@zackbart/connecta 0.27.0 → 0.28.0

package/dist/operator-ui/model.d.ts

@@ -7,10 +7,10 @@ import type { CatalogAccessObservation, CatalogDriftReport } from "../types.js";
  *
  * - `runs_in_programs` — explicitly read-only, so `execute_code` may call it.
  * - `exempt` — not read-only, but the deployment's `execute.approval` lets a
- *   program call it without pausing (#566). Still approval-required
+ *   program call it without asking (#566). Still approval-required
  *   everywhere else.
- * - `needs_approval` — everything else: a program pauses for
- *   `resume_execution`, and a direct call crosses `call_destructive_tool`.
+ * - `needs_approval` — everything else: a program refuses it, and it crosses
+ *   `call_destructive_tool`, where the host asks.
  *
  * The badge renders from a table keyed by this union, so each value is one
  * entry, not a branch.

package/dist/operator-ui/view.js

@@ -413,12 +413,12 @@ export const TOOL_SAFETY_BADGE = {
     exempt: {
         label: "exempt from approval",
         tone: "neutral",
-        title: "Not read-only, but this deployment's config lets programs call it without pausing. Each call still counts against the write budget and appears in activity; call_tool still refuses it.",
+        title: "Not read-only, but this deployment's config lets programs call it without asking. Each call still counts against the write budget and appears in activity; call_tool still refuses it.",
     },
     needs_approval: {
         label: "asks for approval",
         tone: "warn",
-        title: "Not explicitly read-only: a program pauses for resume_execution, and a direct call crosses call_destructive_tool — either way the host asks first.",
+        title: "Not explicitly read-only: programs refuse it, and it runs through call_destructive_tool, where the host asks first.",
     },
 };
 /**
@@ -608,7 +608,8 @@ export function activitySummary(events) {
     return `${events.length} loaded call${events.length === 1 ? "" : "s"} · ${tools} tool${tools === 1 ? "" : "s"}`;
 }
 // A pause and an approval are neither success nor failure: each gets its own
-// class, and the stylesheet paints neither as an error.
+// class, and the stylesheet paints neither as an error. Nothing has emitted
+// either since issue #672 removed program pauses, but older rows carry them.
 const ACTIVITY_OUTCOMES = [
     "success",
     "error",
@@ -626,7 +627,7 @@ const OUTCOME_BADGE = {
     error: { label: "Failed", tone: "danger" },
     timeout: { label: "Timed out", tone: "danger" },
     cancelled: { label: "Cancelled", tone: "neutral" },
-    paused: { label: "Waiting for approval", tone: "warn" },
+    paused: { label: "Paused for approval", tone: "warn" },
     approved: { label: "Approved", tone: "ok" },
 };
 export function activityOutcomeBadge(outcome) {
@@ -636,6 +637,7 @@ const SOURCE_LABELS = {
     execute_code: "In a program",
     call_tool: "Direct call",
     call_destructive_tool: "Direct call, approved by the host",
+    // History only: resume_execution left with program pauses (#672).
     resume_execution: "Resumed program",
     batch_call: "Batch call",
 };

package/dist/routes/mcp.js

@@ -4,9 +4,8 @@ import { notFoundResponse } from "../branding.js";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError, } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { registerResumeTool } from "../resumable.js";
 import { intersectAccess } from "../connector-access.js";
-import { instructionsFor } from "../skills.js";
+import { CONNECTA_INSTRUCTIONS } from "../skills.js";
 import { msg } from "../errors.js";
 import { detach } from "../runtime/run.js";
 import { authorize, loggableValue, mayManageConnector, validateAuthPermissions, } from "./shared.js";
@@ -218,19 +217,14 @@ function toolkitRetired(logger) {
         },
     });
 }
-function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canManageAuth, poolName, runtimeContext) {
-    // A paused run belongs to the endpoint it started on: resuming it through
-    // another pool's endpoint finds nothing, as another subject would.
-    const resumable = opts.resumable
-        ? { ...opts.resumable, pool: poolName ?? null, approval: opts.approval }
-        : undefined;
+function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canManageAuth, runtimeContext) {
     // Every McpServer the request builds is fresh and closes with its scope.
     // The modern handler tears its own down after the exchange; the legacy
     // transport never does, and neither may stay wired to an ended request.
     const servers = [];
     const createServer = () => {
         const server = new McpServer(opts.serverInfo, {
-            instructions: instructionsFor(resumable !== undefined),
+            instructions: CONNECTA_INSTRUCTIONS,
             cacheHints: {
                 "tools/list": {
                     ttlMs: 3_600_000,
@@ -274,7 +268,7 @@ function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canMan
                 : {}),
             approval: opts.approval,
         });
-        const runner = registerExecuteTool(server, registry, {
+        registerExecuteTool(server, registry, {
             baseUrl,
             executor: opts.executor,
             logger: opts.logger,
@@ -304,19 +298,9 @@ function serveMcp(request, requestSignal, opts, baseUrl, actor, registry, canMan
             ...(opts.watchdogMs !== undefined
                 ? { watchdogMs: opts.watchdogMs }
                 : {}),
-            resumable,
             approval: opts.approval,
             maxWrites: opts.maxWrites,
         });
-        // Always registered, so the surface is the same eight tools on every
-        // deployment; without resumable writes it answers that there is nothing
-        // to resume.
-        registerResumeTool(server, registry, {
-            runner,
-            settings: resumable,
-            ...(activity ? { activity } : {}),
-            requestSignal,
-        });
         servers.push(server);
         return server;
     };
@@ -527,7 +511,7 @@ export function createMcpRoute(opts) {
                 if (new URL(request.url).searchParams.has("toolkit")) {
                     return cors(toolkitRetired(opts.logger));
                 }
-                return cors(yield* serveMcp(localRequest, localAbort.signal, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, poolName, runtimeContext));
+                return cors(yield* serveMcp(localRequest, localAbort.signal, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext));
             });
             if (remainingMs === undefined)
                 return yield* handled;

