@zackbart/connecta 0.33.0 → 0.34.1

package/dist/providers/vercel/skill.generated.js

@@ -3,8 +3,8 @@ export const skill = {
     "content": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
     "instructionsHeading": "Account instructions",
     "fragments": {
-        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in deployment `errorMessage`, build-event `payload.text`/`text`, and runtime-log `message` on the reviewed deployment/log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Deployment metadata and other application content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. Deployment creation also inspects decoded `files[].data` when `encoding` is `base64` (one decode bounded by the field's encoded length and the host's request limit; malformed base64 is refused). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
+        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `web_fetch_vercel_url` runs application code and is reviewed as destructive; the toolbar reply, reaction, edit, and resolve tools are writes.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, daemon liveness-probe header values and internal endpoint ciphertext, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), conditional firewall bypass compiled `condition` expressions and their credential match values, team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in deployment `errorMessage`, build-event `payload.text`/`text`, and runtime-log `message` on the reviewed deployment/log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Deployment metadata and other application content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. Deployment creation also inspects decoded `files[].data` when `encoding` is `base64` (one decode bounded by the field's encoded length and the host's request limit; malformed base64 is refused). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
         "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
     }
 };

package/dist/providers/vercel/value-safety.js

@@ -24,7 +24,7 @@
 // Residual risk, as with Infisical: a secret a person typed into a free-text
 // name, description, log line, or identifier is out of scope.
 // Embedded URL verdict (#812): reviewed paths + global signing parameters.
-// Evidence: pinned index/candidates sha256:32399b3ed273 identify deployment
+// Evidence: pinned index/candidates sha256:5a702fd2dc76 identify deployment
 // reads/creation/listing, build events and runtime logs; the operation/path
 // list below scans errorMessage, deployments.errorMessage, payload.text/text
 // and message respectively, both lists and individual named-stream rows.
@@ -33,9 +33,9 @@
 // other application content retain generic query parameters byte for byte.
 // Literal X-Amz-/X-Goog- Signature/Credential/Security-Token values are
 // withheld in every string. Existing structured-capability rules still apply.
-// The original full response document is unavailable at its unversioned URL:
-// current upstream differs and is supplementary evidence only. This is not a
-// claim of complete pinned-response review or of a Vercel-wide host policy.
+// The full pinned response document was reviewed on 2026-10-19, including
+// CI failureReason and task recommendations: no vendor-minted bearer links
+// are documented there. This is not a Vercel-wide host policy.
 import { redact, refuse as refusal, safe, under, } from "../_shared/rest/value-safety.js";
