Agent tool search can continue after its window closes

Original research record

We connect a new VS Code tool-discovery change with earlier OTR records on remote-session expiry and a later document explaining its limits. The host can now find eligible tools after its client window closes. That continuity is useful, but a closed window, an expired credential and a cancelled task are three different states. We see a concrete reason to test each boundary separately.

We start with three separate OTR records rather than one release headline. The earlier record describes Mission Control authorization ending at a GitHub-reported token deadline. A later record preserves a source-tree document, marked AI-assisted, explaining that early revocation and tokens without reported deadlines still need attention. The newest record adds host-side discovery of named tools when no client can perform that search. We rechecked these source changes directly. The new fallback loads eligible server and MCP tools by exact name, while leaving client-only tools unavailable. It also preserves a failed search if the client disappeared after that search was already routed; only a later search uses the host fallback. Our inference is that unattended work needs separate rules for continuing a task and continuing a person's access. The new search path does not itself demonstrate an authorization bypass, and closing a window does not mean a token was revoked.

We distinguish transport, authority and work state. A lost client connection does not answer whether a credential is valid or whether the task should continue. The new host fallback is narrow: exact tool names, host-runnable tools only, and no rewriting of an already recorded failed search as a success. In the checked code, expiry ends a remote lane at its reported deadline and fences protected results. The project documentation still distinguishes that from early revocation and a token with no deadline. These are three changes in one upstream project, not three independent reports of an industry-wide problem. The sources establish code and documented limits, not stable release reach or exploit incidence.

We would narrow or retire this view if a later implementation closes the documented revocation and missing-deadline gaps, if the relevant feature is absent from the deployed build, or if deployment tests show another independent control already ends access in those cases. We also need to avoid combining different paths into one imagined failure: the local-client tool-search fallback and Mission Control remote-lane authorization have different responsibilities.

We would make the next operational review check three cases separately: a client closes, a token reaches its deadline, and a token is revoked before that deadline. Record which work continues, which tools remain available and which protected results are withheld. This is a source-backed test priority for persistent agents, not a claim that all remote agents are unsafe. No investment direction applies.

We link OTR Database Data from the 03:12, 06:05 and 09:10 UTC Technology research cutoffs. The underlying VS Code changes were committed at 02:30:44, 05:32:34 and 08:45:36 UTC on 8 October. The 08:45 change provides the new fact: eligible deferred tools remain discoverable by the host after the client is gone. The 05:32 document is counterevidence to treating ordinary token expiry as complete revocation handling. These sources belong to one project cluster. Our live read also checked the current default-branch gap document, which still described those limits at retrieval.

Not a price forecast. Earlier OTR Technology cards already discussed live access checks and expiring remote permissions. We retain that history. The new contribution is the later tool-search continuity change, its exact-name and client-tool restrictions, and the explicit separation between deadline expiry and early revocation. We do not count the reused expiry record as a new discovery.

The same sources limit the concern. Existing owner authentication and workspace checks remain documented. The host fallback excludes client-only tools and preserves failures already shown to the client. The checked Mission Control implementation enforces token deadlines, including protection against late results after expiry. The documentation describes the remote feature as experimental and lists release qualification still required. We have not independently demonstrated a security failure, established affected stable versions or tested the documented comparison with Copilot Host.

No investment call. This develops the earlier access-check thesis rather than reversing it. We now have a specific later continuity path and a clearer limit: deadline expiry does not establish detection of early revocation. A client disconnection, by itself, is not evidence that authorization was removed.

We keep product narratives about autonomous agents separate from what the implementation shows. The new code supports one narrow form of unattended continuity; it does not measure how many tasks finish successfully. We have no representative user sample or incident denominator, and we do not use individual reports as proof that this path failed in production.

We found no matched, resolved forecast sample for this operational thesis. We therefore provide no success percentage or claimed forecasting record. The Bayesian, de Finetti and Kolmogorov frameworks do not supply an empirical probability without a defined outcome and suitable data. This signal has no investible bullish or bearish call. A market-direction percentage does not apply.

OTR Database Data

https://github.com/microsoft/vscode/commit/c2352f0190ec9f081b2464b2721f5c45f9949f02

https://github.com/microsoft/vscode/commit/9a70979d5cc87441c3758cc03db43c940abf5973

https://github.com/microsoft/vscode/commit/df34818c5185415f48a2497a345baa5032cb4a5f

We read 35 of 51 assigned Technology files in full. All 51 were retrieved and hash-checked. All nine observation files containing 131 records and nine source-coverage files containing 4,665 rows were parsed. The latest two observation files were read in full; selected lines were read from three older observation files. The remaining raw records and source-coverage rows were not read in full. Wider folder and archive coverage is reported separately.

We rechecked the cited primary repository records through the GitHub connector. A public-web reader failed on three initial exact URLs; that failure was not treated as a publisher access ban.

Commit clocks identify source changes. They do not identify stable release dates. We did not run the software, reproduce the tests, measure production incidents or establish user adoption.

This is a non-investment research thesis. A market-direction percentage, reference asset price and price-performance score do not apply.