Rhys SullivanVersion Packages (#1743)bc8dd392 months agoHistory
811 lines · 73.5 KB · MarkdownRawDownload

executor

1.6.1

Patch Changes

  • #1576 6535a74 Thanks @GeiserX! - The CLI's server-connection store is written owner-only, and two of its tests now actually run

    ~/.executor/server-connections.json holds live credentials for a hosted server — a bearer token, or an OAuth access token together with its long-lived refresh token, rewritten on every silent refresh. It was created with no explicit mode, so the process umask applied and it landed world-readable (0644 by default). Any other account on the machine — or anything that copies a home directory, such as a backup or a container layer — could read a durable credential until the user ran executor logout.

    It is now created 0600 with a follow-up chmod, matching what the local-server manifest already does for the sibling secret it keeps under server-control/. Both steps are needed: mode applies only on create, and the chmod covers rewriting a store that already exists with looser permissions — which is the common path here, since the file is rewritten on every token refresh.

    Separately, two tests in server-profile.test.ts were written as it("…", () => Effect.gen(…)). An Effect is not a thenable, so Vitest treated each as passing without ever running its body — a deliberately falsified assertion still passed. They are now it.effect and execute for real. No production behaviour was wrong; the tests simply were not checking it.

  • #1454 e8ea62c Thanks @jadch! - Prevent concurrent SQLite data-migration runners from failing when another runner commits the same ledger stamp first.

  • #1579 31e17c7 Thanks @GeiserX! - The desktop settings store is written owner-only

    settings.json holds serverProfiles, which carries a remote server's credential — a bearer token, or a basic-auth username and password — for any "Custom server" the user connects to. conf (under electron-store) defaults to configFileMode: 0o666, so with no explicit mode the file was created 0644. On Linux, where ~/.config is not reliably 0700, that is readable by every other account on the machine. macOS is protected by ~/Library being 0700 and Windows by ACLs, so this is primarily a Linux-desktop exposure — but owner-only credential files are already this app's standard: local-auth.ts writes auth.json at 0o600, and the sidecar manifest is chmodded the same way.

    One option is sufficient here, rather than the mode-plus-chmod pair used elsewhere: atomically chmods the temp inode only when the requested mode differs from its own default, and the atomic rename then carries the tight mode onto an already-loose file. Verified against the installed conf — with no option a fresh file lands 0644; with configFileMode: 0o600 a fresh file lands 0600 and an existing 0644 file becomes 0600 on the next write.

  • #1582 e8e97c4 Thanks @GeiserX! - An MCP health check no longer reports healthy when the connection's credential is missing

    Rendering skips an auth placement whose value is unresolved — that is the renderer's documented behaviour, and callers own the missing-value policy. The MCP health check had no such policy, so it dialled unauthenticated, and any server that lists tools without auth answered. discoverTools succeeding maps straight to healthy, so a connection whose credential was gone reported as healthy.

    Health status is the signal telling a user to re-authenticate, which makes healthy the one answer it must never give in that state. The check now reports expired with the unresolved input names, mirroring the OpenAPI health check, which already did exactly this.

    The MCP tool-invocation path already refused for the same reason. resolveTools is deliberately left alone — its own comment records that discovery tolerating unresolved credentials is intended, since an open server lists tools unauthenticated.

  • #1741 62748e8 Thanks @RhysSullivan! - Opt-in per-integration search tools on the MCP surface

    Connecting with ?search_tools=true (stdio: executor mcp --search-tools) adds one minimally-described search_<integration> MCP tool per connected integration, so the integration namespaces reach the model as tool names it can see without calling anything. Each call routes through the same flow as tools.search({ namespace }) inside execute, and the tool list comes from the same inventory the execute description shows. Off by default; a clean endpoint URL is unchanged.

  • #1573 45ba141 Thanks @GeiserX! - The MCP connection pool no longer keeps credentials in its cache key

    A pooled remote MCP session is looked up by a key describing the connection's identity, and that key included the connection's resolved credential values — plus the headers and query params those same secrets had already been rendered into. The key is retained as a Map key for the pool's lifetime, so the secret stayed readable in process memory long after the call that needed it had finished, with nothing left to read it.