package/dist/routes/shared.d.ts

@@ -41,14 +41,9 @@ export interface ServerOptions {
     hostCallTimeoutMs?: number | undefined;
     /** Hard ceiling on one execute_code run, outside the sandbox. Default 120_000. */
     watchdogMs?: number | undefined;
-    /** Resumable writes' settings; absent when they are off. */
-    resumable?: {
-        maxWrites: number;
-        ttlSeconds: number;
-    } | undefined;
     /** Config approval exemptions (`execute.approval`), resolved at construction. */
     approval?: ApprovalPolicy | undefined;
-    /** Writes one program may send (`execute.maxWrites`), exempt ones included. */
+    /** Exempt writes one program may send (`execute.maxWrites`). */
     maxWrites?: number | undefined;
     /** Required sandbox backing the execute_code meta-tool. */
     executor: Executor;

package/dist/server.js

@@ -52,10 +52,6 @@ export function createFetchHandler(opts) {
             ...(opts.executorName !== undefined
                 ? { executor: { name: opts.executorName } }
                 : {}),
-            // Whether a program's write pauses for resume_execution or fails E4.
-            // The tool is listed either way; this is the only place an operator
-            // can see which answer it gives (#565).
-            resumableWrites: opts.resumable !== undefined,
             // Counts only, from refreshes that already happened — the endpoint
             // asks no downstream anything, and `connecta doctor` reads it to
             // report a stale allowlist without a probe of its own (#343).

package/dist/skills.js

@@ -1,24 +1,17 @@
 import { boundedEchoText } from "./errors.js";
-const ROUTE = "Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Inspect unfamiliar read results with a small sample before proceeding.";
+const ROUTE = "Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Sample unfamiliar reads.";
 const RECOVERY = 'After auth_required use authorize_connector. After a truncated direct result use get_result. Guidance is on demand: fetch skills({ name: "usage" }) only when these instructions and the tool description are insufficient or a run needs repair.';
 /**
- * The MCP instructions of a deployment whose programs pause at writes. The
- * route sentence is its own, not ROUTE's: with writes in programs, "one known
- * write" is the only work left for call_destructive_tool, and an agent told
- * only that programs *may* write reads each write after a lookup as a known
- * one and sends them one prompt at a time.
+ * The always-loaded MCP `instructions` string. A program runs reads and the
+ * writes config exempts from approval; every other write is its own top-level
+ * call_destructive_tool, where the host's permission prompt is the approval.
  */
-export const CONNECTA_INSTRUCTIONS = `Choose a route before discovery. One known read: call_tool; one known write: call_destructive_tool. Everything else starts with execute_code to discover, call, and return the answer: unknown addresses, reduction, multiple or dependent calls, and writes that follow reads. Keep authorized batches in one program. Sample unfamiliar reads. Reduce a one-time write's full result there or page a direct call with get_result; never repeat it to recover output. Non-exempt program writes pause unsent; resume_execution with the returned token, address, and args approves the call and continues the program. Approval "tool" covers later same-address calls in this run; other approval-required writes need their own approval. ${RECOVERY}`;
-/**
- * The instructions of a deployment without resumable writes, whose programs
- * refuse every write: the routing it always had.
- */
-export const READ_ONLY_PROGRAM_INSTRUCTIONS = `${ROUTE} Only readOnlyHint: true tools run there. Keep catalog inspection and unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. ${RECOVERY}`;
+export const CONNECTA_INSTRUCTIONS = `${ROUTE} Only readOnlyHint: true tools and config-exempt writes run there. Keep catalog inspection and other unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. Never repeat a write to recover its output. ${RECOVERY}`;
 const USAGE_SKILL_BASE = `# Connecta usage
 
 ## The surface
 
-Eight tools: \`execute_code\`, \`resume_execution\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
+Seven tools: \`execute_code\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
 
 Follow the MCP instructions for routing. Read at most once for syntax or repair.
 
