jif 880f1135ea
Scope MCP app resource reads to their originating call ( #39187 ) ...
## Why
App widgets need to read resources using the app and account context of the
tool call that produced them, including after a thread is restored.
## What changed
- Add an optional `originCallId` to `mcpServer/resource/read` requests and
return it on successful scoped reads.
- Track bounded provenance for successful app tool calls in thread history and
use the current tool binding, account link, and app policy when reading the
associated widget resource.
- Reject missing, mismatched, failed, or ambiguous origins, while keeping
app-only tools available for widget reads without exposing them to the model.
## Testing
Add app-server coverage for scoped widget reads across both history modes,
ephemeral and persistent threads, server restarts, app-only visibility, and
invalid origin cases.
GitOrigin-RevId: 11eaefc066b2a3b639599e4cbdef680233d150a2
2026-08-18 11:51:21 +00:00
2026-07-29 13:53:15 +00:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-17 04:01:37 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 11:51:21 +00:00
2026-08-18 00:45:00 +00:00
2026-07-21 08:50:21 +00:00
2026-08-18 11:51:21 +00:00
2026-07-30 19:47:30 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-10 18:44:58 +00:00
2026-08-10 01:39:55 +00:00
2026-08-17 13:20:58 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-18 06:25:56 +00:00
2026-08-13 19:35:22 +00:00
2026-08-13 19:35:22 +00:00
2026-07-21 08:28:51 +00:00
2026-08-14 20:42:35 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-05 16:09:01 +00:00
2026-08-15 01:34:33 +00:00
2026-07-30 21:49:53 +00:00
2026-08-13 23:13:37 +00:00
2026-08-18 11:51:21 +00:00
2026-08-04 22:58:02 +00:00
2026-08-18 05:30:11 +00:00
2026-08-07 00:23:38 +00:00
2026-08-03 11:39:51 +00:00
2026-08-18 11:51:21 +00:00
2026-08-17 19:22:45 +00:00
2026-08-18 07:56:41 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-18 06:22:04 +00:00
2026-08-17 22:53:55 +00:00
2026-08-17 21:49:30 +00:00
2026-08-17 04:37:50 +00:00
2026-08-18 06:48:12 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 18:41:50 +00:00
2026-08-07 19:56:29 +00:00
2026-07-31 21:37:56 +00:00
2026-08-17 21:49:30 +00:00
2026-08-10 15:50:53 +00:00
2026-08-14 12:16:51 +00:00
2026-08-17 04:17:45 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-08-17 23:21:28 +00:00
2026-07-22 04:17:34 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 10:01:59 +00:00
2026-08-14 13:44:51 +00:00
2026-07-17 20:52:42 +00:00
2026-08-17 23:08:26 +00:00
2026-08-14 01:23:59 +00:00
2026-08-17 23:08:26 +00:00
2026-08-17 19:22:45 +00:00
2026-07-30 04:26:36 +00:00
2026-08-17 19:06:53 +00:00
2026-08-10 14:25:13 +00:00
2026-08-17 21:49:30 +00:00
2026-08-18 05:46:08 +00:00
2026-08-15 01:34:33 +00:00
2026-08-17 23:04:09 +00:00
2026-08-18 05:46:08 +00:00
2026-08-06 03:11:42 +00:00
2026-08-17 21:49:30 +00:00
2026-08-10 15:43:10 +00:00
2026-08-18 07:26:21 +00:00
2026-08-08 16:58:26 +00:00
2026-08-18 03:31:06 +00:00
2026-08-18 05:46:08 +00:00
2026-08-04 03:49:53 +00:00
2026-08-18 00:45:00 +00:00
2026-08-18 05:46:08 +00:00
2026-08-14 05:49:33 +00:00
2026-08-18 06:48:12 +00:00
2026-08-17 21:49:30 +00:00
2026-07-22 16:18:08 +00:00
2026-07-24 00:16:42 +00:00
2026-08-17 21:49:30 +00:00
2026-08-15 14:31:04 +00:00
2026-07-09 17:31:44 -07:00
2026-08-18 11:51:21 +00:00
2026-08-17 23:04:09 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-11 23:40:07 +00:00
jif
880f1135ea