@zackbart/connecta 0.40.0 → 0.42.0

package/documentation/operating.md

@@ -12,7 +12,7 @@ Use your host's tool search, call a known operation directly, and follow its
 repair or authorization handoff. Use `execute_code` for combined work when
 listed; without code, page results through the listed `read_result` tool.
 
-Meta endpoints expose six top-level tools. Read [the tool table](./meta-tools.md#the-six-tools)
+Meta endpoints expose six top-level tools, plus `execute_read_code` on a writable `/mcp` or `/mcp/<pool>`. Read [the tool table](./meta-tools.md#the-meta-tools)
 for exact arguments and result envelopes. Follow the endpoint's supplied
 instructions and `skills` usage guide for deployment-specific context.
 
@@ -22,7 +22,7 @@ instructions and `skills` usage guide for deployment-specific context.
 | Discover a tool, chain calls, combine services, or reduce a result | `execute_code`                                            |
 | One known write on a writable endpoint                             | `call_destructive_tool`                                   |
 | Obtain connector instructions                                      | `skills` with the returned guide name                     |
-| Start a required authentication handoff                            | `authorize_connector`, using the returned recovery action |
+| Start an authentication handoff no error has given you             | `authorize_connector`, using the returned recovery action |
 
 Whether the endpoint is read-only or writable is part of its tool
 descriptions. On a writable endpoint, programs and `call_destructive_tool` may
@@ -109,7 +109,9 @@ MCP request bodies default to a 4 MiB limit on every endpoint. Deployment code
 can set `admission.requests.maxBodyBytes`; `describeConfig()` reports its value
 and source. An oversized body returns 413 before tool dispatch. See
 [request admission and body limits](./architecture.md#admission-in-two-places)
-for Node's separate pre-auth buffer and the listen-classification bound.
+for Node's separate pre-auth buffer and the listen-classification bound. A `503`
+from Node before auth means all in-flight bodies together passed
+[`maxInFlightBodyBytes`](./deploying.md#start-on-node).
 
 Direct calls may return a preview and a result handle. Page the handle through
 `connecta.result` in a program using the returned offset and byte limits, or
@@ -125,7 +127,9 @@ which URIs may be read. Connector guides and native skills are described in
 
