Arcade 1.9.8

None. This release applies no schema changes.

Advisories remediated in the bundled application images since c4c7bc1:

• CVE-2026-67213 — nanoid 3.3.18
• GHSA-55q2-fjhq-7xh7 — dompurify 3.4.13
• GHSA-5p4m-2wfm-xmqj — js-yaml 4.3.1 / 3.15.1

• engine.publicCatalog.enabled turns on two credential-free endpoints, GET /v1/public/tool_catalog and GET /v1/public/tools, which serve the deployment's default catalog — tool names, descriptions, and input/output schemas — to anyone who can reach the engine, with paging, caching, and 304 Not Modified support. Off by default. engine.publicCatalog.cacheTtl (default 30s) bounds how long a built catalog is reused before the next read rebuilds it.
• An MCP gateway now accepts private_key_jwt client authentication. A client that presents a signed assertion instead of a shared secret — ChatGPT among them — was previously refused as an unknown client.
• An account can change which organization it opens in, from the organization switcher or over the API. It was chosen once at signup and nothing could move it afterwards.
• An organization admin can be demoted to a project role, keeping access to the organization's projects instead of losing it. Removal was previously the only way to take the role away.
• Tool-execution filters tool_name, toolkit_name, and user_id each accept several comma-separated values, and the listing reports how long executions are retained.

• Removing someone from an organization now removes them: every role they hold, their project access, and the membership itself. It previously revoked only the organization role and left the membership in place. The last remaining admin can no longer be removed.
• The organization members table shows each member's real role and lets an admin change or remove it there. Every non-admin was labelled Member, which hid the project role they held.

• An authorization prompt now reaches MCP clients that check tool output against the schema the tool advertised. Such a client discarded the whole response, so the user never saw the link and the request failed outright.
• A remote MCP server is asked only for the scopes it accepts. A server fronted by an authorization server advertising a different scope set than the resource could not be connected at all.
• PagerDuty asks for the granular scopes its tools declare. Authorizing it previously presented the OAuth application's entire registered scope set, read and write, whatever the tool needed.
• A rejected form now shows the reason on the field it names, opening the section that field sits in and scrolling it into view. Saving a secret or a user source previously produced only a generic try-again message, naming neither the field nor the reason.
• Toolkit and provider brand icons appear whatever capitalization the name uses. Entries like arcade-airtable and snowflake showed a blank icon and a raw value in the Tools page filters.
• The tool inventory popover stays anchored to its own server when a server lower in the list is expanded.
• Clearing every tool from a chat selection keeps it cleared instead of restoring the defaults.
• A failing built-in tool call now appears in logs and traces with the reason it failed. One class of these failures was recorded nowhere, leaving nothing to investigate.
• The gateways list no longer fails to load when it contains fields an older component does not recognise, a mismatch that can appear briefly during a rolling upgrade.

• The built-in authorization tool no longer accepts a whole service, or the whole gateway, as a target; it takes the specific tools it needs. Naming a service asked the end user to grant every scope behind it.

• New chart values. engine.publicCatalog.enabled (default false) and engine.publicCatalog.cacheTtl (default 30s). Upgrading changes nothing until you turn the first one on.
• Read the public-catalog caveat before enabling it. On a self-hosted install the "default catalog" is whatever workers you configured, so enabling it publishes their tool names, descriptions, and input/output schemas to anyone who can reach the engine. It never exposes tenant-scoped toolkits, secret values, OAuth tokens, or per-user readiness.
• No schema changes, no new secrets, no RBAC changes, and no change to cluster prerequisites.

• Two new anonymous endpoints, served only when engine.publicCatalog.enabled is true: GET /v1/public/tool_catalog and GET /v1/public/tools.
• DELETE on an organization member is now a full removal rather than a role revocation, and is refused for the last remaining admin. Anything automating member cleanup should be re-read against this.
• The built-in authorization tool rejects a whole-service or whole-gateway target. An agent that sends one must name the tools it needs instead.
• Tool-execution filters accept comma-separated lists; single values behave as before.