 /** A refusal's reason reads as a sentence about the operation: "It mints …". */
 const refuse = (reason) => refusal(`It ${reason}`);
@@ -51,6 +51,7 @@ const PROJECT = [
     "internalRoutes[].missing[?header].value",
     "security.firewallRoutes[].has[?header].value",
     "security.firewallRoutes[].missing[?header].value",
+    "security.firewallRoutes[].response_has[?header].value",
 ];
 /** Project metadata whose names contain a credential word. */
 const PROJECT_ALLOW = [
@@ -112,6 +113,7 @@ const FIREWALL_CONDITIONS = [
 ];
 /** Every firewall config shape: rules, rulesets, and top-level conditions, active, draft, and versions. */
 const FIREWALL = under(["rules[]", "rulesets[]", "conditions[]"], FIREWALL_CONDITIONS);
+const BYPASS_CONDITIONS = ["condition", "conditionGroup[].conditions[?header].value"];
 const FIREWALL_REASON = "Firewall rules match header, cookie, and query values, which can be credentials a rule checks for (an X-Auth-Key).";
 const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team (visible to owners).";
 /**
@@ -120,6 +122,11 @@ const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team
  * these operations project it themselves (value-safe environment variables).
  */
 const VALUE_SAFETY = {
+    "GET /ai-gateway/budgets/list": safe("Coverage counts per API key; no key value.", ["defaultCoveredCounts.api-key"]),
+    "GET /v8/artifacts/status": safe("Remote-cache read-only status is a flag.", ["readOnly"]),
+    "GET /v1/security/firewall/bypass/rules": redact(FIREWALL_REASON, under(["", "rules[]"], BYPASS_CONDITIONS)),
+    "POST /v1/security/firewall/bypass/rules": redact("The compiled condition and header, cookie, or query matches can contain stored credentials.", BYPASS_CONDITIONS),
+    "DELETE /v1/security/firewall/bypass/rules": safe("Deletes a conditional bypass rule; no response value."),
     "PATCH /aliases/{id}/protection-bypass": refuse("creates a shareable link that bypasses Deployment Protection."),
     "POST /api-keys": refuse("mints an AI Gateway API key and returns it in cleartext."),
     "POST /v1/connect/authorize/{connector}": refuse("starts a Connect authorization for a caller-chosen subject and returns its verifier and device code."),
@@ -185,6 +192,9 @@ const VALUE_SAFETY = {
     "POST /v1/kms/issuers/{issuerId}/sign/token": refuse("signs a token with the issuer's private key."),
     "GET /v1/microfrontends/groups/{groupId}/projects": redact(PROJECT_REASON, under(["projects[]"], PROJECT), under(["projects[]"], PROJECT_ALLOW)),
     "POST /v1/projects/traces/session": refuse("mints a trace session token for a deployment."),
+    "GET /v1/projects/{idOrName}/daemons": redact("Daemon liveness probes store custom HTTP header values that may authenticate under arbitrary names; encrypted internal endpoint data is also withheld.", ["daemons.config.livenessProbe.httpGet.httpHeaders.value", "daemons.replicas.items.iroh.publicKeyCiphertext"]),
+    "PUT /v1/projects/{idOrName}/daemons/{daemonName}/instances": safe("Returns only an ok boolean after scaling instances."),
+    "POST /v1/projects/{idOrName}/daemons/{daemonName}/instances/{instanceId}/restart": safe("Returns only an ok boolean after accepting an instance restart."),
     "POST /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
     "DELETE /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
     "DELETE /v1/projects/{idOrName}/env": redact(ENV_REASON, PROJECT_ENV),