 ## Recover without replaying a write
 
-Read typed failures and their `nextAction`. Authorization recovery can point
+Read typed failures and their `nextAction`. An auth error that carries a link
+says so in `nextAction.url`: give that link to the user unchanged and stop, with
+no further call. Authorization recovery can point
 to consent, operator credential setup, or deployment configuration. Discovery
 and status do not begin consent on their own. Follow
 [authorization recovery](./meta-tools.md#authorization-recovery),
@@ -162,3 +166,86 @@ and [execution](https://github.com/zackbart/connecta/blob/main/src/execute.ts).
 and [guest-contract tests](https://github.com/zackbart/connecta/blob/main/test/guest-api-contract.test.ts)
 check the contracts. Executor-specific evidence is indexed in
 [code-mode verification](./code-mode.md#verification).
+
+## Sample payload-free timing on Workers
+
+Set `timingTraceSampleRate` in deployment code passed to `createConnecta`:
+
+```ts
+const app = createConnecta({
+  // ...the deployment's connectors, storage, auth and executor
+  timingTraceSampleRate: 0.1, // sample 10% of MCP requests; default 0 (off)
+});
+```
+
+The rate must be a finite number from 0 through 1. Set 1 for a short diagnostic
+window, then return it to 0. Sampling is independent of the caller's
+`diagnostics` argument. Enable Workers observability logs in the deployment's
+Wrangler configuration (`observability.logs.enabled: true`). Its own sampling
+may reduce captured records further. The configured logger receives
+`connecta.timing` and one structured object when the MCP response body closes;
+`logger: "silent"` suppresses these records too. Consume or close streaming
+responses to finish their trace. An isolate-first-request flag means the first
+MCP request that reaches tracing in that isolate, including unsampled requests;
+it does not measure module boot.
+
+Each version-1 record contains elapsed request time, the first-request flag,
+weak-reference availability and aggregate operation families. Each family has
+`count`, `durationMs`, `bytes`, `statements`, `items` and `absent` totals.
+`catalog.accepted` counts complete accepted catalogs, serialized bytes and tools. Invocation
+`catalog`, `admission`, `connector` and `result` durations reuse the existing
+`diagnostics` segments. `catalog.cache.lookup` counts cache probes; `catalog.cache.hit` counts accepted
+unexpired entries. Lookups without hits can include misses, expiry, invalid
+entries or interrupted reads; they are not proof of live relisting.
+`catalog.validated.hit`/`miss` report immutable validation reuse.
+`catalog.decode` counts JSON decodes and their UTF-8 input bytes;
+`catalog.validate` and `catalog.intake` count those stages without timing them.
+These three count-only families always have `durationMs: 0`.
+`catalog.chunks` records accepted chunk bytes and counts. These counters do not
+identify a connector, owner or private/public partition.
+Concurrent spans can overlap; do not sum them as wall time.
+`memo.hit`, `memo.miss` and `memo.fresh` describe the request-read memo
+(`absent` counts null values, not cache failures). `d1.read`, `d1.write` and
+`d1.batch` count physical native D1 trips and SQL statements, including
+failed attempts. Batch count is one trip; statements is the batch length.
+All native D1 work carrying the request context shares these totals, including
+admission, credential and catalog work. Comparing them with `catalog` duration
+(the diagnostics `catalogMs` segment) does not isolate catalog storage.
+Returned D1 bytes measure serialized application results, not Cloudflare's wire
+encoding. Memo bytes measure UTF-8 stored values. Result bytes use the existing
+invocation measurement. No keys, tool names, owner identity, arguments, results,
+credentials or error text enter the record. Records retain totals only.
+
+On production Workers, `performance.now()` advances only across I/O. Durations
+are I/O-spanning elapsed observations, not CPU attribution: zero is ambiguous,
+and CPU work can appear in a later I/O interval. D1 durations are therefore not
+pure storage latency. Use counts, sizes, cache outcomes and the isolate-first-request
+flag to compare warm direct and one-call program requests with the same catalog.
+For per-invocation CPU, use Workers' invocation telemetry field
+[`$workers.cpuTimeMs`](https://developers.cloudflare.com/workers/observability/query-builder/).
+Deeper attribution requires [CPU profiling](https://developers.cloudflare.com/workers/runtime-apis/performance/).
+
+Only work carrying the MCP request's native context contributes D1 counters;
+standalone operator/background or custom Promise adapter work is outside that
+request trace. Sampling does not add reads, change TTLs, bypass generation or
+credential fences, or start authorization.
+
+For example, query a ten-minute window for a neutral Worker `assistant` (replace
+the millisecond timestamps with the window you need):
+
+```sh
+cf --profile assistant o11y telemetry query \
+  --query-id 00000000-0000-4000-8000-000000000001 \
+  --view events --limit 100 \
+  --timeframe-from 1793700000000 --timeframe-to 1793700600000 \
+  --parameters-order-by-value count --parameters-order-by-order desc \
+  --parameters-calculations '[{"operator":"count","alias":"count"}]' \
+  --parameters-filters '[{"key":"$workers.scriptName","operation":"eq","type":"string","value":"assistant"}]'
+```
+
+Select `connecta.timing` messages in the returned events and inspect their
+structured operation totals. Use the profile belonging to your deployment.
+The example reads telemetry only; it changes no Worker settings.
+
+The example passes CLI dry-run validation; server acceptance has not been verified.
+Use `--dry-run` to validate the request locally without querying telemetry.

package/documentation/operator-ui.md

@@ -287,7 +287,7 @@ stack each row into a card.
 
 ### Activity
 
-Counts for the loaded history (calls, failed, tools, catalog changes), also
+Counts for the loaded history (calls, failed, tools, catalog changes, and opt-in operations), also
 in its accessible summary, and a strip of calls over time with failures in
 red when the calls span more than a minute.
 
@@ -304,7 +304,9 @@ red when the calls span more than a minute.
   row lists what was recorded: result, how it ran, classification, exact
   duration and size, caller, stable caller id, request id, client, and
   connecta version. Unrecorded fields are left out. Catalog changes are rows
-  with added, removed and changed counts.
+  with added, removed and changed counts. Opt-in operation rows use fixed names
+  (Search, Describe, Result page, Skill read, Program) and an Operation detail;
+  they do not count as calls, failed calls, friction, tools or last calls.
 - **Empty.** "No calls yet" with Refresh, or "No matches" with Clear filters.
 