    The key is now the SHA-256 digest of that identity rather than the identity itself. Reuse is unchanged, because equal identities still produce equal keys, and separation is unchanged too: a rotated access token, a different rendered auth header and a credential carried in a query param each still dial a fresh session instead of reusing one authenticated as somebody else. Hashing the whole identity rather than only the fields known to be sensitive means a field added later is covered without anyone having to remember it carries a secret.

    Nothing reads the key back — the pool only compares it, and it reaches no log, span or error message — so nothing observable changes.

  • #1800 eac13e7 Thanks @RhysSullivan! - Idle MCP session runtimes are actually reclaimed

    The MCP session Durable Object has an idle timeout that disposes a session's execution runtime — the execution engine and its executor closure, the built tool catalog, and a live database handle — once the session has gone quiet. That timeout never ran.

    The session arms an idle alarm on every request. The agents framework independently recomputes the Durable Object alarm from its own schedule table and keep-alive refcount, and when it finds neither it does not leave the alarm alone: it deletes it. It releases the last keep-alive reference at the end of every ordinary tool call, from a waitUntil that runs just after the response goes out — so the idle alarm the session had armed moments earlier was erased, and a session that had just served a request was left with no alarm at all. Its runtime then stayed resident until the platform evicted the whole object.

    Durable Objects are colocated many-to-one onto an isolate with a single heap, so runtimes that are never reclaimed accumulate there. When the heap is exhausted the allocation that fails is whichever comes next, anywhere in the isolate — which is why the failure tended to surface from storage rather than from the runtimes that had consumed the memory.

    The idle deadline belongs to the session, not to the framework's scheduler, so it is now re-asserted after the framework has arranged whatever it needs — and only while a runtime is actually resident, since once there is nothing left to reclaim the framework's answer is correct.

    Disposal also now emits a span carrying a per-isolate resident-runtime gauge, alongside the same gauge on runtime build, so the reclaim can be confirmed in production rather than inferred.

  • #1609 662ebe2 Thanks @timkley! - Fix: declare the OAuth application type during dynamic client registration

    Dynamic OAuth registrations now identify HTTPS callbacks as web applications and loopback HTTP callbacks as native applications. This lets strict OAuth servers validate Executor's redirect URI against the correct client type.

  • #1570 e66a3d8 Thanks @GeiserX! - The OAuth popup clears its result out of localStorage after handing it over

    The popup writes its result to localStorage as the fallback completion channel, because postMessage is severed when a provider's consent page sets COOP and BroadcastChannel can be partitioned or raced by the auto-close. Nothing removed that entry afterwards, so the payload — which carries the identity label, an email, and on failure the error preview — stayed parked in the user's browser profile.

    The entry is now cleared once the handover has had time to land, and on pagehide as a backstop — the failure page never auto-closes so the user can read the error, and closing it by hand would otherwise cancel the pending timer and strand the entry. This cannot cost a listener the result: a storage event captures newValue at dispatch, so an opener that has been notified already holds it.

  • #1574 c8bb857 Thanks @GeiserX! - The 1Password service-account token is cleared from the op-js global after each call

    @1password/op-js keeps the service-account token on a module-level CLI instance (cli.serviceAccountToken) and reads it when it spawns op. The CLI backend set that global before each call and never cleared it, so one reachable reference to the token stayed live for the rest of the process.

    It is now cleared as soon as the call that needed it is done, on success, failure and interruption alike. Authentication is unaffected: every read and write of that global already happens inside the backend's semaphore, so the next operation re-sets the token before it spawns anything.

    This is hygiene rather than a boundary change. No unrelated op child ever received a stale token — every call routes through the same critical section that sets the correct one immediately before invoking — and the token is separately persisted in plaintext in the plugin's config blob, so an attacker's reach is unchanged. What it removes is a long-lived reachable reference that nothing needed to keep.

  • #1749 d4afe0c Thanks @RhysSullivan! - Slim the per-integration search_<integration> tool definitions to under half their size: one shared one-line description (the tool name already carries the namespace) and a single bare query parameter, dropping the limit/offset knobs. A session pays for these definitions once per connected integration, so the surface now costs ~2k tokens instead of ~5k at 30 integrations; paging through a namespace belongs in execute.