package/dist/registry.d.ts

@@ -124,6 +124,8 @@ export interface RegistryView {
     /** Age of the complete cached catalog; null for static or unobserved catalogs. */
     catalogAgeMs(id: string): number | null;
     statusFor(id: string, baseUrl: string, requestScope?: object, callOptions?: ConnectorOperationOptions): Promise<ConnectorStatus>;
+    /** Rebuild a status with this partition's latest bounded observations, without probing. */
+    withCatalogObservations(id: string, baseUrl: string, status: ConnectorStatus): ConnectorStatus;
     invalidateStored(id: string): Promise<void>;
     /** Bind returned OAuth state to its initiating user for either owner scope. */
     bindOAuthHandoff(id: string, authorizationUrl: string, principalKey?: string): Promise<void>;
@@ -159,13 +161,8 @@ export declare class Registry implements RegistryView {
     private readonly catalogObservedAt;
     /** Last payload-free agent catalog access in this runtime. */
     private readonly catalogAccess;
-    /** Count-only intake findings, including catalogs loaded from storage. */
-    private droppedToolNames;
-    /**
-     * Schema digest verification per reviewed facts array. Only the registry's
-     * own deep-frozen arrays are keys, so an entry stays true while they live.
-     */
-    private readonly verifiedFacts;
+    /** Bounded tokens isolating count-only observations by catalog identity. */
+    private readonly catalogObservationPartitions;
     private readonly observedOutputSchemas;
     /** Result-size guard cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
@@ -220,11 +217,10 @@ export declare class Registry implements RegistryView {
     }): Promise<CallAdmissionPermit>;
     /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
-    /**
-     * The drift a connector last showed in this runtime: the registry's own
-     * observation against a connector's `classification`, otherwise whatever
-     * the connector's `catalogDrift()` seam reports, bounded either way.
-     */
+    /** The admitted identity fields used by both catalog caching and reporting. */
+    private catalogPartition;
+    /** Bounded, in-memory tokens; no principal or catalog data is persisted. */
+    private catalogObservationPartition;
     private catalogDriftOf;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
@@ -268,8 +264,6 @@ export declare class Registry implements RegistryView {
     private loadDownstreamTools;
     /** The served catalog excludes control-character names; raw caches stay complete. */
     private acceptToolNames;
-    /** Observe intake once, never while serving an older cached listing. */
-    private observeDroppedToolNames;
     /**
      * One connector's catalog as served: the cached downstream facts, classified
      * on every read by the connector's `classification`, into fresh objects.
@@ -287,6 +281,8 @@ export declare class Registry implements RegistryView {
     credentialDriftFor(id: string): Promise<string | undefined>;
     /** Age of a complete cache entry; reads never refresh it. */
     catalogAgeMs(id: string): number | null;
+    /** Pure lookup shared by status probes and operator catalog refreshes. */
+    withCatalogObservations(id: string, baseUrl: string, status: ConnectorStatus, scope?: RegistryScope): ConnectorStatus;
     /** Best-effort connector status for the operator UI. */
     statusFor(id: string, baseUrl: string, requestScope?: object, callOptions?: ConnectorOperationOptions, scope?: RegistryScope): Promise<ConnectorStatus>;
     /** Rotate the storage generation; in-flight old readers cannot republish it. */