 ### Navigation, gates and recovery
@@ -767,6 +769,53 @@ names, descriptions or schemas enter the event. Private catalog changes require
 a matching principal owner even when the connector uses shared auth. Empty credential declarations
 report `credential_required` before running a connector status or catalog probe.
 
+### Opt in to operation history
+
+Set `operations: true` on the existing activity module, for example
+`activity: activityHistory({ store, operations: true })`, where `store` is the
+configured platform activity store. The default is off: existing deployments
+emit no operation rows. Each admitted search, describe, result page, skill read
+and whole program adds one event through the existing detached sink. Workers
+attach its promise to `waitUntil`; Node does not await it in the response path.
+This adds storage writes and retention cleanup work for every operation.
+
+Rows use `kind: "operation"`, `source: "execute_code"`, and a fixed operation
+name. They contain duration, outcome, a checked error code, returned page
+byte count when already measured, and host-call counts for a program. No query, tool
+address supplied by a caller, skill name, result ID, code, arguments, result
+contents or raw error text enters the row. Custom history readers must exclude
+operation rows from call/friction counts. The public kind union adds
+`"operation"`; exhaustive consumers may need a new case even when their
+runtime configuration leaves recording off.
+
+Operation disclosure is deliberately conservative:
+
+- The existing maintainer permission and optional `readGate` still apply.
+- Scope means every connector visible to the admitted endpoint, rather than
+  just the connectors named by a particular argument. A single-connector scope
+  uses that connector ID; other scopes use a reserved operation ID internally.
+- Every connector in that scope must still be visible through a whole-connector
+  grant to both the reader and the recorded pool. Address-only grants do not
+  disclose operations. Removed pools/connectors or invalid scope metadata
+  withhold the entire row.
+- All human operations are owner-only. Scopes containing personal auth,
+  caller-bound auth or a dynamically discovered catalog are also owner-only,
+  since static configuration cannot prove the catalog public. Owner-only rows
+  require the recorded principal basis and an exact match to the reader's
+  admitted principal ID and namespace. An agent without a provable admitted
+  human owner has those rows withheld.
+- Shared machine operations over statically declared catalogs are visible to
+  maintainers only when the complete scope passes those checks. This policy
+  can withhold single-connector work performed on a mixed endpoint.
+
+Existing D1 and SQLite activity tables need no new columns. The existing
+kind-tagged metadata text slot stores the checked operation scope and counts;
+legacy tool and catalog-change rows keep their format. The timeline shows
+operations separately and excludes them from call totals, friction, tool
+counts, call strips and last-call overlays.
+
+### Activity actor labels
+
 Activity label resolvers receive an optional `AbortSignal`. Pass it to user-directory
 fetches and stop work when it aborts: the reader has left or the label lookup
 budget has expired. Clerk label lookups follow the same lifetime and discard

package/documentation/providers.md

@@ -275,12 +275,12 @@ discovery for your deployment's catalog.
 </details>
 
 <details>
-<summary>QuickBooks Online (10 tools)</summary>
+<summary>QuickBooks Online (11 tools)</summary>
 
 [Setup](#quickbooks-online). **API source:** Hand-authored endpoint contracts. No vendored OpenAPI document.
 
 - **Named reads:** `get_company_info`, `get_record`, `get_report`, `search_records`.
-- **Named writes:** `create_customer`, `create_invoice`, `update_customer`.
+- **Named writes:** `create_customer`, `create_invoice`, `update_customer`, `update_unsent_invoice`.
 - **API reads:** `quickbooks_api_details`, `quickbooks_api_read`, `quickbooks_api_search`.
 - **API writes:** None.
 