  • #1798 69b0e64 Thanks @RhysSullivan! - The packed Worker toolchain is verified at build time, and an incomplete copy is now reported instead of silently ignored

    @cloudflare/worker-bundler cannot live inside the compiled binary: bunfs has no node_modules, so a bare specifier is unresolvable there by construction. The build instead copies the package's dist/ next to the executable and native-bindings.ts publishes that path as EXECUTOR_WORKER_BUNDLER_DIR for consumers to load from.

    That handoff was described in two places that were free to drift, and did. The build writes dist/index.bundled.js — the entry consumers actually load, packed so it has no bare imports of its own — while the runtime check only looked for dist/index.js and dist/esbuild.wasm. Nothing verified the staged copy after the compile, so a partial staging produced a binary that looked fine on the build machine and failed on the user's, at startup. Worse, the runtime check failed open: when a file was missing it silently declined to set the environment variable, leaving a consumer to fall through to the bare specifier and crash.

    The required file list is now one shared contract used by both sides, so they cannot disagree. The build asserts the staged copy after compiling each target — every required file present, a size floor on the packed entry, and the \0asm magic on the wasm so a truncated copy cannot pass — turning a packaging slip into a failed build rather than a broken install. At runtime, a directory that is present but incomplete is reported on stderr naming the missing files, instead of being swallowed. An absent directory stays quiet, since that is the normal non-packaged path.

  • Updated dependencies [55180cb]:

    • @executor-js/sdk@1.6.1
    • @executor-js/api@1.4.64
    • @executor-js/local@1.6.1
    • @executor-js/runtime-quickjs@1.6.1

1.6.0

Patch Changes

  • #1737 9296f36 Thanks @RhysSullivan! - Scope the skills tool to Executor's own documentation. Its description, argument, index, and unknown-name error now state that it serves a fixed catalog of how-to docs for this server's tools, so an agent on a host without a skill tool of its own no longer reads it as a general reader for the harness's or the user's skills.

  • Updated dependencies [a2d1417]:

    • @executor-js/sdk@1.6.0
    • @executor-js/local@1.6.0
    • @executor-js/api@1.4.63
    • @executor-js/runtime-quickjs@1.6.0

1.5.42

Patch Changes

  • Updated dependencies [d3f0617]:
    • @executor-js/sdk@1.5.42
    • @executor-js/local@1.5.42
    • @executor-js/api@1.4.62
    • @executor-js/runtime-quickjs@1.5.42

1.5.41

Patch Changes

  • #1600 1b5f931 Thanks @RhysSullivan! - Add integrations.remove to the core tools so an agent can drop a catalog integration

    integrations.list advertises canRemove per integration, but nothing on the agent surface could act on it: removal existed only on the HTTP API and the web console, so an agent that could add an integration could never take one back out. Cleaning up a catalog meant clicking through the UI once per integration.

    The core-tools plugin now contributes integrations.remove, taking the slug reported by integrations.list and cascading to every connection under the integration and the tools those produced. It is approval-gated, being strictly more destructive than connections.remove. The removed flag is honest rather than always-true: false means no catalog row matched, so an already-absent slug and a built-in namespace like executor are distinguishable from a real removal, and an integration pinned with canRemove: false is refused with IntegrationRemovalNotAllowedError instead of silently surviving.

  • #1556 f674fb8 Thanks @RhysSullivan! - Fix: native MCP elicitation now reaches clients on the local HTTP endpoint instead of timing out

    The local daemon's Streamable HTTP transport ran with enableJsonResponse: true, which buffers a tools/call into a single JSON body and leaves no open stream for the server to write on. A server-to-client elicitation/create raised during that call was therefore never delivered, and approval-gated tools failed with a -32001 request timeout even though the session had negotiated elicitation_mode=native and the client's elicitation.form capability. The transport now uses the spec-default SSE streaming, so the reverse request rides the originating tool call's stream — matching the Cloudflare host's behaviour.

