0.33.0

Connecta 0.33.0 makes pools the access model, and every deployment with inbound auth must change its configuration (#837). Work through documentation/migration-0.33.md before upgrading; it maps every removed option to its replacement. A new top-level maintainers list names the people who reach plain /mcp and administer the deployment. Each pool now has a static members list and serves exactly its tools to those members. Agents are declared by name in agents, each with one rotatable cta_ token. Each removed option fails at startup with a message naming its replacement, so a deployment that starts has nothing silently ignored: identity (even {}) and its connectorAccess, credentialAdministration, personalConnection, accessTokenManagement and activityAccess, plus the top-level grant and pool grant.

Agents move from /mcp/<pool> to /agent/<pool>, which admits only a declared agent's cta_ token for a pool it belongs to. /mcp, /mcp/<pool> and the operator routes refuse cta_ tokens, so point every agent at /agent/<pool>. Deployments behind Cloudflare Access add one Access application for <host>/agent/* with a single Bypass policy, after which agents send only their token. Tokens issued by earlier releases stop admitting until trusted provisioning adopts each one for an agent (AccessTokenManager.adopt, or npm run adopt-token in the Node template). Creating, renaming and human-bound tokens are gone, along with maxActive. Programmatic callers construct AccessTokenManager with { agents } and call rotate where they called create, and revoke(agent, options). Activity names agents by name. Rotation is an immediate cutover. HTTP issue, rotate and revoke requests must send the observed slot revision as expect; a stale revision gets 409 slot_changed. AccessTokenManager.rotate, revoke and adopt accept optional expect and reject a stale revision with AccessTokenError.code: "slot_changed". A pool can set owner, the Google Workspace address its agents act as, so one Workspace connector serves a pool per person. An agent never reaches a subject mapping function, so a 0.32 mapping that answered for machine tokens must move to owner.

This release also defines how to organize an agent's pools. Each agent has one Connecta connection whose client picks the pool per turn. The base pool <agent> holds shared connectors and is used in group chats, scheduled runs and anything else without exactly one identified person. An <agent>-<user> pool adds that person's own connector ids, and its owner is their Workspace address; it is used only in a one-on-one with that person. Never mount a second Connecta connection beside the first. The rules and an example are in the auth guide, "Organizing an agent's pools".

The shipped documentation is now written first for the agent running a deployment from the installed package (#858). documentation/README.md has an operator task index: add or remove a connector, organize an agent's pools, add a person, connect a shared credential, issue, rotate or revoke an agent token, upgrade, and diagnose with connecta doctor. Each row links to a self-contained section, and the Node template and Worker example route agents through it. Existing deployments should add the pointer line from the migration guide to their own AGENTS.md.

The operator UI is rebuilt as an admin console and a member page (#834). Maintainers land on Endpoints, which lists /mcp and every pool with who can use it, its tools grouped by connector and who each connector runs as. They also get Connectors with a connector × endpoint matrix, Activity, Tokens with one row per agent and in-row issue, rotate and revoke, and Settings. Old URLs redirect (/access to /, /tools to /connectors, /config to /settings). Pool members get one page with their endpoints and client setup, their own accounts to connect or disconnect, and shared connectors by name only; anyone else sees a No access page. A saved dark mode no longer flashes light on load, and private browsing no longer breaks token sign-in. The UI reads operator contract v2 from GET /ui/api/config, which is now the page's only gate: 401 when signed out, 404 for anyone who is neither a maintainer nor a member, and 200 with role otherwise. Contract v1 and its types are removed, and /ui/data and /ui/connectors/<id> are maintainer-only. The UI also recovers from transient Cloudflare Access and auth failures without a reload (#830).

Security: 0.29.0 through 0.32.0 buffered an unauthenticated POST carrying Mcp-Method: subscriptions/listen with no size limit before authentication, so an anonymous client could exhaust memory on deployments without an edge gate such as Cloudflare Access. Every MCP endpoint now authenticates before reading any body and caps the pre-dispatch read at 64 KiB. Stripe, Vercel, Cloudflare and Notion REST responses now withhold signed URL parameters, and writes that carry the redaction placeholder are refused before sending (#812, #818).

The release also fixes Notion property filtering, Gmail's charset notice under truncation, recovery of long caller idempotency keys, Cloudflare ownership lookups against call admission, and callAdmission values that silently disabled rate limits. Notion token connectors accept callAdmission, and the fake-vendor agent evaluations now run.