v1.0.0b33 (preview)

[DevArjun23]

The next preview of the az connector-namespace Azure CLI extension. Builds on v1.0.0b9 with a new end-to-end OAuth connection authenticate flow, connector/operation discovery commands, catalog and search modes, security hardening, and a long list of fixes.

⚠ Pre-release — Command names, arguments, and behaviors may change before GA. For evaluation and feedback only; don't pin production workloads to this version yet.

✨ New commands

• az connector-namespace connection authenticate — runs a connection's OAuth consent flow end to end: list-consent-links → opens the connector's login page in the browser → captures the redirect on an ephemeral 127.0.0.1 loopback → confirm-consent-code (when the connector returns a code) → polls the connection overallStatus to a terminal state. On success it also grants the authenticating user an access policy (their oid/tid from the current token). Flags: --no-browser (headless/CI — print URL, paste the code), --no-access-policy, --object-id/--tenant-id (advanced overrides), --redirect-url, --parameter-name, --timeout.
• az connector-namespace connector list-operations — lists a connector's operations, filtered by --operation-type {trigger,action,all} (default action). Works in gateway mode and --catalog <region> mode. Designed for trigger discovery and previewing mcp-connector create auto-fill.
• az connector-namespace list-locations — enumerates the Azure regions where a connector namespace can be created ({name, displayName} sorted by display name, normalized region ids), matching the az account list-locations convention.

➕ New flags on existing commands

• connection create --authenticate — create a connection and run its OAuth consent flow in a single command. The consent options (--no-browser, --no-access-policy, --timeout, --object-id/--tenant-id, --redirect-url, --parameter-name) apply only when --authenticate is set. connection authenticate and connection create share the same consent engine internally.
• connector show --catalog <region> and --export-swagger — independently combinable, giving four modes: gateway+metadata (default, unchanged), gateway+swagger, catalog+metadata, catalog+swagger. --catalog reads the regional managedApis catalog and makes --namespace / --resource-group optional.
• connector list / connector list-operations --search <keywords> — client-side filter; an item matches only when it contains every space-separated keyword (case-insensitive substring). list matches name/displayName/description; list-operations matches name/summary/description/path.
• mcp-connector create operation auto-fill — auto-populates operations[] from the connector swagger (one MCP tool per non-trigger operation, every parameter mapped to agentParameters) when a --connectors entry omits it. --no-auto-tools opts out; an explicit empty operations: [] is honored as "zero tools".

💥 Breaking changes (vs v1.0.0b9)

• trigger run list, trigger run show, trigger status show: --trigger-config-name is renamed to --name / -n (no back-compat alias — the old option is removed). To free the --name slot, the leaf-resource args drop their --name/-n aliases: trigger run show now takes --run-id only, and trigger status show now takes --trigger-status-name only.

  Migration: replace --trigger-config-name <x> with -n <x> on all three commands; use --run-id / --trigger-status-name for the leaf ids.

🔒 Security hardening

• ARM-name pattern enforcement extended to the inherited api_name / connector_namespace_name args (connector show, connector list-operations), and now rejects exact . / .. — closing a dot-segment URL-collapse vector (e.g. /managedApis/.. rewriting to a different ARM resource).
• Format constraints added to --catalog and to connectors[].connection_name / connectors[].name so ? / / / % can't smuggle URL delimiters into the ARM URLs the extension builds.

🐛 Notable fixes

• connection invoke no longer crashes (Expect <class 'dict'>…) when the upstream response body is a JSON array, scalar, or null (e.g. SharePoint GetViewScopeOptions, OneDrive folder listings). Resolves connector-namespace CLI: connection invoke crashes on array response body (OneDrive folder listing) #131.
• mcp-connector create auto-fill: handles Swagger 2.0 / JSON-Schema allOf / anyOf / oneOf / additionalProperties (SharePoint/Outlook/Teams body schemas no longer drop to empty); tool_name now comes from operationId (no duplicate toolName within a connector); deprecated-operation filtering honors the spec-standard deprecated: true; $ref resolution depth raised 5 → 10; falsy x-ms-trigger (false/"") treated as "not a trigger".
• connection authenticate consent capture: the loopback is now a threaded server with a per-connection timeout, so a browser preconnect can't stall the real "Allow access" redirect; the consent URL prints as a clickable OSC 8 hyperlink.
• Consent UX polish (this release): loop-free /start launcher popup; the command waits for the browser to finish before reading status (then polls every 40s) — fixing a premature "Connected" on already-authenticated connections; an up-front heads-up when the connection is already Connected; concise green success output (no full-resource JSON dump); the terminal consent link is shown in blue rather than as a yellow warning.

🔧 CLI conventions / internals

• ARM-failure errors now raise AzureResponseError (correct azclierror taxonomy); --no-auto-tools / --export-swagger are true bare-flag switches; every command ships :example: help blocks; the command loader wires every @register_command recipe and fails loud if one is missing from __all__.

Install

az extension add --upgrade --yes --source \
  https://github.com/Azure/Connectors/releases/download/v1.0.0b33/connector_namespace-1.0.0b33-py3-none-any.whl

Verify: az connector-namespace --help · az extension show --name connector-namespace --query version

Verify the download

• Wheel: connector_namespace-1.0.0b33-py3-none-any.whl (223,281 bytes)
• SHA-256: 4012e771185b0bfcce7cc0e6dacdfb364d3a161bee1855ce874c5641310c568f

curl -L -O https://github.com/Azure/Connectors/releases/download/v1.0.0b33/connector_namespace-1.0.0b33-py3-none-any.whl
sha256sum connector_namespace-1.0.0b33-py3-none-any.whl
# Expect: 4012e771185b0bfcce7cc0e6dacdfb364d3a161bee1855ce874c5641310c568f

Filing issues

https://github.com/Azure/Connectors/issues. Include az --version, az extension show --name connector-namespace, the full command (redact secrets), and the full error (run with --debug if helpful).

---

This discussion was created from the release v1.0.0b33 (preview).