  • #1603 624e85f Thanks @RhysSullivan! - Fix: oauth.clients.remove reported success for clients it never removed

    The tool returned { removed: true } unconditionally. oauth.removeClient is idempotent by design at the storage layer — deleteMany on a missing row is a no-op, which is the right behaviour for a delete — but the tool mapped that silence to success, so a typo'd slug, an already-deleted client, and the wrong owner were all indistinguishable from a real deletion.

    This bites hardest because clients are keyed by BOTH owner and slug, so the same slug can exist separately under org and user. An agent sweeping a list of slugs under one hardcoded owner would delete only half of them and report every call as a success, leaving org-owned OAuth apps registered after everything they authorized was gone.

    The tool now checks the caller-visible client set first and returns removed: false when nothing matched that (owner, slug) pair. The service-level removeClient is unchanged and stays idempotent.

  • Updated dependencies [d572658]:

    • @executor-js/sdk@1.5.41
    • @executor-js/local@1.5.41
    • @executor-js/api@1.4.61
    • @executor-js/runtime-quickjs@1.5.41

1.5.40

Patch Changes

  • #1528 676af1a Thanks @baggiiiie! - Prevent execute agents from attempting unsupported base64 decoding by directing file payloads through ToolFile emission and bodyBase64 forwarding.

  • #1545 df62bb3 Thanks @RhysSullivan! - Fix: reconnecting an OAuth connection now refreshes its health status in place — no page reload needed

    Completing a reconnect previously left the stale "Expired" verdict on the connection row (and the integrations-list summary) until a hard refresh. Re-minting now clears the persisted verdict, and the UI re-probes as soon as the refreshed connection arrives.

  • #1534 80e5530 Thanks @RhysSullivan! - Report the real product surface and version in the integrations.sh registry user-agent. The daemon previously sent local with a version frozen at 1.4.4; it now reports cli or desktop (matching analytics surfaces) and @executor-js/local is versioned with the release train.

  • Updated dependencies [8ba64f6, 80e5530]:

    • @executor-js/sdk@1.5.40
    • @executor-js/local@1.5.40
    • @executor-js/api@1.4.60
    • @executor-js/runtime-quickjs@1.5.40

1.5.39

Patch Changes

  • Updated dependencies [6c316c7]:
    • @executor-js/sdk@1.5.39
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.59
    • @executor-js/runtime-quickjs@1.5.39

1.5.38

Patch Changes

  • #1417 046d67d Thanks @morluto! - Show policy and OAuth app removal failures in the UI, and keep success-only state unchanged when those writes fail.

  • #1511 7eb795d Thanks @RhysSullivan! - Fix: execute scripts that both emit() output and return a value no longer lose the returned value in MCP clients that ignore structuredContent — the return value is now appended to the tool-result content after the emitted items

  • #1418 d3610e3 Thanks @morluto! - Return an execution error when a Deno subprocess closes stdin instead of emitting an unhandled write failure.

  • #1507 541549a Thanks @RhysSullivan! - Fix: OAuth refresh rejections with non-spec error bodies (e.g. Datadog) now surface as expired connections with a reconnect path, and definitively dead refresh tokens are no longer retried against the authorization server

  • #1517 59a6640 Thanks @kitze! - Fix: OpenAPI query parameters that use form-style exploded objects now serialize each object field as a query parameter.

  • #1416 f1b617c Thanks @morluto! - Prevent provider service migration row loss caused by generated ID conflicts.

  • #1420 8c71744 Thanks @morluto! - Abort GraphQL tool calls that exceed the configured invocation timeout instead of waiting indefinitely for an upstream response.

  • Updated dependencies [6a924dd]:

    • @executor-js/sdk@1.5.38
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.58
    • @executor-js/runtime-quickjs@1.5.38

1.5.37

Patch Changes

  • #1506 c05a1cf Thanks @RhysSullivan! - Artifacts are now on by default for MCP connections. A plain endpoint URL serves the full artifact surface — the artifact tools, the app shell resource, and the artifact skills. Connections that don't want it opt out with ?artifacts=false (or --no-artifacts on the stdio CLI); ?artifacts=true remains accepted as the explicit default. Previously the surface required a ?artifacts=true opt-in.