@@ -409,9 +409,11 @@ path the current response lacks is never refused, and the selection omits it.
 `fields` entry matched nothing anywhere in a nonempty response. Each warning
 names the entry position, the segment where matching stopped and the
 properties the operation's contract declares there, for example
-`fields/1 matched nothing in this response after value safety and privacy
-filtering, at segment 2; declared there: id, name.` Where the contract
-declares none, such as inside an open map, it says so. A warning never lists
+`fields/1 matched nothing after filtering, at segment 2; declared there: id,
+name.` Filtering means value safety and privacy filtering. The list stops at
+160 characters with a count of the rest, and a later miss stopping at the same
+place says `same as fields/1`. Where the contract declares none, such as inside
+an open map, it says so. A warning never lists
 the response's own keys, which in an open map such as `metadata` are data, and
 never repeats the submitted path. A path that matched in any listed item, a
 path that runs past a scalar (selection keeps the scalar), and any path of an
@@ -941,10 +943,20 @@ Enable only vendor permissions needed by the workflows: Metadata read for
 repository lookup; Issues read for issues/comments/labels; Pull requests read
 for PRs/reviews/review comments/changed files/PR commits; Contents read for
 repository commits/comparisons/contents/releases; Actions read for workflows,
-runs and jobs. Release writes require Contents write. The guarded merge retains
+runs and jobs; Checks read for check runs, suites and annotations; Commit statuses
+read for commit statuses. Release writes require Contents write. The guarded merge retains
 Contents, Pull requests and Workflows write. Code search retains Contents read
 and GitHub's own search restrictions. Each operation token is narrowed to its
 reviewed permission and repository IDs; an org grant does not permit org admin.
+A resource 403 that carries no rate-limit header is `provider_permission_denied`, with
+no credential handoff, naming the repository and the permission the endpoint accepts.
+It establishes the refusal, not its cause: a missing permission is likely, but a policy,
+an unmarked secondary rate limit or a lockout gives the same answer, so its message
+ends with credential checks for when every call is refused. A refused token mint is a
+permission gap only when GitHub's installation record lacks the requested permission;
+otherwise a 422 is a neutral `connector_call_failed` and a 403 stays
+`provider_permission_denied` with its causes open. A 401, an unusable key or a 403 on
+the App's own installation list is `auth_required`.
 
 The four github_api tools cover a pinned operation index with a bounded reviewed
 repository read and release-write allowlist. All other operations are refused.
@@ -963,8 +975,8 @@ File contents retain base64 encoding; the character bound applies after decoding
 Use `/repos/alice/widget/contents/src/index.ts` for a nested file and
 `/repos/alice/widget/contents` for the root directory. Contents paths must be
 canonical relative paths, without dot/empty segments, backslashes or encoded
-traversal. Encode branch-name slashes as `%2F` in `commits/{ref}` and
-`compare/{basehead}`. Owner-prefixed object refs and cross-repository compares are
+traversal. Encode branch-name slashes as `%2F` in `commits/{ref}`, its check and
+status reads, and `compare/{basehead}`. Owner-prefixed object refs and cross-repository compares are
 refused before authentication. PR-list head filters require `login:branch`, for
 example `head:"alice:feature/x"`; they filter the selected repository's PRs.
 Bare head branches are refused because GitHub silently ignores them. The base
@@ -1520,18 +1532,20 @@ Creation fixes EmailStatus to `NotSet` and IPN/online/card/ACH/PayPal/Affirm
 payment flags to false, accepts no email fields, and never calls a send endpoint.
 Intuit's documented autosend path requires company opt-in, enabled online
 payments and `NeedToSend` with BillEmail; the fixed creation body withholds
-those request conditions. Invoice updates remain unavailable because retaining
-an existing send-ready state is not established safe, and resetting that state
-would change existing payment settings. Deletes, voids, delivery, payment
-execution, batch and other accounting writes remain unavailable. The API hatch
-refuses POSTs even when named writes are enabled.
-
-Sparse field preservation, a current SyncToken and requestid do not establish
-that an invoice update cannot send email. For example, changing only DueDate
-on an invoice with NeedToSend and enabled card/ACH payments retains those
-settings; omitting email fields does not disable them. Do not reset delivery or
-payment settings to work around the unavailable update, or replace the invoice
-with a new one. No unsent-only update tool is currently exposed either.
+those request conditions.
+
+`update_unsent_invoice` changes only DocNumber. Supply caller-observed Id and
+SyncToken and an explicit docNumber. It reads the US company and invoice,
+requires USD, explicit NotSet, no DeliveryInfo and every IPN/online/card/ACH/
+PayPal/Affirm payment flag explicitly false. Unknown state, send-ready or
+delivered state and stale versions fail before POST; no newer version is
+substituted. The sparse body preserves omitted delivery/payment fields.
+No date edits are exposed. Applying autosend prerequisites to updates is an
+inference, not an update-specific Intuit no-email guarantee. NotSet and absent
+delivery information cannot prove there was never historical delivery.
+Do not reset state to qualify or replace an invoice to bypass a refusal.
+Deletes, voids, delivery, payment execution, batch and other accounting writes
+remain unavailable. The API hatch refuses POSTs even when named writes are enabled.
 
