root/goodbuddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: keep tool authorization valid throughout long requests

Browse Source 
Remove the fixed gateway capability lifetime so active requests retain knowledge, notes, browser, configuration, and custom MCP access. Preserve token validation and request cancellation or cleanup revocation, and replace the misleading knowledge expiry error with a tool authorization error.

Remove native-client clock overrides and cover long-running scoped and HTTP MCP calls. Validation: 34 focused tests passed; changed-file lint passed. Repository typecheck and lint remain blocked by unrelated manual-compaction and sidebar probe files.

Release note: Long-running Agent requests no longer lose tool access after ten minutes, including when the knowledge-base switch is off. Request cancellation and completion still revoke access.
This commit is contained in:
mesalogo
2026-09-28 21:36:41 +08:00
parent 393a07ccdf
commit 1603871f7c
6 changed files with 35 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/magic-notes/technical-design.md
+7
View File
@@ -474,6 +474,13 @@ The built-in MCP gateway returns invalid scoped-tool arguments as an
the model to correct its arguments without an MCP internal-error response.
Validation failures do not execute the tool.
Note tools can be authorized with the knowledge-base switch off. The shared
desktop gateway binds authorization to each request, without a fixed elapsed-time
expiry, so long-running requests retain tool access. Request completion,
cancellation, failure cleanup, or gateway disposal revokes the token. Invalid or
revoked tokens report unavailable tool authorization rather than a knowledge-base
expiry error.
These note tools run in the desktop gateway. Remote gbagent ACP sessions
currently inject only the image MCP server, so this change requires no
daemon implementation update.