The Cyber Toolchain — issue 133, November 7, 2026

XALGORIX_BOUNDED_CONTEXT now defaults to true: full tool output is archived under the scan directory, old results are replaced in the agent conversation by compact retrieval stubs, and read_tool_output returns the original byte-identical content on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Tune retention with XALGORIX_TOOL_ARCHIVE_ACTIVE_WINDOW and XALGORIX_TOOL_ARCHIVE_MIN_BYTES, or disable with XALGORIX_BOUNDED_CONTEXT=false. Setups relying on the previous unbounded default, where full tool output was resent every iteration, will behave differently on upgrade.

$ XALGORIX_TOOL_ARCHIVE_ACTIVE_WINDOW=10 XALGORIX_TOOL_ARCHIVE_MIN_BYTES=4096 xalgorix --web

$ XALGORIX_BOUNDED_CONTEXT=false xalgorix --web

Scans are now limited to the port specified in the target URL — requests, port scans, and findings on any other port of that host are refused, so a scan of https://example.com:9000 stays on :9000 only; service enumeration must name the pinned port, e.g. -p 9000. Scans that previously relied on automatic enumeration and coverage of additional ports on the same host will no longer produce those findings.

XALGORIX_EPOCH_COVERAGE now defaults to true, measuring coverage against a frozen surface snapshot that advances in bounded epochs so scans can close on large or still-growing attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. without dropping any discovered endpoint. Set XALGORIX_EPOCH_COVERAGE=false to restore the previous behaviour.

$ XALGORIX_EPOCH_COVERAGE=false xalgorix --web

Gateway and inference-host providers named in XALGORIX_LLM_PROVIDER (OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code., Groq, Together, vLLM, LM Studio, and others) now receive requests with the model ID unchanged — a slash-prefixed ID such as google/gemini-3-pro or qwen/qwen3-32b is no longer stripped before forwarding. Xalgorix also logs a one-time message when a provider setting overrides a model-ID prefix, making a stale XALGORIX_LLM_PROVIDER or XALGORIX_API_BASE setting easy to spot.

Built-in multi-vendor providers such as OpenRouter and Together now use their catalog base URL automatically when XALGORIX_API_BASE is unset, instead of falling back to a generic default host. Setups that relied on the previous generic fallback host will now send traffic to a different base URL.

The identity add command gains --from-env-vars and --from-imds flags, letting pathrunner load AWS identity from environment variables (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ inside a CI job or assumed-role shell) or from EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware./Lambda instance metadata, authenticating automatically as the execution role when run on an AWS-hosted instance.

$ pathrunner> identity add --from-env-vars

$ pathrunner> identity add --from-imds

Semgrep Guardian Policies and local developer rules are now generally available for all organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Developers can store local rules in ~/.semgrep/guardian-rules/ or the root of a repository, with Guardian running up to 1,000 organization rules and 50 local developer rules per scan, and per-rule control available in the Claude Code remote plugin and the Codex plugin.

$ cp my-org-rules.yaml ~/.semgrep/guardian-rules/

Semgrep Code now parses C# Unicode escape sequences and Unicode identifier characters, Terraform provider functions with a namespace (e.g. provider::fn(...)), conditional and loop template directives, and Lua 5.4 variable attributes plus Lua 5.5 leading attributes, global declarations, and named variable-argument parameters.

Findings CSV exports now include Last triaged by, Ticket key, and Ticket URL columns; the ticket columns appear only when a Jira integration is active.

Free and Teams plan organizations can no longer select GitHub Enterprise, GitLab Self-Managed, or Bitbucket Data Center when setting up Semgrep Managed Scans.

MissingView, UnconfiguredFilesystemDisk, SerializedQueuedModel, and UnknownModelAttribute now run by default at errorLevel 1–4 (reported as info above that level).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Projects that still have <findMissingViews value="false" /> in psalm.xml (added automatically by psalm-laravel init v3.11.0+) must delete that line to actually get the newly default MissingView check.

$ # In psalm.xml, delete this line:
# <findMissingViews value="false" />
# Then run:
./vendor/bin/psalm-laravel analyze

psalm-plugin-laravel now types has{Relation}() and for{Relation}() magic methods on Eloquent factories, eliminating false UndefinedMagicMethod errors previously raised on calls like User::factory()->hasLinks(2)->create().