package/dist/registry.js

@@ -16,6 +16,8 @@ import { GUIDE_SUMMARY_LENGTH, normalizeGuideSummary } from "./skills.js";
 import { attachOAuthSealer, vaultOAuthSealer } from "./oauth-sealing.js";
 import { attachOAuthPartition, oauthPartitionIdle } from "./oauth-partition.js";
 import { attachCaller } from "./connector-caller.js";
+import { isWorkspaceAddress } from "./workspace-address.js";
+import { workspaceSubjectOf } from "./workspace-subject.js";
 import { runEdge } from "./runtime/run.js";
 import { SharedRead } from "./runtime/shared-read.js";
 import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageSet } from "./runtime/storage.js";
@@ -227,13 +229,8 @@ export class Registry {
     catalogObservedAt = new Map();
     /** Last payload-free agent catalog access in this runtime. */
     catalogAccess = new Map();
-    /** Count-only intake findings, including catalogs loaded from storage. */
-    droppedToolNames = new Map();
-    /**
-     * Schema digest verification per reviewed facts array. Only the registry's
-     * own deep-frozen arrays are keys, so an entry stays true while they live.
-     */
-    verifiedFacts = new WeakMap();
+    /** Bounded tokens isolating count-only observations by catalog identity. */
+    catalogObservationPartitions = new Map();
     observedOutputSchemas;
     /** Result-size guard cap threaded to the meta-tools. */
     maxResultBytes;
@@ -261,6 +258,9 @@ export class Registry {
             if (this.connectors.has(c.id)) {
                 throw new Error(`Duplicate connector id "${c.id}"`);
             }
+            if (c.readOnly !== undefined && typeof c.readOnly !== "boolean") {
+                throw new Error(`Connector "${c.id}" readOnly must be a boolean.`);
+            }
             if (c.authScope !== undefined && c.authScope !== "shared" && c.authScope !== "personal") {
                 throw new Error(`Invalid authScope on connector "${c.id}": expected "shared" or "personal"`);
             }
@@ -330,9 +330,6 @@ export class Registry {
             catalogStorage: this.opts.catalogStorage ?? this.opts.storage,
             constructionChecks: false,
         });
-        // Counts only, like the connector-wide reviewed drift observation. No
-        // principal, credentials, or catalog payload crosses this registry boundary.
-        registry.droppedToolNames = this.droppedToolNames;
         if (this.callAdmissionClosed)
             registry.closeCallAdmission();
         this.personalRegistries.set(principalKey, registry);
@@ -501,13 +498,7 @@ export class Registry {
         attachCaller(context, scope?.caller);
         attachCatalogCache(context, {
             storage: this.opts.catalogStorage ?? this.opts.storage,
-            partition: JSON.stringify([
-                scope?.principalKey ?? this.opts.credentialOwner ?? null,
-                scope?.subjectKey ?? null,
-                scope?.caller?.identity ?? null,
-                scope?.caller?.authenticated ?? false,
-                scope?.caller?.pool ?? null,
-            ]),
+            partition: this.catalogPartition(scope),
             sharedPartition: JSON.stringify([baseUrl, this.opts.publicUrl ?? null, scope?.caller?.pool ?? null]),
             defaultTtlMs: (this.opts.toolCacheTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds) * 1000,
             minTtlMs: (this.opts.catalogMinTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogMinTtlSeconds) * 1000,
@@ -551,26 +542,38 @@ export class Registry {
         }
         return Object.fromEntries([...snapshots].map(([id, values]) => [id, aggregateCallAdmissionSnapshots(values)]));
     }
-    /**
-     * The drift a connector last showed in this runtime: the registry's own
-     * observation against a connector's `classification`, otherwise whatever
-     * the connector's `catalogDrift()` seam reports, bounded either way.
-     */
-    catalogDriftOf(connector) {
-        const report = boundedCatalogDrift(catalogReviewOf(connector) ? observedCatalogDrift(connector) : connector.catalogDrift?.());
-        const dropped = this.droppedToolNames.get(connector.id);
-        if (!dropped)
-            return report;
-        return {
-            ...(report ?? {
-                unclassifiedTools: 0,
-                unservedTools: 0,
-                annotationConflicts: 0,
-                schemaChanges: 0,
-            }),
-            observedAt: dropped.observedAt,
-            ...(dropped.count > 0 ? { droppedTools: dropped.count } : {}),
-        };
+    /** The admitted identity fields used by both catalog caching and reporting. */
+    catalogPartition(scope) {
+        return JSON.stringify([
