@zackbart/connecta 0.27.0 → 0.28.0

package/AGENTS.md

@@ -4,13 +4,13 @@ This is the canonical instruction file for coding agents. `CLAUDE.md` is a
 symlink to this file so every agent works from the same conventions.
 
 A single MCP endpoint aggregating downstream connectors (remote MCP servers and
-plain HTTP APIs) behind eight meta-tools, `execute_code` among them. Every
+plain HTTP APIs) behind seven meta-tools, `execute_code` among them. Every
 deployment configures an executor, and agents reach connectors by writing
 JavaScript against it. One fetch-native core on Effect behind a Promise API,
-running on both Node and Cloudflare Workers. A program's write pauses until
-`resume_execution` repeats it. One `planned` decision changes that picture — an
-artifacts module — and until it ships, the code and the guides describe what
-exists.
+running on both Node and Cloudflare Workers. A program runs read-only and
+config-exempt tools; every other write is its own `call_destructive_tool` call,
+so the host's permission prompt is the only approval. The code and the guides
+describe what exists.
 
 - **[`ethos.md`](./ethos.md) is the constitution.** It states what connecta is
   and isn't, and its decisions table carries a verdict for every shape already
@@ -74,7 +74,7 @@ pins the generated deployment to the CLI package's exact version, restores the
 template `.gitignore` and the `CLAUDE.md` symlink, and refuses to merge into an
 existing path.
 `connecta doctor` verifies a running deployment's health, executor, and exact
-eight-tool surface. The template carries its own `Dockerfile` and
+seven-tool surface. The template carries its own `Dockerfile` and
 `docker-compose.yml`, so the generated project is the container: setup changes
 must keep the root README, the template (source, container files, and README),
 and the `scripts/check-package.mjs` smoke — which builds and runs that

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to this package are documented here.
 
+## 0.28.0 — 2026-10-04
+
+This minor release removes program pauses ([#672](https://github.com/zackbart/connecta/issues/672)).
+`execute_code` programs run explicitly read-only tools and the writes
+`execute.approval` exempts, and every other write is its own
+`call_destructive_tool` call, so the host's permission prompt on that call is
+the only approval there is. Hosts approve one tool call at a time, and under
+always-allow or bypass modes the agent called `resume_execution` itself: each
+pause cost a round trip and a full replay and protected nothing. What breaks:
+`resume_execution` is gone, so the surface is seven tools again, and a host
+allow-list or cached tool list naming it should drop it.
+`execute.resumableWrites` and `execute.pausedRunTtlSeconds` now refuse to
+construct with an error naming
+the removal — delete them, including the Worker example's
+`execute: { resumableWrites: false }` line. A program's non-exempt write now
+fails `destructive_tool_requires_approval` with a `nextAction` for
+`call_destructive_tool`, exactly as it did on deployments without resumable
+writes, and a run never returns `{ paused: … }`. `Date.now()` and
+`Math.random()` inside a program are the runtime's own again rather than pinned
+per run. A deployment that sets neither option and whose programs only read
+can ignore all of this: approval exemptions, `execute.maxWrites`, storage
+contracts, and the D1 activity schema are unchanged, and any paused runs left
+in storage expire on their own TTL. The Node template now pins 0.28.0.
+
+### Removed
+
+- `resume_execution`, the run journal, deterministic replay, compare-and-set
+  run claims, and the pinned clock and randomness (code-mode `P6`) that
+  existed only so a replay could match. `W1`–`W8`, `W11`, `P6`, and `X12` are
+  retired clause ids.
+- The pause-only error codes: `execution_paused`, `pending_write_too_large`,
+  `journal_too_large`, `execution_interrupted`, `execution_diverged`,
+  `execution_claim_lost`, `approval_mismatch`, `execution_token_stale`,
+  `execution_in_progress`, `execution_expired`, `execution_not_found`, and
+  `resumable_writes_unavailable`. `write_outcome_unknown` stays, for an exempt
+  write that was sent and never answered.
+- `resumableWrites` from `/health`, and the "resumable writes off" note from
+  `connecta doctor`, which now verifies the exact seven-tool surface.
+- The pause and resume agent eval tasks.
+
+### Changed
+
+- The MCP instructions, the `execute_code` description, and the `usage` skill
+  describe the read-only program route: reads and config-exempt writes in a
+  program, every other write through `call_destructive_tool`. The description
+  states the exempt-write budget.
+- `execute.maxWrites` now bounds only config-exempt writes, the one kind a
+  program can still send. Its default stays 10.
+- Activity no longer emits `paused` or `approved` outcomes, the
+  `resume_execution` source, or an `approval` scope. The types keep them as
+  read-only history, the operator UI still renders older rows (a historical
+  pause now reads "Paused for approval"), and the D1 example still stores and
+  reads the `approval` column.
+- QuickJS still runs its child with `TZ=UTC`, now for parity with a Dynamic
+  Worker's local time rather than for replay.
+
 ## 0.27.0 — 2026-10-01
 
