoked_at"] = None
             lease["expires_at"] = _format_time(now + timedelta(seconds=_parse_ttl(ttl)))
             lease["reactivated_at"] = _format_time(now)
@@ -194,6 +287,88 @@ def reactivate_lease(
     return {"ok": False, "file": str(store_path), "error": f"lease not found: {lease_id}"}
 
 
+def lease_token_for_renewal(renewal_token: str, lease_id: str, generation: int) -> str:
+    """Recover the current access token without persisting plaintext in the lease store."""
+
+    payload = f"snulbug.lease.v1:{lease_id}:{generation}".encode()
+    return LEASE_TOKEN_PREFIX + hmac.new(renewal_token.encode(), payload, hashlib.sha256).hexdigest()
+
+
+@_lease_transaction
+def renew_lease(
+    path: str | Path,
+    *,
+    invite_id: str,
+    renewal_token: str,
+    bearer: str | None = None,
+    auth_context: Mapping[str, Any] | None = None,
+    policy_capabilities: Sequence[str] | Callable[[], Sequence[str]] | None = None,
+) -> dict[str, Any]:
+    """Renew or recover an invite's existing lease, never its permissions or budget."""
+
+    def denied(reason: str) -> dict[str, Any]:
+        return {"ok": False, "reason_code": reason}
+
+    store = _load_store(Path(path), create_missing=False)
+    lease = next((item for item in _leases(store) if item.get("invite", {}).get("id") == invite_id), None)
+    renewal = lease.get("renewal") if lease else None
+    if (
+        not isinstance(renewal, dict)
+        or not renewal_token
+        or not hmac.compare_digest(str(renewal.get("token_hash") or ""), _token_hash(renewal_token))
+    ):
+        return denied("lease.renewal_invalid")
+    if lease.get("revoked_at") or renewal.get("revoked_at"):
+        return denied("lease.revoked")
+    now = _now()
+    until = _parse_time(renewal.get("authorization_expires_at"))
+    if until is None or until <= now:
+        return denied("lease.renewal_expired")
+    auth = auth_context or {}
+    if renewal.get("bearer_hash") and auth.get("enabled") is not True:
+        if not bearer or not hmac.compare_digest(str(renewal["bearer_hash"]), _token_hash(bearer)):
+            return denied("lease.renewal_auth_required")
+    elif auth.get("enabled") is not True:
+        return denied("lease.auth_missing")
+    auth_denial = _lease_auth_denial_reason(lease, auth)
+    if auth_denial:
+        return denied(str(auth_denial["reason_code"]))
+    if callable(policy_capabilities):
+        policy_capabilities = policy_capabilities()
+    if policy_capabilities is not None and not set(lease.get("capabilities", [])).issubset(policy_capabilities):
+        return denied("lease.renewal_capability_removed")
+    if isinstance(lease.get("max_calls"), int) and int(lease.get("use_count") or 0) >= lease["max_calls"]:
+        return denied("lease.max_calls_exceeded")
+
+    expires = _parse_time(lease.get("expires_at"))
+    seconds = float(renewal["lease_ttl_seconds"])
+    # Retrying/restarting inside a healthy lease window returns the same token.
+    # A short overlap lets in-flight requests finish when the next window opens.
+    next_expiry = min(until, now + timedelta(seconds=seconds))
+    changed = expires is None or ((expires - now).total_seconds() <= seconds / 2 and next_expiry > expires)
+    if changed:
+        if expires is not None and expires > now:
+            renewal["previous_token_hash"] = lease["token_hash"]
+            renewal["previous_token_expires_at"] = _format_time(min(expires, now + timedelta(seconds=30)))
+        else:
+            renewal.pop("previous_token_hash", None)
+            renewal.pop("previous_token_expires_at", None)
+        renewal["generation"] = int(renewal.get("generation") or 0) + 1
+        renewal["renewal_count"] = int(renewal.get("renewal_count") or 0) + 1
+        renewal["last_renewed_at"] = _format_time(now)
+        lease["expires_at"] = _format_time(next_expiry)
+        token = lease_token_for_renewal(renewal_token, str(lease["id"]), renewal["generation"])
+        lease["token_hash"] = _token_hash(token)
+        _write_store(Path(path), store)
+    token = lease_token_for_renewal(renewal_token, str(lease["id"]), int(renewal.get("generation") or 0))
+    return {
+        "ok": True,
+        "reason_code": "lease.renewed" if changed else "lease.recovered",
+        "lease": _lease_view(lease),
+        "token": token,
+    }
+
+
 def enforce_mcp_lease_policy(
     request: Mapping[str, Any] | None,
     scope: Scope,
@@ -300,6 +475,19 @@ def _evaluate_mcp_lease_policy(
     *,
     config: LeasePolicyConfig,
     consume: bool,
+) -> tuple[bool, dict[str, Any]]:
+    if consume and config.lease_file is not None:
+        with _store_transaction(config.lease_file):
+            return _evaluate_locked_lease_policy(request, scope, config=config, consume=consume)
+    return _evaluate_locked_lease_policy(request, scope, config=config, consume=consume)
+
+
+def _evaluate_locked_lease_policy(
+    request: Mapping[str, Any] | None,
+    scope: Scope,
+    *,
+    config: LeasePolicyConfig,
+    consume: bool,
 ) -> tuple[bool, dict[str, Any]]:
     method = request.get("method") if isinstance(request, Mapping) else None
     auth_context = _scope_auth_context(scope)
@@ -581,6 +769,7 @@ def _write_store(path: Path, store: Mapping[str, Any]) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
     tmp = path.with_name(f"{path.name}.tmp")
     tmp.write_text(json.dumps(store, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    tmp.chmod(0o600)
     tmp.replace(path)
 