@@ -48,16 +41,14 @@ For top-level catalog inspection or approval-required discovery, omit \`limit\`
 - Preserve the schema's JSON types exactly: a numeric id is a number, not a numeric-looking string.
 - Validate tabular headers, row arrays, and row widths before mapping them. Never let a header or partial row become data.
 
-Only explicitly \`readOnlyHint: true\` or config-exempt calls run unasked. With resumable writes, non-exempt approval-required calls pause unsent; \`resume_execution\` repeats the pending address, args, and token. Without them, use \`call_destructive_tool\` for writes. Keep each authorized batch in one resumable program, final post included. \`approval: "call"\` covers one write; \`approval: "tool"\` covers later same-address calls in this run. Other approval-required writes need approval. Replay requires the same call order. Sandbox code cannot widen host gates.
+Only explicitly \`readOnlyHint: true\` calls and writes the deployment's config exempts from approval run in a program. Any other write is refused before it is sent: send it through top-level \`call_destructive_tool\`, where the host asks. Sandbox code cannot widen host gates.
 
 ## Errors and repair
 
 Caught Connecta errors expose \`message\`, \`code\`, \`retryable\`, and \`details\`. Promise rejections retain these fields. Branch on fields, never prose. After a shared argument failure, repair one call before repeating it across other records. Do not retry \`retryable: false\`, and do not retry \`rate_limited\` immediately because portable code has no timer.
 
 - \`destructive_tool_requires_approval\`: stop and send the returned address through top-level \`call_destructive_tool\`.
-- \`execution_paused\`: the run already stopped at a write; let it end.
-- \`write_outcome_unknown\`: sent but unanswered, never re-sent; check the target.
-- \`execution_expired\`, \`_diverged\`, \`_interrupted\`: check \`writes\`, then rerun.
+- \`write_outcome_unknown\`: an exempt write was sent but unanswered and is never re-sent; check the target.
 - \`auth_required\`: let the failure reach the model, then use top-level \`authorize_connector\`, give its handoff to the operator, and retry after recovery.
 - Truncated direct call: page with \`get_result\`, never repeat a write. A program result has no page handle; reduce a read in a new program. After a write, check the target or report the gap.
 - Unknown addresses and tools carry scoped search recovery. Use it inside the current run. Do not invent an address.
@@ -72,8 +63,6 @@ The \`execute_code\` description states this deployment's host-call and write bu
 
 Portable code uses standard JavaScript builtins, \`connecta\`, and \`console.*\`. QuickJS blocks imports and lacks fetch, process, timers, crypto, and WebSocket. Dynamic Workers must use only \`{ loader }\`; bindings, modules, or globalOutbound grant ambient authority. With loader only, environment maps are empty; node:fs/http/https are absent; outbound fetch, WebSocket, node:net, and node:tls are denied; DNS is unresolved. Runtime builtins remain through \`import()\` and \`process.getBuiltinModule()\`, including node:path and cloudflare:workers; this set can drift. Timers, process, crypto, WebSocket, and data: fetch remain. Avoid every runtime-only capability because QuickJS fails.
 
-\`Date.now()\` is the run's start and does not advance; \`Math.random()\` is seeded per run.
-
 ## Examples
 
 One read-only call at a known address:
@@ -113,10 +102,6 @@ Connector guides appear in \`skills({})\` and discovery with an exact \`guide\`
 `;
 /** Shared Connecta routing guidance, byte-identical across deployments. */
 export const USAGE_SKILL = USAGE_SKILL_BASE + CONNECTOR_GUIDES_SECTION;
-/** The always-loaded MCP `instructions` string. */
-export function instructionsFor(resumableWrites) {
-    return resumableWrites ? CONNECTA_INSTRUCTIONS : READ_ONLY_PROGRAM_INSTRUCTIONS;
-}
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {
     return connectors.some((connector) => connectorGuide(connector) !== undefined);