 This minor release moves the runtime to stable Effect v4 and fixes execution,

package/README.md

@@ -10,19 +10,18 @@ writing code instead of loading a thousand tool definitions.
 You ask your agent a question that touches a service — Linear, Stripe, an
 internal API, anything you have connected. Here is what happens:
 
-1. The agent talks to one endpoint, yours, and sees eight tools. Always eight,
+1. The agent talks to one endpoint, yours, and sees seven tools. Always seven,
    no matter how many services sit behind it.
 2. It writes a short JavaScript program. Connecta runs it in a sandbox next to
    your integrations. The program can search for tools, call them, chain the
    calls, and shape the result.
 3. Only the answer comes back into the agent's context — not raw pages of
    API output.
-4. If the program wants to change something — create, update, delete — it
-   stops right there, before anything is sent, and hands the agent the exact
-   write. The agent repeats it through `resume_execution`, which your MCP
-   client can put in front of you first. Approve it and the program picks up
-   where it stopped, without re-reading what it already read. A single write
-   can also go straight through `call_destructive_tool`.
+4. If the agent wants to change something — create, update, delete — it
+   cannot do that from a program, unless your config exempts that tool. The
+   program refuses the write before anything is sent and hands back the exact
+   call; the agent makes it through `call_destructive_tool`, one visible call
+   your MCP client can put in front of you first.
 
 Credentials never leave the server. The program never sees them, and neither
 does the agent.
@@ -31,9 +30,9 @@ does the agent.
 flowchart TB
     Client["Your MCP client<br/>Claude, Cursor, …"]
 
-    subgraph Connecta["Connecta — one endpoint, eight tools, your credentials"]
-        Sandbox["execute_code<br/>the agent's program runs here<br/>reads run, writes pause"]
-        Explicit["resume_execution · call_destructive_tool<br/>the exact write, visible<br/>your client can ask you first"]
+    subgraph Connecta["Connecta — one endpoint, seven tools, your credentials"]
+        Sandbox["execute_code<br/>the agent's program runs here<br/>read-only tools, plus writes<br/>your config exempts"]
+        Explicit["call_destructive_tool<br/>one visible call per write<br/>your client can ask you first"]
     end
 