 
@@ -592,7 +781,15 @@ def _leases(store: Mapping[str, Any]) -> list[dict[str, Any]]:
 def _find_lease(store: Mapping[str, Any], token: str) -> dict[str, Any] | None:
     digest = _token_hash(token)
     for lease in _leases(store):
-        if lease.get("token_hash") == digest:
+        if hmac.compare_digest(str(lease.get("token_hash") or ""), digest):
+            return lease
+        renewal = lease.get("renewal", {})
+        previous_until = _parse_time(renewal.get("previous_token_expires_at"))
+        if (
+            previous_until is not None
+            and previous_until > _now()
+            and hmac.compare_digest(str(renewal.get("previous_token_hash") or ""), digest)
+        ):
             return lease
     return None
 
@@ -625,6 +822,30 @@ def _lease_view(lease: Mapping[str, Any]) -> dict[str, Any]:
         "use_count": int(lease.get("use_count") or 0),
         "last_used_at": lease.get("last_used_at"),
         "last_tool": lease.get("last_tool"),
+        **({"renewal": _renewal_view(lease)} if lease.get("renewal") else {}),
+    }
+
+
+def _renewal_view(lease: Mapping[str, Any]) -> dict[str, Any]:
+    renewal = lease.get("renewal")
+    if not isinstance(renewal, Mapping):
+        return {}
+    until = _parse_time(renewal.get("authorization_expires_at"))
+    expires = _parse_time(lease.get("expires_at"))
+    ttl = float(renewal.get("lease_ttl_seconds") or 0)
+    return {
+        "active": bool(
+            not lease.get("revoked_at") and not renewal.get("revoked_at") and until is not None and until > _now()
+        ),
+        "revoked_at": renewal.get("revoked_at"),
+        "authorization_expires_at": renewal.get("authorization_expires_at"),
+        "lease_ttl_seconds": ttl,
+        "generation": int(renewal.get("generation") or 0),
+        "renewal_count": int(renewal.get("renewal_count") or 0),
+        "last_renewed_at": renewal.get("last_renewed_at"),
+        "renew_after": _format_time(expires if expires == until else expires - timedelta(seconds=ttl / 2))
+        if expires
+        else None,
     }