package/dist/tool-safety.d.ts

@@ -20,7 +20,7 @@ export interface ApprovalPolicy {
 }
 export declare const NO_EXEMPTIONS: ApprovalPolicy;
 /**
- * Whether a program may call this tool without pausing for approval.
+ * Whether a program may call this tool without asking for approval.
  *
  * Only a tool that is *not* explicitly read-only can be exempt — a read-only
  * tool needs no exemption, and reporting one would blur the two classes an

package/dist/tool-safety.js

@@ -14,7 +14,7 @@ export const NO_EXEMPTIONS = {
     tools: new Map(),
 };
 /**
- * Whether a program may call this tool without pausing for approval.
+ * Whether a program may call this tool without asking for approval.
  *
  * Only a tool that is *not* explicitly read-only can be exempt — a read-only
  * tool needs no exemption, and reporting one would blur the two classes an

package/dist/types.d.ts

@@ -253,8 +253,8 @@ export interface Connector {
     /**
      * This connector's own default for its tools that are not explicitly
      * read-only, inside `execute_code`: `"never"` lets a program call them
-     * without pausing for approval. Reserved for connectors connecta ships
-     * whose writes are cheap to undo (the planned artifacts connector, whose
+     * without asking for approval. Reserved for connectors connecta ships
+     * whose writes are cheap to undo (the artifacts connector, whose
      * every write is a new immutable version); a deployment's own connectors
      * leave it unset and exempt through `execute.approval`, which overrides
      * this either way. Never read from a downstream catalog — a server cannot

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.27.0";
+export declare const CONNECTA_VERSION = "0.28.0";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.27.0";
+export const CONNECTA_VERSION = "0.28.0";

package/documentation/architecture.md

@@ -61,7 +61,7 @@ top to bottom.
 | 2 | MCP preflight | Allowed `OPTIONS` on `/mcp*`: 204 without admission or auth. |
 | 2 | Other `OPTIONS` | Auth metadata first, otherwise compatibility CORS preflight. |
 | 3 | `/.well-known/*` | Auth metadata, or 404. |
-| 4 | `/health` | Open and payload-free: health, executor, whether resumable writes are on, admission, and deployment metadata, with drift as stable short hashes. |
+| 4 | `/health` | Open and payload-free: health, executor, admission, and deployment metadata, with drift as stable short hashes. |
 | 5 | `/oauth/callback/<connectorId>` | Core downstream OAuth completion, state and personal-ownership checked, independent of the UI. |
 | 6 | `/mcp`, `/mcp/<pool>` | Admission, then auth, then a request-local MCP server. An undeclared pool, a refusing grant, and a throwing grant are one identical 404; see [pools](./auth.md#pools). |
 | 7 | Other paths | 404. Custom HTTP routes belong to the deployment. |
@@ -94,7 +94,7 @@ An admitted non-preflight `/mcp` request then takes five steps in
 5. **Serve.** Refuse `?toolkit=` with a 404 — the toolkits are gone
    ([#178](https://github.com/zackbart/connecta/issues/178)) but their URLs were
    handed out, and retiring a scoping boundary into fail-open is worse than any
-   404 — then register the eight meta-tools on a fresh `McpServer`
+   404 — then register the seven meta-tools on a fresh `McpServer`
    (`test/server.test.ts`, `test/code-first-surface.test.ts`).
 
 ## Layers below the meta-tools
@@ -109,7 +109,7 @@ or hands out, and a change usually belongs in exactly one of them:
 | `src/invocation.ts` | One tool call: argument validation, call admission, one-attempt timeout, provider retry hints, result unwrapping, size capping, and the activity record. |
 | `src/catalog.ts` | Ranking, description summarizing, and the compact and TypeScript schema renderers discovery shows. |
 | `src/result-shapes.ts` | Bounded runtime-only inference and merging for output shapes learned from successful read-only calls whose providers declared none. |
-| `src/resumable.ts`, `src/run-journal.ts` | Resumable writes: a program's host-call numbering, the write gate that pauses it, the journal a paused run becomes, the replay `resume_execution` plays from it, and the claim and write-ahead marks that keep an approved write to at most one send. |
+| `src/exempt-writes.ts` | The writes a program may send, which config exempted from asking: the write budget's default, what a dispatched write's outcome says about whether it landed, and the tracking that lets one outlive the program without hiding an unknown outcome. Every other program write is refused before it reaches this. |
 