  • #1498 657b913 Thanks @RhysSullivan! - Add anonymous product analytics to the local daemon (CLI + desktop) and self-host: execution counts split by MCP/API plane, toolkit usage, integration add/remove, and artifact usage (created/viewed/updated/deleted, attributed to agent tools vs the console UI), filed under a persisted per-install anonymous id. Opt out with DO_NOT_TRACK or EXECUTOR_DISABLE_ANALYTICS.

  • #1500 5eb2ca3 Thanks @RhysSullivan! - Fix: the artifact migration no longer narrows definition.name to varchar(255), which failed on existing long definition names

  • #1472 1178e3b Thanks @RhysSullivan! - Add an Artifacts tab. Interactive components an agent generates with render-ui are saved and listed in the console, and each one has its own page that renders it live — the page an MCP client without MCP Apps support deep-links to. Artifacts can be renamed and deleted from the console, and agents find them again by title.

  • #1505 9bd4a5b Thanks @RhysSullivan! - Artifact tool results now include the web deep link beside the inline widget payload, not just on the no-apps fallback. Clients can lose a rendered widget in ways the server never sees — a reopened transcript that skips the resource re-read shows raw JSON — and the URL in the result is the model's way to point the user back at the artifact.

  • #1483 54df2e3 Thanks @davidwrossiter! - Fix: GraphQL connections now reject credentials when schema introspection fails and show actionable tool sync diagnostics

  • #1499 010ea98 Thanks @RhysSullivan! - Fix: the add-connection wizard no longer wipes a pasted credential when the key check saves a health check mid-flow

  • #1503 a7c4689 Thanks @RhysSullivan! - Fix: MCP responses larger than Durable Object storage's 128 KiB per-value cap hung the client instead of being delivered

    The DO transport persisted every outbound message for reconnect replay before writing the live SSE frame, and storage.put of an oversize value throws — so a large response (the ui://executor/shell.html resource is ~5 MB) was neither stored nor sent, and the client waited on keepalives forever. The transport now delivers the live frame first and treats persistence as best-effort: an oversize message skips the event store with a logged warning and arrives without a replay id, which only costs replayability if the connection drops mid-delivery.

  • #1502 25270b1 Thanks @RhysSullivan! - Fix: MCP clients of the cloud host got a "Shell not built" placeholder as the ui://executor/shell.html resource, so every artifact rendered as a widget that never finished loading

    The deployed Worker has no filesystem, and the shell loader silently fell back to an inert placeholder document when its fs.readFile failed. Workers hosts now fetch the built shell through the static-assets binding (the app build emits a stable-named copy alongside the hashed one), the self-host image reads the same emitted asset from its SPA dist, and a host that cannot produce the shell now fails the resource read with an actionable error instead of serving a document that hangs the client. App builds fail if the shell asset was not emitted.

  • Updated dependencies [657b913]:

    • @executor-js/sdk@1.5.37
    • @executor-js/api@1.4.57
    • @executor-js/local@1.4.4
    • @executor-js/runtime-quickjs@1.5.37

1.5.36

Patch Changes

  • #1478 8ecbfd6 Thanks @RhysSullivan! - Store minted OAuth tokens in the durable file secret store (auth.json under EXECUTOR_DATA_DIR) instead of the system keychain. On sandbox/headless hosts the keychain can be an in-memory keyring that a stop/recreate wipes, leaving OAuth connections expired with "Stored refresh token could not be resolved." Existing keychain-backed connections migrate with one clean reconnect.

  • #1462 5a70675 Thanks @RhysSullivan! - Fix: org OAuth connections on self-host worked only for whoever ran the consent

    The encrypted-secrets credential provider (the writable provider on the self-hosted and Cloudflare hosts) filed token rows under the acting user's private partition instead of the credential's own owner. An org-owned OAuth connection whose consent completed in one member's browser session therefore resolved only for that member — every other principal failed with oauth_connection_missing, while the UI showed the connection healthy. The provider now partitions by the owner embedded in the item id (oauth:org:… → org-shared), matching the WorkOS Vault provider, and a boot-time data migration re-files rows already written wrong. The encrypted value itself was never affected.