 Each write requires `requestId`, a stable identifier for the exact intent,
 unique across all requests/tools for this company: 1–50 ASCII letters, digits,

package/examples/worker/README.md

@@ -10,7 +10,7 @@ runnable Worker steps.
 A deployable Worker that aggregates a downstream remote MCP and an in-code HTTP
 API connector, guarded by Cloudflare Access. It uses three Cloudflare resources
 and nothing else: one D1 database (`CONNECTA_DB`) for every piece of state, the
-Worker Loader binding (`LOADER`) behind the six-tool surface, which requires
+Worker Loader binding (`LOADER`) behind the meta-tool surface, which requires
 the Workers Paid plan, and two secrets: `DOWNSTREAM_TOKEN` (the example remote
 MCP connector's token) and `CREDENTIAL_ENCRYPTION_KEY` (the credential vault).
 
@@ -493,7 +493,7 @@ from `@zackbart/connecta/d1`. See [Activity history](#activity-history-optional)
 Omit the module and store wiring to record no history and show no Activity tab. Diagnostics remain independent; `logger: "silent"` suppresses
 them explicitly.
 
-Verify MCP health and the exact six tools with the following. Doctor reads
+Verify MCP health and the exact tool list with the following. Doctor reads
 `/health` through Access with the service credentials, then checks `/agent/ci`
 with the `cta_` token alone:
 
@@ -526,7 +526,7 @@ LOADER: Cloudflare.WorkerLoader(),
 `@zackbart/connecta/worker`. The adapter constructs the upstream
 `DynamicWorkerExecutor` with only the loader and a deadline, and disposes each
 run's loader and RPC handles when its lease ends, even if the guest has not
-settled. It serves the six-tool surface. Its admission pool is per isolate:
+settled. It serves the meta-tool surface. Its admission pool is per isolate:
 two runs, eight queued for up to 60 seconds, then a retryable
 `executor_overloaded`. Pass `admission` to `workerExecutor()` to change it; see
 [code mode](../../documentation/code-mode.md#deploy-time-capability). Do not

package/guides/how-it-works.md

@@ -77,7 +77,7 @@ account choices, including the Google Workspace exception.
 ## Finding a tool and using it are separate steps
 
 First the agent finds an action and learns what information it needs.
-Then it calls that action. The default connection gives the AI app six small
+Then it calls that action. The default connection gives the AI app a few small
 **meta-tools** to help it do this without loading every service's tools into
 the conversation.
 
@@ -87,6 +87,7 @@ the conversation.
 | `call_tool`             | Call a discovered action that reads data.                                    |
 | `call_destructive_tool` | Call a discovered action that changes data, under the app's approval policy. |
 | `execute_code`          | Combine discovery, actions, and a small answer in a program.                 |
+| `execute_read_code`     | The same for read-only work. It refuses anything that changes data.          |
 | `authorize_connector`   | Request the permitted account-connection handoff.                            |
 | `skills`                | Read guidance for using a connection.                                        |
 

package/guides/safety-and-trust.md

@@ -74,9 +74,7 @@ credentials as another boundary where possible.
 The Eve helper defaults to unattended authorized writes. For interactive use,
 `gateWrites: true` asks before tools not marked read-only; an explicit Eve
 approval policy takes precedence. The AI app owns approvals. It may ask based
-on an earlier tool label. If a
-read becomes a write, a writable pool can execute it without a fresh
-approval; a read-only pool refuses it. Connecta does not pause a program to
+on an earlier tool label. If a native tool becomes a write, its cached read name is refused before dispatch. Refresh `tools/list` and use the write's name; approval follows the host's policy. Read-only pools refuse writes. `execute_read_code` is the exception an app need not ask about: it refuses anything that can change data. It can still read, so a page's text can try to talk an agent into sending data through a read action; see [read programs](../documentation/meta-tools.md#read-programs). Connecta does not pause a program to
 ask a person partway through.
 