$user = User::factory()->hasLinks(2)->create();
// $user is now typed as User — no UndefinedMagicMethod error

The REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. now exposes explicit attribution fields identifying Copilot's reviews and comments — including the review effort used and the skills, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and custom instructions reported as sources for a comment — and adds code review settings endpoints for enterprise, organization, and repository levels: enterprise administrators read and update code review enablement across organizations, organization administrators manage default review effort and runner configuration, and repository administrators manage review effort, custom instructions, and MCP tool settings, with repository settings endpoints supporting GitHub Apps and fine-grained personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. via Administration: read and Administration: write permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The Copilot impact dashboard's Agent adoption chart now shows Copilot Chat and the VS Code Agents window, bringing the total tracked experiences to nine. Enterprise and organization 28-day reports expose this via new chat and vscode_agent entries in copilot_feature_engagement.totals_by_feature.

@GitHub is now generally available in Slack and Teams, letting users investigate bugs, create issues, implement changes, and open pull requests directly from chat conversations. In Teams, Canvas lets you review implementation plans, code changes, and previews alongside team discussions without leaving the app. @GitHub automatically identifies the repository from your message and launches a coding session without manual repository selection, and issues and pull requests it creates include 'Created from a Slack/Teams conversation with @username' in their description.

Manage all CLI plugins, MCP servers, and settings from one place using the /settings dashboard in GitHub Copilot CLI.

$ /settings

Run local automations on a schedule by adding cron expressions and custom agents from your workspace in VS Code.

⤢

Add files to chat without moving them into your workspace using Add Context > Files in VS Code; cloud sessions support images only.

Review overview now shares one Files not reviewed section for skipped and content-excluded files with filenames and linked exclusion reasons, omitting empty sections and showing an overflow count for long lists. Effort used and surveys moved into a compact footer so findings stay together at the top, and findings unrelated to recent changes collapse then hide on later reviews of the same pull request.

After giving a review overview a thumbs-down, use Add a reason to pick the main problem — such as a disagreeable approval assessment, a verbose comment, or incorrect or nitpicky findings — to send structured feedback to improve Copilot's findings.

⤢

The Automatically request Copilot code review repository rule now supports the bypass list, so exempt actors will not receive an automatic review.

GitHub Copilot now works in JetBrains Air, letting you track multiple agent sessions and run tasks locally or in the cloud through Air Teams with an existing Copilot subscription.

Teams can create a custom status via Settings > Organization > Configuration > Custom Status Configuration > Add Status, apply it to findings in Vulnerabilities > Findings, then add an Add Exclusions (BUT NOT) rule on the Objective filtered by Finding Status to keep those findings from counting toward a team's remediation target until review is complete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Held-back findings can be located again via the Custom Statuses filter in the Findings Filters panel, or shown/hidden using the Show Excluded options toggle.

Phoenix Security adds Remediation Targets, where an Objective can be scoped to the organisation, or to a specific application, environment, component or service using the Scopes card, with the nearest assignment winning. Objectives match findings by category (e.g. Risk Level set to High/Critical) and set a goal such as 'Allow up to 5 open matching findings per asset', run in Objective-based mode via Re-run selection under Automation > Remediation Targets.

Adds Android dynamic analysis support for physical devices, covering both rooted and stock (non-rooted) devices with hardened defaults for physical-device deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Includes a Frida Gadget APK builder to instrument apps on stock devices (including split APK sets), a gallery of installed apps on the connected device with on-demand scanning, and a live step-by-step progress display while the dynamic analysis setup runs.

Static analysis adds Dart string extraction from Flutter libapp.so, a detection check that flags unauthenticated LocalServerSocket listeners, and analysis of native libraries inside split APKs. False-positive noise is reduced by skipping JetBrains and Flutter embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. classes and by ignoring Flutter plugin constants and tightening binary secret detection.

Dynamic analysis now includes a built-in authenticated live Web Traffic viewer backed by mitmproxy, with a Send to Fuzzer action that replays captured requests through an upstream proxy.