     Integrations["The integrations you chose<br/>Linear · Stripe · Notion · Vercel · your HTTP API · any MCP server"]
@@ -41,7 +40,6 @@ flowchart TB
     Client -->|"one connection"| Sandbox
     Client --> Explicit
     Sandbox -->|"reads"| Integrations
-    Sandbox -.->|"paused write"| Explicit
     Explicit -->|"writes"| Integrations
 ```
 
@@ -82,13 +80,11 @@ Fifty issues in, one small object out. Your context window notices.
   notice also points the agent to reduce or search the result inside a
   program. Discovery can show compact schemas, exact JSON Schema, or a
   TypeScript signature to read while writing JavaScript.
-- **Keep writes deliberate.** Only tools marked read-only run in a program
-  unasked. Any other call pauses the program with the exact write, and it
-  runs only once `resume_execution` repeats it — a visible call your client
-  can gate. A paused run is a journal in storage, not a held program, so it
-  survives a restart; it expires, and a write whose outcome is unknown is
-  never sent twice. Config — and only config — can exempt a cheap,
-  reversible write from asking, per tool or per connector.
+- **Keep writes deliberate.** Only tools marked read-only run in a program.
+  Every other write is a separate, visible `call_destructive_tool` call your
+  client can gate, so the host's permission prompt is the one approval there
+  is. Config — and only config — can exempt a cheap, reversible write from
+  asking, per tool or per connector, and then a program may make it.
 - **Run it on Node or Cloudflare Workers.** The core is shared; each deployment
   supplies its platform's executor and storage. The Node template also runs
   unchanged in Docker.
@@ -122,7 +118,7 @@ and why.
 
 Setup is written for an agent. Point yours at [`AGENTS.md`](./AGENTS.md) and
 ask it to set up a Connecta deployment; the
-[documentation](./documentation/) covers the architecture, the eight tools,
+[documentation](./documentation/) covers the architecture, the seven tools,
 code mode, and inbound auth if you want to go deeper. When upgrading an
 existing deployment, each [changelog](./CHANGELOG.md) release opens with what
 breaks and what a deployment can ignore.

package/bin/connecta.mjs

@@ -257,7 +257,6 @@ async function doctor() {
     "call_tool",
     "execute_code",
     "get_result",
-    "resume_execution",
     "search_tools",
     "skills",
   ];
@@ -310,10 +309,7 @@ async function doctor() {
   console.log(
     `Connecta doctor passed: ${health.connectors} connector(s), ` +
       `${executorName ? `${executorName} executed` : "code executed"}, ` +
-      "prescribed eight-tool surface" +
-      // resume_execution is listed either way; whether programs can write is
-      // what an operator cannot tell from the tool list, so say when not.
-      (health.resumableWrites === false ? ", resumable writes off" : "") +
+      "prescribed seven-tool surface" +
       (drifted.length > 0
         ? `, catalog drift on ${drifted.length} connector(s).`
         : "."),

package/dist/activity.d.ts

@@ -2,7 +2,7 @@ import type { ActivityModule } from "./module-contracts.js";
 import type { CatalogDriftCounts, Logger } from "./types.js";
 export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code" | "resume_execution";
 export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled" | "paused" | "approved";
-/** How much one `resume_execution` approved: this call, or this tool for the run. */
+/** Read-only history: how much one `resume_execution` approved (#672). */
 export type ActivityApproval = "call" | "tool";
 export type AgentFriction = "tool_not_found" | "schema_retry" | "destructive_reroute" | "auth_required" | "result_too_large";
 export { agentFrictionForCode } from "./activity-friction.js";
@@ -50,8 +50,9 @@ export interface ToolCallActivityEvent {
      */
     friction?: AgentFriction;
     /**
-     * Set only on an `approved` event: the scope the approval covered. An enum,
-     * like everything else here — the approved arguments are never recorded.
+     * Read-only history: set only on an `approved` event written before issue
+     * #672, the scope the approval covered. An enum, like everything else
+     * here — the approved arguments were never recorded.
      */
     approval?: ActivityApproval;
     serverName: string;
@@ -149,7 +150,7 @@ export interface ActivityRequestContext {
     defer?: (promise: Promise<unknown>) => void;
     logger: Logger;
 }
-export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "errorCode" | "friction" | "approval">;
+export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "errorCode" | "friction">;
 /**
  * Best-effort by design: activity storage can never change a tool result.
  * Workers attach async sinks to waitUntil; synchronous sinks such as Analytics

package/dist/activity.js

@@ -49,18 +49,9 @@ export function recordToolActivity(context, input) {
         source: input.source,
         outcome: input.outcome,
         durationMs: Math.max(0, Math.trunc(input.durationMs)),
-        // A pause and an approval reach nothing downstream, so they are the two
-        // events that honestly carry zero attempts. Every other outcome keeps its
-        // floor of one, as it always has.
-        attempts: input.outcome === "paused" || input.outcome === "approved"
-            ? 0
-            : Math.max(1, Math.trunc(input.attempts)),
+        attempts: Math.max(1, Math.trunc(input.attempts)),
         ...(input.errorCode ? { errorCode: input.errorCode } : {}),
         ...(friction ? { friction } : {}),
-        ...(input.outcome === "approved" &&
-            (input.approval === "call" || input.approval === "tool")
-            ? { approval: input.approval }
-            : {}),
         serverName: context.serverInfo.name,
         serverVersion: context.serverInfo.version,
         ...(context.deploymentId

package/dist/artifacts/json.js

@@ -66,3 +66,13 @@ export function jsonProblem(value, maxDepth) {
     }
     return undefined;
 }
+const encoder = new TextEncoder();
+/** A string's size in UTF-8 bytes: what every artifact limit counts. */
+export function utf8Bytes(text) {
+    return encoder.encode(text).byteLength;
+}
+/** SHA-256 as lowercase hex: the content address of a stored body. */
+export async function sha256Hex(text) {
+    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(text));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/artifacts/operations.js

@@ -14,8 +14,8 @@
 // Nothing here throws for a caller's mistake. Operations answer
 // `{ ok: false, code, message }`, and the connector turns that into its typed
 // error; a throw means storage failed.
-import { sha256Hex, utf8Bytes } from "../run-journal.js";
 import { buildFrameDocument, FRAME_OVERHEAD_BYTES } from "./document.js";
+import { sha256Hex, utf8Bytes } from "./json.js";
 import { markdownPage, MarkdownNestingError } from "./markdown.js";
 import { ARTIFACT_ID, checkDocument, checkDocumentTotals, checkView, finish, validDocumentName, } from "./validate.js";
 /** Physical head moves a write absorbs before giving up as busy. */

package/dist/artifacts/validate.js

@@ -7,9 +7,8 @@
 // finding names a line where there is one, quotes the source only through the
 // shared echo bound, and says what to do instead.
 import { boundedEchoText } from "../errors.js";
-import { utf8Bytes } from "../run-journal.js";
 import { lineLocator, scanHtml } from "./html-scan.js";
-import { jsonProblem, scriptSafeJson } from "./json.js";
+import { jsonProblem, scriptSafeJson, utf8Bytes } from "./json.js";
 import { FRAME_OVERHEAD_BYTES } from "./document.js";
 import { markdownPage, MarkdownNestingError } from "./markdown.js";
 import { DEFAULT_ARTIFACT_ALLOWLIST, DEFAULT_ARTIFACT_LIMITS, } from "./types.js";

package/dist/catalog-service.js

@@ -538,7 +538,7 @@ export class CatalogService {
                     ...(match.tool.annotations
                         ? { annotations: match.tool.annotations }
                         : {}),
-                    // Config lets a program call this write without pausing (#566).
+                    // Config lets a program call this write without asking (#566).
                     // A marker, not a class: the tool stays approval-required.
                     ...(isApprovalExempt(this.approval, match.connector, match.tool.name, match.tool)
                         ? { approval: "exempt" }