  • #1459 fc1e589 Thanks @wan0net! - Preserve elicitation_mode=native when creating self-hosted MCP sessions.

  • #1475 77b0821 Thanks @RhysSullivan! - Refresh OAuth tokens when the upstream rejects them with HTTP 401, not only when the stored expiry says they are due. Connections whose authorization server omits expires_in can now recover without a manual reconnect, and the refresh path is traced.

  • #1476 167d899 Thanks @RhysSullivan! - Remove the custom apps plugin. Git and local-directory app sources are no longer supported. The packed binary still ships the workerd and worker-bundler sidecars.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.36
    • @executor-js/runtime-quickjs@1.5.36
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.56

1.5.35

Patch Changes

  • Updated dependencies [1b9b1f1, 99c808f]:
    • @executor-js/sdk@1.5.35
    • @executor-js/runtime-quickjs@1.5.35
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.55

1.5.34

Patch Changes

  • Updated dependencies [e2712db, 7207347, 0c4e9b4]:
    • @executor-js/sdk@1.5.34
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.54
    • @executor-js/runtime-quickjs@1.5.34

1.5.33

Patch Changes

  • #1404 5e0dd15 Thanks @RhysSullivan! - The provider service split boot migration now skips an org whose Google or Microsoft integration cannot be migrated (for example a config without a stored specHash) instead of failing the whole migration and blocking server startup. A daemon that does fail during boot now exits with the underlying error message instead of hanging with a generic "Unknown error".

  • Updated dependencies []:

    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.33
    • @executor-js/runtime-quickjs@1.5.33
    • @executor-js/api@1.4.53

1.5.32

Patch Changes

  • #1395 d90d8be Thanks @RhysSullivan! - Policy create now defaults a new rule's position below any more-specific existing rule on the server, so a broad rule written without an explicit position (stale UI, API, agent tool) cannot shadow an existing narrower rule.

  • #1394 1ca5111 Thanks @RhysSullivan! - Ship the platform workerd binary in the self-host Docker runtime; without it custom app tools failed to sync or invoke with "workerd is unavailable on this platform".

  • Updated dependencies []:

    • @executor-js/sdk@1.5.32
    • @executor-js/runtime-quickjs@1.5.32
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.52

1.5.31

Patch Changes

  • #1390 d95e63c Thanks @RhysSullivan! - Ship @cloudflare/worker-bundler in the self-host Docker runtime so the server starts; it was resolved at runtime since the dynamic Worker bundler change but never copied into the image.

  • Updated dependencies []:

    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.31
    • @executor-js/runtime-quickjs@1.5.31
    • @executor-js/api@1.4.51

1.5.30

Patch Changes

  • #1371 262fc3e Thanks @RhysSullivan! - Explain 401s from a hosted server as a sign-in problem with the exact executor login command to run, instead of surfacing a raw decode error. executor login now defaults to https://executor.sh when no server is specified, and profile plumbing stays out of messages unless you address servers by name.

  • #1375 0f81165 Thanks @RhysSullivan! - Run cloud custom tool bundling in a dynamically loaded Worker so dependency installation and bundling do not share the serving request isolate.

  • #1349 a7e3091 Thanks @RhysSullivan! - Back-stop code execution with a host-side timeout so a wedged sandbox delivers a descriptive error instead of hanging silently.

  • #1351 93b000a Thanks @RhysSullivan! - Let stock MCP clients auto-reconnect and recover a tool result when a POST stream drops mid-call.

  • #1345 c46730b Thanks @RhysSullivan! - Preserve MCP tool results across dropped streamable HTTP SSE connections.

  • #1357 4c319ee Thanks @RhysSullivan! - Throw a guidance error when sandbox code enumerates the tools proxy (Object.keys, spread, for...in) instead of returning an empty list, pointing agents at tools.search().

