lael-labs/executor

.changeset/data-upgrade-paths.md+5−0

@@ -0,0 +1,5 @@
	1	---
	2	"executor": patch
	3	---
	4
	5	Fix local data upgrade paths for legacy OAuth connection backfills and OpenAPI inline credential rewrites.

.skills/cli-release/SKILL.md+3−1

@@ -26,7 +26,9 @@ Does not ship in the CLI: · 25 unmodified lines
26		26
27	- Prior convention in this repo uses `patch` bumps for feature-heavy releases (see `.changeset/executor-1.4.6-beta.md` for precedent). Don't push back on patch unless there are genuine SemVer-breaking API changes to a library consumer surface.	27	- Prior convention in this repo uses `patch` bumps for feature-heavy releases (see `.changeset/executor-1.4.6-beta.md` for precedent). Don't push back on patch unless there are genuine SemVer-breaking API changes to a library consumer surface.
28	- Breaking CLI UX changes (removed flags, changed argv shape) have historically still been `patch` bumps. Follow the owner's call — ask, don't assume `minor`.	28	- Breaking CLI UX changes (removed flags, changed argv shape) have historically still been `patch` bumps. Follow the owner's call — ask, don't assume `minor`.
29	- Only `apps/cli/package.json` version should move during Version Packages PRs. `@executor-js/*` library packages have their own publish path.	29	- Normal release/patch PRs must add a `.changeset/.md` file with frontmatter like `"executor": patch`. Do not* directly bump `apps/cli/package.json` or `bun.lock` in a feature/fix PR.
		30	- Only the Changesets-generated `Version Packages` PR should move `apps/cli/package.json`. If a normal PR directly changes that version, merging it to `main` can make `.github/workflows/release.yml` tag the commit and dispatch `publish-executor-package.yml`, causing an immediate CLI publish.
		31	- `@executor-js/*` library packages have their own publish path.
30		32
31	## Release notes: curated, not auto-generated	33	## Release notes: curated, not auto-generated
32		34

apps/cli/release-notes/next.md+2−0

@@ -50,6 +50,8 @@ Tool dispatch, plugins, storage, schema, and transport are now fully instrumente · 49 unmodified lines
50	- Per-scope blob and secret lookups now use a single `IN` query instead of N per-scope round-trips.	50	- Per-scope blob and secret lookups now use a single `IN` query instead of N per-scope round-trips.
51		51
52	## Fixes	52	## Fixes
		53	- Upgrade: preserve legacy OAuth connection backfills after the `connection.kind` column is removed.
		54	- OpenAPI: refreshing or editing sources with legacy inline secret/OAuth config now materializes the new source binding rows instead of dropping credentials.
53	- Keychain: skip provider registration when the OS backend is unreachable (no more startup failure when running headless on Linux without a keyring).	55	- Keychain: skip provider registration when the OS backend is unreachable (no more startup failure when running headless on Linux without a keyring).
54	- Local server: return 404 for missing static assets instead of serving HTML.	56	- Local server: return 404 for missing static assets instead of serving HTML.
55	- Tests: Windows compatibility across the suite.	57	- Tests: Windows compatibility across the suite.

apps/local/src/server/migrate-connections.test.ts+115−0

@@ -0,0 +1,115 @@
	1	import { afterEach, beforeEach, describe, expect, it } from "@effect/vitest";
	2	import { Database } from "bun:sqlite";
	3	import { migrate } from "drizzle-orm/bun-sqlite/migrator";
	4	import { drizzle } from "drizzle-orm/bun-sqlite";
	5	import { mkdtempSync, rmSync } from "node:fs";
	6	import { tmpdir } from "node:os";
	7	import { join } from "node:path";
	8
	9	import { migrateLegacyConnections } from "./migrate-connections";
	10
	11	let workDir: string;
	12
	13	beforeEach(() => {
	14	workDir = mkdtempSync(join(tmpdir(), "executor-migrate-connections-"));
	15	});
	16
	17	afterEach(() => {
	18	rmSync(workDir, { recursive: true, force: true });
	19	});
	20
	21	const columnNames = (db: Database, table: string): ReadonlyArray<string> =>
	22	(
	23	db.prepare(`PRAGMA table_info('${table}')`).all() as ReadonlyArray<{
	24	readonly name: string;
	25	}>
	26	).map((column) => column.name);
	27
	28	describe("migrateLegacyConnections", () => {
	29	it("backfills legacy MCP OAuth rows after connection.kind has been dropped", async () => {
	30	const db = new Database(join(workDir, "data.db"));
	31	migrate(drizzle(db), {
	32	migrationsFolder: join(import.meta.dirname, "../../drizzle"),
	33	});
	34
	35	expect(columnNames(db, "connection")).not.toContain("kind");
	36
	37	const now = Date.now();
	38	db.prepare(
	39	"INSERT INTO secret (scope_id, id, name, provider, created_at) VALUES (?, ?, ?, ?, ?)",
	40	).run("scope-1", "access-token", "Access token", "keychain", now);
	41	db.prepare(
	42	"INSERT INTO secret (scope_id, id, name, provider, created_at) VALUES (?, ?, ?, ?, ?)",
	43	).run("scope-1", "refresh-token", "Refresh token", "keychain", now);
	44	db.prepare(
	45	"INSERT INTO mcp_source (scope_id, id, name, config, created_at) VALUES (?, ?, ?, ?, ?)",
	46	).run(
	47	"scope-1",
	48	"remote-mcp",
	49	"Remote MCP",
	50	JSON.stringify({
	51	transport: "remote",
	52	endpoint: "https://example.com/mcp",
	53	auth: {
	54	kind: "oauth2",
	55	accessTokenSecretId: "access-token",
	56	refreshTokenSecretId: "refresh-token",
	57	tokenType: "Bearer",
	58	expiresAt: null,
	59	scope: "read",
	60	clientInformation: null,
	61	authorizationServerUrl: null,
	62	resourceMetadataUrl: null,
	63	},
	64	}),
	65	now,
	66	);
	67
	68	await migrateLegacyConnections(db);
	69
	70	const connection = db
	71	.prepare(
	72	"SELECT id, provider, access_token_secret_id, refresh_token_secret_id FROM connection WHERE scope_id = ?",
	73	)
	74	.get("scope-1") as
	75	\| {
	76	readonly id: string;
	77	readonly provider: string;
	78	readonly access_token_secret_id: string;
	79	readonly refresh_token_secret_id: string \| null;
	80	}
	81	\| undefined;
	82	expect(connection).toEqual({
	83	id: "mcp-oauth2-remote-mcp",
	84	provider: "mcp:oauth2",
	85	access_token_secret_id: "access-token",
	86	refresh_token_secret_id: "refresh-token",
	87	});
	88
	89	const source = db
	90	.prepare("SELECT config FROM mcp_source WHERE scope_id = ? AND id = ?")
	91	.get("scope-1", "remote-mcp") as { readonly config: string };
	92	expect(JSON.parse(source.config).auth).toEqual({
	93	kind: "oauth2",
	94	connectionId: "mcp-oauth2-remote-mcp",
	95	});
	96
	97	const ownedSecrets = db
	98	.prepare(
	99	"SELECT id, owned_by_connection_id FROM secret WHERE scope_id = ? ORDER BY id",
	100	)
	101	.all("scope-1");
	102	expect(ownedSecrets).toEqual([
	103	{
	104	id: "access-token",
	105	owned_by_connection_id: "mcp-oauth2-remote-mcp",
	106	},
	107	{
	108	id: "refresh-token",
	109	owned_by_connection_id: "mcp-oauth2-remote-mcp",
	110	},
	111	]);
	112
	113	db.close();
	114	});
	115	});

apps/local/src/server/migrate-connections.ts+29−11

   return row !== null && row !== undefined;
 };
+const columnExists = (sqlite: Database, table: string, column: string): boolean => {
+  const columns = sqlite
+    .prepare(`PRAGMA table_info('${table.replaceAll("'", "''")}')`)
+    .all() as ReadonlyArray<{ readonly name: string }>;
+  return columns.some((c) => c.name === column);
+};
 type SecretRow = { id: string; owned_by_connection_id: string | null };
 /** Shared: re-parent the pointed-to secret ids to the new connection,
     providerState: unknown;
   },
 ): void => {
-  const stmt = sqlite.prepare(
+  const hasKind = columnExists(sqlite, "connection", "kind");
-    `INSERT INTO connection (
+  const stmt = hasKind
-       id, scope_id, provider, kind, identity_label,
+    ? sqlite.prepare(
-       access_token_secret_id, refresh_token_secret_id,
+        `INSERT INTO connection (
-       expires_at, scope, provider_state,
+           id, scope_id, provider, kind, identity_label,
-       created_at, updated_at
+           access_token_secret_id, refresh_token_secret_id,
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+           expires_at, scope, provider_state,
-  );
+           created_at, updated_at
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+    : sqlite.prepare(
+        `INSERT INTO connection (
+           id, scope_id, provider, identity_label,
+           access_token_secret_id, refresh_token_secret_id,
+           expires_at, scope, provider_state,
+           created_at, updated_at
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      );
   const now = Date.now();
-  stmt.run(
+  const values = [
     params.id,
     params.scopeId,
     params.provider,
-    "user",
+    ...(hasKind ? ["user"] : []),
     params.identityLabel,
     params.accessTokenSecretId,
     params.refreshTokenSecretId,
     JSON.stringify(params.providerState),
     now,
     now,
-  );
+  ];
+  stmt.run(...values);
 };
 // ---------------------------------------------------------------------------

packages/plugins/openapi/src/sdk/plugin.ts+12−4

           name: existing.name,
           baseUrl: resolvedConfig.baseUrl,
           namespace: existing.namespace,
-          headers: existing.config.headers,
+          headers: existing.legacy?.headers ?? existing.config.headers,
-          oauth2: existing.config.oauth2,
+          oauth2: existing.legacy?.oauth2 ?? existing.config.oauth2,
         });
       });
               const existing = yield* ctx.storage.getSource(namespace, scope);
               if (!existing) return;
               const canonicalHeaders =
-                input.headers !== undefined ? canonicalizeHeaders(input.headers) : null;
+                input.headers !== undefined
+                  ? canonicalizeHeaders(input.headers)
+                  : existing.legacy?.headers
+                    ? canonicalizeHeaders(existing.legacy.headers)
+                    : null;
               const canonicalOAuth2 =
-                input.oauth2 !== undefined ? canonicalizeOAuth2(input.oauth2) : null;
+                input.oauth2 !== undefined
+                  ? canonicalizeOAuth2(input.oauth2)
+                  : existing.legacy?.oauth2
+                    ? canonicalizeOAuth2(existing.legacy.oauth2)
+                    : null;
               yield* ctx.storage.updateSourceMeta(namespace, scope, {
                 name: input.name?.trim() || undefined,
                 baseUrl: input.baseUrl,