From 4ecbaa19db9959a29f205f7d9ebf4b5eb1fef563 Mon Sep 17 00:00:00 2001 From: Kishore Kumar Date: Sun, 16 Aug 2026 16:49:33 +0530 Subject: [PATCH 1/2] docs(changelog): a revoked integration grant stays revoked MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pairs with agentsfleet@bea73a723 — a stale approval gate resolved after an explicit revoke no longer resurrects the grant it belonged to. Co-Authored-By: Claude Opus 5 (1M context) --- changelog.mdx | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/changelog.mdx b/changelog.mdx index 3bbc56d..07bd1ad 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -7,6 +7,16 @@ description: "Stay up to date with the latest agentsfleet product updates, new f agentsfleet is in **stealth-mode testing** and pre-production. APIs and agent behavior may change between releases without long deprecation windows. Email [agentsfleet@agentmail.to](mailto:agentsfleet@agentmail.to) if you want a hand calibrating an agent or to join as a design partner. + + ## A revoked integration grant stays revoked + + Revoking a grant only ever wrote to the grant itself — it had no reason to know about the fleet's approval gate. A gate raised before the revoke and left unanswered was still pending, and resolving it later, even as an ordinary approval, matched the grant by fleet and service alone with no check on its current status. The revoke was silently reversed, with no error and no record that it happened. + + ## Security + + - **A stale gate can no longer resurrect a revoked grant.** Gate resolution now leaves an already-revoked grant alone, whatever decision the gate carries. Re-authorizing a service goes back through the install flow, which raises a fresh gate. + + ## `--provider` is checked against the model catalogue your server serves From a6d1713cddcd77ac523c6975718bdb5681a16398 Mon Sep 17 00:00:00 2001 From: Kishore Kumar Date: Sun, 16 Aug 2026 21:39:54 +0530 Subject: [PATCH 2/2] docs(api): list the two connector operations the drift check flagged `_lint-openapi-drift` compares agentsfleet's live main openapi.json against the operations docs.json references, and M136's connector work landed upstream without its two entries here: DELETE /v1/workspaces/{workspace_id}/connectors/{provider} POST /v1/connectors/{provider}/callback Both are public and documented upstream -- a provider disconnect, and the dashboard's callback completion. Placed beside their same-path siblings, matching how the Secrets group orders its verbs. Unrelated to this branch's changelog entry; it fails every docs PR opened after that upstream merge, this one included. Co-Authored-By: Claude Sonnet 5 --- docs.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs.json b/docs.json index d23f2f6..8320ea1 100644 --- a/docs.json +++ b/docs.json @@ -219,7 +219,9 @@ "GET /v1/workspaces/{workspace_id}/connectors", "POST /v1/workspaces/{workspace_id}/connectors/{provider}/connect", "GET /v1/workspaces/{workspace_id}/connectors/{provider}", + "DELETE /v1/workspaces/{workspace_id}/connectors/{provider}", "GET /v1/connectors/{provider}/callback", + "POST /v1/connectors/{provider}/callback", "POST /v1/connectors/slack/events" ] },