  • #1352 8bdf315 Thanks @RhysSullivan! - Treat a transient WorkOS outage during the MCP live-membership check as a retryable 503 instead of a Forbidden that destroys the session.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.30
    • @executor-js/runtime-quickjs@1.5.30
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.50

1.5.29

Patch Changes

  • #1341 5656c3e Thanks @RhysSullivan! - Fix 1Password desktop-app connections failing with "undefined is not a constructor (evaluating 'new n.DesktopAuth(...)')" in packaged builds. The compiled binary now bundles the 1Password SDK's wasm core correctly and falls back to a copy shipped next to the binary, so vault listing and secret resolution work without the op CLI installed.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.29
    • @executor-js/runtime-quickjs@1.5.29
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.49

1.5.28

Patch Changes

  • Updated dependencies [1c48182]:
    • @executor-js/sdk@1.5.28
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.48
    • @executor-js/runtime-quickjs@1.5.28

1.5.27

Patch Changes

  • Updated dependencies [c7ab1e2]:
    • @executor-js/api@1.4.47
    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.27
    • @executor-js/runtime-quickjs@1.5.27

1.5.26

Patch Changes

  • #1221 3606317 Thanks @RhysSullivan! - Send correct Cache-Control headers for the self-hosted web app. The SPA shell (index.html) and its client-route fallbacks are now served with no-cache, so a new deploy is picked up on the next visit instead of the browser rendering a stale UI from cache until a hard refresh. Content-hashed /assets/* are served immutable and cached long-term.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.26
    • @executor-js/runtime-quickjs@1.5.26
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.46

1.5.25

Patch Changes

  • Updated dependencies []:
    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.25
    • @executor-js/runtime-quickjs@1.5.25
    • @executor-js/api@1.4.45

1.5.24

Patch Changes

  • #1207 c8d9b9d Thanks @RhysSullivan! - Polish the app's title bar. The release tag beside the executor wordmark is now quiet muted-mono metadata instead of a filled pill, matching the registry-minimal design language, and the wordmark is shared across the desktop and dashboard shells so the brand reads identically everywhere. The macOS traffic-light offset is also applied to the mobile sidebar overlay and the collapsed top bar, so the native window controls never sit on top of the wordmark when the window is narrow.

  • #1204 9394217 Thanks @RhysSullivan! - Fix the self-host and Cloudflare web dashboards showing "update available" even on the latest version. The builds baked a placeholder version (0.0.0-selfhost / 0.0.0-cloudflare) into the shell, so the update check always compared as behind. They now bake the real release version, and the sidebar footer shows the running version so you can see what you are on.

  • #1209 ffa4f70 Thanks @RhysSullivan! - Fix the desktop and CLI daemon crashing on first launch on Windows when a v1 local database is present. The v1 to v2 data migration performed file operations (fsync, rename, remove) on libSQL SQLite files whose native OS handles linger after close() on Windows, surfacing as a fatal "Unknown error" (EPERM on fsync of a read-only handle, EBUSY on rename/remove of just-closed files). POSIX is unaffected, so this only reproduced on Windows. The migration now opens files read-write for fsync (treating it as best-effort), retries removes the same way renames were already retried, and forces a GC pass on each retry so libSQL's native finalizer releases the handle before the next attempt. Fixes the v1.5.23 Windows startup regression.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.24
    • @executor-js/runtime-quickjs@1.5.24
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.44

1.5.23

Patch Changes

  • #1199 29936d5 Thanks @RhysSullivan! - Add a test seam to skip the first-run "keep Executor running in the background?" consent dialog under automation, matching the existing confirmResetState seam. Set EXECUTOR_TEST_AUTO_CONFIRM_BACKGROUND_SERVICE=1 to keep the background service or any other value to decline. When the variable is unset the dialog is shown exactly as before. Native dialogs cannot be answered from CDP or Playwright, so a packaged first-run boot under automation previously blocked at this prompt with no way to proceed.

  • #1199 29936d5 Thanks @RhysSullivan! - Fix the desktop app failing to start its local server when the generated auth token begins with a dash. The token is randomBytes(32).toString("base64url"), which can start with "-", and the packaged app passed it to the bundled CLI as a separate argument (--auth-token, then the token). The CLI then read the leading-dash token as an unknown flag, printed its help, and exited, so the desktop showed a fatal "local Executor server crashed during startup" dialog. This was persistent (the token is saved) and cross-platform, affecting roughly 1 in 64 fresh installs. The token is now passed in the combined --auth-token=<value> form so a leading dash is treated as the value.