+            scope?.principalKey ?? this.opts.credentialOwner ?? null,
+            scope?.subjectKey ?? null,
+            scope?.caller?.identity ?? null,
+            scope?.caller?.authenticated ?? false,
+            scope?.caller?.pool ?? null,
+        ]);
+    }
+    /** Bounded, in-memory tokens; no principal or catalog data is persisted. */
+    catalogObservationPartition(id, baseUrl, scope, create = false) {
+        const key = JSON.stringify([id, this.catalogPartition(scope), baseUrl, this.opts.publicUrl ?? null]);
+        let partition = this.catalogObservationPartitions.get(key);
+        if (!partition && create) {
+            partition = {};
+            this.catalogObservationPartitions.set(key, partition);
+            if (this.catalogObservationPartitions.size > 1024)
+                this.catalogObservationPartitions.delete(this.catalogObservationPartitions.keys().next().value);
+        }
+        return partition;
+    }
+    catalogDriftOf(connector, baseUrl, scope) {
+        const partition = this.catalogObservationPartition(connector.id, baseUrl, scope);
+        const observed = partition ? observedCatalogDrift(connector, partition) : undefined;
+        // Plugin reports cannot establish a reviewed baseline or schema coverage
+        // that this registry has not checked. Personal plugin seams have no subject
+        // parameter and must never bypass the partition above.
+        const fallback = !observed && !catalogReviewOf(connector) && connector.authScope !== "personal"
+            ? connector.catalogDrift?.()
+            : undefined;
+        return boundedCatalogDrift(observed ?? (fallback ? { ...fallback, reviewedBaseline: false } : undefined));
     }
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission() {
@@ -743,7 +746,7 @@ export class Registry {
         if (!connector)
             throw new Error(`Unknown connector "${id}"`);
         if (connector.staticTools)
-            return markCatalogFreshness(connector.staticTools, Infinity);
+            return { tools: markCatalogFreshness(connector.staticTools, Infinity), verification: undefined };
         const ctx = this.contextFor(id, baseUrl, requestScope, callOptions, scope);
         let listed;
         try {
@@ -764,10 +767,8 @@ export class Registry {
         }
         const facts = frozenFacts(structuredClone(tools));
         const accepted = this.acceptToolNames(facts);
-        this.observeDroppedToolNames(connector, facts.length - accepted.length);
         const review = catalogReviewOf(connector);
-        if (review)
-            await observeReviewedDrift(connector, review, accepted, this.opts.logger);
+        const verification = await observeReviewedDrift(connector, review, accepted, this.opts.logger, this.catalogObservationPartition(id, baseUrl, scope, true), facts.length - accepted.length);
         if (catalogFetchedAt(ctx) === undefined) {
             try {
                 await storeCustomCatalogFallback(ctx, id, facts);
@@ -789,19 +790,13 @@ export class Registry {
             state: freshUntil > Date.now() ? "fresh" : "stale",
             observedAt: new Date().toISOString(),
         });
-        return markCatalogFreshness(facts, freshUntil);
+        return { tools: markCatalogFreshness(accepted, freshUntil), verification };
     }
     /** The served catalog excludes control-character names; raw caches stay complete. */
     acceptToolNames(tools) {
         const accepted = tools.filter((tool) => !hasControlCharacters(tool.name));
         return accepted.length === tools.length ? tools : accepted;
     }
-    /** Observe intake once, never while serving an older cached listing. */
-    observeDroppedToolNames(connector, count) {
-        if (count > 0 || this.droppedToolNames.has(connector.id)) {
-            this.droppedToolNames.set(connector.id, { count, observedAt: new Date().toISOString() });
-        }
-    }
     /**
      * One connector's catalog as served: the cached downstream facts, classified
      * on every read by the connector's `classification`, into fresh objects.
@@ -811,7 +806,7 @@ export class Registry {
      * the next read.
      */
     async loadTools(id, baseUrl, requestScope, callOptions = {}, scope) {
-        const tools = await this.loadDownstreamTools(id, baseUrl, requestScope, callOptions, scope);
+        const { tools, verification } = await this.loadDownstreamTools(id, baseUrl, requestScope, callOptions, scope);
         const connector = this.connectors.get(id);
         if (!connector)
             throw new Error(`Unknown connector "${id}"`);
@@ -820,7 +815,7 @@ export class Registry {
         this.validateClassification(id, accepted, overrides);