PDF report generation now uses the pure-Python xhtml2pdf library with a ResourceAccessPolicy for confined asset resolution, replacing the prior wkhtmltopdf and pdfkit dependencies.

Scope breakpoints to a process with /p <pid> on bp, ba and bm — for example ba e1 /p <pid> kernelbase!GetFileAttributesExW+0x60 — without changing the current process context; the SDK's breakpoints.add(hardware=True, process=...) and breakpoints.watch(..., process=...) provide the same capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ ba e1 /p 1234 kernelbase!GetFileAttributesExW+0x60

A single NTOSEYE_TRACE environment variable, set to a comma-separated list of kd, kd-bytes, gdb, step and unwind, now controls all diagnostic traces, replacing the five separate NTOSEYE_KD_TRACE, NTOSEYE_KD_TRACE_BYTES, NTOSEYE_GDB_TRACE, NTOSEYE_STEP_TRACE and NTOSEYE_UNWIND_TRACE variables, which are removed.

$ NTOSEYE_TRACE=kd,unwind ntoseye <target>

ntoseye can inspect handle object information from a user-mode minidump with !handle <handle> f, surfacing thread/process IDs, TEB/PEB, priority, exit status, event/mutant/semaphore state, and section size via UserHandle.object_info in the SDK.

ntoseye adds bpec, ssec, cce, ch, hc, wkd, aph, dbce, vcpp, clr and clrn as sx event aliases, and realigns existing aliases to WinDbg's event table: cc now maps to Ctrl+C (0x40010005) instead of the C++ exception (previously eh), asrt is now an assertion failure (0xC0000420), and bp is now the breakpoint exception alias bpe.

Select processor N on the memory backend with ~N and ~Ns, so !idt, !gdt, !pcr and PRCB-reading commands inspect that processor as on a halted target.

The SDK's PteWalk result now lists page-table entries in a levels array (root first), replacing the individual pxe, ppe, pde and pte fields.

dx and dt now show typed globals and static variables from private PDBs — for example dx balloon!GUID_DEVINTERFACE_BALLOON reads the GUID's fields without requiring a manual cast.

$ dx balloon!GUID_DEVINTERFACE_BALLOON

NTOSEYE_NO_PDB_FROM_MEMORY and NTOSEYE_GDB_ON_HVF are now off when empty or 0 and on for any other value; previously NTOSEYE_NO_PDB_FROM_MEMORY=0 disabled the feature and NTOSEYE_GDB_ON_HVF was on only at 1.

dt -a counts above 16 and dl sizes above 64 are now errors instead of being silently truncated.

DotNetCorePathProvider now prefers DOTNET_ROOT installations of the runtime/SDK to better reflect loader behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Added TryReadX methods to BinaryStreamReader for safer binary parsing.

Install the community database bundle with net util -download-dbs or refresh it with net util -update-dbs; the layout-3 database (NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. 2002–2026 schema 2, DB-IP City/ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., IANA services, UA-parser, and HASSH from a pinned BSD-licensed source) is cryptographically signed with Ed25519 and protected against rollback, rejecting expiring updates, future timestamps, lower key epochs or sequences, and same-sequence equivocation while staying usable offline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The database server supports keys, approve, sign, serve, candidate, and pack modes via -mode, with flags -policy, -policy-sha256, -previous-count, -key, -certificate, -sequence, -epoch, and -signed-root (also readable from NC_DBS_SIGNED_ROOT); install-time trust can be overridden for private publishers via NC_DBS_APPROVALS and NC_DBS_APPROVALS_SHA256. Windows database activation now works without symlink privileges.

$ net util -download-dbs

$ net util -update-dbs

$ export NC_DBS_APPROVALS=/path/to/private-approvals.json
export NC_DBS_APPROVALS_SHA256=<sha256-of-approvals-file>
net util -update-dbs