 See [read-only setup](../documentation/integrating.md#make-one-connection-read-only)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -173,8 +173,8 @@
     "build:operator-ui": "node scripts/build-operator-ui.mjs",
     "check:operator-ui": "node scripts/build-operator-ui.mjs --check",
     "check:clerk-sdk": "node scripts/build-clerk-sdk.mjs --check",
-    "build": "pnpm run providers:generate && pnpm run clean && tsc -p tsconfig.build.json && node scripts/prune-declarations.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.operator-ui.json --noEmit",
+    "build": "node scripts/eval-runtime.mjs --build",
+    "typecheck": "node node_modules/typescript-native/bin/tsc -p tsconfig.json --noEmit && node node_modules/typescript-native/bin/tsc -p tsconfig.operator-ui.json --noEmit",
     "test": "vitest run",
     "test:browser:install": "playwright install chromium",
     "test:browser": "playwright test",
@@ -182,19 +182,20 @@
     "pretest:browser:snapshots": "pnpm run build:operator-ui",
     "test:node": "vitest run --config vitest.config.node.ts",
     "test:workers": "vitest run --project workers",
+    "check:node-shards": "node scripts/check-node-shards.mjs",
     "check:docs": "node scripts/check-doc-links.mjs",
     "check:lint": "oxlint -D correctness --report-unused-disable-directives .",
     "check:unused": "knip --include dependencies,unlisted,exports,nsExports,types,nsTypes",
-    "check:examples": "tsc -p tsconfig.template.node.json && tsc -p tsconfig.examples.worker.json",
+    "check:examples": "node node_modules/typescript/bin/tsc -p tsconfig.template.node.json && node node_modules/typescript/bin/tsc -p tsconfig.examples.worker.json",
     "check:security": "pnpm audit --prod --audit-level moderate",
     "check:package": "node scripts/check-package.mjs",
     "check:declarations": "node scripts/check-declarations.mjs --dist .",
     "check:bundle": "node scripts/bundle-size.mjs",
     "providers:check": "tsx scripts/drift-check.mjs --specs --manual",
-    "eval:selftest": "tsx eval/selftest.ts",
-    "eval:agent": "tsx eval/run-agent.ts",
-    "eval:smoke": "tsx eval/run-smoke.ts",
-    "eval:outcomes": "tsx eval/run-outcomes.ts",
+    "eval:selftest": "node --import tsx scripts/eval-runtime.mjs selftest",
+    "eval:agent": "node --import tsx scripts/eval-runtime.mjs run-agent",
+    "eval:smoke": "node --import tsx scripts/eval-runtime.mjs run-smoke",
+    "eval:outcomes": "node --import tsx scripts/eval-runtime.mjs run-outcomes",
     "preeval:outcomes": "node scripts/generate-version.mjs && pnpm run build:operator-ui",
     "eval:perf": "tsx eval/run-perf.ts",
     "eval:report": "tsx eval/report.ts",
@@ -279,6 +280,7 @@
     "react-dom": "^19.3.1",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
+    "typescript-native": "npm:typescript@7.0.2",
     "undici": "6.29.1",
     "vite": "^8.3.4",
     "vitest": "^5.0.4",

package/templates/node/AGENTS.md

@@ -10,10 +10,10 @@ tokens, upgrading, and diagnosis with `connecta doctor` to their procedures.
 
 - Edit `src/connecta.config.ts` for connectors, authentication, storage, public
   URL, and optional modules. `src/index.ts` only starts it.
-- Keep `executor: quickJsExecutor()` for the prescribed six-tool code-first
-  surface. Keep the required `readOnly` choice in the config: `false` lets
+- Keep `executor: quickJsExecutor()` for the prescribed code-first
+  meta-tool surface. Keep the required `readOnly` choice in the config: `false` lets
   `call_destructive_tool` and programs write and annotates `execute_code` as
-  a write; `true` omits write tools from search and describe and refuses every
+  a write, with `execute_read_code` listed for read-only programs at `/mcp`; `true` omits write tools from search and describe and refuses every
   write call. Named pools inherit it unless they set their own `readOnly`.
   Approval belongs to the MCP host. Do not configure the removed `trust` or
   `execute.approval`.

package/templates/node/README.md

@@ -272,7 +272,7 @@ npm run typecheck
 CONNECTA_TOKEN='cta_REPLACE_WITH_RETURNED_SECRET' npm run doctor
 ```
 
-Doctor checks health, the executor, and the exact prescribed six-tool
+Doctor checks health, the executor, and the exact prescribed meta-tool
 model-facing surface by running a harmless sandbox program. It reads the bearer
 from `CONNECTA_TOKEN`; it never accepts the secret as a command-line argument.
 Remote URLs must use HTTPS.

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.40.0",
+    "@zackbart/connecta": "0.42.0",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },