Rhys SullivanVersion Packages (#2048)3890d6f1 month agoHistory
630 lines · 30.5 KB · MarkdownRawDownload

@executor-js/plugin-openapi

1.6.10

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.6.10
    • @executor-js/config@1.6.10
    • @executor-js/api@1.4.73
    • @executor-js/react@1.4.73

1.6.9

Patch Changes

  • #1955 55a8b5e Thanks @smrht! - Fetch Google Analytics Data (analyticsdata) Discovery from the service's own host. The central directory does not list the GA4 Data API, so the canonical https://www.googleapis.com/discovery/v1/apis/analyticsdata/v1beta/rest answers 404 and the source fails to import. Same treatment forms, keep and photospicker already get.

  • #1960 d64639b Thanks @baggiiiie! - OpenAPI tools that cannot reach the upstream server now return an upstream_unreachable error instead of Internal tool error [id]. The message names the integration and origin that could not be reached, details carries the sanitized host and errno-style code (ECONNREFUSED, ENOTFOUND, …), and the failure is logged with the same classification.

  • #1937 e9055c1 Thanks @The-AarushiSingh! - Preserve vendor +json Content-Type on OpenAPI object request bodies.

  • #1952 1f67d83 Thanks @Karavil! - Support POST health checks for APIs that expose reads through HTTP RPC. Warn that POST can change data, allow validated JSON request bodies, and display the reason when a configured probe cannot run.

  • #2000 3fd28a5 Thanks @RhysSullivan! - Update the YAML parser to include fixes for malformed-input denial of service.

  • Updated dependencies [d873caf, 40b2f2e, 65d939e, 3c263d7, 61f71c5, a6cdcf1, be77521, f8cfa5f, 1f67d83, 905e097, cc0fd8f, 85cf428, 38a7725, 3fd28a5, 929b233]:

    • @executor-js/api@1.4.72
    • @executor-js/sdk@1.6.9
    • @executor-js/react@1.4.72
    • @executor-js/config@1.6.9

1.6.8

Patch Changes

  • #1913 6d1f670 Thanks @RhysSullivan! - Expose OpenAPI spec updates as an approval-gated Executor tool so agents can refresh URL-backed integrations without removing their connections.

  • #1919 caa0391 Thanks @RhysSullivan! - Workspace writes now require an administrator

    Executor bindings accept orgWrites: "allowed" | "denied" | "request". Request-aware hosts use "request" and bind CurrentOrgWriteAccess from the authenticated principal for each request. An approval, decline, cancellation, or form response also rebinds the paused execution to the resumer's current access. Browser approvals derive access from the authenticated browser user's live organization membership when that user posts the decision, rather than from the earlier MCP request waiting for it or the user's global role. Self-host uses the same Better Auth membership lookup for ordinary requests and browser decisions. A demotion before either kind of resume therefore takes effect before the paused execution can reach a workspace-write sink.

    Principal now declares its role model explicitly: organization-backed hosts carry orgRoleModel: "organization" and an optional normalized admin/member role, while hosts without roles carry orgRoleModel: "none" and cannot also carry an organization role. Missing role data under the organization model fails closed, including legacy persisted MCP session metadata. Cloud derives roles from WorkOS memberships and self-host derives them from Better Auth.

    Members may still read and execute shared workspace resources and perform operational maintenance such as token refresh and tool-catalog synchronization. User-requested workspace mutations now return OrgWriteDeniedError (HTTP 403): workspace connections and reconnects, organization OAuth clients and connect flows, tool policies, and integration add/update/replace/remove/health-check operations. Personal connection management remains available.

    Pasted connection credentials, OAuth client secrets, OAuth connection tokens, and dependent tool discovery run only after the outermost transaction commits their row, including when a plugin wraps creation in ctx.transaction. Each committed row records unique provider item references owned by that write attempt. Reads resolve only those recorded references, so the post-commit window fails closed with a retryable incomplete-write error and can never resolve a predecessor's credential. A process crash leaves detectable missing references; a later executor incarnation can atomically replace and retry a stranded pasted connection, while OAuth client and connection retries replace their rows through their existing update paths.

    If credential persistence fails while the process remains alive, row and provider compensation restore the prior state where possible and surface incomplete cleanup explicitly. Best-effort cleanup can leave inert orphaned attempt items, but an attempt never shares an item reference with a successor, eliminating the former successor-clobber interval without requiring provider compare-and-set support.

  • Updated dependencies [31a8042, b5271a6, caa0391]:

    • @executor-js/sdk@1.6.8
    • @executor-js/api@1.4.71
    • @executor-js/config@1.6.8
    • @executor-js/react@1.4.71

1.6.7

Patch Changes

  • Updated dependencies [98d6c6a]:
    • @executor-js/sdk@1.6.7
    • @executor-js/api@1.4.70
    • @executor-js/config@1.6.7
    • @executor-js/react@1.4.70

1.6.6

Patch Changes

  • Updated dependencies [9a1fbd5]:
    • @executor-js/react@1.4.69
    • @executor-js/api@1.4.69
    • @executor-js/sdk@1.6.6
    • @executor-js/config@1.6.6

1.6.5

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.6.5
    • @executor-js/config@1.6.5
    • @executor-js/api@1.4.68
    • @executor-js/react@1.4.68

1.6.4

Patch Changes

1.6.3

Patch Changes

  • #1530 85b1955 Thanks @BittuBarnwal7479! - Multipart file fields in an OpenAPI spec now accept and send real files. A multipart/form-data property typed as a binary or byte string is rewritten into the SDK's tool-file schema when the tool is extracted, so an agent supplies a file the same way it does everywhere else. On invocation those values are decoded back into File/Blob parts — as bare properties and inside arrays, with a per-property encoding.contentType applied to each file part — instead of being JSON-stringified into the form body, which is what upstreams were previously rejecting. A file whose base64 payload does not decode now fails the invocation and names the field, rather than sending the file envelope as JSON.

    The rewrite advertises only the shapes the request encoder can deliver. Two are deliberately left alone:

    • A binary field nested inside an object property. Only top-level multipart properties and direct items of a top-level array property become form parts.
    • A multipart body schema, or one of its properties, behind a $ref. Component schemas are carried through unresolved by design — the streaming compile path never materializes components.schemas — so a $ref'd file field keeps its declared binary string type.

    The rewrite reads the request schema's own properties map rather than walking every object key, so a default, example, or vendor extension that happens to look like a binary string schema is untouched. Descriptions, titles, and nullability on the replaced field are carried onto the file schema.

  • Updated dependencies [66fb1a4, c1f51b7, d7e4b73, 02b52cd]:

    • @executor-js/react@1.4.66
    • @executor-js/sdk@1.6.3
    • @executor-js/api@1.4.66
    • @executor-js/config@1.6.3

1.6.2

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.6.2
    • @executor-js/config@1.6.2
    • @executor-js/api@1.4.65
    • @executor-js/react@1.4.65

1.6.1

Patch Changes

  • #1755 7c12aee Thanks @RhysSullivan! - Make Microsoft Graph slice URLs first-class spec sources instead of a hidden substitution. Catalog tiles now point directly at the slice release assets, the stored specUrl is exactly what gets fetched, and selection narrowing travels visibly in the URL fragment; requesting the upstream monolith URL fetches the monolith, never a silently swapped slice.

  • #1753 ddbf0fe Thanks @RhysSullivan! - Serve Microsoft Graph preset selections from precomputed slice release assets instead of the 43MB upstream monolith. The monolith fetch almost never survives a 128MB Workers isolate (production traces show one completion in 30 days), so covered selections — every catalog preset, plus any combination within the default bundle — now read a 4–19MB filtered document built offline by the graph-slices workflow, with the monolith path kept only as a fallback and for full-graph/custom-scope selections.

  • #1751 0007474 Thanks @RhysSullivan! - Preview OpenAPI spec-format selections (Microsoft Graph) through the streaming structural-split path instead of a whole-document parse, and guard generic whole-document parses by parsed-tree size (line count for block YAML, text size for JSON). Previewing a Graph preset URL previously parsed the 43MB source whole and killed the 128MB Workers isolate mid-request, surfacing as an empty 503; it now streams within budget, and oversized generic specs fail with an actionable error instead of taking down the isolate.

  • Updated dependencies [9dff4e8, 55180cb]:

    • @executor-js/react@1.4.64
    • @executor-js/sdk@1.6.1
    • @executor-js/api@1.4.64
    • @executor-js/config@1.6.1

1.6.0

Patch Changes

  • #1660 c11bef2 Thanks @RhysSullivan! - Cloudflare ships as MCP-only, with code mode opted out

    The Cloudflare OpenAPI preset is gone from the default catalog; the MCP preset is the one Cloudflare entry. Its endpoint now pins ?codemode=false because Cloudflare's MCP server otherwise hides the tool catalog behind a single code-execution tool, and executor already provides the code-execution surface. Hand-entered mcp.cloudflare.com URLs missing the opt-out get an inline warning in the add flow telling the user to append ?codemode=false.

  • #1669 46cea2c Thanks @RhysSullivan! - Request Gmail's basic-settings scope alongside full mailbox access so Google integrations can create and manage Gmail filters without including domain-admin-only sharing settings.

  • Updated dependencies [a2d1417, 2bdbedf]:

    • @executor-js/sdk@1.6.0
    • @executor-js/react@1.4.63
    • @executor-js/api@1.4.63
    • @executor-js/config@1.6.0

1.5.42

Patch Changes

  • #1642 32206c7 Thanks @RhysSullivan! - Preserve an integration's selected OAuth consent scopes when refreshing converted API specifications, so Google Gmail refreshes do not restore operations that require broader scopes.

  • Updated dependencies [d3f0617]:

    • @executor-js/sdk@1.5.42
    • @executor-js/api@1.4.62
    • @executor-js/config@1.5.42
    • @executor-js/react@1.4.62

1.5.41

Patch Changes

  • Updated dependencies [d572658]:
    • @executor-js/sdk@1.5.41
    • @executor-js/api@1.4.61
    • @executor-js/config@1.5.41
    • @executor-js/react@1.4.61

1.5.40

Patch Changes

  • Updated dependencies [8ba64f6]:
    • @executor-js/sdk@1.5.40
    • @executor-js/api@1.4.60
    • @executor-js/config@1.5.40
    • @executor-js/react@1.4.60

1.5.39

Patch Changes

  • Updated dependencies [6c316c7]:
    • @executor-js/sdk@1.5.39
    • @executor-js/api@1.4.59
    • @executor-js/config@1.5.39
    • @executor-js/react@1.4.59

1.5.38

Patch Changes

  • #1428 df01d91 Thanks @saga-agent! - Use the versioned Google Photos raw upload endpoint so generated upload tools send media to /v1/uploads instead of the invalid /uploads path.

  • Updated dependencies [6a924dd, 1de85fc]:

    • @executor-js/sdk@1.5.38
    • @executor-js/react@1.4.58
    • @executor-js/api@1.4.58
    • @executor-js/config@1.5.38

1.5.37

Patch Changes

  • Updated dependencies [657b913]:
    • @executor-js/sdk@1.5.37
    • @executor-js/api@1.4.57
    • @executor-js/config@1.5.37
    • @executor-js/react@1.4.57

1.5.36

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.36
    • @executor-js/config@1.5.36
    • @executor-js/api@1.4.56
    • @executor-js/react@1.4.56

1.5.35

Patch Changes

  • Updated dependencies [1b9b1f1]:
    • @executor-js/sdk@1.5.35
    • @executor-js/api@1.4.55
    • @executor-js/config@1.5.35
    • @executor-js/react@1.4.55

1.5.34

Patch Changes

  • #1430 a86cc4e Thanks @RhysSullivan! - OpenAPI invocations now bound how long a buffered (non-streaming) response body may take to arrive. An upstream that returns headers quickly and then stalls the body previously hung the call indefinitely on runtimes without a platform subrequest limit; it now aborts after the response-body timeout (default 60s, configurable via invokeOptions.responseBodyTimeoutMs) with a distinct upstream_response_body_timeout failure.

  • #1427 7207347 Thanks @RhysSullivan! - Apply persisted RFC 6902 overrides to OpenAPI specifications during preview, import, and refresh so upstream documents can be corrected without maintaining a fork. Figma imports automatically narrow OAuth to the scopes supported by its OAuth app configuration.

  • #1426 171de20 Thanks @RhysSullivan! - Do not add unadvertised OpenID Connect identity scopes to OAuth authorization requests derived from OpenAPI specifications.

  • Updated dependencies [e2712db, 7207347, 0c4e9b4]:

    • @executor-js/sdk@1.5.34
    • @executor-js/api@1.4.54
    • @executor-js/config@1.5.34
    • @executor-js/react@1.4.54

1.5.33

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.33
    • @executor-js/config@1.5.33
    • @executor-js/api@1.4.53
    • @executor-js/react@1.4.53

1.5.32

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.32
    • @executor-js/config@1.5.32
    • @executor-js/api@1.4.52
    • @executor-js/react@1.4.52

1.5.31

Patch Changes

  • #1389 9e38928 Thanks @RhysSullivan! - Advertise NDJSON operation outputs as arrays. Endpoints declaring application/stream+json, application/x-ndjson, or application/jsonl responses (for example Vercel's runtime-logs) spec the schema of one line, but invocations return an array of parsed lines; describe previews now wrap the line schema in an array so generated code matches what actually comes back. Existing integrations with NDJSON operations are stale-marked once so their tool catalogs rebuild with the corrected schemas.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.31
    • @executor-js/config@1.5.31
    • @executor-js/api@1.4.51
    • @executor-js/react@1.4.51

1.5.30

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.30
    • @executor-js/config@1.5.30
    • @executor-js/api@1.4.50
    • @executor-js/react@1.4.50

1.5.29

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.29
    • @executor-js/config@1.5.29
    • @executor-js/api@1.4.49
    • @executor-js/react@1.4.49

1.5.28

Patch Changes

  • Updated dependencies [1c48182]:
    • @executor-js/sdk@1.5.28
    • @executor-js/api@1.4.48
    • @executor-js/config@1.5.28
    • @executor-js/react@1.4.48

1.5.27

Patch Changes

  • Updated dependencies [c7ab1e2]:
    • @executor-js/api@1.4.47
    • @executor-js/react@1.4.47
    • @executor-js/sdk@1.5.27
    • @executor-js/config@1.5.27

1.5.26

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.26
    • @executor-js/config@1.5.26
    • @executor-js/api@1.4.46
    • @executor-js/react@1.4.46

1.5.25

Patch Changes

  • #1213 dc9bf71 Thanks @RhysSullivan! - Allow a plain string body for octet-stream uploads again. Operations like Microsoft Graph's drive item content upload were rejecting string bodies with "request body must be bytes; provide bodyBase64", even though the request layer already sends a string through fine. String bodies now go through as UTF-8 bytes; binary content still uses bodyBase64.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.25
    • @executor-js/config@1.5.25
    • @executor-js/api@1.4.45
    • @executor-js/react@1.4.45

1.5.24

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.24
    • @executor-js/config@1.5.24
    • @executor-js/api@1.4.44
    • @executor-js/react@1.4.44

1.5.23

Patch Changes

  • Updated dependencies [29936d5, 29936d5]:
    • @executor-js/api@1.4.43
    • @executor-js/react@1.4.43
    • @executor-js/sdk@1.5.23
    • @executor-js/config@1.5.23

1.5.22

Patch Changes

  • #1137 1a1f9aa Thanks @zrm625! - Add a Google Photos preset with raw upload support and binary-safe bodyBase64 handling.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.22
    • @executor-js/config@1.5.22
    • @executor-js/api@1.4.42
    • @executor-js/react@1.4.42

1.5.21

Patch Changes

  • #1151 4b361b9 Thanks @RhysSullivan! - Derive separate credential inputs for OpenAPI auth strategies that require multiple API key headers.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.21
    • @executor-js/config@1.5.21
    • @executor-js/api@1.4.41
    • @executor-js/react@1.4.41

1.5.20

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.20
    • @executor-js/config@1.5.20
    • @executor-js/api@1.4.40
    • @executor-js/react@1.4.40

1.5.19

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.19
    • @executor-js/config@1.5.19
    • @executor-js/api@1.4.39
    • @executor-js/react@1.4.39

1.5.18

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.18
    • @executor-js/config@1.5.18
    • @executor-js/api@1.4.38
    • @executor-js/react@1.4.38

1.5.17

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.17
    • @executor-js/config@1.5.17
    • @executor-js/api@1.4.37
    • @executor-js/react@1.4.37

1.5.16

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.16
    • @executor-js/config@1.5.16
    • @executor-js/api@1.4.36
    • @executor-js/react@1.4.36

1.5.15

Patch Changes

  • Surface binary tool results as model-native file outputs across OpenAPI and upstream MCP integrations.

  • Updated dependencies []:

    • @executor-js/sdk@1.5.15
    • @executor-js/api@1.4.35
    • @executor-js/config@1.5.15
    • @executor-js/react@1.4.35

1.5.14

Patch Changes

  • Updated dependencies []:
    • @executor-js/sdk@1.5.14
    • @executor-js/config@1.5.14

Lines 1–500 of 630.