$ net util -download-dbs

$ net util -update-dbs

Download the signed optional enrichment channel with net util --download-enrichment; it installs under NC_ENRICHMENT_ROOT (default $NC_CONFIG_ROOT/enrichment) using bounded member verification and monotonic sequence checks, and the approval chain can be overridden via NC_DBS_APPROVALS and NC_DBS_APPROVALS_SHA256 for private publishers. It adds CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. attributed CVE enrichment with source links (federal deadlines labeled as such, Unknown ransomware labels not treated as negative assertions), passive web technology detection with bounded origin-transaction advertisements covering WordPress/Drupal built-ins and reviewed optional Hugo/Joomla descriptors (no active probes or inferred exact versions from major-only headers), optional historical FingerBank option-55 device candidates under ODbL/DbCL and IEEE vendor prefixes (falling back to the bounded MAC fallback when absent), and popularity filtering controlled by an explicit external CSV only, off by default, with PSL-aware filtered Maltego transforms and no bundled popularity dataset. Attribution metadata can be retrieved via curl http://127.0.0.1:8080/api/enrichment/attribution.

$ net util --download-enrichment

$ NC_ENRICHMENT_ROOT=/data/netcap/enrichment net util --download-enrichment

$ curl http://127.0.0.1:8080/api/enrichment/attribution

Legacy v1/v2 database distribution endpoints are retired and now return HTTP 410, so installations using those endpoints must switch to net util -update-dbs. Schema-1 database readers must upgrade before consuming the new layout-3 database, and legacy CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. and DHCP OS catalogues are disabled, with HASSH catalogue enrichment unavailable in this database snapshot.

File capture now exits without starting the Web UI by default when --read is set; pass --http <addr> explicitly to opt back into the old behavior.

A new net triage command summarizes existing audit output from offline captures without re-running capture, usable as net capture -read traffic.pcap -out nc && net triage --read nc.

$ net capture -read traffic.pcap -out nc && net triage --read nc

Evidence recovery now reconstructs SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., IMAP, POP3, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication conversations, handles request-only HTTP and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. captures and post-gap sessions with request/response attribution and SMB file reassembly, reassembles fragmented TLS and QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. hellos and QUIC Initials while recognizing mail protocol TLS upgrades, and correlates host identity across DHCP, NetBIOS, LDAP, Kerberos, and DCE/RPC observations without assigning identities to unrelated hosts.

Prowler Cloud ingests CloudTrail events via EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure./SQS or a LookupEvents fallback, applying per-account policy modes monitor, pr, and auto (including dry-run support), with a new /realtime dashboard and a Manage Realtime role permission to control who can change the real-time policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Lighthouse AI and the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. gain tools to manage the event feed, read detections and actions, and revert them.

AWS gains a bedrockagentcore service with bedrockagentcore_full_access_policy_attached, bedrockagentcore_payments_process_payment_role_separation, bedrockagentcore_runtime_vpc_configured, plus cloudtrail_agentcore_data_events_enabled for AgentCore data event coverage. Cloudflare gains 13 checks across a new account service (account_two_factor_enforced, account_member_two_factor_enabled, account_super_admins_limited, account_api_token_expiration_set, account_api_token_ip_restriction_enabled, account_api_token_recently_used), a new r2 service (r2_bucket_public_dev_url_disabled, r2_bucket_cors_no_wildcard_origin, r2_bucket_custom_domain_min_tls_secure), and a new workers service (workers_script_observability_enabled, workers_script_workers_dev_disabled, workers_script_preview_urls_disabled, workers_script_no_secrets_in_plain_text_bindings), plus zone_firewall_no_skip_all_traffic_rules. GitHub gains repository_secret_scanning_push_protection_enabled to flag repositories that accept pushes containing secrets. Vercel gains project_environment_no_secrets_with_public_prefix (flagging secret-like environment variables exposed via prefixes such as NEXT_PUBLIC_ or VITE_) and project_linked_to_git_repository (flagging projects that can only receive unreviewed CLI deployments).

Setting PROWLER_NO_PROMOTIONS=1 hides the Prowler Cloud hand-off note in the OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. CLI dashboard; Prowler Cloud and Private Cloud reports never show it.

$ PROWLER_NO_PROMOTIONS=1 prowler dashboard

Add global switches for GraphQL secure defaults via the feat(graphql) configuration to harden API behaviour without per-query changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Databricks now supports wikis on Unity Catalog tables, letting data owners and stewards draft and publish documentation manually or with Genie Code, while viewers can comment on, suggest edits to, and react to published wikis in Catalog Explorer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Account admins can control access to this Beta feature from the Previews page (Account Console > Settings > Previews > Unity Catalog wikis).

