feat(vnext): port capability policy and Cursor HITL updates

[eshwar-sundar-glean]

Summary

Port the latest merged runtime changes from gleanwork/glean-plugins-vnext into the consolidated shared/glean/mcp implementation.

Audited upstream PRs: #43 and #48–#52.

Audit and changes

Already present — no duplicate port

• vnext #43: task-atomic skill-search framing, maxItems: 3, and one-time usage instructions were already present under the exposed find_skills_and_tools name (backend RPC remains find_skills).
• vnext #48: the 5 MiB file_args limit and documentation were already present.

Ported

• vnext #49 — trusted plugin version

  • Validate root and MCP package versions match and are plain semver.
  • Bake the version into the esbuild bundle.
  • Fail if substitution does not land.
  • Use the baked version in local serverInfo and downstream clientInfo.

• vnext #50 — capability/policy negotiation

  • Send plugin, host, capability, negotiated MCP revision, and inventory context through com.glean.mcp/capabilityPolicy metadata on downstream tools/list and tools/call.
  • Validate, log, cache, and evaluate returned policies.
  • Add atomic policy and remote-tool cache writes.
  • Keep valid cached policy through missing/malformed responses, network failures, and setup reset.

• vnext #51 — Cursor HITL restoration

  • Use the local elicitation approval gate on Cursor.
  • Include action and arguments directly in Cursor prompts.
  • Explain the known pre-3.15 dropped-prompt issue only after a full timeout.
  • Preserve agent-plugins' stricter fail-closed behavior when tool approval metadata is missing/corrupt and its prompt-key sanitization.

• vnext #52 — policy enforcement

  • Filter the advertised surface for metaTools, toolPromotion, and fileArgs.
  • Deactivated versions expose only setup.
  • Refuse stale-list calls at execution time as well as withdrawing them from tools/list.
  • Refuse disabled file_args before reading any local file.
  • Notify the host when a call-time policy changes the reachable surface.
  • Surface policy/version/host context and upgrade guidance in setup output.

Consolidated-repo adaptations

• Exposed discovery tool is find_skills_and_tools; backend remains find_skills.
• Plugin/release name is glean, not glean-vnext.
• Version is sourced from the root + MCP packages rather than three committed host manifests.
• Existing OAuth refresh serialization and prior security-review fixes are preserved.
• Applies to Claude Code, Cursor, and Codex (Cursor local MCP landed in feat(cursor): bundle the local Glean MCP server #16).

Verification

• npm run check:no-shell ✅
• npm run typecheck:bundle ✅
• npm run test:bundle — 19 files / 283 tests passed ✅
• npm test — Claude, Cursor, and Codex build + validation passed ✅
• Bundle reports baked 3.3.0; zero unresolved version placeholders ✅
• Runtime immutable-version smoke test: bundle still reported 3.3.0 beside a modified 9.9.9 package manifest ✅
• git diff --check ✅

[glean-it]

Issue: Policy decisions survive Glean instance switches because setPolicyServerUrl updates only cacheKeyUrl while decisionInForce returns the memoized decision. A restriction or deactivation from instance A can therefore remain enforced after switching to instance B.

Suggested fix: When the configured URL changes, invalidate the memoized decision and lastRequest so the next evaluation uses the new instance's URL-keyed policy and current session context. Add an A-to-B instance-switch regression test.

_{🔧 Tag @ glean-for-engineering to fix or click here to fix in Glean}

_{💬 Help us improve! Was this comment helpful? React with 👍 or 👎}