Focusing Fastio on Storage for Agentic Teams

Fastio is now one product: cloud storage for agentic teams. Org-owned workspaces where agents and people work on the same files, reachable from the web app, the REST API, the MCP server, and the fastio CLI. Everything that was not that has come out.

What Was Removed

Workflow automation, tasks, and approvals have been removed from Fastio. This was a deletion, not a deprecation, and it went deep:

• About 105,000 lines across 345 files came out of the web app. That was the entire workflow domain.
• About 1,150 files came out of the platform, covering Workflows, Tasks, and Approvals.
• About 7,750 lines came out of the MCP server, taking the workflow and task tools with them.
• The matching commands and MCP tools are gone from the fastio CLI.
• OAuth discovery no longer advertises the retired all_workflows scope.

If you have links or bookmarks pointing at those routes, they do not dead-end. Deep-link tombstones now catch the removed routes and explain what happened, so an old link tells you where you stand instead of dropping you on a broken page.

The rest of this release is storage work: OAuth consent, uploads, previews, and agent access over MCP and the CLI.

OAuth Consent Is Now Server Authoritative

The consent screen used to draw scope details from URL parameters. It no longer does. Scope details are read from the server, so what you approve on the screen is what actually gets issued.

Two related fixes shipped with it:

• A consent over-grant is fixed. Some consent grants minted organization-wide tokens where share-scoped tokens were correct. Consent now issues the narrower token.
• Cross-type scope escalation is blocked. The server evaluates scope at consent time and refuses to escalate across types.

Two other OAuth changes are smaller but will unblock people:

• OAuth registration accepts JSON bodies.
• OAuth discovery endpoints answer CORS preflight, which unblocks browser based MCP clients.

Also on the access-control side: a missing PUT handler let PUT requests bypass gates, and that handler is now in place. An access-control mismatch that let admin-only events be read by other viewers has been corrected.

Uploads and Rendering

• Upload batches no longer hang on “Finalizing on server.”
• The upload-wait fast-wake path no longer reports a false failure.
• Render open-failure logs now surface the underlying storage error cause.
• The async queue drops unknown job classes instead of resurrecting them.

Previews and Notes

• Convert-to-Note and Share are now on the preview slideout toolbar.
• The slideout Share action resolves the workspace correctly.
• Note editor toolbar icons now show hover tooltips and accessibility labels.
• The filmstrip fallback file icon follows the theme in dark previews.
• A recurring tooltip crash is fixed, by memoizing context and refs.

Navigation and Billing

• Comments got its own navigation destination, then moved into the More overflow.
• The credits billing gauge no longer flip-flops. The billing window is unified.

Agent Access

The MCP endpoint family was reworked so connector OAuth works, which closed a bypass. First-party platform callers now go through a spoofing-proof internal endpoint.

Two changes make agent work more predictable:

• The blob upload sidecar is the default byte source for uploads.
• File downloads are discoverable for code-mode agents, and search ranking is fixed.

On the CLI, the tools allowlist was a stub. It is implemented now, with alias canonicalization so equivalent tool names resolve to a single entry.

Where This Leaves You

Less product, working better. If your day-to-day on Fastio is putting files where agents and people can both reach them, this release is upload reliability, preview polish, and an OAuth path you can reason about. If your bookmarks pointed somewhere that no longer exists, the tombstone will tell you.