JDBC drivers for Unity Catalog connections can now be installed from a Maven coordinate instead of being uploaded to a volume. This requires serverless compute, Databricks Runtime 19 or above, or SQL warehouses 2026.43 or above.

Filter the Service Desk dashboard by date range (Today, Yesterday, This Week, Last Week, Last 7 Days, Last 30 Days, This Month, Last Month, Last 365 Days, or Custom range) and by Department, with results applied together across stat cards, chart, and the Statistics table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Switch the chart between Line, Bar, and Pie views and export the dashboard to CSV or PDF.

Ticket columns gained Excel-style per-column filters — select one or more values, combine filters across columns, and clear individual columns or all filters at once via Clear all. The ticket inbox can also be filtered by organization, and the top menu bar and Ticket List column headers can now be pinned while scrolling across Inbox, My Tickets, Unassigned, Overdue, and Closed views.

Clerk's Application Logs now group sign-ins and sign-ups into a single row per event, and GET /v1/logs returns these groups by default instead of individual log lines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Callers that expected individual log lines per event will receive a different response shape without any documented opt-out.

Email events can now be queried alongside every other event type via GET /v1/logs in the Backend API, and viewed next to other events on the Application Logs page in the Dashboard.

$ curl -X GET 'https://api.clerk.com/v1/logs' \
  -H 'Authorization: Bearer <secret_key>'

The installer now writes /etc/apt/apt.conf.d/99zz-amneziawg-installer-noretries at the start of every run to disable apt download retries and mitigate CVE-2026-109518, deleting the file on exit; --uninstall also removes it if a run was interrupted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ It also warns when apt retries remain enabled via another apt setting despite this file being in place.

$ apt-get -o Acquire::Retries=0 update && apt-get -o Acquire::Retries=0 install --only-upgrade apt

Manage agent identity with warden identity entity and warden identity alias, and surface ungoverned agents via warden identity entity list -ungoverned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ The unknown_aliases setting controls unclaimed agents (observe logs why deny would refuse each request, deny actively refuses unclaimed and ungoverned agents), and governed_only roles are restricted to what a claimed agent's entity groups explicitly allow. Agent sponsors — virtual groups of humans who accept an agent — are managed with warden identity sponsor, without requiring a Warden role.

$ warden identity entity list -ungoverned

auth/<mount>/role/* now returns 410; roles must instead be created with warden role create at sys/roles/<name> and granted by groups per request. Mount keys default_role, groups_claim, group_policy_prefix, metadata_claims, metadata_mappings, token_type, and the provider's user_auth_role are refused. Agent jwt and spiffe mounts now require bound_audiences, and max_age moves from the role to the mount. In mixed-version clusters, a v0.21.0 node cannot read PS256 capabilities, roles, or groups.

Sign people in with warden login through the new oidc auth method, and manage sessions with warden logout, warden role use, and warden print token. Four built-in operator roles (warden-admin, warden-provider-admin, warden-security-admin, warden-viewer) can be enabled per namespace using the enable_builtin_roles setting.

$ warden login
warden role use warden-viewer

Set token_cache_megabytes and credential_cache_megabytes to cap how much memory Warden's token and credential caches use. At the default 100 MiB limit, the token cache holds approximately 113,000 service tokens.

token_cache_megabytes = 200
credential_cache_megabytes = 150

Azure sources can now authenticate with a certificate whose private key stays in a KMS. OAuth2 sources can authenticate with client_secret_basic, private_key_jwt, or kms_private_key_jwt, and an issuer audience can now be set on oauth2 and token_exchange sources.

Token types are now identity_token and service_token (prefix wds.); tokens issued by a v0.21.0 auth mount are refused, requiring agents to log in again. Root and other cws. tokens from no-longer-present mounts will not resolve until they expire.

The new msgraph provider reaches Microsoft 365 as the calling user via the Entra on-behalf-of flow. Bedrock Runtime model calls are now routed through the aws gateway, bounded by the mount's timeout.

Discovery now requires a credential, returning 401 without one, and is capped at batches of 50; 503 is returned when no mount admitted the credential.