  • #1199 29936d5 Thanks @RhysSullivan! - Notify when a newer Executor is published. The CLI now prints an "update available" line under its ready banner, and the web shell's sidebar update card works for real (a new /v1/app/npm/dist-tags endpoint backs it). In the desktop app the card shows a native "Restart to update" action wired to the in-app updater instead of the npm command. The check is best-effort and offline-safe, and can be disabled with EXECUTOR_DISABLE_UPDATE_CHECK.

  • Updated dependencies [29936d5, 29936d5]:

    • @executor-js/api@1.4.43
    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.23
    • @executor-js/runtime-quickjs@1.5.23

1.5.22

Patch Changes

  • #1167 add2e40 Thanks @RhysSullivan! - Fix the desktop app's main-area title-bar strip pushing page content down so page headers no longer lined up with the sidebar header. The drag strip now overlays the top of the main area (behind page content) instead of reserving its own row, and the Toolkits header uses a fixed title-bar height so its bottom border aligns with the sidebar header again.

  • Updated dependencies []:

    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.22
    • @executor-js/runtime-quickjs@1.5.22
    • @executor-js/api@1.4.42

1.5.21

Patch Changes

  • #1134 78aa871 Thanks @RhysSullivan! - Fix OAuth callbacks in cloud so they preserve the URL-selected organization when the session cookie points at another org.

  • Updated dependencies []:

    • @executor-js/local@1.4.4
    • @executor-js/sdk@1.5.21
    • @executor-js/runtime-quickjs@1.5.21
    • @executor-js/api@1.4.41

1.5.20

Patch Changes

  • #1132 580fc7f Thanks @RhysSullivan! - Fix the PostHog custom MCP OAuth setup flow so Add connection opens PostHog authorization instead of falling back to manual OAuth app registration.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.20
    • @executor-js/runtime-quickjs@1.5.20
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.40

1.5.19

Patch Changes

  • #1115 92bd86c Thanks @RhysSullivan! - Google media downloads (Drive file contents, exports, and other binary endpoints) are now returned as binary responses instead of being decoded as text, so files come back intact. Emit them with emit(result.data).

  • #1115 92bd86c Thanks @RhysSullivan! - The CLI now validates that a URL is http/https before handing it to the operating system's browser opener, and on Windows opens it via rundll32 url.dll,FileProtocolHandler instead of cmd /c start. This removes a path where a crafted URL could be interpreted as a shell command. executor login and the "open in browser" prompts behave the same for normal URLs.

  • #1115 92bd86c Thanks @RhysSullivan! - Hardened the hosted egress guard. Outbound requests from OAuth token exchanges, MCP transports, and GraphQL/Google/Microsoft discovery now all route through the guard, and the guard resolves DNS before connecting so a hostname that points at a private or loopback address is blocked rather than only literal private IPs. This tightens SSRF protection for hosted and cloud execution.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.19
    • @executor-js/runtime-quickjs@1.5.19
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.39

1.5.18

Patch Changes

  • #1093 bc24d1a Thanks @RhysSullivan! - connections.create now accepts no-auth connections (the none template with no credential), which previously failed validation with "Expected exactly one provider credential origin". Agents can wire up public, no-auth integrations (public MCP servers, public REST APIs) programmatically instead of bouncing through the web UI. Templates that take a credential still require exactly one.

  • #1093 bc24d1a Thanks @RhysSullivan! - OpenAPI tools that return a file now spell out how to emit it directly in the tool's description, so an agent sees the emit(result.data) contract before its first call instead of only discovering it after a failed attempt or by reading describe.tool. Non-file tools are unchanged.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.18
    • @executor-js/runtime-quickjs@1.5.18
    • @executor-js/local@1.4.4
    • @executor-js/api@1.4.38

1.5.17

Patch Changes

Lines 1–500 of 811.