         const review = catalogReviewOf(connector);
         return carryCatalogFreshness(tools, review
-            ? await classifyCatalog(review, id, accepted, this.opts.logger, this.verifiedFacts, overrides)
+            ? await classifyCatalog(review, id, accepted, this.opts.logger, overrides, verification)
             : accepted.map((tool) => this.publishUnreviewedTool(id, tool)));
     }
     publishUnreviewedTool(id, tool) {
@@ -902,6 +897,20 @@ export class Registry {
         const observedAt = this.catalogObservedAt.get(id);
         return observedAt === undefined ? null : Math.max(0, Date.now() - observedAt);
     }
+    /** Pure lookup shared by status probes and operator catalog refreshes. */
+    withCatalogObservations(id, baseUrl, status, scope) {
+        const connector = this.connectors.get(id);
+        if (!connector)
+            return ownStatus({ state: "error", message: "Unknown connector" });
+        const report = this.catalogDriftOf(connector, baseUrl, scope);
+        const access = this.catalogAccess.get(id);
+        // Connector.status is an open plugin seam. Rebuild its public fields so
+        // it cannot smuggle payload or another partition's observations (INV-6).
+        return Object.assign(boundedStatus(status), {
+            ...(report ? { catalogDrift: report } : {}),
+            ...(access ? { catalogAccess: { ...access } } : {}),
+        });
+    }
     /** Best-effort connector status for the operator UI. */
     async statusFor(id, baseUrl, requestScope = {}, callOptions = {}, scope) {
         const connector = this.connectors.get(id);
@@ -915,18 +924,7 @@ export class Registry {
         // The report is rebuilt rather than spread through: what the seam returned
         // is third-party output, and status is read by the operator UI and copied
         // into responses.
-        const withObservations = (status) => {
-            const report = this.catalogDriftOf(connector);
-            const access = this.catalogAccess.get(id);
-            // Connector.status is an open plugin seam. Rebuild its public fields so
-            // a connector cannot smuggle payload through either registry-owned
-            // observation when this runtime has not made one, nor through its
-            // message, which survives only when connecta wrote it (INV-6).
-            return Object.assign(boundedStatus(status), {
-                ...(report ? { catalogDrift: report } : {}),
-                ...(access ? { catalogAccess: { ...access } } : {}),
-            });
-        };
+        const withObservations = (status) => this.withCatalogObservations(id, baseUrl, status, scope);
         // Credential declarations own their readiness even when a static catalog
         // or a plugin status would otherwise report success. Never probe an empty slot.
         if (connector.credential) {
@@ -997,10 +995,23 @@ class ScopedRegistryView {
         const connector = this.root.getConnector(id);
         if (!connector)
             return undefined;
+        // An agent has no Workspace account: on a mapping-subject Workspace
+        // connector it acts as the pool's owner. Without one there is no account
+        // to act as, so the connector is absent, as a personal connector is.
+        if (this.agentWithoutOwner && workspaceSubjectOf(connector)?.kind === "mapping")
+            return undefined;
         if (connector.authScope !== "personal")
             return this.root;
         return admission ? this.admissionPersonal : this.personal;
     }
+    /** An agent admitted through a pool that names no Workspace owner. */
+    get agentWithoutOwner() {
+        const caller = this.scope.caller;
+        if (caller?.identity.agent === undefined)
+            return false;
+        // The same test the Workspace provider applies before acting as the owner.
+        return caller.pool === undefined || !isWorkspaceAddress(caller.poolOwner);
+    }
     listConnectors() {
         return this.root.listConnectors().filter((connector) => this.registryFor(connector.id) !== undefined);
     }
@@ -1093,6 +1104,10 @@ class ScopedRegistryView {
             ? registry.statusFor(args[0], args[1], args[2], args[3], this.scope)
             : Promise.resolve({ state: "error", message: "Unknown connector" });
     }
+    withCatalogObservations(id, baseUrl, status) {
+        return (this.registryFor(id)?.withCatalogObservations(id, baseUrl, status, this.scope) ??
+            ownStatus({ state: "error", message: "Unknown connector" }));
+    }
     invalidateStored(id) {
         const registry = this.registryFor(id);
         return registry ? registry.invalidateStored(id) : Promise.resolve();