 `src/meta-tools.ts` and `src/execute.ts` are two front doors onto the same two
 services, `CatalogService` and `InvocationService`. That is the point: a
@@ -222,12 +222,10 @@ successful call's preview and a paging-unavailable notice rather than a result i
 A second optional method, `compareAndSet(key, expected, next, options?)`, is an
 atomic claim: `null` means absent (expired counts) on the way in and delete on
 the way out. A successful write accepts the same optional `ttlSeconds` as
-`set`. Resumable writes require it: of two `resume_execution` calls racing
-for one paused run exactly one may win, and every write that run sends is
-marked on its header first, so a read and a write standing in for the claim
-could send an approved write twice. Omitted, `execute.resumableWrites` is on
-exactly when the store has it, and asking for it over a store without it
-refuses to construct. Downstream OAuth uses it where the store has it, so
+`set`. Artifacts require it, because every write commits by swapping a head,
+and so does issuing access tokens; a read and a write standing in for the
+claim would let two writers both win. Downstream OAuth uses it where the store
+has it, so
 resealing legacy plaintext and discarding a refused grant cannot overwrite a
 consent that landed in between, and falls back to a read and a write where it
 does not.
@@ -330,7 +328,7 @@ owner admitted to `set_refresh` is stored with the program. Every run rechecks
 that identity's current `connectorAccess` and pool grant, including continued
 access to `artifacts.set_refresh`, then intersects those grants with shared
 connectors. Revoking either grant stops later runs.
-Resumable writes and approval exemptions are off. A refused call fails the
+Approval exemptions are off, so a refresh writes nothing. A refused call fails the
 entire refresh even if its program catches the error. The head CAS claims one
 run per artifact; the data commit checks the claim ID and program version in
 the same CAS. The claim deadline starts before executor admission and aborts
@@ -483,7 +481,6 @@ would be another partition's.
 | Admission (`executor-admission.ts`, `call-admission.ts`) | Queued waiters are Deferreds settled by whoever removes them from the queue; a wait is one flat race of grant, Clock timeout, and signal. The uncontended path stays synchronous. Two controllers, as [#453](https://github.com/zackbart/connecta/issues/453) requires. |
 | One tool call (`invocation.ts`) | One fiber: resolution, the read-only and schema refusals, admission, and the downstream attempt sit under a single `withDeadlineEffect`, whose expiry interrupts the call wherever it is. The permit is an `acquireRelease`; the connector call is `Effect.tryPromise` over the unchanged `Connector`. |
 | `execute_code` (`execute.ts`) | One fiber whose Scope owns the run's signal and executor lease, so a result, a throw, the watchdog, and cancellation all release the lease and abort the signal the same way. The executor's `acquire()` and `execute()` stay Promises raced against the signal and `execute.watchdogMs`. Each guest host call is a fiber of its own. |
-| Resumable writes (`resumable.ts`) | A play's stop is a Deferred its write gate completes, raced against the executor like the watchdog; the gate for call n awaits the decision Deferreds of every lower-numbered call; header writes are one compare-and-set at a time on a per-play turn. A paused run holds nothing request-bound — its journal is data, and the next play is a new request's. |
 | Discovery (`catalog-service.ts`) | A request-scoped cache: one shared read per connector (`runtime/shared-read.ts`), settled by the read itself and carrying its own signal and the probe timeout whichever asker starts it. Each asker waits under its own deadline and signal, so one that times out or is cancelled fails alone, and the read is cancelled only once every asker has gone. Fan-out is `Effect.forEach` under the discovery concurrency. |
 | Registry (`registry.ts`) | Catalog persistence and the result stash are programs over `Storage`. A refresh flight is a Deferred its publishing request completes, bounded by its owner's deadline (the default probe timeout when it has none); persisted-catalog writes take per-connector turns, each a Deferred its own request completes. Same-request loads share one read the way discovery's do. |
 | Remote MCP (`connectors/remote-mcp.ts`) | Each request scope's state holds a Scope, each connection is a lease forked from it, and a connect in flight is a Deferred carrying the client it connected. Closing a session and the transport are each bounded to a second. |
@@ -589,9 +586,8 @@ cap. Effect can reject excess properties when both decoding and rendering use
 `onExcessProperty: "error"`; its default strips them. The generated schemas
 still differ from the exact meta-tool goldens, including record rendering and
 composed numeric bounds. A Schema replacement would need to preserve that
-contract, memoized rendering, and the raw-argument checks used by resumable
-writes. Both MCP SDK packages still depend on Zod, so changing our inputs alone
-does not remove Zod from an installation.
+contract and memoized rendering. Both MCP SDK packages still depend on Zod,
+so changing our inputs alone does not remove Zod from an installation.
 
 A one-endpoint `HttpApi` prototype adds 106,634 bytes gzip to `./ui` and 106,453
 to `./activity`. Even plain `HttpRouter` adds 45,324 to `./ui`, taking it to