package/dist/routes/mcp.js

@@ -8,7 +8,7 @@ import { Duration, Effect, Exit, Option, Result, Scope } from "effect";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
-import { CONNECTA_INSTRUCTIONS } from "../skills.js";
+import { endpointInstructions } from "../skills.js";
 import { registerSkills } from "./skills.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { redactAgentOutput, sentSecretsForRequest } from "../sent-secrets.js";
@@ -341,7 +341,10 @@ function serveMcp(request, requestSignal, requestScope, opts, baseUrl, actor, re
             // A request-local server cannot publish catalog changes. Set this before
             // tool registration, whose SDK default otherwise advertises listChanged.
             capabilities: { tools: { listChanged: false }, extensions: { "io.modelcontextprotocol/skills": {} } },
-            instructions: CONNECTA_INSTRUCTIONS,
+            // Instructions differ per endpoint only by the admitted pool's
+            // description. Every cache hint below is private, so a client keeps
+            // what it learned per endpoint URL and never shares it across them.
+            instructions: endpointInstructions(pool !== undefined ? opts.pools.get(pool)?.description : undefined),
             inputRequired: { legacyShim: false },
             requestState: { verify: (state, context) => authElicitation.verify(state, context) },
             cacheHints: {
@@ -738,6 +741,18 @@ export function createMcpRoute(opts) {
                             return yield* refuseAdmission(late.failure);
                     }
                 }
+                // The caller rides on the view, and the paging recheck builds the
+                // same one: an agent's Workspace visibility depends on the owner.
+                const callerFor = (identity, owner) => ({
+                    identity,
+                    // `authorize` admits an open deployment's every request as the
+                    // anonymous actor; only a provider's `ok` is an authentication.
+                    authenticated: opts.config.auth.length > 0,
+                    // Both pool endpoints build the caller here from the same
+                    // admitted scope, so an agent at /agent/<pool> carries the owner.
+                    ...(poolName !== undefined ? { pool: poolName } : {}),
+                    ...(owner !== undefined ? { poolOwner: owner } : {}),
+                });
                 let scopedRegistry;
                 try {
                     scopedRegistry = opts.registry.scoped({
@@ -760,11 +775,12 @@ export function createMcpRoute(opts) {
                             const currentScope = scopeFor(current);
                             if (!currentScope)
                                 return false;
-                            const { access: currentAccess, readOnly: currentReadOnly } = currentScope;
+                            const { access: currentAccess, readOnly: currentReadOnly, poolOwner: currentOwner } = currentScope;
                             const view = opts.registry.scoped({
                                 ...currentAccess,
                                 ...(current.subjectKey ? { subjectKey: current.subjectKey } : {}),
                                 ...(current.principalKey ? { principalKey: current.principalKey } : {}),
+                                caller: callerFor(current.identity, currentOwner),
                             });
                             if (classification === "write" && currentReadOnly)
                                 return false;
@@ -789,16 +805,7 @@ export function createMcpRoute(opts) {
                                 await closeConnectorScope(resolved.connector, view.contextFor(resolved.connector.id, baseUrl, requestScope), runtimeContext?.waitUntil?.bind(runtimeContext));
                             }
                         },
-                        caller: {
-                            identity: authz.identity,
-                            // `authorize` admits an open deployment's every request as the
-                            // anonymous actor; only a provider's `ok` is an authentication.
-                            authenticated: opts.config.auth.length > 0,
-                            // Both pool endpoints build the caller here from the same
-                            // admitted scope, so an agent at /agent/<pool> carries the owner.
-                            ...(poolName !== undefined ? { pool: poolName } : {}),
-                            ...(poolOwner !== undefined ? { poolOwner } : {}),
-                        },
+                        caller: callerFor(authz.identity, poolOwner),
                     });
                 }
                 catch {

package/dist/routes/oauth.js

@@ -38,7 +38,7 @@ function html(reason, opts, connector) {
     const details = outcome.fixPrompt
         ? `<details class="status-details">
       <summary>Details for the operator</summary>
-      <p>If this keeps happening, send this to whoever runs ${escapeHtml(brand.productName)}. It is written for a coding agent working on the deployment and carries nothing from the provider's response.</p>
+      <p>If this keeps happening, send this to whoever runs ${escapeHtml(brand.productName)}. It is for a coding agent and holds nothing from the provider.</p>
       <pre>${escapeHtml(outcome.fixPrompt)}</pre>
     </details>`
         : "";
@@ -55,7 +55,7 @@ function html(reason, opts, connector) {
   </section>
 </main>`;
     return new Response(renderPage(opts.config.ui?.branding, {
-        title: `${outcome.heading} — ${brand.pageTitle}`,
+        title: `${outcome.heading} · ${brand.pageTitle}`,
         uiMounted,
         body,
     }), { status: outcome.status, headers: htmlSecurityHeaders({ "Content-Type": "text/html; charset=utf-8" }) });

package/dist/routes/ui-data.js

@@ -74,7 +74,13 @@ export function uiData(registry, baseUrl, options) {
                 }))).pipe(Effect.map((tools) => ({ status, tools, catalogFailed: false })), 
                 // The registry owns the failed catalog observation; the page only
                 // needs to know there was one.
-                Effect.catch(() => Effect.succeed({ status, tools: [], catalogFailed: !signal.aborted })));
+                Effect.catch(() => Effect.succeed({ status, tools: [], catalogFailed: !signal.aborted })), 
+                // Loading the catalog may replace an earlier clean observation.
+                // Read this view's current bounded facts without another status probe.
+                Effect.map((observed) => ({
+                    ...observed,
+                    status: registry.withCatalogObservations(c.id, baseUrl, observed.status),
+                })));
             }).pipe(Effect.catch((error) => Effect.succeed({
                 status: failureStatus(c.id, error),
                 tools: [],
@@ -168,7 +174,7 @@ export function uiData(registry, baseUrl, options) {
                 toolCount: tools.length,
                 tools,
                 // Counts only, and only when a refresh in this runtime produced them.
-                // `Registry.statusFor` already rebuilt the report through
+                // `Registry.withCatalogObservations` rebuilt the report through
                 // `boundedCatalogDrift`, so what lands here cannot carry a name or a
                 // schema even if the plugin seam returned one.
                 ...(status.catalogDrift ? { catalogDrift: status.catalogDrift } : {}),

package/dist/skills.js

@@ -13,6 +13,16 @@ const RECOVERY = 'When an auth error includes a handoff, give it to the user or
  * and describe and refuses every write call. Guides may still name them.
  */
 export const CONNECTA_INSTRUCTIONS = `${ROUTE} On a writable endpoint, programs and call_destructive_tool may write. On a read-only endpoint, search omits write tools and every write call is refused; guides may still name them. The execute_code description says which this endpoint is. Never repeat a write to recover its output. ${RECOVERY}`;
+/**
+ * The instructions one endpoint serves: {@link CONNECTA_INSTRUCTIONS}, then
+ * the admitted pool's `description` after a fixed lead-in. Plain `/mcp` and a
+ * pool without a description serve the constant unchanged. The description
+ * comes from deployment config for the pool the request was admitted through;
+ * nothing a request sends reaches it.
+ */
+export function endpointInstructions(description) {
+    return description === undefined ? CONNECTA_INSTRUCTIONS : `${CONNECTA_INSTRUCTIONS} This endpoint: ${description}`;
+}
 export { USAGE_SKILL } from "./usage-guide.js";
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {
@@ -76,7 +86,11 @@ export function connectorSkillName(connectorId) {
 export function connectorGuide(connector) {
     const guide = connector.usageGuide;
     const content = typeof guide === "string" ? guide : guide?.content;
-    return content && content.trim() !== "" ? content : undefined;
+    if (!content || content.trim() === "")
+        return undefined;
+    return connector.readOnly === true
+        ? `Read-only connection: only read-classified tools are available. Write calls are refused, including tools named in this guide.\n\n${content}`
+        : content;
 }
 /** Discovery budget for one connector-guide summary, including an ellipsis. */
 export const GUIDE_SUMMARY_LENGTH = 120;
@@ -288,7 +302,9 @@ export function connectorGuideSummary(connector) {
             // normalization here so direct Connector callers see the same text.
             boundedSummary(connector.usageGuide.summary ?? "")
         : undefined;
-    return configured ?? summarizeGuide(connector, guide);
+    const original = typeof connector.usageGuide === "string" ? connector.usageGuide : connector.usageGuide?.content;
+    const summary = configured ?? summarizeGuide(connector, original ?? guide);
+    return connector.readOnly === true ? boundedSummary(`Read-only. ${summary}`) : summary;
 }
 /** Whether correct use always depends on conventions outside the tool schema. */
 export function connectorGuideRequired(connector) {

package/dist/storage/sql.js

@@ -492,7 +492,11 @@ export function sqlActivityStore(driver, kind, options = {}) {
         }
     });
     return {
-        describe: () => ({ kind, retentionDays }),
+        describe: () => ({
+            kind,
+            retentionDays,
+            optionSources: { retentionDays: options.retentionDays === undefined ? "default" : "config" },
+        }),
         async record(event) {
             await ensure();
             const occurredAtMs = Date.parse(event.occurredAt);